An Exchange Framework for Intrusion Alarm Reduction in Mobile Ad-hoc Networks

Numerous Intrusion Detection Systems (IDSs) have been developed for MANETs; however, comparatively little research focuses on intrusion alarm exchange and validation in Mobile Ad Hoc Networks (MANETs). We provide a secure alarm exchange framework for proactive MANET routing protocols and use Optimized Link State Routing model (OLSR) for the implementation. In our solution, alarms can be aggregated at a group coordinator for advanced alarm verification and reduction. This model can solve two major challenges in MANETs: lack of a centralized authority and dynamic topology caused by mobility. Furthermore, it also provides the foundations for local and global alarm validations. Unnecessary responses to false or forged alarms can be prevented if intrusion alarms are proved to be authentic and accurate. Our model selects the node with the best connectivity as the temporary centralized node for collecting all local alarms. Subsequently, it utilizes majority-voting strategy to detect false alarms. After false alarm reduction, an accurate local alarm is broadcast as a global alarm for notifying the entire network of the attacker existence. This model has the advantages of alarm reduction and low time overhead. The experimental results demonstrate that our solution is scalable and is not influenced by mobility. Extra alarm exchange and verification messages cause low time and message overhead.