Mobile ad-hoc network with intrusion detection features and related methods

• US 7,082,117 B2
• Filed: 08/12/2002
• Issued: 07/25/2006
• Est. Priority Date: 08/12/2002
• Status: Expired due to Term

• Current Assignee: Stingray IP Solutions LLC (Acacia Research Corporation)
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Billhartz, Thomas Jay
• Primary Examiner(s): Pham, Chi
• Assistant Examiner(s): TRAN, PHUC H
• Application Number:
  US10/217,097
• Publication Number:
  US 20040028000A1
• Time in Patent Office: 1,443 Days
• Field of Search: 370/252, 370/254, 370/240, 370/389, 370/351, 370/352, 370/401, 709/223, 709/224, 713/164, 713/187, 726 1- 23
• US Class Current: 370/338
• CPC Class Codes: H04L 1/00 Arrangements for detecting or preventing errors in the information received correcting synchronisation H04L7/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A mobile ad-hoc network (MANET) may include a plurality of nodes for transmitting data therebetween using a media access layer (MAC), where each of the nodes has a respective MAC address associated therewith. The MANET may also include a policing node for detecting intrusions into the MANET by monitoring transmissions among the plurality of nodes to detect frame check sequence (FCS) errors from a MAC address, and generating an intrusion alert based upon detecting a number of FCS errors for the MAC address exceeding a threshold. The policing node may also detect intrusions based upon one or more of failed MAC address authentications, illegal network allocation vector (NAV) values, and unexpected contention or contention-free operation.

Claims

1. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data therebetween using a media access layer (MAC), each of said nodes having a respective MAC address associated therewith; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect frame check sequence (FCS) errors from a MAC address; and

generating an intrusion alert based upon detecting a number of FCS errors for the MAC address exceeding a threshold.

2. The MANET of claim 1 wherein said policing node further detects intrusions into the MANET by:

monitoring transmissions among said plurality of nodes to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

3. The MANET of claim 2 wherein said policing node generates an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

4. The MANET of claim 1 wherein said plurality of nodes transmit request to send (RTS) and clear to send (CTS) packets therebetween prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

and wherein said policing node further detects intrusions into the MANET by;

monitoring RTS and CTS packets transmitted among said plurality of nodes to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

5. The MANET of claim 1 wherein said plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

6. The MANET of claim 1 wherein said plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation outside a CFP.

7. The MANET of claim 1 wherein the MANET has at least one service set identification (ID) associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

8. The MANET of claim 1 wherein said plurality of nodes transmit data over at least one channel;

and wherein said policing node further detects transmissions over the at least one channel not originating from one of the plurality of nodes and generates an intrusion alert based thereon.

9. The MANET of claim 1 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

10. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data therebetween using a media access layer (MAC), each of said nodes having a respective MAC address associated therewith; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

11. The MANET of claim 10 wherein said policing node generates an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

12. The MANET of claim 10 wherein said plurality of nodes transmit request to send (RTS) and clear to send (CTS) packets therebetween prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

and wherein said policing node further detects intrusions into the MANET by;

monitoring RTS and CTS packets transmitted among said plurality of nodes to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

13. The MANET of claim 10 wherein said plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

14. The MANET of claim 10 wherein said plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP.

15. The MANET of claim 10 wherein the MANET has at least one service set identification (ID) associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

16. The MANET of claim 10 wherein said plurality of nodes transmit data over at least one channel;

and wherein said policing node further detects transmissions over the at least one channel not originating from one of the plurality of nodes and generates an intrusion alert based thereon.

17. The MANET of claim 10 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

18. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data therebetween;

said plurality of nodes transmitting request to send (RTS) and clear to send (CTS) packets therebetween prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data; and

a policing node for detecting intrusions into the MANET by

monitoring RTS and CTS packets transmitted among said plurality of nodes to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

19. The MANET of claim 18 wherein said plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

20. The MANET of claim 18 wherein said plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP.

21. The MANET of claim 18 wherein the MANET has at least one service set identification (ID) associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

22. The MANET of claim 18 wherein said plurality of nodes transmit over at least one channel;

and wherein said policing node further detects transmissions over the at least one channel not originating from one of the plurality of nodes and generates an intrusion alert based thereon.

23. The MANET of claim 18 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

24. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data therebetween, said plurality of nodes intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

25. The MANET of claim 24 wherein the MANET has at least one service set identification (ID) associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

26. The MANET of claim 24 wherein said plurality of nodes transmit over at least one channel;

and wherein said policing node further detects transmissions over the at least one channel not originating from one of the plurality of nodes and generates an intrusion alert based thereon.

27. The MANET of claim 24 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

28. A mobile ad-hoc network (MANET) comprising:

a plurality of nodes for transmitting data therebetween, said plurality of nodes intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs; and

a policing node for detecting intrusions into the MANET by

monitoring transmissions among said plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP.

29. The MANET of claim 28 wherein the MANET has at least one service set identification (ID) associated therewith;

and wherein said policing node further detects intrusions into the MANET by;

monitoring transmissions among said plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

30. The MANET of claim 28 wherein said plurality of nodes transmit over at least one channel;

and wherein said policing node further detects transmissions over the at least one channel not originating from one of the plurality of nodes and generates an intrusion alert based thereon.

31. The MANET of claim 28 wherein said policing node further transmits an intrusion alert to at least one of said plurality of nodes.

32. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data between the plurality of nodes using a media access layer (MAC), each of the nodes having a respective MAC address associated therewith;

monitoring transmissions among the plurality of nodes to detect frame check sequence (FCS) errors from a MAC address; and

generating an intrusion alert based upon detecting a number of FCS errors for the MAC address exceeding a threshold.

33. The method of claim 32 further comprising:

monitoring transmissions among the plurality of nodes to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

34. The method of claim 33 wherein generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address comprises generating an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

35. The method of claim 32 further comprising:

transmitting request to send (RTS) and clear to send (CTS) packets between the plurality of nodes prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

monitoring the RTS and CTS packets sent between the plurality of nodes to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

36. The method of claim 32 wherein the plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

37. The method of claim 32 wherein the plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

38. The method of claim 32 wherein the MANET has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

39. The method of claim 32 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of nodes and generating an intrusion alert based thereon.

40. The method of claim 32 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

41. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data between the plurality of nodes using a media access layer (MAC), each of the nodes having a respective MAC address associated therewith;

monitoring transmissions among the plurality of nodes to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

42. The method of claim 41 wherein generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address comprises generating an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

43. The method of claim 41 further comprising:

transmitting request to send (RTS) and clear to send (CTS) packets between the plurality of nodes prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

monitoring the RTS and CTS packets sent between the plurality of nodes to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

44. The method of claim 41 wherein the plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

45. The method of claim 41 wherein the plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

46. The method of claim 41 wherein the MANET has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

47. The method of claim 41 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of nodes and generating an intrusion alert based thereon.

48. The method of claim 41 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

49. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting request to send (RTS) and clear to send (CTS) packets between the plurality of nodes, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting data between the plurality of nodes;

transmitting data between the plurality of nodes;

monitoring the RTS and CTS packets sent between the plurality of nodes to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

50. The method of claim 49 wherein the plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

51. The method of claim 49 wherein the plurality of nodes intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

52. The method of claim 49 wherein the MANET has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

53. The method of claim 49 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of nodes and generating an intrusion alert based thereon.

54. The method of claim 49 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

55. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data between the plurality of nodes, the plurality of nodes intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

monitoring transmissions among the plurality of nodes to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

56. The method of claim 55 wherein the MANET has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

57. The method of claim 55 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of nodes and generating an intrusion alert based thereon.

58. The method of claim 55 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.

59. An intrusion detection method for a mobile ad-hoc network (MANET) comprising a plurality of nodes, the method comprising:

transmitting data between the plurality of nodes, the plurality of nodes intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

monitoring transmissions among the plurality of nodes to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

60. The method of claim 59 wherein the MANET has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of nodes to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the MANET.

61. The method of claim 59 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of nodes and generating an intrusion alert based thereon.

62. The method of claim 59 further comprising transmitting the intrusion alert to at least one of the plurality of nodes.