Enhanced OLSR For Defense DoS - 2013
Enhanced OLSR For Defense DoS - 2013
Enhanced OLSR For Defense DoS - 2013
1, FEBRUARY 2013
31
I. INTRODUCTION
A mobile ad hoc networks (MANET) is a collection of mobile devices which are connected by wireless links without the
use of any fixed infrastructures or centralized access points. In
MANET, each node acts not only as a host but also as a router to
forward messages for other nodes that are not within the same
direct wireless transmission range. Each device in a MANET
is free to move independently in any direction, and will therefore change its links to other devices frequently. MANETs are
much more vulnerable and are susceptible to various kinds of
security attacks [1] because of its cooperating environment. In
the absence of a fixed infrastructure that establishes a line of defense by identifying and isolating non-trusted nodes, it is possible that the control messages generated by the routing protocols
are corrupted or compromised thus affecting the performance
of the network. Routing protocols in MANET can be classified
into two categories: reactive protocol and proactive protocol. In
proactive routing protocols, all nodes need to maintain a consistent view of the network topology. When a network topology changes, respective updates must be propagated throughout
the network to notify the change. In reactive routing protocols
Manuscript received December 29, 2011; approved for publication by JangWon Lee, Division II Editor, May 20, 2012.
The authors are with Sri Krishna College of Engineering and Technology,
Coimbatore, Tamilnadu, India, email: {mohanapriya, deancse}@skcet.ac.in.
Digital Object Identifier 10.1109/JCN.2013.000007
c 2013 KICS
1229-2370/13/$10.00
32
(a)
(b)
Fig. 1. Node broadcasting messages: (a) Regular flooding and (b) MPR
flooding.
lection. In OLSR, each node generates HELLO message periodically (every HELLO INTERVAL). A nodes HELLO message contains its own address and the list its 1-hop neighbors.
A TC message is the message that is used for route calculation.
In OLSR, each MPR node advertises TC message periodically
(every TC INTERVAL). A TC message contains the list of the
senders MPR selector. The protocol functioning of OLSR is as
follows:
A. Neighborhood Discovery
Neighborhood discovery is the process, whereby each router
discovers the routers which are in direct communication range
of itself (1-hop neighbors), and detects with which of these it can
establish bi-directional communication [3]. Each router sends
HELLOs, listing the identifiers of all the routers from which it
has recently received a HELLO, as well as the status of the
link.
B. MPR Flooding
MPR Flooding is the process whereby each router is able
to, efficiently, conduct network-wide broadcasts [3], [5]. Each
router designates, from among its bi-directional neighbors, a
subset (MPR set) such that a message transmitted by the router
and relayed by the MPR set is received by all its 2-hop neighbors. Nodes may express, in their HELO messages, their willingness to be selected as MPR, which is taken into consideration for the MPR calculation. Each node selects its MPR set
from among its 1-hop neighbors such that they can reach all its
2-hop neighbors.
Each node maintains information about the set of neighbors
that have selected it as an MPR. The set of nodes having selected
a given node as MPR is the MPR-selector-set of that node. A
node obtains this information from periodic HELLO messages
received from the neighbors. In OLSR, each MPR node must
forward the data and routing message coming from any of its
MPR selectors.
C. Link State Advertisement
Link state advertisement is the process whereby nodes are determining which link state information to advertise through the
network [3]. Each node must advertise, at least, all links between itself and its MPR-selector-set, in order to allow all nodes
to calculate shortest paths. Such link state advertisements are
carried in TCs, broadcast through the network using the MPR
flooding process. As a node selects MPRs only from among
its bi-directional neighbors, links advertised in TC are also bidirectional and routing paths calculated by OLSR contain only
bi-directional links. TCs are sent periodically, however certain
events may trigger non-periodic TCs.
III. NODE ISOLATION ATTACK
Node isolation attack is a kind of DOS attack launched by malicious nodes against OLSR protocol [5]. The goal of this attack
is to isolate a node from communicating with other nodes in the
network. More specifically, this attack prevents a victim node
from receiving data packets from other nodes in the network.
The idea of this attack is that attacker(s) prevent link information of a specific node or a group of nodes from being spread
to the whole network. Thus, other nodes who could not receive
link information of these target nodes will not be able to build
a route to these target nodes and hence will not be able to send
data to these nodes.
In this attack, attacker creates virtual links by sending fake
HELLO messages including the address list of target nodes 2hop neighbors, (the attacker can learn victims 2-hop neighbors
by analyzing TC message of its 1-hop neighbors). According to
OLSR protocol, the MPR selection is based on the maximum
coverage of any nodes 2-hop neighbors. So the target node will
select the attacker to be its only MPR node because it assumes
that it can reach all its 2-hop neighbors through the attacker itself. Thus, the only node that must forward and generate TC
messages for the target node is the attacking node. By dropping TC messages received from the target and not generating
TC messages for the target node, the attacker can prevent the
link information of target node from being disseminated to the
whole network. As a result, other nodes would not be able to receive link information of a target node and will conclude that a
target node does not exist in the network thus launching DOS
attack on the victim. Therefore, a target nodes address will
be removed from other nodes routing tables. Since in OLSR,
through HELLO messages each node can obtain only information about its 1-hop and 2-hop neighbors, other nodes that are
more than two hops away from a target node will not be able
to detect the existence of the target node. As a consequence, the
target node will be completely prevented from receiving data
packets from nodes that are three or more hops away from it.
In Fig. 2, node C is the attacking node, and node B is the target node. Instead of sending correct HELLO message that contain {B, F} in neighbor address list, the attacker sends a fake
33
34
Table 1. As ONE_HOP.
Table 2. Xs neighbors.
Originator
X
Neighbors
E, F, G, Z
35
simulation is 600 s. Random waypoint model is used as the mobility model for each node. Node speed is varied from 2 m/s
to 25 m/s. The node pause time is varied from 0 second to 300
seconds. The default settings as in the specifications of OLSR
[2] were used for HELLO and TC messages. In our simulation,
we used 35% of malicious nodes out of the normal nodes to
launch the attack. The malicious nodes are chosen randomly
and also one of the neighbors of the nodes that are generating
the data traffic is chosen as malicious nodes. The traffic load is
simulated using 15 user datagram protocol-case based reasoning
(UDP-CBR) connections (30 nodes) generating traffic of 5 kB
UDP packets (data payload 512 Bytes) with an inter departure
time of 1 s. To eliminate the randomness in the result, for each
metric, simulation is done for ten different seed values with different random movement of nodes and the average value is taken
for the result. Also our approach is compared with another existing approach [5].
A. Performance Evaluation
We used the following metrics to evaluate the performance of
our proposed solution EOLSR against OLSR under attack and
the results obtained are shown in Figs. 810.
1. Packet delivery ratio: The ratio between the number of packets originated by the CBR sources of source nodes and the
number of packets received by the CBR sink at the destination node.
2. Packet loss rate: It is the number of data packets dropped by
the malicious nodes that are selected as MPR nodes.
3. Control packet overhead: This is the ratio of number of control packets generated to the data packet received.
Fig. 8 shows the packet delivery ratio in the presence of node
isolation attack. Here 1 to 5 malicious nodes are randomly selected to launch the attack. They select any one of the neighbor nodes as their victim and after analyzing the TC messages
and hello messages coming from that node; they create a fake
hello message containing all the 2-hop neighbors of the victim
and send it to the victim. Once the victim selects it as its MPR,
they drop all the data packets and TC packets coming from the
victim. As shown in the figure, The throughput achieved by
OLSR was approximately 25%, while the throughput achieved
in EOLSR under the same scenario was approximately 70%, increased by 45% i.e., EOLSR improved the throughput achieved
by OLSR under attack. When the number of attackers increases,
the throughput nearly drops to zero in normal OLSR whereas in
our scheme, even though the number of attackers increases, the
throughput achieved is more or less in steady state because the
MPR selection is made only after verifying the correctness and
trustworthiness of the node. Similarly, the throughput achieved
by the existing approach [5] is 65% which is 5% less than our
scheme. This is because the existing solution in [5] does not verify the trustworthiness of a node before selecting it as an MPR.
Instead after selecting the MPR node, it overhears the packet
forwarded by that MPR node and compares it with the packets send by itself to verify whether the MPR node is forwarding
the packets or not. Since the detection of malicious MPR node
is possible after the dropping of some TC and data packets by
the MPR node, the throughput achieved in [5] is lesser than our
scheme.
36
&RQWUROSDFNHWV
3DFNHWORVV
(/265
6RORLQ>@
7KURXJKSXW
1RRIDWWDFNHUV
1RRIDWWDFNHUV
1RRIDWWDFNHUV
B. Kannhavong, H. Nakayama, and A. Jamalipour, A survey of routing attacks in mobile ad hoc networks, IEEE trans. Wireless Commun., vol. 14,
no. 5, pp. 8591, Oct. 2007.
[2] T. Clausen and P. Jacquet, IETF RFC3626: Optimized link state routing
protocol (OLSR), Experimental, 2003.
[3] T. Clausen and U.Herberg, Security issues in the optimized link state
routing protocol version 2 (OLSRv2), Int. J. Netw. Security Appl., 2010.
[4] B. Kannhavong, H. Nakayama and A. Jamalipour, A study of routing
attack in OLSR-based mobile ad hoc networks, Int. J. Commun. Syst.,
2007.
[5] B. Kannhavong, H. Nakayama, N. Kato, Y. Nemoto, and A. Jamalipour,
Analysis of the node isolation attack against OLSR-based mobile ad hoc
network, in Proc. ISCN, 2006, pp. 3035.
[6] D. Raffo, C. Adjih, T. Clausen, and P. Muhlethaler, Securing the OLSR
protocol, in Proc. Med-Hoc-Net, 2003.
[7] D. Raffo, C. Adjih, T. Clausen, and P. Muhlethaler, An advanced signature system for OLSR, in Proc. ACM SASN, 2004.
[8] D. Raffo, C. Adjih, T. Clausen, and P. Muhlethaler, Attacks against
OLSR: Distributed key management for security, in Proc. OLSR Interop
and Workshop, 2005.
[9] C. Adjih, T. Clausen, A. Laouiti, P. Muhlethaler, and D. Raffo, Securing the OLSR routing protocol with or without compromised nodes in the
network, HIPERCOM Project, INRIA Rocquencourt, Tech. Rep. INRIA
RR-5494, Feb. 2005.
[10] D. Dhillon, T. S. Randhawa, M. Wang, and L. Lamont, Implementing a
fully distributed certificate autorithy in an OLSR MANET, in Proc. IEEE
WCNC, 2004.
[11] D. Dhillon, J. Zhu, J. Richards, and T. Randhawa, Implementation &
[12]
[13]
[14]
[15]
[16]
Mohanapriya Marimuthu is currently a Ph.D. candidate in the Computer Science Department, at Anna
university of Technology, Coimbatore. She received
her B.E. degree in Computer Science and Engineering
from Bharathiar University in 2002 and M.E. degree
in Computer Science and Engineering from Anna University in 2004. She is working as an Assistant Professor in the Department of Computer Science and Engineering at Sri Krishna College of Engineering and
Technology, Coimbatore. Her research interests are
Network Security and Ad hoc Networks.
37
Ilango Krishnamurthi is a Professor Dean at the Department of Computer Science and Engineering of
Sri Krishna College of Engineering and Technology,
Coimbatore. Ilango received his Ph.D. degree in Computer Science and Engineering from the Indian Institute of Technology, Chennai. He graduated from
BITS, Pilani and received M.S. degree from Iowa
State University, USA both in the fields of Computer
Science & Engineering. He spent 15 years at NIT,
Trichirapalli in the capacities of Lecturer, Assistant
Professor and coordinator of the part time B. Tech programme. Since July 2006, he is with SKCET as a Professor & Head. Since June
2008, he has been promoted as Dean, CSE Department. He has published 20
research papers in National, International journals and conferences. His current
research interests are in the areas of semantic web, mobile computing, and data
mining.