Creating Offline MANET IDS Network Traces

A number of Intrusion Detection System (IDS) techniques for Mobile Ad Hoc Networks (MANETs) have been proposed in the research literature. These techniques include trust building and cluster-based voting schemes, statistical anomaly detection, host-based watchdogs, and finite state machines for specifying correct routing behavior. Comparing and evaluating the effectiveness of these IDS techniques has been hindered by the limited number of large-scale MANET deployments, the lack of publicly available network traces of actual MANET traffic, and the difficulty in defining typical application and mobility scenarios. Network simulation tools have allowed researchers to study MANET IDSs without purchasing mobile nodes or conducting costly and time-consuming field trial tests. These simulations, however, have been conducted using widely varying assumptions on background network traffic, mobility, previous security associations, and the type of malicious network activity. This paper describes how we use our mLab testbed to create publicly available MANET network traces. These network traces allow researchers to compare the effectiveness of different MANET IDS techniques on the same data set, and conduct offline experiments with new IDS techniques without requiring expensive hardware.