CARE: Enhancing Denial-of-Service Resilience in Mobile Ad Hoc Networks

• Published in: Proceedings of 15th International Conference on Computer Communications and Networks pp. 5 - 10
• Main Authors: Ruiliang Chen, Jung-Min Park, Snow, M.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.10.2006
• Subjects: Authentication; Computer crime; Cryptography; Femtocell networks; Information security; Mobile ad hoc networks; Monitoring; Resilience; Routing; Throughput
• ISBN: 1424405726; 9781424405725
• ISSN: 1095-2055; 2637-9430
• DOI: 10.1109/ICCCN.2006.286237

This paper proposes an attack-resilient routing architecture, called cross-layer active re-routing (CARE), for mobile ad hoc networks (MANETs). Different from existing solutions, CARE does not focus on a particular type of attack, but instead takes a fundamentally general approach-it achieves resilience against a wide range of routing disruption Denial- of-Service (DoS) attacks by treating them and "dysfunctional" network events in the same way. Here, dysfunctional network events denote link and routing failures caused by link contention or node mobility. CARE is a cross-layer scheme that detects attacks at the transport layer but responds to them at the network layer. Because dysfunctional network events and routing disruption attacks have a pronounced effect on the size of the TCP congestion window, monitoring the window size is an effective method of detecting such events. Using this method, CARE is able to detect attacks. Once an attack is detected, CARE initiates a re-routing process to find a new route. For this purpose, a re-routing algorithm is proposed that circumvents the nodes that are likely to be misbehaving. Analysis and simulation results show that the CARE architecture is effective in thwarting a number of insider and protocol-compliant attacks. Our results indicate that CARE is also effective in improving network throughput in non-hostile environments because its proactive re-routing mechanism aids in maintaining a reasonable level of throughput when dysfunctional network events occur.