A Perceptron based Classifier for Detecting Malicious Route Floods in Wireless Mesh Networks

Transcription

1 A Perceptron based Classfer for Detectng Malcous Route Floods n Wreless Mesh Networks Lakshm Santhanam*, Anndo Mukheree*, Ra Bhatnagar Ψ, and Dharma P. Agrawal* Department of ECECS, CDMC Lab, Unversty of Cncnnat, Cncnnat, OH, USA Ψ Department of ECECS, Machne Intellgence Lab, Unversty of Cncnnat, Cncnnat, OH, USA Emal: {santhal, mukherao, dpa}@ececs.uc.edu, rbhatnag@ececs.uc.edu Abstract Wreless Mesh Networks WMN) are evolvng as a new paradgm for broadband Internet, n whch a group of statc mesh routers employ multhop forwardng to provde wreless Internet connectvty. All routng protocols n WMNs navely assume nodes to be nonmalcous. But, the plug-n-and play archtecture of WMNs paves way for malcous users who could explot some loopholes of the underlyng routng protocol. A malcous node can nundate the network by conductng frequent route dscovery whch severely reduces the network throughput. In ths paper, we nvestgate the detecton of route floods by ncorporatng a machne learnng technque. We use a perceptron tranng model as a tool for ntruson detecton. We tran the perceptron model by feedng varous network statstcs and then use t as a classfer. We llustrate usng an expermental wreless network ns-2) that the proposed scheme can accurately detect route msbehavors wth a very low false postve rate. open wreless communcaton channel and the multhop nature of communcaton can pave way to malcous ntruders. A malcous ntruder can explot the hdden loopholes n the routng protocol [2], to conduct varous knds of attack such as route dsrupton attacks e.g. blackhole attack, selfsh node attack, malcous route flood, route table posonng, route loopng, modfcaton of route requests) and packet forwardng attacks e.g. selfsh node attack, Denal of Servce DoS) attack). Bhargava et al. [3] demonstrated that a false dstance vector and a false sequence number attack can drastcally reduce the network throughput by 75%. Buldng a secure routng protocol SEAD [4], Aradne [5]) s not a complete soluton to thwart attacks on the routng protocol, as MRs are often deployed n publc locatons lke rooftops, streetlghts, poles etc.) that are easly accessble to potental adversares. Keywords - Anomaly Detecton, AODV, Intruson Detecton System, Normalzaton, Perceptron, and Wreless Mesh Networks.. Introducton Wreless Mesh Networks WMNs) [] are becomng ncreasngly popular as they provde cheap and ubqutous broadband Internet access. WMNs consst of a group of statc mesh routers MRs) that are connected by wreless lnks. It obvates the need for extensve wred backhaul network by connectng only a small subset of MRs known as Internet Gateways IGWs)) to the wred backbone. Other MRs forward ther traffc n a multhop fashon towards the IGW. Fg. shows a typcal mesh network scenaro. Securty n WMNs s very much n ts nfancy and there are several ssues that reman to be addressed. The Fgure. Sample Wreless Mesh Network Scenaro In ths paper, we study the problem of detectng malcous nodes that mtates a normal node n all respects, except n performng unnecessary route dscoveres. These malcous nodes frequently ntate route dscovery to unknown destnatons wth ntent to flood the network wth route request packets. As t s dffcult to dstngush between a route dscovery ntated wth a malcous ntent and a legtmate route dscovery for reparng broken/stale routes, ths type of attack s hard to detect. Though, several broadcast management technques exsts that try to allevate *Ths work s has been supported by the Oho Board of Regents, Doctoral Enhancement Funds Proceedngs of the Internatonal Mult-Conference on Computng n the Global Informaton Technology ICCGI'7) /7 $ /7 $25. 27

2 redundant broadcasts [6]; they fal to address the problem of bogus broadcast packets. Deslva et al. [7] propose a statstcal method to mtgate malcous route floods; n whch when the generaton rate of a node exceeds a certan threshold, all the route requests of that node are dropped by ts neghbors. We however, detect the same based on the examnaton of the network. In order to detect malcous route floods n a WMN; we propose to deploy an Intruson Detecton System IDS) on every MR n the network. As WMNs don t suffer from power constrants, each MR can be made as a montorng agent. We propose an IDS based on a machne learnng technque called perceptron tranng. The IDS collects a set of statstcs on few route and data parameters such as RREQ Route Request), RREP Route reply), and RERR Route error), data packets orgnated, and data packets forwarded. The above lsted parameters are then fed to the perceptron model n order to learn the normal routng behavor and establsh a normal routng profle. Typcally, t s dffcult to udge a safe threshold value for the number of RREQs packets that can be generated by a MR n a WMN as t depends on several other network condtons lke lnk falure, stale route, network congeston, etc. Thus, we propose a threshold ndependent scheme called perceptron based IDS to detect malcous route flood attack. It adaptvely modfes the detecton model based on the tranng data and detects attack n the face of new data. The remander of the paper s organzed as follows: Secton 2 descrbes the related work. Secton 3 presents the varous loop holes n the route dscovery phase of Ad hoc On-Demand Vector AODV) routng protocol. We study the mpact of a malcous route flood attack through smple smulatons. Secton 4 delneates the archtecture of our perceptron based IDS. Secton 5 llustrates the effectveness of our proposed scheme through extensve smulatons. We fnally conclude the paper and present the future work n Secton Related Work Most of the tradtonal IDS, detect attack by processng audt trals for devatons from normal actvty anomaly detecton [8]) or by matchng typcal ntruson nstances msuse detecton [9]). The man drawback of msuse detecton s that, t cannot detect new attacks. On the other hand, an anomaly detector successfully detects unknown ntrusons also. But, f an attacker changes ts profle slowly, even well-known attacks reman undetected. Intellgent machne learnng technques lke perceptron, artfcal neural networks ANN), and decson trees can be used to tran the IDS accurately. ANN has nnumerable advantages n the detecton of ntrusons []. Zhang et al. [] propose to detect DoS attacks usng a hybrd ANN classfer based on perceptron and backpropagaton. It derves a statstcal smlarty decson vector between the observed profle and the establshed normal profle. As n the presence of a DoS attack the smlarty vector s very small, an alert s rased by the IDS. But, the detecton metrcs for a route floodng attack and DoS attack are dfferent. Hence, such a scheme s not sutable for detectng msbehavor n the routng protocol. Ghost et al. [2] employ a neural network to detect anomalous ntrusons on a software system Buffer overflow attack). Saterls et al. [3] employ a Mult-Layer Perceptron MLP) to detect Dstrbuted DoS attacks by montorng several passve flow statstcs. Thus, most of the works n the lterature focus on developng a IDS for detectng DoS attacks only and are unsutable for detectng route floods. We however, focus on the problem of detectng malcous route floods by usng the ntellgence provded by our perceptron model. Huang et al. [4] propose a cooperatve detecton system by electng Custer Heads CHs). The CHs apply smple rules to dentfy varous route attacks. As the CHs are elected randomly, there s a possblty that a malcous attacker can be elected as a CH whch would be detrmental to the network. We however, employ a dstrbuted approach to detect route attacks that also decreases the detecton tme when compared to [4]. 3. Malcous Route Flood & ts Impact In ths paper, we use an AODV routng protocol for our analyss. In ths secton, we explan the route dscovery phase n the AODV protocol and hghlght the vulnerabltes n t that can be exploted by an attacker. We then nvestgate the mpact of a malcous route flood attack on the network. 3. Vulnerabltes of AODV AODV s a reactve ad hoc routng protocol. A source node n AODV ntates a route dscovery to a destnaton only f ts route entry s unknown or old. It broadcasts a route request packet RREQ) requestng for a route to the requred destnaton. Ths s repeatedly re-broadcasted by other nodes untl t reaches the destnaton tself or an ntermedate node wth a fresh enough route. However, a malcous node can perodcally generate large number of false RREQ packets to non-exstent destnaton nodes so that t s repeatedly re-broadcasted tll the lfetme of the packet. Ths attack s known as a malcous route flood attack. Ths creates a deluge of packets whch drastcally affects the achevable throughput at the applcaton layer. If the network s saturated, a malcous floodng further aggravates the network performance [7]. An Proceedngs of the Internatonal Mult-Conference on Computng n the Global Informaton Technology ICCGI'7) /7 $2. 27

3 Instantaneous Throughput Kbps) Flow- Flow Tme Secs) Flow-2 45 Number of MAC Transmssons No attack 5 Under attack AODV UDP DATA Throughput Kbps) RREQ/sec RREQ/sec 2 RREQ/sec 5 RREQ/sec RREQ/sec Offered load Kbps) Fgure 2. Instantaneous throughput of flows durng attack Fgure 3. Average Number of Packets Transmtted by each MR Fgure 4. Throughput obtaned vs. offered load condtons attacker can ntensfy the effect of a malcous route flood by further manpulatng the protocol. Typcally, each RREQ packet s assocated wth an dentfcaton number ID) to prevent redundant broadcast. A malcous node can modfy the ID of a RREQ packet so that t always appears to be a fresh request to other nodes and s repeatedly re-broadcasted by them. A malcous route flood attack results n route nvason, packet droppng, and network congeston. 3.2 Impact of Malcous Route Flood In ths sub-secton, we study and llustrate the mpact of a malcous route flood attack n WMNs through smulatons n ns-2 [5]. We consder a smple IEEE 82.s based mesh network wth 49 MRs 7 x 7) deployed n a grd lke fashon n an area of 5 x 5 meters. We randomly attach 2-3 mesh clents to each of the MRs. One MR s elected as the IGW. The MRs communcate wth each other usng legacy IEEE 82. based nterfaces. We start flows from few mesh clents attached to MRs). We ntate 3 UDP flows, sendng traffc at a constant rate of 2 Kbps. We use a constant packet sze of 52 bytes. We use IEEE 82. as the channel arbtraton protocol. The transmsson range and the channel capacty are set to 25 meters and Mbps respectvely. AODV s used as the routng protocol. The total smulaton tme s set to 5 seconds. Each smulaton s repeated wth dfferent traffc profles contanng randomly chosen traffc sources. We randomly choose one MR as malcous, whch perodcally generates every second) large number of RREQ packets to arbtrarly chosen unknown destnatons. We consder the case when all MRs are backlogged wth traffc. Fg. 2 shows the effect of a malcous route flood RREQ/ sec) on the nstantaneous throughput of flows at the IGW all flows not shown for clarty), under a randomly chosen traffc profle. We see that whle the throughput of flow-3 s affected by a small percentage 45%) only, the throughput of flow- and flow-2 are drastcally reduced by 99% n the presence of a malcous route flood attack. Fg. 3 llustrates the average number of packets transmtted at each MR n the presence and the absence of a malcous route flood attack. It can be seen from Fg. 3 that durng an attack, the average number of RREQs packets receved at each MR s abnormally hgh 22), whle the average number of data packets transmtted by each MR s cut down from 8 to 529. Ths s because; control packets are gven hgher prorty over data packets to prevent lnk breakages. We next study the effect of a malcous MR generatng RREQs at dfferent rates - RREQs /sec), for dfferent offered load. We clearly see from Fg. 4 that as the generaton rate of malcous requests ncreases, the aggregate throughput of flows drastcally decreases. Thus, a malcous route flood attack s a serous threat. 4. Perceptron based IDS In ths secton, we present the applcaton of a machne learnng technque called perceptron n IDS. We frst present the hgh level archtecture and then dscuss the confguraton of our perceptron based classfer. 4. System Archtecture An IDS s deployed at every MR n the WMN. The archtecture of the proposed IDS s shown n Fg. 5. Fgure 5. Archtecture of perceptron based IDS Proceedngs of the Internatonal Mult-Conference on Computng n the Global Informaton Technology ICCGI'7) /7 $2. 27

4 It conssts of the followng components: Packet Montor & Feature Extractor Packet montor at every MR ntercepts the ncomng traffc and passes t to the feature extractor. Feature selecton plays an mportant role n determnng the accuracy of any classfer. The feature extractor gathers a set of statstcs for each of ts neghbors N where N represents the set of neghbors of a node N ). A sample snapshot of the features collected s shown n Table.. For broadcast packets lke RREQ, we mantan only the number of packets sent by a node s neghbor. But, for uncast packets lke RREP, we gather two statstcs.e., the number of packets sent by node s neghbor wth destnaton as the node tself and wth destnaton as some other node; the latter beng collected by lstenng n promscuous mode. Table. Sample snapshot of nodal table # RREQ sent N to # RERR sent N to # RREP sent N to # Packets orgnated N to N ) # Packets forwarded N to N ) N ) N ) N ) number of route request packets Number of route error packets number of route reply packets number of data packets orgnated wth source address as self number of data packets forwarded wth source address as self Anomaly Detector It conssts of the traned perceptron model. The montored network statstcs s fed as nput to the perceptron classfer, whch gves a bnary output t). A postve output s ndcatve of a normal condton and a negatve output s ndcatve of an attack. When an attack s detected, an alert s ssued by the alert module to block the ntrusve actvty and a report s lodged n the ntrusve log. Known Attack Profle The tranng data for the perceptron model s generated by conductng expermental smulatons usng ns-2 [5]. The known attack s grafted nto the smulaton and the accumulated network statstcs gathered durng ths perod are labeled as attack nstances. 4.2 Perceptron Tranng Algorthm We model the detecton of malcous flood attack as a typcal classfcaton problem. Perceptron s used as a classfer to assess the network status based on the montored network actvty. Perceptron s the smplest form of a lnear classfer [6]. The confguraton of a lnear perceptron s shown n Fg. 6. As seen n Fg. 6, a perceptron accepts a lnear combnaton of real-valued nputs; and outputs, f the result s greater than a certan threshold and outputs -, otherwse. For a gven set of n nputs x, x 2,, x n, the output s, o x, x,..., x )={ f w w x + w x w x n 2 n n > - otherwse}, ) where each w denotes the contrbuton of each nput x to the perceptron output. Here, w denotes the threshold that the lnear combnaton of nputs must surpass for an output of. For smplfcaton, we augment an addtonal unty constant x = to the orgnal nput vector so that the above equaton can be rewrtten n a smpler form as, n o x, x,..., x ) = { f w > ; else - 2) 2 n = Fgure 6. Lnear Perceptron Model The perceptron tranng algorthm nvolves the evoluton of the weght vector w, whch would correctly classfy all the nstances presented to t n the tranng stage. We nput a feature vector of route and data parameters to the perceptron along wth the label ω orω 2 ), whch represents the class of the nstance where ω represents a normal nstance and ω2 represents an attack nstance). We begn the tranng wth some random assgnment of weghts. When the perceptron msclassfes an example, the weghts are actvely adapted accordng to the followng perceptron tranng rule, w x = w + η x f w x and x ω, and w = w η x f w x and x ω2, 3) where η s the learnng rate of the algorthm whch moderates the extent to whch weghts are changed. We set η to a small value of.2. Thus, N tranng examples consstng of normal and attack nstances are presented to the algorthm teratvely. The algorthm s repeated untl all the examples are correctly classfed. Proceedngs of the Internatonal Mult-Conference on Computng n the Global Informaton Technology ICCGI'7) /7 $2. 27

5 Cluster 2 Slhouette Value True Postve R ate Tranng Sample Sze True Postve Rate False Postve Rate Fgure 7. Lnearly separable tranng data Fgure 8. Effect of tranng sample sze on true postve rate Fgure 9. ROC Curve It s mportant to note that a perceptron can be appled for lnearly separable data ponts only. To hghlght the fact that the attack nstances and the normal nstances are lnearly separable n the space of detecton metrcs, we tested the data by performng k-means clusterng test [6]. We see from the slhouette plot MATLAB) n Fg. 7, that our tranng sample s perfectly classfed nto two clusters attack and non-attack nstances). 5. Performance analyss In ths secton, we study the performance of our proposed perceptron based IDS usng smulatons performed n ns-2 [5]. We use the same scenaro and attack confguraton as descrbed n Secton 3. Each smulaton s run for 6 seconds. We generate a sample sze of 33,5 feature ponts, comprsng of 5 % of attack nstances and 5 % of normal nstances. The tranng perod s set for 5 epochs so that the weghts of the perceptron model converge for sure. We use about 5 % of the generated data for our tranng model and the other half s used later for testng and valdaton purposes. We evaluate the network performance based on the followng detecton metrcs: True postves TP): Number of tmes an alert s rased, when an attack s present. False negatves FN): Number of tmes when no alert s rased, but attack s present. False postves FP): Number of tmes when alert s rased, but attack s not present. True negatves TN): Number of tmes when no alert s rased, when no attack s present. The performance of our classfcaton algorthm s thus based on TPR True postve rate) and FPR False postve rate). TPR = TP, whch s the rato of TP + FN number of alerts when there s an attack to total number of attacks. Smlarly, FPR = FP. TN + FP We llustrate the detecton accuracy TPR) of the traned perceptron model for varous szes of tranng sample n Fg. 8. We fnd that the accuracy of the model s less for a small sample sze. The model acheves best results for a tranng sze of 4-8 nstances. We next study the Recever Operatng Characterstcs ROC) curve TPR vs. FPR) whch reflects the tradeoffs n the senstvty of the detecton algorthm. Fg. 9 shows the ROC curve for our detecton scheme. We observe that n our scheme very less number of normal nstances are msclassfed as anomales as seen by FPR value) and all attack nstances are correctly dentfed as ntrusons as seen by the hgh TPR value close to ). Table. 2 summerzes the msclassfcaton rate of our traned algorthm for dfferent generaton rate of RREQs by a sngle malcous MR. Msclassfcaton rate s defned as the percentage of nputs msclassfed durng one tranng epoch nclude FP and FN). Table 2. Msclassfcaton rates of perceptron Bogus RREQ generaton rate Msclassfcaton rate RREQ/sec.98 % 5 RREQ/sec.988 % RREQ/sec.9995 % Fg. demonstrates the detecton ablty of our system when the number of malcous MRs generatng malcous requests s ncreased. Even f only a small percentage of the MRs are malcous, we see that our perceptron based IDS accurately detects them wth a hgh TPR of 98% and has close to % detecton rate for largely compromsed network. Ths s because for a hgh attack rate, the data s easly separable n the space of detecton metrcs and s thus easly classfable by the perceptron model. Smlarly, Fg. shows the FPR for varyng number of good MRs. A large number of good MRs mply very few MRs are compromsed. It can be seen that the maxmum value of FPR s wthn 23%, for a largely compromsed WMN. We also see that as the attack rate ncreases, the FPR ncreases ndcatng that a Proceedngs of the Internatonal Mult-Conference on Computng n the Global Informaton Technology ICCGI'7) /7 $2. 27

6 True Postve Rates RREQ 2 RREQ 5 RREQ RREQ Number of Msbehavng MRs False Postve Rate RREQ 2 RREQ 5 RREQ RREQ Number of Well Behavng MRs True Postve Rat Learnng Rate Fgure. TPR under varyng number of msbehavng MRs Fgure. FPR under varyng number of well behavng MRs Fgure 2. Effect of learnng threshold on the detecton rate small percentage of false alarms would be rased from tme-to-tme. Both graphs prove that the proposed perceptron based IDS has a very hgh TPR %) and a low FPR 23%). The proposed IDS, thus detects malcous route dscoveres accurately and effcently. It also llustrates the fact that the features detecton metrcs) selected as nputs for tranng the perceptron model, are accurate predctors of the attack. We next study the effect of learnng rate η ) on the detecton rate of our proposed IDS. It s mportant to choose a small value for the perceptron to correctly classfy the data wth a low FPR and a hgh TPR. We see from Fg. 2, that a lower learnng rate has a hgher detecton rate over hgher learnng rate. Hence, we choose an deal learnng rate of.2 for our model. 6. Concluson and future work In ths paper, we propose to use an ntellgent machne learnng technque based on lnear perceptron classfer to detect malcous route dscoveres. We model the detecton of malcous route flood as a classfcaton problem. As malcous route flood attack has a global effect at every MR n the WMN, the IDS rases a tmely alert on the occurrence of the attack. We prove through extensve smulatons, that our perceptron based IDS model has a hgh detecton rate and a low false postve rate. As a part of our future work, we plan to use other machne learnng technques lke mult-layer perceptron model to detect attacks lke selfsh node and blackhole attack, whch fal to get classfed by a lnear perceptron model. 7. References [] N. Nandrau, D. Nandrau, L. Santhanam, B. He, J. Wang, and D. P. Agrawal, Wreless mesh networks: current challenges and future drectons of web-n-thesky, To appear n IEEE Communcaton Magazne. [2] P. Nng and K. Sun, How to msuse AODV: a case study of nsder attacks aganst moble ad-hoc routng protocols, Ad Hoc Networks, 36), pp , 25. [3] B. Bhargava, W. Wang, and Y. Lu, On vulnerablty and protecton of ad hoc on-demand dstance vector prototol, In the Proc. of Internatonal Conference on Telecommuncaton, 23. [4] Y. Hu, D. B. Johnson, and A. Perrg, SEAD: secure effcent dstance vector routng for moble wreless ad hoc networks, Ad Hoc Networks, pp , 23. [5] Y. Hu, A. Perrg, and D. B. Johnson, Aradne: a secure on-demand routng protocol for ad hoc networks, In the Proc. of ACM Mobcom, pp. 2-23, 22. [6] S.-Y. N, Y. C. Tseng, Y. Shyan, and J.-P. Sheu, The broadccast storm problem n a moble ad hoc networks, In the Proc. of IEEE MCN, pp , 999. [7] S. Deslva and R. V. Boppana, Mtgatng malcous control packets floods n ad hoc networks, In the Proc. of IEEE WCNC, Vol.4, pp , 25. [8] A. Valdes and D. Anderson, Statstcal methods for computer usage anomaly detecton usng NIDES, Techncal report, SRI Internatonal, January 995. [9] W. Lee, S. J. Stolfo, and K. W. Mok, A data mnng framework for buldng ntruson detecton models, In the Proc. of IEEE Symposum of Securty and Prvacy, pp. 2-32,999. [] J. Cannady, Artfcal neural networks for msuse detecton, In the Proc. NISSC, pp , 998. [] Z. Zhang, J. L, C. N. Mankopoulos, J. Jorgenson, and J. Ucles, HIDE: A herarchal network ntruson detecton system usng statstcal preprocessng and neural network classfcaton, In the Proc. of Workshop on Informaton Assurance and Securty, pp. 85-9, 2. [2] A. K. Ghosh, J. Wanken, and F. Charron, Detectng anomalous and unknown ntrusons aganst programs, In the Proc. of Computer Securty Applcatons Conference, pp , 998. [3] C. Saterls and V. Maglars, Detectng ncomng and outgong DDoS attacks at the edge usng a sngle set of network characterstcs, In the Proc. of th IEEE Intl. Symposum on Computers and Communcaton Systems, pp , 25. [4] Y.-A. Huang and W. Lee, A cooperatve ntruson detecton system for ad hoc networks, In the Proc. of st ACM Workshop on Ad hoc and Sensor Networks, pp , 23. [5] Network Smulator NS-2), [6] S. Theodords and K. Koutroumbas, Pattern Recognton, 3 rd Edton, Academc Press, 997 Proceedngs of the Internatonal Mult-Conference on Computng n the Global Informaton Technology ICCGI'7) /7 $2. 27