An artificial immune system for misbehavior detection in mobile Ad-Hoc networks with virtual thymus, clustering, danger signal, and memory detectors

Abstract

In mobile ad-hoc networks, nodes act both as terminals and information relays, and they participate in a common routing protocol, such as Dynamic Source Routing (DSR). The networks are vulnerable to routing misbehavior, due to faulty or malicious nodes. Misbehavior detection systems aim at removing this vulnerability. For this purpose, we use an Artificial Immune System (AIS), a system inspired by the human immune system (HIS). Our goal is to build a system that, like its natural counterpart, automatically learns and detects new misbehavior. In this paper we build on our previous work [1,2] and investigate the use of four concepts: (1) "virtual thymus", a novel concept, introduced in this paper, that provides a dynamic description of normal behavior in the system; (2) "clustering", a decision making mechanism for decreasing false positive detections (3) "danger signal", a concept that is, according to the "danger signal theory" of the human immune system [11,12], crucial for correct final decisions making; in our case, the signal is exchanged among nodes, which makes our detection system distributed; (4) "memory detectors", used for achieving faster secondary response of the detection system. We implement our AIS in a network simulator and test it on two types of misbehavior. We analyze the performance and show the effects of the four concepts on the detection capabilities. In summary: thanks to the virtual thymus, the AIS does not require a preliminary learning phase in which misbehavior should be absent; the use of the clustering and the danger signal is useful for achieving low false positives; the use of memory detectors significantly accelerates the secondary response of the system. © Springer-Verlag 2004.