Log-based intrusion detection for MANET

Ad hoc networks operate mostly over open environments and are hence vulnerable to a large number of threats. This calls for providing advanced intrusion detection. To meet this requirement, we introduce IDAR, a signature- and log-based distributed intrusion detector dedicated to ad hoc routing protocols. Contrary to existing systems that observe packets, IDAR analyses the logs generated by the OLSR protocol and identifies patterns of misuse. This detector copes with the resource-constraints of devices by providing distributed detection. In particular, depending on the level of suspicion/gravity involved, in-depth cooperative investigation is launched. Simulation shows limited bandwidth usage, high detection and low false positives.