Combining Passive Autoconfiguration and Anomaly-Based Intrusion Detection in Ad Hoc Networks

Two essential services of ad-hoc networks are IP address autoconfiguration and intrusion detection systems. Since both autoconfiguration and intrusion detection may base their decisions on routing protocol anomalies, their interdependencies can cause problems. In this paper, we present our approach to efficiently combine autoconfiguration and intrusion detection, and present our enhancements in attack detection for an auto configuration system. We have identified anomalies indicating specific attacks, implemented suitable anomaly detectors, and evaluated our system. The results show that it is possible to detect both the attacks and IP address conflicts in an efficient way.