A Wired-Side Approach to MAC Misbehavior Detection

We propose a simple scheme for detecting selfish behavior achieved by manipulating the 802.11 Medium Access Control (MAC) protocol. Specifically, attacks that exploit the Distributed Coordination Function (DCF) parameters and data rate adaption scheme to maximize individual throughput pose a denial of service threat against protocol abiding nodes. We detect this malicious behavior by employing a combination of supervised and unsupervised learning techniques that monitor for disparities in the delay patterns of protocol-abiding and illegitimate traffic. Unlike existing approaches, detection is done on the wired side. We apply an anomaly-based categorization, which obviates the need to train on traces from different network instances. Since the approach is holistic and does not rely on a feature selection using individual parameters, the technique is free of adaptive cheating. Additionally, the accuracy of classification is independent of the number of terminals in the network, the number of colluding attackers, protocol, rate adaptation and higher layer transmission behavior. Simulations and experiments are used to validate our scheme.