A Comprehensive Survey on Anomaly-Based Intrusion Detection in MANET
---
paper_title: System Health and Intrusion Monitoring Using a Hierarchy of Constraints

paper_content:

This paper presents a new approach to run-time security monitoring that can detect system abnormalities including attacks, faults, or operational errors. The approach, System Health and Intrusion Monitoring (SHIM), employs a hierarchy of constraints to describe correct operation of a system at various levels of abstraction. The constraints capture static behavior, dynamic behavior, and time-critical behavior of a system. A system in execution will be monitored for violation of the constraints, which may indicate potential security problems in the system. SHIM is based on specification-based intrusion detection, but it attempts to provide a systematic framework for developing the specifications/ constraints. SHIM does not detect directly the intrusive actions in an attack, but their manifestations as violations of constraints. In this paper, we describe the constraint model and the methodology for developing the constraints. In addition, we present preliminary results on the constraints developed for host programs and network protocols. By bounding the behavior of various system components at different levels of abstraction, SHIM has a high chance of detecting different types of attacks and their variants.
---
paper_title: Real-time intrusion detection for ad hoc networks

paper_content:

A mobile ad hoc network is a collection of nodes that are connected through a wireless medium and form rapidly changing topologies. The widely accepted existing routing protocols designed to accommodate the needs of such self-organised networks do not address possible threats aimed at the disruption of the protocol itself. The assumption of a trusted environment is not one that can be realistically expected; hence several efforts have been made towards the design of a secure routing protocol for ad hoc networks. The main problems with this approach are that it requires changes to the underlying routing protocol and that manual configuration of the initial security associations cannot be completely avoided. We propose RIDAN, a novel architecture that uses knowledge-based intrusion detection techniques to detect, in real-time, attacks that an adversary can perform against the routing fabric of a mobile ad hoc network. Our system is designed to take countermeasures minimising the effectiveness of an attack and maintaining the performance of the network within acceptable limits. RIDAN does not introduce any changes to the underlying routing protocol since it operates as an intermediate component between the network traffic and the utilised protocol with minimum processing overhead. We have developed a prototype that was evaluated in AODV-enabled networks using the ns-2 network simulator.
---
paper_title: Comparative study of Distributed Intrusion Detection in Ad-hoc Networks

paper_content:

In recent years ad hoc networks are widely used because of mobility and open architecture nature. But new technology always comes with its own set of problems. Security of ad hoc network is an area of widespread research in recent years. Some unique characteristics of ad hoc network itself are an immense dilemma in the way of security. In this paper we have presented study about characteristics of ad hoc network, how they are problematic in ad hoc network security, attacks in ad hoc network and brief description of some existing intrusion detection system. We have also justified why distributed intrusion detection is better for ad hoc network with comparative study of existing intrusion detections in ad hoc network.
---
paper_title: Multivariate Statistical Analysis of Audit Trails for Host-Based Intrusion Detection

paper_content:

Intrusion detection complements prevention mechanisms, such as firewalls, cryptography, and authentication, to capture intrusions into an information system while they are acting on the information system. Our study investigates a multivariate quality control technique to detect intrusions by building a long-term profile of normal activities in information systems (norm profile) and using the norm profile to detect anomalies. The multivariate quality control technique is based on Hotelling's T/sup 2/ test that detects both counterrelationship anomalies and mean-shift anomalies. The performance of the Hotelling's T/sup 2/ test is examined on two sets of computer audit data: a small data set and a large multiday data set. Both data sets contain sessions of normal and intrusive activities. For the small data set, the Hotelling's T/sup 2/ test signals all the intrusion sessions and produces no false alarms for the normal sessions. For the large data set, the Hotelling's T/sup 2/ test signals 92 percent of the intrusion sessions while producing no false alarms for the normal sessions. The performance of the Hotelling's T/sup 2/ test is also compared with the performance of a more scalable multivariate technique-a chi-squared distance test.
---
paper_title: Specification-based anomaly detection: a new approach for detecting network intrusions

paper_content:

Unlike signature or misuse based intrusion detection techniques, anomaly detection is capable of detecting novel attacks. However, the use of anomaly detection in practice is hampered by a high rate of false alarms. Specification-based techniques have been shown to produce a low rate of false alarms, but are not as effective as anomaly detection in detecting novel attacks, especially when it comes to network probing and denial-of-service attacks. This paper presents a new approach that combines specification-based and anomaly-based intrusion detection, mitigating the weaknesses of the two approaches while magnifying their strengths. Our approach begins with state-machine specifications of network protocols, and augments these state machines with information about statistics that need to be maintained to detect anomalies. We present a specification language in which all of this information can be captured in a succinct manner. We demonstrate the effectiveness of the approach on the 1999 Lincoln Labs intrusion detection evaluation data, where we are able to detect all of the probing and denial-of-service attacks with a low rate of false alarms (less than 10 per day). Whereas feature selection was a crucial step that required a great deal of expertise and insight in the case of previous anomaly detection approaches, we show that the use of protocol specifications in our approach simplifies this problem. Moreover, the machine learning component of our approach is robust enough to operate without human supervision, and fast enough that no sampling techniques need to be employed. As further evidence of effectiveness, we present results of applying our approach to detect stealthy email viruses in an intranet environment.
---
paper_title: Stochastic protocol modeling for anomaly based network intrusion detection

paper_content:

A new method for detecting anomalies in the usage of protocols in computer networks is presented. The proposed methodology is applied to TCP and disposed in two steps. First, a quantization of the TCP header space is accomplished, so that a unique symbol is associated with each TCP segment. TCP-based network traffic is thus captured, quantized and represented by a sequence of symbols. The second step in our approach is the modeling of these sequences by means of a Markov chain. The analysis of the model obtained for diverse TCP sources reveals that it captures adequately the essence of the protocol dynamics. Once the model is built it is possible to use it as a representation of the normal usage of the protocol, so that deviations from the behavior provided by the model can be considered as a sign of protocol misusage.
---
paper_title: Detection of Web-based attacks through Markovian protocol parsing

paper_content:

This paper presents a novel approach based on the monitoring of incoming HTTP requests to detect attacks against Web servers. The detection is accomplished through a Markovian model whose states and transitions between them are determined from the specification of the HTTP protocol while the probabilities of the symbols associated to the Markovian source are obtained during a training stage according to a set of attack-free requests for the target server. The experiments carried out show a high detection capability with low false positive rates at reasonable computation requirements.
---
paper_title: Host-Based Intrusion Detection Using Dynamic and Static Behavioral Models

paper_content:

Intrusion detection has emerged as an important approach to network security. In this paper, we adopt an anomaly detection approach by detecting possible intrusions based on program or user profiles built from normal usage data. In particular, program profiles based on Unix system calls and user profiles based on Unix shell commands are modeled using two different types of behavioral models for data mining. The dynamic modeling approach is based on hidden Markov models (HMM) and the principle of maximum likelihood, while the static modeling approach is based on event occurrence frequency distributions and the principle of minimum cross entropy. The novelty detection approach is adopted to estimate the model parameters using normal training data only, as opposed to the classification approach which has to use both normal and intrusion data for training. To determine whether or not a certain behavior is similar enough to the normal model and hence should be classified as normal, we use a scheme that can be justified from the perspective of hypothesis testing. Our experimental results show that the dynamic modeling approach is better than the static modeling approach for the system call datasets, while the dynamic modeling approach is worse for the shell command datasets. Moreover, the static modeling approach is similar in performance to instance-based learning reported previously by others for the same shell command database but with much higher computational and storage requirements than our method.
---
paper_title: Use of K-Nearest Neighbor Classifier for Intrusion Detection

paper_content:

A new approach, based on the k-Nearest Neighbor (kNN) classifier, is used to classify program behavior as normal or intrusive. Program behavior, in turn, is represented by frequencies of system calls. Each system call is treated as a word and the collection of system calls over each program execution as a document. These documents are then classified using kNN classifier, a popular method in text categorization. This method seems to offer some computational advantages over those that seek to characterize program behavior with short sequences of system calls and generate individual program profiles. Preliminary experiments with 1998 DARPA BSM audit data show that the kNN classifier can effectively detect intrusive attacks and achieve a low false positive rate.
---
paper_title: Bayesian event classification for intrusion detection

paper_content:

Intrusion detection systems (IDSs) attempt to identify attacks by comparing collected data to predefined signatures known to be malicious (misuse-based IDSs) or to a model of legal behavior (anomaly-based IDSs). Anomaly-based approaches have the advantage of being able to detect previously unknown attacks, but they suffer from the difficulty of building robust models of acceptable behavior, which may result in a large number of false alarms. Almost all current anomaly-based intrusion detection systems classify an input event as normal or anomalous by analyzing its features, utilizing a number of different models. A decision for an input event is made by aggregating the results of all employed models. We have identified two reasons for the large number of false alarms, caused by incorrect classification of events in current systems. One is the simplistic aggregation of model outputs in the decision phase. Often, only the sum of the model results is calculated and compared to a threshold. The other reason is the lack of integration of additional information into the decision process. This additional information can be related to the models, such as the confidence in a model's output, or can be extracted from external sources. To mitigate these shortcomings, we propose an event classification scheme that is based on Bayesian networks. Bayesian networks improve the aggregation of different model outputs and allow one to seamlessly incorporate additional information. Experimental results show that the accuracy of the event classification process is significantly improved using our proposed approach.
---
paper_title: Learning nonstationary models of normal network traffic for detecting novel attacks

paper_content:

Traditional intrusion detection systems (IDS) detect attacks by comparing current behavior to signatures of known attacks. One main drawback is the inability of detecting new attacks which do not have known signatures. In this paper we propose a learning algorithm that constructs models of normal behavior from attack-free network traffic. Behavior that deviates from the learned normal model signals possible novel attacks. Our IDS is unique in two respects. First, it is nonstationary, modeling probabilities based on the time since the last event rather than on average rate. This prevents alarm floods. Second, the IDS learns protocol vocabularies (at the data link through application layers) in order to detect unknown attacks that attempt to exploit implementation errors in poorly tested features of the target software. On the 1999 DARPA IDS evaluation data set [9], we detect 70 of 180 attacks (with 100 false alarms), about evenly divided between user behavioral anomalies (IP addresses and ports, as modeled by most other systems) and protocol anomalies. Because our methods are unconventional there is a significant non-overlap of our IDS with the original DARPA participants, which implies that they could be combined to increase coverage.
---
paper_title: Fuzzy network profiling for intrusion detection

paper_content:

The Fuzzy Intrusion Recognition Engine (FIRE) is an anomaly-based intrusion detection system that uses fuzzy logic to assess whether malicious activity is taking place on a network. It uses simple data mining techniques to process the network input data and help expose metrics that are particularly significant to anomaly detection. These metrics are then evaluated as fuzzy sets. FIRE uses a fuzzy analysis engine to evaluate the fuzzy inputs and trigger alert levels for the security administrator. This paper describes the components in the FIRE architecture and explains their roles. Particular attention is given to explaining the benefits of data mining and how this can improve the meaningfulness of the fuzzy sets. Fuzzy rules are developed for some common intrusion detection scenarios. The results of tests with actual network data and actual malicious attacks are described. The FIRE IDS can detect a wide-range of common attack types.
---
paper_title: Fuzzy Data Mining And Genetic Algorithms Applied To Intrusion Detection

paper_content:

We are developing a prototype intelligent intrusion detection system (IIDS) to demonstrate the effectiveness of data mining techniques that utilize fuzzy logic and genetic algorithms. This system combines both anomaly based intrusion detection using fuzzy data mining techniques and misuse detection using traditional rule-based expert system techniques. The anomaly-based components are developed using fuzzy data mining techniques. They look for deviations from stored patterns of normal behavior. Genetic algorithms are used to tune the fuzzy membership functions and to select an appropriate set of features. The misuse detection components look for previously described patterns of behavior that are likely to indicate an intrusion. Both network traffic and system audit data are used as inputs for both components.
---
paper_title: Intrusion Detection in Wireless Ad Hoc Networks

paper_content:

Intrusion detection has, over the last few years, assumed paramount importance within the broad realm of network security and it has significant impact on wireless ad hoc networks. These networks do not have an underlying infrastructure and the network topology constantly changes. The inherently vulnerable characteristics of wireless ad hoc networks make them susceptible to attacks, and it may be difficult to control before any prevention works out. Secondly, with so much advancement in hacking, if attackers use sophisticated technology, they will eventually succeed in infiltrating the system. This makes it important to constantly or periodically monitor what is taking place on a system and look for suspicious behavior. Intrusion detection systems (IDS)monitor audit data, look for intrusions to the system, and initiate a proper response. In this paper, we present a method for determining critical path that use the distributed security scheme to find out the malicious node. The nodes with the help of the critical links will find out the malicious node using distributed security scheme and inform all the nodes about malicious node. The simulation results describe the details of the critical path test.
---
paper_title: Intrusion Detection Techniques for Mobile Wireless Networks

paper_content:

The rapid proliferation of wireless networks and mobile computing applications has changed the landscape of network security. The traditional way of protecting networks with firewalls and encryption software is no longer sufficient and effective. We need to search for new architecture and mechanisms to protect the wireless networks and mobile computing application. In this paper, we examine the vulnerabilities of wireless networks and argue that we must include intrusion detection in the security architecture for mobile computing environment. We have developed such an architecture and evaluated a key mechanism in this architecture, anomaly detection for mobile ad-hoc network, through simulation experiments.
---
paper_title: Alert aggregation in mobile ad hoc networks

paper_content:

In Intrusion Detection Systems (IDSs) for Mobile Ad hoc NETworks (MANETs), IDS agents using local detection engines alone may lead to undesirable performance due to the dynamic feature of MANETs. In this paper, we present a nonoverlapping Zone-based Intrusion Detection System (ZBIDS) for MANETs. Focusing on the protection of MANET routing protocols, we propose the collaboration mechanism of ZBIDS agents and an aggregation algorithm used by ZBIDS gateway nodes. The aggregation algorithm mainly utilizes the probability distribution of the $Source$ attribute in order to make the final decisions to generate alarms. We demonstrate that, by integrating the security related information from a wider area, the aggregation algorithm can reduce the false alarm ratio and improve the detection ratio. Also, the gateway nodes in ZBIDS can provide more diagnostic information by presenting a global view of attacks. We also present an alert data model conformed to Intrusion Detection Message Exchange Format (IDMEF) to facilitate the interoperability of IDS agents. Based on the routing disruption attack aimed at the Dynamic Source Routing protocol (DSR), we study the performance of ZBIDS at different mobility levels. Simulation results show that our system can achieve lower false positive ratio and higher detection ratio, compared to systems with local detection only.
---
paper_title: Effective intrusion detection using multiple sensors in wireless ad hoc networks

paper_content:

In this paper we propose a distributed intrusion detection system for ad hoc wireless networks based on mobile agent technology. Wireless networks are particularly vulnerable to intrusion, as they operate in open medium, and use cooperative strategies for network communications. By efficiently merging audit data from multiple network sensors, we analyze the entire ad hoc wireless network for intrusions and try to inhibit intrusion attempts. In contrast to many intrusion detection systems designed for wired networks, we implement an efficient and bandwidth-conscious framework that targets intrusion at multiple levels and takes into account distributed nature of ad hoc wireless network management and decision policies.
---
paper_title: Intrusion Detection in Wireless Ad Hoc Networks

paper_content:

Intrusion detection has, over the last few years, assumed paramount importance within the broad realm of network security and it has significant impact on wireless ad hoc networks. These networks do not have an underlying infrastructure and the network topology constantly changes. The inherently vulnerable characteristics of wireless ad hoc networks make them susceptible to attacks, and it may be difficult to control before any prevention works out. Secondly, with so much advancement in hacking, if attackers use sophisticated technology, they will eventually succeed in infiltrating the system. This makes it important to constantly or periodically monitor what is taking place on a system and look for suspicious behavior. Intrusion detection systems (IDS)monitor audit data, look for intrusions to the system, and initiate a proper response. In this paper, we present a method for determining critical path that use the distributed security scheme to find out the malicious node. The nodes with the help of the critical links will find out the malicious node using distributed security scheme and inform all the nodes about malicious node. The simulation results describe the details of the critical path test.
---
paper_title: Intrusion Detection Techniques for Mobile Wireless Networks

paper_content:

The rapid proliferation of wireless networks and mobile computing applications has changed the landscape of network security. The traditional way of protecting networks with firewalls and encryption software is no longer sufficient and effective. We need to search for new architecture and mechanisms to protect the wireless networks and mobile computing application. In this paper, we examine the vulnerabilities of wireless networks and argue that we must include intrusion detection in the security architecture for mobile computing environment. We have developed such an architecture and evaluated a key mechanism in this architecture, anomaly detection for mobile ad-hoc network, through simulation experiments.
---
paper_title: Alert aggregation in mobile ad hoc networks

paper_content:

In Intrusion Detection Systems (IDSs) for Mobile Ad hoc NETworks (MANETs), IDS agents using local detection engines alone may lead to undesirable performance due to the dynamic feature of MANETs. In this paper, we present a nonoverlapping Zone-based Intrusion Detection System (ZBIDS) for MANETs. Focusing on the protection of MANET routing protocols, we propose the collaboration mechanism of ZBIDS agents and an aggregation algorithm used by ZBIDS gateway nodes. The aggregation algorithm mainly utilizes the probability distribution of the $Source$ attribute in order to make the final decisions to generate alarms. We demonstrate that, by integrating the security related information from a wider area, the aggregation algorithm can reduce the false alarm ratio and improve the detection ratio. Also, the gateway nodes in ZBIDS can provide more diagnostic information by presenting a global view of attacks. We also present an alert data model conformed to Intrusion Detection Message Exchange Format (IDMEF) to facilitate the interoperability of IDS agents. Based on the routing disruption attack aimed at the Dynamic Source Routing protocol (DSR), we study the performance of ZBIDS at different mobility levels. Simulation results show that our system can achieve lower false positive ratio and higher detection ratio, compared to systems with local detection only.
---

Title: A Comprehensive Survey on Anomaly-Based Intrusion Detection in MANET
Section 1: Introduction
Description 1: This section introduces the concept of Mobile Ad Hoc Networks (MANETs) and discusses their advantages and inherent security vulnerabilities.

Section 2: Intrusion Detection Systems
Description 2: This section discusses the vital role of Intrusion Detection Systems (IDS) in securing MANETs and explains their multi-layer protection strategy.

Section 3: Classification of Intrusion Detection System
Description 3: This section classifies IDSs based on data collection mechanisms (Host-based and Network-based) and detection techniques (misuse-based, anomaly-based, and specification-based).

Section 4: Architecture of IDS
Description 4: This section presents different architectures for IDS in MANETs, including stand-alone, distributed and cooperative, hierarchical, and mobile agent-based systems.

Section 5: Anomaly-Based Detection Techniques
Description 5: This section categorizes anomaly-based detection techniques into statistical-based, knowledge-based, and machine learning-based methods, detailing the strengths and weaknesses of each.

Section 6: Analysis and Evaluation of Anomaly-Based Detection System
Description 6: This section evaluates various anomaly-based detection systems proposed for MANETs, highlighting their main capabilities, benefits, and limitations.

Section 7: Discussion and Summary
Description 7: This section summarizes the critical aspects of IDS and highlights the advantages and challenges of different architectures and anomaly-based detection techniques in MANETs.

Section 8: Conclusion and Further Guidelines
Description 8: This section concludes the survey by suggesting future research directions, such as using game theory and Bayesian networks, and emphasizes the need for combined detection techniques and protecting IDS themselves.