Auswertung von Positionsdaten, Funkcharakteristika und des Verbindungsgraphen für die Angriffserkennung in mobilen Ad-hoc-Netzen

This diploma thesis examines how positioning data, radio signal characteristics and routing information can be used to detect active attacks (such as the black hole attack) in mobile ad hoc networks (MANETs). Various data sets are analysed and compared to check their consistency in order to detect anomalies that might indicate an attack. Direct positioning data (such as GPS coordinates) and other sources of information (such as radio signal strength) are taken into account from which conclusions can be drawn about the distance between individual nodes. Expected communication relationships derived from node localization are compared to the actual network connectivity graph given by the routing tables. This comparison can detect suspicious properties (divergent values) which could indicate an attack in progress. The thesis is divided into three parts. The first part gives an overview to MANETs, routing, security, attackers and attack detection. In Chapter 2, the routing in MANETs and the special characteristics of routing protocols is explained. Chapter 3 presents the relevant information about GPS, radio signal strength and topology information while Chapter 4 deals with attacks on computer networks and their detection, focusing on MANETs. Based on the above approaches and findings, the second part introduces the models for the attack detection based on positioning data, radio signal strength and topology information. In Cahpter 5 The model is described mathematically. In Chapter 6 an overview of the implementation is given to simplify further developments based on this work. The last part describes the evaluation of the developed model using the simulator JiST/MobNet (Chapter 7) and Ad hoc On-demand Distance Vector Routing (AODV) as the underlying routing protocol. In Chapter 8 various simulation scenarios and the corresponding results are presented. In this evaluation part the obtained simulation data are analysed and the effectiveness of the developed IDS is discussed in detail. Simulation results show that the developed IDS component detect attacks on a MANET with high probability for various set-ups. Significant differences between the number of warnings in a network with one or more attacker compared to a network without malicious nodes could be derived. The accuracy of the IDS detecting blackhole attacker within a MANET is above 95% in average. On the other hand the probability of false positive warnings for a benign node is below 1%. A summary of all results and a prospect of further work improving this new concept of intrusion detection in MANETs can be found in the final Chapter 9