International Second Symposium on Intelligent Information Technology and Security Informatics
A Novel Intrusion Detection Architecture Based on Adaptive Selection Event Triggering for Mobile Ad-hoc Networks
Chuan-xiang Ma, Ze-ming Fang School of Mathematics and Computer Science. Hubei University, Wuhan [e-mail]
Hubei,China 430062
Abstract
Due to resource limitation, it is an optimum solution for intrusion detection in mobile Ad-hoc networks (MANETs) that all nodes investigate system and user activities while a subset of network nodes are selected as monitoring nodes to monitor and detect network packets. In this paper, a novel intrusion detection architecture for energy-constrained mobile Ad-hoc networks is proposed, in which the network detection module is optional. Monitoring nodes are selected by activating the network detection model to work. A selection scheme of monitoring nodes called Event Triggering Based Adaptive Selection (ETBAS) is also proposed, which introduces the mechanism of monitoring states and the method of event triggering. Triggering events, for example, a node has been voted to be a monitoring node by its neighbors, the battery power of a monitoring node has consumed to a threshold, or the networks topology has changed, can activate a non-monitoring node, or make a monitoring node fall asleep. High connectivity and energy resource are balanced in ETBAS for adaptive selection scheme, which is adaptable to dynamically changing networks and enhances the network lifetime.
1. Introduction
Compared with traditional wire or wireless network, security in mobile Ad hoc networks is hard to achieve for dynamically changing, distributed collaboration, lacking of certification center and the limitation of node energy resources. In the recent years, intrusion detection technology has been applied into Ad-hoc networks to resolve those security problems, but
efficiency architecture for energy-constrained wireless network is an unavoidable challenge. A distributed and cooperative intrusion detection architecture for mobile wireless networks is proposed by Zhang etc in [1], in which every node should participate in local and network intrusion detection and response. On account of the additional resources consumed during monitoring and detecting, this architecture is not efficient in utilizing the limited network energy resources. Anjum etc in [2] showed that it is certainly not necessary for all the nodes to run the IDS. Instead, they can be selected randomly on the network and the number of IDS node can be defined in order to obtain a good percentage of detection. In order to save energy resources, the problem of selecting monitoring nodes has been raised. Kachirski and Guha in [3] proposed a layered mobile agent architecture, in which the network is logically divided into clusters with a single clusterhead for each cluster. This clusterhead, as well as network monitoring nodes, will monitor the packets within the cluster and only packets whose originators are in the same cluster are captured and investigated. A simpler selection scheme called lifetimeenhancing selection (LES) is proposed in [4], which adaptively choose a monitoring node that has a maximum remaining battery power between adjacent mobile nodes for intrusion detection. Once its power becomes the lowest among its neighbors, re-choosing happens. Thus, by dispersing the battery consumption among the nodes with relatively high remaining battery power, LES scheme can enhance the network lifetime. However, LES does not accommodate to dynamically changing topology of Ad Hoc networks, because the rechoosing may impact more other monitoring nodes,
Ze-ming Fang: the corresponding author. This research is supported by National Natural Science Foundation of China (No: 60603069) , the projects of science and research plan of Hubei provincial department of education (D20060003) and the Natural Science Foundation Of Hubei Province of China (2006ABA016).
978-0-7695-3579-1/09 $25.00 2009 IEEE DOI 10.1109/IITSI.2009.54
198
Authorized licensed use limited to: Maharaja Agrasen Institute of Technology. Downloaded on January 27, 2010 at 18:07 from IEEE Xplore. Restrictions apply.
especially when a monitoring nodes leaves network suddenly. In our architecture, it is more flexible because each node with the same IDS has an equal opportunity to be selected as monitoring node on activating its network detection model. In ETBAS scheme each node has its monitoring state that can be automatically transformed by event triggering. Therefore, ETBAS is an adaptive selection scheme and adaptable to dynamically changing networks. The main contributions of this paper are as follows: 1 A novel intrusion detection architecture with alterable network detection model that can be awaken or closed according to monitoring states is proposed, consequently the limited network energy resource is efficiently utilized. 2 A selection scheme corresponding to our framework is presented, in which a node is selected to be a monitoring node by activating its network detection model to work once an appropriate triggering event occurring. This paper is organized as follows. In Section 2, the novel IDS architecture is described. Section 3 presents the mechanism of monitoring states and the method of event triggering firstly, then describes the original section and updating selection of ETBAS. Section 4 is the conclusion.
The triggering events are monitored by monitoring state management and monitoring state is alternated correspondingly.
IDS agent resource manage module monitoring state manage module
local detection module
network detection module
user and system activities
network packets
Figure 1. The conceptual model for IDS agent. Dashed pane indicates that the network detection module is available when the node is selected as a monitoring node. In this paper, we concentrate on the selection of monitoring nodes to enhance network lifetime instead of intrusion detection techniques.
3. ETBAS scheme
In our architecture, all nodes have different monitoring states according to whether their network detection module is available or not. A monitoring node is at the activating state when its network detection module is in effect, while a non-monitoring node, or called as a normal node, is at the sleeping state with this module closed. The sleeping state is also set to be the default state of all nodes when the network is established. When appropriate events happen, one monitoring state can transform to another. For example, when a non-monitoring node is voted by its neighbors, it then will be altered to activating state. Or once the battery power of a monitoring node is lower than a threshold value, it will send control packets to inform neighbors to choose a new one, and turn into sleeping state. Since are nodes self-organized in Ad hoc networks, the selection process of ETBAS scheme can accordingly divide into original selection and updating selection.
2. The model architecture
Because of the distributed and cooperative features of mobile Ad-hoc networks, local and network intrusion should be given attention. Since it is testified in [2] that a subset of IDS nodes obtain a good percentage of network detection, we focus on energy saving and propose a flexible architecture as illustrated in Figure 1. It comprises the following four major components: local detection, network detection, resource management and monitoring state management. Local detection module collects the user and system activities, detects local intrusion and generates a local alert with sufficient evidence. Network detection model is an optional module which can be activated to capture and investigate network packets only when the monitoring nodes are in effect. Resource management module supervises the remaining energy resource of the node and its neighbors, and generates a vote if required. When the battery power of a monitoring node is lower than threshold value, it will be reported to monitoring state manage module as a triggering event.
3.1. Original selection
The original selection process selects monitoring nodes during the establishment of network. The selection criterion of monitoring nodes in this process is the remaining battery power and requires an exchange of energy information.
199
Authorized licensed use limited to: Maharaja Agrasen Institute of Technology. Downloaded on January 27, 2010 at 18:07 from IEEE Xplore. Restrictions apply.
First, each node broadcasts a control packet containing its battery power information. With comparing the battery power among it and its neighbors, resource management module then chooses the highest one, and send a control packet to it. If a node has been voted, it will activate its network detection module and broadcast a new control packet, which tells its neighbors that it is a monitoring node. Any nodes that have not been voted but receipted such control packets will go to sleep to be a non-monitoring one. But if a node has not, which means no monitoring node is its neighbor, it will awaken itself. Nodes 2, 3, 5, 9 selected as monitoring nodes are illustrated in Figure 2.
63w 81w 3 77w 5 85w 70w 1 2 7 92w 9 8 68w 70w 4 57w 6
11; otherwise, it will awaken itself to be a monitoring node. Node 10 is self-activated as given in Figure 3.
63w 81w 3 77w 5 85w 70w 1 2 7 92w 9 87w 11 8 68w 70w 4 57w 6 67w 10
Figure 3. Re-selection process when a new node entering network. (2) Before a monitoring node leaving the network, it must broadcast a packet to inform its neighbors. Once non-monitoring nodes have receipted such packet, they exchange their energy information and select new monitoring nodes according to the original selection process. A re-selection when monitoring node 2 leaves is shown in Figure 4.
63w 81w 3 77w 5 4 57w 6 67w 10 70w 7 92w 87w 11 9 8 68w
Figure 2. The original selection process in ETBAS scheme. Dashed lines indicate a vote packet route. The first step nearly selects monitoring nodes synchronously in ETBAS scheme. Those monitoring nodes also will be altered when triggering events happen. Relative to LES scheme, nodes do not need to exchange energy information periodically if no triggering events occur. Consequently, ETBAS observably reduces the traffic load and enhances the network lifetime.
85w 70w 1 2
3.2. Updating selection
When triggering events occur, nodes in local network will vote new monitoring nodes in ETBAS scheme. The main triggering events discussed in this paper are: (1) a new node enters the network; (2) a monitoring node leaves the network; and (3) the battery power of a monitoring node is lower than threshold value. The re-selection processes triggered by those events are described as follows. (1) When a new node enters the network, at first it broadcast a request packet that its neighbors will reply with a packet containing their monitoring states information. If it receives at least one response from monitoring nodes, it will still be sleeping state as node
Figure 4. Re-selection process when a monitoring node leaving network. (3) If the battery power of a monitoring node is lower than threshold value, it also need to broadcast a packet to inform its neighbors, then transform to sleeping state and will not be selected again. This node and its non-monitoring neighbors that receive such packet exchange their energy information and select new monitoring nodes according to the original selection process. An example is shown in Figure 5.
200
Authorized licensed use limited to: Maharaja Agrasen Institute of Technology. Downloaded on January 27, 2010 at 18:07 from IEEE Xplore. Restrictions apply.
63w 81w 3 19w 5 70w 1 92w 87w 11 9 8 68w 7 4 57w 6 67w 10 70w
Networks", International Journal of Electronics and Communications, 2006; 248-250.
Figure 5. Re-selection process when the battery power of a monitoring node is lower than threshold value (here is 20w). The selection scheme based on event triggering is adaptive to the dynamically changing of mobile Ad-hoc network, with motion regarded as leaving and entering network later. It is advantageous that re-selection happens in local network without impacting other monitoring nodes.
4. Conclusions
In this paper, we proposed a novel intrusion detection architecture for energy-constrained mobile Ad-hoc networks with optional network detection module. In ETBAS, an adaptive selection scheme of monitoring nodes, each node has its monitoring states, activating state or sleeping state. Monitoring nodes can be updated by three triggering events as discussed above. Compared to LES scheme, ETBAS scheme has much better performance in terms of the network lifetime and stability.
5. References
[1] Y.Zhang, W.Lee, Y.Huang, "Intrusion Detection Techniques for Mobile Wireless Networks", ACM/Kluwer Wireless Networks Journal (ACM WINET) 2003 Vol. 9, No. 5, September 2003, pp. 545-556. [2] F.Anjum, D.Subhadrabandhu, S.Sarkar, "Signature-based Intrusion Detection for Wireless Ad-hoc Networks", In Proceedings of Vehicular Technology Conference, Wireless Security Symposium, Orlando, Florida, October 2003. [3] O.Kachichirski, R.Guha, "Effective intrusion detection using multiple sensors in wireless ad hoc networks", Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS'03), Hawaii, January 2003, pp. 57-64, [4] H.Kim, D.Kim, S.Kim, "Lifetime-enhancing Selection of Monitoring Nodes for Intrusion Detection in Mobile Ad Hoc
201
Authorized licensed use limited to: Maharaja Agrasen Institute of Technology. Downloaded on January 27, 2010 at 18:07 from IEEE Xplore. Restrictions apply.