Towards adaptive intrusion detection in mobile ad hoc networks

One of the main challenges in budding intrusion detection systems (IDSs) for mobile ad hoc networks (MANETs) is to integrate the mobility impact and adjust the behavior of IDSs dynamically. In this paper, focusing on the protection of MANET routing protocols, we first demonstrate that nodes´ moving speed, a commonly used parameter in tuning IDS performance, is not an effective metric for the performance measurement of IDSs for MANETs. We then propose a new feature - the link change rate, which can not only act as a unified metric in measuring MANET IDS performance, but also be used to facilitate local MANET IDSs to select normal profiles adaptively. We utilize different mobility models to study the performance of our proposed adaptive mechanisms at different mobility levels. Simulation results show that our proposed adaptive mechanisms are effective and less dependent on mobility models. Detailed analysis of simulation results is also provided.