CS 495 Advanced Networking

David R. Choffnes, Spring 2005

Denial of Service Resilience in Ad Hoc Networks

Imad Aad, Jean-Pierre Hubaux, Edward W. Knightly

(EPFL & Rice)

Appears in: MobiCom ’04

Presented by: David R. Choffnes

2

Outline

Ranting

More Ranting

Zombies

Ranting

3

JellyFish Attacks

Requires a closed-loop protocol, like TCP– But we’ve already discussed paper detailing how

TCP doesn’t work well for ad hoc networks– How do protocol-compliant attacks work on cross-

layer protocols?

Not specific to ad-hoc networks– E.g., periodic dropping– It would be nice to compare performance against

wired networks in these cases

Can actually help the system when it is overloaded!

4

Methodology: Attacks without Solutions

Exploring impact of attacks without considering solutions lessens validity of resultsAuthors do not consider more interesting scenarios such as hybrid environments (more than one TCP implementation)Even though nodes are protocol compliant, anomalous complete TCP collapse or significant reduction in performance is not hard to detectSeems to rely too much on cross-layer independence

5

Misbehavior Diagnosis

PACK limitations– Power management not likely in highly mobile

scenarios– Directional antennae not widely deployed yet, not

necessarily true that they will be anytime

Diagnosis time: order of seconds– No results back up the claim– How does this change with different routing

protocols?

6

Modeling and Simulation

Mean route lifetime: 10s– Why not look at a range of mean lifetimes

corresponding to real scenarios?

Simulation environment– Open field of 1.2 square miles!– 200 nodes moving randomly! (Shaun of the Dead)– Maximum velocity of 10 m/s (Most people can’t

run much faster than 3 m/s, esp. with a computer in hand, browsing the Web or using FTP)

– Receive range of 250m is ridiculously unrealistic

7

More issues with Experiments

To what realistic scenario does the network traffic correspond?

Figure 16: large radio range inhibits fairness measurement, but the authors do not consider reducing the radio range

Only one routing protocol evaluated– How does JF impact AODV?– How about location-based routing protocols?– Cross-layer reliable delivery protocols?

8

Finally…

This is NOT the Internet– These are mobile scenarios, where all computers

are relatively close to each other and in an open field

– Malicious attacker cannot simply hide behind a bush

– No doubt there are techniques to locate the JF attacker and physically remove her from the network