A new packet trap based algorithm to detect black hole attack in ad hoc networks

Dissertation for Master Degree in Computer Engineering (M.Sc.)

Trend: Software

Abstract

Nowadays, moving ad hoc networks are more widely used and popular than in the past. Therefore, paying attention to the category of security in such networks is of great importance to the point where it has become one of the important topics in scientific and research circles in the fields of information exchange. The presence of malicious attacks is one of the things that have seriously challenged the security of private networks. Black hole attack is one of these attacks. In this research, a new algorithm for detecting black hole malicious nodes has been presented for the demand-based routing protocol [1] in mobile ad hoc networks. This algorithm identifies malicious nodes by sending empty packets (traps) to frequently used nodes in the network and checking the input and output of these nodes. The proposed method will have the ability to run in parallel on several processors, which will increase the speed of the algorithm execution. The results of the simulation of the proposed algorithm show the ability of the proposed method to detect malicious black hole nodes. Also, the amount of packet loss will be reduced by using this method and the operational capacity of the network will increase to a favorable ratio.

Key words: black hole attack;  moving case networks;  security; intrusion detection; trap package; AODV routing protocol

Chapter 1

Research overview

Introduction

Mobile ad hoc networks [2] include sets of nodes that can freely communicate with each other without having any network infrastructure and through radio frequencies. The speed of setting up and the unstructured nature of these networks has made them play a very important role in various fields, especially military and emergency applications [22], [5] The topic of security in these networks is one of the important research topics today. Mobility of nodes, mobility of communication, dynamic change of network structure, lack of centralized management to check behaviors and functions, lack of specific defense lines and limitation in consumption power of nodes provide a suitable platform for various attacks against these networks. The attacks that exist in these networks are somehow different from the attacks in other networks, and of course the systems used to detect attacks in these networks are different from those in common wired networks. [5]

Mobile ad hoc networks are sets of mobile nodes that can be formed dynamically anywhere and anytime without using any network infrastructure. Most of these nodes act as a router[3] and as a host[4] at the same time. This feature has made it possible to use these networks in emergency cases where it is not possible to form a network with a fixed and predefined structure, such as military cases or floods and such. Communication between nodes in these networks is done through radio waves, and if a node is in the radio range of another node, it is considered a neighbor of that node, and otherwise, if there is a need for communication between two nodes that are not in the radio range of each other, the help of other nodes can be used in this case. Therefore, the communication between nodes in these networks is somehow based on trust and cooperation between nodes. What needs to be paid special attention in the applications of these networks is the limitation of the resources used in it. Therefore, the evaluation criteria of these networks are different from those in wired networks. Some examples of these criteria are as follows: [22]

Energy consumption

Route stability despite its mobility

Security

Identifying the routing protocols of mobile ad hoc networks is necessary to understand the security problems of these networks. The routing protocols of these networks are different from those in wired networks due to high route updates, node mobility, and limited communication range. Therefore, the routing protocol used in these networks needs to keep the following in mind: [16]

Considering that centralized routing involves a lot of overhead and is not scalable as a result, it is necessary for its routing algorithm to be completely distributed.

It should be compatible with the large change in network alignment [5] that occurs due to the large movement of nodes.

The calculation and maintenance of routes should include the minimum number of routes and the existing nodes are required to have the fastest access to the routes.

The demand-based distance vector protocol, which is defined as an on-demand protocol, has route request [6] and route response [7] packets. This protocol is not based on routing from the source and uses a routing table for intermediate nodes [27]. The general working method is as follows: When a source node needs a route to a destination node and there is no valid route in the routing table, the source node broadcasts a route request packet to the destination node [8]. When each node receives the route request packet, it creates or updates a reverse route to the source node in the routing table, and if it does not have a valid route in the routing table to the destination node, it rebroadcasts the route request packet. When the route request packet arrives from the source node to the destination node via broadcast, the destination node creates or updates the reverse route and sends a route response packet that has an increased sequence number [9] in the unicast reverse route [10]. When the route response packet reaches the source node along the reverse route, it creates or updates a forward route to the destination and communication starts [24].

1-2 statement of the problem

Because of the routing structure of mobile ad hoc networks, which is based on a kind of trust between nodes, it provides a good opportunity for attackers to participate in the routing process, cause routing deception and ultimately disrupt the routing. The self-structuring feature [11] of mobile ad hoc networks will also cause a series of attacks [16]. The structure of this network is such that when a node enters, it is necessary to assign an ID to it by obtaining information from other nodes. A malicious node [12] can disrupt this or take the ID assigned to the node for itself [22].

The use of attack prevention methods in these networks faces more limitations. For example, encryption [13] and authentication [14] methods are used in these networks for defense purposes. But according to the structure of these networks, there is a possibility that a node will be stolen and if there is a private key [15] for it, this key will be revealed, so these methods will be useless. Considering that there is no centralized structure for nodes in mobile ad hoc networks, nodes cannot trust the security facilities of the network and each node needs to consider its own security [5]. This firewall causes only nodes with physical address [17] to connect to the network. The absence of this option for mobile ad hoc networks makes it easy for attackers to enter the network. In the case of an attack on the network, in the best case, the attacking node can find out the existence of confidential information by checking the network information, and in the worst case, it can cause a disconnection between the nodes. Due to the lack of a specific access point to control the entry and exit of packets in mobile ad hoc networks, there is no suitable place to install a firewall in a way that checks the entire network traffic. Mobile nodes can easily enter or leave the network without any restrictions being imposed on them. Routing algorithms that operate on mobile ad hoc networks require complete trust between nodes, which reduces the security factor in these networks. Also, not having a centralized structure prevents the existence of a central supervisor in the system[22].

Black hole attack[18] is one of the most well-known attacks in mobile ad hoc networks. This attack is applied through one of the nodes in the network. Because an attacking node from outside the network introduces itself as a node inside the network. This node sends a favorable route response to each received route request, regardless of its routing table and whether this node has a route to the destination node or not. This shortens the sending of route response packets compared to other nodes, and the network nodes find this node as a suitable and short path for sending packets and send their packets from this node's route.