1. INTRODUCTION:

A mobile ad hoc network (MANET) [1] is an autonomous system of mobile stations connected by wireless link to form a network. It does not rely on predefined infrastructure to keep the network connected therefore it is also known as infrastructure less networks. In MANET, each node can communicate with node in its range and those which are beyond the range can communicate using the concept of multi hop communication in which other node relay the Packets. In recent years, the security issues on MANET have become one of the basic concerns. The MANET is more vulnerable to be attacked than wired network. These vulnerabilities are environment of the MANET structure that cannot be removed. As a result, attacks with malicious intent have been and will be devised to develop these vulnerabilities and to cripple the MANET operation. In many simple IDS implementation, several category are combined in a single device for improved efficiency. Intrusion Detection system (IDS) is another way to provide security and privacy in MANET. Intrusion detection can be defined as a process of monitoring activities in a system by capturing user’s actions called audit, analyzing the audit and inferring from this profile if there are any security violations [12].

The rest of this paper will be structured as follows. Section 2 describes Intrusion Detection in MANETs. Intrusion Response in section 3, in section 4 describes the Classification of IDS. In section 5, we present architectures for IDS in MANETs. Finally, the conclusions and future research are shown in section 6.

2. Intrusion Detection in MANETs:

IDS can be defined [6] as the protector system that automatically detects malicious actions within a host or a network, and consequently generates an alarm to alert the security tools at a location if intrusions are considered to be illegal on that host or network.Intrusion detection can be defined [8] as a process of monitoring actions in a system, which can be a computer or network system. Which this is achieved is called an intrusion detection system (IDS). Intrusion detection provides the following:

· Monitoring and analysis of user and system activity,

· Auditing of system configurations and vulnerabilities,

· Assessing the integrity of critical system and data files,

· Numerical analysis of activity patterns based on the matching to known attacks

· Irregular activity analysis,

· Operating system audit.

3. Intrusion Response:

The type of intrusion reply for wireless ad hoc networks depends on the type of intrusion, the network protocols and applications in use, and the confidence (or certainty) in the evidence.

A few likely responses include:

• Reinitializing communication channels between.

• Identifying the compromised nodes and reorganizing the network to prevent the compromised Nodes.

• The IDS agent informing the end user, who may in turn do his/her own inquiry and take appropriate action.

• Initiating a re-authentication request to all nodes in the network to prompt the end users

To authenticate themselves (and hence their wireless nodes) using out-of-band mechanisms

Only the re-authenticated nodes, which may collectively discuss a new communication channel, will recognize each other as legitimate. That is, the compromised/ malicious nodes can be excluded [2].

4. Classification of IDS:

IDS may be classified [10] as either host-based or network-based, depending on the data collection method.

· Host-based IDS operate on the operating system’s audit trails, system and application logs, or assessment data generated by loadable-kernel modules that intercept system calls.

· Network-based IDS operate on packets captured from network traffic.

In addition, IDS may be classified based on the detection procedure as described below:-

^[1]Signature-based detection: - This technique may display low false positive rates, but does not perform well at detecting previously unknown attacks.

^[2]Anomaly-based detection:-This technique may detect previously unknown attacks, but may exhibit high rates of false positives.

^[3]Specification-based detection: - This technique may provide the capability to detect previously unknown attacks, while exhibiting a low false positive rate

5. Architectures for IDS in MANETs:

The network infrastructures that MANETs can be configured to are either Flat or multi-layer, depending on the applications. Therefore, the optimal IDS architecture for a MANET may depend on the network infrastructure itself [3]. In a flat network infrastructure, all nodes are considered equal, thus it may be suitable for applications such as virtual classrooms or conferences. And multi-layered network infrastructure, nodes may be partitioned into clusters with one cluster head for each cluster. To communicate within the cluster, nodes can communicate directly. However, communication across the clusters must be done through the cluster head. This infrastructure might be well suited for military applications.

There are four major architectures on the network [4], as follows: 1) Standalone IDS, II)

Distributed and Collaborative IDS, III) Hierarchical IDS, and IV) Mobile Agent for Intrusion Detection Systems.

I) Stand-alone Intrusion Detection Systems:

Stand-alone intrusion detection system [4] is run on each node independently to the determine intrusions. Every decision made is based on information collected at its own node, since there is no collaboration among nodes in the network. So, data is not exchanged. In addition, nodes in the same network do not know anything about the situation on other nodes in the network as no prepared information is passed. Even though this architecture is not effective due to its limitations, this architecture is more suitable for smooth network infrastructure than for multi-layered network infrastructure.

II) Distributed and Cooperative Intrusion Detection Systems:

An IDS agent is responsible for detecting and collecting local events and data to identify possible intrusions, as well as initiating an answer independently, this architecture is more suitable for flat network infrastructure [11].

Figure 1: Distributed and Cooperative IDS in MANETs [11].

III) Hierarchical Intrusion Detection Systems:

This architecture [4] is an extended version of the distributed and cooperative IDS Architecture. This architecture proposes using multi-layered network infrastructures where the Network is divided into clusters. The architecture has cluster heads, in some sense, act as Control points which are similar to switches, gate ways, and routers in wired networks.

It also aggregates information from the member nodes about malicious activities. Cluster-head detects attacks as member-nodes could potentially reroute, modify or drop packet in transmission. At the same time all cluster-heads can cooperate with central base station to form global IDS [13].

IV) Mobile Agent for Intrusion Detection Systems:

The mobile agent [4] for IDS architecture uses mobile agents to perform specific task on a nodes Absence the owner of the agents . This architecture allows the distribution of the intrusion Detection tasks. There are several advantages using mobile agents [5] for intrusion Detection. A flow model of intrusion detection architecture of CBID [7] is presented in figure.2, which consists of 4 modules. These modules are linked with each other for valuable intrusion detection. The information collected during the training phase in the logging module is passed regularly to the intrusion information module to perceive a threshold value for the usual traffic. This threshold value is further used for the traffic during the testing phase to check intrusive activity. If some irregular performance is found, an alert is generated by the intrusion response module.

Figure 2. Intrusion Detection Process Flow [7].

6. CONSLUSION:

With the nature of mobile ad hoc networks, almost all of the intrusion detection systems (IDSs) Are structured to be distributed and have a cooperative architecture. Mostly the proposed research prefers using anomaly detection approach. An intrusion detection system aims to detect attacks on mobile nodes or intrusions into the networks. And this article presents the current state of the art in the region of intrusion detection and response for wireless mobile ad hoc networks.

7. REFERENCES:-

1. Sunita Sahu1 & Shishir K. Shandilya2 “A COMPREHENSIVE SURVEY ON INTRUSION DETECTION IN MANET” International Journal of Information Technology and Knowledge Management July-December 2010, Volume 2, No. 2, pp. 305-310

2. A. Mishra, K. Nadkarni, and A. Patcha, \Intrusion Detection in Wire- less Ad Hoc Networks," IEEE Wireless Communications, Vol. 11, Issue 1, pp. 48-60, February 2004.

3. P. Brutch and C. Ko, \Challenges in Intrusion Detection for Wireless Ad-hoc Networks," Proceedings of 2003 Symposium on Applications and the Internet Workshop, pp. 368-373, January 2003.

4. Tiranuch Anantvalee, Jie Wu “A Survey on Intrusion Detection in Mobile AdHoc Networks” pp. 170 – 196 2006 Springer

5. C. Krugel and T. Toth. “Applying mobile agent technology to intrusion detection”. In ICSE Workshop on Software Engineering and Mobility, 2001.

6. Bahareh Pahlevanzadeh and Azman Samsudin “Distributed Hierarchical IDS for MANET over AODV+” Intemational Confbrence on Telecommunications and Malaysia International conference on communications, 2007 IEEE, penang, Malaysia

7. Kashan Samad, Ejaz Ahmed, Waqar Mahmood, “Simplified Clustering Scheme for Intrusion Detection in Mobile Ad Hoc Networks”, 13th International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia, September 15-17, 2005.

8. Blake Hartstein,” Intrusion Detection Likelihood: A Risk-Based Approach”SANS Institute InfoSec Reading Room, November 3, 2008

9. D.Jeyabharathi , D.Sasireka , D.Kesavaraja “Implementation of Mobile Intrusion Detection Controller [MIDC] for Affording Secure Service in MANET Environment” IJCA Special Issue on “Mobile Ad-hoc Networks” MANETs, 2010

10. Paul Brutch ,Calvin Ko “Challenges in Intrusion Detection for Wireless Ad-hoc Networks” Network Associates Laboratories {Paul_Brutch, Calvin_Ko}@nai.com2010

11. Y. Zhang, W. Lee, and Y. Huang, \Intrusion Detection Techniques for Mobile Wireless Networks," ACM/Kluwer Wireless Networks Journal (ACM WINET), Vol. 9, No. 5, September 2003.

12. Y. Xiao, X. Shen, and D.Z. Du, “A Survey on Intrusion Detection in Mobile AdHoc Networks”, Chapter 7, Wireless/Mobile Network Security, pp. 170 – 196, 2006

13. Mohammad Saiful Islam Mamun, A.F.M. Sultanul Kabir” Hierarchical Design Based Intrusion Detection System For Wireless Ad Hoc Sensor Network” International Journal of Network Security & Its Applications (IJNSA), Vol.2, No.3, July 2010

Received on 11.03.2011 Accepted on 22.03.2011

Int. J. Tech. 1(1): Jan.-June. 2011; Page 20-22