Analysis of Denial of Service Attack Using Proposed Model

Transcription

1 Chapter 5 Analysis of Denial of Service Attack Using Proposed Model 5.0 Introduction An Adhoc network is a collection of nodes that are capable of forming dynamically a temporary network without the support of any centralized fixed infrastructure. Since there is no central controller to determine the secure and reliable communication paths in the mobile Adhoc network. Each node in the Adhoc network has to believe on other nodes in order to forward packets. Thus highly cooperative nodes are required to ensure that the initiated data transmission process does not fail. In a mobile Adhoc network where security is a critical issue and they are forced to rely on the neighbor node, trust plays an important role that could increase the number of successful data transmission. The larger number of trusted nodes results enhances the successful data communication process rate. In this chapter, denial of service (DoS) attack is applied in the network. Evidences are collected to design an intrusion detection engine for MANET intrusion detection system (IDS). The flow diagram of this chapter is given in the Figure Problem Definition for Denial of Service Attack for MANET Problem Definition 1: Simulation without DoS Attack There are 21 MANET workstations with random mobility of (0-20) m/sec, following a random way point trajectory (predefined trajectory 5 for Adhoc network in Opnet). Simulation area is (1000*1000) meter. This simulation area is considered because most of 43

2 the researchers are using this area and it will be easy to compare the results more accurately. But this is not a constraint one can consider any area with varying density of mobile nodes. All nodes are AODV enabled, sending the route request for mobile node 21. Figure 5.2 shows the environment of simulation. Simulation parameters are given in Table 5.1. For the problem definition 1, AODV parameters are given in Table 5.2 and MANET traffic generated parameters are given in Table 5.3. Figure 5.1: Flow diagram for Denial of Service Attack Detection Engine 44

3 Figure 5.2: Simulation environment Table 5.1: Simulation parameters at a glance Parameters Value Simulation Area 1000*1000 (in meters) Simulation Time 1200 Sec Nodes 21 Mobility (0-20)m/sec (Random) Distribution Random Trajectory Trajectory-5 Routing Protocol AODV Table 5.2: AODV Parameters Parameters Value Route Discovery Parameters Default Route Request Retries 5 Route Request Rate Limit 10 (Packets/Sec) Active Route Timeout 3 Hello Interval Uniform (1,1.1) Net Diameter 35 Table 5.3: MANET traffic Parameters Parameters Value Start Time 10 Packet Inter Arrival Time Exponential(1) Packet Size Exponential(1024) bits Destination IP Address Mobile Node 20 45

4 a) Problem Definition 2: With one Malicious Node Problem definition is the same as in problem definition 1, except in this case, one node is malicious and attempting to create a DoS attack for destination node 21. For simulation environment the parameters are same as in shown in the Table 5.1 for normal nodes. AODV and MANET traffic parameters are the same as in Table 5.2 and Table 5.3. Routing parameters for malicious node are shown in Table 5.4. MANET traffic generation parameters are given in Table 5.5. Table 5.4: AODV Routing parameters (malicious node) Parameters Value Route Discovery Parameters Malicious Route Request Retries 100 Route Request Rate Limit 1000 (Packets/Sec) Active Route Timeout 3 Hello Interval Uniform (1,1.1) Net Diameter 100 Table 5.5: MANET Traffic parameters (malicious node) Parameters Value Start Time 10 Packet Inter Arrival Time Exponential(1) Packet Size Exponential( ) bits Destination IP Address Mobile Node Comparison With and Without Malicious Node The performance of the system with and without malicious node are given in Figure 5.3 to Figure After comparing with the result of without denial of service attack, it can be concluded that the performance of the system degrades in the presence of the malicious node. More than one malicious node can be assumed and a total number of nodes in the network may be scalable. But the aim of this research is to extract the data from simulation to design the detection engine for denial of service attack, whatever the number of nodes trusted is large enough or fewer malicious nodes. 46

5 Figure 5.3: Total routing traffic received Figure 5.4: Total routing traffic sent Figure 5.5: Total MANET traffic received 47

6 Figure 5.6: Total MANET traffic sent Figure 5.7: Total packet drop Figure 5.8: Total delay 48

7 Figure 5.9: Target node delay Figure 5.10: Target node packet queue size 5.3 Feature Extraction for Denial of Service Attack The following features are extracted for DoS attack on the basis of above simulation. Total Delay (MDelay); MANET Traffic Sent Ratio (MTSR) = (MANET Traffic Sent by Malicious Node / Total MANET Traffic Sent) *100; MANET Traffic Received Ratio (MTRR) = (MANET Traffic Received by Malicious Node / Total MANET Traffic Received) *100; Routing Traffic Sent Ratio (RTSR) = (Routing Traffic Sent by Malicious Node / Total Routing Traffic Sent) *100; Routing Traffic Received Ratio (RTRR) = (Routing Traffic Received by Malicious Node / Total Routing Traffic Received) *100; Packet Drop Ratio (PDR) = (Packet Drop by Malicious Node / Total Packet Drop) *100; 49

8 Route Request Ratio (RRReq) = (Route Request Generated by Malicious Node / Total Route Request) * 100; Route Reply Ratio (RRRep) = (Route Reply Received by malicious node / Total Route Reply sent by the Destination node); 5.4 Rules Set for DoS Attack Following rule sets are generated. But these rule sets and their threshold value may be changed according to the need and the environment of the network. We may use an incremental approach to build up the rule sets dictionary. If ((MDelay > Sec) If (PDR > 25%) If (MTSR > 50% ^ MTRR < 5%) If (RTSR >10 % ^ RTRR < 5%) If (RRReq > 20% ^ RRRep > 5%)) Then {Not A Friend}; 5.5 Training Data Set for Denial of Service Attack Table 5.6: Training data set for DoS attack Input Features Train Data Set Function Parameters (C,γ) CPU Run Time (in Sec) Mis Classified Support Vector Linear Default Linear (0.5,0.5) Linear (1,0.5) Linear (1,1) Linear (2,1) Radial Default Radial (0.5,0.5) Radial (1,0.5) Radial (1,1) Radial (2,1) Sigmoid Default Sigmoid (0.5,0.5) Sigmoid (1,0.5) Sigmoid (1,1) Sigmoid (2,1)

9 5.6 Testing Data Set for DoS Attack Table 5.7: Test data set for DoS attack Input Test Function Correct Incorrect Accuracy Precision/Recall Features Data Set (%) Linear % / 87.89% Linear % / 91.37% Linear % / 90.34% Linear % / 90.34% Linear % / 90.34% Radial %/97.16% Radial %/96.91% Radial %/96.78% Radial %/97.42% Radial %/97.29% Sigmoid %/100% Sigmoid %/100% Sigmoid %/100% Sigmoid %/100% Sigmoid %/100% A model file generated after training on the training data set is the confidence value generated by SVM LIGHT, which is the value used to test the given test data set of prediction. The accuracy shows the true positive and true negative generated by detection engine. Table 5.6 and Table 5.7 shows the result of training and testing. The accuracy depends upon the nature of input features and their classifications. 5.7 Results and Validation For the given test data set the accuracy of detection engine is the best in case of radial function and observed to be more than 90%, which is satisfactory for an Adhoc environment. The obtained results are observed to be better than the previous work done by the researchers given in Table

10 Table 5.8: Result comparison with previous models for DoS Attack S.No. Model Accuracy 1. Hongmei Deng et. Al [81] (1-SVMDM) 89.95% 2. Hongmei Deng et. Al [81] (2-SVMDM) 90.45% 3. Aleksandar L. et. Al [82], (LOF approach) 68.4% 4. Aleksandar L. et. Al [82], NN approach 73.7% 5. Aleksandar L. et. Al [82], Mahalanobis-based 57.9% approach 6. Aleksandar L. et. Al [82], Unsupervised SVM 84.2% approach 7. Proposed Approach 90.76% 5.8 Conclusion In this chapter, denial of service (DoS) attack is applied in the network using reactive protocol AODV. Evidences are collected, features are extracted and rules are applied to detect the intruder. SVM LIGHT is used to train the data set and then the test data set is used to check the accuracy of the system. Linear, radial and sigmoid functions are used to train and test the data set. Improved accuracy is achieved and which is observed to be more than 90% which is better than previous models. A model file generated for DoS attack will be deployed in an appropriate layer for detection. 52