Detecting DDoS Attack in Mobile Ad Hoc Network

Based on Network Density Awareness

Made Harta Dwijaksara and Kwangjo Kim

Department of Computer Science, KAIST

Abstract

DDoS (Distributed Denial of Service) is a notorious methods to attack an open network and to make the system unavailable to the legitimate users. In mobile ad hoc network, the probability that DDoS attack will happen is even higher than in any other type of network.  One of the well known DDoS attacks is exploited by jamming the network with a bounce of control packets which will exhaust network resources. This paper deals with this type of attacks.  We  implemented our method over DSR (Dynamic Source Routing) protocol and  verified its correctness and  performance using NS2 network simulator.

Introduction

A mobile ad hoc network (MANET), sometimes called a mobile mesh network, is a self-configuring network of mobile devices connected by wireless links [3]. In MANET, a routing protocol plays an important role to ensure a reliable communication among nodes. Unlike traditional routing protocol, in MANET, the route discovery should be executed more quickly. Once a route path is found, it cannot be maintained for a long time because of the node mobility, node interference, hidden node problem, etc.  As a result, the route discovery must be done frequently so it consumes a lot of network resources. This phenomenon shows that routing protocol takes very extensive amount of cost in order to create or maintain the communication among nodes.

DSR (Dynamic Source Routing) protocol is one of the well known routing protocols used in MANET. DSR uses source routing instead of relying on the routing table. When we use DSR protocol, route discovery will be executed if there is a packet to be sent. When there is such a case the node will initiate route discovery by sending route request (RREQ) to other nodes. This route request will be forwarded by neighbor nodes until it reaches the destination node or until TTL (time to live) of that packet is over. When the destination node receives the RREQ, it will send route reply (RREP) to the originating node that indicates the route has been found. In normal case, we believe that all nodes follow  the protocol. But when it comes into hostile environment, no one can guarantee that all nodes will act normally. A compromised nodes may try to join a network and interrupt the ongoing communication.

DDoS can be considered as one of the result yielded by compromised nodes to disrupt the network. The naïve assumption [1] used in designing a routing protocol

Figure 1. DDoS attack on routing protocol

is the drawback used by the adversaries to attack the network. For instance: some malicious nodes cooperate to send bounce of fake RREQ packets continuously. As a result, a packet from other innocent nodes will be inappropriately processed.

The rest of this paper is organized as follows: Section 2 presents the related work. Section 3 describes our detection scheme. In section 4 after giving the parameters setting for our simulation we show the simulation result and analysis. Finally, Section 5 concludes this paper.

Related Work

In [4][6], they introduced the intrusion detection and response mechanism for wireless ad hoc network. Here the misbehaving activities are detected by an individual node. This individual node will calculate the confidence value of its neighbor nodes. This information will be exchanged with the other nodes within the network. Since a lot of parameters need to be considered to make a decision, it may not be suitable for real time detection of DDoS attack.

Sugata et al.[5] suggested a quite simple method for DDoS detection. They introduced two parameters for detecting DDoS attack which are RREQ_ACCEPT_LIMIT and RREQ_BLACK_LIST_LIMIT. The first parameter is used to limit the number of RREQ which can be accepted and processed per unit time by a node. The second parameter is used to specify a value that aids in determining whether a node acts maliciously or not. But network density was not considered which may

Figure 2. Different network density in MANET

result false positive i.e. when we mark innocent node as malicious node.  For example: in Figure 2, x is not malicious node, but due to network density like Figure 2b, this detection scheme may mark x as a malicious node. This happens because x has to forward so many packets.

The certificate authority is introduced in [2]. So if there is a node request for route with its RREQ, this node should append its certificate to the RREQ. Since this method was designed to utilize  cryptosystem, it requires high computation and additional process for key management.

Credence mechanism is used in [7] to detect malicious node. Here, credence is defined as credit measurement of entities in the network. The complexity of their formulation may also lead to excessive computation process, which also degrades the performance of detection mechanism as well.

Our Detection Scheme

The detection scheme relies on a number of control packets for routing protocol which can be sent by a particular node for a certain period of time. In brief, the node could be considered as a malicious node if it sends the number of packets exceeding the threshold value continually.  But in order to decrease the rate of false positive alarm in a detection, we should consider network density. We refer network density as number of node in a network, because more node will likely produce more traffic in the network. To achieve this goal, we introduce degree of trust (i.e. trustiness) value. Every node will be assigned certain degree of trust value which will be determined by their activities in sending packet (mostly control packet), for a particular interval of time. Looking at the degree of trust value, one node can decide whether the neighbor node is malicious one or not.

First we would define certain threshold for the number of packet limit (m) per interval of time (Δt). Then, we defined threshold value (σ) for degree of trust in which a node can be considered to act maliciously. We also defined reset time (T) for degree of trust, since there might be for some moment when a certain node may send packet exceeding the threshold value because of the network density, but in fact that the node is not a malicious one. Using those parameters, we examine the activities of neighbor nodes. Once the nodes are found as malicious node, their neighbors will isolate them from the network. So, they will have no chance to hijack the network resources. The degree of trust can be calculated using  Eq. (1):

[eqn: d _{n} ^{i} =d _{n} ^{i-1} -k _{i} * LEFT ( {p _{i} -m} over {m} RIGHT )]      (1)

where:

[eqn: d _{n} ^{i}]	: degree of trust of node n for	i-th Δt, in which  [eqn: d _{n} ^{0}] = 0 and

[eqn: i IN LEFT { 1,2,3,4...... RIGHT }]

pi	: total number of packet sent for	i-th Δt

ki	: [eqn: {cases{k _{i-1} +1&```if`p _{i} >m#k _{i-1}&```else}}]  : k0 = 0

If [eqn: d _{n} ^{i}] <  σ, the node n will be considered as a malicious node. The lower trusting value of a node, the less we trust that node. When a  node is considered as a malicious node, the detecting nodes will add this node into their list of malicious nodes. The malicious node will be isolated from the network and all data from that node will be ignored.

Figure 3. MANET with DDoS attack detection

Figure 3 depicts the MANET condition when an attack happens and our detection scheme is applied.

Simulation Result

We used NS2 simulator to implement our proposed method. The DSR routing protocol is available as a part of the simulator. We modified the DSR source code and add method for malicious nodes and for our DDoS detection scheme. For preliminary setting, we used:

Table 1: Preliminary Setting

m	5 packets
Δt	500 ms
σ	-20
T	10 sec

Figure 4 shows the total network throughput per simulation time. Since  our scheme can isolate malicious node in short time, we can keep maintaining the total throughput. Although for a couple of times the throughput is decreased, this happens because of the time which is needed for detection process.

Figure 4. Total throughput

We can also maintain network's effectiveness up to 95% (ratio between packet sent by source and packet received at destination), as depicted in Figure 5.

Figure 5. Total packet sent and received

But due to more congestion, the total number of packet sent and received are smaller than normal case.

Finally we can also maintain the average end-to-end delay when an attack happens. In Figure 6, the average end-to-end delay is rapidly increased when an attack occurs in a network. The first  reason is because the packet will be routed longer than it should be. The   second reason is that  the packet should stay longer on buffer queue due to high traffic. By isolating the malicious node, this cases can be avoided.

Figure 6. Average end-to-end delay

For energy consumption, since we extend the capability of routing protocol so the energy required for our scheme will be similar with the energy required by the routing protocol itself. Table 2 shows the comparison of our proposed method with other related method. The meaning of + and - are merit and demerit, respectively in Table 2.

	[4][6]	[5]	Our Method
Speed	-	+	+
False pos.	+	-	+

Table 2: Comparison

Our proposed method has the advantages both in term of performance and network density awareness which can minimize the rate of false positive.

Conclusion

We propose new direction for network density aware DDoS attack detection in MANET. Our method take the network density into consideration. Furthermore we can reduce the possibility of false positive alarm. Our simulation shows that our method works well and can improve the throughput, network effectiveness, and also can decrease the average end-to-end delay when there is an attack. For our simulation, we select the parameters intuitively. Further work requires to determine the appropriate value for those parameters.

References

[1] D. Johnson, Y. Hu and D. Maltz. "The Dynamic Source Routing Protocol (DSR) for Mobile Ad Hoc Networks for IPv4," http://www.ietf.org/rfc/rfc4728.txt

[2] J. Tingyao, L. Qinghua, and R. Youlin. "Secure Dynamic Source Routing Protocol,"  Porceeding of the Fourth International Conference on Computer and Information Technology (CIT'04), 2004.

[3] "MANET" In Wikipedia: The Free Encyclopedia. Wikimedia Foundation Inc. Encyclopedia on-line. Available from http://en.wikipedia.org/wiki/Mobile_ad_hoc_network. Internet. Retrieved 20 May 2010.

[4] S. Bhargava and D.P. Agrawal "Security Enhancement in AODV Protocol for Wireless Ad Hoc Network," Vehicular Technology Conference, VTC 2001 Fall, IEEE VT S 54, 2001, vol. 4 pg. 2143-2147.

[5]  S. Sugata, A. Ajith,  G. Dhaval,  G. Rajat,  R. Punit, D. Zalak,  and M. Nirali. "Security Scheme for Distributed DoS in Mobile Ad Hoc Networks,"  International Workshop on Distributed Computing,  2004.

[6]  Y.  Zhang and W. Lee. "An Intrusion Detection in Wireless Ad Hoc Networks," ACM MOBICOM, 2000.

[7] Z. Li, J. Liu, D. Li, and Y. Liu. "Security Enhanced AODV Routing Protocol," MSN 2005, LCNS 3794, pp. 298-307, 2005.