Findings on a Semantically-Based Intrusion Detection Approach for OLSR MANET Protocol

The Optimized Link State Routing (OLSR) protocol is a proactive Mobile Ad hoc Network (MANET) routing protocol. OLSR (v1 [1] or v2 [2]) were not designed with integrated security measures. Research provides inputs on how to secure the OLSR protocol against attacks from outside intruders. To address the protocol vulnerabilities, authentication and encryption techniques have been proposed. We will focus on the attacks coming from inside intruders, i.e. coming from nodes that were successfully authenticated as being part of the MANET. In this paper we present a follow-up on an “Effective Intrusion Approach” [3] based on the OLSR protocol semantic-checking, a solution that was successfully used in our test bed to detect intruders. To test the detection of intruders, we developed an implementation of a typical replay attack where a node first records traffic at a given time, to replay it at later time. Such an attack can be used, for example, to give the impression of a stale network. The intruder has sufficient knowledge of the protocol to increase OLSR’s message sequence number and TC’s advertised neighbour sequence number values so that compromised messages will take precedence over legitimate network control messages, in respect to OLSR’s duplicate checking algorithms. This results in good packets being dropped, and bad packets being forwarded. We show how our implementation of the semantic-checking based on OLSR protocol is able to identify the intruder, and also how implausible links are detected. Once the intruder is identified, counter measures need to be applied. The implementation of those measures is the subject of our next research and is briefly presented.