Iaetsd identifying and preventing resource depletion attack in

Identifying And Preventing Resource Depletion Attack In
Mobile Sensor Network
M.Swapna M.Tech
swapna.12b2@gmail.com
V.Sucharitha
Associate Professor
jesuchi78@yahoo.com
Audisankara college of engineering and technology
ABSTRACT:
Ad-hoc low-power wireless networks are inspiring research direction in sense
and enveloping computing. In previous security work in this area has focused primarily
on inconsistency of communication at the routing or medium access control levels. This
paper explores resource depletion attacks at the navigation protocol layer, which
permanent disable networks by quickly draining nodes battery power. The “Vampire”
attacks are not specific protocol, but rather rely on the properties of many popular classes
of routing protocols. We find that all examined protocols are vulnerable to Vampire
attacks, which are demolish and difficult to detect, and easy to carry out using as few as
one malicious insider send only protocol compliant messages.
1.INTRODUCTION:
the last couple of years wireless
communication has become of such
fundamental importance that a world
without is no longer imaginable for
many of using. Beyond the establish
technologies such as mobile phones and
WLAN, new approaches to wireless
communication are emerging; one of
them are so called ad hoc and sensor
networks. Ad hoc and sensor networks
are formed by autonomous nodes
communicating via radio without any
additional backbone infrastructure. Ad-
hoc wireless sensor networks (WSNs)
promise exciting new applications in the
near future, such as omnipresent on-
demand computing power, continuous
connectivity, and instantly-deployable
communication for military and first
responders. Such networks already
monitor environmental conditions,
factory performance, and troop
deployment, to name a few applications.
As WSNs become more and more
crucial to the everyday functioning of
people and organizations, availability
faults become less tolerable — lack of
availability can make the difference
between business as usual and lost
productivity, power outages,
environmental disasters, and even lost
lives; thus high availability of these
155
INTERNATIONAL CONFERENCE ON CURRENT INNOVATIONS IN ENGINEERING AND TECHNOLOGY
INTERNATIONAL ASSOCIATION OF ENGINEERING & TECHNOLOGY FOR SKILL DEVELOPMENT
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

networks is a critical property, and
should hold even under malicious
conditions. Due to their ad-hoc
organization, wireless ad-hoc networks
are particularly vulnerable to denial of
service (DoS) attacks, and a great deal of
research has been done to enhance
survivability.
While these schemes can prevent
attacks on the short-term availability of a
network, they do not address attacks that
affect long-term available — the most
permanent denial of service attack is to
entirely deplete nodes’ batteries. This is
an instance of a resource depletion
attack, with battery power as the
resource of interest. this paper we
consider how routing protocols, even
those designed to be secure, lack
protection from these attacks, which we
call Vampire attacks, since they drain
the life from networks nodes. These
attacks are distinct from previously-
studied DoS, reduction of quality (RoQ),
and routing infrastructure attacks as they
do not disrupt immediate availability,
but rather work over time to entirely
disable a network. While some of the
individual attacks are simple, and power-
draining and resource exhaustion attacks
have been discussed before, prior work
has been mostly confined to other levels
of the protocol stack, e.g. medium access
control (MAC) or application layers, and
to our knowledge there is little
discussion, and no thorough analysis or
mitigation, of routing-layer resource
exhaustion attacks.
Vampire attacks are not protocol-
specific, in that they do not rely on
design properties or implementation
faults of particular routing protocols, but
rather exploit general properties of
protocol classes such as link-state,
distance-vector, source routing and
geographic and beacon routing. Neither
do these attacks rely on flooding the
network with large amounts of data, but
rather try to transmit as little data as
possible to achieve the largest energy
drain, preventing a rate limiting solution.
Since Vampires use protocol-compliant
messages, these attacks are very difficult
to detect and prevent.
This paper makes three primary
contributions. First, we thoroughly
evaluate the vulnerabilities of existing
protocols to routing layer battery
depletion attacks. We observe that
security measures to prevent Vampire
attacks are orthogonal to those used to
protect routing infrastructure, and so
existing secure routing protocols such as
Ariadne, SAODV, and SEAD do not
protect against Vampire attacks. Existing
work on secure routing attempts to
ensure that adversaries cannot cause path
discovery to return an invalid network
path, but Vampires do not disrupt or
alter discovered paths, instead using
existing valid network paths and
protocol compliant messages. Protocols
that maximize power efficiency are also
inappropriate, since they rely on
cooperative node behavior and cannot
optimize out malicious action. Second,
we show simulation results quantifying
the performance of several
representative protocols in the presence
of a single Vampire (insider adversary).
Third, we modify an existing sensor
network routing protocol to provably
bound the damage from Vampire attacks
during packet forwarding.
1.1.Wireless Adhoc Network:
An ad hoc wireless network is a
collection of wireless mobile nodes that
self-configure to form a network without
the aid of any established infrastructure,
as shown in without an inherent
infrastructure, the mobiles handle the
156
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

necessary control and networking tasks
by themselves, generally through the use
of distributed control algorithms.
Multihop connections, whereby
intermediate nodes send the packets
toward their final destination, are
supported to allow for efficient wireless
communication between parties that are
relatively far apart. Ad hoc wireless
networks are highly appealing for many
reasons. They can be rapidly deployed
and reconfigured. They can be tailored
to specific applications, as implied by
Oxford’s definition. They are also highly
robust due to their distributed nature,
node redundancy, and the lack of single
points of failure.
Fig:Adhoc Network Structure
Existing work on secure routing
attempts to ensure that adversaries
cannot cause path discovery to return an
invalid network path, but Vampires do
not disrupt or alter discovered paths,
instead using existing valid network
paths and protocol compliant messages.
Protocols that maximize power
efficiency are also inappropriate, since
they rely on cooperative node behavior
and cannot optimize out malicious
action.
2.LITERATURE REVIEW:
Literature survey is the most important
step in software development process.
Before developing the tool it is
necessary to determine the time factor,
economy n company strength. Once
these things r satisfied, ten next steps are
to determine which operating system and
language can be used for developing the
tool. Once the programmers start
building the tool the programmers need
lot of external support. This support can
be obtained from senior programmers,
from book or from websites. Before
building the system the above
consideration r taken into account for
developing the proposed system.
A wireless sensor network (WSN)
consists of spatially distributed
autonomous sensors to monitor physical
or environmental conditions, such as
temperature, sound, pressure, etc. and to
cooperatively pass their data through the
network to a main location. The more
modern networks are bi-directional, also
enabling control of sensor activity. The
development of wireless sensor networks
was motivated by military applications
such as battlefield surveillance; today
such networks are used in many
industrial and consumer applications,
such as industrial process monitoring
and control, machine health monitoring,
and so on.
157
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

The WSN is built of "nodes" –
from a few to several hundreds or even
thousands, where each node is connected
to one (or sometimes several) sensors.
Each such sensor network node has
typically several parts: a radio
transceiver with an internal antenna or
connection to an external antenna, a
microcontroller, an electronic circuit for
interfacing with the sensors and an
energy source, usually a battery or an
embedded form of energy harvesting. A
sensor node might vary in size from that
of a shoebox down to the size of a grain
of dust, although functioning "motes" of
genuine microscopic dimensions have
yet to be created. The cost of sensor
nodes is similarly variable, ranging from
a few to hundreds of dollars, depending
on the complexity of the individual
sensor nodes. Size and cost constraints
on sensor nodes result in corresponding
constraints on resources such as energy,
memory, computational speed and
communications bandwidth. The
topology of the WSNs can vary from a
simple star network to an advanced
multi-hop wireless mesh network. The
propagation technique between the hops
of the network can be routing or
flooding.
3.IMPLIMENTATION:
As a prerequisite, all nodes
cooperatively build a Chord overlay
network over the sensor network. Cloned
node may not participate in this
procedure, but it does not give them any
advantage of avoiding detection. The
construction of the overlay network is
independent of node clone detection. As
a result, nodes possess the information
of their direct predecessor and successor
in the Chord ring. In addition, each node
caches information of its g consecutive
successors in its successors table. Many
Chord systems utilize this kind of cache
mechanism to reduce the communication
cost and enhance systems robustness.
More importantly in our protocol, the
facility of the successors table
contributes to the economical selection
of inspectors. One detection round
consists of three stages.
Stage 1: Initialization
To activate all nodes starting a new
round of node clone detection, the
initiator uses a broadcast authentication
scheme to release an action message
including a monotonously increasing
nonce, a random round seed, and an
action time. The nonce is intended to
158
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

prevent adversaries from launching a
DoS attack by repeating broadcasting
action messages. The action message is
defined by
Stage 2: Claiming neighbors information
Upon receiving an action message, a
node verifies if the message nonce is
greater than last nonce and if the
message signature is valid. If both pass,
the node updates the nonce and stores
the seed. At the designated action time,
the node operates as an observer that
generates a claiming message for each
neighbor (examinee) and transmits the
message through the overlay network
with respect to the claiming
probability .The claiming message by
observer for examinee is constructed
by
Where , are locations of and
,respectively. Nodes can start
transmitting claiming messages at the
same time, but then huge traffic may
cause serious interference and degrade
the network capacity. To relieve this
problem, we may specify a sending
period, during which nodes randomly
pick up a transmission time for every
claiming message.
Stage 3: Processing claiming messages
A claiming message will be forwarded to
its destination node via several Chord
intermediate nodes. Only those nodes in
the overlay network layer (i.e., the
source node, Chord intermediate nodes,
and the destination node) need to process
a message,
whereas other nodes along the path
simply route the message to temporary
targets. Algorithm 1 for handling a
message is the kernel of our DHT-based
detection protocol. If the algorithm
returns NIL, then the message has
arrived at its destination. Otherwise, the
message will be subsequently forwarded
to the next node with the ID that is
returned by Algorithm 1.
Criteria of determining inspectors:
During handling a message in Algorithm
1, the node acts as an inspector if one of
the following conditions is satisfied.
159
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

4.ALGORITHMS:
1) This node is the destination node of
the claiming message.
2) The destination node is one of the g
successors of the node. In other words,
the destination node will be reached in
the next Chord hop. While the ﬁrst
criterion is intuitive, the second one is
subtle and critical for the protocol
performance. By Algorithm 1, roughly
of all claiming messages related to a
same examinee’s ID will pass through
one of the predecessors of the
destination. Thus, those nodes are much
more likely to be able to detect a clone
than randomly selected inspectors. As a
result, this criterion to decide inspectors
can increase the average number of
witnesses at a little extra memory cost.
We will theoretically quantify those
performance measurements later. In
Algorithm 1, to examine a message for
node clone detection, an inspector will
invoke Algorithm 2, which compares the
message with previous inspected
messages that are buffered in the cache
table. Naturally, all records in the cache
table should have different examinee
IDs, as implied in Algorithm 2. If
detecting a clone, which means that
there exist two messages and
satisfying and , the
witness node then broadcasts the
evidence to notify the whole network.
All integrity nodes verify the evidence
message and
stop communicating with the cloned
nodes. To prevent cloned nodes from
joining the network in the future, a
160
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

revocation list of compromised nodes
IDs may be maintained by nodes
individually. It is worth noting that
messages and are
authenticated by observers and,
respectively. Therefore, the witness does
not need to sign the evidence message. If
a malicious node tries to launch a DoS
attack by broadcasting a bogus evidence
message, the next integrity node
receiving it can immediately detect the
wicked behavior by verifying the
signatures of and before
forwarding to other nodes.
The DHT-based detection protocol
can be applied to general sensor
networks, and its security level is
remarkable, as cloned nodes will be
caught by one deterministic witness plus
several probabilistic witnesses.
However, the message transmission over
a Chord overlap network incurs
considerable communication cost, which
may not be desired for some sensor
networks that are extremely sensitive to
energy consumption. To fulfill this
challenge, we propose the randomly
directed exploration (RDE), which
tremendously reduces communication
cost and presents optimal storage
expense with adequate detection
probability. The RDE protocol shares the
major merit with broadcasting detection:
Every node only needs to know and
buffer a neighbor-list containing all
neighbors IDs and locations. For both
detection procedures, every node
constructs a claiming message with
signed version of its neighbor-list, and
then tries to deliver the message to
others which will compare with its own
neighbor-list to detect clone. For a dense
network, broadcasting will drive all
neighbors of cloned nodes to find the
attack, but in fact one witness that
successfully catches the clone and then
notifies the entire network would suffice
for the detection purpose. To achieve
that in a communicatively efficient way,
we bring several mechanisms and
effectively construct a multicast routing
protocol. First, a claiming message
needs to provide maximal h op limit, and
initially it is sent to a random neighbor.
Then, the message subsequent
transmission will roughly maintain a
line. The line transmission property
helps a message go through the network
as fast as possible from a locally optimal
perspective. In addition, we introduce
border determination mechanism to
161
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

signiﬁcantly reduce communication cost.
We can do all of those because every
node is aware of its neighbors locations,
which is a basic assumption for all
witness-based detection protocols but
rarely utilized by other protocols.
4.1 Protocol Description:
One round of clone detection is still
activated by the initiator. Subsequently,
at the designated action time, each node
creates its own neighbor-list including
the neighbors IDs and locations, which
constitutes the sole storage consumption
of the protocol. Then, it, as an observer
for all its neighbors, starts to generate a
claiming message containing its own ID,
location, and its neighb-list. The
claiming message by node is
constructed by
where is time to live (a.k.a. message
maximum hop). Since tt1 will be altered
by intermediate nodes during
transmission, it should not be
authenticated. The observer willdeliver
the claiming message r times. In each
time, the node transmits it to a random
neighbor as indicated. Note that can be a
real number, and accordingly an
observer transmits its claiming message
at least[r] ,up to ,[r] and on average r
times. When an intermediate node
receives a claiming message it
launches , which is described by
pseudo code in Algorithm 3, to
process the message. During the
processing, node , as an inspector,
compares its own neighbor-list to the
neighbor-list in the message, checking if
there is a clone. Similarly, if detecting a
clone, the witness node will
broadcast an evidence messageto notify
the whole network such
that the cloned
nodes are expelled from the sensor
network. To deal with routing, node
162
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

decreases the message’s by 1 and
discards the message if reaches zero;
Essentially, Algorithm 4 contains the
following three mechanisms.
4.2Deterministicdirected
transmission:
When node receives a claiming message
from previous node, the ideal direction
can be calculated. In order to achieve the
best effect of line transmission, the next
destination node should be node , which
is closest to the ideal direction.
4.3Networkborder
determination:
This takes network shape into
consideration to reduce the
communication cost. In many sensor
network applications, there exist outside
borders of network due to physical
constrains. When reaching some border
in the network, the claiming message
can be directly discarded. In our
proposal for border local determination,
another parameter
4.4target range :
This is used along with ideal direction to
determine a target zone. When no
neighbor is found in this zone, the
current node will conclude that the
message has reached a border, and thus
throw it away.
Fig:Loose source routing performance
compared to optimal, in a network with
diameter slightly above 10. The dashed
trend line represents expected path
length when nodes store logN local state,
and the solid trend line shows actual
observed performance.
5.CONCLUSION:
We defined Vampire attacks, a new class
of resource consumption attacks that use
163
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

routing protocols to permanently disable
ad-hoc wireless sensor networks by
depleting nodes’ battery power. These
attacks do not depend on particular
protocols or implementations, but rather
expose vulnerabilities in a number of
popular protocol classes. We showed a
number of proof-of-concept attacks
against representative examples of
existing routing protocols using a small
number of weak adversaries, and
measured their attack success on a
randomly-generated topology of 30
nodes.
REFERENCES:
[1] “The Network Simulator - ns-2,”
http://www.isi.edu/nsnam/ns,2012.
[2] I. Aad, J.-P. Hubaux, and E.W.
Knightly, “Denial of Service Resilience
in Ad Hoc Networks,” Proc. ACM
MobiCom, 2004.
[3] G. Acs, L. Buttyan, and I. Vajda,
“Provably Secure On-Demand Source
Routing in Mobile Ad Hoc Networks,”
IEEE Trans. Mobile Computing, vol. 5,
no. 11, pp. 1533-1546, Nov. 2006.
[4] T. Aura, “Dos-Resistant
Authentication with Client Puzzles,”
Proc. Int’l Workshop Security Protocols,
2001.
[5] J. Bellardo and S. Savage, “802.11
Denial-of-Service Attacks: Real
Vulnerabilities and Practical Solutions,”
Proc. 12th Conf. USENIX Security,
2003.
[6] D. Bernstein and P. Schwabe, “New
AES Software Speed Records,” Proc.
Ninth Int’l Conf. Cryptology in India:
Progress in Cryptology (INDOCRYPT),
2008.
[7] D.J. Bernstein, “Syn Cookies,”
http://cr.yp.to/syncookies.html, 1996.
[8] I.F. Blaked, G. Seroussi, and N.P.
Smart, Elliptic Curves in cryptography,
vol. 265. Cambridge Univ. , 1999.
[9] J.W. Bos, D.A. Osvik, and D. Stefan,
“Fast Implementations of AES on
Various Platforms,” Cryptology ePrint
Archive, Report 2009/ 501,
http://eprint.iacr.org, 2009.
[10] H. Chan and A. Perrig, “Security
and Privacy in Sensor Networks,”
Computer, vol. 36, no. 10, pp. 103-105,
Oct. 2003.
[11] J.-H. Chang and L. Tassiulas,
“Maximum Lifetime Routing in
Wireless Sensor Networks,” IEEE/ACM
Trans. Networking, vol. 12, no. 4, pp.
609-619, Aug. 2004.
164
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

[12] T.H. Clausen and P. Jacquet,
Optimized Link State Routing
Protocol(OLSR), IETF RFC 3626, 2003.
[13] J. Deng, R. Han, and S. Mishra,
“Defending against Path-Based DoS
Attacks in Wireless Sensor Networks,”
Proc. ACM Workshop Security of Ad
Hoc and Sensor Networks, 2005.
[14] J. Deng, R. Han, and S. Mishra,
“INSENS: Intrusion-Tolerant Routing
for Wireless Sensor Networks,”
Computer Comm., vol. 29, 1. 2, pp. 216-
230, 2006.
[15] S. Doshi, S. Bhandare, and T.X.
Brown, “An On-Demand Minimum
Energy Routing Protocol for a Wireless
Ad Hoc Network,” ACM SIGMOBILE
Mobile Computing and Comm. Rev.,
vol. 6, no. 3, pp. 50-66, 2002.
[16] J.R. Douceur, “The Sybil Attack,”
Proc. Int’l Workshop Peer-to-Peer
Systems, 2002.
[17] H. Eberle, A. Wander, N. Gura, C.-
S. Sheueling, and V. Gupta,
“Architectural Extensions for Elliptic
Curve Cryptography over GF(2m) on 8-
bit Microprocessors,” Proc. IEEE Int’l
Conf’ Application- Specific Systems,
Architecture Processors (ASAP), 2005.
165
ISBN: 378 - 26 - 138420 - 5
www.iaetsd.in

Iaetsd identifying and preventing resource depletion attack in

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (12)

Similar to Iaetsd identifying and preventing resource depletion attack in

Similar to Iaetsd identifying and preventing resource depletion attack in (20)

More from Iaetsd Iaetsd

More from Iaetsd Iaetsd (20)

Recently uploaded

Recently uploaded (20)

Iaetsd identifying and preventing resource depletion attack in