FJADA: Friendship Based JellyFish Attack Detection Algorithm for Mobile Ad Hoc Networks

TCP and UDP are considered the most popular and well known transport layer protocols to facilitate the end to end communication between two nodes in the network. TCP is used as the transport layer protocol in packet delivery and error sensitive applications, where packet loss cannot be compromised. However, low-rate TCP targeted Denial of Service (DoS) attacks exploit the retransmission timeout and congestion control features of TCP protocol. These low-rate TCP targeted Denial of Service (DoS) attacks are also called JellyFish (JF) attacks. These attacks perform the malicious activities either by delaying, or periodically dropping or mis-ordering the data packets on the route from source to destination node in the network, and cause severe degradation in end-to-end throughput in the network. JellyFish attack is further classified as JF-Delay Variance Attack, JF-Periodic Drop Attack and JF-Reorder Attack based on the type of the malicious activities being performed. JellyFish attack conforms to all existing routing and packet forwarding protocol specifications, and therefore it becomes very difficult to detect its presence in the network. In this paper, a Friendship Based JellyFish Attack Detection Algorithm (FJADA) is presented for Mobile Ad Hoc Networks, where the basic concept of friendship mechanism is added to the existing Direct Trust-based Detection (DTD) algorithm to save the valuable resources of a node in monitoring the activities of its one hop neighbours, through promiscuous mode. FJADA also minimizes the possibility of overestimating the malicious behaviour of innocent nodes due to radio transmission errors, network congestion or packet collisions. The results obtained throughout the simulation experiments clearly show the feasibility and effectiveness of the proposed detection algorithm.