A Statistical Framework for Intrusion Detection in Ad Hoc Networks

— We focus on detecting intrusions in ad hoc networks using the misuse detection technique. We allow for detection modules that periodically fail to detect attacks and also generate false positives. Combining theories of hypothesis testing and approximation algorithms, we develop a framework to counter different threats while minimizing the resource consumption. We obtain computationally simple optimal rules for aggregating and thereby minimizing the errors in the decisions of the nodes executing the intrusion detection software (IDS) modules. But, we show that the selection of the optimal set of nodes for executing the IDS is an NP-hard problem. We describe a polynomial complexity, distributed selection algorithm, “Maximum Unsatisfied Neighbors in Extended Neighborhood” (MUNEN) that attains the best possible approximation ratio. The aggregation rules and MUNEN can be executed by mobile nodes with limited processing power. The overall framework provides a good balance between co...

• Type: Conference
• Year: 2006
• Where: INFOCOM
• Authors: Dhanant Subhadrabandhu, Saswati Sarkar, Farooq Anjum
• Keywords: Ad Hoc Networks, Communications, Detection, INFOCOM 2006, Intrusion Detection