Intrusion Detection Techniques for Mobile Wireless Networks

Intrusion Detection Techniques for Mobile Wireless Networks Zhang, Lee, Yi-An Huang Presented by: Alex Singh and Nabil Taha

Outline • Introduction • Intrusion Detection and the Challenges of Mobile Ad-Hoc Networks • An Architecture for Intrusion Detection • Anomaly Detection in Mobile Ad-Hoc Networks • Experimental Results • Conclusion

Introduction • Rapid proliferation of wireless networks changed the landscape of network security • Traditional firewalls and encryption software no longer sufficient • Need new mechanisms to protect wireless networks and mobile computing application

Checklist • Examine vulnerabilities of wireless networks • Discuss intrusion detection in security architecture for mobile computing environment • Evaluate such architecture through simulation experiments

Vulnerabilities of Wireless Networks • Wireless links leaves the network susceptible to • Passive eavesdropping • Active interfering • Mobile nodes are capable of roaming independently • Decision-making in wireless networks rely on cooperative algorithms

Intrusion Detection and the Challenges of Mobile Ad-Hoc Networks • Intrusion – Any set of actions that attempt to compromise the integrity, confidentiality, or availability of a resource • Intrusion Prevention – Primary defense (i.e. Passwords, Biometrics) • Intrusion Detection Systems (IDSs)– Second wall of defense

Network-based IDS – Runs at the gateway of a network and examines network packets that go through the network hardware interface Host-based IDS – Relies on operating system audit data to monitor and analyze the events generated by programs or users on the host Categories of IDSs

Misuse Detection – uses patterns of well known attacks or weak spots to identify known intrusions. ex: guessing password, locks account after 4 failed attempts. Lacks ability to detect newly invented attacks Anomaly Detection – flags activates that differ significantly from the established normal usage. ex: frequency of program usage much lower or much higher than normal usage Does not need prior knowledge of attacks High false positive rate Intrusion Detection Techniques

Problems with current IDSs • Fixed infrastructure IDS techniques can not be directly applied to mobile ad-hoc networks • Rely on real-time traffic analysis • Must be done at the system for mobile ad-hoc networks and not at a gateway, switch or router • Mobile users tend to adopt new operations modes such as disconnected operations

Questions for a Viable IDSs • What is a good system architecture for building intrusion detection and response systems • What are the appropriate audit data sources and how do we detect anomaly based on partial, local audit traces • What is a good model of activities in a mobile computing environment that can separate an anomaly from normalcy

An Architecture for Intrusion Detection

IDS agent

Data Collection • Gathers streams of real-time audit data from various sources • Includes: • System activities • User activities • Communication activities by this node • Communication activities by other nodes within this radio range • This supports multi-layered intrusion detection method

Local Detection • The local detection engine analyzes the local data traces gathered by the local data collection module for evidence of anomalies. • Includes both misuse detection or anomaly detection

Cooperative Detection • Any node can initiate a response if it has strong enough evidence about intrusion • If the node only has weak or inconclusive evidence, it can warrant a broader investigation • Possible to detect intrusion even when evidence at individual nodes is weak

Intrusion Response • The type of intrusion response depends on: • Type of intrusion • Type of network protocols • Type of applications • Confidence (or certainty) in the evidence • Typical Responses: • Re-initiate communication channels between nodes • Identify compromised node and exclude it

Multi-Layer Integrated Intrusion Detection and Response • With wireless networks, there are vulnerabilities in multiple layers and intrusion detection module needs to be placed at each layer on each node • Need to coordinate intrusion detection and response efforts between layers • Enables us to analyze the attack scenario in its entirety

Anomaly Detection in Mobile Ad-Hoc Networks • Anomaly detection works on the premise that there is intrinsic and observable characteristic of normal behavior that is distinct from that of abnormal behavior • We can use a classifier, trained using normal data, to predict what is normally the next event given the previous n events

Procedure for Anomaly Detection • Select audit data • Perform appropriate data transformation • Compute classifier using training data • Apply classifier to test data • Post-process alarms to produce intrusion reports

Attack on Routing Protocols • Route Logic Compromise – Manipulating routing information • Misrouting: forwarding a packet to an incorrect node • False Message Propagation: distributing a false route update • Traffic Patter Distortion – Changes default/normal traffic behavior • Packet dropping • Packet generation with faked source address • Corruption on packet contents • Denial-of-service

Audit Data • Local Routing Information, including cache entries and traffic statistics • Position locater or GPS which is assumed to not be compromised • Only local information is used since remote nodes can be compromised

Feature Selection • Since we use classifiers as detectors we need to select/construct features from the available audit data • A large feature set is first constructed to cover a wide range of behaviors • Several training runs are conducted and features that occur more than a minimum threshold are selected into the Essential Feature Set

Classifier • Two classifiers were used in the study • RIPPER – A rule induction program, searches the given feature space and computes rules that separate data in appropriate classes • SVM light – Support Vector Machine classifier, pre-process the data to represent patterns in much higher dimension than the given feature space

Post-processing • Choose a parameter l and let the window size be 2l+1 • For a region in the current window if there are more abnormal than normal predictions then the entire region is marked abnormal • Shift the window and repeat • Count all continuous abnormal regions as one intrusion session

Detecting Abnormal Updates to Routing Tables • Routing table contains at a minimum the next hop to each destination node and the distance • Physical movement is measured by distance and velocity • The routing table change is measured by the percentage of changed routes – PCR • And the percentage of changes of all hops of all the routes – PCH

Computing Normal Profile • Denote PCR the class (i.e. concept), and distance, velocity, and PCH, etc. the features describing the concept; • Use n classes to represent the PCR values in n ranges, ex, we can use 10 classes each representing 10 percentage points - that is, the trace data belongs to n classes • Apply a classification algorithm to the data to learn a classifier for PCR • Repeat the above for PCH, that is, learn a classifier for PCH

Finding Anomalies • If abnormal data is not available compute clusters of the deviation scores where each score pair is a point (PCR, PCH) then the outliers can be considered anomalies

Detecting Abnormal Activities in Other Layers • Anomaly detection in other layers (MAC protocols, application, services, etc.) use a similar approach • MAC protocols- form cluster using the deviations of the total number of channel requests and the total number of nodes making the request during a time period s

Experimental Results

Discussion • Anomaly detection works much better on a routing protocol in which a degree of redundancy exists within infrastructure • DSR embeds a whole source route in each packet dispatched • This makes it harder to hide intrusion by faking a bit of routing information

Conclusions • Mobile Wireless networks require different techniques to detect intrusions • Anomaly detection is a critical part of component of intrusion detection and response • Trace analysis and anomaly detection should be done locally and possibly through cooperation with all nodes in the network • Paper focused on ad-hoc routing protocols since they are the foundation of a mobile ad-hoc network

Conclusions – Routing Protocols • Use anomaly detection models constructed using information available from the routing protocols • Apply RIPPER and SVM Light to compute classifiers • Showed that these detectors in general have good detection performance with SVM Light having better performance

Conclusions - findings • They noted some disparity in security performance among different types of routing protocols • They claimed that protocols with strong correlation among changes of different types of information(location, track and routing message) tend to have better detection performance • And on-demand protocols usually work better than table-driven protocols

Intrusion Detection Techniques for Mobile Wireless Networks