Cost-Sensitive Intrusion Responses for Mobile Ad Hoc Networks

This paper addresses how to perform cost-sensitive responses to routing attacks on (Mobile Ad Hoc Networks) MANET. There have been numerous research efforts on securing MANET protocols using cryptography or intrusion detection technique. However, little literature on MANET intrusion response is addressed. Most research on automated response for wired networks focuses on how to select the best response action to improve the security posture and availability of the system cost-sensitively. We borrow this costsensitive concept and develop a cost model for MANET. Two indices, Topology Dependency Index (TDI) and Attack Damage Index (ADI), are developed to reflect the response cost and attack damage respectively. TDI measures the positional relationship between nodes and the attacker, and ADI represents the routing damage caused by the attacker. Response cost, routing damage brought by the isolation response, can be calculated from TDI. Comparing TDI with ADI helps the response agents (RAs) to perform Adaptive Isolation with maintaining good network throughput. The simulation results show that launching adaptive isolations according to the comparison of TDI and ADI gives better network throughput than direct isolation. Therefore, the main contribution of our solution is to keep network connectivity when launching isolation responses and such that good quality of network routing services is maintained.