NDLI: Infrastructures and algorithms for distributed anomaly-based intrusion detection in mobile ad-hoc networks

Content Provider	IEEE Xplore Digital Library
Author	Cabrera, J.B.D. Gutierrez, C. Mehra, R.K.
Copyright Year	2005
Description	Author affiliation: Sci. Syst. Co., Inc., Woburn, MA (Cabrera, J.B.D.; Gutierrez, C.; Mehra, R.K.)
Abstract	This paper addresses one aspect of the problem of defending mobile ad-hoc networks (MANETs) against computer attacks, namely, the development of a distributed anomaly-based intrusion detection system. In a general sense, the proposed system is a co-located sensor network, in which the monitored variable is the health of the network being monitored. A three level hierarchical system for data collection, processing and transmission is described. Local IDSs (intrusion detection systems) are attached to each node of the MANET, collecting raw data of network operation, and computing a local anomaly index measuring the difference between the current node operation and a baseline of normal operation. Anomaly indexes from nodes belonging to a cluster are periodically transmitted to a cluster head, which fuses the node indexes producing a cluster-level anomaly index. Likewise, cluster heads periodically transmit these cluster-level anomaly indexes to a manager node, which fuses the cluster-level indexes into a network-level anomaly index. Due to network mobility, cluster membership and cluster heads are time varying. The paper describes: (1) clustering algorithms to update cluster centers; (2) machine learning algorithms for computing the local anomaly indexes; (3) a statistical scheme for fusing the anomaly indexes at the cluster heads and at the manager. The statistical scheme is formally shown to increase detection accuracy under idealized assumptions. These algorithms were implemented and tested under the following conditions. Routing schemes: AODV (ad-hoc on demand distance vector routing) and OLSR (optimized link state routing); mobility patterns: random walk mobility model and reference point group mobility at various speeds; types of attacks: traffic flooding denial-of-service and black hole. For performance evaluation we determined the ROC (receiver operating characteristics) for various operational conditions at the nodes, cluster heads and manager. The overall results confirm the effectiveness of the infrastructures and algorithms described in the paper, with detection accuracy generally improving as we move up in the hierarchy, i.e. detection accuracy at the cluster level is higher than at local level, while network-level detection outperforms cluster-level detection
Starting Page	1831
Ending Page	1837
File Size	346447
Page Count	7
File Format	PDF
ISBN	0780393937
DOI	10.1109/MILCOM.2005.1605939
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2005-10-17
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Intrusion detection Ad hoc networks Magnetic heads Clustering algorithms Machine learning algorithms Routing Computer networks Computerized monitoring Fuses Mobile computing
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in