1. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK A Simulation Analysis of Routing Misbehaviour in Mobile Ad hoc Networks 2 nd International Conference and Exhibition on NEXT GENERATIONS MOBILE APPLICATIONS SERVICES AND TECHNOLOGIES (NGMAST 2008) Workshop on Mobile and Wireless Security (WMS’08) Abdelaziz Babakhouya CERIST Center of Research, Algiers, Algeria. University of Béjaia, Algeria. Y. Challal and A. Bouabdallah (UTC, Heudiasyc lab., France )

2. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 2 Outline  Mobile Ad hoc Network (MANET)  Dynamic Source Routing protocol (DSR)  Nodes misbehaviour  Simulation Results (NS-2)  Countermeasures  Conclusion

3. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 3 Mobile Ad hoc NETwork (MANET)  Definition  MANET is a collection of wireless mobile nodes which may form a temporary network, without the use of any fixed infrastructure or centralized administration  Features  Multi-hop communication  Dynamic topology  Constrained resources  No physical security  Applications  Military and Rescue operations  Civilian application

4. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 4 Routing in MANET  Network layer  Routing: Route discovery and route maintenance  Data forwarding ASDB Source nodeDestination nodeIntermediate nodes Problem:  In a malicious environment, misbehaving nodes may not cooperate.  How can they misbehave?  What is the effect of nodes misbehaviour on network performance ?

5. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 5 Route discovery in DSR 1 1-2 1 1-3 1-3-4 1-2-5 1-3-4-6 1-3-4-7 S D 5 2 1 3 4 6 7 8 Route Request (RREQ)

6. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 6 Route discovery in DSR S D 5 2 1 3 4 6 7 8 Route Reply (RREP) 1-2-5-8

7. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 7 Packet forwarding in DSR S D 5 2 1 3 4 6 7 8

8. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 8 Nodes misbehaviour G S1 M S2  Cooperative node: cooperate in both route discovery and packet forwarding functions.  Selfish node : try to save their own resources (energy and bandwidth).  Selfish node type 1: Disable packet forwarding function.  Selfish node type 2: Disable routing function.  Malicious node: Try to sabotage other nodes, example of Black hole attack  Other parameters:  Time: start/stop time of the behaviour  Target: source/destination of the behaviour  Degree P: [0,1] the probability of the behaviour

9. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 9 Simulation  Objectives:  What is the effect of selfish behaviour when varying the % of misbehaving nodes?  What is the effect of one malicious node when varying nodes mobility and traffic load?  Comparison between malicious behaviour and selfish behaviour, according to the packet dropping attack strength.  Performances metrics  Packet Delivery Fraction (PDF) : CBR packets received / CBR packets sent  Average End to End Delay (EED): the delay between the sending of CBR packet by the source and its receipt by the destination.

10. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 10 Simulation in NS2  Fixed parameters  Mobility: random waypoint  Pause time = 10s, max speed = 5m/s.  CBR: 20 connections,  Packets size = 512 bits; packet rate = 2 packet/s  Simulation time : 500 s  Target of attack : all nodes  Time of attack = simulation time = 500 s  Variables parameters  Density number of nodes in an area of 1000m x 1000m  Low density = 30 nodes  High density = 60 nodes  Probability of packets dropping  P:[1.0, 0.5, 0.1]

11. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 11 Selfish type 1 ASDB RREQ packets from S to D RREP packets from D to S CBR packets from S to D  What is the effect on PDF when varying % of misbehaving nodes?  We consider two scenarios:  Low density = 30 nodes, and high density = 60 nodes  Probability of packets dropping: [ 1.0, 0.5, 0.1]

12. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 12 Simulation results of selfish type 1  Degradation of PDF when the % of misbehaving nodes increases.  Node density has a negligible influence on the PDF  Reduction of the attack strength when Pi decreases.

13. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 13 Selfish type 2 ASDB RREQ packets from S to D RREP packets from D to S CBR packets from S to D  Misbehaving nodes do not drop data packet  What is the effect on Average EED ?  Low and high node density scenarios

14. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 14 Simulation results of selfish type 2  Negligible influence on the PDF  there exists alternative routes  Degradation of EED when the percentage of misbehaving nodes increases, especially in low density (30 nodes).

15. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 15 Malicious node (black hole attack) BAD Forged RREP packets  What is the impact on PDF, by varying mobility and number of CBR connections? M S C Correct route Forged route

16. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 16 Simulation results of Malicious behaviour  PDF falls to 55% when only one malicious node performs the black hole attack.  Nodes Mobility and CBR connection don’t affect the metric PDF.

17. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 17 Countermeasures  Secure routing  S-AODV, SRP, ARAN, Adriane.  Achieve authentication integrity and non repudiation of the discovered route  Prevent malicious nodes from being included in the discovered route.  Limitations:  Do not prevent from with selfish nodes.  Need of a Public Key Infrastructure (PKI)  New security follows.  Detection and isolation of misbehaving nodes  Watch-dog, CORE, CONFIDANT, OCEAN, SORI.  Neighbours monitoring, node’s reputations and exchange of Alarms and recommendations.   False detection,  need of nodes authentication

18. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK 18 Conclusion  Misbehaving node is one of the major security issues of MANET  To retain from simulation results :  RREQ dropping do not affects the PDF. However, it can really affect the average EED and lead to congestion in a low density network.  One malicious node carrying a black hole attack can have the same effect as 20% to 30% of selfish nodes type 1.  Both of data and routing packets need to be secured from selfish and malicious nodes.

19. NGMAST- WMS workshop17/09/2008, Cardiff, Wales, UK Thanks