移动自组网络是一种不需要基础设施的网络.在这种网络中,移动节点是自组织的,并且需要互相提供网络路由服务.自组网络非常容易受到攻击,特别是内部攻击.提出了一个基于模糊行为分析的入侵检测方案,以检测网络内部的路由攻击.利用邻接节点监测,通过分析节点路由行为与路由规范的偏差,发现恶意行为.在数据分析的过程中引入了模糊路由行为分析的方法,大大降低了误报率.仿真实验表明,该方案能有效地检测出路由入侵行为,而将误报率控制在一个较低的水平.
Mobile ad hoc network is a kind of network that does not need infrastructure. In such networks mobile nodes are self-organized and provide network routing for each other. Ad hoc networks are extremely vulnerable to attacks, especially internal attacks. In this paper, an intrusion detection scheme is proposed to detect internal routing attacks. In the scheme, every node monitors its adiacent nodes and tries to detect their misbehavior by analyzing the difference between their route behavior and the route specification. An FBA (fuzzy behavior analysis)method is introduced into the data analysis procedure, which can greatly decrease the false alarm rate. Simulation result shows that the scheme can effectively detect intrusions, while keeping the false alarm rate comparatively low.