Routing anomaly detection in mobile ad hoc networks

Intrusion detection systems (IDSs) for mobile ad hoc networks (MANETs) are necessary when we deploy MANETs in reality. In this paper, focusing on the protection of MANET routing protocols, we present a new intrusion detection agent model and utilize a Markov chain based anomaly detection algorithm to construct the local detection engine. The details of feature selection, data collection, data preprocess, Markov chain construction, classifier construction and parameter tuning are provided. Based on the routing disruption attack aimed at the dynamic source routing protocol (DSR), we study the performance of the algorithm at different mobility levels. Simulation results show that our algorithm can achieve low false positive ratio, high detection ratio, and small MTFA (mean time to the first alarm), especially when the mobility is low. Detailed analysis of simulation results is also presented.