A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Worm Hole Attack: <s> The application of multi-path techniques in wireless ad hoc networks is advantageous because multi-path routing provides means to combat the effect of unreliable wireless links and constantly changing network topology. The performance of multi-path routing under wormhole attack is studied in both cluster and uniform network topologies. Because multi-path routing is vulnerable to wormhole attacks, a scheme called statistical analysis of multi-path (SAM) is proposed to detect such attacks and to identify malicious nodes. As the name suggests, SAM detects wormhole attacks and identifies attackers by statistically analyzing the information collected by multi-path routing. Neither additional security services or systems nor security enhancement of routing protocols is needed in the proposed scheme. Simulation results demonstrate that SAM successfully detects wormhole attacks and locates the malicious nodes in networks with cluster and uniform topologies and with different node transmission range. <s> BIB001 </s> A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Worm Hole Attack: <s> As mobile ad hoc network applications are deployed, security emerges as a central requirement. In this paper, we introduce the wormhole attack, a severe attack in ad hoc networks that is particularly challenging to defend against. The wormhole attack is possible even if the attacker has not compromised any hosts, and even if all communication provides authenticity and confidentiality. In the wormhole attack, an attacker records packets (or bits) at one location in the network, tunnels them (possibly selectively) to another location, and retransmits them there into the network. The wormhole attack can form a serious threat in wireless networks, especially against many ad hoc network routing protocols and location-based wireless security systems. For example, most existing ad hoc network routing protocols, without some mechanism to defend against the wormhole attack, would be unable to find routes longer than one or two hops, severely disrupting communication. We present a general mechanism, called packet leashes, for detecting and, thus defending against wormhole attacks, and we present a specific protocol, called TIK, that implements leashes. We also discuss topology-based wormhole detection, and show that it is impossible for these approaches to detect some wormhole topologies. <s> BIB002 </s> A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Worm Hole Attack: <s> We have implemented a fully-functional wormhole attack in an IPv6 802.11b wireless Mobile Ad Hoc Network (MANET) test bed running a proactive routing protocol. Using customised analysis tools we study the traffic collected from the MANET at three different stages: i) regular operation, ii) with a "benign" wormhole joining distant parts of the network, and iii) under stress from wormhole attackers who control a link in the MANET and drop packets at random. Our focus is on detecting anomalous behaviour using timing analysis of routing traffic within the network. We first show how to identify intruders based on the protocol irregularities that their presence creates once they begin to drop traffic. More significantly, we go on to demonstrate that the mere existence of the wormhole itself can be identified, before the intruders begin the packet-dropping phase of the attack, by applying simple signal-processing techniques to the arrival times of the routing management traffic. This is done by relying on a property of proactive routing protocols? that the stations must exchange management information on a specified, periodic basis. This exchange creates identifiable traffic patterns and an intrinsic "valid station" fingerprint that can be used for intrusion detection. <s> BIB003 </s> A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Worm Hole Attack: <s> Colluding malicious insider nodes with no special hardware capability can use packet encapsulation and tunnelling to create bogus short-cuts (in-band wormholes) in routing paths and influence data traffic to flow through them. This is a particularly hard attack using which even a handful of malicious nodes can conduct traffic analysis of packets or disrupt connections by dropping packets when needed. Using simulations we show that a disproportionately large amount of traffic goes through routes with wormholes even when a secure routing protocol such as Ariadne is used. To mitigate this, we propose distributed techniques based on the propagation speeds of requests and statistical profiling; they do not require network-wide synchronized clocks, do not impose any additional control packet overhead, and need only simple computations by the sources or destinations of connections. We implemented our techniques in Ariadne and evaluated their effectiveness using the Glomosim simulator. Our results indicate that in-band wormhole creation and usage can be reduced by a factor of 2-10. Also, the false alarm rates of the proposed techniques are very low and have little impact on normal network operation, making them practical for MANETs. <s> BIB004
In BIB002 , packet leashes are proposed to detect and defend against the wormhole attack. Hu et al. in their work have proposed temporal leashes and geographical leashes. For temporal leashes each node is to compute the packet expiration time (t e ) based on the speed of light c and is to include the expiration time (t e ') in its packet to prevent the packet from traveling further than a specific distance, L. At the receiving node, the packet is checked for packet expiry by comparing its current time and the t e in the packet. The authors also proposed TIK, which is used to authenticate the expiration time that can otherwise be modified by the malicious node. The constraint here is that all nodes have to be tightly clock synchronized. For the geographical leashes, each node must know its own position and may have loosely synchronized clocks. In this approach, a sender of a packet includes its current position and the sending time. Therefore, a receiver can judge neighbor relations by computing distance between itself and the sender of the packet. The advantage of geographic leashes over temporal leashes is that the time synchronization is not critical. In BIB001 Qian et al. have proposed a Statistical Analysis of Multipath (SAM), which is an approach to detect the wormhole attack by using multipath routing. The attack is detected by calculating the relative frequency of each link that appears in all of the obtained routes from one route discovery. The link that has the highest relative frequency is identified as the wormhole link. In BIB004 Su et al. have proposed technique based on propagation speeds of requests and statistical profiling. For on demand route discovery schemes that use flooding, requests should be transmitted at a higher priority than all other packets. This implicitly increases the time to exchange information among malicious nodes. A distributed and adaptive statistical profiling technique to filter RREQs (each destination node filters RREQs that are targeted to it and have excessively large delays) or RREPs (each source node monitors the RREPs it receives and filters those that have excessively large delays) is suggested. Since different RREQs/RREPs take varying number of hops, the upper bound on the per hop time of RREQ/RREP packets is so calculated that most normal packets are retained and most falsified packets are filtered. The main advantages of this approach are that no networkwide synchronized clocks are required, no additional control packet overhead is imposed and only simple computations by the sources or destinations of connections is required. In BIB003 Gorlatova et al. have proposed an approach that uses the anomaly in the MANET traffic behavior, particularly the behavioral anomalies in the protocol related packets for detection of worm holes. The HELLO message interval was set to 0.3 seconds, with a simple jitter function -randomly adding 0.03 seconds of delay overlaid upon it. The traffic is parsed, the HELLO messages arriving at a particular node are indexed, and the difference between arrival times of HELLO messages sent by its neighbors is calculated. The HELLO Message Timing Interval HMTI profile so obtained is used for detection of attacker nodes, as the frequency profile of HMTI is at a set frequency, a violation of OLSR protocol specifications. The interval between the packets is repeatedly much larger than it should be for a genuine node.