Design and Development of Secure Data Cache Framework
CHAPTER 6 DESIGN AND DEVELOPMENT OF A SECURE DATA CACHE FRAMEWORK The nodes of the MANETs act as host and a router without trustworthy gateways. An Ad Hoc network could be subjected to user misbehaviour or malicious attacks and hardware or software failures. These aspects make the security issues more challenging in a MANET than the Internet, since a wide variety of attacks might exploit its weaknesses. Although security is an important issue in Ad Hoc networks, information access is also very important since the aim of using ad hoc networks is to offer information access to mobile nodes. Dynamic network connections and restricted energy supplies in MANETs make the data accessibility in data access applications a challenging task. Caching frequently accessed information at the clients is an effective strategy to enhance the performance in mobile environments. When caching is used, information available in the server is duplicated on the caching nodes. As the mobile node has the responsibility to return the cached data, or alter the route and forward a data request to a caching node, it is very important that mobile nodes do not maliciously amend the data, drop or forward the data request to the wrong destination. The proposed work concentrates on improving the cooperative caching mechanism by incorporating security. 6.1 INTRUSION DETECTION SYSTEM (IDS) AND CACHING ARCHITECTURE Intrusion detection is achieved by comparing the actual behaviour of the system with the normal behaviour of the system in the absence of any intrusions. The normal and abnormal behaviours of the system could be initialized during the design of IDS. 76
The intrusion detection techniques are classified into two categories as anomaly detection and misuse detection or signature detection. Misuse based detection detects the occurrence of known attacks. Anomaly based technique detects misbehaviour by measuring variation from a normal behaviour (D. E. Denning, 1987; F.Anjum et al., 2003). Caching diminishes the information access latency since information access requests might be served from the local cache, thereby avoiding the need for data transmission over the limited wireless links. As mobile nodes in Ad Hoc networks may have similar tasks and share common interest, cooperative caching, which permits the sharing and coordination of cached data among multiple nodes, could be utilized to decrease the transfer speed and power utilization. The mobile devices don t need to send requests to the information source as they share the information among the neighbouring nodes. Caching the data item (CacheData) and the data path (CachePath) and both (HybridCache) are proposed in (L. Yin et al., 2003). A cluster based approach has been proposed that divides the MANET into equivalent clusters based on the proximity (N. Chand et al., 2006). In another scheme the queries are cached along with the data path (H. Artail et al., 2008). When the data items are cached, there may be a high storage requirement. A prefetch based cooperative caching has been done with the data mining rules which sense the future needs of the mobile nodes (Naveen Chauhan et al., 2012). Mieso K.Denko et al. (2009) proposed a cluster based cooperative caching scheme to improve cross-layer optimization by reducing query delay. It improves network performance by reducing the client query delay, reducing traffic congestion, improving client capacity by adopting clustering and also provides the quick retrieval of required 77
data by using cooperative caching and cross-layer design approach. In all the caching schemes, the security of the data packets has not been addressed. A data communication mechanism which combines the concept of Artificial Immune System (AIS) along with Ant Colony Optimization (ACO) has been proposed which provides better performance than immune system with AODV protocol (S.Umamaheswari et al., 2012). Node mobility in MANET causes node failure which leads to path distraction that raises end-to-end delay. Security not only means giving protection against known and unknown attacks but also involves injecting immunity into data packets or mobile nodes. Message from source may not reach the destination because of many reasons such as node mobility, paucity of traffic monitoring, scarcity of battery power and bandwidth, lack of security etc. A malicious node can easily decline to forward routing message (misbehaviour node) inject the wrong routing packets, changing routing information, which disturb the proper functioning of the routing scheme. Due to the limited resources in MANET, there may be a delay in forwarding the data packets. Hence the design of secured routing algorithm and an improved caching architecture is a major issue in MANETs. 6.2 SECURE DATA CACHE FRAMEWORK - ANTSEC ANTSEC (AntHocNet + Security) framework has been proposed by the author that contains an Enhanced Cooperative Caching Scheme (ECOCA) embedded with Artificial Immune System (AIS). This framework improves security by injecting immunity to the data packets, improves the packet delivery ratio and reduces end to end delay using Cross layer design. The issues of node failure and the malfunction of nodes have been addressed during the cache management. 78
ANTSEC framework combines the features of Anthocnet protocol, Artificial Immune System, Cross layer design and Clustering. The main components of the proposed framework are ECOCA middleware and the Stack Profile (Cross Layer). The COCA middleware proposed by Mieso K.Denko et al. (2009) has been added with Artificial Immune System Packet (AISp) and Cross Layer Control (CLCp) and the Stack Profile is added with Routing Table, Detector Set and Cross Layer Control (CLC) for the design of the ANTSEC framework. AISp and CLCp are embedded with each Data Packet (DP) which is received from the Application Layer. AISp or CLCp gets activated when there is a malfunction in the nodes or node failure. The system architecture is depicted in Figure 6.1. Application Layer Cache Consistency Cache Replacement Prefetching Stack Profile (Cross Layer Information) Cached Item IDS Cache Admission Control Information Search Network Traffic Routing Table Clustering Detector Set CLCp AISp CLC ECOCA Middleware Transport Layer Network Layer Data Link Layer Figure 6.1 System Architecture of ANTSEC Framework 79
ECOCA is a middleware which stays below the Application Layer and provide the functionalities such as caching, data management and security. Functional components of ECOCA agent include information search, caching/prefetching, clustering, Stack profile, and User interface which works in similar way as specified by Mieso K.Denko et al. (2009). Two control packets named AIS control packet (AISp) and Cross Layer Control Packet (CLCp) have been added to the middleware. A cross-layer design approach improves the performance. There are several schemes proposed for implementing the cross-layer approach in mobile wireless networks. The functionality of existing internal protocols, such as the Internet Control Message Protocol (ICMP) is extended or the packet headers are modified to carry cross- layer information (N.Yang et al., 2005). Cross-Layer Signaling Shortcuts (CLASS) scheme creates shortcuts between adjacent or nonadjacent layers, which need to exchange and share information. Any two protocol layers can communicate with each other directly using the shortcuts (Q.Wang et al., 2003). A new component is created as an independent vertical layer, in addition to the traditional layered protocol stack for cross-layer information exchange. This architecture could be used for full cross-layer design. As the shared data is kept in the vertical layer, data duplication could be avoided (M.Conti et al., 2004). The Stack Profile module of the ANTSEC framework is independent of the protocol stack that bridges the main network layer and the cross layer and provides information exchange buffer for protocol layers in the protocol stack. Cached Item IDs, Network Traffic, Routing table, Detector set, and member function CLC (Cross Layer Control) are the components of the proposed Stack profile. Network Traffic Status 80
information is provided by the data link layer. The middleware layer needs it for the prefetching process. Cached Item IDs is provided by the ECOCA middleware layer and is used by the network layer. Stack profile is defined as a class in ECOCA agent. When it is initialized, it gets pointers pointed to ECOCA agent. Agent mainly monitors all the data packets and propagation path. It maintains up to date information about the network. Routing table contains routing information and pheromone value between two nodes. CLC function takes care of identifying the failure nodes and does the process of rerouting. Earlier, wired networks mainly used proactive scheme routing protocols which periodically generates ant-like agents for all possible destinations. In reactive scheme routing information is gathered when an event triggers for new route or in case of failure of existing route. In proactive scheme routing information is gathered earlier before the start of new event. ACO algorithm uses a control packet called ant agent to sample possible paths towards destination. In ECOCA, Routing information obtained by ant agents can be updated in Stack profile. Routing table holds pheromone variables that are continually updated according to path quality values calculated by the ant agents. When ant agents move on the same path repeatedly and concurrently, then generation of path-sampling results in the availability of a bundle of paths at each node with an estimated measure of quality. Functions of ECOCA Agent Table 6.1 depicts the assumptions used to define the procedures AIS and CLC. 81
Table 6.1. Assumptions for the procedures AIS and CLC Definition Data Packet Severity Base line path Cluster head Current behaviour/event Detect or set behaviour/event Pheromone Value Symbols DP S BP CH Cb Db phvalue MANET is a collection of mobile nodes that involves well behaving node and misbehaving node. Initially, the behaviour of the MANET is learnt and the sequence of events of the routing protocol is assigned to a label. Detector set contains sequence of labels at different time period for the events such as data packet sent, data packet received, etc. It is based on the negative selection part of the self-nonself model. Upon receiving the data request, the cache management related functions are invoked and the data is received from the application layer. The control packets AISp and CLCp are embedded into the received data packets. AISp adds immunity into the data packets to identify the node malfunction and CLCp detects the failure nodes during the path discovery and provide a new path for routing. Generally, destination node alone could open the data packets. AISp control packet gets activated and checks whether this behaviour is normal or abnormal by comparing it with detector set when intermediate 82
node tries to open the data packet or if a node tries to add extra information into the data packet. If the match is found then AIS won t allow the node to open the data packet. AIS make use of Negative Selection algorithm to find the detector set. This set contains the abnormal behaviour that is completely different from normal behaviour. Hamming distance is used to find the match between normal and abnormal behaviour. Commonly, Negative Selection algorithms are applied to anomaly detection or novelty detection problems. ECOCA Function Step 1: Receives DP from Application layer Step 2: Embed AISp (Artificial immune system packet) and CLCp (Cross layer control packet) along with DP Step 3: During route discovery phase, AnthocNet protocol propagates and finds the shortest path. Ant selects Best path based on the quality of pheromone value between nodes. After propagation mode the ants move to transition mode. Once first DP reaches the destination, BP is stored in source cache. Step 4: Detector set is obtained from Negative Selection Algorithm. It contains abnormal behaviour. Step 5: Severity is based on the quantity of pheromone value. Step 6: AISp gets activated when an intermediate node tries to open the data. Step 7:CLCp gets activated when there is less quantity of pheromone value in a particular node. It passes the control to CLC. 83
Procedure AIS (Cb, Detector set) Begin If the Cb = = Db then Discard current behaviour Else Propagate End Since it is the mobile node, dynamic change in network topology leads to node failure, traffic, etc. Node failure occurs when a node moves out of its cluster which is the major cause for ACO route distraction. In the ACO system pheromone values are significant to find the path. If an ant traversal reduces on specific node the pheromone value get evaporated. Therefore, strength of the node or path can be determined by the pheromone value. In this framework the pheromone value is mapped with sensitivity of the node or path. The sensitivity is referred in terms of percentage and classified through the following conditions high sensitive (ph<30%), moderate sensitive (30%<ph<60%) and low sensitive (ph>60%). The classification interval is an assumption, thus it can be altered if required. By classifying the pheromone value helps to decide the weak nodes among the path between source and destination. All the nodes with failure node as intermediate would update current phvalue which would be very less. Low phvalue makes the ant to propagate in different route. If the phvalue of all next hop nodes is low then in this case CLCp gets activated and passes the control to CLC in cross layer. It fetches the BP from the source node cache and 84
passes it to node with less phvalue. If phvalue is between 30 to 60% then ant propagates till time T after which it gets the routing path with large pheromone value from cluster head and reroute in that path. If phvalue in a node is more than 60% then ant propagates in that route for reaching the destination in short time. When there is distraction in path then CLCp gets activated similarly to find the malicious activity within network AISp has been proposed. It gets activated when a node performs unexpected event which would collapse the normal behaviour. Initially, the detector set is framed using Negative Selection algorithm. AIS compares current behaviour with list of behaviours in detector set. If a match found, it realize current behaviour is malicious and current event is discarded, else current event takes place. Procedure CLC (Datagram) Begin Get pheromone value from Routing table then If phvalue < 30% then S is more 1. Get BP from Source cache 2. Send BP directly to intermediate node where path distraction occurred. 3. Intermediate node Reroute to destination through BP Else if phvalue >30% and phvalue <60% then S is moderate Propagate till time T 85
If T expire then Get Correct Path from CH Reroute to Correct Path End if Else phvalue > 60% S is low Routing protocol propagates and find a path with high phvalue Data gets transmitted in that path End if End if End 6.3 PERFORMANCE EVALUATION The proposed ANTSEC framework was evaluated in an NS-2 simulation environment. Different simulation scenarios have been performed. The performance of the proposed framework is measured with packet delivery ratio and end to end delay. In the simulation, each mobile host moves in the simulation area following the random waypoint mobility model. The random waypoint model is used for simulating the movement pattern of mobile host in a MANET. For 100 and 150 nodes simulation was carried out in 1500*1000m. In Table 6.2, the simulation parameters are listed. 86
Table 6.2. ns-2 Simulation Parameters Parameter Value Transmission Range(M) 250 Bandwidth(Mbps) 3 Node Speed(M/s) 0-10 Routing Protocol AntHocNet Pause Time(S) 100 Cache size (KB) 300 Average TTL (S) 100-3000 Zipf-like Parameter ( ) 0.5-1.0 Number of Data items 1000 No. of nodes 100,150 Request Interval(S) 10 Simulation Time 2000 sec. To evaluate the performance of the proposed ANTSEC framework, two scenarios based on number of mobile nodes have been considered. In scenario 1 and 2, five Tcl simulations run have been conducted in 100 and 150 nodes, based on which average end to end delay and packet delivery ratio has been obtained. Generally, misbehaving node may cause raise in delays, packet drop and reduce throughput of the network. To reduce this factor AISp has been embedded within the data packet. This prevents the network from nodes that cause abnormal behaviour. 87
Table 6.3. Network Performance on 100 nodes (100 Nodes) Scenario1 Packet Delivery Ratio Delay ANTSEC AODV+COCA ANTSEC AODV+COCA 1 94.16 89.15 190.57 217.94 2 92.71 88.05 228.81 251.75 3 90.65 87.39 139.22 156.50 4 93.72 87.24 248.47 314.08 5 95.00 91.67 186.77 232.65 Mean 93.25 88.70 198.77 234.58 SD 1.67 1.82 42.22 56.99 The mean value of packet delivery ratio and end to end delay of ANTSEC framework presented in Table 6.3 shows good performance than AODV+COCA as it contains cross layer control CLC. This CLC manages path distraction due to node failure which certainly reduces end to end delay. As there is decrease in delay, packet delivery ratio gets increased. But there is no control for managing Path distraction in case of AODV+COCA. The delivery ratio was 93.25% in the ANTSEC framework where it was 88.7% in case of AODV+COCA. ANTSEC framework has 15.27% efficient in reducing the delay and 5.13% efficient in improving the packet delivery ratio than AODV+COCA while transmitting the packets. 88
Table 6.4. Statistical Analysis for 100 Nodes 100-nodes Mean SD t-value df p-value PDR-ANTSEC vs. PDR-AODV+COCA 4.55 1.33 7.633 4 0.002 DELAY-ANTSEC vs. DELAY-AODV+COCA -35.82 19.81-4.043 4 0.016 Table 6.5. Network Performance on 150 nodes (150 Nodes) Scenario2 Packet Delivery Ratio Delay ANTSEC AODV+COCA ANTSEC AODV+COCA 1 93.99 90.18 153.31 171.29 2 91.13 87.61 269.93 304.04 3 84.76 81.45 304.68 337.82 4 96.20 92.60 205.63 239.97 5 95.22 92.12 170.69 207.74 Mean 92.26 88.79 220.85 252.17 SD 4.60 4.55 64.70 68.36 ANTSEC framework shows good performance in the Tcl simulation runs as specified in Table 6.5. The delivery ratio was 92.26% in the ANTSEC framework where it was 88.79% in case of AODV+COCA. In case of delay, ANTSEC transmits the packet within 220.85 ms where as AODV+COCA takes around 252.17ms. The proposed framework has 12.42% efficient in reducing the delay and 3.9% efficient in improving the packet delivery ratio than AODV+COCA while transmitting the packets. 89
Packet Delivery Ratio (%) Table 6.6. Statistical Analysis for 150 Nodes 150-nodes Mean SD t-value df p-value PDR-ANTSEC vs. PDR-AODV+COCA 3.47 0.27 28.436 4 0.000 DELAY-ANTSEC vs. DELAY-AODV+COCA -31.32 7.60-9.217 4 0.001 PACKET DELIVERY RATIO with 150 NODES 100 95 90 85 80 75 70 1 2 3 4 5 ANTSEC AODV+COCA SCENARIO WITH 150 NODES Figure 6.2 Packet Delivery Ratio with 150 Nodes 90
Packet Delivery Ratio (%) Delay (in Sec) 400 DELAY with 150 NODES 350 300 250 200 150 100 ANTSEC AODV+COCA 50 0 1 2 3 4 5 SCENARIO WITH 150 NODES Figure 6.3 Delay with 150 Nodes 96 PACKET DELIVERY RATIO with 100 NODES 94 92 90 88 86 ANTSEC AODV+COCA 84 82 1 2 3 4 5 SCENARIO WITH 100 NODES Figure 6.4 Packet Delivery Ratio with 100 Nodes 91
Delay (in Sec) 350 DELAY with 100 NODES 300 250 200 150 100 ANTSEC AODV+COCA 50 0 1 2 3 4 5 SCENARIO WITH 100 NODES Figure 6.5 Delay with 100 Nodes The packet delivery ratio of the network with 150 nodes and 100 nodes is depicted in the figure 6.2 and figure 6.4 respectively. The delay of the network with 150 nodes and 100 nodes is depicted in figure 6.3 and figure 6.5 respectively. The statistical analysis of the performance is depicted in Table 6.4 and Table 6.6. Statistical paired t-test has been proposed to evaluate the significant difference between proposed model and existing model with respect to Packet Delivery Ratio (PDR) and Packet Delay. The 100-nodes evaluation shows that the paired value of PDR is 4.55 1.33, Delay is -35.82 19.81, and both p-values are less than the level of significance 0.05. Similarly 150-nodes also evaluated, which shows that the paired value of PDR is 3.47 0.27, Delay is -31.32 7.60, and both p-values are less than the level of significance 0.05. Hence, the 92
proposed model has found significant effect on existing model with respect to PDR and Delay in both the scenarios with 100 nodes and 150 nodes. The ANTSEC framework always outperforms AODV+COCA as it embeds AIS and ECOCA; both factors make the proposed framework more efficient with higher PDR (Packet Delivery Ratio). As the framework uses AntHocNet protocol and the misbehaving nodes are identified by the AIS packets (AISp) which are embedded into the Data Packets (DP) the end-to-end delay is lowered. From the above results, it is proved that the proposed ANTSEC framework works well in large network size including malicious nodes. 6.4 SUMMARY The design of secure data cache framework ANTSEC that is capable of improving self-immunity of data packets and decreases delay caused by node failure is presented in this chapter. The successful delivery of data packets with the ability to protect itself from mild attacks makes the framework more efficient than ordinary secure data transmission mechanism using AODV. ANTSEC framework contains AIS and ECOCA, which is a unique blend of data security and cache management. As the data packets are embedded with the immunity packet AISp, it can be guaranteed to provide far more effective protection against hacker incidents during data transmission. The cache management is handled through cluster based co-operative caching. ANTSEC has performed well in most of the scenarios compared with AODV-COCA method that is evaluated with the parameters end-to-end delay and packet delivery ratio. 93