Anomaly-based intrusion detection algorithms for wireless networks

Abstract

In this paper we present and evaluate anomaly-based intrusion detection algorithms for detecting physical layer jamming attacks in wireless networks, by seeking changes in the statistical characteristics of the signal-to-noise ratio (SNR). Two types of algorithms are investigated: simple threshold algorithms and algorithms based on the cumulative sum change point detection procedure. The algorithms consider SNR-based metrics, which include the average SNR, minimum SNR, and max-minus-min SNR values in a short window. The algorithms are applied to measurements taken in two locations, one close and one far from the jammer, and evaluated in terms of the detection probability, false alarm rate, detection delay and their robustness to different detection threshold values. Our results show that the cumulative sum detection procedure can improve the detection probability and false alarm rate when measurements are taken far from the jammer, and can improve the robustness for different values of the detection threshold. © 2010 Springer-Verlag Berlin Heidelberg.