TOGBAD - an approach to detect routing attacks in tactical environments

Topology graph based anomaly detection (TOGBAD) is a centralized approach to detect routing attacks in tactical multi-hop networks. It uses anomaly detection based on topology graphs to identify attackers trying to launch routing attacks. Such attacks are a serious threat to multi-hop networks since they may be used to disrupt, eavesdrop or manipulate the network. In this work, we present studies on the impact of an attacker launching a routing attack. Furthermore, we show a reasonable choice of attack parameters for the attacker. In our main contribution, we introduce TOGBAD and an evaluation of TOGBAD concerning its detection rate with and without packet loss. Finally, we illustrate TOGBAD's detection rate with an attacker trying to inure TOGBAD's anomaly detection to his attack. Copyright © 2010 John Wiley & Sons, Ltd.