Wormhole Attach Detection in Presence of Variable Delay in Presence of Variable Delay in Mobile Ad Hoc Network

Abstract

A Mobile Ad-hoc Network (MANET) is an infrastructure-less, self-healing, autonomous, network of mobile devices. These features of a MANET make it vulnerable to various attacks. One such attack is a wormhole attack (or wormhole tunnel), which if present in the MANET, would create the illusion of a low (or high) per-hop delay through the malicious nodes. Using this illusion, the malicious nodes disrupt the routing procedures and attract traffic for analysis or dropping. Two or more malicious nodes collude and create such a wormhole tunnel. Existing literature assumes that the wormholes (colluding nodes) are located at a large distance from each other or create a shorter path by manipulating the hops in between. Because of this, the path through colluding nodes could have higher delay than the average per-hop delay, of a network. However, this assumption would not hold in presence of newer routing protocols such as Lightweight On-demand Ad-hoc Distance-vector Routing Protocol - Next Generation (LOADng), which enforce jitter while forwarding the packets, to avoid collisions. We propose JITWORM-1 and JITWORM-2 algorithms, which can detect wormholes in presence of variable delay (jitter). Our algorithm assumes that the colluding nodes do not apply jitter to the packet so that their chances of appearing on a path increase. JITWORM-1 and JITWORM-2 detect wormholes by each node monitoring and analyzing the average jitter application behavior of other neighboring nodes. If the percentage of packets to which jitter is not applied exceeds a set threshold, then a wormhole is assumed to be present. After successful detection of a wormhole, it is isolated from the network, and the detecting node discovers an alternate path.