A distributed cross-layer intrusion detection system for ad hoc networks

Most existing intrusion detection systems (IDSS) for ad hoc networks are proposed for single layer detection. Although they may apply to other layers of network protocol stack, individual layers of data is still being analyzed separately. In addition, most have not been able to emphasize localization of attack source. In this paper, we propose an anomaly-based IDS that utilizes cross-layer features to detect attacks, and localizes attack sources within one-hop perimeter Specifically, we suggest a compact feature set that incorporate intelligence front both MAC layer and network layer to profile normal behaviors of mobile nodes; we adapt a data mining anomaly detection technique from wired networks to ad hoc networks; and we develop a novel collaborative detection scheme that enables the IDs to correlate local and global alerts. We validate our work through ns-2 simulation experiments. Experimental results demonstrate the effectiveness of our method.