ATTENTION: ATTackEr traceback using MAC layer abNormality detecTION

TL;DR

This paper introduces the ATTENTION protocol framework for attacker traceback in MANETs, focusing on MAC layer abnormalities to improve success rates in identifying DoS and DDoS attackers despite network dynamics.

Contribution

The paper proposes a novel MAC layer abnormality detection framework with coarse and fine-grained traceback methods, incorporating a spatio-temporal fusion architecture and small-world model for energy efficiency.

Findings

79% success rate with coarse-grained attack signature

97% success rate with fine-grained attack signature

83% success rate in DDoS attacker traceback

Abstract

Denial-of-Service (DoS) and Distributed DoS (DDoS) attacks can cause serious problems in wireless networks due to limited network and host resources. Attacker traceback is a promising solution to take a proper countermeasure near the attack origins, to discourage attackers from launching attacks, and for forensics. However, attacker traceback in Mobile Ad-hoc Networks (MANETs) is a challenging problem due to the dynamic topology, and limited network resources. It is especially difficult to trace back attacker(s) when they are moving to avoid traceback. In this paper, we introduce the ATTENTION protocol framework, which pays special attention to MAC layer abnormal activity under attack. ATTENTION consists of three classes, namely, coarse-grained traceback, fine-grained traceback and spatio-temporal fusion architecture. For energy-efficient attacker searching in MANETs, we also utilize small-world model. Our simulation analysis shows 79% of success rate in DoS attacker traceback with coarse-grained attack signature. In addition, with fine-grained attack signature, it shows 97% of success rate in DoS attacker traceback and 83% of success rate in DDoS attacker traceback. We also show that ATTENTION has robustness against node collusion and mobility.