RADAR: A ReputAtion-Based Scheme for Detecting Anomalous Nodes in WiReless Mesh Networks
Zonghua Zhang, Farid Naït‐Abdesselam, Pin‐Han Ho, Xiaodong Sheldon Lin · 2008
As one of the backup measures of intrusion prevention techniques, intrusion detection system (IDS) plays a paramount role in the second defense line of computer networks. Due to the special infrastructure and communication mode, intrusion detection in wireless mesh networks (WMNs) is especially challenging and requires particular design considerations. In this paper, we propose a novel anomaly detection scheme, called RADAR, to detect anomalous mesh nodes in WMNs. Firstly, we introduce a general concept of reputation to characterize and quantify the mesh node's behavior/status in terms of fine-grained performance metrics. This enables us to construct a robust baseline for leveraging and measuring the derivation between normal and anomalous behavior of each mesh node. Secondly, based on reputation management, we develop a cooperative anomaly detection scheme by fully exploring the spatio-temporal properties of mesh nodes' behavior. Our current scheme is specified and implemented with a reactive routing protocol, aiming at detecting malicious mesh nodes which intentionally violate normal routing mechanisms. The simulation results show that our scheme performs well in terms of detection accuracy, false positive rate, computational overhead, and scalability.