DTQ BASED DETECTION AND IDENTIFICATION OF PACKET FORWARDING MISBEHAVIOR IN MANETS

Abstract

In recent years the widespread availability of wireless communications, mobile computing and handheld devices has led to the growth and significance of wireless mobile ad hoc networks. The ability to establish communication without an infrastructure at very low cost and the capacity to communicate beyond the node's wireless transmission range embarks Mobile Ad hoc Networks (MANET) as the deployment ground for various fields such as wireless sensor networks, ubiquitous networks and peer-to-peer networks. Security issues are paramount in such networks. Nodes in MANETs may launch various attacks or may become selfish to save their resources. These nodes can be termed as malicious. Detection of such malicious nodes is critical to success of MANETs. Detecting malicious nodes in an open ad hoc network is more complicated than in traditional wired networks. Also, MANETs have several operational constraints like bandwidth, battery power, CPU, memory. Considering all these factors, developing a technique for detection of malicious nodes in MANETs is very challenging. A variety of techniques have been proposed but all of them have their limitations. In this work, a new technique for detection of malicious node is suggested. This technique is based on a metric known as Data Transmission Quality (DTQ) which decides the communication quality of a node by considering both its near-term and long-term behaviour. A node is blacklisted if its DTQ value falls below the threshold. The DTQ function is defined in a way that it will keep close to constant or change smoothly for legitimate nodes and will keep decreasing for suspicious nodes. We have also proposed a design of an intrusion detection system based on the DTQ based technique. The proposed solution is tested by simulating it in Qualnet. The results show that the solution works well and is able to find all the malicious nodes. False positives are found to be very low and can be reduced to zero by adjusting parameters like bucket sizes, DTQ threshold etc depending on the network behaviour.