A COLLABORATIVE INTRUSION DETECTION SYSTEM FOR MANET USING DATA MINING TECHNIQUE
Mobile Ad hoc Networks (MANETs) are vulnerable to various kinds of threats due to their dynamic nature and lack of a central point of control. Intrusion Detection System (IDS) which can act in collaboration with other IDS nodes in the nertwork is getting popularity due to its faster adaptability to the changes in the behavior of network traffic. A standalone node in MANET will feel very difficult to set any predefined rule for identifying correctly attack traffic since there is no major difference between normal and attack traffic. Hence, in this paper we have proposed an intelligent collaborative model based on data mining for intrusion traffic detection system that can detect attacks. Here we find and deploy friendly nodes in the network that continuously monitors the behavior of other nodes to find nodes or set of nodes exhibiting anomalous behavior. NS 2 simulations were carried out to anlyze the performance of the proposed system. We evaluated the performance of our proposed collaborative IDS scheme with various other existing IDS models. The results clearly showed that the proposed intrusion detection system considerably reduces the false positive rate, thereby proving that the proposed technique is capable of identifying anomalies in network better than other existing system. Keyword: MANET, anomaly detection, data mining, IDS, collaborative IDS. INTRODUCTION With the rapid development of technology, wireless communication networks have appeared in many forms. Mobile Ad hoc Networks (MANETs) have selfconfiguration and self maintenance capabilities (Nekovee et. al. 2010) In MANETs, each node works as a router and can communicate with other nodes directly or indirectly with the help of its neighbors. MANETs can be deployed in disaster areas to collect critical information, in battlefields to allow for communication among soldiers, and in hazardous areas in the form of sensor networks. Due to the lack of a central point of control, it is more likely that malicious nodes can join the network and launch various types of attacks (Muhammad Imran et al, 2014, Hamed Janzadeh et al. 2009, Humaira Ehsan et al. 2012) An attack can be launched by a single node or multiple nodes in a cooperative manner. The attacker node can be external (node outside the network) or internal (compromised node inside the network) with the internal attackers being the more dangerous and difficult to detect of the two. In some attacks, multiple attackers synchronize their actions to disrupt a target network. According to Ghosh et al. 1998, Vigna and Kemmerer, 1998, intrusion detection systems have been widely implemented in many networks aiming to defend against a variety of attacks. IDS have already become an essential component for current defense infrastructure (Scarfone and Mell, 2007) However, network intrusions have become much more sophisticated and hard to detect (Vasilomanolakis et al. 2015) Since conventional IDSs are not scalable to resolve this issue, IDS collaboration is considered as an effective way to enhance the detection capability of a single ID. They consist of several monitoring components that collect and exchange data. Depending on the specific collaborative intrusion detection system (CIDS) architecture, central or distributed analysis components mine the gathered data to identify attacks. Resulting alerts are correlated among multiple monitors in order to create a holistic view of the network monitored. Motivated by this, collaborative intrusion detection systems have been developed, with the purpose of strengthening a single IDS by collecting knowledge and learning experience from other IDS nodes. According to (Wu et al. 2003) collaborative IDS is expected to enhance the overall detection accuracy of intrusion assessment and will also improve the possibility of identifying novel attacks. Hence, the main objective of this paper is to design a robust collaborative intrusion detection system that can effectively evaluate the trustworthiness of each node within the network and identify the intrusions in the network. The collaborative IDS pproposed in this paper uses data mining techniques for detecting attacks. Here we select and deploy friendly IDS nodes based on their trust, that continuously monitor the behavior of other nodes in the network for any intrusions. The proposed IDS was evaluated using NS 2 simulations which showed that the proposed system considerably reduced the false positive rate compared to other existing IDS, thereby proving that it is better than other existing system. RELATED WORK Shakshuki et al. 2013 proposed an IDS named Enhanced Adaptive Acknowledgment (EAACK) for MANETs. Their scheme requires all acknowledgment packets to be digitally signed by its sender and verified by its receiver. They used DSA and RSA as digital signatures and showed that their scheme is able to detect wide range of attacks. However, the drawback of their scheme is the requirement to digitally sign all the acknowledgments which increases computational overhead. VOL. 13, NO. 14, JULY 2018 ISSN 1819 6608 ARPN Journal of Engineering and Applied Sciences (c)2006 2018 Asian Research Publishing Network (ARPN) All rights reserved. www.arpnjournals.com 4388 Marti et al. 2000 proposed an IDS scheme for MANET which consists of two different modules, viz. the Watchdog and the Pathrater. In this scheme, the Watchdog acts as an IDS for the MANET and detects malicious node behaviors in the network by promiscuously listening to its next hop's transmission. If the Watchdog notices that its immediate next node fails to forward the packet within a given period of time then it increments the node's failure counter. If the failure counter of the monitored node exceeds a threshold value then the Watchdog reports the node as misbehaving. The Pathrater is then employed to inform the routing protocol to avoid the reported nodes for further data transmission. The drawback of this scheme is that it requires continuous monitoring by the Watchdog for detecting intrusions. Liu et al. 2007 proposed a TWOACK MANET IDS scheme which requires every data packets transmitted over three consecutive nodes along the source to the destination path to be acknowledged. Every node along the route has to send back an acknowledgment packet to the node that is two hop counts away from it in the route. The arrival of TWOACK packet at first node X (in the three consecutive nodes along the route) indicates a successful transmission of packet from node X to node Z via the intermediate node Y. However, if this TWOACK packet is not received within a given predefined time interval, both nodes Y and Z are reported as malicious. The drawback of this scheme is that it introduces a routing overhead due to frequent TWOACK packet generation. Misra et al. 2010 proposed a distributed self learning, energy aware and low complexity protocol for intrusion detection in wireless sensor network. Their protocol uses the stochastic Learning Automata (LA) on packet sampling mechanism to obtain an energy efficient IDS. They showed that their approach was successful in detecting and removing malicious packets from the WSN. The drawback of this scheme is that the LA needs multiple rounds of learning before it becomes efficient. Haddadi and Sarram, 2010 proposed a hybrid IDS model for Wireless Local Area Network (WLAN) that uses both misuse and anomaly based IDS submodules to detect intrusion. The drawback of this approach is that the response times of the misuse based and anomaly based IDSs are different. It also introduces significant computational overhead due to processing of the same data traffic by two different IDSs. A light weight, energy efficient and noncryptographic intrusion detection solution against the gray hole attack in MANET is proposed by Mohanapriya and Krishnamurthi, 2014. However, their scheme requires the IDS to operate in a promiscuous mode to detect intrusions, which results in high power consumption for operating the IDS. Liu et al. 2006 proposed a game theoretic framework to analyze the interactions between pairs of attacking/defending nodes using a Bayesian formulation in wireless Ad hoc Networks. They suggested a Bayesian hybrid detection approach for the defender, in which a less powerful lightweight module is used to estimate the opponent's type, and a more powerful heavyweight module acts as a last line of defense. They analyzed the obtainable Nash Equilibrium (NE) for the attacker/defender Bayesian game in both static and dynamic settings and concluded that the dynamic approach is a more realistic model, since it allows the defender to consistently update its belief about the maliciousness of the opponent player as the game evolves. The drawback of their work is that it is difficult to determine a reasonable prior probability about the maliciousness of the attacker player. Liu, 2003 proposed a general incentive based method to model attacker's intent, objectives and strategies (AIOS) based on game theoretic formalization. The author developed an incentive based conceptual framework for AIOS modeling which can capture the inherent inter dependency between AIOS and defender objectives and strategies in such a way that AIOS can be automatically inferred. The AIOS modeling enables the defender to predict which kind of strategies are more likely to be taken by the attacker than the others, even before such an attack happens. The AIOS inferences lead to more precise risk assessment and harm prediction. The drawback of the scheme is that it assumes the complete information game. Chen et al. 2001 proposed a framework that applies two game theoretic schemes for economic deployment of intrusion detection agent. In the first scheme, the interaction between an attacker and the intrusion detection agent is modeled and analyzed within a noncooperative game theory setting. The mixed strategy Nash Equilibrium solution is then used to derive the security