A Survey on Security in Mobile Peer-to-Peer Architectures—Overlay-Based vs. Underlay-Based Approaches <s> Countermeasures for Attacks during Routing and Data Transmission Phase <s> This paper describes two techniques that improve throughput in an ad hoc network in the presence of nodes that agree to forward packets but fail to do so. To mitigate this problem, we propose categorizing nodes based upon their dynamically measured behavior. We use a watchdog that identifies misbehaving nodes and a pathrater that helps routing protocols avoid these nodes. Through simulation we evaluate watchdog and pathrater using packet throughput, percentage of overhead (routing) transmissions, and the accuracy of misbehaving node detection. When used together in a network with moderate mobility, the two techniques increase throughput by 17% in the presence of 40% misbehaving nodes, while increasing the percentage of overhead transmissions from the standard routing protocol's 9% to 17%. During extreme mobility, watchdog and pathrater can increase network throughput by 27%, while increasing the overhead transmissions from the standard routing protocol's 12% to 24%. <s> BIB001 </s> A Survey on Security in Mobile Peer-to-Peer Architectures—Overlay-Based vs. Underlay-Based Approaches <s> Countermeasures for Attacks during Routing and Data Transmission Phase <s> Most recent ad hoc network research has focused on providing routing services without considering security. We detail security threats against ad hoc routing protocols, specifically examining AODV and DSR. In light of these threats, we identify three different environments with distinct security requirements. We propose a solution to one, the managed-open scenario where no network infrastructure is pre-deployed, but a small amount of prior security coordination is expected. Our protocol, authenticated routing for ad hoc networks (ARAN), is based on certificates and successfully defeats all identified attacks. <s> BIB002 </s> A Survey on Security in Mobile Peer-to-Peer Architectures—Overlay-Based vs. Underlay-Based Approaches <s> Countermeasures for Attacks during Routing and Data Transmission Phase <s> An ad hoc network is a collection of wireless computers (nodes), communicating among themselves over possibly multihop paths, without the help of any infrastructure such as base stations or access points. Although many previous ad hoc network routing protocols have been based in part on distance vector approaches, they have generally assumed a trusted environment. We design and evaluate the Secure Efficient Ad hoc Distance vector routing protocol (SEAD), a secure ad hoc network routing protocol based on the design of the Destination-Sequenced Distance-Vector routing protocol (DSDV). In order to support use with nodes of limited CPU processing capability, and to guard against denial-of-service (DoS) attacks in which an attacker attempts to cause other nodes to consume excess network bandwidth or processing time, we use efficient one-way hash functions and do not use asymmetric cryptographic operations in the protocol. SEAD performs well over the range of scenarios we tested, and is robust against multiple uncoordinated attackers creating incorrect routing state in any other node, even in spite of any active attackers or compromised nodes in the network. <s> BIB003 </s> A Survey on Security in Mobile Peer-to-Peer Architectures—Overlay-Based vs. Underlay-Based Approaches <s> Countermeasures for Attacks during Routing and Data Transmission Phase <s> We consider the problem of incorporating security mechanisms into routing protocols for ad hoc networks. Canned security solutions like IPSec are not applicable. We look at AODV[21] in detail and develop a security mechanism to protect its routing information. We also briefly discuss whether our techniques would also be applicable to other similar routing protocols and about how a key management scheme could be used in conjunction with the solution that we provide. <s> BIB004 </s> A Survey on Security in Mobile Peer-to-Peer Architectures—Overlay-Based vs. Underlay-Based Approaches <s> Countermeasures for Attacks during Routing and Data Transmission Phase <s> Mobile ad-hoc networking works properly only if the participating nodes cooperate in routing and forwarding. However, it may be advantageous for individual nodes not to cooperate. We propose a protocol, called CONFIDANT, for making misbehavior unattractive; it is based on selective altruism and utilitarianism. It aims at detecting and isolating misbehaving nodes, thus making it unattractive to deny cooperation. Trust relationships and routing decisions are based on experienced, observed, or reported routing and forwarding behavior of other nodes. The detailed implementation of CONFIDANT in this paper assumes that the network layer is based on the Dynamic Source Routing (DSR) protocol. We present a performance analysis of DSR fortified by CONFIDANT and compare it to regular defenseless DSR. It shows that a network with CONFIDANT and up to 60% of misbehaving nodes behaves almost as well as a benign network, in sharp contrast to a defenseless network. All simulations have been implemented and performed in GloMoSim. <s> BIB005 </s> A Survey on Security in Mobile Peer-to-Peer Architectures—Overlay-Based vs. Underlay-Based Approaches <s> Countermeasures for Attacks during Routing and Data Transmission Phase <s> This paper analyzes the blackhole attack which is one of the possible attacks in ad hoc networks. In a blackhole attack, a malicious node impersonates a destination node by sending a spoofed route reply packet to a source node that initiates a route discovery. By doing this, the malicious node can deprive the traffic from the source node. In order to prevent this kind of attack, it is crucial to detect the abnormality occurs during the attack. In conventional schemes, anomaly detection is achieved by defining the normal state from static training data. However, in mobile ad hoc networks where the network topology dynamically changes, such static training method could not be used efficiently. In this paper, we propose an anomaly detection scheme using dynamic training method in which the training data is updated at regular time intervals. The simulation results show the effectiveness of our scheme compared with conventional scheme. <s> BIB006 </s> A Survey on Security in Mobile Peer-to-Peer Architectures—Overlay-Based vs. Underlay-Based Approaches <s> Countermeasures for Attacks during Routing and Data Transmission Phase <s> A mobile ad hoc network (MANET) is a self-organizing, self-configuring confederation of wireless systems. MANET devices join and leave the network asynchronously at will, and there are no predefined clients or server. The dynamic topologies, mobile communications structure, decentralized control, and anonymity creates many challenges to the security of systems and network infrastructure in a MANET environment. Consequently, this extreme form of dynamic and distributed model requires a revaluation of conventional approaches to security enforcements. In this paper, we propose a new routing mechanism to combat the common selective packet dropping attack. Associations between nodes are used to identify and isolate the malicious nodes. Simulation results show the effectiveness of our scheme compared with conventional scheme. <s> BIB007
Reliable routes and correct data transmission are crucial for a MANET. Most countermeasures introduced in this chapter are capable of preventing malicious behavior during both routing and data transmission phases. The countermeasures can be categorized into intrusion prevention, intrusion detection, and intrusion response mechanisms. Preventive mechanisms are mostly based on cryptographically secured routing protocols. The Authenticated Routing for Ad hoc Networks (ARAN) BIB002 is one of the first proposed crypto-based intrusion prevention algorithms for MANETs. ARAN uses a Public Key Infrastructure (PKI) to authenticate routing messages. Both route request and route reply messages are signed by the originating node. Each intermediate node validates received messages before these messages are again signed and forwarded. This way, ARAN can prevent attacks that are based on altering routing messages. Yet, on the other hand, a trusted entity that provides cryptographic certificates is required. Further, private key cryptography is computationally expensive. Therefore, further approaches as, e.g., the Secure Efficient Ad hoc Distance vector (SEAD) BIB003 routing protocol, the Secure Routing Protocol (SRP)  , and the Secure AODV (SAODV) BIB004 routing protocol were proposed to overcome or reduce the impact of those drawbacks. By using one-way hash chains instead of asymmetric cryptography, SEAD reduces computational resources required for authentication. SRP is based on a similar approach by using message authentication codes (i.e., symmetric cryptography and a shared key) instead of asymmetric cryptography for authentication of routing messages. On the other hand, SAODV combines asymmetric cryptography with hash chains. SAODV distinguishes between mutable fields (as, e.g., the hop count) and static fields (as, e.g., source and destination addresses) of routing messages. As mutable fields have to be modified on each hop from source to destination, computationally cheap hash chains are used for authentication. As static fields have to be signed only at the source, asymmetric cryptography is used. Besides cryptographic approaches, Yi et al.  introduced a trust-based and less costly approach to prevent malicious behavior. By mapping predefined real-world relations to the network, trusted nodes can be identified. Those trusted nodes are assumed to behave benignly. As long as sufficient trusted nodes are available, no malicious node is involved in routing or data forwarding. Yi et al. motivated their work with a military scenario where the military rank is defined as a trust level that is mapped directly to nodes. Nodes with high trust level are preferred for routing to ensure that messages are delivered correctly. Although the trust-based approach is less costly compared to previously presented cryptographic intrusion prevention mechanisms, it can only be used in scenarios where trust-relationships between nodes exist. As intrusion prevention can fail, a network has to be capable of detecting ongoing malicious behavior. Therefore, intrusion detection is required. One of the first Intrusion Detection Systems (IDS) for MANETs is the Watchdog IDS introduced by Marti et al. BIB001 . Assuming bidirectional wireless links, each node in a wireless network receives all messages sent by nodes in transmission range. The Watchdog algorithm is based on analyzing these overheard messages to verify the behavior of nodes in the neighborhood. Whenever a malicious node drops a received message, the predecessor on the route can detect this misbehavior as the malicious node has received but not forwarded a message. This information can be used to exclude the malicious node from routes. Furthermore, as long as the data is not encrypted, neighbor nodes are able to detect forged or modified messages. In order to operate correctly, Watchdog requires bidirectional links and wireless interfaces operating in promiscuous mode. Since Watchdog, several other IDSs were proposed. For instance, Kurosawa et al. BIB006 introduced a more specialized IDS for the Blackhole attack in AODV-based MANETs. In AODV, each routing message sent by a node is marked by a unique sequence number. These sequence numbers are used to determine the freshness of the routing information. Blackholes tamper with the sequence numbers to feign fresh routes and, therefore, increase the probability that routes are established based on the forged messages. To detect forged messages, Kurosawa et al. proposed a metric based on the difference between the received sequence number and stored sequence numbers from previously established routes with the same destination node. When the sequence numbers differ strongly, a Blackhole may be involved. After detecting malicious nodes, Intrusion Response Systems (IRS) exclude malicious nodes from routes. The Pathrater was proposed by Marti et al. BIB001 in combination with the Watchdog IDS. Each node in the neighborhood has a trust level defined by the Pahtrater. The data transmission is monitored by the Watchdog and whenever a node does not forward a packet correctly, the trust level is decreased. During routing, the average trust level per route is calculated and the route with the highest trust level is preferred. Further, the path length is considered by the Pathrater to ensure that short routes (regarding the number of hops) are preferred over longer ones with an equal trust level. A prominent combination of a trust-based IRS with an IDS was proposed by Buchegger et al. BIB005 . The Cooperation of Nodes-Fairness in Dynamic Ad-Hoc Networks (CONFIDANT) system consists of the Monitor, the Trust Manager, the Reputation System and the Path Manager. The Monitor detects misbehavior of neighbor nodes while the Reputation System records detected misbehavior of monitored nodes. When a threshold is exceeded, the Trust Manager sends an alarm message to neighbors and the Path Manager removes malicious nodes from routing tables. This way, the routing algorithm avoids malicious nodes when they are detected. Both approaches, Watchdog with Pathrater and CONFIDANT are based on detecting malicious nodes by overhearing packets sent in the neighborhood combined with a trust-based metric. However, while a Watchdog node has to detect each malicious node on its own, CONFIDANT nodes cooperate and share information about malicious nodes. Furthermore, besides bypassing malicious nodes, CONFIDANT also denies routing and forwarding services to detected malicious nodes to discourage malicious behavior. A more recent IDS and IRS combination was presented in BIB007 . Here, a distinction is made between unknown, known and companion trust levels for neighbor nodes. The trust level depends on the behavior of the node and can be improved from the initial unknown level up to the high companion level. The metric according to which the behavior of neighbor nodes is rated, is defined as the ratio of correctly forwarded foreign packets and originated own packets. This results in more reliable routes, as trustworthy nodes are preferred for routing.