TREND: Trust estimation system for wireless networks via multi-pronged detection

We describe a system developed for the DARPA Wireless Network Defense (WND) program for detecting attacks against the control plane at the link and network layers in a mobile ad hoc network. The goal of our system is for each node to independently assess the trustworthiness of other nodes in its neighborhood, and to disseminate these assessments to other nodes. We have developed a cross-layer invariant-based technique for detecting control plane attacks that exploits the readily observable nature of the wireless medium. Nodes listen to the transmissions of other nodes in their neighborhood and compare their observed behavior with expected behavior. Opinions formed by nodes are shared with other nodes and are combined at each node to form a consolidated opinion about other nodes in the network. We tested our approach in a realistic environment using a high fidelity ns-2 simulation of a 50-node scenario provided by ARL and running 802.11 and OLSR that included multiple subnets, realistic tactical traffic, wireless channels and ranges, propagation models, and variations of mobility. We injected a wide range of attacks and a varied number of attackers, with attacks that included a randomized and variable number of false advertisements for the above protocols as well as malicious forwarding behaviors with varying drop rates, with and without colluding attackers. Our results show that we exceeded all of the WND metrics, namely: (i) We achieved a detection rate of greater than 95% for all attacks; (ii) Probability of false alarms <;0.0005%; (iii) Additional network overhead due to reliability estimation <;1% of network capacity.