Internati
o
nal
Journal of Ele
c
trical
and Computer
Engineering
(IJE
CE)
V
o
l.
6, N
o
. 4
,
A
ugu
st
2016
, pp
. 17
79
~
1
784
I
S
SN
: 208
8-8
7
0
8
,
D
O
I
:
10.115
91
/ij
ece.v6
i
4.1
000
8
1
779
Jo
urn
a
l
h
o
me
pa
ge
: h
ttp
://iaesjo
u
r
na
l.com/
o
n
lin
e/ind
e
x.ph
p
/
IJECE
A Generic Review on Effective Intrusion Detection in
Ad hoc Networks
G
.
Go
p
i
cha
nd,
RA
. K
.
Sa
rav
a
n
a
g
u
ru
School of Com
p
uting Sci
e
nce
an
d Engin
eering
,
Vellore
Institu
te
of Technolog
y
Universit
y
, Vel
l
o
re,
India
Article Info
A
B
STRAC
T
Article histo
r
y:
Received
Ja
n 28, 2016
Rev
i
sed
Ju
l 12
,
20
16
Accepte
d
J
u
l 25, 2016
Ad hoc network
is specifically
designe
d for the establishm
ent of a network
an
y
w
here and an
y
time, which d
o
es not
have an
y
fixed infrastructure in order
to suppo
rt the mobilit
y
of the users in
the network
.
The network is
established
without u
s
ing
an
y
access points or
base
st
ations for
comm
unication
im
plem
ented in m
u
lti hop sche
m
e
s. Hence we call an Ad hoc
network as a
collection of nodes which are mobile
in nature with a d
y
namic network
infras
t
ructure and forms
a tem
porary
netw
ork. Becaus
e
of d
y
nam
i
c
topological chan
ges, these networks are
vulnerable at the ph
y
s
ical link, and
the
y
can eas
il
y
be m
a
nipulated. An intruder can eas
i
l
y
atta
ck the Ad hoc
network by
loading the netwo
r
k resour
ces
which are availa
ble, s
u
ch as
wireless links a
nd energy
(batt
e
r
y
) leve
ls of other users, and
then starts
disturbing all the users. This pa
per provides a
comparative sur
v
ey
on the
various existing
intrusion detection sy
st
ems f
o
r
Ad hoc networ
ks
based on the
various appr
oaches applied in
the in
trusion
detection sy
stems f
o
r providin
g
security
to
the A
d
hoc network.
Keyword:
A
d
ho
c
n
e
twork
Mu
lti h
o
p
sch
e
mes
Intr
u
d
er
Int
r
usi
o
n
det
e
c
t
i
on sy
st
em
Copyright ©
201
6 Institut
e
o
f
Ad
vanced
Engin
eer
ing and S
c
i
e
nce.
All rights re
se
rve
d
.
Co
rresp
ond
i
ng
Autho
r
:
G.
Go
picha
n
d,
D
e
p
t
of S
o
ftwa
re Sy
stem
s, SCOPE,
VIT Un
iv
ersity, Vello
re (Tam
i
l
Nad
u
)
,
Indi
a.
Em
ail
:
gopi
chand.
g@
vi
t
.
ac.i
n
1.
INTRODUCTION
Int
r
usi
on
det
ect
i
on m
echani
s
m
i
s
one of t
h
e
m
o
st
im
p
o
rt
a
n
t
researc
h
area whi
c
h h
a
s vari
o
u
s
pot
e
n
t
i
a
l
appl
i
cat
i
ons f
o
r t
h
e cur
r
ent
gene
rat
i
on.
Int
r
usi
on
det
ect
i
on i
s
a t
ool
w
h
i
c
h fi
g
h
t
s
agai
nst
t
h
e c
y
ber-
at
t
acks of t
h
e
real
wo
rl
d
w
h
i
c
h t
h
reat
e
n
s c
r
i
t
i
cal
sy
st
em
s. M
a
l
i
c
i
ous be
havi
or
det
ect
i
on i
s
t
h
e
p
r
i
m
ary
ob
ject
i
v
e
of t
h
e Int
r
usi
on
det
ect
i
on sy
st
em
in a dy
nam
i
c n
e
t
w
o
r
k
[1]
,
wh
i
c
h det
ect
s t
h
e
dam
a
ges cause
d i
n
th
e n
e
t
w
ork b
y
v
i
o
l
ating
au
t
h
en
ticity, av
ailab
ility, co
n
f
i
d
en
tiality, in
teg
r
ity, n
o
n
-
rep
u
d
i
atio
n
o
r
p
r
i
v
acy; a
s
an
ex
am
p
l
e, a n
o
d
e
in
a
mo
b
ile telep
hony n
e
tw
or
k
m
a
sq
uer
a
d
e
s as an
o
t
h
e
r
n
o
d
e
so
as to
d
e
f
e
at th
e
in
teg
r
ity of t
h
e b
illin
g fun
c
tio
n
.
Selfish
beh
a
v
i
o
r
is a
n
on-co
mm
u
n
ity
m
i
n
d
e
d actio
n
;
wh
ich can
b
e
explaine
d
with an exam
ple, whe
r
e a node in a
W
i
re
l
e
ss Ad hoc Net
w
o
r
k does n
o
t
fo
rwa
r
d pac
k
et
s.
The
term
adversa
r
y
is used to refer to an
un
desira
ble
n
o
d
e
th
at sp
ecifically ex
h
i
b
its
malicio
u
s
o
r
sel
f
ish
beha
vi
o
r
.
Thi
s
di
f
f
ere
n
t
i
a
t
i
on i
s
m
a
de
as
it is critical to
con
s
id
er t
h
e
attack
m
o
d
e
l wh
ile ev
alu
a
ti
n
g
a
d
e
fen
s
iv
e m
ech
an
ism
.
An
In
tru
s
ion
Detectio
n
Syst
em
p
e
rform
s
two
m
a
in
fun
c
tion
s
: Co
llectin
g d
a
ta
rega
rdi
ng s
u
s
p
ect
s and anal
y
z
i
ng t
h
e dat
a
. In t
h
i
s
pa
pe
r
we had
gi
ve
n
a det
a
i
l
e
d descri
pt
i
o
n o
f
t
h
ese
fu
nct
i
o
ns
per
f
o
rm
ed by
i
n
t
r
usi
o
n
det
ect
i
o
n sy
st
em
s
and given a c
o
mparative
an
aly
s
is of the
procedure
im
pl
em
ent
e
d b
y
t
h
e i
n
t
r
usi
o
n
det
ect
i
o
n
sy
st
em
s i
n
perf
orm
i
ng
t
h
ose
fu
nct
i
ons
.
An i
n
t
r
usi
on
d
e
t
ect
i
on sy
st
em
i
s
capabl
e
of i
d
e
n
t
i
f
y
i
n
g
t
h
e ad
versa
r
i
e
s
t
hose ha
ve cr
osse
d t
h
e
bo
r
d
er
o
f
t
h
e
net
w
or
k.
A
si
m
p
l
e
appr
oach
t
o
fi
n
d
i
n
t
r
u
d
e
rs i
s
t
o
vi
ew
t
h
e n
o
d
es
w
h
i
c
h
hav
e
a
nom
al
ous
net
w
or
k t
r
af
fi
c p
r
o
f
i
l
e
s.
In
t
h
i
s
su
r
v
ey
pa
pe
r
we
di
scus
s a
b
o
u
t
i
n
t
r
usi
o
n
det
ect
i
on.
S
p
eci
fi
cal
l
y
, we cl
ass
i
fy
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
I
J
ECE
Vo
l. 6
,
N
o
. 4
,
Au
gu
st 2
016
:
17
79
–
1
784
1
780
the efectivenes
s of existing IDS techni
qu
es o
f
th
e Ad
h
o
c n
e
tw
or
ks b
a
sed
on
th
e v
a
r
i
ou
s f
actor
s show
n
in
the Figure
1.
Fi
gu
re
1.
Fact
o
r
s
on
w
h
i
c
h
t
h
e
effectiveness
of IDS is
base
d
2.
BACKG
R
OU
ND
Here
, we
fi
rst
descri
be a
b
o
u
t
t
h
e va
ri
o
u
s e
x
i
s
t
i
ng i
n
st
r
u
si
o
n
det
ect
i
on t
e
c
hni
que
ap
pl
i
e
d
fo
r
Ad
h
o
c
net
w
or
k,
w
h
i
c
h a
r
e
nam
e
d as an
om
al
y
based i
n
t
r
u
s
i
o
n
det
ect
i
o
n
t
e
c
hni
que
, si
gnat
u
re
base
d i
n
t
r
usi
o
n
det
ect
i
on t
e
c
h
ni
q
u
e, s
p
eci
fi
c
a
t
i
on ba
sed i
n
t
r
usi
o
n
de
t
ect
i
on t
e
c
hni
que
and
re
put
at
i
o
n
based t
e
c
h
ni
que
s.
Fi
gu
res
2 a
nd
3 s
h
o
w
s t
h
e
d
e
t
ect
i
on t
ech
ni
que
di
m
e
nsi
o
n
and
gi
ves a c
o
m
p
ari
s
on
o
n
t
h
e va
ri
o
u
s
det
ect
i
o
n
techniques
.
Figure 2.
D
i
mensions
of intr
usion
detectio
n s
y
s
t
e
m
s
2.1.
Anomaly based intrusion
detection technique
An
om
al
y
based i
n
t
r
u
s
i
o
n d
e
t
ect
i
on t
ech
n
i
que
p
o
ssess c
e
rt
ai
n r
u
nt
im
e feat
u
r
es t
h
at
are di
ffe
re
n
t
fr
om
t
h
at
of t
h
e or
di
nary
,
wh
i
c
h can be
defi
ned i
n
2 way
s
,
The fi
rst
way
i
s
wi
t
h
respect
t
o
t
h
e hi
st
ory
of t
h
e
test sig
n
a
l
(
u
n
s
up
er
v
i
sed
)
an
d th
e second w
a
y is
w
ith r
e
sp
ect to a co
llectio
n of tr
ain
i
ng
d
a
ta (
s
em
i-
su
perv
ised). C
l
u
s
tering
is a m
a
in
ex
am
p
l
e o
f
un
su
pervised m
achine
learning
[2]
.
The
sem
i
-supe
rvise
d
ap
pro
ach, trai
n with
a set
o
f
t
r
u
t
h
d
a
ta an
d the
u
n
s
upe
rvi
s
e
d
ap
pr
oac
h
, t
r
ai
n
wi
t
h
l
i
v
e
dat
a
[
3
]
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
A Ge
neri
c Revi
ew
o
n
Ef
f
ect
i
ve I
n
t
r
usi
o
n
Det
e
ct
i
on i
n
A
d
hoc
N
e
t
w
orks (
G
.
Go
pi
ch
a
nd)
1
781
Fi
gu
re
3.
C
o
m
p
ari
s
on
o
f
t
h
e
vari
ous
i
n
t
r
usi
o
n
det
ect
i
o
n t
e
chni
que
s
The p
r
i
m
ary
adva
nt
age
of a
n
om
aly
based i
n
t
r
usi
o
n
det
ect
i
on t
e
c
hni
ques i
s
t
h
at
t
h
ey
doe
sn’t
l
o
o
k
f
o
r
som
e
thing spe
c
ific, and he
nc
e it eliminates the necess
ity o
f
fu
lly
sp
eci
fyin
g
all
known attack
vectors and
k
eep
t
h
is attack
d
i
ction
a
ry
up
d
a
ted
.
Th
e m
a
in
d
i
sad
v
a
n
t
ag
e of th
is techn
i
qu
e is its suscep
tib
ility to
false
p
o
s
itiv
es. Ch
an
do
la et al.
[4
]
h
a
s
p
r
ov
id
ed
a b
r
ief su
rv
ey
o
f
ano
m
aly b
a
sed
in
t
r
u
s
i
o
n detectio
n
techn
i
q
u
e
th
at
is g
e
n
e
ral to all app
licatio
n
s
.
2.2.
Specification
based intrus
ion detection
techniqu
e
Speci
fi
cat
i
o
n base
d i
n
t
r
usi
o
n det
ect
i
on e
x
hi
bi
t
s
an ab
no
rm
al perfo
rm
ance at
t
h
e sy
stem
l
e
vel
;
i
n
cont
rast
wi
t
h
anom
al
y
based i
n
t
r
usi
o
n
de
t
ect
i
on
whi
c
h
anal
y
zes s
p
e
c
i
f
i
c
use
r
pr
o
f
i
l
e
s o
r
dat
a
f
l
ows.
Speci
fi
cat
i
o
n
base
d i
n
t
r
usi
o
n
det
ect
i
on t
e
c
hni
que
s n
o
r
m
a
l
l
y
exhi
bi
t
s
l
e
gi
t
i
m
a
t
e
behav
i
or a
n
d i
n
di
cat
es an
i
n
t
r
usi
on
whe
n
t
h
e sy
st
em
depart
s f
r
om
t
h
i
s
m
odel
.
The Fi
rst
key
advant
a
g
e of s
p
eci
fi
cat
i
on base
d i
n
t
r
u
s
i
o
n
detection tec
h
nique is l
o
w
fals
e ne
gative rate. Based
on
t
h
e
defi
nition, t
h
es
e techni
ques
only react to
known
b
a
d
b
e
h
a
v
i
o
r
; th
eoretical b
a
sis is a b
a
d
nod
e wh
ich
will d
i
srup
t th
e fo
rm
al
syste
m
sp
ecificatio
n
.
Th
e seco
nd
k
e
y ad
v
a
n
t
ag
e o
f
th
is techn
i
qu
e is th
e system is h
i
g
h
l
y effectiv
e as th
ere is n
o
tr
ain
i
n
g
/
p
r
o
f
iling
ph
ase. Th
e
pri
m
ary
di
sadvant
a
g
e o
f
t
h
e
speci
fi
cat
i
on
base
d i
n
t
r
usi
o
n det
ect
i
o
n t
echni
que i
s
t
h
e
hi
g
h
ef
fo
rt
w
h
i
c
h i
s
req
u
ire
d
fo
r th
e ge
neratio
n a
fo
rm
al specification.
Speci
fi
cat
i
o
n b
a
sed i
n
t
r
usi
o
n det
ect
i
on t
ech
n
i
ques are hi
ghl
y
effect
i
v
e ove
r i
n
si
der at
t
ack
s as t
h
ey
conce
n
t
r
at
e o
n
sy
st
em
di
srup
t
i
on. O
n
t
h
e o
t
her ha
nd
, t
h
i
s
i
s
sai
d
t
o
be
not
t
h
e best
a
p
p
r
oach f
o
r
ou
t
s
i
d
e
attackers beca
use the s
p
ecifi
cations,
for e
x
a
m
ple, st
ate machine or gra
m
m
a
r is application-s
p
ecifi
c and
resp
o
nds
onl
y
t
o
t
h
e act
i
ons t
h
at
are t
a
ken
b
y
an i
n
si
der.
An
ou
tsid
er m
a
y
n
o
t
b
e
ab
le to
g
e
n
e
rate tran
si
tio
n
s
in
th
e
go
v
e
rn
ing
state m
ach
in
e or tran
sform
s
in
th
e d
e
fin
i
n
g
grammar.
2.3.
Signature b
a
sed intrusion
detection technique
Si
gnat
u
re
base
d i
n
t
r
usi
o
n det
ect
i
on ap
pr
oac
h
es p
o
sses
s
ce
rt
ai
n r
u
n
-
t
i
m
e
feat
ures
w
h
i
c
h m
a
t
c
h a
speci
fi
c
pat
t
e
r
n
of
m
i
sbehavi
o
r
.
F
r
om
som
e
sou
r
ces
t
h
i
s
t
e
c
hni
que
i
s
re
fe
rr
ed t
o
as
pat
t
e
r
n
base
d
det
ect
i
o
n
[5]
or
i
n
t
r
ude
r
pr
o
f
i
l
i
ng,
m
i
suse det
ect
i
o
n
[
5
]
-
[
8
]
,
s
upe
r
v
i
s
ed
det
ect
i
o
n
[
9
]
.
Th
e m
a
in
ad
v
a
n
t
ag
e
o
f
th
is
tech
n
i
qu
e is a lo
w false
p
o
sitiv
e rate. Based
on
th
e
d
e
fi
n
itio
n
,
t
h
ese
techniques
will only react to known
ba
d behavi
or; th
e t
h
eoretical basis shows
t
h
at a good node m
a
y not
exhi
bi
t
t
h
e at
t
a
ck si
gnat
u
re
. T
h
e
pri
m
ary
di
sadva
nt
age
of
t
h
is is that th
e t
ech
n
i
q
u
e
s m
u
st id
en
tify a sp
ecific
pat
t
e
rn;
a
di
ct
i
ona
ry
s
h
oul
d s
p
eci
fy
eac
h att
ack
vector a
nd rem
a
in curre
n
t. Th
e attack sig
n
a
ture m
a
y b
e
a
uni
vari
at
e dat
a
seque
nce (e
g:
by
t
e
s t
r
ans
m
i
t
t
e
d on a
net
w
or
k, a p
r
o-
gram
’s sy
st
em
call
hi
st
ory
or
ap
p
lication
-
sp
ecific in
form
at
i
o
n
fl
o
w
s. Th
e
main
h
ectic tas
k
is th
e co
m
b
i
n
atio
n
o
f
sim
p
l
e
d
a
ta seq
u
e
n
c
es in
to
a m
u
lt
iv
ariate d
a
ta seq
u
e
n
ce
[3
].
2.4.
Reputation man
a
gement
intr
usion detection technique
The m
a
i
n
obje
c
t
i
v
e of a re
p
u
t
a
t
i
on m
a
nag
e
r i
s
t
o
det
ect
no
des w
h
i
c
h
exhi
bi
t
s
sel
f
i
s
h be
ha
vi
o
r
rat
h
er t
h
an
vi
o
l
at
i
ng secu
ri
t
y
.
W
h
e
n
e
v
er
, m
a
l
i
c
i
ous be
ha
vi
or i
s
i
d
e
n
t
i
f
i
e
d
,
t
h
e re
put
at
i
o
n m
a
nagers s
h
oul
d
al
so g
u
ar
d a
g
ai
nst
col
l
u
di
n
g
no
des. B
e
l
l
a
et
al
. [10]
has
i
d
ent
i
f
i
e
d t
h
a
t
t
h
e
m
a
i
n
pr
obl
em
i
n
M
ANET
(M
o
b
i
l
e
Ad hoc Net
w
or
k)
reput
at
i
o
n m
a
nagem
e
nt
is di
st
ri
b
u
t
i
o
n
of re
put
at
i
o
n sco
r
es. R
e
put
at
i
o
n
m
a
nagem
e
nt
techni
que
s are
m
a
i
n
l
y
appl
i
cabl
e
t
o
l
a
r
g
e n
e
two
r
k
s
in
wh
ich
estab
lish
i
ng
a priori tru
s
t
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
I
J
ECE
Vo
l. 6
,
N
o
. 4
,
Au
gu
st 2
016
:
17
79
–
1
784
1
782
rel
a
t
i
ons
hi
ps
i
s
hi
g
h
l
y
i
n
feas
i
b
l
e
(e
g:
packe
t
s fo
r
w
ar
ded
o
v
er
pac
k
et
s
so
urce
d,
pac
k
et
s
sent
o
v
er
pac
k
et
s
receive
d
a
nd packets
forwa
r
ded ove
r no
n-l
o
cal
packets rec
e
ived .
Reputati
on m
a
nagem
e
nt is hi
ghly rel
e
vant
to
ad ho
c
n
e
two
r
k
app
licatio
ns.
3.
PROBLEM DESCRIPTION
Here
, we spec
i
f
y
t
h
e effect
i
v
ene
ss of i
n
t
r
usi
o
n det
ect
i
o
n t
echni
que
s whe
n
ap
pl
y
i
n
g
t
o
A
d
h
o
c
net
w
or
ks.
The
effect
i
v
e
n
ess o
f
i
n
t
r
usi
o
n det
e
ct
i
on
t
ech
ni
q
u
e
s
can be
s
p
eci
fi
ed base
d on m
a
i
n
l
y
t
h
ree
fe
at
ures
t
h
ey
are nam
e
d as Dat
a
C
o
l
l
ect
i
on ap
pr
oac
h
, Tr
ust
m
ode
l
,
and
Dat
a
An
al
y
s
i
s
Techni
q
u
e.
A bri
e
f des
c
ri
pt
i
o
n
of these
features is gi
ven as
follows :
3.1.
Data Collection Appr
oac
h
As
d
i
scu
s
sed earlier in
section
1
,
co
llectin
g d
a
ta
rega
rdi
n
g s
u
s
p
ects is t
h
e fi
rst m
a
in functio
n
o
f
a
n
i
n
t
r
usi
o
n
det
e
c
t
i
on sy
st
em
. There a
r
e m
a
i
n
ly
t
w
o t
y
pes
of
dat
a
col
l
ect
i
o
n ap
p
r
oac
h
es
whi
c
h are
use
d
bef
o
r
e
dat
a
anal
y
s
i
s
,
t
h
ey
are
nam
e
d
as,
beha
vi
o
r
ba
sed c
o
l
l
ect
i
on
and
t
r
af
fi
c
bas
e
d c
o
l
l
ect
i
on.
3.1.
1.
Be
hav
i
or base
d
co
l
l
ect
ion
IDSs wh
ich
use b
e
h
a
v
i
or b
a
sed
d
a
ta co
llectio
n
will an
alyze th
e lo
g
s
main
tain
ed
b
y
a n
o
d
e
, to
d
e
term
in
e wh
eth
e
r it is co
mp
ro
m
i
sed
.
Th
e first m
a
in
adv
a
n
t
ag
e
o
f
u
s
i
n
g th
is app
r
o
a
ch
is scalab
ility; in
larg
e scale ap
plicatio
n
s
(for eg
: m
o
b
ile tele
p
hon
y and
WSN) it h
a
s its effectiv
en
ess in
a v
e
ry
h
i
gh
lev
e
l.
The ne
xt m
a
in adva
ntage of
using this approac
h
is d
ecent
r
alization; this is eff
ective for infrastructure-less
ap
p
lication
s
lik
e ad
h
o
c
n
e
tworks. Th
e p
r
i
m
ary d
i
sad
v
a
nt
ag
e o
f
th
is app
r
o
a
ch
is th
e ad
d
ition
a
l wo
rk th
at
each node has
to perform
to
co
llect, or a
n
alyze, their data.
3.1.
2.
Traffic base
d collection
IDSs wh
ich
u
s
e traffic b
a
sed co
llectio
n
will an
alyze th
e
n
e
two
r
k
activ
ity to
d
e
ter
m
in
e wh
eth
e
r a
no
de i
s
com
p
r
o
m
i
sed. The p
r
im
ary
advant
a
g
e re
gar
d
i
n
g re
sou
r
ce m
a
nage
m
e
nt
i
s
t
h
at
t
h
e i
ndi
vi
dual
no
des are
free t
o
an
alyze or m
a
in
tain
th
eir l
o
g
s
.
Th
e m
a
in
d
i
sad
v
a
n
t
ag
e reg
a
rd
i
n
g d
a
ta collectio
n
is th
at th
e
effectiv
en
ess
of th
is tech
n
i
q
u
e is li
m
ited
b
y
th
e v
i
si
b
ility o
f
th
e
no
des co
llectin
g
th
e
d
a
t
a
. Hen
ce
In
term
s o
f
effectiv
en
ess t
h
is app
r
o
a
ch
is said
to
b
e
m
o
re eff
ective
whe
n
c
o
m
p
ared with th
e
be
h
a
vi
o
r
base
d co
l
l
ect
i
on
approach.
3.2.
Trust Model
The t
r
ust
[
1
1]
m
odel
det
e
r
m
ines t
h
e dat
a
w
h
i
c
h a m
oni
t
o
r no
de can use
t
o
audi
t
t
h
e t
r
u
s
t
ee node
s.
Trust m
o
d
e
ls are m
a
in
ly class
i
fied
in
t
o
two
basic typ
e
s,
n
a
med
as, m
u
ltitru
s
t an
d un
itru
s
t.
3.2.
1.
Multitrust model
Mu
ltitru
s
t
m
o
d
e
l i
m
p
l
e
m
en
t
s
th
e co
n
c
ep
t
o
f
u
s
ing
d
a
ta
fro
m
th
ird
p
a
rties o
r
witn
esses. Liu
and
Issar
n
y
[
12]
h
a
s refer
r
e
d
t
h
i
s
t
y
pe of i
n
fo
r
m
at
i
on as a recom
m
e
ndat
i
o
n
.
In C
ont
ra
st
t
o
rec
o
m
m
e
nda
t
i
ons,
Sh
in
et al. [13
]
referred
it as d
i
rect m
o
n
ito
rin
g
. If m
u
ltitru
s
t is u
s
ed
alo
ng with
b
e
h
a
v
i
or b
a
sed
co
llectio
n
th
e
k
e
y weakn
e
ss
o
b
s
erv
e
d is: the op
portun
ity fo
r cap
ab
le ad
ve
rsaries t
o
cover th
ei
r track
s
. Mu
ltitru
s
t is
m
o
stl
y
pre
f
er
red
i
n
t
h
e d
o
m
a
i
n
of
re
put
at
i
o
n m
a
nagem
e
nt
whi
c
h
i
s
hi
g
h
l
y
ap
pl
i
cabl
e
i
n
ad
h
o
c
net
w
o
r
ks
.
3.2.
2.
Unitrust model
Un
itru
s
t m
o
d
e
l is referred
to
as a stan
d
a
lon
e
. In
con
t
rast to
m
u
l
titru
s
t
m
o
d
e
l, th
e u
n
itrust m
o
d
e
l wil
l
n
o
t
u
s
e repo
rt
ed
in
form
at
io
n; a u
n
itrust mo
d
e
l is purel
y b
a
sed
on
d
i
rect
m
o
n
ito
ring
.
Data reliab
ility is th
e
pri
m
ary
adva
n
t
age o
f
a
uni
t
r
ust
m
odel
;
th
e I
D
S need
no
t r
e
qu
ir
e t
o
ap
ply saf
e
gu
ard
s
t
o
to
ler
a
te
or
pr
ev
ent
bi
ased
rep
o
rt
s
fr
om
adversari
e
s. The m
a
i
n
di
sadva
nt
age
of
a uni
t
r
ust
m
o
del
i
s
t
h
e sm
all
e
r dat
a
set
.
H
e
nce i
n
term
s o
f
effectiv
en
ess, m
u
ltitru
s
t m
o
d
e
l is
h
i
g
h
l
y effectiv
e th
an un
itru
s
t mo
d
e
l.
3.3.
Data Anal
ysis
Technique
As di
sc
usse
d
earl
i
e
r i
n
sect
i
on
1,
Anal
y
z
i
ng t
h
e dat
a
i
s
t
h
e seco
nd m
a
i
n
fu
nct
i
o
n o
f
an i
n
t
r
usi
o
n
det
ect
i
o
n
sy
st
em
. There are
m
a
i
n
l
y
t
w
o
way
s
t
o
a
n
al
y
ze dat
a
, nam
e
d as,
pa
t
t
e
rn m
a
t
c
hi
ng
and
dat
a
m
i
ni
n
g
.
3.3.
1.
Pattern
matching Analysis
Pat
t
e
rn m
a
t
c
hing t
e
c
hni
que i
s
use
d
t
o
si
m
p
l
y
scan an i
n
p
u
t
so
urce
. Si
g
n
at
u
r
e base
d a
p
p
r
oaches
[3]
,
[8]
,
[1
3]
-[
2
0
]
scans
f
o
r t
h
e entrie
s i
n
t
h
e
at
t
ack di
ct
i
o
n
a
ry
. Sem
i
-supe
rvi
s
e
d
a
nom
aly
based
ap
pr
o
aches
scans
for the
deviations
from
expected
perform
ance.
R
e
p
u
t
at
i
on ba
sed a
p
p
r
oaches
[
18]
,[
21]
,
[
2
2
]
scan
s t
h
e
p
r
o
f
ile
d
a
ta in
o
r
d
e
r to
m
easure so
m
e
criteria wh
ich
was estab
lish
e
d prior
to
d
e
p
l
o
y
m
e
n
t
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
A Ge
neri
c Revi
ew
o
n
Ef
f
ect
i
ve I
n
t
r
usi
o
n
Det
e
ct
i
on i
n
A
d
hoc
N
e
t
w
orks (
G
.
Go
pi
ch
a
nd)
1
783
3.3.
2.
Da
ta
minin
g
An
alysis
The e
x
am
ples of
data m
i
ning analysis techniqu
e ar
e t
h
e
uns
u
p
er
vi
se
d
vari
a
n
t
s
o
f
a
n
om
aly
based
Int
r
usi
o
n
det
e
ct
i
on sy
st
em
s [
10]
,
[
2
3
]
-
[
2
5]
. I
n
som
e
cases like m
achine learni
ng
, neu
r
al n
e
twor
ks
and
B
a
y
e
si
an cl
assi
fi
ers t
h
e
com
b
i
n
at
i
o
n
of
b
o
t
h
pat
t
e
r
n
m
a
t
c
hi
ng
an
d
d
a
t
a
m
i
ni
ng a
n
al
y
s
i
s
t
echni
q
u
es i
s
p
e
rform
e
d
.
Hence in
term
s o
f
effectiv
en
ess
pattern
m
a
tch
i
ng a
n
alysis technique is sai
d
t
o
be m
o
re effe
ctive
whe
n
c
o
m
p
are
d
wi
t
h
t
h
e
dat
a
m
i
ni
ng a
n
al
y
s
i
s
t
echni
que
.
4.
R
E
SU
LTS AN
D ANA
LY
SIS
In t
h
i
s
sect
i
o
n,
i
t
i
s
expl
ai
ned wi
t
h
a t
a
bl
e
(Tabl
e
1),
w
h
i
c
h sh
ow
s t
h
e
cl
assi
fi
cat
i
on
of
vari
ous
i
n
t
r
usi
o
n
det
e
c
t
i
on sy
st
em
s of A
d
h
o
c
net
w
or
ks
base
d
on
t
h
e i
n
t
r
usi
o
n
d
e
t
ect
i
on t
ech
ni
que
ap
pl
i
e
d,
d
a
t
a
col
l
ect
i
on a
p
pr
oach
, t
r
ust
m
ode
l and a
n
alysis techniques.
Tabl
e
1. T
h
e
cl
assi
fi
cat
i
on
o
f
vari
ous
i
n
t
r
usi
o
n
det
ect
i
o
n sy
st
em
s of
A
d
ho
c net
w
o
r
ks
IDS tec
hnique
Type of De
tection
techniqu
e applied
Type of data
Collection
approach used
Trust
Model
applied
Analysis
techniqu
e used
CONF
IDANT
[26]
Reputation
Traffic
m
u
lti
trust
Pattern
m
a
tching
CORE [22]
Reputation
Traffic
m
u
lti
trust
Pattern
m
a
tching
Z
h
ang and
L
ee
Technique [8
]
Ano
m
aly
Traf
fic
m
u
lti
trust
Data mining
S
p
e
c
i
fi
c
a
t
i
on
Ba
se
d M
oni
t
o
ri
ng
o
f
AODV
[21]
Specification
Traffic
m
u
lti
trust
Pattern
m
a
tching
Sar
a
fijanovic
´
T
e
chnique [
19]
Ano
m
aly
Traf
fic
m
u
lti
trust
Data mining
Vigna
Technique
[13
]
Signature
Traffic
m
u
lti
trust
Bella Technique
[10]
Reputation
Behavior
m
u
lti
trust
Pattern
m
a
tching
Fr
o
m
th
e above tab
l
e it is ev
i
d
en
t t
h
at m
a
x
i
m
u
m
n
u
m
b
er
o
f
ID
S techn
i
qu
es ar
e im
p
l
e
m
en
tin
g
th
e
traffic
b
a
sed
data co
llectio
n
tech
n
i
q
u
e
, wh
ich
is said
to
be
m
o
re effective
whe
n
c
o
m
p
ared with t
h
e be
havior
base
d
dat
a
col
l
ect
i
on t
e
c
hni
qu
e.
5.
CON
C
LUSIO
N
In t
h
i
s
pa
pe
r,
we p
e
r
f
o
r
m
e
d a ge
neral
c
o
m
p
arat
i
v
e
su
rve
y
on t
h
e v
a
ri
o
u
s
exi
s
t
i
n
g i
n
t
r
u
s
i
on
det
ect
i
o
n
sy
st
em
s for A
d
hoc
net
w
or
ks
base
d o
n
t
h
e v
a
ri
o
u
s ap
pr
oac
h
es ap
pl
i
e
d i
n
t
h
e I
D
S f
o
r
pr
o
v
i
d
i
n
g sec
u
ri
t
y
t
o
t
h
e
Ad
h
o
c
net
w
o
r
k
.
T
h
e a
p
p
r
o
aches i
n
cl
u
d
e
t
h
e va
ri
o
u
s
de
t
ect
i
on t
ech
ni
q
u
es a
ppl
i
e
d a
n
d t
h
e
t
y
pe
of
dat
a
co
llectio
n
app
r
o
ach
u
s
ed
and th
e tru
s
t m
o
d
e
l ap
p
lied
to
th
e syste
m
an
d th
e typ
e
o
f
d
a
ta an
alysis tec
h
n
i
q
u
e
im
pl
em
ent
e
d i
n
t
h
e i
n
t
r
u
s
i
o
n
det
ect
i
on sy
st
em
whi
c
h
per
f
o
rm
s
m
a
l
i
c
i
o
u
s
be
havi
or
det
ect
i
on i
n
t
h
e
Ad
h
o
c
net
w
or
ks. A
s
per t
h
e a
n
al
y
s
i
s
per
f
o
r
m
e
d i
t
i
s
sho
w
n
t
h
at
m
a
xim
u
m
num
ber
of i
n
t
r
usi
o
n det
ect
i
o
n t
echni
que
s
are i
m
pl
em
ent
i
ng t
h
e t
r
af
fi
c b
a
sed ap
p
r
oac
h
fo
r dat
a
c
o
l
l
ect
i
on a
nd
he
nce i
t
i
s
pro
v
ed t
o
be m
o
re effec
t
i
v
e
whe
n
c
o
m
p
are
d
wi
t
h
t
h
e
be
ha
vi
o
r
based
ap
p
r
oac
h
i
n
t
h
e
de
t
ect
i
on o
f
m
a
l
i
ci
ous
n
o
d
es i
n
a M
A
N
ET.
REFERE
NC
ES
[1]
J. Kumar, “802.11 DCF in Dy
n
a
mic MANET On-demand Routing,”
International Journal of Informatics and
Communication Technology
(
I
J-ICT)
,
vol/issue: 2
(
2), pp
. 85-92
, 2
013.
[2]
Y
.
Zhang
and
W. Lee,
“
I
ntrusion
dete
ctio
n in
w
i
reless ad-ho
c
netw
orks,”
in
Th
e 6
t
h
Ann
u
a
l
In
terna
tional
Co
n
f
ere
n
ce
on
Mob
ile
Co
mpu
t
in
g a
nd Networkin
g
,
Boston, MA
, USA
,
pp.
275–28
3,
2000.
[3]
V. Chandola,
et al.
, “
A
nomaly
detection for
discrete
s
e
qu
ence
s
:
a
s
u
rve
y
,
”
I
EEE T
r
ans.
Knowl. Data Eng.
,
vol/issue: 2
4
(
5
)
,
pp.
823–839
, (2012)
.
[4]
V
.
Chandola,
et a
l
.
, “
A
nomaly detect
ion:
a survey,”
ACM
C
o
m
p
ut
.
Su
rv
.
,
v
o
l
/
i
s
s
u
e
:
41(15), p
p
.
1–58,
2009.
[5]
D
.
F
a
rid
and
M.
Rahman, “
L
earning i
n
trusion
detec
tion
b
a
sed
on ada
p
ti
ve bay
e
sian
al
gorithm,” in
11
th
Int
e
r
n
at
i
o
n
a
l
C
onf
e
r
e
n
c
e
on
C
o
m
p
ut
e
r
a
n
d
I
n
f
o
rm
at
i
o
n
Te
c
h
nol
o
g
y
, K
hulna,
Bangladesh, pp. 652–6
56,
2008.
[6]
F.
L
i
,
et al.
, “
B
ehaviour profiling on mobile
devices,” in
International Co
nference
on Emerging
Security
Technologies
,
C
a
nterbur
y
,
UK,
pp. 77–82,
2010.
[7]
S. Sh
in
,
et a
l
.
, “A
n experimental stu
dy
of
h
i
erarchical intr
usion
de
tecti
o
n
for w
i
reless
industrial senso
r
netw
orks,”
IEE
E
Tr
an
s.
I
n
d.
I
n
f
.
, v
o
l
/
i
s
s
u
e
:
6
(
4
)
,
p
p
.
744–757,
2010.
[8]
Y
.
Zhang,
et a
l
.
, “
I
ntrusion de
tectio
n
techn
i
q
u
es for
mobile
w
i
reless
netw
orks,”
Wireless Netw.
, vol/issue:
9
(
5
)
, p
p
.
545–5
56,
2003.
[9]
S. Zhong,
et a
l
.
, “
A
clusterin
g
approach to
wireless networ
k
intrusion detection,” in
17th Internationa
l
Conferenc
e
on Tools with Artifi
cial
Inte
llig
ence
,
Hong Kong,
pp
. 196,
2005
.
[10]
G
.
Bella,
et a
l
.
, “
M
anaging
re
putati
on o
v
er
manets,” in
Fou
r
th
In
terna
tion
a
l
Con
f
ere
n
ce on
In
f
o
rma
tion
Assura
n
ce a
nd
S
ecu
rity
,
N
a
pl
es, Italy, pp. 255
–260,
2008.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
I
J
ECE
Vo
l. 6
,
N
o
. 4
,
Au
gu
st 2
016
:
17
79
–
1
784
1
784
[11]
P. K. Krishnappa and B. R
.
P.
Babu, “
I
nvestig
ating Open Issues in Swarm
Intellig
enc
e
for Mi
tigat
ing Secur
i
t
y
threa
t
s in
MANET,
”
In
ternation
a
l Journal
of Electrical and Co
m
puter Eng
i
neerin
g,
vol/issue: 5(5)
, 2015
.
[12]
F
.
H
a
ddadi
and
M. S
a
rra
m,
“
W
ireless intrusion dete
ctio
n system
using a
lightw
e
ig
ht age
n
t,”
in
Se
c
ond
In
terna
tio
na
l
C
o
n
f
ere
n
ce on
C
o
mpu
t
er an
d
N
e
two
rk Techno
l
o
g
y
, Bangkok,
Thailand, p
p
. 84–87,
2010.
[13]
G.
Vi
g
n
a
,
et al.
, “
A
n
intrusi
on dete
ctio
n to
ol for aodv-bas
e
d
ad h
o
c w
i
reless
netw
orks,”
in
20t
h
Annu
al
Co
mpu
t
er S
e
c
u
rity App
lica
tions Con
f
eren
ce
, Tucson,
AZ, U
S
A
,
pp.
16–27,
2004.
[14]
R. Mitchell
an
d
I.
R. Chen, “
A
hierarchical
perform
ance
model for intrusion
detec
tio
n
in
cy
ber-physic
al
systems,” in
Wi
reless Commu
nica
tio
n
and
Net
w
o
r
king Con
f
eren
ce
, Cancun, Mexico, pp. 209
5–210
0,
2011.
[15]
L. Y
i
ng,
et a
l
.
, “
T
he
design and implementatio
n
of host-based
intrusio
n
detecti
on sy
stem,” in
Th
ird
In
terna
tio
na
l
Sympo
s
i
u
m o
n
In
tellig
en
t
In
f
o
rma
t
i
o
n
Tec
h
no
l
o
g
y
and
S
e
c
u
ri
ty
In
forma
tics
, Jinggangsha
n,
China,
pp. 595–
598,
2
010
.
[16]
Y
.
Mao, “
A
semantic-based
in
trusion detect
io
n frame
w
o
rk
fo
r w
i
reless
senso
r
netw
ork,” in
6t
h I
n
t
e
r
nat
i
o
n
a
l
Co
n
f
ere
n
ce
on
Netwo
rked
C
o
mpu
ting
,
G
y
eon
g
ju, S
outh K
o
re
a, pp. 1–5,
2010.
[17]
Z. Xiao
,
et al.
,
“
A
n anomaly
detection
sch
e
me based on machine
l
earnin
g
for
ws
n,”
in
1st Internationa
l
Conference on
I
n
formation Science and
Engineering
, Nanjing
,
C
h
ina, pp
.
3959–
3962,
2009
.
[18]
W. H
a
irui
and
W. H
u
a,
“
R
esearch
and design
of multi-
agent
based
intru
s
ion
detec
tio
n
system on w
i
rele
ss
netw
ork,” in
Intern
a
t
i
o
na
l S
y
mp
osium
on
C
o
mp
u
t
a
tiona
l In
tellig
en
ce
a
n
d
De
sig
n
, Wuhan, China, vol.
1,
p
p
.
444– 447, 2008
.
[19]
S. Sarafijanov
ic
´
and J.
Y.
Boudec, “
A
n artificia
l immune
sy
ste
m
for
misbe
h
a
v
ior
dete
ction
in
m
obile
ad-hoc
networks with
virtual
th
y
m
us,
clustering
, dan
g
er
s
i
gna
l,
and
m
e
m
o
ry
d
e
t
ecto
r
s
,
”
in G.
Nico
s
i
a, e
t
a
l
.
(Eds.)
,
Artifi
cial
Immune Syst
ems,
Lec
t
ure Notes
in C
o
mputer Sci
e
nc
e
, vol.
3239, pp.
342–356,
2004.
[20]
H. Han
,
et a
l
.
, “
U
sing
data
mining t
o
di
scover
signat
u
res
in
netw
ork-based intrusion
detecti
on,”
i
n
In
terna
tio
na
l C
o
n
f
ere
n
ce
o
n
M
a
ch
i
n
e
Le
ar
ni
n
g
a
n
d
C
y
be
rne
t
i
c
s
, Beijing, China, vol. 1, pp. 13
–17,
2002.
[21]
C. Y
.
Tseng,
et a
l
.
, “
A
specification-based i
n
tru
s
ion
detec
t
ion s
y
stem
for
aodv,”
in
1st
W
o
rk
s
h
op
o
n
S
ecu
rity of
Ad hoc
a
n
d
Se
ns
or
N
e
t
w
o
rk
s
,
F
a
irfax, V
A
, USA
,
pp. 125–1
34,
2003.
[22]
P. Michiardi
and R. Molva,
“
C
ore: a
coll
ab
orat
ive reputat
ion mechanism to
enforce
node c
o
o
p
eration in
mob
i
le
ad hoc
netw
orks,”
in
Th
e In
terna
tion
a
l
Fe
dera
tion
f
o
r
Inf
o
r
m
at
i
on
P
r
oc
e
ssi
n
g
TC
6/
TC
11 Si
x
t
h J
o
i
n
t
Wo
rki
n
g C
o
n
f
e
r
en
ce
on
C
o
mmu
n
i
c
a
tion
s
a
nd Mu
ltimed
i
a
S
e
c
u
rity
, P
o
rtoroz, S
l
ovenia,
pp.
107–121,
200
2.
[23]
S. Misra,
et a
l
.
, “
E
nergy effi
cient learni
ng
solutio
n
for
int
r
usion
detect
io
n in
w
i
reless sensor netw
orks,”
S
econd
In
ternatio
na
l
Con
f
ere
n
ce o
n
C
o
mmun
ica
tion
S
y
stems
a
n
d
Netw
orks
, Bangalore,
India,
pp. 1–6
,
2010.
[24]
B. F
oo,
et a
l
.
, “
A
depts: adaptiv
e
intrusion
resp
onse
using
atta
ck graphs
in an
e-co
mme
rce e
nvironment,”
i
n
Int
e
r
n
at
i
o
n
a
l
C
onf
e
r
e
n
c
e
o
n
D
e
pe
n
d
abl
e
Sy
st
e
m
s a
n
d
N
e
t
w
ork
s
, Y
okohama,
Japan, pp. 508–
5
17,
2005.
[25]
J. H
a
ll,
et a
l
.
, “
A
nomaly-based
intrusion
det
ection
usi
n
g
mobili
ty profil
es of publ
ic
transp
ortation
users,”
in
In
terna
tio
na
l C
o
n
f
ere
n
ce
on
Wireless And
Mob
ile
Co
mpu
tin
g, Netwo
rki
n
g
A
n
d
C
o
mmunica
tio
ns
, Montreal,
Q
C
,
Canada, vol
.
2, pp. 17–24,
2005.
[26]
S
.
Buchegger
an
d J
.
Y.
L. Boud
ec, “
P
erform
an
ce
analy
s
is of
th
e confid
ant
protocol,”
in
T
h
e
3rd
i
n
tern
a
tional
symp
osium
on
Mob
ile
ad
ho
c n
e
two
rki
n
g
.
BIOGRAP
HI
ES OF
AUTH
ORS
M
r
.
G
.
G
o
p
i
c
h
a
n
d
.
is
currentl
y
working
as
A
s
s
i
s
t
ant
P
r
ofes
s
o
r and R
e
s
earch
S
c
holar in
the
School of Computing Scien
ce
and Engineer
in
g
at
V
I
T
U
n
i
v
e
r
s
i
t
y
. His r
e
s
ear
ch
w
o
rk
focuses network
security
, Intrusion Detecti
on S
y
s
t
ems, and Wireless
ad-hoc netwo
r
ks.
Dr. RA. K. Sar
a
vanaguru
.
is currently
worki
ng as Associate Professor in
the Schoool of
Computing Science and Eng
i
neering at VIT U
n
iv
e
r
sity
.
His are
a
of inte
re
st
ma
inly
foc
u
se
s
Context Aware S
y
stems, Mid
d
leware D
e
ve
lo
pment, VANETS, Web Services, and C
l
oud
Computing.
Evaluation Warning : The document was created with Spire.PDF for Python.