![](bg5.png)
using the adjacency matrix A, the computed transitive
closure, and the multi-step reachability matrix after
having applied the clustering algorithm is explained
in (Noel and Jajodia, 2005). When an intrusion alarm
is generated, it can be associated with the adjacency
matrix for single step reachability, with the multi-step
reachability matrix for multi-step reachability, or
with the transitive closure of A for all step
reachability. From this, the intrusion alerts can be
categorized based on the number of associated attack
steps. If an attack occurs within a zero-valued region
of the transitive closure, it might be concluded as a
false alarm, or if an alarm occurs within a single step
region of the reachability matrix, it is indeed one of
the single-step attacks in the attack graph.
Somewhere in between, if an alarm occurs in a p-step
region, the attack graph predicts it takes a minimum
of p-steps to achieve such an attack. By associating
intrusion alarms with a reachability graph, the origin
and impact of the attack can also be predicted. This
general approach, in (Noel and Jajodia, 2005) for
different network security situations can be applied to
our wormhole attack graph and generalized to ad hoc
networks after creating network attack graphs for the
different attacks, knowing the special vulnerabilities
of this type of networks.
3.2 Use of Attack Graph’s Distances
In (Noel, Robertson, and Jajodia, 2004) an idea for
correlating intrusion events and building attack
scenarios through attack graph distances was
suggested. This idea could be applied as well in our
case for the wormhole attack detection and in general
for any ad hoc network’s attack graph. To determine
the degree of correlation, the graph distance between
corresponding exploits is measured. Two events that
fall on a connected path in an attack graph are
considered correlated, at least to some extent. The
graph distance between a pair of exploits is the
minimum length of paths connecting them, as the
shortest path is the best assumption for event
correlation and the most efficient to compute. The
graph distances are unweighted, i.e. no weights are
applied to graph edges between exploits. Once the
exploit distances are computed for an attack graph,
they are applied continuously for real time stream of
intrusion events. The inverse of the events distance is
computed and applied to an exponentially weighted
moving average filter, used to provide resiliency
against detection errors, to obtain the filtered version
of the original sequence of event distances. These
filtered inverse events distances constitute the basic
measure of event correlation in that model; a proper
threshold is applied to the filtered distances to
separate event paths into highly correlated attack
scenarios. An overall relevancy score is also
computed for each attack scenario as a function of the
number of events in the scenario. This relevance
score is the proportion of the attack paths actually
occupied by an attacker scenario’s intrusion events.
This same idea could be applied for ad hoc networks
intrusion correlation after having assessed all the
vulnerabilities and created the network attack graph.
In our approach, we will assume that there are
central distributed authorities responsible of building
the attack graphs, calculating their corresponding
adjacency matrix, and computing the attack graph
distances. They should also be responsible of
distributing this data to the nodes and informing the
nodes of the current status whenever there is an attack
so that nodes could locate the most recent event on
their attack graphs. This is not our ultimate goal, but
we shall start our work based on this assumption and
then enhance our approach. Figure 3 summarizes the
suggested anomaly detection technique for ad hoc
networks using attack graphs.
4 CONCLUSIONS AND FUTURE
WORK
In this paper we focused on the anomaly detection
approach for intrusion detection in ad hoc networks.
Some anomaly detection methods such as classifiers,
state machines, and game approach are suitable for
well understood protocols such as routing protocols.
However, since self contained protocols are limited
in ad hoc networks, these approaches might not be
appropriate in some cases. Also, since the risk
assessment methodology described in this paper uses
attack graphs anyway, we suggested the use of attack
graphs for ad hoc networks. As an example for attack
graphs, we created an attack graph for the wormhole
attack. Based on this attack graph we discussed two
methods for anomaly detection that rely basically on
the constructed attack graph for intrusion detection.
The first was based on the attack graph adjacency
matrix and helped in the prediction of a single or
multiple step attack and in the categorization of
intrusion alarms’ relevance. The second method used
the attack graph distances for correlating intrusion
events and building attack scenarios. Therefore, our
approach is more appropriate to ad hoc networks’
collaborative and dynamic nature, especially at the
application level. In the future we intend to build a
full ad hoc network environment and use the
suggested anomaly detection approach to evaluate it
USING ATTACK GRAPHS IN AD HOC NETWORKS - For Intrusion Prediction Correlation and Detection
67