IDSs based on Stand-alone Architecture for MANET: A Survey
---
paper_title: A cooperative intrusion detection system for ad hoc networks

paper_content:

Mobile ad hoc networking (MANET) has become an exciting and important technology in recent years because of the rapid proliferation of wireless devices. MANETs are highly vulnerable to attacks due to the open medium, dynamically changing network topology, cooperative algorithms, lack of centralized monitoring and management point, and lack of a clear line of defense. In this paper, we report our progress in developing intrusion detection (ID) capabilities for MANET. Building on our prior work on anomaly detection, we investigate how to improve the anomaly detection approach to provide more details on attack types and sources. For several well-known attacks, we can apply a simple rule to identify the attack type when an anomaly is reported. In some cases, these rules can also help identify the attackers. We address the run-time resource constraint problem using a cluster-based detection scheme where periodically a node is elected as the ID agent for a cluster. Compared with the scheme where each node is its own ID agent, this scheme is much more efficient while maintaining the same level of effectiveness. We have conducted extensive experiments using the ns-2 and MobiEmu environments to validate our research.
---
paper_title: Observation-based Cooperation Enforcement in Ad Hoc Networks

paper_content:

Ad hoc networks rely on the cooperation of the nodes participating in the network to forward packets for each other. A node may decide not to cooperate to save its resources while still using the network to relay its traffic. If too many nodes exhibit this behavior, network performance degrades and cooperating nodes may find themselves unfairly loaded. Most previous efforts to counter this behavior have relied on further cooperation between nodes to exchange reputation information about other nodes. If a node observes another node not participating correctly, it reports this observation to other nodes who then take action to avoid being affected and potentially punish the bad node by refusing to forward its traffic. Unfortunately, such second-hand reputation information is subject to false accusations and requires maintaining trust relationships with other nodes. The objective of OCEAN is to avoid this trust-management machinery and see how far we can get simply by using direct first-hand observations of other nodes' behavior. We find that, in many scenarios, OCEAN can do as well as, or even better than, schemes requiring second-hand reputation exchanges. This encouraging result could possibly help obviate solutions requiring trust-management for some contexts.
---
paper_title: Feature Analysis for Intrusion Detection in Mobile Ad-hoc Networks

paper_content:

As Mobile Ad-hoc network (MANET) has become a very important technology, research concerning its security problem, especially, in intrusion detection has attracted many researchers. Feature selection methodology plays a central role in the data analysis process. The proposed features are tested in difierent network operating conditions. PCA is used to analyze the selected features. This is because, redundant and irrelevant features often reduce performance of the detection system. Performance reduction will occur both in speed and predictive accuracy. This paper aims to select and analyze the network features using principal component analysis. In this paper, performing various experiments, normal and attack states are simulated and the results for the selected features are analyzed.
---
paper_title: Observation-based Cooperation Enforcement in Ad Hoc Networks

paper_content:

Ad hoc networks rely on the cooperation of the nodes participating in the network to forward packets for each other. A node may decide not to cooperate to save its resources while still using the network to relay its traffic. If too many nodes exhibit this behavior, network performance degrades and cooperating nodes may find themselves unfairly loaded. Most previous efforts to counter this behavior have relied on further cooperation between nodes to exchange reputation information about other nodes. If a node observes another node not participating correctly, it reports this observation to other nodes who then take action to avoid being affected and potentially punish the bad node by refusing to forward its traffic. Unfortunately, such second-hand reputation information is subject to false accusations and requires maintaining trust relationships with other nodes. The objective of OCEAN is to avoid this trust-management machinery and see how far we can get simply by using direct first-hand observations of other nodes' behavior. We find that, in many scenarios, OCEAN can do as well as, or even better than, schemes requiring second-hand reputation exchanges. This encouraging result could possibly help obviate solutions requiring trust-management for some contexts.
---
paper_title: A novel intrusion detection approach for wireless ad hoc networks

paper_content:

The potential for rapid and infrastructure-less deployment in harsh geographic terrain as well as in conference-room like scenarios has propelled research on wireless ad hoc networks (MANETs). However, these networks are vulnerable to attackers due to certain inherently vulnerable characteristics. With intrusion prevention measures not guaranteed to work all the time, the need to constantly monitor what is going on in a system and look for intrusions is fulfilled by intrusion detection systems (IDS). In this paper we have proposed a novel and robust IDS for MANETs that aims to combine misuse with anomaly detection. Our protocol-independent design makes use of a self-adjusting threshold scheme that detects a priori known attack patterns with over 90% accuracy and is generally insensitive to false alarms. Experimental results indicate the non-degradability of network performance when our IDS is incorporated in the routing algorithm for security enhancements.
---
paper_title: Mobile Host-Based intrusion Detection and Attack Identification

paper_content:

Although much attention has focused on optimizing power in batteries for mobile devices, little attention to date has focused on battery constraints to determine if an attack is present. This research proposes that resident monitoring of the demands placed on a battery's current (mA) and other system processes can be used as an early-warning, trip-wire-like sensor for mobile hosts as a means to block attacks as well as to identify them.
---
paper_title: A Dynamic Anomaly Detection Scheme for AODV-Based Mobile Ad Hoc Networks

paper_content:

Mobile ad hoc networks (MANETs) are usually formed without any major infrastructure. As a result, they are relatively vulnerable to malicious network attacks, and therefore, security is a more significant issue than infrastructure-based wireless networks. In MANETs, it is difficult to identify malicious hosts as the topology of the network dynamically changes. A malicious host can easily interrupt a route for which it is one of the forming nodes in the communication path. In the literature, there are several proposals to detect such malicious hosts inside the network. In those methods, a baseline profile, which is defined as per static training data, is usually used to verify the identity and the topology of the network, thus preventing any malicious host from joining the network. Since the topology of a MANET dynamically changes, the mere use of a static baseline profile is not efficient. In this paper, we propose a new anomaly-detection scheme based on a dynamic learning process that allows the training data to be updated at particular time intervals. Our dynamic learning process involves calculating the projection distances based on multidimensional statistics using weighted coefficients and a forgetting curve. We use the network simulator 2 (ns-2) system to conduct the MANET simulations and consider scenarios for detecting five types of attacks. The simulation results involving two different networks in size show the effectiveness of the proposed techniques.
---
paper_title: Cross-Layer Detection of Sinking Behavior in Wireless Ad Hoc Networks Using SVM and FDA

paper_content:

The uniqueness of security vulnerabilities in ad hoc networks has given rise to the need for designing novel intrusion detection algorithms, different from those present in conventional networks. In this work, we propose an autonomous host-based intrusion detection system for detecting malicious sinking behavior. The proposed detection system maximizes the detection accuracy by using cross-layer features to define a routing behavior. For learning and adaptation to new attack scenarios and network environments, two machine learning techniques are utilized. Support Vector Machines (SVMs) and Fisher Discriminant Analysis (FDA) are used together to exploit the better accuracy of SVM and faster speed of FDA. Instead of using all cross-layer features, features from MAC layer are associated/correlated with features from other layers, thereby reducing the feature set without reducing the information content. Various experiments are conducted with varying network conditions and malicious node behavior. The effects of factors such as mobility, traffic density, and the packet drop ratios of the malicious nodes are analyzed. Experiments based on simulation show that the proposed cross-layer approach aided by a combination of SVM and FDA performs significantly better than other existing approaches.
---
paper_title: Observation-based Cooperation Enforcement in Ad Hoc Networks

paper_content:

Ad hoc networks rely on the cooperation of the nodes participating in the network to forward packets for each other. A node may decide not to cooperate to save its resources while still using the network to relay its traffic. If too many nodes exhibit this behavior, network performance degrades and cooperating nodes may find themselves unfairly loaded. Most previous efforts to counter this behavior have relied on further cooperation between nodes to exchange reputation information about other nodes. If a node observes another node not participating correctly, it reports this observation to other nodes who then take action to avoid being affected and potentially punish the bad node by refusing to forward its traffic. Unfortunately, such second-hand reputation information is subject to false accusations and requires maintaining trust relationships with other nodes. The objective of OCEAN is to avoid this trust-management machinery and see how far we can get simply by using direct first-hand observations of other nodes' behavior. We find that, in many scenarios, OCEAN can do as well as, or even better than, schemes requiring second-hand reputation exchanges. This encouraging result could possibly help obviate solutions requiring trust-management for some contexts.
---
paper_title: Feature Analysis for Intrusion Detection in Mobile Ad-hoc Networks

paper_content:

As Mobile Ad-hoc network (MANET) has become a very important technology, research concerning its security problem, especially, in intrusion detection has attracted many researchers. Feature selection methodology plays a central role in the data analysis process. The proposed features are tested in difierent network operating conditions. PCA is used to analyze the selected features. This is because, redundant and irrelevant features often reduce performance of the detection system. Performance reduction will occur both in speed and predictive accuracy. This paper aims to select and analyze the network features using principal component analysis. In this paper, performing various experiments, normal and attack states are simulated and the results for the selected features are analyzed.
---
paper_title: Cross-Layer Detection of Sinking Behavior in Wireless Ad Hoc Networks Using SVM and FDA

paper_content:

The uniqueness of security vulnerabilities in ad hoc networks has given rise to the need for designing novel intrusion detection algorithms, different from those present in conventional networks. In this work, we propose an autonomous host-based intrusion detection system for detecting malicious sinking behavior. The proposed detection system maximizes the detection accuracy by using cross-layer features to define a routing behavior. For learning and adaptation to new attack scenarios and network environments, two machine learning techniques are utilized. Support Vector Machines (SVMs) and Fisher Discriminant Analysis (FDA) are used together to exploit the better accuracy of SVM and faster speed of FDA. Instead of using all cross-layer features, features from MAC layer are associated/correlated with features from other layers, thereby reducing the feature set without reducing the information content. Various experiments are conducted with varying network conditions and malicious node behavior. The effects of factors such as mobility, traffic density, and the packet drop ratios of the malicious nodes are analyzed. Experiments based on simulation show that the proposed cross-layer approach aided by a combination of SVM and FDA performs significantly better than other existing approaches.
---
paper_title: A Dynamic Anomaly Detection Scheme for AODV-Based Mobile Ad Hoc Networks

paper_content:

Mobile ad hoc networks (MANETs) are usually formed without any major infrastructure. As a result, they are relatively vulnerable to malicious network attacks, and therefore, security is a more significant issue than infrastructure-based wireless networks. In MANETs, it is difficult to identify malicious hosts as the topology of the network dynamically changes. A malicious host can easily interrupt a route for which it is one of the forming nodes in the communication path. In the literature, there are several proposals to detect such malicious hosts inside the network. In those methods, a baseline profile, which is defined as per static training data, is usually used to verify the identity and the topology of the network, thus preventing any malicious host from joining the network. Since the topology of a MANET dynamically changes, the mere use of a static baseline profile is not efficient. In this paper, we propose a new anomaly-detection scheme based on a dynamic learning process that allows the training data to be updated at particular time intervals. Our dynamic learning process involves calculating the projection distances based on multidimensional statistics using weighted coefficients and a forgetting curve. We use the network simulator 2 (ns-2) system to conduct the MANET simulations and consider scenarios for detecting five types of attacks. The simulation results involving two different networks in size show the effectiveness of the proposed techniques.
---
paper_title: A novel intrusion detection approach for wireless ad hoc networks

paper_content:

The potential for rapid and infrastructure-less deployment in harsh geographic terrain as well as in conference-room like scenarios has propelled research on wireless ad hoc networks (MANETs). However, these networks are vulnerable to attackers due to certain inherently vulnerable characteristics. With intrusion prevention measures not guaranteed to work all the time, the need to constantly monitor what is going on in a system and look for intrusions is fulfilled by intrusion detection systems (IDS). In this paper we have proposed a novel and robust IDS for MANETs that aims to combine misuse with anomaly detection. Our protocol-independent design makes use of a self-adjusting threshold scheme that detects a priori known attack patterns with over 90% accuracy and is generally insensitive to false alarms. Experimental results indicate the non-degradability of network performance when our IDS is incorporated in the routing algorithm for security enhancements.
---
paper_title: Cross-Layer Detection of Sinking Behavior in Wireless Ad Hoc Networks Using SVM and FDA

paper_content:

The uniqueness of security vulnerabilities in ad hoc networks has given rise to the need for designing novel intrusion detection algorithms, different from those present in conventional networks. In this work, we propose an autonomous host-based intrusion detection system for detecting malicious sinking behavior. The proposed detection system maximizes the detection accuracy by using cross-layer features to define a routing behavior. For learning and adaptation to new attack scenarios and network environments, two machine learning techniques are utilized. Support Vector Machines (SVMs) and Fisher Discriminant Analysis (FDA) are used together to exploit the better accuracy of SVM and faster speed of FDA. Instead of using all cross-layer features, features from MAC layer are associated/correlated with features from other layers, thereby reducing the feature set without reducing the information content. Various experiments are conducted with varying network conditions and malicious node behavior. The effects of factors such as mobility, traffic density, and the packet drop ratios of the malicious nodes are analyzed. Experiments based on simulation show that the proposed cross-layer approach aided by a combination of SVM and FDA performs significantly better than other existing approaches.
---
paper_title: Observation-based Cooperation Enforcement in Ad Hoc Networks

paper_content:

Ad hoc networks rely on the cooperation of the nodes participating in the network to forward packets for each other. A node may decide not to cooperate to save its resources while still using the network to relay its traffic. If too many nodes exhibit this behavior, network performance degrades and cooperating nodes may find themselves unfairly loaded. Most previous efforts to counter this behavior have relied on further cooperation between nodes to exchange reputation information about other nodes. If a node observes another node not participating correctly, it reports this observation to other nodes who then take action to avoid being affected and potentially punish the bad node by refusing to forward its traffic. Unfortunately, such second-hand reputation information is subject to false accusations and requires maintaining trust relationships with other nodes. The objective of OCEAN is to avoid this trust-management machinery and see how far we can get simply by using direct first-hand observations of other nodes' behavior. We find that, in many scenarios, OCEAN can do as well as, or even better than, schemes requiring second-hand reputation exchanges. This encouraging result could possibly help obviate solutions requiring trust-management for some contexts.
---
paper_title: Mobile Host-Based intrusion Detection and Attack Identification

paper_content:

Although much attention has focused on optimizing power in batteries for mobile devices, little attention to date has focused on battery constraints to determine if an attack is present. This research proposes that resident monitoring of the demands placed on a battery's current (mA) and other system processes can be used as an early-warning, trip-wire-like sensor for mobile hosts as a means to block attacks as well as to identify them.
---
paper_title: Feature Analysis for Intrusion Detection in Mobile Ad-hoc Networks

paper_content:

As Mobile Ad-hoc network (MANET) has become a very important technology, research concerning its security problem, especially, in intrusion detection has attracted many researchers. Feature selection methodology plays a central role in the data analysis process. The proposed features are tested in difierent network operating conditions. PCA is used to analyze the selected features. This is because, redundant and irrelevant features often reduce performance of the detection system. Performance reduction will occur both in speed and predictive accuracy. This paper aims to select and analyze the network features using principal component analysis. In this paper, performing various experiments, normal and attack states are simulated and the results for the selected features are analyzed.
---
paper_title: Cross-Layer Detection of Sinking Behavior in Wireless Ad Hoc Networks Using SVM and FDA

paper_content:

The uniqueness of security vulnerabilities in ad hoc networks has given rise to the need for designing novel intrusion detection algorithms, different from those present in conventional networks. In this work, we propose an autonomous host-based intrusion detection system for detecting malicious sinking behavior. The proposed detection system maximizes the detection accuracy by using cross-layer features to define a routing behavior. For learning and adaptation to new attack scenarios and network environments, two machine learning techniques are utilized. Support Vector Machines (SVMs) and Fisher Discriminant Analysis (FDA) are used together to exploit the better accuracy of SVM and faster speed of FDA. Instead of using all cross-layer features, features from MAC layer are associated/correlated with features from other layers, thereby reducing the feature set without reducing the information content. Various experiments are conducted with varying network conditions and malicious node behavior. The effects of factors such as mobility, traffic density, and the packet drop ratios of the malicious nodes are analyzed. Experiments based on simulation show that the proposed cross-layer approach aided by a combination of SVM and FDA performs significantly better than other existing approaches.
---

Title: IDSs based on Stand-alone Architecture for MANET: A Survey

Section 1: Introduction
Description 1: Write about what MANET is, its advantages, and the vulnerabilities. Explain the role of IDS in MANET, including the categorization of IDS based on architecture.

Section 2: Related Work
Description 2: Discuss different stand-alone IDS approaches detailed in various publications, focusing on their methodologies and detection mechanisms.

Section 3: Comparison Criteria
Description 3: Outline the criteria used to compare different stand-alone IDSs, such as implementation environment, processing overhead, detection accuracy, mobility impact, traffic/node density, detection interval, scalability, addressed attacks, and open issues.

Section 4: Implementation Environment
Description 4: Describe the implementation environments used for evaluating IDSs and how they impact detection mechanisms.

Section 5: Processing Overhead
Description 5: Discuss how different detection engines and algorithms influence the processing overhead in MANET IDSs.

Section 6: Detection Accuracy
Description 6: Explain the importance of detection accuracy, the rate of false positives/negatives, and its role in evaluating IDS performance.

Section 7: Impact of Node's Mobility
Description 7: Discuss how node mobility affects detection accuracy and the rate of false positives in different stand-alone IDSs.

Section 8: Traffic / Node Density
Description 8: Analyze the effect of traffic and node density on the detection efficiency of various stand-alone IDSs.

Section 9: Detection Interval
Description 9: Define detection interval and its significance in the performance of IDSs, including how it impacts storage overhead.

Section 10: Scalability
Description 10: Examine the ability of stand-alone IDSs to scale with the size of the network and the implications for performance.

Section 11: Addressed Attacks
Description 11: Evaluate the types of attacks identified by various stand-alone IDSs and their effectiveness in distinguishing normal from harmful activities.

Section 12: Open Issues
Description 12: Identify the limitations and weaknesses of existing stand-alone IDSs, which point towards areas needing further research and development.

Section 13: Conclusion & Future Direction
Description 13: Summarize the evaluation and comparison of stand-alone IDS architectures for MANETs. Discuss significant limitations and propose future research directions to enhance IDS effectiveness.