Survey of Intrusion Detection and Prevention System in MANETs based on Data Gathering Techniques
---
paper_title: Mobile Agents-Based Intrusion Detection System for Mobile Ad Hoc Networks

paper_content:

The thesis proposed an Agent-based Intrusion Detection Model of Mobile Ad Hoc Network that forms a cluster-head-centered backbone network by using a decision mode of joint detection used among cluster heads and vote by ballot in partial cluster heads to execute total network intrusion detection. The model has advantages of simple structure and short computing time; meanwhile, the model can save more network bandwidth and power consumption while ensuring higher detection rate. Simulation test results verify availability of this solution.
---
paper_title: Mechanism Design-Based Secure Leader Election Model for Intrusion Detection in MANET

paper_content:

In this paper, we study leader election in the presence of selfish nodes for intrusion detection in mobile ad hoc networks (MANETs). To balance the resource consumption among all nodes and prolong the lifetime of an MANET, nodes with the most remaining resources should be elected as the leaders. However, there are two main obstacles in achieving this goal. First, without incentives for serving others, a node might behave selfishly by lying about its remaining resources and avoiding being elected. Second, electing an optimal collection of leaders to minimize the overall resource consumption may incur a prohibitive performance overhead, if such an election requires flooding the network. To address the issue of selfish nodes, we present a solution based on mechanism design theory. More specifically, the solution provides nodes with incentives in the form of reputations to encourage nodes in honestly participating in the election process. The amount of incentives is based on the Vickrey, Clarke, and Groves (VCG) model to ensure truth-telling to be the dominant strategy for any node. To address the optimal election issue, we propose a series of local election algorithms that can lead to globally optimal election results with a low cost. We address these issues in two possible application settings, namely, Cluster-Dependent Leader Election (CDLE) and Cluster-Independent Leader Election (CILE). The former assumes given clusters of nodes, whereas the latter does not require any preclustering. Finally, we justify the effectiveness of the proposed schemes through extensive experiments.
---
paper_title: Intrusion detection in wireless ad hoc networks

paper_content:

Intrusion detection has, over the last few years, assumed paramount importance within the broad realm of network security, more so in the case of wireless ad hoc networks. These are networks that do not have an underlying infrastructure; the network topology is constantly changing. The inherently vulnerable characteristics of wireless ad hoc networks make them susceptible to attacks, and it may be too late before any counter action can take effect. Second, with so much advancement in hacking, if attackers try hard enough they will eventually succeed in infiltrating the system. This makes it important to constantly (or at least periodically) monitor what is taking place on a system and look for suspicious behavior. Intrusion detection systems (IDSs) do just that: monitor audit data, look for intrusions to the system, and initiate a proper response (e.g., email the systems administrator, start an automatic retaliation). As such, there is a need to complement traditional security mechanisms with efficient intrusion detection and response. In this article we present a survey on the work that has been done in the area of intrusion detection in mobile ad hoc networks.
---
paper_title: Mitigating routing misbehavior in mobile ad hoc networks

paper_content:

This paper describes two techniques that improve throughput in an ad hoc network in the presence of nodes that agree to forward packets but fail to do so. To mitigate this problem, we propose categorizing nodes based upon their dynamically measured behavior. We use a watchdog that identifies misbehaving nodes and a pathrater that helps routing protocols avoid these nodes. Through simulation we evaluate watchdog and pathrater using packet throughput, percentage of overhead (routing) transmissions, and the accuracy of misbehaving node detection. When used together in a network with moderate mobility, the two techniques increase throughput by 17% in the presence of 40% misbehaving nodes, while increasing the percentage of overhead transmissions from the standard routing protocol's 9% to 17%. During extreme mobility, watchdog and pathrater can increase network throughput by 27%, while increasing the overhead transmissions from the standard routing protocol's 12% to 24%.
---
paper_title: Performance Analysis of the CONFIDANT Protocol: Cooperation of Nodes – Fairness In Dynamic Ad Hoc Networks

paper_content:

Mobile ad-hoc networking works properly only if the participating nodes cooperate in routing and forwarding. However, it may be advantageous for individual nodes not to cooperate. We propose a protocol, called CONFIDANT, for making misbehavior unattractive; it is based on selective altruism and utilitarianism. It aims at detecting and isolating misbehaving nodes, thus making it unattractive to deny cooperation. Trust relationships and routing decisions are based on experienced, observed, or reported routing and forwarding behavior of other nodes. The detailed implementation of CONFIDANT in this paper assumes that the network layer is based on the Dynamic Source Routing (DSR) protocol. We present a performance analysis of DSR fortified by CONFIDANT and compare it to regular defenseless DSR. It shows that a network with CONFIDANT and up to 60% of misbehaving nodes behaves almost as well as a benign network, in sharp contrast to a defenseless network. All simulations have been implemented and performed in GloMoSim.
---
paper_title: Effective intrusion detection using multiple sensors in wireless ad hoc networks

paper_content:

In this paper we propose a distributed intrusion detection system for ad hoc wireless networks based on mobile agent technology. Wireless networks are particularly vulnerable to intrusion, as they operate in open medium, and use cooperative strategies for network communications. By efficiently merging audit data from multiple network sensors, we analyze the entire ad hoc wireless network for intrusions and try to inhibit intrusion attempts. In contrast to many intrusion detection systems designed for wired networks, we implement an efficient and bandwidth-conscious framework that targets intrusion at multiple levels and takes into account distributed nature of ad hoc wireless network management and decision policies.
---
paper_title: Security in Ad Hoc Networks : a General Intrusion Detection Architecture Enhancing Trust Based Approaches

paper_content:

In the last few years, the performances of wireless technologies have increased tremendously thus opening new fields of application in the domain of networking. One of such fields concerns mobile ad hoc networks (MANETs) in which mobile nodes organise themselves in a network without the help of any predefined infrastructure. Securing MANETs is just as important, if not more, as securing traditional wired networks. Existing solutions can be used to obtain a certain level of security. Nevertheless, these solutions may not always be suitable to wireless networks. Furthermore, ad hoc networks have their own vulnerabilities that cannot be tackled by these solutions. To obtain an acceptable level of security in such a context, traditional security solutions should be coupled with an intrusion detection mechanism. In this paper we show how ad hoc networks can be, to a certain extent, secured using traditional techniques. We then examine the different intrusion detection techniques and point out the reasons why they usually cannot be used in an ad hoc context. Finally, we go through the requirements of an intrusion detection system for ad hoc networks, and define an adapted architecture for an intrusion detection system for manets.
---
paper_title: A general cooperative intrusion detection architecture for MANETs

paper_content:

Intrusion detection in MANETs is challenging because these networks change their topologies dynamically; lack concentration points where aggregated traffic can be analyzed; utilize infrastructure protocols that are susceptible to manipulation; and rely on noisy, intermittent wireless communications. We present a cooperative, distributed intrusion detection architecture that addresses these challenges while facilitating accurate detection of MANET-specific and conventional attacks. The architecture is organized as a dynamic hierarchy in which detection data is acquired at the leaves and is incrementally aggregated, reduced, and analyzed as it flows upward toward the root. Security management directives flow downward from nodes at the top. To maintain communications efficiency, the hierarchy is automatically reconfigured as needed using clustering techniques in which clusterheads are selected based on topology and other criteria. The utility of the architecture is illustrated via multiple attack scenarios.
---
paper_title: An Intrusion Detection Architecture for Clustered Wireless Ad Hoc Networks

paper_content:

For the shortcomings of the existing single-function management systems of electric power marketing management at present, the energy acquisition and operation management system based on the customized integrated services distribution automation terminal is proposed, using wireless ad-hoc networks and wireless mesh networking technology to solve the 'last mile' problem in the distribution automation system. As an instance of a wireless sensor network (WSN), it provides a highly reliable, real-time on-site intelligent network with strong adaptability to environment. This paper describes the structure of the energy acquisition and operation management system, and it's the uplink downlink communication channels and interfaces. The main function module design and system characteristics are detailed. The system seamlessly integrates power on-site management system, distribution transformer management system and automatic meter reading system, with a new intensive, diversified, practical system to replace the previous single-function systems.
---
paper_title: An Intrusion Detection Architecture for Clustered Wireless Ad Hoc Networks

paper_content:

For the shortcomings of the existing single-function management systems of electric power marketing management at present, the energy acquisition and operation management system based on the customized integrated services distribution automation terminal is proposed, using wireless ad-hoc networks and wireless mesh networking technology to solve the 'last mile' problem in the distribution automation system. As an instance of a wireless sensor network (WSN), it provides a highly reliable, real-time on-site intelligent network with strong adaptability to environment. This paper describes the structure of the energy acquisition and operation management system, and it's the uplink downlink communication channels and interfaces. The main function module design and system characteristics are detailed. The system seamlessly integrates power on-site management system, distribution transformer management system and automatic meter reading system, with a new intensive, diversified, practical system to replace the previous single-function systems.
---
paper_title: Mechanism Design-Based Secure Leader Election Model for Intrusion Detection in MANET

paper_content:

In this paper, we study leader election in the presence of selfish nodes for intrusion detection in mobile ad hoc networks (MANETs). To balance the resource consumption among all nodes and prolong the lifetime of an MANET, nodes with the most remaining resources should be elected as the leaders. However, there are two main obstacles in achieving this goal. First, without incentives for serving others, a node might behave selfishly by lying about its remaining resources and avoiding being elected. Second, electing an optimal collection of leaders to minimize the overall resource consumption may incur a prohibitive performance overhead, if such an election requires flooding the network. To address the issue of selfish nodes, we present a solution based on mechanism design theory. More specifically, the solution provides nodes with incentives in the form of reputations to encourage nodes in honestly participating in the election process. The amount of incentives is based on the Vickrey, Clarke, and Groves (VCG) model to ensure truth-telling to be the dominant strategy for any node. To address the optimal election issue, we propose a series of local election algorithms that can lead to globally optimal election results with a low cost. We address these issues in two possible application settings, namely, Cluster-Dependent Leader Election (CDLE) and Cluster-Independent Leader Election (CILE). The former assumes given clusters of nodes, whereas the latter does not require any preclustering. Finally, we justify the effectiveness of the proposed schemes through extensive experiments.
---
paper_title: Mobile Agents-Based Intrusion Detection System for Mobile Ad Hoc Networks

paper_content:

The thesis proposed an Agent-based Intrusion Detection Model of Mobile Ad Hoc Network that forms a cluster-head-centered backbone network by using a decision mode of joint detection used among cluster heads and vote by ballot in partial cluster heads to execute total network intrusion detection. The model has advantages of simple structure and short computing time; meanwhile, the model can save more network bandwidth and power consumption while ensuring higher detection rate. Simulation test results verify availability of this solution.
---

Title: Survey of Intrusion Detection and Prevention System in MANETs based on Data Gathering Techniques
Section 1: INTRODUCTION
Description 1: This section introduces MANETs, their significance, and the critical need for security using Intrusion Detection and Prevention Systems (IDPS) due to the inherent vulnerabilities and challenges.

Section 2: INTRUSION DETECTION AND PREVENTION
Description 2: This section explains the concepts of intrusion detection and prevention, including the different types of IDPS, and their roles in maintaining the security of MANETs.

Section 3: IDPS FOR MANET
Description 3: This section discusses various Intrusion Detection System architectures that have been proposed specifically for MANETs, considering the unique characteristics and requirements of these networks.

Section 4: Distributed and Cooperative Intrusion Detection System
Description 4: This subsection presents the distributed and cooperative architecture proposed for statistical anomaly detection in MANETs.

Section 5: CONFIDANT
Description 5: This subsection describes the CONFIDANT system, an extension to the DSR protocol aimed at monitoring and punishing misbehaving nodes in the network.

Section 6: Distributed Intrusion Detection System Using Multiple Sensors
Description 6: This subsection covers the intrusion detection system proposed by Kachriski and Guha, which uses mobile agents and multiple sensors for audit data collection and cooperative detection in MANETs.

Section 7: Local Intrusion Detection System (LIDS)
Description 7: This subsection explains the distributed and collaborative architecture using mobile agents for local intrusion detection as proposed by Albers.

Section 8: Dynamic Hierarchical Intrusion Detection Architecture
Description 8: This subsection details the dynamic hierarchical intrusion detection architecture proposed by Sterne, which is scalable and organizes nodes into a hierarchy for efficient detection and response.

Section 9: Zone-Based Intrusion Detection System (ZBIDS)
Description 9: This subsection explains the architecture of the ZBIDS, which combines local and collaborative detection techniques within a zoned ad hoc network structure.

Section 10: COMPARISON OF IDS FOR MANETS
Description 10: This section presents a comparative study of several intrusion detection systems, highlighting their unique approaches and effectiveness in dealing with the challenges faced by MANETs.

Section 11: An Intrusion Detection Architecture for Clustered Wireless Ad Hoc network
Description 11: This subsection describes Jaydip Sen's architecture which adopts a clustered semi-centralized approach for intrusion detection.

Section 12: Mechanism Design-Based Secure Leader Election Model for Intrusion Detection in MANET
Description 12: This subsection details the leader election model based on the VCG model, aimed at ensuring efficient and truthful leader election for intrusion detection in MANETs.

Section 13: Mobile agents-based intrusion detection system for mobile ad hoc networks
Description 13: This subsection covers the IDS proposed by Yinan Li, which uses mobile agents in a clustered network for cooperative detection and response to intrusions.

Section 14: CONCLUSION AND FUTURE DIRECTION
Description 14: This section summarizes the key points discussed in the paper and outlines possible future directions for research in improving intrusion detection and prevention in MANETs.

Section 15: ACKNOWLEDGEMENTS
Description 15: This section acknowledges the contributions of individuals and organizations that supported the research work.