Visualization assisted detection of sybil attacks in wireless networks

ABSTRACT

In wireless networks,the authenticity and uniqueness of node identities are essential to the fundamental operations such as routing, resource allocation, and intrusion detection. In this paper, we investigate Sybil attack, an attack in which a malicious node illegitimately acquires multiple identities and performs as these nodes simultaneously. We propose an effective approach to monitoring and detecting such attacks by integrating network security and visualization methods. The security component explores the time-varying network topology and its statistical and geometry information to detect the existence of Sybil attacks. The visualization component incorporates the detection results and provides an effective mechanism to illustrate abnormal topology patterns and locate fake identities. These two components are integrated into a practical system that takes advantage of both interactive visualization and intelligent security methods. Experimental studies are conducted to investigate the impacts of the network parameters such as node connectivity on the detection capability of the proposed mechanism.

REFERENCES

• 1: Proceedings of IEC Workshop on Internet Simulations with the NS simulator 2000.
• 2: Kulsoom Abdullah , Chris Lee , Gregory Conti , John A. Copeland , John Stasko, IDS RainStorm: Visualizing IDS Alarms, Proceedings of the IEEE Workshops on Visualization for Computer Security, p.1, October 26-26, 2005 [doi>10.1109/VIZSEC.2005.8]
• 3: F. Anjum, D. Subhadrabandhu, and S. Sarkar. Signature based Intrusion Detection for Wireless Ad-Hoc Networks: A Comparative study of various routing protocols. In Proc. of VTC 2003.
• 4: Robert Ball , Glenn A. Fink , Chris North, Home-centric visualization of network traffic for security administration, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 29-29, 2004, Washington DC, USA [doi>10.1145/1029208.1029217]
• 5: Rida A. Bazzi , Goran Konjevod, On the establishment of distinct identities in overlay networks, Proceedings of the twenty-fourth annual ACM symposium on Principles of distributed computing, July 17-20, 2005, Las Vegas, NV, USA [doi>10.1145/1073814.1073873]
• 6: Vijay Bhuse , Ajay Gupta, Anomaly intrusion detection in wireless sensor networks, Journal of High Speed Networks, v.15 n.1, p.33-51, January 2006
• 7: J.-Y. Le Boudec and M. Vojnovic. Perfect Simulation and Stationarity of a Class of Mobility Models. In Proc. of IEEE Infocom 2005.
• 8: Miguel Castro , Peter Druschel , Ayalvadi Ganesh , Antony Rowstron , Dan S. Wallach, Secure routing for structured peer-to-peer overlay networks, Proceedings of the 5th symposium on Operating systems design and implementation

  Due to copyright restrictions we are not able to make the PDFs for this conference available for downloading

  , December 09-11, 2002, Boston, Massachusetts [doi>10.1145/1060289.1060317]
• 9: Haowen Chan , Adrian Perrig , Dawn Song, Random Key Predistribution Schemes for Sensor Networks, Proceedings of the 2003 IEEE Symposium on Security and Privacy, p.197, May 11-14, 2003
• 10: Alice Cheng , Eric Friedman, Sybilproof reputation mechanisms, Proceeding of the 2005 ACM SIGCOMM workshop on Economics of peer-to-peer systems, August 22-22, 2005, Philadelphia, Pennsylvania, USA [doi>10.1145/1080192.1080202]
• 11: John R. Douceur, The Sybil Attack, Revised Papers from the First International Workshop on Peer-to-Peer Systems, p.251-260, March 07-08, 2002
• 12: Wenliang Du , Jing Deng , Yunghsiang S. Han , Pramod K. Varshney, A pairwise key pre-distribution scheme for wireless sensor networks, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948118]
• 13: Laurent Eschenauer , Virgil D. Gligor, A key-management scheme for distributed sensor networks, Proceedings of the 9th ACM conference on Computer and communications security, November 18-22, 2002, Washington, DC, USA [doi>10.1145/586110.586117]
• 14: W. Fan , M. Miller , S. Stolfo , W. Lee , P. Chan, Using artificial anomalies to detect unknown and known network intrusions, Knowledge and Information Systems, v.6 n.5, p.507-527, September 2004
• 15: Glenn A. Fink , Paul Muessig , Chris North, Visual Correlation of Host Processes and Network Traffic, Proceedings of the IEEE Workshops on Visualization for Computer Security, p.2, October 26-26, 2005 [doi>10.1109/VIZSEC.2005.18]
• 16: Yun Fu , Jeffrey Chase , Brent Chun , Stephen Schwab , Amin Vahdat, SHARP: an architecture for secure resource peering, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 17: Michael Gerharz , Christian de Waal , Matthias Frank , Peter Martini, Link Stability in Mobile Wireless Ad Hoc Networks, Proceedings of the 27th Annual IEEE Conference on Local Computer Networks, p.30-42, November 06-08, 2002
• 18: Philippe Golle , Dan Greene , Jessica Staddon, Detecting and correcting malicious data in VANETs, Proceedings of the 1st ACM international workshop on Vehicular ad hoc networks, October 01-01, 2004, Philadelphia, PA, USA [doi>10.1145/1023875.1023881]
• 19: John R. Goodall , Wayne G. Lutters , Penny Rheingans , Anita Komlodi, Preserving the Big Picture: Visual Network Traffic Analysis with TN, Proceedings of the IEEE Workshops on Visualization for Computer Security, p.6, October 26-26, 2005 [doi>10.1109/VIZSEC.2005.17]
• 20: J. Hall, M. Barbeau, and E. Kranakis. Using mobility profiles for anomaly based intrusion detection in mobile networks. In Proc. of Wireless and Mobile Security Workshop 2005.
• 21: Wei-jen Hsu , Kashyap Merchant , Haw-wei Shu , Chih-hsin Hsu , Ahmed Helmy, Weighted waypoint mobility model and its impact on ad hoc networks, ACM SIGMOBILE Mobile Computing and Communications Review, v.9 n.1, January 2005 [doi>10.1145/1055959.1055968]
• 22: Anita Komlodi , Penny Rheingans , Utkarsha Ayachit , John R. Goodall , Amit Joshi, A User-centered Look at Glyph-based Security Visualization, Proceedings of the IEEE Workshops on Visualization for Computer Security, p.3, October 26-26, 2005 [doi>10.1109/VIZSEC.2005.1]
• 23: Kiran Lakkaraju , William Yurcik , Adam J. Lee, NVisionIP: netflow visualizations of system state for security situational awareness, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 29-29, 2004, Washington DC, USA [doi>10.1145/1029208.1029219]
• 24: Loukas Lazos , Radha Poovendran, SeRLoc: Robust localization for wireless sensor networks, ACM Transactions on Sensor Networks (TOSN), v.1 n.1, p.73-100, August 2005 [doi>10.1145/1077391.1077395]
• 25: Donggang Liu , Peng Ning , Rongfang Li, Establishing pairwise keys in distributed sensor networks, ACM Transactions on Information and System Security (TISSEC), v.8 n.1, p.41-77, February 2005 [doi>10.1145/1053283.1053287]
• 26: Y. Livnat, J. Agutter, S. Moon, R. Erbacher, and S. Foresti. A Visualization Paradigm for Network Intrusion Detection. In Proceedings of the IEEE Information Asssurance Workshop pages 92--99, 2005.
• 27: B. S. Manoj , R. Ananthapadmanabha , C. Siva Ram Murthy, Multi-hop cellular networks: architecture and protocols for best-effort and real-time communication, Journal of Parallel and Distributed Computing, v.65 n.6, p.767-791, June 2005 [doi>10.1016/j.jpdc.2004.04.006]
• 28: Jonathan McPherson , Kwan-Liu Ma , Paul Krystosk , Tony Bartoletti , Marvin Christensen, PortVis: a tool for port-based detection of security events, Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 29-29, 2004, Washington DC, USA [doi>10.1145/1029208.1029220]
• 29: Chris Muelder , Kwan-Liu Ma , Tony Bartoletti, A Visualization Methodology for Characterization of Network Scans, Proceedings of the IEEE Workshops on Visualization for Computer Security, p.4, October 26-26, 2005 [doi>10.1109/VIZSEC.2005.2]
• 30: James Newsome , Elaine Shi , Dawn Song , Adrian Perrig, The sybil attack in sensor networks: analysis & defenses, Proceedings of the third international symposium on Information processing in sensor networks, April 26-27, 2004, Berkeley, California, USA [doi>10.1145/984622.984660]
• 31: D. Rafiei and S. Curial. Effectively Visualizing Large Networks Through Sampling. In Proc. of IEEE Visualization 2005.
• 32: Pin Ren , Yan Gao , Zhichun Li , Yan Chen , Benjamin Watson, IDGraphs: Intrusion Detection and Analysis Using Histographs, Proceedings of the IEEE Workshops on Visualization for Computer Security, p.5, October 26-26, 2005 [doi>10.1109/VIZSEC.2005.7]
• 33: Nitesh Saxena , Gene Tsudik , Jeong Hyun Yi, Admission control in Peer-to-Peer: design and performance evaluation, Proceedings of the 1st ACM workshop on Security of ad hoc and sensor networks, October 31, 2003, Fairfax, Virginia [doi>10.1145/986858.986873]
• 34: S. Vasudevan, B. DeCleene, N. Immerman, J. Kurose, and D. Towsley. Secure Leader Election Algorithms for Wireless Ad Hoc Networks. In Proc. of IEEE DARPA Information Survivability Conference and Exposition (DISCEX)2003.
• 35: W. Yurcik. VisFlowConnect-IP: A Link-Based Visualization of NetFlows for Security Monitoring. In 18th Annual FIRST Conference on Computer Security Incident Handling 2006.
• 36: Yongguang Zhang , Wenke Lee, Intrusion detection in wireless ad-hoc networks, Proceedings of the 6th annual international conference on Mobile computing and networking, p.275-283, August 06-11, 2000, Boston, Massachusetts, United States [doi>10.1145/345910.345958]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)

General Terms:
Algorithms, Security

Keywords:
interactive detection, sybil attacks, topology visualization, visualization on network security, wireless networks