Intrusion Detection Network Comparison in Mobile Ad-Hoc Networks

This thesis provides a comparison of Intrusion Detection Networks (IDS) for Mobile Ad-Hoc Networks (MANETs), focusing on the challenge of reducing false positives in cooperative IDS. It analyzes existing intrusion detection networks, ultimately recommending the Hybrid Intrusion Detection Network CPDOD as the most effective. The thesis explores various techniques used by experts in the field, demonstrating the usefulness and competence of the chosen network for achieving a high detection rate and improved accuracy. It references earlier work such as SMITH's Intrusion Detection Architecture and Zhang and Lee's model for a disseminated IDS, along with other approaches like Albert et al.'s agent-based system and Sun et al.'s Zone-Based Intrusion Detection Network (ZBIDS). The research also touches upon specific MANET subtypes like VANETs and concludes by offering case studies and guidelines for IDS implementation in different scenarios.

INTRUSION DETECTION NETWORK IN MOBILE AD-HOC NETWORK
COMPARISION AND RECOMMENDATIONS
BY
Reyad Hossain
A Minor Thesis
Submitted in partial fulfillment of the requirements for the degree of
Master of Applied Information Technology
Supervisor:
Dr Rachid Hamadi
Victoria University – Sydney, Australia
January, 2019
NIT6042 (Thesis 2)
[1]

[2]

Abstract
Mobile Ad Hoc Network (MANET) has become one of the trending technologies
in every sector of the world and has a wide range of applications for professional and
personal use. This thesis focuses on the introduction of Intrusion Detection Network
(IDS) that can allow the enhancement in the security of the MANET and improve the
application scenario for all the users. The major problem in this scenario is the troubles
correlated to the decrement in the amount of the false positive generated through the
cooperative IDS within the Mobile Ad Hoc Networks. This thesis focused on the analysis
of the existing intrusion detection networks and selection of the best among the
previously proposed intrusion detection network. The Hybrid Intrusion Detection
Network CPDOD is being proposed as the best among the others for managing the
intrusions detecting network. There are many available techniques that are being
introduced and researched by the various experts in this field as also explained in this
thesis. This thesis will also be demonstrating the usefulness and competence of the
projected network or method which can contribute in the high detection rate and much
more accuracy in the detection. Intrusion Detection Architecture Based on a Static
Stationary Database has been proposed by SMITH. Zhang and Lee additionally
proposed the model for a disseminated and helpful IDS as appeared. In this model, an
IDS specialist keeps running at every portable hub, and performs nearby information
gathering and neighborhood identification. Albert et al proposed a conveyed and
communitarian engineering of IDS by utilizing versatile specialists. Karachirski and
guha have proposed a disseminated Intrusion detection framework for ad-hoc remote
network dependent on portable operator technologies. Sun et al has proposed a
peculiarity based two-level no overlapping Zone-Based Intrusion Detection Network
(ZBIDS). There are even some particular subtypes of MANET that are devoted to a
portion of the issues like VANETs. VANETs are basically utilized for correspondence
among vehicles and among vehicles and roadside hardware for the most part (in most
research) inside a city domain, smart home, Online retailer and Military.
[3]

Acknowledgements
I would like to express my sincere gratitude to Prof. Dr. Rachid Hamadi and Course Co-Ordinator
Dr Omid Ameri Department of Master of Applied Information Technology for allowing me to
undertake this work.
I am grateful to my supervisor Professor Dr. Rachid Hamadi Department of Computer Science
for his continuous guidance advice effort and invertible suggestion throughout the research.
I would also like to thank my wife for encouraging me to carry out this project. I would also like
to thank my friends. Lastly, I would like to express my sincere appreciation to my parents.
[4]

Statement of Originality
I certify that this thesis contains no material which has been accepted for the award of any other
degree or diploma in any institute, college or university, as well as that, to the best of my
knowledge and belief. Besides, it comprises no material beforehand published or written by
another person, except where due references are made in the text of the thesis.
-----------------------------
Reyad Hossain
ID: 4587347
Date:13. 01.2019
[5]

Table of Contents
Abstract...................................................................................................................................2
Acknowledgements.................................................................................................................3
Statement of Originality..........................................................................................................4
Table of Contents....................................................................................................................5
Chapter-1: Introduction...........................................................................................................9
1.1 Aims, Objectives and Research questions...........................................................................11
1.2 Outline of the Dissertation..................................................................................................12
1.3 Related terms......................................................................................................................14
Chapter-2: Background.........................................................................................................17
2.1 The concept of False Alarm Protocol..................................................................................18
2.2 Acknowledgment-based Approach for the Detection of Routing Misbehavior in MANETs
..................................................................................................................................................18
2.3 Signal Detection Theory.....................................................................................................19
2.3.1 Intrusion Detection Issues in MANETs...........................................................................22
2.4 Proposed IDSs....................................................................................................................26
2.5 Cooperative IDS using Cross-Feature Analysis in MANETs..............................................29
Chapter-3 Literature Review.................................................................................................34
3.1 Introduction........................................................................................................................34
3.2 Different types of Intrusion Detection Network (IDS)........................................................34
3.2.1 Monitoring based IDS..................................................................................................34
3.2.2 Principal component analysis-based............................................................................36
3.2.3 Biologically inspired computing-based........................................................................37
[6]

3.2.4 Data mining-based approaches.....................................................................................38
3.2.5 Bayesian order-based methodologies...........................................................................39
Parametric Gaussian mixture model.....................................................................................39
3.2.6 Context-aware intrusion detection mechanism (CAID)...............................................40
3.2.7 Penalty and reward-based approaches..........................................................................42
3.2.8 Alarm Prioritization Technique....................................................................................43
3.3 The discovery network for dispersed denial of supply (DDoS)...........................................43
3.4 Search Vector Machine-based IDS.....................................................................................44
3.5 Dynamic Intrusion Detection Method using CPDOD Algorithm........................................46
3.6 Search Vector Machine-based IDS (Porras, 2002)..............................................................47
Chapter - 4: Analysis and Comparison.................................................................................49
4.1 Analysis of the Approaches..........................................................................................49
4.2 Comparison Criteria......................................................................................................56
4.3 Comparison of the Approaches.....................................................................................61
Chapter-5: Case Study and Guidelines.................................................................................68
5.1 City Council..................................................................................................................68
5.1.1 Recovery and Adaptability Issues.........................................................................68
5.1.2 Recommended Solutions.......................................................................................69
5.2 Online Retailer..............................................................................................................70
5.2.1 Recovery and Adaptability Issues.........................................................................71
5.2.2 Recommended Solutions.......................................................................................71
5.3 Military Force...............................................................................................................72
5.3.1 Recovery and Adaptability Issues.........................................................................72
5.3.2 Recommended Solutions.......................................................................................72
[7]

5.4 Smart Home..................................................................................................................73
5.4.1 Recovery and Adaptability Issues.........................................................................73
5.4.2 Recommended Solutions.......................................................................................74
5.5 Guidelines for IDS........................................................................................................75
5.6 Summary.......................................................................................................................75
Chapter - 6: Conclusion........................................................................................................76
List of References.................................................................................................................79
List of Figures
Figure 1: Outline of the dissertation..................................................................................12
Figure 2: structure of CPDOD algorithm..........................................................................50
Figure 2: RCO curves showing the performance of our method and other two algorithms
over Black Hole Attack dataset.........................................................................................66
Figure 3: RCO curves showing the performance of our method and other two................66
Figure 4: RCO curves showing the performance of our method and other two algorithms
over Dropping Routing Traffic Attack dataset..................................................................67
[8]

List of Tables
1.3.1.1.1 Table 1: Different IDS and effect of False Alarms on their performance..........16
Table 1: Performance comparison.....................................................................................65
[9]

Chapter-1: Introduction
There have been various security issues identified in the internet network and
MANET (Butun, Morgera and Sankar 2014). This has been an important phenomenon in
the dependency of the telecommunication sector in the market. Intrusion detection
network has been performing various functions that help in monitoring users and activity
in the network for managing audit trails and highlight user violation of policy and normal
activity. According to this issue, there have been various IDS techniques for detecting
different malicious activities effectively in MANET (Butun, Morgera and Sankar 2014).
The Mobile Ad hoc Network (MANET) have been consisting of nodes that helps
in building up several devices including wireless phones and Personal Digital Assistant
(PDA). These nodes help in to communication among different links being
interconnected in the network and developing temporary networks. There has been the
absence of centralized administration and node mobility that helps MANET behaving as
both routers and hosts (Alheeti, Gruebler and McDonald-Maier 2015). The cooperation
of all nodes in MANET helps in ensuring reliability in routing services. There have been
various mediums those lead to the different network topologies; lagging behind in central
monitoring leading to the unavailability of defense activities. MANET has been
vulnerable to several malicious activities including denial of active impersonation,
service, eavesdropping, and passive. An attacker might intrude through the nodes of the
MANET and enter into the security network of the network. The dependency of the
effective execution of MANET majorly depends on the assurance of the user in the
[10]

security (Krishnan 2015). Besides, MANET’s security research has been based up to the
implementation of security protocols and algorithms in the network. The management of
routing protocols and intrusion detection techniques has been maintaining a smart
approach to the development of security protocols for MANET (Krishnan 2015).
The detection techniques have been maintaining a smart approach in providing a
security network in the MANET. Therefore, an intrusion detection network (IDS) has
been playing an important role in various attack types different types of attacks. This
network helps in protecting the network, analyze and identify intrusions in the network.
There are two types of methods which are categorized as Intrusion detection methods and
misuse detection methods (Spanos 2018). The network used to store patterns those are
related to the known attacks and utilize them for comparing them with the actual
activities those are technically occurring. The Intrusion detection method has also been
referred to be signature-based that operates on the database having the attack signatures
those are unknown. The general working of the network is to assume that there is a lot of
difference in the attack behavior and sufficient amount of distinction from the behavior of
the normal users. There have been many approaches to intrusion detection, one of them is
also known as the “anomaly-based intrusion detection method (Spanos 2018).”
The signature-based model helps in performing simple pattern matching and situation of
report matching with corresponding known attack type. Anomaly-based model has been
developed for acceptable behavior and flag exceptions for identifying abnormal activity.
Every node may just utilize the correspondence, restricted, and halfway exercises as the
accessible review follow. The MANETS have certain attributes such as separated tasks
[11]

those have only existence of the wired network everywhere in the network. The lack of
safety controls in mobile ad hoc networks have been picked against normal attacks
including DoS attack. Intrusion detection network has been a mechanism for providing
security failures identification in networks (Spanos 2018).
1.1 Aims, Objectives and Research questions
The aim of the study is to detect dynamic modelling technique for a false alarm in
Intrusion Detection Network in Mobile Ad Hoc Network.
Following are the list of objectives for the research:
 To analyze dynamic modelling technique for false alarm
 To analyze the different Intrusion Detection Networks available theoretically and
practically
 To propose best technique among the analyzed ones in manner to make sure that
the proposed network is sophisticated enough for delivering the necessary
operational activities.
 To again, analyze the efficiency and effectiveness of the proposed network.
 To recommend strategies for utilizing MANET in the Intrusion detection network
Following are the list of research questions:
 What is IDS for Mobile Ad-hoc network?
 How dynamic modelling technique used for a false alarm?
 How effective could be the proposed anomalies in the development of a secured
MANETS?
 Which could be the best IDS network for the MANET?
[12]