Resource-misuse attack detection in delay-tolerant networks

In a Delay-Tolerant Network (DTN), data originating from a source node may be delivered to the destination node, despite the non-existence of end-to-end connectivity between them at all times. In an adversarial environment such as a battlefield, DTN nodes could be compromised to launch Denial-of-Service (DoS) attacks by generating excess data, to cause an overflow of the limited resources of the legitimate nodes, hence decreasing the network throughput. A node may also display selfish behavior by generating more data than allowed, to increase its throughput and to decrease the latency of its data packets. In this paper, we term such a DoS attack and selfish data generation behavior, a resource-misuse attack. We study two types of resource-misuse attacks, breadth attacks and depth attacks. Accordingly, we propose different schemes to detect these attacks. Trace-driven simulations using both a synthetic and a real-world trace show that our detection schemes have low average detection latency and additionally, probabilistic detection of the depth attack has low false positive and false negative rates.