A survey of survivability in mobile ad hoc networks <s> IV. SURVIVABILITY REQUIREMENTS FOR MANETS <s> Pervasive societal dependency on large scale, unbounded network systems, the substantial risks of such dependency, and the growing sophistication of system intruders, have focused increased attention on how to ensure network system survivability. Survivability is the capacity of a system to provide essential services even after successful intrusion and compromise, and to recover full services in a timely manner. Requirements for survivable systems must include definitions of essential and non essential services, plus definitions of new survivability services for intrusion resistance, recognition, and recovery. Survivable system requirements must also specify both legitimate and intruder usage scenarios, and survivability practices for system development, operation, and evolution. The paper defines a framework for survivable systems requirements definition and discusses requirements for several emerging survivability strategies. Survivability must be designed into network systems, beginning with effective survivability requirements analysis and definition. <s> BIB001 </s> A survey of survivability in mobile ad hoc networks <s> IV. SURVIVABILITY REQUIREMENTS FOR MANETS <s> An ad-hoc network is the cooperative engagement of a collection of mobile nodes without the required intervention of any centralized access point or existing infrastructure. We present Ad-hoc On Demand Distance Vector Routing (AODV), a novel algorithm for the operation of such ad-hoc networks. Each mobile host operates as a specialized router, and routes are obtained as needed (i.e., on-demand) with little or no reliance on periodic advertisements. Our new routing algorithm is quite suitable for a dynamic self starting network, as required by users wishing to utilize ad-hoc networks. AODV provides loop-free routes even while repairing broken links. Because the protocol does not require global periodic routing advertisements, the demand on the overall bandwidth available to the mobile nodes is substantially less than in those protocols that do necessitate such advertisements. Nevertheless we can still maintain most of the advantages of basic distance vector routing mechanisms. We show that our algorithm scales to large populations of mobile nodes wishing to form ad-hoc networks. We also include an evaluation methodology and simulation results to verify the operation of our algorithm. <s> BIB002 </s> A survey of survivability in mobile ad hoc networks <s> IV. SURVIVABILITY REQUIREMENTS FOR MANETS <s> The Dynamic Source Routing protocol (DSR) is a simple and efficient routing protocol designed specifically for use in multi-hop wireless ad hoc networks of mobile nodes. DSR allows the network to be completely self-organizing and self-configuring, without the need for any existing network infrastructure or administration. The protocol is composed of the two mechanisms of Route Discovery and Route Maintenance, which work together to allow nodes to discover and maintain source routes to arbitrary destinations in the ad hoc network. The use of source routing allows packet routing to be trivially loop-free, avoids the need for up-to-date routing information in the intermediate nodes through which packets are forwarded, and allows nodes forwarding or overhearing packets to cache the routing information in them for their own future use. All aspects of the protocol operate entirely on-demand, allowing the routing packet overhead of DSR to scale automatically to only that needed to react to changes in the routes currently in use. We have evaluated the operation of DSR through detailed simulation on a variety of movement and communication patterns, and through implementation and significant experimentation in a physical outdoor ad hoc networking testbed we have constructed in Pittsburgh, and have demonstrated the excellent performance of the protocol. In this chapter, we describe the design of DSR and provide a summary of some of our simulation and testbed implementation results for the protocol. <s> BIB003
MANETs introduce diverse functions, operations and services influenced by the context, applications and basic characteristics. In a critical situation, where parts of a system are compromised by attacks or intrusions, priority is given to maintain correct functionality of essential services. Essential services demand capacities and guaranties to assure their correct delivery in the presence of attacks, failures or multiple fake identities will be created for adversary nodes, meaning that an attacker can appear to be in multiple places at the same time Rushing adversaries quickly forward their route request (RREQ) messages when a route discovery is initiated, in order to participate any route discovery. This attack can be carried out against on-demand routing protocols, as AODV BIB002 , DSR BIB003 and others Transport SYN Flooding classic TCP SYN flood where an adversary sends many connection establishment requests to a target node, overwhelming its resources accidents. Such capacities and guaranties are identified as survivability requirements and they can diverge significantly depending on the system characteristics, its scope, and the consequence of the service interruption. Despite of Linger et. al BIB001 define those requirements in terms of essential and non-essential services, this section discusses survivability requirements for MANETs considering essential services and network characteristics. Essential services in MANETs can be classified in two types: specific services and general services. The former represents those services designed by application or network context. The latter denotes fundamental services that are independent of applications or context as routing, connectivity and communication. Since specific services can vary with application or context, this work analyzes the survivability requirements related to general services. Survivable MANET's must maintain a connected network even in adverse situations, since that service allows efficient routing and end-to-end communication. Consequently, survivable networks must (i) consider node heterogeneity balancing their operations and tasks among the network nodes; (ii) be able to change dynamically the parameters of the connections such as node's addressing and service discovery (self-configurable); (iii) be able to adjust transmit powers of nodes adaptively in response to mobility, activity requirements such as QoS level, environmental conditions and attacks (selfadaptation); and (iv) use node's energy and other resources efficiently when the system suspects that it is under attack (efficiency). Routing is another essential service whose cooperative way of work brings many security weaknesses. Hence, survivable networks need to apply mechanisms to (i) control the access of nodes in the network (access control); (ii) protect the wireless communication at physical and data link layers as well as user/data acquisition (protection); (iii) guarantee integrity, confidentiality and authentication principles; (iv) offer ro-bust and efficient routing; and (v) tolerate attacks by means of intrusion tolerance techniques such as redundant approaches -multipath, double routing protocol and others (redundancy). Communication is the main purpose of any network, and security or mobility issues make MANET's communication a challenge. In this way, its survivability requirements consist of (i) designing protocols that work normally on different and adverse conditions (self-adaptation); (ii) making functional end-to-end communication without needing a reliable return channel for acknowledgments; (iii) using multiple communication channels (redundancy); (iv) proceeding during eventual disconnection and along with partial segments of paths (robustness). Table II summarizes MANETs survivability these requirements taking into account the general services. Certain survivability requirements are consequence of network characteristics. Survivable systems for MANETs can not have the central point of failures/attacks. They must be fully decentralized and they must achieve the necessary organizational structures without requiring human intervention (self-organization). Survivable MANETs must be scalable to consider the great variability on the total number of nodes and the dynamic topology. They must also be self-managed and self-controlled, that is, autonomic to guarantee network functionality and efficiency. Survivable MANETs must be self-diagnosed monitoring themselves and finding faulty, unavailable, misbehavior or malicious nodes. They must also prevent disruptions or recover from problems that might have happened and find an alternative way of using resources and reconfiguring the entity to keep in normal operation (self-healing). Survivable networks must finally manage themselves in order to optimize the use of their resources, minimizing latency and maintaining the quality of service. Figure 4 illustrates the integration among all mentioned requirements, highlighting those yielded by general essential services (light gray) from those produced by network characteristics (dark gray). The requirements dependent of the context or application are not considered, making this incomplete view in the figure. Each requirement, as depicted in Figure 4 , is connected to others that together can improve the network survivability. Robustness, for example, will be more effective for survivability when redundancy, access control and protection are also applied. Protection is often reached by authentication, integrity and confidentiality. Access control applies generally authentication mechanisms and self-controlling characteristic enhances it. Scalability requirement will be reached by means of self-management, self-organization and self-controlling. These integrations only illustrate some possibilities for together improving the survivability, without extinguishing all of them. Nowadays, each essential service in Table II , connectivity, routing and communication, is treated and associated to three different layers, respectively, link, network and application layers. This is not sufficient for archieving a complete survivable system due to multi-layer attacks. Further, the use of multi-layer information can make security mechanisms more robust, resistant and survivable. Routing layer, for example, can use energy or bandwidth information present in link layer to take better choices and to be more adaptive. Routing layer can inform the others about attack detection and in this way, those layers can start an alert procedure. In summary, the survivability existent on the layers can mutually provide guarantees and support. Based on these previous considerations and on the survivability key properties presented in Section II, we identified three view planes for survivable systems, as illustrated in Figure 5 . In the first one (key properties), we have the properties that must be achieved by the system. In the second one (requirements), we highlight the requirements that survivable systems need to reach. Finally, in the third one (protocol layers), we emphasize that all network layers need to be addressed by the system. We note that a complete survivable system attends these three planes.