André König

Routing performance of Wireless Mesh Networks: A practical evaluation of BATMAN advanced

The performance of Wireless Mesh Networks under realistic conditions is not well understood. Given the huge design and parameter space for these networks, all-encompassing performance evaluations are unfeasible. We follow a practical approach and perform a targeted, in-depth investigation of the current state of the BATMAN Advanced (batman-adv) protocol in a realistic office environment, using the thoroughly studied AODV protocol as a baseline. In particular, we study the reachability, packet loss, delay and throughput of the network. We identify the main parameters influencing the routing performance and demonstrate failure modes of the studied protocols.

A Generic Metamodel for IT Security Attack Modeling for Distributed Systems

Understanding and discussing the security aspects of IT systems during their development is challenging for both domain specialists and IT experts - neglecting this aspect leads to communication problems and, eventually, to less secure systems. An important factor for these challenges is the distribution and variety of basic IT security concepts, attacks, and countermeasures, e.g., in the standard literature. In this paper, we propose a generic metamodel for IT security capturing both its major concepts and their relationships to each other. With a focus on attacks, we show how this model is applied to different scenarios in distributed systems, i.e., Peer-to-Peer systems, Service-oriented Architectures, and Mobile ad hoc Networks. This allows for a better understanding of IT security in general and attacks in particular, thus, enabling effective communication between different parties during the development of security-critical IT systems.

GeoSec: quarantine zones for mobile ad hoc networks

With their wireless and infrastructureless nature, mobile ad hoc networks offer new possibilities for communication, but also new possibilities for attacks. An intrusion detection system combined with intrusion response mechanisms is a promising approach which mitigates the effects of attacks, but cannot be taken directly from wired or infrastructure-based environments. In this paper, we propose an intrusion response mechanism for mobile ad hoc networks that excludes detected adversaries from the network based on their geographical position. To this end, we establish geographical quarantine zones, which block communication around misbehaving nodes. Thus, we depart from the assumption that attacks can be uniquely bound to addresses. Without loss of generality, we show how our approach can be used together with the AODV routing protocol to provide an intrusion response to a combination of Blackhole and Sybil attacks. In a series of simulation studies, we compare our approach with a ‘traditional’, address-based intrusion response strategy. Copyright

The rise and fall of the AODV protocol: A testbed study on practical routing attacks

Securing the routing service of Mobile Ad-hoc Networks (MANET) is a basic requirement for application scenarios such as emergency response operations. In this paper we analyze the effects of routing attacks on the Ad-hoc On-demand Distance Vector (AODV) protocol. We present results of a testbed-based analysis to consider real-world characteristics of hardware as well as wireless communications. As AODV is shown to produce unstable multi-hop routes, we design and implement a mechanism to address this issue. We then present an evaluation of three selected types of malicious behavior. Our results show that our protocol-variant delivers a reliable ad-hoc routing service. Yet, it is strongly affected by routing attacks.

A Survey on Security in Mobile Peer-to-Peer Architectures— Overlay-Based vs. Underlay-Based Approaches

Mobile Ad hoc networks (MANET) and Peer-to-Peer (P2P) networks share central characteristics such as their distributed and decentralized nature. Combining both networking paradigms results in a Mobile Peer-to-Peer (MP2P) system that operates independently from a preexisting infrastructure. Securing MP2P networks in terms of availability and robustness as basic demands in envisioned application scenarios like first responder operations is a challenging task. In this article, we present a survey of selected threats and of state of the art countermeasures for MANETs and P2P networks. Further, we discuss the efficiency of MANET and P2P security mechanisms when applied in MP2P networks.

Quality of experience of voice communication in large-scale mobile ad hoc networks

Real-time voice communication is an essential requirement in first responder scenarios. While mobile ad hoc networks (MANET) already prove to be an appropriate communication substrate in small-scale real-world operations, questions regarding scalability limitations remain. In this paper, we identify major factors that affect the quality of experience of voice communication in MANETs. In a series of simulation studies, we show that voice transmission using MANETs is also feasible in large-scale scenarios, if appropriate settings are chosen.

An Analytical Model of Routing, Misbehavior, and Countermeasures in Mobile Ad Hoc Networks

We present an analytical model combining geometric and stochastic approaches to describe the effects of attacks and countermeasures on MANETs. In particular, we focus on the packet loss that can be charged to the misbehavior as well as to the countermeasures as a primary metric. For this, we model the entire chain of (1) MANET routing, (2) attack, (3) intrusion detection, and (4) intrusion response. We validate the models proposed by means of simulation.

A Cross-Layer Approach towards Robustness of Mobile Peer-to-Peer Networks

The lookup mechanism used to locate services in Peer-to-Peer systems can be attacked with little effort due to its decentralized and self-organizing nature. Security mechanisms aiming at rendering the lookup mechanism more robust mostly require a high amount of network resources. These mechanisms cannot be applied without adaptations when network resources are limited. In this paper, we introduce a novel approach to increase lookup robustness in mobile Peer-to-Peer networks. Here, network resources are limited by the mobile ad hoc network that is used as communication substrate. Our approach harnesses cross-layer information provided from the mobile ad hoc underlay to the Peer-to-Peer overlay. We derive analytical models to compare our approach to existing security mechanisms and validate our results by means of simulation. Our core findings how that our approach consumes less resources than existing mechanisms while the robustness remains at a comparable level.

On the Implications of Adaptive Transmission Power for Assisting MANET Security

Mitigating misbehavior in mobile ad hoc networks (MANET) requires effective intrusion response systems. In this work, we present an intrusion response scheme that is tailored to support the infrastructure less nature of MANETs. We propose a geographic solution towards excluding misbehaving nodes which is robust against address spoofing from the attacker. In particular, we investigate how an adaptive transmission power can be used to physically keep communication away from misbehaving nodes. We present different strategies for adapting transmission power taking into account effects of asymmetric links, and we provide a detailed performance evaluation based on a series of simulation studies. Our results show that the proposed solution significantly reduces the artificial packet loss that is introduced by geographic intrusion response strategies. Yet, we further observe side-effects of an adaptive transmission power on standard (non power-aware) MANET routing protocols.

Protecting IEEE 802.11s wireless mesh networks against insider attacks

IEEE 802.11s is an emerging standard for wireless mesh networks. Networks based on IEEE 802.11s directly benefit from existing security mechanisms in IEEE 802.11. This limits the attack surface of IEEE 802.11s significantly for adversaries that cannot authenticate with the network. Mesh networks are, however, often conceived for community network scenarios, which are inherently more open than managed infrastructure networks. This openness entails an increased risk of insider attacks, i.e., attacks by compromised stations that can authenticate with the network. Currently, IEEE 802.11s is lacking adequate protection against such insider attacks. In this paper, we hence derive an attack model for insider attacks and present two insider attack strategies to which IEEE 802.11s networks are prone, namely impairing the network performance and preventing communication between a pair of nodes. We design countermeasures that allow to defend the wireless network against both types of attacks. Our implementations only incur marginal computational and memory overheads, while the network security is measurably strengthened.