International Journal of Innovative Research in Science, Engineering and Technology
MenuISSN ONLINE(2319-8753)PRINT(2347-6710)
ISSN ONLINE(2319-8753)PRINT(2347-6710)
Sakthidevi.I1 and Joshva Devadas.T2
|
| Related article at Pubmed, Scholar Google |
Visit for more related articles at International Journal of Innovative Research in Science, Engineering and Technology
In wireless network environments, the chances for the vulnerability and the attacks against the data are getting higher at a gradual phase because of the various hacking and intrusion mechanisms. Lot of researches is in progress to protect the data and the associated nodes against these attacks. In comparison, the protection for the data and the nodes are reasonable for the centralized networks in defining specified architectures. But alarmingly, the security measures among the decentralized networks are very less in number and hence the need for efficient decentralized network control and attack analysis model is very high. In our work, we design a novel mechanism called Enhanced Network Intrusion Detection and Countermeasure Selection (ENICS) for detection and prevention of intrusion in the decentralized network. The control centre associated with the upstream intermediate network has three sub divisions, network controller, node profiling and attack analyzer. We analyze and detect the DDOS attacks using the control centre. Programmable network has performance enhancer and counter measure selection. This will ease the prevention control for the decentralized collaborative networks. In the simulation analysis, we measure the performance metrics, viz. CPU Utilization, Network Communication Delay, Success Analysis Rate and Throughput Analysis Rate for ENICS and compare them with the existing works based on NICE and Firecol-DGSOT using the simulation tool NS2. Results show that ENICS has better performance measure while detecting and preventing the intrusion attacks of the decentralized networks
Keywords |
| Collaborative networks; Counter measure selection; DDOS attacks; ENICS; Intrusion Detection; Intrusion Prevention |
INTRODUCTION |
| Numerous protection mechanisms systems are there to secure the wireless networks against the vulnerable attacks [1] [2] [3]. Most of the intrusion detections deal with the centralised networks. Only limited number of researches is under process for the decentralised networks. To aim for the common goals in the intrusion based detection and prevention systems, lot of works has been established by means of individual participation and modular designs. The integration of the modular designs to build as a coherent system for protection and prevention is the need of the modern day works. Internet has emerged as a major source of active participation and storage [4] [5]. To transmit a data from the remotely located server to the local client machine and vice versa involves the passage along the contaminated route. To secure the previous data along the public runway and to prevent it from malicious attachment needs a dedicated and one to one flow all along the way which is practically impossible. To develop a tunnel virtually across the data transmission path extends to the development of new Intrusion Prevention System. If at all, any attacks are prone in the data path, the mechanism to detect it and to get rid of it is also of prime importance. [6][7][8][11]Existing anomaly based intrusion works on deviation principle in which the contaminated path is simply eliminated in the routing algorithm. [9][10] For effective and efficient data delivery, the design of the system which detects the anomaly and prevents such anomalies in the near future is necessary [12]. This should be looked into by the proposed Enhanced Network Intrusion detection based on Counter Measure Selection (ENICS) solution [11][13]by analysing the decentralized collaborative network control and attack analysis model using quick change point detection method. Existing anomaly detection is measured by trust aware routing but ENICS provides the better security than fuzzy based trust aware routing[16],and data cleaning methods for packets counter measure [14][15] in Wifi positioning system. Our proposed method covers the collaborative network and measure the intrusion in global level. |
| The paper is organized as follows: Section 2 deals with the decentralized network control and detection model based on ENICS architecture. Section 3 deals with the implementation procedures for Quickset change point detection mechanism. Section 4 deals with the simulation analysis. Section 5 deals with the conclusion and the future works. |
DECENTRALIZED NETWORK CONTROL AND DETECTION MODEL – ENICS ARCHITECTURE |
| ENICS model is designed as high secured one. Collaborative computation and counter measure selection are the prime factors in this model. The potential attacks shall get brief communication exchange with the vertical collaborative network. Depending on the probable attacks in the pathway and analyzing cost benefits, this ENIVS model is proposed. To reduce the countermeasures and the cost investment, greedy objective techniques are used. |
 |
| The decentralized network model can be divided into three sections, one with the upstream intermediate network, the other one control centre and another one, programmable network. Upstream Intermediate Network is one in which the actual data transmissions occur. The data is transmitted from the source to the destination through the intermediate nodes and gateways. During the data transmission, when the DDOS attack sources invade the network, there is a high probability of intrusion into the network. During such intrusion, control centre controls the network through network controller, node profiling and attack analyzer associated with it. The programmable network has performance enhancer and the counter measure selection to control and restore the network. Information stored in the network controller can be categorized as stable, vulnerable, exploited or zombie based on the type of susceptibility. The schematic architecture Decentralized Network model using ENICS is described in figure 1. |
ALGORITHM – COUNTER MEASURE SELECTION |
| The core algorithm for the intrusion detection and prevention model is based on the counter measure selection phenomenon as illustrated in figure 2. On the reception of the counter measure selection alert in the programmable network, the data starts transmitted from the source. Considering the variation between the distance to the target and the threshold value, the value of ACG (Alert Correlation Graph) is getting updated or acknowledged for retransmission. Based on the risk probability set for the network controller and the benefits of the target node identification probability, updating of SAG (Scenario Attack Graph) and ACG (Alert Correlation Graph) are done regularly. The optimal selection of CM (Counter Measure) based on ROI (Return of Investment) is defined as final procedure in the counter measure selection algorithm. |
 |
QUICKSET CHANGE POINT DETECTION |
| To identify the change in the state time process, Quickest change point detection mechanism is used. The computation measures such as Overall Average Delay to Detection and the Minmax function in the quickest change point detection are computed for the network detection model based on ENICS. Rapid Anomaly detection is analyzed in the study. By this mechanism, we have formulated the multi-cyclic detection procedure based on counter measure selection Overall Average Delay to Detection (OADTD) on the Counter Measure (CM) selection part is defined as |
 |
| For the Decentralized Network control and attack analysis in the collaborative systems, the parameters Accuracy, Scalability, Complexity, Network Delay and System Performance (in terms of Throughput Efficiency) are taken for consideration. For a defense mechanism against DDOS attacks in the Intrusion Detection System, three types of Networks viz. Centralized, Hybrid and ENICS are compared. |
| The Results listed in the following table show that ENICS system which is having a centralized as well as secured control center and programmable network is better in terms of all the parameters. In terms of accuracy and scalability, centralized network is low; hybrid network is medium where as enhanced decentralized network ENICS is high. Comparing the parameter complexity, centralized network has low complexity, whereas decentralized network has medium high complexity, but ENICS has medium complexity only. The two other parameters are included for our simulation analysis to test the network delay and the system performance. ENICS shows better results in both the parameters. The Network Delay is very much reduced and the system performance in terms of Throughput Efficiency is good while implementing the IDS system using ENICS. |
| With respect to the graphical analysis, the metrics are tested for three different algorithms and the comparison values are plotted in the line / column charts. The performance of the existing algorithms, NICE and Firecol-DGSOT are compared with the performance of the proposed ENICS algorithm. |
| The figure 3 shows the CPU utilization in percentage with reference to the traffic load in packets per second. In the simulation analysis, it is shown that the system using ENICS reduces the CPU utilization to the greater extend. The plot is drawn to demonstrate the effective utilization of the system resources in a network based intrusion detection system. |
 |
| The figure 4 shows the network communication delay with respect to different algorithms. Delay is the parameter which reduces the system performance. Lesser the communication delay better will be the system performance. In our simulation analysis, we have compared the delay performance in three different levels, one using the minimum number of nodes, another one using the maximum number of nodes and finally we have calculated the average network communication delay of the system using three different algorithms. In the performance evaluation, it’s found that the network IDS system using ENICS has lesser delay on both minimum and maximum node implementation. |
 |
| The success analysis rate of the data transmission with reference to the traffic load is plotted in Figure 5. The Results obtained indicate that the number of successful transmitted data is better in ENICS when compared to the other algorithms. In the real time environment, ideal success rate of 100% could never be achieved. Still increasing the success rate nearing to the good practical conditions gives better performance in the system. |
 |
| Figure 6 shows the throughput analysis of the collaborative network based IDS comparing the different algorithms. The performance of the system using ENICS is better and the system gives higher throughput when using ENICS. This shows that the efficiency of the collaborative wireless network is increased using the proposed model. |
 |
CONCLUSION & FUTURE ENHANCEMENT |
| The collaborative attacks in the decentralized networks and the novel method to detect and prevent the network are presented in the paper by using ENICS mechanics. Attack detection and futuristic prediction model is introduced in this paper. The solution proposed inhibits the characteristics of the real time Intrusion Detection and Prevention (IDPS) model. The experimental analysis shows that the performance metrics shows better results while implemented using the proposed model. Future works on the collaborative networks may increase the scope of the preventive measure for the system at the time of attacks using heterogeneous counter measure selection procedures. |
References |
|