Intrusion detection systems in wireless ad-hoc networks: detecting worm attacks

As wireless networks become more commonplace, it is important to have methods to detect attacks against them. We have surveyed current open source and commercial wireless intrusion detection systems, and we present our findings. An intrusion detection system utilizing cross-layer detection, which has been designed and implemented, is described. Kismet, in conjunction with Snort and a custom developed CPU usage monitoring tool, is used to detect worm attacks on wireless networks. The process of designing and implementing a computer worm to test the accuracy of the developed system is detailed. The design, implementation, and configuration of the wireless intrusion detection system are presented. After testing how well this system detects the worm, the results are given and discussed, which indicate that the tools we use work well together and can accurately detect a worm attack. We include a discussion on how our intrusion detection system can be broadened into a more useful general framework that can be used in different environments to detect different attacks. Conclusions about the performance of this system and directions of future research are included at the end