An Analytical Approach to Real-Time Misbehavior Detection in IEEE Based Wireless Networks

Transcription

1 Tis paper was presented as part of te main tecnical program at IEEE INFOCOM 20 An Analytical Approac to Real-Time Misbeavior Detection in IEEE 802. Based Wireless Networks Jin Tang, Yu Ceng Electrical and Computer Engineering Illinois Institute of Tecnology {jtang9, Weiua Zuang Electrical and Computer Engineering University of Waterloo Abstract Te distributed nature of te CSMA/CA based wireless protocols, e.g., te IEEE 802. distributed coordinated function (DCF), allows malicious nodes to deliberately manipulate teir backoff parameters and tus unfairly gain a large sare of te network trougput. Te non-parametric cumulative sum (CUSUM) test is a promising metod for real-time misbeavior detection due to its ability to quickly find abrupt canges in a process witout any aprioriknowledge of te statistics of te cange occurrences. Wile most of te existing scemes for selfis beavior detection depend on euristic parameter configuration and experimental performance evaluation, we develop a Markov cain based analytical model to systematically study te CUSUM based sceme for real-time detection of te backoff misbeavior. Based on te analytical model, we can quantitatively compute te system configuration parameters for guaranteed performance in terms of average false positive rate, average detection delay and missed detection ratio under a detection delay constraint. Moreover, we find tat te sort-term fairness issue of te 802. DCF impacts te transition probabilities of te Markov model and tus te detection accuracy. We develop a suffle sceme to mitigate te sort-term fairness impact on te sample series, and investigate te proper suffle period (in terms of observation windows) tat can maintain te randomness in eac node s backoff beavior wile resolving te sort-term fairness issue. We present simulation results to confirm te accuracy of our teoretical analysis as well as demonstrate te performance of te developed real-time detection sceme. I. INTRODUCTION Te IEEE 802. based wireless networks ave been widely deployed over recent years due to teir ig-speed access, easy-to-use features and economical advantages. To resolve te contention issue among te multiple participating nodes, 802. employs te carrier sense multiple access/collision avoidance (CSMA/CA) protocol to ensure tat eac node gets a reasonably fair sare of te network. Tis is particularly te case for te distributed cooperation function (DCF) of 802., were every node accesses te network in a cooperative manner and randomly delays transmissions to avoid collisions by following a common backoff rule [ [3. However, in suc a distributed environment witout a centralized controller, a malicious node may deliberately coose a smaller backoff timer and gain an unfair sare of te network trougput at te expenses of oter normal nodes cannel access opportunities. Moreover, only to make tings worse, te easily available programmable and reconfigurable wireless network devices Tis work was supported in part by NSF grant CNS nowadays [4, [5 make te backoff misbeavior muc more feasible. In tis paper, we propose an analytical approac for real-time detection of te backoff misbeavior. An efficient detection sceme needs to address te two main correlated callenges: ) unknown misbeavior strategy, 2) real-time detection of te misbeavior. For te first callenge, since a malicious node can first beave as a normal node and ten manipulate its backoff timer to a random small value at any time, we ave no way to know te misbeavior strategy apriori. For te second, te misbeavior needs to be detected in real-time and we can ten isolate te malicious node to prevent it from bringing more arm to te network as soon as possible. Te existing solutions eiter can not address bot issues at te same time [5 [9, or require modifications to te 802. protocols [0, [. Considering te callenges, in our very recent work [2, we develop a detection sceme based on te non-parametric cumulative sum (CUSUM) test [3 wic can quickly find abrupt canges in a process witout any prior knowledge of te statistical model of te cange occurrences. In [2, we also propose a new observation metod to get samples for testing, wic directly counts te number of successful transmissions from a tagged node to facilitate te real-time detection. Also, our detection sceme does not require any modification to te protocols. Tus it can be implemented by any node assuming te role of te detection agent tat monitors te network. A significant open researc issue regarding te selfis beavior detection is tat most of te existing detection scemes depend on euristic parameter configuration and experimental performance evaluation. Suc a euristic approac largely limits te flexibility and robustness of te detection sceme; a cange of te operation context could trigger te retraining of te configuration parameters by experimenting over a large set of data traces and te performance under tose euristic parameters is not teoretically provable. In tis paper, we develop an analytical model for te CUSUM based detection sceme, wic can provide quantitative performance analysis and teoretical guidance on system parameter configuration. Specifically, we use a discrete-time Markov cain to model te beavior of te CUSUM detector, because te detector s value in an observation window only depends on its value in te previous window and te observation samples in te current window. To determine te transition //$ IEEE 638

2 probabilities of te Markov cain, we take te popular modeling tecnique [ tat eac node independently accesses an idle cannel for transmission wit a probability determined by its contention window size. Tis Markov cain based model enables us to conduct rigorous quantitative analysis of te detection sceme on tree fundamental metrics: average false positive rate, average detection delay, and missed detection ratio, and furter compute te system configuration for guaranteed performance. In particular, te Markov cain modeling te CUSUM detector takes different transition probabilities under te normal traffic condition and under te abnormal condition wit misbeaving nodes present, respectively. Te Markov cain obtained from te normal traffic condition can be used to directly calculate te average false positive rate and also provide te initial states for misbeavior analysis. Based on tese initial states, we can ten use te Markov cain under te abnormal conditions to analyze te average detection delay and te missed detection ratio. Note tat te missed detection ratio is not often considered in te context of CUSUM test due to its non-stop until detection property. In tis paper, we examine a missed detection ratio under a detection delay constraint, wic is of importance regarding real-time detection. To ensure te accuracy of our analytical model, we must take te well-known sort-term fairness issue regarding te 802. DCF [4 into account. Te sort-term fairness issue is inerent to te 802. backoff mecanism, by wic a successful node will ave advantages in grabbing te cannel for next few transmissions in a sort period. Suc an issue implies correlations among te cannel accesses, wic impact te accuracy of te transition probability calculation based on te assumption of independent cannel access. Te system configuration based on an inaccurate model will furter lead to inaccurate detection results. In order to address te sort-term fairness issue, we enance te detection sceme by applying a suffle strategy to te observation samples to mitigate te correlations among neigboring observations. Specifically, a sample value of te number of successful transmissions of te tagged node is calculated as te mean value over a few observation windows. Moreover, we also investigate ow to find a proper value for te suffle period (in terms of observation windows). A too sort suffle period could not effectively remove te sort-term fairness, wile a too long period will average out te randomness in te 802. backoff beavior. We would like to empasize tat te suffle sceme will not impact te detection delay, wic only requires a few normal observation samples to fill te observation windows in te suffle period wen te system turns up and ten works in a sliding window manner for detection. In summary, te main contributions of te paper come in four aspects: ) We develop a discrete-time Markov cain model to caracterize te CUSUM based detection system for te backoff misbeavior. 2) We utilize te model to guide te detection system configuration based on teoretical analysis for guaranteed performance. 3) We apply a suffle strategy to resolve te impact of te 802. sort-term fairness issue on te analysis and detection accuracy. 4) We provide simulation results to confirm te accuracy of our teoretical analysis and demonstrate te performance of te developed detection sceme. Te rest of te paper is organized as follows. Section II reviews more related work. Section III describes te system model. In Section IV, we present te detection sceme design wit te enancement of te suffle strategy. Section V develops te Markov cain based analytical model, and Section VI gives te teoretical performance analysis based on te Markov cain model. Section VII presents te simulation results, and Section VIII concludes te paper. II. RELATED WORK Te problem of detecting backoff misbeavior over 802. based wireless networks as been studied in various scenarios and under several matematical frameworks in te literature. In [0, [, te autors presented a modification to te 802. protocol to facilitate te misbeavior detection. In teir sceme, te receiver assigns a backoff timer for te sender. If te number of idle slots between consecutive transmissions from te sender does not comply wit te assigned backoff timer, te receiver will consider tat te sender potentially deviates from te protocol and penalize te sender wit a smaller backoff timer. Continuous deviations will result in tat te receiver labels te sender as a selfis node. However, te above sceme assumes a trustworty receiver wic performs te detection, wic may not be te case in a dynamic network environment. Modification to te 802. protocol and reliance on te receiver are te main limitations of te work. Anoter approac to deal wit te backoff misbeavior is to develop protocols based on te game-teoretic tecniques, by imposing adequate costs on network operations [5 [7. Te goal is to encourage all te nodes to reac a Nas equilibrium. As a result, a malicious node is not able to gain an unfair sare compared to well-beaved nodes and are tus discouraged from te misbeavior. However, tis category of approaces assume tat all te nodes are willing to deviate from te protocol wen necessary, and performance of te network may converge to a suboptimal operation point. Moreover, modifications to te standard protocols are also required. A euristic sequence of conditions are proposed in [8, [9 to test multiple misbeavior options in te 802. protocol based on simple numerical comparisons. Te detection algoritm estimates te average values of te option parameters and raises alarms wen te cumulative effect of te misbeavior exceeds a tresold. Tis approac, named DOMINO, preserves its advantage of simplicity and easiness of implementation, and still demonstrates its efficiency wen dealing wit a wide range of 802. MAC misbeavior. However, te specific conditions limit its applications to certain protocols. Te sequential probability ratio test (SPRT) metod is used in [7 [9 to detect te 802. backoff misbeavior. Te detection decision is made wen a random walk of te likeliood ratio of observations (given two ypoteses) rises greater tan an upper tresold. Te main advantage of SPRT 639

3 is tat it can reac decision very fast, given te complete knowledge of bot normal beavior and backoff misbeavior strategy [20. However, in a realistic setting, te strategy of malicious nodes is ard to know in advance; suc an issue imposes te major inerent limitation of te SPRT metod. Furter, te existing work normally assumes tat te backoff timer of eac node is observable, wic is again ard to acieve in practice because te transmission attempts involved in a collision are impossible to be distinguised. Tus in our detection we monitor te successful transmission of te tagged node as te observation measurement. Te autors in [5, [6 utilize te Kolmogorov-Smirnov (K- S) significance test to address te detection problem assuming an aprioriknown misbeavior strategy model. Tis test is able to make te decision by comparing te distribution of sampled traffic data wit te normal-beavior distribution estimated online. Noneteless, as a batc test metod, te K-S statistic as its own drawback. Fixed-size data samples are needed to perform te test eac time, wic actually makes realtime detection impossible. Even in te modified sequential truncated K-S test, a stage number N [5 still needs to be predetermined before test starts in order to get a proper significant level for eac test step. In our very recent work [2, we propose to adopt te non-parametric CUSUM cange point test [3 for te backoff misbeavior detection, wic as te advantages of bot real-time detection and no requirement of aprioriknowledge of te misbeavior strategy. However, a common issue among most of te existing scemes for misbeavior detection is teir dependency on euristic parameter configuration and experimental performance evaluation, wic largely limits te flexibility and robustness of te scemes. III. SYSTEM MODEL In tis section we provide a brief description of te IEEE 802. DCF and ow a malicious node can utilize te vulnerability of te DCF to gain advantages over oter normal nodes troug backoff misbeavior. A. IEEE 802. DCF Tere are two major functions in te IEEE 802. protocols: te point coordination function (PCF) and te distributed coordination function (DCF). Te PCF is a centralized function and is an optional feature in In tis paper, our concentration is te more widely used DCF wic operates in a distributed manner. In te DCF, every node contends for access to te wireless medium following te CSMA/CA function [. Wen a node attempts to transmit a packet, it needs to sense te medium idle for a specified time. Te time is divided into slots, and a node can only transmit at te beginning of a slot time. If te medium is not idle, te node will enter a backoff stage and defer te transmission according to a timer before attempting te next transmission. Tis backoff timer is a random value uniformly selected from a set {0,,..., CW min }, were CW min is called te minimum contention window wit a standard value of 32. Te timer will decrease if te medium is continuously sensed idle and freeze wenever te medium is sensed busy. After te timer reaces 0 te node will attempt anoter transmission. Eac unsuccessful transmission due to reasons suc as collisions or lost of ACK messages from te reception node will result in a doubled contention window size until it reaces te maximum contention window CW max =2 m CW min, were m is called te maximum backoff stage wit a standard value of 5. Tis operation is also referred to as te binary exponential backoff sceme. After a successful transmission, te node will reset te contention window to te minimum value CW min and continue sensing te medium if it as more packets to transmit. B. Backoff Misbeavior in IEEE 802. DCF A malicious node does not need to misbeave if no one else is contending for te network access wit it and te effect of te misbeavior may be ignorable. Terefore we assume tat te 802. wireless network works in te saturated condition, were every participating node always as packets to transmit. As a distributed contention based protocol, te DCF assumes tat every node in te network operates in accordance wit te protocol rules as described above to obtain a fair sare of te wireless medium. However, a node wic as te smallest backoff timer will obviously be favored by te protocol as it can always obtain more cances to transmit wile oter nodes are still in te backoff stage. Since tere is no central controlling unit wic assigns te backoff timer for eac node, a malicious node can continuously coose a small backoff timer and ten gain significant advantages in cannel access probability over oters. Moreover, because te increased transmission probability of te malicious node causes more collisions, normal nodes are forced to furter exponentially defer teir transmissions as tey operate according to te protocol, wic results in te malicious node gaining more advantages. Te backoff misbeavior can drastically decrease te transmission probability of normal nodes and subsequently severely downgrade teir trougput. In some extreme case were a malicious node sets its own backoff timer to a very small constant value, it will lead to denial of service (DoS) of te wole network except for te malicious node itself. Tus, a detection sceme capable of quickly and accurately identifying te misbeaving malicious node is igly desired for te normal operation of an IEEE 802. wireless network. IV. DETECTION SCHEME DESIGN In tis section, we describe te CUSUM based backoff misbeavior detection sceme design, enanced wit a suffle mecanism to mitigate te sort-term fairness impact. A. Te Observation Measure Consider a tagged node v. In our detection system, te observation measure is te number of successful transmissions of te tagged node v, denoted as M v,ineverym successful transmissions over te wole network. Under te 802. DCF, M n is a random variable. We take te popular modeling tecnique [ tat eac node independently accesses an idle 640

4 cannel for transmission wit a probability determined by its contention window size. If we use qs v to denote te probability tat a successful transmission over te network is from node v, we could ave te binomial distribution of M v as P {M v = k} = ( M k ) (q v s ) k ( q v s ) M k. () In a normal situation tat every node uses te same contention window size and follows te 802. DCF model, it can be seen tat qs v = N under te independent cannel access assumption and fair cannel saring, given N nodes in te network. If node v is a malicious node taking a smaller contention window size, it will acieve a qs v larger tan N and tus a larger portion of te network trougput. In Section V, we will present ow to calculate qs v given te contention window size. Te distribution of M v in () is te basis to establis our analytical model. B. Suffle Strategy Te sort-term fairness issue is inerent to te 802. backoff mecanism by wic a node tat as just accomplised a successful transmission will ave advantages in grabbing te cannel for next transmission in a sort period [4. Suc an issue implies correlations among te cannel accesses, wic impact te accuracy of () to model te successful transmissions of te tagged node based on te assumption of independent cannel access, and will in turn impact te accuracy of te analytical model later. Intuitively, if we always assume a fair cannel saring for te normal condition, te sort-term fairness issue poses significant difficulties in distinguising between te backoff misbeavior of a malicious node and te sort-term monopolization of a normal node, wic may result in significant false positives for a detection sceme. Directly computing te distribution of M v under te sortterm fairness impact is difficult. A possible approac to adapt to te sort-term fairness issue is to measure te distribution from te training data. However, tis approac requires an excessive number of experiments to ave compreensive training data sets for different traffic conditions and tus lacks te flexibility. We owever coose to apply a suffle strategy to te observation samples to mitigate te sort-term fairness issue. Rater tan directly using te observation measure in te current observation window, we average te observation measures over I windows, termed as suffling wit a period v of I. Let M n denote te raw observation witout suffling at window n, and Mn v te suffled observation. We apply a sliding window mecanism for suffling as I Mn v = M I n i. v (2) i=0 We expect tat different nodes may take sort-term advantages in different observation windows; suc a suffling average could dilute te correlations in eac window. Wit te sortterm fairness impact mitigated by te suffle mecanism, te binomial distribution in () can still be applied. Te value of te suffle period I needs to be properly selected. A too sort I could not effectively remove te correlations among observation measures, wereas a too long I will average out te random operation of te 802. backoff mecanism. We will resort to simulations to sow tat an optimal I does exist resulting in accurate analytical results based on (). C. CUSUM Based Detection Considering te callenges on real-time detection of te unpredictable backoff misbeavior, we design our detection sceme based on te non-parametric CUSUM test [3 due to its robust ability to quickly find abrupt canges in a process witout any prior knowledge of te statistical model of te cange occurrences. For convenience, let {M n,n =0,,...} be te sequence of te number of successful transmissions of te tagged node in eac observation window and u be te upper bound of te expectation of M n. Here, we drop te superscript of v for easier presentation considering te clear context. We ten ave te CUSUM test statistic X n =(X n +(M n u)) + X =0 (3) were (x) + = x if x 0 or 0 oterwise. Note tat if te tagged node acts normal, X n will stay around 0 no matter ow long te normal beavior as been observed. However, wen te node turns to misbeave, X n will quickly accumulate to a large positive. Let be te detection tresold, ten te decision rule of te test in step n is { if Xn δ n = (4) 0 if X n < were δ n is also an indicator function of weter te detection event appens or not. Te detector value X n will be reset back to 0 as soon as it exceeds te tresold and te detection procedure starts over again. V. MARKOV CHAIN BASED MODEL Consider te sequence {X n } as a discrete random process, wic takes values from a finite set A = {0,, 2,..., }. Te process is said to be in state j at time n if X n = j and in state i at time n if X n = i, were i, j A. Te transition between te states appens at te end of every observation window M. According to (3), te current state X n depends only on te state X n and is independent of any oter previous states, were te transition probability is P ij = P {X n = j X n = i}. (5) Tus te random process {X n } satisfies te Markov property and can be modeled as a discrete-time Markov cain. Given te decision tresold, te Markov cain is ten described by a ( +) ( +) transition probability matrix 64

5 as P 00 P 0 P P 0 P 0 P P 2... P P = P 0 P P 2... P Tis transition probability matrix can be divided into four distinct groups based on te operation of te CUSUM detector. Group consists of P ij for i [0, and j =0, wit values { P {Mn (u i)} if u i 0 P i0 = (6) 0 oterwise Tis group is related to te transitions to state 0. According to (3), te state X n is always reset to 0 from i wen i+m n u 0. Tus te transition probability is P {M n (u i)} as sown in (6). Note tat it is impossible to reac state 0 wen u i<0 due to nonnegative value of M n. Group 2 consists of P ij for i [0, and j [,, wit values { P {Mn =(j i + u)} if j i + u 0 P ij = (7) 0 oterwise Tis group is about te transitions to all te states oter tan 0 and. Again te transitions are according to te CUSUM detector s beavior (3) and te fact tat M n is nonnegative. Group 3 consists of P ij for i [0, and j =, wit values P i = P ij. (8) j=0 Tis group is about te transitions to state. Note tat state in fact incorporates all possible values X n. Finally, group 4 consists of P ij for i = and j [0,, wit values { if j =0 P j = (9) 0 oterwise Tis group is related to te transition from to any oter states, according to te beavior tat te detector value will be reset to 0 as soon as it exceeds. VI. THEORETICAL PERFORMANCE ANALYSIS In tis section, we conduct rigorous teoretical performance analysis of te detection sceme based on te Markov cain model in terms of te tree fundamental metrics to cange detection: average false positive rate, average detection delay, and missed detection ratio under a detection delay bound. Ten we sow ow we can configure te system parameters to acieve guaranteed performance. We consider a network wit N nodes, and eac node always as data to transmit (i.e., in te saturated condition). In all te analysis, we consider tat te suffle mecanism is applied and tus te analysis could be based on (). Te observation window size is M =30. P fp Fig.. Average false positive rate. A. Average False Positive Rate Te average false positive rate P fp is te rate tat te detector value X n its state given te fact tat tere is no node in te network misbeaving. According to te teory on te discrete-time Markov cain, suc a rate is equal to te steady-state probability tat te Markov cain describing te CUSUM detector stays at in te normal condition. In te normal condition wit a fair sare of te cannel access, we ave qs v = N for a tagged node. We can calculate te distribution of M n according to (), and furter obtain te transition probabilities matrix P according to (6) (9). Let (π 0,..., π ) denote te steady state probabilities of Markov cain, wic could be solved from te equations π j = π i P ij, for j {0,..., } (0) i=0 π j =. () j=0 Ten we can get te average false positive rate P fp = π. (2) Te analytical result (2) allows us to numerically examine te impact of te two fundamental parameters and u on te false positive rate P fp of te CUSUM detector. As an example, we compute te results for a network wit N =0 nodes, and te results are illustrated in Fig.. Te logaritmic scale is used in te figure for te vertical axis. Te minimum value of u is set to 3 as it represents te upper bound of te expectation of M n, wic is M/N in te normal condition. From te figure, we can observe tat a larger or a larger u yields a smaller false positive rate, as expected. B. Average Detection Delay In tis subsection we analyze te average detection delay denoted as, wic is te average number of samples observed from te moment tat te tagged node starts to 642

6 misbeave until te misbeavior is detected. Wit te Markov cain under te abnormal condition (abnormal Markov cain), can be computed as te expected number of transitions required for te state variable to it state, starting from te moment wen te misbeavior starts. To carry out te analysis, we need to find te transition probabilities of te abnormal Markov cain and determine te initial state of te CUSUM detector wen te misbeavior starts. ) Transition Probabilities under te Misbeavior: We consider a network consisting of two classes of nodes. Class includes te one misbeaving node wit a small minimum contention window CW min denoted as W, and class 0 includes all te normal nodes wit te standard minimum contention window denoted as W 0. According to te classic modeling approac for te 802. DCF [, we consider tat eac node independently accesses an idle cannel for transmission. Let p i t denote te probability tat a class i (i 0, ) node transmits at a random time slot and p i c denote te collision probability of a class i node. Also recall tat N is te number of nodes and m is te maximum backoff stage. According to [, we ave te following equations: p 0 2( 2p 0 t = c) ( 2p 0 c)(w 0 +)+p 0 cw 0 ( (2p 0 c) m ) p 2( 2p t = c) ( 2p c)(w +)+p cw ( (2p c) m (3) ) p 0 c = ( p t )( p 0 t ) N 2 p c = ( p 0 t ) N from wic te four parameters p 0 t, p t, p 0 c and p c can be solved. Note tat a node can get a successful transmission under te circumstance tat tere is no collision wile te node transmits. Tus from te solutions of (3), we can obtain te probability tat a node gets a successful transmission at a random time slot: p 0 s = p 0 t ( p 0 c) (4) p s = p t ( p c). (5) We can ten calculate te probability ˆq s tat a successful transmission over te network is from te malicious node as (5): ˆq s = p s +(N )p 0. (6) s Using ˆq s in (), we can obtain te probability distribution of M n for te misbeaving node; using suc M n distribution in (6) (9), we can ten compute te transition probability matrix ˆP for te abnormal Markov cain. It is wort noting tat altoug we only include two classes of nodes in te above analysis, te model of (3) to (6) can be easily extended to cases were multiple classes of misbeaving nodes wit different intensities of misbeavior exist. Tis will enable us to analyze muc more complicated misbeaving scenarios. p s 2) Initial States: A natural tougt of te initial state of X n is 0 wen te misbeavior starts. However, tis may not be te case; before a malicious node starts to misbeave, it can beave like a normal node and still affect X n. Tus X n can be initially at any state following te normal Markov cain except for state, as we do not consider an already alarmed state as an initial state. We can calculate te steady state probabilities of te normal Markov cain according to (0) and (). Since we are interested in detection starting from an unalarmed state, under suc a constraint te conditional initial state probabilities sould be π i π i = i=0 π for i {0,..., }. (7) i 3) Average Detection Delay: As we ave various initial states, te average detection delay sould be calculated as te weigted average of te expected numbers of transitions from every initial state to state based on te transition probability matrix ˆP. Let μ i, i [0, denote te expected number of transitions for state i to state. According to [2, te values of μ i can be solved from te equations μ i =+ ˆP ir μ r for i {0,..., }. (8) r = were ˆP ir is te transition probability from state i to r of ˆP. Based on te solutions of (7) and (8), we can obtain te average detection delay as = π iμ i. (9) i=0 Te analytical result (9) allows us to numerically examine te impact of and u on te average detection delay of te CUSUM detector. As an example, we compute te results for a network wit N =0nodes, and te results are illustrated in Fig. 2. Specifically, Fig. 2 sows te analysis results under four misbeaving intensities CW min = 4, CW min =8, CW min =6and CW min =24. As we expect, te figure illustrates tat more intense misbeavior leads to a sorter detection delay. Also, we observe tat a smaller and a smaller u yield better performance in average detection delay. C. Missed Detection Ratio In tis subsection we discuss te missed detection ratio, denoted as P md. Te missed detection ratio is not often considered in te context of CUSUM test due to its non-stop until detection property. We owever examine te P md under a given detection delay constraint D, wic is of importance regarding real-time detection. Te detection event appens only wen X n its state. Tus te missed detection ratio P md under te delay constraint D is te summation of te probabilities of X n staying at a state oter tan at time D. Wit te transition probability matrix ˆP, te missed detection ratio could be computed in an iterative 643

7 (a) (b) (c) (d) Fig. 2. Average detection delay. (a) CW min =4.(b)CW min =8.(c)CW min =6.(d)CW min =24. P md (a) P md Fig. 3. Missed detection ratio. (a) D =8.(b)D =6. manner. Let te row vector P (j) =[P 0 (j),,p (j) denote te probabilities of te state variable at step j wit 0 j D. Te computation starts from te initial states given in (7), setting P i (0) = π i, i [0, (20) P (0) = 0. (2) At eac transition step j [0,D, te state probabilities are updated as (b) P (j) = P (j ) ˆP (22) P (j) =0. (23) At eac step, P (j) is set to 0 for next step computation because we are interested in te missed detection cases. Te missed detection ratio under te delay bound constraint D can be obtained as P md = P i (D). (24) i=0 Fig. 3 demonstrates te missed detection ratios P md of our analysis under te delay constraints D = 8 and D = 6, for a misbeaving node wit te moderate misbeavior of CW min =6. We observe tat te longer te constraint is, te lower te missed detection ratio will be. Or in oter words, te probability of detection increases wit a cost of longer delay. Also, a low and a low u yield better missed detection ratio. D. System Configuration under Performance Constraints Te above teoretical analysis provides us a guideline to configure te system parameters and u for guaranteed performance. For eac performance metric, we can obtain te feasible ranges of and u to satisfy te performance constraint. Ten wit te intersection of te parameter ranges under all te constraints, we expect to obtain te proper configuration of and u tat meet te performance requirements of all te metrics. In our analytical results presented above, we notice tat te metrics are more sensitive to te cange of u tan. Tus a rule of tumb for configuration is to first concentrate on finding a proper u and ten refine it by determining an appropriate. Moreover, once we determine a set of configuration parameters, we could explicitly know te target performance measures. In practice, as we do not ave aprioriknowledge of te misbeavior, te analytical model allows us to conservatively configure te system so tat even te misbeavior wit a low intensity could be detected wit good performance. For example, if we select = 7 and u = 5 for system configuration, our analytical model can tell tat even for te moderate misbeavior wit CW min =6, we target ig level of performance wit te false positive rate of , te average detection delay of observation windows, and te missed detection ratio of wit te delay constraint D =6. In next section, we will use simulation results to demonstrate tat our target performance measures are indeed acieved. VII. SIMULATION RESULTS A. Simulation Setup We establis an 802. DCF based wireless network consisting of 0 competing nodes and an access point (AP) troug ns-2 [22 simulation. Te network works under te saturated condition and every node sends constant traffic via UDP towards te AP. Te AP also acts as te detection agent wic monitors te transmissions from all te competing nodes and runs te CUSUM based detection sceme based on te collected samples. Te nodes are located close enoug to eac oter and can ten sense te transmissions from oters to avoid te idden terminal problem. Tere is misbeaving node among te 0 competing nodes, wic accesses te wireless cannel using te binary exponential backoff sceme 644

8 CDF of X n I= 0.86 I=2 I= I=4 Analytical X n P fp I= I=2 I=3 I=4 Analytical 0 Fig. 4. CDF of X n under different observation window sizes. Fig. 5. Average false positive rate. but can manipulate its minimum contention window CW min to any value between and 32. Due to te conflicting nature of te tree performance metrics, it is impossible to find te system configuration parameters tat acieve best performance at all fronts. However, as discussed in te previous section, we find tat te performance metrics are more sensitive to u and for u =5a good tradeoff can be acieved among te metrics. Terefore in our simulation, we adopt 5 as te value of u to furter evaluate te performance of our detection. B. Suffle Period Selection As described in te pervious section, te sort-term fairness issue makes te binomial modeling of M n not accurate due to te correlations among successful transmissions, wic furter impacts te transition probabilities of te Markov cain model and tus te accuracy in system configuration and detection performance. Here we examine te efficiency of te suffle mecanism in mitigating suc an issue. Since te sort-term fairness issue is inerent to te 802. DCF independent of weter te misbeavior presents or not, we study te selection of te suffle period in te normal traffic condition and ten examine te efficiency of te determined suffle period in misbeavior detection. Te purpose of te suffle mecanism is to mitigate te correlations in cannel access, tus its efficiency could be demonstrated if te distribution of te CUSUM statistic X n obtained in simulations wit te suffling applied matces te analytical results based on te independent model of (). In Fig. 4, we present te simulation results of te cumulative distribution function (CDF) of X n under different suffle period, compared wit te analytical CDF. Te configuration parameters are = 7 and u = 5. We note tat te curve closest to te analytical one is I =2. We ten examine te false positive rate troug comparing te analytical results wit te simulation results wit u =5and taking various values in Fig. 5. Again, te false positive rate curve obtained from I =2most resembles te analytical model. Based on Analytical Simulation (a) Analytical Simulation 3 Fig. 6. Average detection delay. (a) CW min =8.(b)CW min =6. te experimental results, we can euristically determine tat I =2is te optimal suffle period. According to our conjecture tat te sort-term fairness issues is inerent to te 802. DCF, an effective suffle period in te normal condition sould also apply in te condition wit misbeavior. We ten simulate te average detection delays under different misbeaving intensities and apply te suffle period of 2. Te simulation results and analytical results of te average detection delay are presented in Fig. 6. Te closeness of te two curves confirm te efficiency of te suffle mecanism in ensuring an accurate detection system. C. Performance Guarantee TABLE I COMPARISON OF ANALYTICAL AND SIMULATION RESULTS WITH =7, u =5, D =6 (b) P fp P md Analysis Simulation Given te configuration parameters =7and u =5,we compare te target performance measures (referring to VI-D) wit te simulation results under te same setting in Table I to examine weter te target performance is guaranteed. 645

9 Fig CW min Average detection delays under different misbeavior intensities. We can see tat simulation results are very close to te target values in all tree performance metrics. Te small gap between te values is largely due to te variance in te observation samples; also te suffle mecanism is not 00% accurate according to Fig. 4 and 5. Considering suc a small gap, in practice we could on purpose select configuration parameters to conservatively provision te detection performance. Fig. 7 sows te average detection delays of our sceme under different misbeavior intensities, indicated by te size of te minimum contention window CW min of te malicious node. It is observed tat our sceme generally performs very well wen detecting more intense misbeavior. For example, it takes less tan 2 samples for CW min 0 and less tan 0 samples for CW min 8. Te detection performance degrades against less intense misbeavior as te malicious node s cance of successful transmissions gets lower and te small advantages gained by te malicious node is easily smooted out in a suffle period. However, as practically a malicious node as to coose more intense misbeavior to gain more benefits, our sceme can sow its advantages in suc cases. VIII. CONCLUSION In tis paper we propose an analytical approac to real-time backoff misbeavior detection in IEEE 802. based wireless networks. We first develop a Markov cain based model to caracterize te beavior of te non-parametric CUSUM detector used in our detection. Wile most existing work for backoff misbeavior detection depends on euristic parameter configuration and experimental performance evaluation, we are able to use our model to quantitatively study te system configuration parameters to acieve guaranteed detection performance in terms of te tree fundamental metrics. Moreover, realizing tat te sort-term fairness issue of 802. affects te transition probabilities of te Markov cain model and tus te detection accuracy, we apply a suffle strategy to mitigate te impacts and also investigate te proper value of te suffle period. Finally, we present simulation results tat confirm te accuracy of our teocratical analysis and demonstrate te performance of te CUSUM based detection sceme. In our future work, we will study ow to systematically compute optimal system configuration parameters based on our analytical model. Also, we will expand our work to distributed misbeavior detection, were cooperation among several detection agents and joint distribution analysis are to be employed. REFERENCES [ G. Bianci, Performance analysis of te IEEE 802. distributed coordination function, IEEE J. Sel. Areas Commun., vol. 8, no. 3, pp , Mar [2 H. Zai, X. Cen and Y. Fang, How well can te IEEE 802. wireless LAN support quality of service? IEEE Trans. Wireless Commun., vol. 4, no. 6, pp , Nov [3 Y. Ceng, X. Ling, W. Song, L. Cai, W. Zuang, and X. Sen, A crosslayer approac for WLAN voice capacity planning, IEEE J. Sel. Areas Commun., vol. 25, no. 4, pp , May [4 Te MAdWiFi Driver, [Online. Available: ttp:// [5 A. Toledo and X. Wang, Robust detection of selfis misbeavior in wireless networks, IEEE J. Sel. Areas Commun., vol. 25, no. 6, pp , Aug [6 A. Toledo and X. Wang, A robust Kolmogorov-Smirnov detector for misbeavior in IEEE 802. DCF, in Proc. IEEE ICC, 2007, pp [7 S. Radosavac, J. S. Baras and I. Koutsopoulos, A framework for MAC protocol misbeavior detection in wireless networks, in Proc. ACM Worksop on Wireless Security, 2005, pp [8 S. Radosavac, G. Moustakides, J. Baras and I. Koutsopoulos, An analytic framework for modeling and detecting access layer misbeavior in wireless networks, ACM Trans. Information and Systems Security, vol., no. 4, article no. 9, Jul [9 Y. Rong, S. Lee and H. Coi, Detecting stations ceating on backoff rules in 802. networks using sequential analysis, in Proc. IEEE INFOCOM, 2006, pp. 3. [0 P. Kyasanur and N. Vaidya, Detection and andling of MAC layer misbeavior in wireless networks, in Proc. IEEE DSN, 2003, pp [ P. Kyasanur and N. Vaidya, Selfis MAC layer misbeavior in wireless networks, IEEE Trans. Mobile Comput., vol. 4, no. 5, pp , [2 J. Tang, Y. Ceng, Y. Hao and C. Zou, Real-time detection of selfis beavior in IEEE 802. wireless networks, in Proc. IEEE VTC-Fall, 200. [3 B. Brodsky and B. Darkovsky, Nonparametric Metods in Cange- Point Problems. Kluwer Academic Publiser, 993. [4 C. E. Koksal, Hi. Kassab and H. Balakrisnan, An analysis of sort-term fairness in wireless media access protocols, in Proc. ACM SIGMETRICS, [5 M. Cagalj, S. Ganeriwal, I. Aad and J. Hubaux, On ceating in CSMA/CA Ad Hoc networks, Tec. Rep. LCA-REPORT , [6 J. Konorski, Protection of fairness for multimedia traffic streams in a non-cooperative wireless LAN setting, in Proc. 6t International Conference on Protocols for Multimedis Systems (PROMS), 200. [7 J. Konorski, Multiple access in Ad-Hoc wireless LANs wit noncooperative stations, in Proc. 2nd International IFIP-TC6 Networking Conference on Networking Tecnologies, Services, and Protocols; Performance of Computer and Communication Networks; and Mobile and Wireless Communications (NETWORKING), [8 M. Raya, J. Hubaux and I. Aad, DOMINO: A system to detect greedy beavior in IEEE 802. otspots, in Proc. ACM MobiSys, [9 M. Raya, I. Aad, J. Hubaux and A. El Fawal, DOMINO: Detecting MAC layer greedy beavior in IEEE 802. otspots, IEEE Trans. Mobile Comput., vol. 5, no. 2, pp , Dec [20 H. V. Poor and O. Hadjiliadis, Quickest Detection (st ed.), Cambridge Univ. Press, [2 J. R. Morris, Markov Cains, Cambridge Univ. Press, 997. [22 Te Network Simulator - ns-2, [Online. Available: ttp:// nsnam/ns. 646