Source-linked AI summary
Dpraodv: A Dyanamic Learning System Against Blackhole Attack in Aodv Based Manet
Payal N. Raj, Prashant B. Swadas
TL;DR
MANETs need secure routing because their operating conditions expose them to attacks, including blackholes that attract traffic with false route replies. The paper proposes DPRAODV, which dynamically detects and isolates malicious nodes and notifies neighbors. Simulations report substantially improved packet delivery under attack with nearly unchanged delay and only slight overhead increases.
Problem
MANET routing must protect communication against blackhole attacks that use false route replies to attract and disrupt traffic.
Method
DPRAODV dynamically updates a threshold from routing data, detects blackholes, isolates malicious nodes, and sends ALARM packets to neighbors.
Results
Under blackhole attack, DPRAODV improves PDR by 80-85% over AODV under attack, with delay almost the same as normal AODV.
Takeaways & Limitations
DPRAODV increases packet delivery ratio with minimum increases in average end-to-end delay and normalized routing overhead.
Takeaways & Limitations
Existing secure-routing approaches discussed by the authors can have substantial computation overhead and scalability problems, while signed packets cannot prevent internal packet dropping.
Abstract
from arXiv · showhide
Security is an essential requirement in mobile ad hoc networks to provide protected communication between mobile nodes. Due to unique characteristics of MANETS, it creates a number of consequential challenges to its security design. To overcome the challenges, there is a need to build a multifence security solution that achieves both broad protection and desirable network performance. MANETs are vulnerable to various attacks, blackhole, is one of the possible attacks. Black hole is a type of routing attack where a malicious node advertise itself as having the shortest path to all nodes in the environment by sending fake route reply. By doing this, the malicious node can deprive the traffic from the source node. It can be used as a denial-of-service attack where it can drop the packets later. In this paper, we proposed a DPRAODV (Detection, Prevention and Reactive AODV) to prevent security threats of blackhole by notifying other nodes in the network of the incident. The simulation results in ns2 (ver- 2.33) demonstrate that our protocol not only prevents blackhole attack but consequently improves the overall performance of (normal) AODV in presence of black hole attack.
1. Introduction
MANET security is difficult because nodes operate in an open, shared, resource-constrained, and highly dynamic environment. The paper presents DPRAODV to detect and isolate blackhole nodes while preserving network operation.
- MANETs require protected communication because their open architecture, shared wireless medium, resource constraints, and dynamic topology create security challenges.
- Routing protocols create and maintain multihop connections because each MANET node also forwards packets for other peers.
- Reactive protocols discover routes only when needed, whereas proactive protocols periodically exchange routing information to maintain current routes.
- DPRAODV detects blackhole attacks, stores destination sequence numbers from RREPs, dynamically calculates thresholds, and isolates malicious neighbors from forwarding.
- The paper evaluates DPRAODV through simulation and organizes the study around AODV operation, related work, attack effects, protocol design, evaluation, and conclusions.
2. Theoretical background of AODV
AODV is a reactive, on-demand routing protocol that discovers routes through RREQ and RREP exchanges and repairs broken paths with RERR messages. Its cooperative assumptions can be exploited by blackhole attackers.
- AODV maintains routing information for active paths and discovers routes only when communication requires them.
- A source without a route broadcasts an RREQ, while neighbors either return an RREP or rebroadcast the request toward other nodes.
- When multiple RREPs arrive, AODV prefers a greater destination sequence number or an equal sequence number with a smaller hop count.
- AODV route entries include destination sequence number, active neighbors, and an expiration timer.
- A broken active link triggers RERR notification and route rediscovery from the source.
- Because routing protocols generally assume cooperative nodes, malicious attackers can disrupt operations by violating protocol specifications.
3. Related works in securing AODV
Prior approaches secure MANET routing through cryptographic authentication, trust mechanisms, or intrusion detection, but they incur overhead, scalability, false-positive, or delay concerns. The paper motivates an adaptive reactive alternative.
- MANET security approaches include securing ad hoc routing and intrusion detection.
- SEAD uses hash chains, Ariadne assumes shared secret keys, ARAN uses public-key certificates, and SAR uses security attributes such as trust values.
- The reviewed secure-routing protocols impose substantial computation overhead and often face scalability problems.
- Packet signatures do not prevent an internal attacker from dropping packets while forwarding them, motivating a reactive response to malicious nodes.
- Anomaly-based intrusion detection can produce many false positives, while state-based detection requires extra processing power and sensing capabilities.
- Other methods can increase routing overhead through route confirmation or increase delay by waiting for multiple RREPs.
- The proposed method updates its threshold to reflect the current network environment and prevents detected malicious nodes from forwarding data.
4. Description of Blackhole attack
A blackhole attacker exploits AODV route selection by advertising a falsely fresh route, attracting traffic and then refusing to forward packets. The paper illustrates this attack with a malicious intermediate node.
- Network-layer attacks can stop packet forwarding or modify routing-message parameters such as sequence numbers and hop counts.
- A blackhole immediately sends a false RREP with a higher sequence number, causing the source to select the malicious route.
- After attracting routes, the malicious node prevents packets from being forwarded, effectively swallowing data traffic.
- In the illustrated scenario, source S intends to reach destination D, but malicious node M redirects communication from S toward itself using a modified RREP.
5. DPRAODV: Solution against blackhole attack
DPRAODV detects anomalously high route-reply sequence numbers using a dynamically updated threshold, then informs neighboring nodes and isolates suspected attackers from forwarding.
- DPRAODV compares each RREP sequence number with a dynamically updated threshold in addition to normal AODV’s routing-table check.A value above the threshold causes the node to be suspected as malicious and added to the blacklist.
- The threshold is computed from sequence-number differences collected during time intervals, allowing adaptation to changing network conditions.It is updated when a newer node receives an RREP packet.
- After detecting an anomaly, DPRAODV sends an ALARM packet so other nodes can isolate the malicious node from network participation.The isolated node is prevented from forwarding and sending data packets.
6. Evaluation of DPRAODV
The evaluation uses ns2 simulations varying mobility, network size, and traffic load, with packet delivery ratio, delay, and routing overhead as performance metrics. DPRAODV generally improves delivery under attack while keeping delay near normal AODV and overhead increases small.
- Simulation Environment: The ns2 v-2.33 simulations vary network size, traffic load, and mobility to evaluate DPRAODV across multiple network contexts.The scenarios use a Random waypoint model with 10 to 70 nodes in an 800m x 800m terrain.
- Evaluation Metrics: The evaluation measures Packet Delivery Ratio, Average End-to-end delay, and Normalized routing overhead.These metrics capture delivered data, packet latency, and routing transmissions relative to data transmissions.
- Mobility: Under mobility variation, DPRAODV’s PDR remains within acceptable limits at almost 4-5% below normal AODV, with minimum overhead.The comparison is reported for DPRAODV versus normal AODV.
- Network Size: 80-85%: DPRAODV improves PDR over AODV under attack as network size varies, while average end-to-end delay is almost the same as normal AODV.The normalized routing overhead increases only slightly and is described as negligible.
- Traffic Load: Approximately 60%: DPRAODV increases PDR over AODV under attack as traffic load increases, with almost the same delay as normal AODV.The ALARM packet produces a slight increase in normalized routing overhead.
7. Conclusions
DPRAODV provides AODV security against blackhole attacks by detecting and isolating malicious nodes and notifying neighbors, increasing packet delivery with only small performance costs.
- DPRAODV detects malicious nodes, isolates them from active forwarding and routing, and sends ALARM packets to neighboring nodes.The reported performance benefit is higher PDR with minimum increases in average end-to-end delay and normalized routing overhead.