Source-linked AI summary
A Mechanism for Detection of Gray Hole Attack in Mobile Ad Hoc Networks
Jaydip Sen, M. Girish Chandra, Harihara S. G., Harish Reddy, P. Balamuralidhar
TL;DR
Gray holes make AODV routing security difficult because they attract traffic and selectively drop packets. The paper proposes collaborative, distributed detection and reaction, reporting more than 90% packet delivery even with 20% malicious gray holes.
Problem
Gray holes exploit AODV by advertising a route and probabilistically dropping intercepted packets, making them harder to detect than black holes.
Source: §III · p. 2Method
The mechanism uses DRI neighbor records to select a cooperative node, probes through a suspected node, and invokes neighbor-based cooperative detection when the probe fails.
Source: B. Different Modules of the Scheme · pp. 2–3Results
More than 90% of packets were delivered with the proposed protocol when 20% of network nodes were malicious gray holes.
Source: §V · p. 5Takeaways & Limitations
The authors conclude that the mechanism provides high detection with low false-positive rate and control overhead in their simulations.
Source: §VI · p. 5
Abstract
from arXiv · showhide
Protecting the network layer from malicious attacks is an important and challenging security issue in mobile ad hoc networks (MANETs). In this paper, a security mechanism is proposed to defend against a cooperative gray hole attack on the well known AODV routing protocol in MANETs. A gray hole is a node that selectively drops and forwards data packets after it advertises itself as having the shortest path to the destination node in response to a route request message from a source node. The proposed mechanism does not apply any cryptographic primitives on the routing messages. Instead, it protects the network by detecting and reacting to malicious activities of any node. Simulation results show that the scheme has a significantly high detection rate with moderate network traffic overhead.
II. RELATED WORK
Prior work addresses routing security through cryptography, misbehavior detection, and incentives, while a proposed AODV defense against black-hole attacks fails against cooperative attackers.
II. RELATED WORK
- The AODV black-hole defense checks whether a route exists, but fails to identify cooperative attacks involving multiple malicious nodes.The passage says it completely eliminates a single-attacker black-hole attack but fails against cooperative black-hole attacks.Source: §II · p. 1
- Cryptographic mechanisms have been proposed to secure MANET routing, and certificate-based and self-organized PGP schemes address node authentication.The passage names Hu et al, Papadimitratos and Hass, Sanzgiri et al, Yang et al, Zhou and Haas, and Hubaux et al.Source: §II · p. 1
- Watchdog and Pathrater detect and report observed routing misbehavior, but do not punish malicious nodes.Instead, they relieve those nodes of their packet-forwarding burden.Source: §II · p. 1
- Payment schemes discourage selfish routing but may require tamper-proof hardware or central bankers, unsuitable for some ad hoc scenarios.The passage also notes observation-based techniques for detecting and reporting routing misbehavior.Source: §II · p. 1
III. GRAY HOLE ATTACK
AODV discovers routes through RREQ broadcasts and RREP replies. Gray holes exploit this process to attract traffic, then drop packets selectively or intermittently, making them harder to detect than black holes.
III. GRAY HOLE ATTACK
- AODV broadcasts an RREQ when no route is available; intermediate nodes update reverse routes and forward requests, and an RREP returns from a destination or node with a current route.The source uses an existing route when one is in its routing table.Source: §III · p. 2
- A gray hole first advertises a spurious valid route to intercept packets, then drops intercepted packets with some probability.Unlike a black hole, which drops received data packets with certainty, a gray hole may drop packets for selected nodes, only during some periods, or both.Source: §III · p. 2
- Gray holes may combine target-selective and time-varying packet dropping, making their detection more difficult.The passage contrasts their probabilistic dropping with black holes’ certain packet dropping.Source: §III · p. 2
IV. PROPOSED MECHANISM
The section introduces practical assumptions for the network model before presenting the proposed mechanism in detail.
IV. PROPOSED MECHANISM
- The section first introduces practical assumptions used to formulate the network model.The passage places this before the mechanism description.Source: §IV · p. 2
- The section then presents the proposed mechanism in detail.This is the stated focus following the network-model assumptions.Source: §IV · p. 2
A. Network Model
The model assumes similar mobile nodes in a shared, constrained, error-prone multihop network, with bidirectional links and unique nonzero node IDs; nodes may join, leave, or fail.
A. Network Model
- Nodes are of similar types and may roam or remain stationary, join or leave the network, and fail at any time.The assumptions allow varying node mobility and membership over time.Source: A. Network Model · p. 2
- Communication uses a shared, bandwidth-constrained, error-prone multihop wireless channel, and links are assumed bidirectional.Each node is assumed to have a unique nonzero ID.Source: A. Network Model · p. 2
- The mechanism does not assume promiscuous-mode interfaces, which may add computation and energy costs and may be infeasible with directional antennas.The network may contain varying numbers of cooperating gray-hole nodes over time.Source: A. Network Model · p. 2
B. Different Modules of the Scheme
The scheme gathers neighborhood forwarding evidence, escalates failed probes from local to cooperative checks, and uses network-wide alarms to isolate identified malicious nodes.
B. Different Modules of the Scheme
- Local detection escalates a failed probe into cooperative anomaly detection, within a sequence of four security procedures.The procedures are neighborhood data collection, local anomaly detection, cooperative anomaly detection, and global alarm raising.Source: B. Different Modules of the Scheme · pp. 2–3
- Each node records neighbors’ forwarding history in a DRI table; nodes with no recorded interaction after a threshold interval are probed further.The “From” and “Through” entries indicate whether a node has forwarded packets from or through a neighbor; the threshold depends on network mobility.Source: B. Different Modules of the Scheme · pp. 2–3
- An initiator selects a cooperative node using DRI records, routes a probe through the suspected node, and escalates if the cooperative node does not receive it.A received probe sets the suspected node’s CheckBit; a failed probe raises suspicion and triggers cooperative detection.Source: B. Different Modules of the Scheme · p. 3
- Cooperative detection cross-checks the suspected route with neighbors’ further probes and notifications sent to the initiator over routes that bypass the suspected node.The initiator uses a ProbeCheck table to match notifications with received probes; three spaced probes from a neighbor are used, and none received leads to gray-hole classification for that period.Source: B. Different Modules of the Scheme · p. 3
- Detection frequency should reflect the packet drops the application can tolerate and the desired quality of service.A gray hole may switch from good to bad behavior between detection rounds, so the interval also depends on estimated drops during that period.Source: B. Different Modules of the Scheme · pp. 3–4
- After cooperative detection, a network-wide alarm isolates the node; a k-signature threshold protects against collusion by up to k-1 malicious neighbors.The faulty list can be piggybacked on RREQ/RREP messages or maintained as a partial list of nearby faulty nodes.Source: B. Different Modules of the Scheme · p. 4
V. SIMULATION AND RESULTS
The proposed mechanism was evaluated in simulation using false-positive and misdetection rates, data packet delivery, and control-packet overhead. Delivery remained above 90% with 20% malicious gray holes, while the measured error rates and overhead varied with mobility and traffic volume.
V. SIMULATION AND RESULTS
- The evaluation used ns-2 with AODV, 802.11 DCF, continuously mobile random-waypoint nodes, and gray holes modeled by a two-phase Markov chain.Metrics were false-positive rate, misdetection rate, data packet delivery ratio, and security-algorithm control-packet overhead.Source: §V · p. 4
- 7% was the maximum observed false-positive rate, which increased as nodes moved faster.The authors attribute the increase to nodes having only partial information about transmissions with current neighbors at high speed.Source: Figure 2 · p. 4, §V · p. 4
- 12% was the maximum misdetection rate, observed in a static network; the rate fell as node mobility increased.In sparse static regions, neighbors may lack the requisite k nodes to reach consensus; mobility makes it more likely other nodes enter the region.Source: §V · p. 4, Figure 3 · p. 5
- More than 90% of data packets were delivered with the proposed protocol when 20% of network nodes were malicious gray holes.Delivery did not reach 100%; most packet loss occurred during the algorithm's detection and reaction phase.Source: Figure 4 · p. 5, §V · p. 5
- Control-packet overhead decreased as the number of data packets increased, with normal AODV used as the baseline.The reported case used 20% malicious nodes, the worst case for overhead; overhead is expressed as a percentage of control packets required to route different numbers of data packets.Source: Figure 5 · p. 5, §V · p. 5
VI. CONCLUSION
The paper presents a collaborative, distributed mechanism for detecting malicious gray-hole nodes in MANETs. Its simulations indicate high detection with very low false-positive rate and control overhead.
VI. CONCLUSION
- Occasional misbehavior makes gray holes difficult to detect, so the mechanism proactively involves neighboring nodes in collaborative, distributed detection.The authors say this increases detection reliability.Source: §VI · p. 5
- Detection decisions use a consensus algorithm based on threshold cryptography.Source: §VI · p. 5
- Simulation results indicate high detection rate with very low false-positive rate and control overhead.The paper characterizes the mechanism as effective and efficient.Source: §VI · p. 5