Interactive wormhole detection and evaluation

Received: 23 June 2006 Revised: 31 July 2006 Accepted: 21 October 2006 Online publication date: 25 January 2007 Abstract Wormhole attacks in wireless networks can severely deteriorate network performance and compromise security through spoiling the routing protocols and weakening the security enhancements. This paper develops an approach, interactive visualization of wormholes (IVoW), to monitor and detect such attacks in large-scale wireless networks in real time. We characterize the topology features of a network under wormhole attacks through the node position changes and visualize the information at dynamically adjusted scales. We integrate an automatic detection algorithm with appropriate user interactions to handle complicated scenarios that include a large number of moving nodes and multiple wormhole attackers. Various visual forms have been adopted to assist in the understanding and analysis of reconstructed network topology and to improve the detection accuracy. Extended simulation has demonstrated that the proposed approach can effectively locate the fake neighbor connections without introducing many false alarms. IVoW does not require the wireless nodes to be equipped with any special hardware, thus avoiding any additional cost. We have performed user studies to evaluate the effectiveness of our approach and demonstrate that visual analysis can be successfully combined with network security mechanisms to greatly improve intrusion detection capabilities. Information Visualization (2007) 6, 3--17. doi:10.1057/palgrave.ivs.9500144