Efficient approaches to improve the performance of anomaly intrusion detection in wireless networks using mac layer and network layer feature set

Abstract

Wireless ad-hoc network is an autonomous system of wireless nodes connected by wireless links. The self-organizing property of wireless ad hoc network provides an extremely flexible method for establishing communications in situations where geographical or terrestrial constraints demand totally distributed network, such as battlefields, emergency and disaster areas. This thesis explores various types of intrusion detection techniques such as misuse intrusion detection and anomaly intrusion detection for wireless ad-hoc networks. The design of anomaly intrusion detection technique for wireless ad-hoc network has been proposed in this research work. This research work focuses on wireless node behavior based detection technique. Most of anomaly intrusion detection systems are focusing on upper layers traffic to profile normal behavior of wireless node. This research work focus on only MAC and network layer of wireless node. This research work introduces three behavioral indexes. They are match index, entropy index, and newness index. This research work proposes threshold based detection technique for three behavioral indexes. To improve further the performance of anomaly intrusion detection for wireless ad hoc network, this research introduces combined behavior index and also introduces one more behavior index called sequence index which checks consistency of wireless node feature set that adds to the combined behavioral index. In the implementation part, wireless network traffic is extracted using ns2 simulator. Algorithm for anomaly intrusion detection using genetic algorithm is developed using C language under Linux platform. Sequence behavior Index is separately developed using PERL language under Linux platform. The performance of anomaly intrusion detection is analyzed using single behavioral indices, combined index and combined index with sequence index. The results demonstrate that combined index shows better detection rate and low false alarm rate. newline newline newline