Intrusion Detection Techniques for Mobile Ad Hoc Networks

Georgia Tech Research Corporation, Atlanta GA

Investigators

Abstract

Proposal Number: 0311024 TITLE: Intrusion Detection Techniques for Mobile Ad Hoc Networks PI: Wenke Lee Abstract: A mobile ad hoc network (MANET) is formed by a group of mobile wireless nodes often without the assistance of fixed or existing network infrastructure. A MANET is very vulnerable to attacks because of its characteristics of open medium, dynamically changing network topology, lack of centralized monitoring and management point, and lack of computing resources and (battery) power. This research focuses on developing intrusion detection capabilities for a MANET. A distributed intrusion detection architecture is investigated. Each MANET node can be the monitoring node for itself, or a cluster of neighboring MANET nodes can elect a monitoring node for the neighborhood. A detection agent runs on each monitoring node to detect local intrusions and collaborates with other agents to investigate the source of intrusion and coordinate responses. This research develops a learning-based algorithm that can automatically compute detection models based on the correlations among a large set of features. For efficiency, a cascaded detection scheme is studied where simple and energy efficient models can first filter out the vast amount of normal data so that the more complex and energy consuming models only need to analyze a small amount of suspicious data. The novel intrusion detection architecture and algorithms in this research will be valuable to not only MANET but also other existing and future technologies.