A Moderate to Robust Game Theoretical Model for Intrusion Detection in MANETs

One popular solution for reducing the resource consumption of Intrusion Detection System (IDS) in MANET is to elect a head-cluster (leader) to provide intrusion detection serviceto other nodes in the same cluster. However, such a moderate mode is only suitable when the probability of atack is low. Once the probability of attack is high, victim nodes should launch their own IDSs to detect and thwart intrusions. Such a robust mode is, however, costly with respect to energy and leads nodes to die faster. Clearly, to reduce the resource consumption of IDSs andyet keep its effectiveness, a critical issue is: When should we shift from moderate to robust mode? In this paper, we formalize this issue as a nonzero-sum noncooperative game theoretical model that takes into consideration the tradeoff between security and IDS resource consumption. The game solution will guide theleader-IDS to find the right moment for notifying the victimnode to launch its IDS once the security risk is high enough. To achieve this goal, the Bayesian game theory is used to analyze the interaction between the leader-IDS and intruder with incomplete information about the intruder. By solving such a game, we are able to find the threshold value for notifying the victim node to launch its IDS once the probability of attack exceeds that value. Simulation results show that our scheme can effectively reduce the IDS resource consumption without sacrificing security.

I. Introduction

The cooperation among nodes is a crucial requirement for intrusion detection in Mobile Ad hoc Networks (MANETs) due to their autonomous nature [2], [6]. The cooperation usually requires all the nodes to launch their own IDSs to increase the detection capability. Unacceptable resource consumption is the main obstacle faced by such a model since nodes in a MANET typically have only limited resources. A common approach for reducing the overall resource consumption of intrusion detection is for nodes to collaborate in electing a leader to serve as the intrusion detection system (IDS) for a cluster of one-hop nodes. The election process can be based on one of the following models: Random [3], connectivity index [4], or weight-based model [7]. Relying on leaders for providing IDS service by examining a portion of all nodes' packets is suitable whenever the probability of attack is low. This is usually known as a moderate intrusion detection model. However, a robust model where the victim nodes launch their own IDSs will be more desirable when the probability of attack is high. To the best of our knowledge, the critical issue that has not been addressed so far is: When should we step from moderate to robust mode?