Mitigating Routing Misbehavior in Mobile Ad Hoc Networks”, Sergio Marti,T.J. Giuli, Kevin Lai, and Mary Baker,MobiCom 2000 Introduces two techniques that improve throughput in an ad hoc network in the presence of “misbehaving” nodes.

1. 1
Mitigating Routing
Misbehavior in Mobile
Ad Hoc Networks
Sergio Marti, T.J. Giuli, Kevin Lai and Mary Baker
Department of Computer Science, Stanford University
IEEE Communications Magazine October 2002
報告者 : 楊曜年
指導教授 : 劉如生 博
士

2. OverviewOverview
 “Mitigating Routing Misbehavior in Mobile Ad
Hoc Networks”, Sergio Marti,T.J. Giuli, Kevin
Lai, and Mary Baker,MobiCom 2000
 Introduces two techniques that improve
throughput in an ad hoc network in the presence
of “misbehaving” nodes.

3. OutlineOutline
 Introduction
 Assumptions
 Dynamic Source Routing (DSR)
-Watchdog
-Pathrater
 Methodology
 Movement and Communication Patterns
 Misbehaving Nodes
 Metrics
 Simulation Results
 Related Work
 Future Work and Conclusion

4. IntroductionIntroduction
 There will be a tremendous growth over the next
decade in the use of wireless communication.
 Advantage:Advantage: ability to transmit data among users
in a common area while remaining mobile.
 Disadvantage:Disadvantage: the distance between participants
is limited by a range of transmitters or their
proximity to wireless access points
 Solution:Solution: Ad hoc wireless networks mitigate this
problem by allowing out of range nodes to route
data through intermediate nodes.

5.  Ad hoc networks are ideal in situations where
installing an infrastructure is not possible
because the infrastructure is too expensive or
too vulnerable, the network is too transient or the
infrastructure was destroyed.
e.g. battlefields, military applications , emergency and disaster situation
IntroductionIntroduction

6.  Node may misbehave by agreeing to forward
packets and then failing to do so, because it is:
 Overloaded nodeOverloaded node – lacks the CPU cycles, buffer
space or available network bandwidth to forward
packets.
 Selfish nodeSelfish node – unwilling to spend battery life, CPU
cycles, or available network bandwidth to forward
packets not of direct interest to it.
 Malicious nodeMalicious node – launches a denial of service attack
by dropping packets.
 Broken nodesBroken nodes – might have a software fault that
prevents it from forwarding packets.
IntroductionIntroduction

7.  To mitigate the effects of routing misbehavior, it
is introduced two extensions to the Dynamic
Source Routing algorithm (DSR)
 Watchdog:Watchdog: identifies misbehaving nodes.
 Pathrater:Pathrater: avoids routing packets through these
nodes.
 The two techniques increase throughput by 17%
in the presence of up to 40% misbehaving
nodes.
 During extreme mobility, they can increase
network throughput by 27%.
IntroductionIntroduction

8.  Bidirectional communication symmetry on every
link between nodes.
 Watchdog mechanism relies on bidirectional links.Watchdog mechanism relies on bidirectional links.
 Wireless interface that support promiscuous
mode operation.
 Promiscuous mode means that if a node A is
within a range of a node B, it can overhear
communications to and from B even if those
communications do not directly involve A.
 Useful for improving routing protocol performance.Useful for improving routing protocol performance.
AssumptionsAssumptions

9.  DSR is an on-demand, source routing protocol.
 Route paths are discovers at the time a source send aRoute paths are discovers at the time a source send a
packet to a destination for which the source has nopacket to a destination for which the source has no
path.path.
 DSR is divided into two main functions:
 Route discoveryRoute discovery
 Route maintenanceRoute maintenance
Dynamic Source RoutingDynamic Source Routing
(DSR)(DSR)

10.  Route Discovery:Route Discovery:
Figure 1 – Example of a route request
a. Node S sends out a ROUTE REQUEST packet to find a path to node D

11. b. The ROUTE REQUEST is forwarded throughout the network, each
node adding its address to the packet
 Route Discovery:Route Discovery:
Figure 1 – Example of a route request

12. c. D sends back a ROUTE REPLY to S using the path contained in one
of the ROUTE REQUEST packet that reached it
 Route Discovery:Route Discovery:
Figure 1 – Example of a route request

13.  Route Maintenance:Route Maintenance:
 Handles link breaks – link breaks occurs when two
nodes on a path are no longer in transmission range.
 If an intermediate node detects a link break when
forwarding a packet to the next node in the route path,
 It sends back a message to the source notifying it of that
link break.
 The source must try another path or do a route discovery
if it does not have another path.

14. WatchdogWatchdog
 Identifies misbehaving nodes
 Maintains a buffer of transmitted packets
 Monitors next hop node’s transmission
 Increments a failure tally for the nodes
AS DCB

15. WatchdogWatchdog
 passive acknowledgement
A CB

16. WatchdogWatchdog
 Packet Radio Network Schemes ---passive
acknowledgement
B C
E F
J
G
E tries to transmit
to B but fails
F and J hear
transmission
and will forward
F sends first
J removes packet
from its queue
Route from
E to C

17.  Advantage:Advantage: it can detect misbehavior at the
forwarding level and not just the link level.
 Weakness:Weakness: it might not detect a misbehaving
node in the presence of:
 Ambiguous collision
 Receiver collision
 Limited transmission power
 False misbehavior
 Collusion
 Partial dropping
WatchdogWatchdog

18. WatchdogWatchdog
 Ambiguous collision:Ambiguous collision:
Figure 3 – Illustrate a packet collusion can occur at A while it is listening for B to
forward on a packet.
 Receiver collision:Receiver collision:
Figure 4 – Illustrate node A can only tell whether B sends the packet to C,
but it cannot tell if C receives it.

19. WatchdogWatchdog
 Limited transmission:Limited transmission:
A node could limit its transmission power such that the signal is strong
enough to be overheard by the previous node but too weak to be
received by the true recipient.
 False Misbehavior:False Misbehavior:
A malicious node could attempt to partition the network by claiming that
some node following it in the path are misbehaving.
 Collusion:Collusion:
Multiple nodes in collusion can amount a more sophisticated attack.
 Partial dropping:Partial dropping:
A node can circumvent the watchdog b dropping packets at a lower rate
than the watchdog’s configured minimum misbehavior threshold

20. WatchdogWatchdog
 For the watchdog to work properly, it must know
where a packet should be in two hops.
 The watchdog has this information because DSR
is a source routing protocol.
 If the watchdog does not have this information,
then a malicious or broken node could broadcast
the packet to a non-existent node and the
watchdog would have no way of knowing.
 Because of this limitation, watchdog work best on
top of a source routing protocol.

21. PathraterPathrater
Dynamic Source Routing Extensions
 The pathrater, run by each node in the network,
combines knowledge of misbehaving nodes with
link reliability data to pick the route most likely to
be reliable.
 It calculates a path metric by averaging the node
ratings in the path. We choose this metric
because it gives a comparison of the overall
reliability of different paths

22. PathraterPathrater
Dynamic Source Routing Extensions
 Avoids routing packets through malicious nodes
 Each node maintains a rating for every other node
 A node is assigned as a “neutral” rating of 0.5
 The rating of nodes on all actively used path
increase by 0.01 at periodic intervals of 200 ms
 The rating of nodes decrease 0.05 when a link
break is detected
 High negative numbers are assigned to nodes
suspected of misbehaving nodes by Watchdog

23. PathraterPathrater
Dynamic Source Routing Extensions
 Based on Pathrater on Source
A2
S D
C2B2
A1 C1B1Pathrater
built in
1. Route Discovery
0.5 ---initial
0.01+0.5---200ms
0.01+0.5.01---200ms
0.01+0.5.02---200ms
0.5 ---initial
0.01+0.5---200ms
0.01+0.501---200ms
0.01+0.502---200ms
0.5 ---initial
0.01+0.5---200ms
0.01+0.501---200ms
-0.01+0.502---200ms
0.5 ---initial
-100 by waychdog---200ms
0.5 ---initial
0.01+0.5---200ms
-0.01+0.501---200ms
-0.01+0.500---200ms
S->A1->B1->C1->D
S->A2->B2->C2->D
S->A2->B1->C1->D
Route Cache
0.5 ---initial
0.01+0.5---200ms
0.01+0.501---200ms
0.01+0.502---200ms

24. PathraterPathrater
Dynamic Source Routing Extensions
 Based on Pathrater on Source
A2
S D
C2B2
A1 C1B1S->A1->B1->C1->D
Highest reliable way
2. Data transmission

25. PathraterPathrater
Dynamic Source Routing Extensions
 It calculates a path metric by averaging the node
rating in the path
 If there are multiple paths, the node chooses the
path with the highest metric
 It increases the throughput
 It gives a comparison of the overall reliability of
different paths
 It increases the ratio of overhead transmissions to
data transmission

26. MethodologyMethodology
OverviewOverview
 Assumptions
– Bidirectional communication
– Wireless interfaces that support promiscuous mode
operation
 Setup
– 50 nodes in various states of mobility
– Created 4 different extension scenarios (WD, PR,
SRR)
– Varied misbehaving nodes 0% to 40%

27. MethodologyMethodology
SimulatorSimulator
 Version of Berkeley’s Network Simulator.
 Includes wireless extensions made by the CMU
Monarch project.
 Visualization tool from CMU called ad-hockey.
 To view the results of the simulations and detect overall
trends in the network.
 Simulations take place in a 670x670 meter flat
space filled with a scattering of 50 wireless nodes.

28. MethodologyMethodology
Misbehaving Nodes
 Of the 50 nodes in the simulated network, some
variable percentage of the nodes misbehave.
 In this simulation a misbehaving node is one that
agrees to participate in forwarding packets but then
indiscriminately drops all data packets that are routed
through it.
 The percentage of misbehaving nodes in this
network vary from 0% to 40% in 5% increments.

29. MethodologyMethodology
Metrics
 The following three metrics are used:
 Throughput:Throughput: % of sent data packets actually received in
the intended destinations.
 OverheadOverhead: ratio routing-related transmissions to data
transmissions in a simulation.
 Effects of watchdogEffects of watchdog false positivefalse positive on networkon network
throughputthroughput: The impact when watchdog mistakes a
node as misbehaving

30. Simulation ResultsSimulation Results
 The focus is on three metrics evaluation
 Network throughputNetwork throughput
 Routing overheadRouting overhead
 Effects of false positives on throughputEffects of false positives on throughput
 The utility of various combinations of the
extensions are tested:
 Watchdog (WD)Watchdog (WD)
 Pathrater (PR)Pathrater (PR)
 Send (extra) route request (SRR)Send (extra) route request (SRR)
SRR extension in used to find new paths when all
known paths include a suspected misbehaving node.

31. Network ThroughputNetwork Throughput
 Network ThroughputNetwork Throughput
 Everything enabled
 Watchdog and pathrater enabled
 Only pathrater enabled
 Everything disabled
Figure 5 shows the total network throughput,
calculated as the fraction of data packets generated
that are received, versus the fraction of misbehaving
nodes in the network for the combinations of
extensions.

32.  Network ThroughputNetwork Throughput
Figure 5 (a) 0 second pause time

33.  Network ThroughputNetwork Throughput
Figure 5 (b) 60 second pause time

34.  Network ThroughputNetwork Throughput
As expected, the simulations with all three extensions
active perform the best by a considerable margin as
misbehaving nodes are added to the network.

35. OverheadOverhead
 Routing OverheadRouting Overhead
 Everything on
 Pathrater and watchdog on
 Only watchdog on
 Everything off
Figure 6 shows the amount of overhead incurred
(causes) by activating the different routing
extensions. It shows routing overhead as a ratio of
routing packet transmissions to data packet
transmissions. This ratio is plotted against the
fraction of misbehaving nodes.

36.  Routing OverheadRouting Overhead
Figure 6 (a) 0 second pause time

37.  Routing OverheadRouting Overhead
Figure 6 (b) 60 second pause time

38.  Routing OverheadRouting Overhead

39. Effects on False DetectionEffects on False Detection
 Effects on False DetectionEffects on False Detection
 Compare simulations of the regular watchdog with a
watchdog that does not report false positives
Figure 7 shows the network throughput lost by the
watchdog incorrectly reporting well-behaved nodes.
These results show that throughput is not
appreciably affected by false positives and that they
may even have beneficial side effects.

40.  Effects on False DetectionEffects on False Detection
Figure 7 (a) 0 second pause time

41.  Effects on False DetectionEffects on False Detection
Figure 7 (b) 60 second pause time

42.  Effects on False DetectionEffects on False Detection
Table 3 shows the average value of false positives
reported by the simulation ran for each pause time
and misbehaving node percentage.
More false positives are reported in the 0 seconds
pause time simulations as compared to the 60
seconds pause time simulations.

43.  No significant related work before publication date in
2000.
 DSR, AODV, TORA, DSDV, STAR only detect if the
receiver’s network interface is accepting packets.
 Some recent related work:
– T. GoffNael, B. Abu-Ghazaleh, D. S. Phatak, and R. Kahvecioglu,
"Preemptive Routing in Ad-Hoc Networks," presented at Seventh annual
international conference on Mobile computing and networking, 2001.
– Y.-C. Hu, A. Perrig, and D. B. Johnson, "Adrianne: A Secure On-Demand
Routing Protocol," presented at Eight Annual International Conference on
Mobile Computing and Networking, Atlanta, GA,2002.
– B. Awerbuch, D. Holmer, C. Nita-Rotaru, and H. Rubens, "An On-Demand
Secure Routing Protocol Resilient to Byzantine Failures,"presented at
ACM Workshop on Wireless Security, Atlanta, GA,2002.
Related WorkRelated Work

44.  To conduct a more rigorous tests of the watchdog
and pathrater parameters to determine optimal
values to increase throughput in different situations.
 Rating increment and decrement amounts
 Rate incrementing interval
 Delay between sending out route requests to decrease
the overhead caused by this feature
 Next goal is to analyze how the routing extensions
perform with TCP flows common to most network
applications.
 Evaluate the watchdog and pathrater considering
latency in addition to throughput.
Future WorkFuture Work

45.  Ad hoc networks are vulnerable to nodes that
misbehave when routing packets
 Simulation evaluates that the 2 techniques
– increases throughput by 17% in network with
moderate mobility, while increase ratio of overhead
to data transmission from 9% to 17%
– increases throughput by 27% in network with
extreme mobility, while increase ratio of overhead
to data transmission from 12% to 24%
ConclusionConclusion