Channel-Aware Detection of Gray Hole Attacks in Wireless Mesh Networks

Gray hole attacks (a.k.a selective forwarding attacks) are a special case of denial of service (DoS) attack, where a misbehaving mesh router just forwards a subset of the packets it receives but drops the others. In wireless networks, it is particularly hard to detect the presence of such attackers because a packet loss over the wireless link can be due to bad channel quality, medium access collisions, or intentional dropping. In contrast to existing studies, we propose a more practical algorithm known as channel aware detection (CAD) that adopts two strategies, hop-by-hop loss observation and traffic overhearing, to detect the mesh nodes subject to the attack. We derive the optimal detection thresholds by analyzing the false alarm and missed detection probabilities of CAD. We also compare our approach to existing solutions and demonstrate that CAD detects the attackers effectively even in harsh channel conditions.