Towards Optimal Monitoring in Cooperative IDS for Resource Constrained Wireless Networks

The problem of cooperative intrusion detection in resource constrained wireless networks (e.g., adhoc, sensor) is challenging, primarily because of the limited resources available to participating nodes. Although the problem has received some attention from the research community, little is known about the tradeoffs among different objectives, e.g. network performance, power consumption, delay in information being collected and security effectiveness. This paper proposes, to the best of our knowledge for the first time, to distribute cooperative intrusion detection functions that take into account, simultaneously, multiple objectives. We formulate the problem of identifying the type of intrusion detection each node runs as a multi-objective optimization problem and motivate/develop a genetic algorithm to solve it. Through extensive simulations we demonstrate that our solution is characterized by: a small variance in the normalized fitness values of individual/single objectives; and a smaller attack detection and reporting delay than state of art solutions. In a real implementation/evaluation of our cooperative intrusion detection system, we demonstrate that it achieves a higher detection rate (93%) than state of art solutions (60%-73%).