Risk-Aware Response Mechanism with Extended D-S theory

312 views

Published on

Mobile Ad hoc Networks (MANET) are having dynamic nature of its network infrastructure and
it is vulnerable to all types of attacks. Among these attacks, the routing attacks getting more attention
because its changing the whole topology itself and it causes more damage to MANET. Even there are lot of
intrusion detection Systems available to diminish those critical attacks, existing causesunexpected network
partition, and causes additional damages to the infrastructure of the network , and it leads to uncertainty in
finding routing attacks in MANET. In this paper, we propose a adaptive risk-aware response mechanism with
extended Dempster-Shafer theory in MANET to identify the routing attacks and malicious node. Our
techniques find the malicious node with degree of evidence from the expert knowledge and detect the
important factors for each node.It creates black list and all those malicious nodes so that it may not enter the
network again

Published in: Education, Technology
  • Be the first to comment

  • Be the first to like this

Risk-Aware Response Mechanism with Extended D-S theory

  1. 1. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 6Risk-Aware Response Mechanism withExtended D-S theoryG.NirmalaErode Sengunthar Engineering CollegeThudupathi,Erode,Tamil NaduT. Kalai selviErode Sengunthar Engineering CollegeThudupathi,Erode,Tamil NaduAbstract: Mobile Ad hoc Networks (MANET) are having dynamic nature of its network infrastructure andit is vulnerable to all types of attacks. Among these attacks, the routing attacks getting more attentionbecause its changing the whole topology itself and it causes more damage to MANET. Even there are lot ofintrusion detection Systems available to diminish those critical attacks, existing causesunexpected networkpartition, and causes additional damages to the infrastructure of the network , and it leads to uncertainty infinding routing attacks in MANET. In this paper, we propose a adaptive risk-aware response mechanism withextended Dempster-Shafer theory in MANET to identify the routing attacks and malicious node. Ourtechniques find the malicious node with degree of evidence from the expert knowledge and detect theimportant factors for each node.It creates black list and all those malicious nodes so that it may not enter thenetwork againKeywords: Mobile Adhoc Network, Black list, Aodv, Dempster Shafer theory;1.INTRODUCTIONMOBILE Ad hoc Networks (MANET)introducing a communication in all environmentswithout any predefined infrastructure orcentralized administration Therefore, MANET issuitable for adverse and hostile environmentswhere central authority point is not necessary.The important characteristic of MANET isthe dynamic nature of its network topologywhich is frequently changing due to theunpredict- able mobility of nodes. Furthermore,each mobile node in MANET plays a router rolewhile transmitting data over the network.Hence, any compromised nodes under an adver-sary’s control could cause significantdamage to the functionality and security of itsnetwork since the impact would propagate inperforming routing tasks.Such a simple response against maliciousnodes often neglects possible negative sideeffects involved with the response actions. InMANET scenario, improper countermeasuresmay cause the unexpected network partition,bringing additional damages to the networkinfrastructure. To address the above-mentionedcritical issues, more flexible and adaptiveresponse should be investigated.In Existing Wang proposed a na¨ıve fuzzycost sensitive intrusion response solution forMANET. Their cost model took subjectiveknowledge, objective evidence, and logicalreasoning. Subjective knowledge could beretrieved from previous experience and objectiveevidence could be obtained from observationwhile logical reasoning requires a formalfoundationIn this paper, we seek a way to bridgethis gap by using Dempster-Shafermathematical theory of evidence (D-S theory),which offers an alternative to traditionalprobability theory for representing uncertainty .D-S theory has been adopted as a valuable toolfor evaluating reliability and security ininformation systems and by other engineeringfields , where precise measurement is impossibleto obtain or expert elicitation is required. D-Stheory has several characteristics. First, itenables us to represent both subjective and
  2. 2. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 7objective evidences with basic probabilityassignment and belief function. Second, itsupports Dempster’s rule of combination (DRC) tocombine several evidences together withprobable reasoning. However, as identified in,Dempster’s rule of combination has severallimitations, such as treating evidences equallywithout differentiating each evidence andconsidering priorities among them.To address these limitations in MANETintrusion response scenario, we introduce a newDempster’s rule of combination with a notion ofimportance factors (IF) in D-S evidence model. Inthis paper, we propose a risk-awareresponsemechanism to systematically cope withrouting attacks in MANET, proposing anadaptive time-wise isolation meth- od. Our risk-aware approach is based on the extended D-Sevidence model. In order to evaluate ourmechanism, we perform a series of simulatedexperiments with proactive MANET routingprotocol, Adhoc On Demand Distance VectorRouting Protocol (AODV).In addition, weattempt to demonstrate the effectiveness of oursolution.The major contributions of this paper aresummarizedas follows:We formally propose an extended D-Sevidence model with importance factors andarticulate ex- pected properties for Dempster’srule of combina- tion with importance factors(DRCIF). Our Dempster’s rule of combinationwith importance factors is no associative andweighted, which has not been addressed in theliterature.We propose an adaptive risk-aware responseme- chanism with the extended D-S evidencemodel, considering damages caused by bothattacks and countermeasures. The adaptiveness ofour mechan- ism allows us to systematicallycope with MANET routing attacks.2.Background2.1 AODV ProtocolThe Ad hoc On Demand DistanceVector (AODV) routing algorithm is a routingprotocol designed for ad hoc mobile networks.AODV is capable of both unicast and multicastrouting. It is an on demand algorithm, meaningthat it builds routes between nodes only as desiredby source nodes. It maintains these routes as longas they are needed by the sources AODV buildsroutes using a route request / route reply querycycle.When a source node desires a route to adestination for which it does not already have aroute, it broadcasts a route request (RREQ) packetacross the network. Nodes receiving this packetupdate their information for the source node andset up backwards pointers to the source node in theroute tables. In addition to the source nodes IPaddress, current sequence number, and broadcastID, the RREQ also contains the most recentsequence number for the destination of which thesource node is aware. A node receiving the RREQmay send a route reply (RREP) if it is either thedestination or if it has a route to the destinationwith corresponding sequence number greater thanor equal to that contained in the RREQ. If this isthe case, it unicasts a RREP back to the source.Otherwise, it rebroadcasts the RREQ. Nodes keeptrack of the RREQs source IP address andbroadcast ID. If they receive a RREQ which theyhave already processed, they discard the RREQand do not forward itAs the RREP propagates back to thesource, nodes set up forward pointers to thedestination. Once the source node receives theRREP, it may begin to forward data packets to thedestination. If the source later receives a RREPcontaining a greater sequence number or containsthe same sequence number with a smallerhopcount, it may update its routing information forthat destination and begin using the better route.As long as the route remains active, itwill continue to be maintained. A route isconsidered active as long as there are data packetsperiodically travelling from the source to thedestination along that path. Once the source stops
  3. 3. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 8sending data packets, the links will time out andeventually be deleted from the intermediate noderouting tables. If a link break occurs while theroute is active, the node upstream of the breakpropagates a route error (RERR) message to thesource node to inform it of the now unreachabledestination(s). After receiving the RERR, if thesource node still desires the route, it can reinitiateroute discovery.2.2.Routing Attacks:In AODV, any node can eithermodify the protocol messages beforeforwarding them, or create false messages orspoof an identity. first, it changes the contentsof a discovered route, modifies a route replymessage, and causes the packet to be droppedas an invalid packet; then, it validates theroute cache in other nodes by advertisingincorrect paths, and refuses to participate in theroute discovery process; and finally, itmodifies the contents of a data packet or theroute via which the data packet is supposed totravel or behave normally during the routediscovery process but is dropped. Thus all typesof fabrication attacks can occurs.3. EXTENDED DEMPSTERSHAFER THEORY OFEVIDENCEThe Dempster-Shafer mathematicaltheory of evidence is both a theory ofevidence and a theory of probable reasoning.The degree of belief models the evidence, whileDempster’s rule of combination is theprocedure to aggregate and summarize a corpusof evidences. However, previous research effortsidentify several limitations of the Dempster’srule of combination1. Associative. For DRC, the order ofthe information in the aggregatedevidences does not impact the result. Asshown in , a nonassociative combinationrule is necessary for many cases.2. Nonweighted. DRC implies that wetrust all evidences equally. However, inreality, our trust on differentevidences may differ. In other words,it means we should consider variousfactors for each evidence.We proposed rules to combine severalevidences presented sequentially for the firstlimitation and suggested a weighted combinationrule to handle the second limitation. We evaluateour response mechanism against representativeattack scenarios . The weight for differentevidences in their proposed rule is ineffectiveand insufficient to differentiate and prioritizedifferent evidences in terms of security andcriticality. Our extended Dempster-Shafer theorywith importance factors can overcome both of theaforementioned limitations. The DRC techniquewill be taken for finding the attacks and its countermeasures and thus will be putting the attacker in ablack list to avoid the same attacker while enteringthe network later.3.1 Importance Factors andBelief FunctionIn D-S theory, propositions are represented assubsets of a given set. Suppose e is a finite setof states, and let 2e denote the set of all subsetsof e. D-S theory calls e, a frame of discernment.When a proposition corresponds to a subset of aframe of discernment, it implies that a particularframe discerns the proposition. First, weintroduce a notion of importance factors.Definition 1. Importance factor (IF ) is a positivereal number associated with the importance ofevidence. IF s are derived from historicalobservations or expert experiences.Definition 2. An evidence E is a 2-tuple (m, I F ),where m describes the basic probabilityassignment . Basic prob- ability assignmentfunction m is defined as follows:m(ф)=0 ----------------> (1)
  4. 4. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 9andΣ m(A)=1 ----------------->(2)The Belief Function is as followsBel(A)= Σ m(B) ------------->(3)3.2 Expected Properties forOur Dempster’s Rule ofCombinationThe proposed rule of combinationwith importance factors should be a superset ofDempster’s rule of combination. In this section,we describe four properties that a candidateDempster’s rule of combination withimportance factors should follow. Properties 1and 2 ensure that the combined result is a validevidence. Property 3 guarantees that the originalDempster’s Rule of Combination is a specialcase of Dempster’s Rule of Combination withimportance factors, where the combinedevidences have the same priority. Property 4ensures that importance factors of the evidencesare also independent from each other.Property 1. No belief ought to be committed to qin the result of our combination rulem’(ф)=0 ---------->(4)Property 2. The total belief ought to be equal to 1in the result of our combination ruleΣm’(A)=1 ---------->(5)Property 3. If the importance factors of eachevidence are equal, our Dempster’s rule ofcombination should be equal to Dempster’s ruleof combination without importance factorsm’(A,IF1,IF2)=m(A) if IF1 =I F2Property 4. Importance factors of each evidencemust not be exchangeable.m’(A,IF1,IF2)=m’(A,IF1,IF2) If (IF1=IF2)we propose a Dempster’s rule of combina-tionwith importance factors. We prove ourcombination rulem’(A,IF1,IF2)= m(A )if IF1 =I F24. Theorem Dempster’s rule ofcombinationBelief to either of these evidencesis less than 1. This is straightforward sinceif our belief to one evidence is 1 or 0.Figure. 1. Risk-aware response mechanismProof. It is obvious that our proposedDRCIF holds Properties . We prove thatour proposed DRCIF also holds PropertiesProperty:Our evidence selection approach considerssubjective evidence from experts’ knowledgeand objective evidence from routing tablemodification. We propose a unified analysisapproach for evaluating the risks of both attack(RiskA ) and countermeasure (RiskC ).We takethe confidence level of alerts from IDS as thesubjective knowledge in Evidence 1. In terms
  5. 5. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 10of objective evidence, we analyze differentrouting table modification cases. There arethree basic items in AODV routing table(destination, next hop, distance). Thus,routing attack can cause existing routing tableentries to be missed, or any item of a routingtable entry to be changed. We illustrate thepossible cases of routing table change andanalyze the degrees of damage in Evidences 2through 5.Two independent evidences named E1 andE2 , respectively. The combination of these twoevidences implies that our total belief to thesetwo evidences is 1, in same time, our belief toeither of these evidences is less than 1. Thisis straightforward since if our belief to oneevidence is 1, it would mean our belief to theother is 0, which models Routing tablerecovery includes local routing table recoveryand global routing recovery. Local routingrecovery is performed by victim nodes.4.1 Evidence CollectionOur proposed DRCIF is nonassociativefor multiple evidences. Therefore, for the case inwhich sequential information is not availablefor some instances, it is necessary to makethe result of combination consistent withmultiple evidences. Our combination algorithmsup- ports this requirement and the complexity ofour algorithm is O(n), where n is the number ofevidences. It indicates that our extendedDempster-Shafer theory demands no extracomputational cost compared to a na¨ıvefuzzy-based method. The algorithm forcombination of multiple evi- dences isconstructed as follows:Algorithm 1.MUL-EDS-CMBOUTPUT: One evidence1 jEpj j sizeof(Ep);2 While jEpj > l do3 Pick two evidences with the least 1F inEp, named El and E2 ;4 Combine these two evidences,E j hml m2 , (1Fl + 1F2 )/2);5 Remove El and E2 from Ep;6 Add E to Ep;7 endThe Evidences are collected from the IDS andpriorities assigned to each of them,thus by addingtogether we get the total evidences. RiskAssessment is made with attacks and its effects.Adaptive decision is taken that the node is attackeror not by comparing with with the thresholdvalues namely upper risk tolerance and lower risktolerance and finally Intrusion response will senda alert to other nodes.Figure. 2. Example scenario.Intrusion response. With the output fromrisk assessment and decision-making module,the corresponding response actions, includingrouting table recovery and node isola- tion, arecarried out to mitigate attack damages in adistributed manner.4.2 Response to RoutingAttacksIn our approach, we use two differentresponses to deal with different attackmethods: routing table recovery and nodeisolation. Routing table recovery includeslocal routing table recovery and globalrouting recovery. Local routing recovery isperformed by victim nodes that detect theattack and automatically recover its ownrouting table. Global routing recovery involveswith sending recovered routing messages by
  6. 6. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 11victim nodes and updating their routing tablebased on corrected routing information in realtime by other nodes in MANETRouting table recovery is an indispensableresponse and should serve as the first responsemethod after successful detection of attacks.In AODV routing table recovery does not bringany additional overhead since it periodicallygoes with routing control messages. Also, aslong as the detection of attack is positive, thisresponse causes no negative impacts onexisting routing operations.For example, in Fig. 2, Node 1 behaves like amalicious node. However, if every other nodesimply isolate Node 1, Node 6 will bedisconnected from the network. Therefore, moreflexible and fine-grained node isolationmechanism are required. In our risk-awareresponse mechanism, we adopt two types of time-wise isolation responses: temporary isolation andpermanent isolation4.3 Risk AssessmentEvidence 1: Alert confidence. Theconfidence of attack detection by the IDS isprovided to address the possibility of the attackoccurrence.Evidence 2: Missing entry. This evidenceindicates the proportion of missing entries inrouting table. Link with- holding attack ornode isolation countermeasure can causepossible deletion of entries from routingtable of the node.Evidence 3: Changing entry I. This evidencerepresents the proportion of changing entries inthe case of next hop being the malicious node. Inthis case, the malicious node builds a directlink to this node possible for this.Evidence 4: Changing entry II. This evidenceshows the proportion of changed entries in thecase of different next hop (not the maliciousnode) and the same distance. We believe theimpacts on the node communication shouldbe very minimal in this caseEvidence 5: Changing entry III. Thisevidence points out the proportion of changingentries in the case of different next hop(notthe malicious node and the different distance.The probability assignments of evidences 2to 5 1-d means the maximul value of the beliefthat means the status of the MANET is secure.m(1nsecure) j c, c is confidence given by 1DSm(Secure) j l — c (lO)(Secure, 1nsecure) j O4.3.1 Combination of EvidencesFor simplicity, we call the combinedevidence for an attack, EA and the combinedevidence for a countermeasure, EC Thus, BelA(1nsecure) and BelC (1nsecure) represent risks ofattack (RiskA ) and countermeasure (RiskC ),respectively. The combined evidences, EA andEC are defined The entire risk value derivedfrom RiskA and RiskC is given asEA jE1 E2 E3 E4 E5 ,EC j E2 E4 E5 ,where is Dempster’s rule of combination withimportant factors defined in Theorem 1Risk j RiskA — RiskC j BelA (1nsecure)— BelC(1nsecure).After attack. Specific nodes wereset as attackers which conducted maliciousactivities for their own profits. However, anydetection or response is not available in thisstage. This simulation process can present thetraffic patterns under the circumstance withmalicious activities4.4 Adaptive Decision
  7. 7. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 12MakingOur adaptive decision-making module isbased on quanti- tative risk estimation and risktolerance, which is shown in Fig. 3. Theresponse level is additionally divided intomultiple bands. Each band is associated with anisolation degree, which presents a differenttime period of the isolation action.We recommend the value of lower risktolerance threshold be 0 initially if no additionalinformation is available. It implies when the riskof attack is greater than the risk of isolationresponse, the isolation is needed. If other informa-tion is available, it could be used to adjustthresholds. For example, node reputation is oneof important factors in MANET security, ouradaptive decision-making module could take thisfactor into account as well. That is, if thecompromised node has a high or lowreputation level, the response module canintuitively adjust the risk tolerance thresholdsaccordingly. In the case that LT is less than 0,even if the risk of attack is not greater thanthe risk of isolation, the response could alsoperform an isolation task to the malicious nodes.The risk tolerance thresholds could alsobe dynamicallyadjusted by another factors, suchas attack frequency. If the attack frequency ishigh, more severe response action should betaken to counter this attack. Our risk-awareresponse module could achieve this objectiveby reducing the values of risk tolerancethresholdFig 3 Decision making5. Case Study And EvaluationIn this section, we first explain themethodology of our experiments and themetrics considered to evaluate the effectivenessof our approach. Then, we demonstrate thedetailed process of our solution with a casestudy and also compare our risk-aware approachwith binary isolation. In addition, we evaluateour solution with five random network topologiesconsidering different size of nodes. The resultsshow the effectiveness and scalability of ourapproach.5.1 Methodology and MetricsThe experiments were carried out usingJava with the eclipse tool Eclipse is an IntegratedDevelopment Tool which provides a detailedmodel of the physical and link layer behavior ofa wireless network and allows arbitrarymovement of nodes within the network.In order to evaluate the effectiveness ofour adaptiverisk-aware response solution, wedivided the simulation process into three stagesand compared the network performance interms of several metrics. The following de-scribes the activities associated with each stage:Stage 1—Before attack. Random packetswere generated and transmitted amongnodes without activating any of themas attackers. This simulation canpresent the traffic patterns under the normalcircumstance.Stage 2—After attack. Specific nodeswere set as attackers. whichconducted malicious activities for theirown profits. However, any detection orresponse is not available in this stage.This simulation process can present thetraffic patterns under the circumstance withmalicious activities.
  8. 8. International Journal of Computer Applications Technology anVolume 2www.ijcat.comwStage 3—After response. Responsedecisions for each node were made andcarried out based on three differentmechanisms. We computed six metrics foreach simulation run:. Packet delivery radio. The ratiobetween the number of packe tsoriginated by the application layerCBR sources and the number ofpackets received by the CBR sink atthe final destination.. Routing cost. The ratio between thetotal bytes of routing packetstransmitted during the simulation andthe total bytes of packets received bythe CBR sink at the final destination.. Packet overhead. The number oftransmitted routing packets; forexample, a HELLO or TC messagesent over four hops would be countedas four packets in this metric.. Byte overhead. The number oftransmitted bytes by routing packets,counting each hop similar toPacket Overhead.- Average path length. This is theaverage length of the paths discoveredby AODV. It was calculated byaveraging the number of hopstaken by each data packet to reachthe destination- Mean latency. The average timeelapsed from “when a data packet isfirst sent” to “when it is firstreceived at its destination.”International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 201313After response. Responsedecisions for each node were made andcarried out based on three differentmechanisms. We computed six metrics forPacket delivery radio. The ratiobetween the number of packe tse application layerCBR sources and the number ofpackets received by the CBR sink atRouting cost. The ratio between thetotal bytes of routing packetstransmitted during the simulation andf packets received bythe CBR sink at the final destination.Packet overhead. The number oftransmitted routing packets; forexample, a HELLO or TC messagesent over four hops would be countedhe number oftransmitted bytes by routing packets,counting each hop similar toAverage path length. This is theaverage length of the paths discoveredbyhopsreachMean latency. The average timeelapsed from “when a data packet isfirst sent” to “when it is firstFig 4 a Packet delivery ratioc. Byte OverheadIn Fig. 4a, as the number of nodesincreases, the packet delivery ratio also increasesbecause there are more route choices for thepacket transmission. Among these threeresponse mechanisms, we also notice thepackets delivery ratio of our DRCIF risk-awareresponse is higher than those of the other twoapproaches.In Fig. 4b, we can observe that the routingcost of our DRCIF risk-aware response is lowerthan those of the other two approaches. Notethat the fluctuations of routing cost shown inFig. 4b are caused by the random trafficgeneration and random placement of nodes inour realistic simulation
  9. 9. International Journal of Computer Applications Technology anVolume 2www.ijcat.comb. Routing costd. Packet deliveryFig. 4c show the packet and byteoverhead, respectively. Since the routing attacksdo not change the network topology further inthe given case, the packet overhead and byteoverhead remain almost the same . In next Stage, however, they are higher when our DRCIF riskaware response mechanism is applied. This resultmeet our expectation, because the number ofnodes which isolate malicious node usingbinary isolation and DRC risk-aware response aregreater than those of our DRCIF risk-awareresponse mechanism.In Fig. 4d, due to routing attacks, thepacket delivery ratio decreases in Stage 2. Afterperforming binary isolation and DRC risk-awareresponse in Stage 3, the packet delivery ratioeven decreases more. But in DRCIF mechanismInternational Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 201314c show the packet and byteoverhead, respectively. Since the routing attacksdo not change the network topology further inthe given case, the packet overhead and byteStagethey are higher when our DRCIF risk-aware response mechanism is applied. This resultmeet our expectation, because the number ofnodes which isolate malicious node usingaware response areaware, due to routing attacks, thepacket delivery ratio decreases in Stage 2. Afterawareresponse in Stage 3, the packet delivery ratioBut in DRCIF mechanismthe delivery is more.7 CONCLUSIONWe have proposed a risk-aware responsesolution for mitigating MANET routing attacks.Especially, our approach considered the potentialdamages of attacks and counter- measures. Inorder to measure the risk of both attacks andcountermeasures, we extended Dempster-Shafertheory of evidence with a notion of importancefactors. Based on several metrics, we alsoinvestigated the performance and practi- cality ofour approach and the experiment results clearlydemonstrated the effectiveness and scalability ofour risk- aware approach. Based on thepromising results obtained through theseexperiments, we would further seek moresystematic way to accommodate node reputationand attack frequency in our adaptive decisionmodel.8 REFERENCES[1] Cheng.P, Rohatgi.P, Keser.C, Karger.P,Wagner.G, and Reninger.A, 2007, “Fuzzy Multi-Level Security: An Experiment on QuantifiedRisk-Adaptive Access Control,” Proc. 28th IEEESymp. Security and Privacy.[2] Deng.H, Li.W, and Agrawal.D, 2002,“Routing Security in Wireless Ad HocNetworks,” IEEE Comm. Magazine, vol. 40, no.10, pp. 70-75, Oct..[3] Mu.C, Li.X, Huang.H, and Tian.S, , 2008.“Online Risk Assessment of Intrusion ScenariosUsing D-S Evidence Theory,” Proc. 13thEuropeanSymp. Research in Computer Security (ESORICS’08),pp. 35-48[4] Perkins.C, Belding-Royer.E, and Das.S, 2003,“Ad Hoc On-Demand Distance Vector Routing,”Mobile Ad-Hoc Network Working Group, vol.3561.[5] Refaei.M, DaSilva.L, Eltoweissy.M, andNadeem.T, 2010 “Adaptation of ReputationManagement Systems to Dynamic NetworkConditions in Ad Hoc Networks,” IEEE Trans.Computers, vol. 59, no. 5, pp. 707-719.
  10. 10. International Journal of Computer Applications Technology and ResearchVolume 2– Issue 1, 6- 15, 2013www.ijcat.com 15[6] Sentz.K and Ferson.S, , 1984 “Combination ofEvidence in Dempster-Shafer Theory,” technicalreport, Sandia Nat’l Laboratories, 2002.[9] L.Zadeh, “Review of a Mathematical Theory ofEvidence,” AIMagazine, vol. 5, no. 3, p. 81.[7] Agrawal, Sanjeev Jain, Sanjeev Sharma,January 2011, “A Survey of Routing Attacks andSecurity Measures in Mobile Ad-Hoc Networks”,Journal of Computing, Volume 3, Issue 1, 41-48.[8] Sun.L, Srivastava.R, and Mock.T, , 2006 “AnInformation Systems Security Risk AssessmentModel under the Dempster-Shafer Theory ofBelief Functions,” Management InformationSystems, vol. 22, no. 4, pp. 109-142.[9] Sun.Y, Yu.W, Han.Z, and Liu.K, , 2002“Information Theoretic Framework of TrustModeling and Evaluation for Ad [8] K. Sentz andS. Ferson, “Combination of Evidence in Dempster-Shafer Theory,” technical report, Sandia Nat’lLaboratories.[10] L. Zadeh, 1984 “Review of aMathematical Theory of Evidence,” AIMagazine, vol. 5, no. 3, p. 81.[11] R. Yager, , 1987, “On the Dempster-Shafer Framework and New CombinationRules* 1,” Information Sciences, vol. 41, no. 2,pp. 93-137.[12] H. Wu, M. Siegel, R. Stiefelhagen, and J.Yang, , 2002, “Sensor Fusion Using Dempster-Shafer Theory,” Proc. IEEE Instrumentationand Measurement Technology Conf., vol. 1.

×