Proposing a light weight semi-distributed IDS for mobile ad-hoc network based on nodes´ mode

In this paper we propose a light weight semi-distributed IDS architecture for intrusion detection in mobile ad-hoc network. We consider three modes for nodes in this network as normal, attack-presented, and suspicious which the process of detection is based on them. Suspicious mode is a rough detecting situation which may occur in both normal or attack-presented mode, and our architecture changes to distributed and cooperative fashion to overcome the ambiguity in this mode. We use neural-fuzzy interface as our architecture detection engine. The ability of the proposed architecture has been evaluated using two introduced measures (PTDN and PFDN), and in overhead case it is compared with traditional standalone architecture. Results show that our architecture has a good ability even in a network with low level attack and rapid node movement with low overhead.