Mobile ad-hoc network with intrusion detection features and related methods

• US 6,986,161 B2
• Filed: 08/12/2002
• Issued: 01/10/2006
• Est. Priority Date: 08/12/2002
• Status: Expired due to Term

• Current Assignee: Stingray IP Solutions LLC (Acacia Research Corporation)
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Billhartz, Thomas Jay
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US10/217,017
• Publication Number:
  US 20040028016A1
• Time in Patent Office: 1,247 Days
• Field of Search: 713/200, 713/201, 709/223, 709/224, 370/338, 370/389, 370/908, 370/912, 370/913, 370/339, 380/270
• US Class Current: 726/23
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A mobile ad-hoc network (MANET) may include a plurality of nodes for transmitting data therebetween and a policing node. The policing node may detect intrusions into the MANET by monitoring transmissions among the plurality of nodes to detect transmissions during an unauthorized period and generate an intrusion alert based thereon. The policing node may also detect intrusions based upon one or more of integrity check values which do not correspond with respective data packets, usage of non-consecutive media access control (MAC) sequence numbers by a node, and collisions of packet types and/or MAC addresses.

Claims

1. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data therebetween during an authorized period; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect transmissions during an unauthorized period in which data transmissions are prohibited; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period.

2. The MANET of claim 1 wherein the MANET has at least one service set identification (ID) associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

3. The MANET of claim 1 wherein said plurality of nodes transmit over at least one channel;

and wherein said policing node further detects transmissions over the at least one channel not originating from one of the plurality of nodes and generates an intrusion alert based thereon.

4. The MANET of claim 1 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

5. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data in packets and generating respective integrity check values for transmission with each packet; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect integrity check values which do not correspond with their respective data packets; and

generating an intrusion alert based upon detecting an integrity check value which does not correspond with its respective data packet.

6. The MANET of claim 5 wherein said plurality of nodes transmit data in packets via a medium access control (MAC) layer and also transmit a respective MAC sequence number with each data packet;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect usage of non-consecutive MAC sequence numbers by a node; and

generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a node.

7. The MANET of claim 5 wherein said plurality of nodes transmit data in packets each having a packet type associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.

8. The MANET of claim 7 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

9. The MANET of claim 7 wherein the threshold number of collisions is greater than about three.

10. The MANET of claim 7 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

11. The MANET of claim 5 wherein said plurality of nodes transmit data via a medium access control (MAC) layer;

wherein each node has a MAC address associated therewith to be transmitted with data sent therefrom; and

wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

12. The MANET of claim 11 wherein the threshold number of collisions is greater than about three.

13. The MANET of claim 5 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

14. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data in packets via a medium access control (MAC) layer and also for transmitting a respective MAC sequence number with each data packet data; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect usage of non-consecutive MAC sequence numbers by a node; and

generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a node.

15. The MANET of claim 14 wherein said plurality of nodes transmit data in packets each having a packet type associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.

16. The MANET of claim 15 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

17. The MANET of claim 15 wherein the threshold number of collisions is greater than about three.

18. The MANET of claim 15 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

19. The MANET of claim 14 wherein said plurality of nodes transmit data via a medium access control (MAC) layer;

wherein each node has a MAC address associated therewith to be transmitted with data sent therefrom; and

wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

20. The MANET of claim 19 wherein the threshold number of collisions is greater than about three.

21. The MANET of claim 14 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

22. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data in packets each having a packet type associated therewith; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.

23. The MANET of claim 22 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

24. The MANET of claim 22 wherein the threshold number of collisions is greater than about three.

25. The MANET of claim 22 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

26. The MANET of claim 22 wherein said plurality of nodes transmit data via a medium access control (MAC) layer;

wherein each node has a MAC address associated therewith to be transmitted with data sent therefrom; and

wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

27. The MANET of claim 22 wherein the threshold number of collisions is greater than about three.

28. The MANET of claim 22 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

29. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data via a medium access control (MAC) layer, each node having a MAC address associated therewith to be transmitted with data sent therefrom; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

30. The MANET of claim 29 wherein the threshold number of collisions is greater than about three.

31. The MANET of claim 29 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

32. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data between the plurality of nodes of the MANET during an authorized period;

monitoring transmissions among the plurality of nodes to detect transmissions during an unauthorized period in which data transmissions are prohibited; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period.

33. The method of claim 32 wherein the MANET has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

34. The MANET of claim 32 wherein the plurality of nodes transmit over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of nodes and generating an intrusion alert based thereon.

35. The MANET of claim 32 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

36. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data between the plurality of nodes in packets and generating respective integrity check values for transmission with each packet;

monitoring transmissions among the plurality of nodes to detect integrity check values which do not correspond with their respective data packets; and

generating an intrusion alert based upon detecting an integrity check value which does not correspond with its respective data packet.

37. The method of claim 36 wherein the plurality of nodes transmit data in packets via a medium access control (MAC) layer and also transmit a respective MAC sequence number with each data packet;

and further comprising;

monitoring transmissions among the plurality of nodes to detect usage of non-consecutive MAC sequence numbers by a node; and

generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a node.

38. The method of claim 36 wherein the data packets each have a packet type associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.

39. The method of claim 38 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

40. The method of claim 38 wherein the threshold number of collisions is greater than about three.

41. The method of claim 38 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

42. The method of claim 36 wherein the plurality of nodes transmit data packets via a medium access control (MAC) layer, and wherein each node has a MAC address associated therewith to be transmitted with data sent therefrom;

and further comprising;

monitoring transmissions among the plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

43. The method of claim 42 wherein the threshold number of collisions is greater than about three.

44. The method of claim 36 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

45. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data in packets via a medium access control (MAC) layer and transmitting a respective MAC sequence number with each data packet data;

monitoring transmissions among the plurality of nodes to detect usage of non-consecutive MAC sequence numbers by a node; and

generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a node.

46. The method of claim 45 wherein each data packet has a packet type associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.

47. The method of claim 46 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

48. The method of claim 45 wherein the threshold number of collisions is greater than about three.

49. The method of claim 45 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

50. The method of claim 45 wherein the plurality of nodes transmit data packets via a medium access control (MAC) layer, and wherein each node has a MAC address associated therewith to be transmitted with data sent therefrom;

and further comprising;

monitoring transmissions among the plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

51. The method of claim 50 wherein the threshold number of collisions is greater than about three.

52. The method of claim 45 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

53. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data in packets between the plurality of nodes, each packet having a packet type associated therewith;

monitoring transmissions among the plurality of nodes to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.

54. The method of claim 53 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

55. The method of claim 53 wherein the threshold number of collisions is greater than about three.

56. The method of claim 53 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

57. The method of claim 53 wherein the plurality of nodes transmit data packets via a medium access control (MAC) layer, and wherein each node has a MAC address associated therewith to be transmitted with data packets sent therefrom;

and further comprising;

monitoring transmissions among the plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

58. The method of claim 57 wherein the threshold number of collisions is greater than about three.

59. The method of claim 53 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

60. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data via a medium access control (MAC) layer between the plurality of nodes, each node having a MAC address associated therewith to be transmitted with data sent therefrom;

monitoring transmissions among the plurality of nodes to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.

61. The method of claim 60 wherein the threshold number of collisions of a same MAC address is greater than about three.

62. The method of claim 60 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

63. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data in packets therebetween and generating respective integrity check values for transmission with each packet; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect transmissions during an unauthorized period and to detect integrity check values which do not correspond with their respective data packets; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting an integrity check value which does not correspond with its respective data packet.

64. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data in packets therebetween via a medium access control (MAC) layer and also transmitting a respective MAC sequence number with each data packet; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect transmissions during an unauthorized period and to detect usage of non-consecutive MAC sequence numbers by a node; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting usage of non-consecutive MAC sequence numbers by a node.

65. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data in packets therebetween each having a packet type associated therewith; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect transmissions during an unauthorized period and to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting a threshold number of collisions of packets having the predetermined packet type.

66. The MANET of claim 65 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

67. The MANET of claim 65 wherein the threshold number of collisions is greater than about three.

68. The MANET of claim 65 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

69. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data in packets therebetween via a medium access control (MAC) layer, each node haVING a MAC address associated therewith to be transmitted with data sent therefrom; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect transmissions during an unauthorized period and to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting a threshold number of collisions of a same MAC address.

70. The MANET of claim a 69 wherein the threshold number of collisions is greater than about three.

71. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data in packets between the plurality of nodes and generating respective integrity check values for transmission with each packet;

monitoring transmissions among the plurality of nodes to detect transmissions during an unauthorized period and to detect integrity check values which do not correspond with their respective data packets; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting an integrity check value which does not correspond with its respective data packet.

72. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data in packets between the plurality of nodes via a medium access control (MAC) layer and also transmit a respective MAC sequence number with each data packet;

monitoring transmissions among the plurality of nodes to detect transmissions during an unauthorized period and to detect usage of non-consecutive MAC sequence numbers by a node; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting usage of non-consecutive MAC sequence numbers by a node.

73. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data in packets between the plurality of nodes and each having a packet type associated therewith; and

further comprising;

monitoring transmissions among the plurality of nodes to detect transmissions during an unauthorized period and to detect collisions of packets having a predetermined packet type; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting a threshold number of collisions of packets having the predetermined packet type.

74. The method of claim 73 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.

75. The method of claim 73 wherein the threshold number of collisions is greater than about three.

76. The method of claim 73 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.

77. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data in packets between the plurality of nodes via a medium access control (MAC) layer, each node having a MAC address associated therewith to be transmitted with data sent therefrom;

monitoring transmissions among the plurality of nodes to detect transmissions during an unauthorized period and to detect collisions of a same MAC address; and

generating an intrusion alert based upon detecting transmissions during the unauthorized period and based upon detecting a threshold number of collisions of a same MAC address.

78. The method of claim 77 wherein the threshold number of collisions is greater than about three.