A Survey of Routing Attacks and Security Measures in Mobile Ad-Hoc Networks

1 INTRODUCTION

• MANET nodes create and maintain a network without predefined infrastructure or central authority, forwarding packets hop by hop when nodes are out of wireless range.Each node functions as both host and router, cooperating to form a connected route.Source: §1 · p. 1
• Frequent, unpredictable node movement changes network topology and connectivity, affecting trust and increasing routing complexity.Nodes may join or leave at any time, so network management rests with participating nodes.Source: §1 · p. 1
• Limited power, computation, memory, and bandwidth make secure and reliable communication more difficult, while the absence of central authority limits traditional security and management techniques.A malicious or legitimate node can join and disrupt cooperative communication by disobeying routing rules.Source: §1 · pp. 1–2

2 ROUTING PROTOCOLS IN MANETS

• Routing protocols must be distributed and compute multiple loop-free routes under frequent topology changes while keeping communication overhead low.Nodes route packets for one another because wireless transmission range is limited.Source: §2 · p. 2

2.1 PROACTIVE ROUTING PROTOCOLS

• Proactive protocols maintain a complete network picture at every node, enabling minimal route-selection time but generating redundant traffic and short-lived routes under high mobility.They fit low-mobility networks or settings where nodes transmit frequently.Source: §2.1 · p. 2

2.2 REACTIVE ROUTING PROTOCOLS

• Reactive protocols discover routes only when data must be sent, but network-wide request flooding adds control traffic and delays transmission.They suit high-mobility networks or infrequent data transmission.Source: §2.2 · p. 2

2 ROUTING PROTOCOLS IN MANETS

• Hybrid protocols restrict proactive routing to a small domain and use reactive discovery beyond it to balance control overhead, delay, and bandwidth use.The paper names CEDAR, ZRP, and ZHLS as examples.Source: §2.2 · p. 2

3 ROUTING ATTACKS IN MANETS

• Routing depends on node cooperation and trust, so malicious nodes can disrupt routing or create denial-of-service conditions.The protocols assume nodes behave properly.Source: §3 · p. 2
• Passive attackers listen for information without disrupting protocols, while active attackers inject, delete, or modify packets or impersonate nodes to disrupt network operation.Passive attacks may be difficult to detect because they create no new traffic; active attacks may be detected and avoided by participating nodes.Source: §3 · p. 3
• Flooding bogus route-creation packets can overwhelm routing implementations and prevent new routes; proactive protocols are more vulnerable because they maintain routes to all destinations.Source: §3 · p. 3
• Repeated requests can consume neighboring nodes’ battery and bandwidth, while impersonation can let an attacker join undetected and send false routing information as a trusted node.Source: §3 · p. 3
• False route replies can draw traffic through an attacker for interception or discard, while fabricated or altered routing information can poison tables and create loops, bottlenecks, or network partitions.A high-sequence-number route request can cause legitimate requests with lower sequence numbers to be deleted.Source: §3 · p. 3
• Withholding OLSR link information can isolate a target from routes and data, while colluding wormhole nodes tunnel traffic over a private high-speed link to distort topology [37, 34].Source: §3 · pp. 3–4
• Rushing route requests can force discovered paths through the attacker and suppress later legitimate requests; fabricated blacklists can instead isolate legitimate nodes.Source: §3 · p. 4
• The survey also describes location disclosure and a military snare attack that traces routes from a compromised node to locate a Very Important Node.The invisible node attack involves participating in an identification-dependent protocol without revealing identity, and is described as unsolved so far.Source: §3 · p. 4

4 SECURITY MEASURES AGAINST ROUTING ATTACKS IN MANETS

• Flooding defenses include neighbor RREQ-rate blacklisting, adaptive statistical thresholds, CUSUM-based flow detection, and Fellowship’s obligation-based rate limitation, enforcement, and restoration.Fixed-threshold blacklisting can miss attacks below its threshold or blacklist an impersonated legitimate ID; adaptive thresholds address varying flood rates.Source: §4 · pp. 4–5
• Blackhole defenses collect multiple route replies or confirm routes through a next hop; sequence-number anomaly detection avoids extra routing traffic but can produce false positives.The route-confirmation approach does not resolve attacks by two consecutive colluding nodes, while waiting for multiple replies adds delay.Source: §4 · p. 5
• OLSR node-isolation defenses monitor TC and HELLO messages and may select extra MPR nodes, but can fail against colluding next-hop attackers.Source: §4 · p. 5
• Wormhole defenses include temporal and geographical packet leashes, multipath link-frequency analysis, delay profiling, and HELLO-interval anomaly detection.Temporal leashes require tightly synchronized clocks; geographical leashes require position knowledge and may use loosely synchronized clocks.Source: §4 · pp. 5–6
• Rushing defenses combine secure neighbor detection, secure route delegation, and randomized ROUTE REQUEST forwarding, making low-latency paths only slightly more likely; snare mitigation uses ASRPAKE and decoy-node deployment.Source: §4 · p. 6

• The survey reviews routing attacks and countermeasures, but concludes that proposed solutions do not yet provide complete, effective, and efficient routing security.Source: §5 · p. 7
• Proposed countermeasures may impose high computational or communication overhead, address only one malicious node, or require GPS or protocol modification.Many target only one or two specific attacks and may remain vulnerable to unexpected attacks; the Invisible Node Attack remains a challenge.Source: §5 · p. 7
• Future research should improve security effectiveness while minimizing costs to suit MANETs' limited bandwidth, power, and computational capacity.MANETs are used in scenarios including emergency operations, disaster relief, and military service, where providing security is critical.Source: §5 · pp. 6–7