Monitor Dependent Intrusion Detection Technique for Mobile Ad Hoc Networks

We present an intrusion detection mechanism that uses collaborative efforts of the nodes in a neighborhood to detect aberrant behavior in a mobile ad hoc network. A node showing this kind of behavior is termed as a malicious node. The technique is designed for detection of malicious nodes in a neighborhood in which each pair of nodes are within radio range of each other. Such a neighborhood of nodes is known as a clique. This technique uses message passing between the nodes. A node called the monitor node initiates the detection process. The monitor node sends data packets to two other nodes, called target nodes, through the node which has to be tested for malicious behavior. The monitor node then requests each of these two nodes to return back the data packets that have been sent to them by the node under consideration. The monitor node compares this data with the one it had sent out. Based on this, the monitor determines which of the nodes are secure and which of them are suspicious. Finally, the monitor node, with the help of secure nodes, separates malicious nodes from the suspicious nodes. The technique detects k number of malicious nodes in a set of 2k+2 nodes.