Cross-layer Analysis for Detecting Wireless Misbehaviour

Intrusion detections systems (IDSs) in ad hoc networks monitor other devices for significant deviation from protocol -- misbehavior. This process is complicated due to limited radio range and mobility of nodes. Unlike conventional IDSs, it is not possible to monitor nodes for long durations. As a result IDSs suffer from a large number of false positives. Moreover other environmental conditions like radio interference and congestion increase false positives, complicating classification of legitimate nodes and attackers. We present a scheme that helps in accurate diagnosis of malicious attacks in ad hoc networks. Our scheme employs cross-layer interactions based on observations at various networking layers to decrease the number of false positives. Our simulations show that our scheme is more effective and accurate than those based on isolated observations from any single layer.