Masquerading Attacks Detection in Mobile Ad Hoc Networks

• Published in: IEEE access Vol. 6; pp. 55013 - 55025
• Main Authors: Abbas, Sohail, Faisal, Mohammad, Ur Rahman, Haseeb, Khan, Muhammad Zahid, Merabti, Madjid, Khan, Atta ur Rehman
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 2018; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Accuracy; Anchors; Anomalies; Denial of service attacks; intrusion detection; Masquerading; Mobile ad hoc networks; Monitoring; Monitors; Nodes; Object recognition; Protocols; Signal strength; Smartphones; spoofing attack; Wireless networks; Wireless sensor networks
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2018.2872115

Due to the lack of centralized identity management and the broadcast nature, wireless ad hoc networks are always a palatable target for masquerading attacks. The attackers can spoof identities of privileged legitimate users for various malicious reasons, such as to launch DoS or DDoS attacks, to access unauthorized information, and to evade the detection and accountability. In the current and limited literature, masquerading attacks are mostly counteracted by signal-strength-based detection systems. However, these schemes are mostly proposed to work for infrastructure-based IEEE 802.11 wireless networks using fixed access points, air monitors, or fixed anchor nodes, which are not suitable for the ad hoc architecture. In this paper, we propose a detection system for masquerading attacks without using fixed anchor nodes or air monitors. We develop an anomaly detection model based on the statistical significant testing for our masquerading detection system that takes into consideration the signal strength fluctuation. We conduct a test bed of Samsung Galaxy-based smartphones in order to analyze the real-world signal strength variation. We also plug the real-world signal strength variation in our model for the evaluation of the detection accuracy. We propose the received signal-strength-based masquerading attack detection scheme, which is carried out first by each node in its one-hop vicinity and then extended to five-hop proximity for broader detection scope and improved accuracy. The proposed scheme is evaluated using an NS-2 network simulator for detection accuracy in different environments. The results obtained indicate that our proposed scheme produces more than 90% true positives.