A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Flooding Attack: <s> A wireless ad hoc network is a collection of mobile nodes with no fixed infrastructure. The absence of a central authorization facility in dynamic and distributed environments requires collaboration among nodes. When a source searches for a route to a destination, an intermediate node can reply with its cached entry. To strengthen correctness of such a routing discovery process, we propose a method in which the intermediate node requests its next hop to send a confirmation message to the source. After receiving both a route reply and confirmation message, the source determines the validity of a path according to its policy. As a result, this strategy discourages malicious nodes from intercepting packets. Simulation results show a remarkable improvement in throughput (30% higher delivery ratio and 10% less data transmission overhead) with a moderate increase of control messages. <s> BIB001 </s> A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Flooding Attack: <s> The black hole problem is one of the security attacks that occur in mobile ad hoc networks (MANETs). We present two possible solutions. The first is to find more than one route to the destination. The second is to exploit the packet sequence number included in any packet header. Computer simulation shows that compared to the original ad hoc on-demand distance vector (AODV) routing scheme, the second solution can verify 75% to 98% of the route to the destination depending on the pause times at a minimum cost of the delay in the networks. <s> BIB002 </s> A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Flooding Attack: <s> We investigate the impact of hacker attacks by malicious nodes on the overall network performance. These malicious nodes mimic normal nodes in all aspects, except that they do route discoveries much more frequently than other nodes. We show, using simulations, that the basic route discovery mechanism used in many ad hoc network protocols can be exploited by as few as one malicious or compromised node to bring down throughput dramatically. We propose an adaptive statistical packet dropping mechanism to mitigate such situations and reduce the loss of throughput. The proposed mechanism works even when the identity of the malicious node is unknown and does not use any additional network bandwidth. It is simple to implement and maintains or improves network throughput when there are no malicious nodes, but the network is congested with excess traffic. <s> BIB003 </s> A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Flooding Attack: <s> Mobile ad hoc network (MANET) is particularly vulnerable to flooding attacks. To evade being identified, attackers usually recruit multiple accomplices to dilute attack traffic density of each attack source, and use the address spoofing technique to challenge attack tracing. In this paper, we present a detailed investigation of the flooding attack in MANET. Further, we design two flow based detection features, and apply the cumulative sum algorithm on them to effectively and accurately detect such attack. <s> BIB004 </s> A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks <s> Solutions to the Flooding Attack: <s> This paper analyzes the blackhole attack which is one of the possible attacks in ad hoc networks. In a blackhole attack, a malicious node impersonates a destination node by sending a spoofed route reply packet to a source node that initiates a route discovery. By doing this, the malicious node can deprive the traffic from the source node. In order to prevent this kind of attack, it is crucial to detect the abnormality occurs during the attack. In conventional schemes, anomaly detection is achieved by defining the normal state from static training data. However, in mobile ad hoc networks where the network topology dynamically changes, such static training method could not be used efficiently. In this paper, we propose an anomaly detection scheme using dynamic training method in which the training data is updated at regular time intervals. The simulation results show the effectiveness of our scheme compared with conventional scheme. <s> BIB005
In  , Yi et al. have proposed a simple mechanism to prevent the flooding attack in the AODV protocol. Here each node is to monitor its neighbors' RREQ. If the RREQ rate of any neighbor exceeds the predefined threshold, the node records the ID of this neighbor in a blacklist. All future RREQs from the blacklisted nodes are then dropped. But this approach has limitations that a flooding threshold has to be set below which the attack cannot be detected. Also if a genuine nodes ID is impersonated by a malicious node and a large number of RREQs, are broadcast, other nodes might put the ID of this legitimate node on the blacklist. In BIB003 , Desilva et al. have proposed an adaptive technique to mitigate the effect of a flooding attack in the AODV protocol. It uses a statistical analysis to detect malicious RREQ floods and avoid the forwarding of such packets. The approach to attack detection is similar to that in [40.] with the difference that instead of a fixed threshold, this approach determines the threshold based on a statistical analysis of RREQs. The key advantage of this approach is that it can reduce the impact of the attack for varying flooding rates. In BIB004 , Guo et al. have proposed a flow based detection mechanism against the flooding attacks in MANETs using the non-parameter CUSUM algorithm  . For the attacks when the source and destination node addresses are generated randomly for flooding (address spoofing), the authors have defined a detection feature as the percentage of new RREQ flows from the total RREQ flows, over a small time interval. This percentage over a period of time should remain stably, at a low level for normal network situation. For nonaddress spoofing attacks, where the flooding RREQ have same source and destination node addresses, the detection feature is defined as the percentage of RREQ with a fixed set of source and destination node addresses to the total RREQ flows over a small time interval. This percentage over a period of time should remain stably, at a low level for normal network situation. These percentage variables being random, CUSUM algorithm has been used to detect the threshold level for attack condition. The authors have used the DSR protocol for the case study. In requesting node without sending the DATA packets to the reply node at once waits for other replies with next hop details from the other neighboring nodes. After receiving the first request a timer is set in the 'TimerExpiredTable', for collecting the further requests from different nodes. The 'sequence number', and the time at which the packet arrives is stored in a 'Collect Route Reply Table' (CRRT). Now the 'timeout' value based on arriving time of the first route request are calculated. Now CRRT is checked for any repeated next hop node which if found, it is assumed the paths are correct or the chance of malicious paths is limited. If there is no repetition then any random route from CRRT is selected. In BIB001 Lee et al. have proposed the route confirmation request (CREQ) and route confirmation reply (CREP) to avoid the blackhole attack. The intermediate nodein addition to sending RREPs to the source node also sends CREQs to its next-hop node towards the destination node. The next-hop node on receipt of a CREQ looks up its cache for a route to the destination. If a route is found, it sends the CREP to the source. On receipt of the CREP, the source node compares the path in RREP and the one in CREP. If both are identical the source node pronounces the route to be correct. However in this proposal a blackhole attack is not resolved if two consecutive nodes work in collusion, that is, when the next-hop node is a colluding attacker. In BIB002 , Shurman et al. have proposed the source node to wait until the arrival of a RREP packet from more than two nodes. On receiving multiple RREPs, the source node checks about a shared hop. If at least one hop is shared, the source node judges that the route is safe. The drawback here is the introduction of a time delay due to the wait till the arrival of multiple RREPs. In BIB005 , Kurosowa et al. have analyzed the blackhole attack and propounded that the destination sequence number must sufficiently be increased by the attacker node in order to convince the source node that the route provided is optimum. Based on differences between the destination sequence numbers of the received RREPs, the authors propose a statistical based anomaly detection approach to detect the blackhole attack. This approach has a merit that the attack can be detected at a low cost without introducing extra routing traffic without modification of the existing protocol, albeit false positives is a demerit.