Mobility-Pattern-Based Anomaly Detection Algorithm in Mobile Networks

Numerous approaches have been proposed for intrusion detection in immobile networks. However, little research work has been done in actually implementing them, especially for anomaly detection, in mobile networks. In this paper, we present an efficient mobility-pattern-based (MPB) anomaly detection algorithm. It can effectively identify abnormal mobility patterns of the nodes in mobile networks. In the proposed algorithm, the normal mobility profile of a specific node is characterized by a multi-leaf tree structure in which each node corresponds to a possible destination cluster. A normal mobility profile is generated during the training process through data mining and fuzzy logic techniques. More specifically, data mining techniques are used for cluster classifications, and fuzzy logic techniques are used to integrate the ´similar´´ pattern strings after the corresponding cluster generation. These two techniques are also used during the testing process for distinguishing abnormal mobility patterns of the node from those of the normal in mobile networks. Simulation results demonstrate that our proposed MPB anomaly detection algorithm can achieve good performance in terms of detection rate and false alarm rate for nodes with regular movement behaviors by fine tuning the design parameter - threshold, that can be chosen efficiently.