Mitigating Wormhole Attacks Using Passive Monitoring in Mobile Ad Hoc Networks

Wormhole attacks, in which colluding attackers with out-of-band communication links record packets (or bits) at one location and replay at another, cause far away nodes to consider themselves as neighbors to one another. Such attacks can ruin the routing and communication capabilities of mobile ad hoc networks. This paper presents NEVO, in which nodes passively monitor (overhear) the forwarding of broadcast type packets by their neighbors and use the send and overhear times of transmissions of these packets, to mitigate these wormhole attacks. NEVO does not require synchronized clocks, special hardware support, or any special capability. NEVO can detect almost all instances of wormhole attacks and is virtually independent of the routing protocol used. NEVO is simple to implement - requires mostly network layer software changes, has low overhead, and is very robust. NEVO is implemented in the Glomosim simulator and its performance is evaluated. Simulation results show that NEVO effectively mitigates wormhole attacks (no data packets were sent through the wormholes in the simulated networks) and has low impact in normal with low to moderate traffic loads.