A comparative evaluation of intrusion detection architectures for mobile ad hoc networks

Abstract

Mobile Ad Hoc Networks (MANETs) are susceptible to a variety of attacks that threaten their operation and the provided services. Intrusion Detection Systems (IDSs) may act as defensive mechanisms, since they monitor network activities in order to detect malicious actions performed by intruders, and then initiate the appropriate countermeasures. IDS for MANETs have attracted much attention recently and thus, there are many publications that propose new IDS solutions or improvements to the existing. This paper evaluates and compares the most prominent IDS architectures for MANETs. IDS architectures are defined as the operational structures of IDSs. For each IDS, the architecture and the related functionality are briefly presented and analyzed focusing on both the operational strengths and weaknesses. Moreover, methods/techniques that have been proposed to improve the performance and the provided security services of those are evaluated and their shortcomings or weaknesses are presented. A comparison of the studied IDS architectures is carried out using a set of critical evaluation metrics, which derive from: (i) the deployment, architectural, and operational characteristics of MANETs; (ii) the special requirements of intrusion detection in MANETs; and (iii) the carried analysis that reveals the most important strengths and weaknesses of the existing IDS architectures. The evaluation metrics of IDSs are divided into two groups: the first one is related to performance and the second to security. Finally, based on the carried evaluation and comparison a set of design features and principles are presented, which have to be addressed and satisfied in future research of designing and implementing IDSs for MANETs.

Introduction

A mobile ad hoc network (MANET) is a collection of autonomous nodes that form a dynamic, purpose-specific, multi-hop radio network in a decentralized fashion. In a MANET, the nodes themselves implement the network management in a cooperative fashion and thus, all the network members share the responsibility for this. The wireless – mobile nature of MANETs in conjunction with the absence of access points, providing access to a centralized authority, make them susceptible to a variety of attacks (Djenouri et al., 2005). An effective way to identify when an attack occurs in a MANET is the deployment of an Intrusion Detection System (IDS). The IDS is a sensoring mechanism that monitors network activity in order to detect malicious actions and, ultimately, an intruder. Upon detecting an intruder, the IDS takes an appropriate action ranging from a mere user notification to a more comprehensive defensive action against the intruder. An IDS can be divided in two main parts: (i) the architecture, which exemplifies the operational structure of the IDS; and (ii) the detection engine, which is the mechanism used to detect malicious behavior(s).

The existing IDS architectures for MANETs fall under three basic categories (Anantvalee and Wu, 2006): (a) stand-alone, (b) cooperative, and (c) hierarchical. The stand-alone architectures use an intrusion detection engine installed at each node utilizing only the node’s local audit data (Jacoby and Davis, 2007, Nadkarni and Mishra, 2004, Lauf et al., 2010). However, the fact that these solutions are relying only on local audit data to resolve malicious behaviors limits them in terms of detection accuracy and the type of attacks that they detect (Sen and Clark, 2009) (due to the distributed nature of MANETs). On the other hand, the cooperative and hierarchical architectures process each host’s audit data locally (i.e., similarly to stand-alone), but they also use collaborative techniques to detect more accurately a wider set of attacks. Thus, the majority of the most recent IDSs for MANETs is based on them (Sen and Clark, 2009). More specifically, the cooperative architectures include an intrusion detection engine installed in every node, which monitors local audit data and exchanges audit data and/or detection outcomes with neighboring nodes in order to resolve inconclusive (based on single node’s audit data) detections. The hierarchical architectures amount to a multilayer approach, by dividing the network into clusters. Specific nodes are selected (based on specific criteria) to act as cluster-heads and undertake various responsibilities and roles in intrusion detection that are usually different from those of the simple cluster members. The latter typically run a lightweight local intrusion detection engine that performs detection only on local audit data, while the cluster-heads run a more comprehensive engine that acts as a second layer of detection based on audit data from all the cluster members.

The employed intrusion detection engines are also classified into three main categories: (i) signature-based engines, which rely on a predefined set of patterns to identify attacks; (ii) anomaly-based engines, which rely on particular models of nodes’ behavior and mark nodes that deviate from these models as malicious; and (iii) specification-based engines, which rely on a set of constrains (i.e., description of the correct operation of programs/protocols) and monitor the execution of programs/protocols with respect to these constraints.

IDS for MANETs have attracted much attention recently and thus, there are many publications that propose new IDS solutions or improvements to the existing focusing on both IDS architectures and detection engines. On the other hand, little work has been done in evaluating and comparing them revealing their advantages as well as their limitations and weakness, which constitute open issues that will drive the next research steps in the area of MANET security. Towards this direction, Sun et al. (2007a) have presented a survey of IDSs for MANETs and wireless sensor networks considering on the detection engines employed. Similarly, Azer et al. (2005) briefly discuss the anomaly-based detection engines used in IDSs for MANETs. However, both works mainly focus on solutions published before 2004 (except for one (Sun et al., 2007b) in the former).

Brutch and Ko (2003) provide a brief analysis of several proposed IDSs for MANETs focusing mainly on their architectures. However, the analyzed solutions have been designed to protect the routing mechanism of the dynamic source routing protocol (DSR), operating as extensions to it, and thus, they do not address the wide area of intrusion detection in MANETs. Mishra et al. (2004) present a more detailed analysis of IDSs for MANETs following: (i) an outline of the security vulnerabilities of MANETs; (ii) some design characteristics of IDSs for MANETs; and (iii) some fundamental requirements that an IDS for MANETs should meet. The architectures of the analyzed IDSs are elaborated and briefly compared with the set of fundamental requirements introduced by the authors. Li and Wei (2004) briefly overview some IDS architectures for MANETs and compare them in terms of implementation-specific issues. Anantvalee and Wu (2006) perform a more comprehensive analysis of some IDS architectures for MANETs. Finally, Sen and Clark (2009) present the latest survey of IDSs for MANETs, revealing the weaknesses of each one. However, the studied IDS solutions in the aforementioned works have been published before 2006. Moreover, the considered architectures are hardly evaluated and compared with respect to performance and security factors, such as the consumption of processing and communication resources, the fair distribution of the workload among the network nodes, the impact of nodes’ mobility on the detection accuracy and the rate of false positives, the vulnerabilities of the architectures to attacks, etc.

This paper evaluates and compares the most prominent IDS architectures for MANETs, which represent the most recent developments in this area. For each IDS, the architecture and the related functionality are briefly presented and analyzed focusing on both the operational strengths and weaknesses. Moreover, methods/techniques that have been proposed to improve the performance and the provided security services of those are evaluated and their shortcomings or weaknesses are presented. A comparison of the studied IDS architectures is carried out using a set of critical evaluation metrics, which derive from: (i) the deployment, architectural, and operational characteristics of MANETs; (ii) the special requirements of intrusion detection in MANETs; and (iii) the carried analysis that reveals the most important strengths and weaknesses of the existing IDS architectures. The evaluation metrics of IDSs are divided into two groups: the first one is related to performance and the second to security. Finally, based on the carried evaluation and comparison a set of design features and principles are presented, which have to be addressed and satisfied in future research of designing and implementing IDSs for MANETs.

The rest of this article is organized as follows. Sections 2 Stand-alone IDS architectures, 3 Cooperative IDS architectures, 4 Hierarchical IDS architectures briefly analyze and evaluate the stand-alone, cooperative and hierarchical IDS architectures for MANETs, respectively, focusing on their advantages and limitations. Section 5 compares the studied IDS architectures, using a set of performance and security metrics. Section 6 highlights some design features and principles that are derived from the carried analysis, evaluation, and comparison. Finally, Section 7 contains the conclusions.