Intrusion Detection in Wireless Ad-Hoc Networks

Yongguang Zhang

Wenke Lee

HRL Laboratories, LLC

Malibu, CA 90265

Department of Computer Science

North Carolina State University
Raleigh, NC 27695

[email protected]

[email protected]

ABSTRACT

 
 

 !"
"#
$
%"!'&(*)+!-,./

01(

(2*%3
1*4576
891:<;=>

<&?;6@1A49#B

&?&C6113<&D 61
<
EGF91H45

$<1
$10.49!#I

;1!
6JKLM6110"N1O/61-?
PQ*K6
R;=$&?*6&M8
L/2&?
-
"2!1SSC;=<<S!L 82
 ;="!%TS1&?
8
"#3!

 "U*:&?1SV!2$&(1S<&? -;=< *8W1X!

0#$!
-
!Y!W1
EYZM L !=15 61
<?/
@
0/
[6
\/%<;=O 5]1^/*_45*T1A49#OK`R!;1;1
*!N1
a
T104b<&? *EVcK4dH$ ef Lg2a0

%Lh
M
011SSX
*!
"B;<N&ME$,.a
C;1;=*8
4`]
+`^!&?P1/61"!N1
Y'-45

5</

4`#=8f1O*
X45 L349 *$ 61
<X0
<W8W2M

<i45 L?1_
6 9&?01
Y
*1!5N=-;;1*i
L E
j  1$/

N= 1 4k 61
H
0H13
;=<

&?
011
&?
`1!549-!O%<;S Q!545

_/1

4`#
E

1.
l45INTRODUCTION


-<1
-.4`#i
<

+
mC
<
<$!On.;=0o

&?N1O1
2K-KO
*;1N1Tm
&?& 61
*!1SC45H*!
0
!1O4516C1;X<&pV]^:J"
+61
06<EVF91? 

<1
<
\N=.4`T1/
\!Y
*;1N`2
"2!1SS 5

62!q!2$!N"!LMN1

E5r_/
545$*
"$*s
"</
"!1S3
&?& 61
*!(/
LhV45

?#/
8\45(1

1!_!OtK-!;2!_61
O1
_!
L/
E5r_/
_6
62L

1!?1?
!&??;1 L/

*Y&?*/u\LX"1
&?C1a
[6

S2
V!(1M
!&?M*[ 61
LvN12f851>Q*4w1M
!&?
<;;11Sh
*[ 61
$!V
;/*</1Sh
/<EGF91X!"!1# *L%
61
<1
`&(2!S<51545

P# 
6

92?
 !"2K
&?61&x!



_&?<S@1SN=1S(1/
EPF9O&?*61&x!




`
 <'yZMzP{\;!
<2
m

 1O_45

9</

.4`#iN=
*!61
O-!*45
_&?N1 1/
?
1!T
&?&?<
N/%
*!
+V
"2!11|ElF9M10.49!# AL ?61
<1
(&(! "!
O& 611;V
&?& 61
*!<V;2!



_1 .4`#=uf

_& 61
+Q61
<:
<60
_2KO

K% 2$&(! "!
6
?_
M1 .4`#=EZV<NALH1V%<K
ALaK?11/XJ<&}1@;1;
!<
C
M1!T LX1/?
*

<&?& 61
*KT45: L$ @!
9%0L <T4`@X

PREPRINT. To appear in Proceedings of the Sixth Annual International

Conference on Mobile Computing and Networking (MobiCom2000),
August 611, 2000, Boston, Massachussetts.

~<f.PW+ .\J. + .+JA ++P J |.AOA0..'< J .+ \ f. t"5 |<  AKAJ ..|\%-+ +.A~< 0+A W+ |J` %AW.JP\2  .A<` W||J.+0`. ..R.< " |J J.J  +JJ+ .|
+m   m +.5 + 9+WJWR|  JAW2.AAA . +J~<A.A+5.J+-+J= + .+"W | + ||+AmWJA R .J% .5JYAA-|
P A ++|`\.J|. J~<!h
f|J m!+9.|+ J f.P J| + |JJ |!5+= JY  |"| JJ\ 'JR|JW`  J|J 
|    |A-J .1.|J"|   JY~< V
"| . J m.?2.W "  .+_.T. tA .k
0 +|"||-W J|J+W QJ/ +  9 .+

]1^/* 45*(10.49!#=Em;1;

!<
9'<A
.4`#
`"!1S<
&&?"KLH"

*!m;="!1
V
\";1X;KL/&? 

61
":
&?S1
0LH
*!
"A1/|

6 &?

<
8\1K"3


<2!

Y1A49#
8!2T
+" "<6
R


+ <&iK&?1S
 <&!;1;1
*K1
E
F91$1!6/M-45

V<A
M10.49!#
i&(!#%
&%L
 6110"N1 ?!H<<
!Lfs
&(!
61
!"!
0#
E5q
+mt8
1 61
?`45

C1#
2/
O345

C<A
?1A49!#

61

;N1Vg!"!
0#
"!1S<S:&;2!

<M**%
<;1;1S
X
%( Q0SE:_#%@45*h.4`#
C45V!B<
%
KLh& 6
+TS%B;1 L/

*9



$1(1A49!#:45
@!
;2!

<6S<a
%"m1
T5/Q1
i!O]104P
C2XS%K
4PL/
8'!"
"#
-<:i45

T/1
C1A49#$
X
<&?T<&

1
2("!S! Li1/<Em &(!S<
P
M1
61
*#1S$

TQ!&(!<W8R&?

S?
< "!&?1!<W8R1:/
?&?;=
2KEVR1
?&?*!g2KTV45

@/1

10.49!#C4521!`1*%-
*!`!1
<8/!2 %L@
& 6
+PN=_;/;2K*i5
<6 
945MV</%
!L3/
L
2/
L E

<1W8f&?<NT1/
K@6/<<&?<6
_61
1! KC
;2K
N1TR%!&?1S(2;=2/ L EF9
_&?*!1
52!1/
45
2*[ 62K(;1 L/

`;/
0v!(
;/<($N=SH
*;/
6W8\
&?;&?
W8R!2a1 )+
"#%*WE 1
?"
"#1SH*45B
;2K
61!&?N1-1/ VC!SO

*T<A
-10.49!#(
*/
1!iN=:/<$*
L 8!"
"#
(NL>a
&?;&?
>1/$<&
451?1P.4`#@KQ!`&?1!&(S<SO2@&C61
"@2K"
C
0*EmF91<81 L?3 45

/1
1A49!#
& 6
+PN=_;/;2K*iC<;="K V &?/1!96
+
P1 ;=*E
F91"f8

&(#1S i<A
51A49#
m
`61
61L?/
/
"U*>1v&(!Lh</
V10.49!#BS<!1&?
@Lv<B1

 ;="!%@;1!
;2K<XP!\1
ETF91TJ!
0#$!9
"!
U*h!61!.La&?1
1!T1i</%
!
C
*h0^;<C

6110"N1.L?5104.L/;=
`!\K"
"#/
5/
S<*(CN*!#@1

 ;="!%TS1&?
E
1!V^!&?;1<89$
6 VZMz;
<
3V45

V<
1
1A49#
OK?m/61"!N1<E?1<6S<H1@!@&(!L
ZMzI;!
<
8/1_N1

-49!#S ;/
;1
5K_
&?JK*Em,.
B
<  </AN1
*&?W8*
"1/g& 6
+V
<&?;=HQ!

!1`"
&?


"21*!
0T&?`R
2/
\_&?
+

S<ECr_
-& 6
+_
+
LHQ*4G1T;A/]2*$;
*/6
CK<<?
<
1
P!9 
K%9J<&d1&ME',.i
<  </
M&?1f8`
">V&C61
+
#a&5(1/
?
611&?61
@;/<&?
V! !>^/
6
<M61
3-V
"2190

<6/
<8W<:(<10&?O_
6S3N1

EOS%!"/

m1

AL/;=3!OZMzd;/
|89_H13N=2*%
&(
<6
L 8Y
ZMzG;
<P
*!hN*!#a*45BB$

2KH
& NSH
/1!!

(!"!
0#=E?1<6S<X
61
"gK"
"#
O!@"! 
45*@.4`#
RN=
*!61
P1P;L/

*!.4`#
m2T1ZMz
L iK$
<!*v<& M<6/
V4`>N LBL  S<!
49L
"*]149
8R%LX&?N1 1/?

<&?;0L:6"N
V_45

_;=V&?61&ME
/1
P61SO;
 
`!196"NAL ERZV<
+P</

61Sh;/

VKH
B
 <;="K%HI2!6/
E _/
#%V45IX45*>.4`#=8`45M^"H;!
<>
*>N=
;
*:<g6
T1gS%K4PL/
8R!h</%
!LX451V1 )!
0#

! /1
m1/`
61O;2!"!LUY1m Y45

\.4`# N L
/

&?2!SMt
(<6/S$Q!&(!<WE j !
<8\
6
0gQ

61S /Q!&(!<3
<6J(
61V&?

!S<
PJ<& !1/

N=S Q3 1_
<&?;/<&?
*3<E
A,  61
<X;< :&?
6
8'
6
0:
O
L/;<:1:!6
 
*!<W8!
*ON=m61
* T</
Y.4`#
P*/61
m6/

1
8fN16/_
1&?1! 1&ME51^&?;<82
L/;<
!2?!61
*K<?
*!11!9/Q2?S<1
+`
<&?;/<&?
* &?!
N`1
845
"
!LO1Y;<K`#%0L
E',. S!AL 1!
6
1SO*621! Y/Q&(K<XyQ<&bef Y1/
"{08
61
"i

<
$N=Sg61
vI

6M61
S

/
8  |85
a
(<
 61
+.4`

m_
81451
0$
<61M#%45
TN=
T49*!#31#(Q!
;1
+
*K*$!"!
0#
E
F9P1
+LT!f

6ALT
*!
"@2!
\"61S R61
R_62!N19
+

&(K1*4h&( L6
<O;<  &?*
6/
qK

*@?-10.49!#=8<105!4PL/
m
<&?949# 1#
\2K
1@
<61H^/;1<-iN#$ET,. 6
g/
:;/
 

M

<1g4P9!1
i1g 
C$1


ALgB!L:1S

6/NAL3.4`#=E
,A(
61&?&(!L 8%-45

/1
10.49!#@2!
91 961
!N1
O1!TK@1! *
LX;< "N1<ECF'3N16X3S1L


6_45

/1
1A49#=849_1*@ ;*L( 61
<
/
B2g
;=<1
(
"1J[ 6
8R1gQ6/1T
*K
0h




KLC_<;'1
`
01[ 61
'1
\104B/1&?/
*8<<&G1YS1=!;1;
*K<1
Y@]1^/*C45*@.4`#=E\,.

T;1;=*849?;/<;=<
?6T104G&?\Q!  61
a0

g!2V
;=1
 H&?<N8W</
T45

.4`#
E j 
K
6Li%
+S%KS 1_61
-!\
 <;=0"!%O
+"!
+
*
!1&(L/
<&?/
iV;
<& K"
"#
V<
/1
-61SC;!
<
8=345

_ZMz7;/

81<
45

_;;1
*!<
_!2V
0/

E j  !  S"K1S@1&
 ::


+AL i/Q1
V
+L/
+& 1>KV%
+S%KSg

0ef
%

82 @
1
L 8!2V

*!N1.L E
2.

BACKGROUND OF INTRUSION DETEC
TION

.4`# N2!
*M
<&?;65
+L/
+&?
;1L3
*!
S<L$"


V7&?/I


AL 851Lv2*%$N=
<&?MM"!S<0
3!
6O&?
O1:
&?2!
E j 1a:6
<Iy|/]2*X

n. Li
P!R
1
92K!&?;/`C
<&?;/<&?
- S
AL 89
]2 .L 8P!3KNALI!T:
<6/

o
Q{@"#<

;
<8`6
<v;%B
01[ 61
8Y
61
"v
@
L/;<
!2T6/1 
*!Vyt<E SE8<61
1S;2

+4`"/
\RN1&?

"{08%K
6
62!L31-]1
+1Om/Q1
<EPc*49%0*82 61
<M;/%/
g!1C
1!-
6 @
 -N=
*!61
 
-
+L/
+&?
N=
&?C<
&?!5
<&?;0^W8451

6.L 
`
+2J?1!J|1<6S< *8
T!C4PL/
_0^;<"NO49#1


_M1O
+L/
+&?
6
O/
S<(!2@;S"!&?&?S-!
8Y<K61
Tn.

!L(S<

1*o?;=1"KM

"11[ 61
Ty|!
61
+"K*MM1-

n.
, K%
 Y<6o361
"{0Ei1!O^&?;8'<:<61SXLH49
]1
+P;=*i&( L?L *K
5S</810^;<"N$nAN16/ef5K% 2*45o


6/.L(1
8451
0i
*!V*<?Ci612!6U*? 5

t8f
+R^/
+-H
<&?O
_
+L/
+&w
!A4P!
ET16&?<8

?61
+"K*>N Lg
 ?-
+N16/*v_1J 

$yt_
 {5K"
"#
61
"1*VS%!1
+-
%"&(K).,. 



4510$

6ALI&?*!
6
@4`HI;1!
<8P1$;/

V!2

+L/
+&?
\2K`K
S<*  ;KP


yQ-1P;61N
K{
!?1 LX
61N)+
0 $!"!
0#
O
61
"a!
T_
 Ef,A6
<
0
<a
gN= 61
*a!
T3

2:49Y3;!
T1A49!#

+L/
+&?
ON=
*!61
(<
ia 61
<g
C0
*f8\<E SE8mg1
*KLT
+"!S<9!=5-
 !"!
0#=8!
;=<
9
*TN=`;6\ ;1

(&?1&?UT1&(!S<
8fS<!-1
 Q! ;

6/8W!2
%V61
"V
61 A!"!
0#
E
F913;&(!Lh

61&?;/<1
- 61
I/
<I!361
0
1M;S"&w
0
KCN1
N82Q! ^&?; ?
+L/
+
&D611Sa&?
011
&?
u_17&?$&?;="!L 8P&(!
176
<
0
V1*%X
+1
3N=2**EG,A6
<
0
<h10Q!V%<%
T
*!;6S:!62/@1K"X!2g*K

<1STN=6`//1
5?11K"-C/&?1P451
1X
+L/
+&D
3611V!"!
0#=E 9
*<HAL/;=X!@!62/
1K"i6
*W8W 61
<g
<X
+L
+&?
yt,.
"{
gN=T
*K
S<!U*v
@.4`# N2
a?<
+N2!
*WEg 1A49# N2!
*
,. 1!&(LH611
OKO1@S<!49*Lg531A49#X!2 nA
*;/
6
o:!2g0^1!&?1
T1A49!#g;2!
0#<
T1!TS<$/<61Sa1
10.49!#(2!"4PK-0t
<E91
+N2
3,. 
5<3<;/
"KS-
+L/
+&G61m1K"-&?1m!2 !2!L/U99%

S<1"K*:N LH;S"!&?
O61
0
<H1@<
+*EC,. 61
<:0

M
01[ 61
5
*!$N=O
*!SU*$ "
 !$#&%(')%*$+,*.-/*0-1#3254
17
 654825!965: ;<+,*.-/*0-1#32541E
ZV
61
:
<
+L/
+&?
8<E SE8-,A-, -=
F
>T!2 F'YF=
?|8
16
;2K1
YW49#1*45i!"
"#
`!949*!#@
;=
`f1
+L/
+
&x(&(!
"H2$JL$#1*45$6
<1
E-1_^&?;8
(
S2K6C6CQ!-1Xn.S61

SV;2!

+49!":K"
"#/oi
*!:N=
nAC!T&? 2!@
 (Q*$<S<:!&?;/
P457
 A@&?
6
oERF99&(C< "!S<9!2&?
61
P/
 
q2KRq
*


6"KL(1@ ?
 L(0
Y
+"

`!W#/*45(!"
"#
E
F91O&(!V
</<! "S<O
52!J!
0#
51O!N1AL3(/

161Li1K!%@yttE <E8245LV% *1{`!"!
0#
E
<&(!L7
<
+L/
+&?
8QV^&?;8,A
B

A|
8 2S
< N
%*!
/
V1!V!X
S<]1
* L7J<& :
+
"N
*h1!&(`6
S3;/]2

1&(
8mtE E8m;=

N
 61
<
EH1C^&?;<8'?1&(!`;/]2(M6
C&(*L

"!i-*%"!S<*(*[ 611


9!q
&?_
+L/
+&b
<&?&(1

61
 @1
RY1m<S?


<1
Em,2Q!9_


?2!m
RN=1S
&?<*f8/_[61

K
S<1]1
* LV*490!1S<*8
1V!M<&(!L3!JK&45N=_"
*fEYF91-&(!V</<!"!S<
!1<&(!L?0
<?
Y1!mP/ 
Ym*[ 615;`#1*45
*/S<@!P6
<:2X
*X61
/
 4G 61
<
E?F91
&(>
</<! "S<V
@1!?(&(Lh?N=VN1Vg

0N=
452K51 K"
"#3
1V&(L(2*%-SVt!
T;=
<-"!<E
z`<
;/62L 8P!> 61
70
<v&?t8YtE E8P:&?
61

0
< 61Y\51!&(%;/]181
W1
m.495
&?;=< 

C

1ED*65-1')F(*.%-yt_!N16/
82&?*!
6
"{08<E SE8Pn1O61&@

N=5t*VS<$!&?;
o8Rn1 *%0"S<i[61
0L
_H
 G0(0@
<&?&(!2/o8Y
<E892K?<S1i/

N=$
S<
*!q% *8/<E SE82 61
<SM


<Wu

1 !2+,*: #&4)G 65: G25F.# - ! 8K<E S/E8!61N1
*-;1!-&(K

0/
1S/81!61

P_Q*K6
5@JL3 61
1
E

]2S@
05
8F*+5#30-1#5*9Q*K6
P1!


6"KLV
*!;6/
_
9;
 "!%9N=1*/!
m!f6
%9m&(
0


`_&?
+9&?;="!Y
+;iiN611SC(ef
%_ 61
<
/
v&?/t8m1a
*BN=(2;=2/  !i
S<B!
&?/1S?!S1&?
E
,A<5>/8  fytTE E!-1
P
* 
*!
"
\!).


S<
L1{9
;=<1
!*3-]1
+,. 61
V-
<@BR<!62!

6%L?_
+"K|A!
*!
"MV 61
M0


5|EhF9i
6
2/
!*a2KC?
*!
"B
+L/
+&?

4`T& 61
"M&?!T0ef
% 2!M1O*</S(
<&?&?
J!'
+L/
+
&?
EGc_*49<*8%7$N=
+V
!
"l
+L/
+&?
?Q*
/
-iKS<@61&CN=Y14 !"!
0#
8W1
62/1S?1
C2K
*i@6116U*i61
! !



E
,_
%L3<N61
52K 1&?
82#/*45S@2K_ 61
<
;/% <B!2h/
<h
+L/
+&?
C!i1
+"!*hh<6/@
4`#
8145\K&?;P?/%;$1V61
0V14.L/;=
5!m!
"!
0#
E3,.h! 
;1!<gP1
(2
8',. 
*K
0
K
/
S<S>4}


$!271
X104 61$!"h
<6/


!2 *!6/
8/14I<&(L@
0iS<!&?
8 
"11[ 61

i
& N1Sg!1&(L>2B&?
61
$/
8P!2v
+L
+&
K
0
6
T?/
S$
+N16/*a1g
 !"2K*a
6
<1
E
3.

PROBLEMS OF CURRENT IDS TECHF9_NIQUES


+5/ef1
_N=A49?.4`C.4`#
9&(!#%
`P<L

/ ?
61C:!;1;La 6
v
0h
01[ 61
C%<;=*
Mh]^/*>45*710.49!#>v/1
$45

M.4`#=E
F9:&?
+i&?;=!" Vef
H
i;=1;1
i2KiHJK
/ 
O1!C1*%?3]^XJ"
+6
6<8\2H1Lfs
T.4`# 
N1
*$,A
8451
0$LV<M*!|&? " ?
C1L/

8f
*H1
1S<0MQ61
<4` 7H14 /1&? *E z`<&?;1!*
45T45C10.49!#
q451`" ?
9&?11S
\61
61L /<
K
+45
0
8f<6/
-!2$S%K4PL/
8X<A
C.4`#$/ 

32*%$
6
07" ?
H
<
 "!<;=
(4510HH,.

$

0 61_1!" 1O  1A49!#fEPF91<8WK
! LM< &?821O<L$*<!J!N1C62/"!
T45\N=O&?*
:
<&?&C61
!<v
0
?"#1SX;1
V451>3"</
"!1S<8/1C15 61
<(/
<(!S<&?
Y&C61
+mN=5&(<
C49#i<31
P;2KJ!q!23
*!U*$/Q!&(!<WE
F9@

2XN1SM/ef01
 
OH1@
&?& 61
*!X;1!
lh45

H</
:.4`#=E j 

$6

327BN=

+SL N=6H
&?& 61
*!<l/61:>
K4`X#
8 &?*
N11/45/W8%1S1m

+*8 1 N2KLT;=*49m
1
+" 
ER-
+

<1
*M;="!1


?RKO%L3
<&?&?VV45

-
4`#H!;1;1
*K1
8'1H
i
-
*!A;=2-
<&?;61S
!9!1Y
01[ 61
\1!PK
L(
S1*@Q!`45

P
4`#
1i
/<& 61
i3_45*3/<&? *ER=1


6S<S
+_1!1T<&(L3&?
5Q!_45*$1A49!#V
*!11!
N= 6
*W81
5
831
514l<1&?*E
610&?<8f10 &(L$1!ON=@i
*!O
;1!"KaN=A49
&(!
0LB1h1&(Lhh45

(<A
3.4`#
Egx/
/31!C
2/
@<6/CQ
V<6/1SHQ!&(!<v
61hN=i
1@1! 1
ON=X
<&?;/<&?
*f8'!O&?LH1 1 1!O

&?;="!LX<6/OP
+L/1
@61TV%!?;1 L/

m&?!<&?

*Eh,A6
<v

<B&(Lg]21h 1
*!
1S<L>?
61 

+1S61
VQ
T!&?
P& * 6
1
E
,.h
6&?&(!L 8q4`V&C61
+C
+49@i<*45Sg
*K
0v[ 61
+
<
Ch/%<;1S$MN( 61
<a
0a
+L/
+&}Q!
45

-/1
_1A49#

j 2 K(
iXS< I
+L/
+&K
0
6MiN16J/1Sg/
61
<I
07!2v
;=<1
$
+L/
+&?
C2!?]
@1
Q*K6
q45

_<A
-10.49!#

C

j 2K9K5;1;/<;/JK_!62/`1K"-
<6/

Vc_*47
49-/
P1&(L?N1
*(<(;2Kt81
*!W62/9"


(q1L3K-1 <Li!N1T62/
6
 
C

j 2 K'
q9S T&?/!1


'O945

q
<&?&C6
1
*!?/1&? \2Km
*@
;2!"K_!1&(LC45
612/!"!
0#
P&1-&(!
0L

1!_1 
+R
;2!;=4`T45R</

1
O

"2!S<1S
;N1&?
E
4.
,. 6
NEW
ARCHITECTURE

<1I
;=<
g
+L/
+&?
(
161N=HN=


+N16/*I!2v
 <;="K%Mg
6MM1*
?!-45


<1
?10.49!#
E(,.g6O;/<;=<
a!
"1
6/$y|qS<6"
 *{08
%0LB1Vv1V45

3<1
M.4`#B;2K
;1!
(
 61
<X0
<:1$
;=<1

E BY!
0H 
_
;=<1
N
Q!3
0Sg
S<
(- 61
I
*L!2B2;=2/ L 8
N16/ S<N=SX

*h
J!N="K<L>%
+S<!iv
N<</5"1S<E
,.MC
+L/
+&?

;=
*8f261q,A S 
-!T;1!
*H<
*!
0B!2g<LX1@
E Bm
"a,. S<O61
O2;=2/ L
1&?<1!
3
*!C!

gyt
62/SB61
V1
+L/
+&@

T

8R1:
&?& 61
*!g!
/
O451g1C"<
"S<K{0E3,AT/

T 61
<gJ<&}
*!`"

!2:K


;=1
<EP,R<&(!LV
_/
*331 
*R!"82\1

$
3
<
61
%X1gN<<0V
*K
0
(4PK" 
*f8S<N=SC,A S<
945W
 <;="K%Li;2!
;1!-
S<N2\ 61
:/
:!
<
E F91
C2///62',. K
S<`
<
%L?&d1,.
+L/
+&dC/Q2@1545


<1
10.49!#=E
F91H 2!_!T,. S V
N=Mt!L7
<&?;0^W89N16

1
;/62!Li
*3N=-
+61
6/*( C
^3;1

y|qS<6 A{0E
F91@1!"(

0h&?6T
-
;=<
N1@Q!OS%!1S3!

*!q615"

-1M
0.L3<S
EPr_^*81 
*!\0
<
S<1@45Y6
 1
?1K"3M/
O
*!9<&(!L E -
0
<>&?1/
C2K?1*vN/%i!":
0
??2K@*[ 61

!N="!1
M!&?<Sg,. !S< 
@45_61
31V

 <;="K<
0
<>1S<E7,A 61
<B
;=<
$
01
i!V;KJ/*
N L7N=!H
 
;=<
g!2S<N2-
;=<1
:&?6
E
F91
*=
;=1
_&?/615SS<
5!
<
9
*=O1
9&?
N1 1/<8/Q^&?;-V,. S<!0S@1-
*!'6
*8
451VVS<N2<M
 !"2K
(
1
i&?1SX1S<N=!
1S$
8m
61
"h!
C1(,A S 
Cai.4`#:
1S
3&?/LX
0E3q2!L 8qV

6/?
<&?&C611
*K<X&?61
;K
(X1S</
</]=1
3
<&?&C611
*K<v
011&?1S
,. S 
E

IDS

intrusion state
response action

IDS
IDS

IDS
IDS

IDS
IDS

IDS

IDS



  
 !"#
%$'&(*)+

!, !-#-.*/10324&154 67&8
IDS agent
local response

global response

local
detection engine

cooperative
detection engine

local
data collection

secure communication


>61
@


3H45

i</
V10.49!#h7H

6
1>NX&(1(
31%0(*
+L E F91<849HN=%
2K(1$,. Q!Mg45

$/1
$.4`#v
1617&(
LM6
C
+"K
+
*!m1&(L$/
H
01[ 61
E5,A$S<"t8
1;
6_\N611SC
61
"V!M<&(!Li/
V&?

P1-Q*451S 
C

C
system calls activities
communication activities
other traces, ...

neighboring
IDS agents

9
:
<;1 >=&?@ !A#B,DCE&1/ !,F$'&B(?GHIJ !?1
4.1
F9?]1Data

+C&?Collection
61<8'
*5!"M

08mS%K1
T
+*!&?
C!

|&?962/R1K"& !<6
\
<6


E\-;=2ST
 61
C/
C!S<&?
8!
m61
61 !"P
+*&?

*

62
+L
+&}1:61
0T

O45X1@&?N1 <8

<&?& 61
*KV!

5N L@
P<8!
949
P
&?& 61

!<v
0
451h1?"$"1SV!2aN1
NiN L

-1/<E F9Q!<8& 61;1T1K"i
<
<:&?61

*

 ^/
+53<1,. S 
9C;/K//_& 6;-61P
+*!&?

Y5& 61*L%q S"K*C 61
@0
<T&?1?y 

@
 %{0E

4.2
F9: Local

*! 0Detection

<S<1:1L/U
(1H

*O!"g"!


S<!*>N LaV
*!!"X
<
<I&?61(Q!(J/1

!9!1&(
E `
*!61
C-
_
<
<!N1C1!1T/6& N=!
45Lv
*!I!"!
0#aAL/;=
@&?<6 *h<B45

3.4`#

45m
*!
?[ 61
0#L$!
&?C1X&?!C.4`#H;;1


N=
<&?R45

8%49Y
*1!\
&?;1L-&?;KL 54h^/;=61

1!C!?1L:
*;1N1(/
SV1 4 #/*45g.L/;=
!
K"
"#=Ei16&?<8W6;f1!S31C61N2!
 45a14d/

1_&(!W;/]1
yt|E <E8/11&(!fN=2*P;1!/

"{(K$
<&?;6*v61
1S:"
X1K":&DknA"!1S<o
;


54510O'!

! &(!|u
13!<
& 3&(`;]1
?!i
!"*
6SOMnA
+1SoO;


m451
<&?5&(1?N/
1&(!W

CytR*N1K{5! 
62Wu
 0
<3&?f
P
<&?;6*?&b1-!<V1K
"gB
+1S<6
l&(!
0L7!2<&(!
uT!1<6S<
1P45f4PL/
`N=in.45oO1&(!2!
/
`1!Y2*%
13N=N1
<*IN=<81V!1
3J<& 1
1&(!q;!]2

1<6XN=T& 6
0M
&(!0-2!M1<
C
 6
1
E

,.O;/61
W49#_< ]1^/*_45*O1A49!#/

#K|8!49Y2*%m<

<;=(. ?
 P!" &?11SO!S1&?
mQ!P
<&?;61S &(!
" @
i;1!
TJ<& F5z `K, k"!
V!"ayttE <E8 - 0
+5')!


<6/;16/0{08%!
m4`2
R
!

]1
*!i
"1[6
qQ!mN161S-&?
+
61
M2v<&(!Lv/
I&?
EIF913
61
@& 1
  >@ f BR62KM
1*4`*i1!P1-
0M&?

;/61
VN LV6
+L
+&1<M1OR1 N=
+_K%"!q;=Q!
&(

C&?1S$1(;2K
;2!SX
+L/
+&?
E:F93&(!h
"2!
1S
9_K_K4>T]1151P"
_1K"/8/1?1*4IT0
&?11.L/;=
9!q;2K1
Y2!9N=
+

0N=1_&(!
N=1K*E j O10CKC&(! LM!1<&(!L$0
<H&?

Q!O61
-N=2*O!2H
+L
+&
0
?yt<E SE8
A8 8 {08<6
Q
61
(1V
?I4x&?
(45

3</
V10.49!#

y 
<H
 ?{0E
4.3
L 4 ;-1Cooperative
-1!0

5Detection

*L$@#1*453 6
$<&(K

L745 % -1F 254)GXJ/1

>yttE <E8_:/
6XS<S*
2!
5C%0L?1S<3

6"!
L("!K{08/
*!M0&?11;=2
Lg1! (1A49#:
611 !"!
0#a2a
B1!3$0

;=<
<EcK4`%*89-g1/$0

(I<&(LB!3 6

<(45i4`*#?1
<8!91

`
<
61
%N16

49!"!
5N/%</P%
+S%K<85

*i1!OT
 <;="K%
S<N2!' 61
<M
0M;
*6/<EmF91
;
*/6_4`#

N Li;;2!S%!S(- 61
<$/
$
+"! &(!H!
&?1S1S<N=!S 1/
5ytRQ6/1m/K45 49!" f1


!L1{0E
F9O 6
$0
<$
+"K /Q!&(!<$
*!V"S< &
&?0-%JA
<]2
 61-
6
0M

n j  

</]=1
<8/-
1
62/
`J<&
P
*
1K"C2KP1 
V 6
1o
n j  

</]=1
<8/-
1
62/
`J<&
P
*
1K"@13S<N=
+"!
1!P10 
!V 61
<o
n j  

</]=1
<8Y1/MO8 8`z8EEE>
<
%L

1
62/-2KP1 
M 61
1o
C
C
C

@ &?-
;=
]2

+"! 1!5
+
-
61
;=
0
81#%
n j  

</]=1
<8/-
1
62/
`J<&
P
*
1K"C2K51/k2!
5N=M
&?;&?
o
C

!9CT
&?;1
*!(
"(
62/ST
<&?;1
<E

O1^
+;824`O
*X0<Oi/
+N6*M
<1
1
61
_
S1& 
&?;16C4 61
<V
03
+"K_Q!51

<8W6
S(10 1/
s=
+"!CQ!&(!<H
<*M
 
L E-F91CS<!&
*!X
62C?49S< *$
&?;16/"!<H61/
/O1(!

61&?;:2KT1*KNLX
O2*%?S!*!0C0ef


1 tK\4PL 
8!tE <E8<S/Sm&?&?*/!R1S/N=!

S<1
+6
5V<!62!S 1- 61
$
<V
+"K
E
 O^&?;<83&(*)+AL/N1
*:
+N16X 61
<:0

M;
6
M1
61__Q*451Si
+;

C
C

1T1/C
2
(1S<N=!S(1CnA 6
>yt!

<&(!L1{`
+"K-*[ 61
+o/u
*!
0H1/(yt
62/S@1O1!<HK{P1M;/<;1!
S%K
C?
+"!(&(!8\2/
*!1S$?#% 
2C 6
 !R<&(L 8!_
\&?&?*KYS<N=
u
*!
0C1Y1C0&?
'451\ !625F #&-1;9!1

<*B;=
@2/
*!VB6
<v(!1<&(!LWu`
L 
8!1T\
<1
61
2!'1`.4`# 
q620\!"!
0#=u
654;_52!P
0
Pi6
<(T_10.49!#?
*
1V1! 1
;=<
 ;
*/6<E

F9X"K<2!
MN=1I1
V


"1&?:Kg!
3<K45
E 62/
!"O<& !191
P
*15N=61
+*31i
<61(1!5N=
6
*CN=
*6
`1Y
<&?;/<&?
*O1
\
*C
2 t!
]1*@1K"/E
c*49%0*8%1P
&?;&?
 1/
R2*%P1 
 %
\
2
;=
mf 61
<2<&(!LCN=
*!61
P1P 61
 
;=<

&(L3
61-M-^/;16
M&w1O.4`#=EF91<8
61

9 !9625F #&-1;_!'_1/
5!_
<&?;/<&?
*W8i451
0


_15W15S&(K
m452;/<N1N1L N=_!N1O/


R19 61
<T45@
+<S-
P1T45/
;=<2f8<
!N=K%

"1&?T
*!a0
- 61
:<X45$1CJ/1

K162!
5
P49*!#=E

45

$1A49!#7
M1S<L/L/2!&?

$N=
*6
g
3
*
&?K%5(2?6YW151A49!#fEmF9<8451_
"i
61

q6
<=!<&(L-;=
J<& 10\1/
8!q 
'1
LH<H]1^/*$.4`#M<;=<SL:-&?& N=
;$/Q!&(!<
V1-
+N16V0
<M;/


EY,A5

&?;1$!625F #&-1;
%!S

0&?P451 654;51P1!`
0
9? 61
?
*
1!TC
;=1
<E
4.4
F91.L/Intrusion
;=_!\6
<Response
3
;=<1
-545

</
_10.49!#

;=2/
_<H1O.L/;=TY6
<8fTAL;=T`1A49!#M;!



5!2(;;1
*!1
81?
<]2
TytP
0" .L1{m
1_J/1
<EY15^!&?;1<81-
C4k#%Li
;=<
 
C
C

1U1S_

<&?&C611
*K<T
011
\N=.4`C1

yt<E S81
-0A#<L1{0E
,+JLSi
&?;<&?
*$
O!2$S%!1U1S
1-.4`#( ;
62--;&?
*3
E

1!?^&?;8Y3,A S<@

*v1!JLh132A6
*8R451
&(LX:6h/M1
"!T*45h%
+S<!<B!2:"!#%(;;!
;K_!
<ER,`
(
O
1?HnA6/1 
*!1o *[ 61
+
i\1/
_$1O.4`#V(;&?;51T1/61

5i6/
1
*Km&?
%
my|1-1
\145

\1
"{08K61
1S
<6/N=612@&?
011
&?
5yt#%<8 Q!P^&?;<8%
62!=
< "
0

"{0E _1L@0.!6 
!*(1/
8 451
"3&(L?

%L
1S<K_ 104I
&?& 61
*!@
011t8%452
S<1U*!
0
V
VS&(K<EbF92!3
8H
<&?;/<&?
*2K&(
<6

1/
5
*VN=-^/
62/*WE
5. ANOMALY DETECTION IN WIRELESS
,.H1AD-HOC

-

<8W49 NETWORKS


6

1*4 3N61:!1&(LH0
<

&?
5Q!_45

1A49#
E5-0

<$N1
*M$


$ef5.4`#(L 
5&(Lief31Q&(K2(1
&?61 m*<!J!N162/9!"O
R49f!
Y1P&?/1STS<!
1&?
E c_*49<*8'4`@N=%@2K-1 ;1
;?N=12$1
;;<
"1
`45=N=51
&?<ERFC61
+"!<6/P;;<
"8 49
Q
61
<6/

61

<
$<1
-<6/1S@;/

E

5.1 Detecting Abnormal Updates to Routing

F915&(!Tables
T*[ 61&? R!W?!1<&(!L@/
<?&?//
m*4

t!
i;=
< "!<8
*!
61!*g
1C;=
 "S?`1&(!

L$!K1
/
X!
<&(!
8!2$1S<$6C;=
%
"!8<
*!
61!@
'`;=
 "S<`=!1&(
R
*WE j 
1*Hi]1
+O/&?1T1T"
?!"(VN=@6
*H1!-45
N=*K 
 !`&(
LMO!1<&(!L EO1 </
T61S
;!
<
8m
1
??&(a
1
g
O2KO1@t!
i61S
&(!aS<"!:N LX3
&?;&?
X 45`N=?/
+

&?2K*ag!2B61
*hN Lh!1?
8Y493
*>]11(1
"
-1K"- /

N=<8 Q!5*
"(1/<8 11!&(qyttE <E8/S<
&(!K{`6;f1K
5q61S@/Q&(K<E
l61SC"N1-6
62!L3
< "!
82KP1-&?&C61&M8%-10^/
?<;h:
"I/
+2!I1/V!2h13
+"
ayt61&CN=
5<;
"{0EMbS&(K(
011S(:1@<6/1SM"N?
*hN=

*!61
*XNLV1 ; L


*!R&?!<&? Kyt
"{9P%yt
"{!O1A49!#
&?&CN=
1;
"2S<
E\1m51/<8<
\*45T&?!<&? q!2 1

-
+"

K/E K)
#K
K/E KA
EEE
r

-
0

EEE


.L
KE 
AK
KE 
EEE

Yz`

Yz`c

AK

>"K

EEE

?

?K

EEE

FB
@,  1B<A , %F

B *B  B $ & */10324&1.&#
? 

"
2!1SPC
m*45T<6S_"N5K`1`<1L<F(*: #36: *'/Q!&(!
O1!'
*! 61
+*Ec_
<8*49R6
`!"9< \1s
;1 L/
+

*!f&?!<&? 
`!2@1

;=<2/1ST
011S_i
Y<6S
"!N1-!
YN1

9f"!
_!"EmF91;1 L/

2&?K%&?

T&?*
6/*:N LX/
+"!1
8R
8R!2:<
.L>yQ1
T1!"

VN=_<N"!1*iNLiCN161

  /
K{0EmF91-61ST"!
N_
"2S<
P&?
6(N LC1_;=0
 "S_'
01S<*@<6/

y Yz`_{08 1 1 yt;=
%5!`S%K<K{R;=0
 "S!f
011S

v1M
6&  <;
? !V<6/
$y `z`c-{0E j V6
M;=

 "S<
P
Y&?*
6/&? 
RN=

*6
_!W/L/2!&?
51!65!
45

(.4`#
VyttE <E8`361&CN=C1
"K<6/
?
@1!
]^/*2{0EmFq!N1
 
K45
5
&?-]2
<1f"
O!"C_ 1/<E
_61S(1XnA"!1S<o3;


845@i%
AL$Y1!&(

61!<
K_
& 6!*f8/"!
 !"O
PS<!*i5*!
0
<EqF91\"
`!"P

W 1/
W-\"11S5.4`#
K 1:!S<S!S%K*g 3i
1S<?!"(
*8f451
"g/

N=

!&(!P
011S
?v61SH"N
@Q!iP1i1
EI
/
M&?=45
"V
5*!*iJ<&
5!S<S!S%K*H1!"

0Y45210Q5N=5
*!;2N!f<;="KSO<( L 1P@
.4`#=E
7&(!;/]25<@P"
1K"-?ef
Y
;=
]2
m

JK<M!';L/

*!W&?K%&? 
m!'_1/-!2?1
011S

h1(<6/1S$"NE j 3
*!B61
(1?Q*451Sa

"1&?(

<&?;16/_1_1&(!;/]15
C

C
C

1 Yz`  0:

6% %_yttE E0(254 0 *
8-J{08W!2$
+"!1
<82

8=%
AL 82!2 Yz`c 1ED*(6-1' F*.%5

N11S@

1
;/*u
61

 $



PT;
Y1 `z`61
` $"S<
8
Q!@^!&?;1<8q4`i
h61
@
  KH
J!



"B;
 1S
#K?;=
 "S<O;= 
(2K
82 "
T1K"@N=<S<


 X



u
;;1LV@


]2
*K<XS<!1&x 1O!" ?*!M



]1 `z`Ou
;=*K`!N=K%PQ `z`cT8%2K`
8*K3
!

]19
Yz`cCu

w


]2
*K< S<!&M8<E SE8_,   Bm

.|8_
*!61
M
& 
+

&?2KS Q!6 6
9?

N= *
"V
1
;
?
*E-1_^&?;8=451H61
S Yz`d
1T
<
;*8f,   Bm

g6;6-
J!

]2
*Kg61
_H1TQ!&/Mn._y|
+"

 Auq
@-EEE o/E BY!
0
 KE K (r_ `z`c  AK%{ `z`

J!

]2
*KX6?y|7nA+o {1
gn.
<]2
o?6182
*!
6
K*M
P-;=
 "!S< '
"/
P2!5&(K
0iN=i1_6

<2/B1:61?

1
61
h<6T!<
@1!T&(!
":
6i
<2/EHF9?


]2
!<B61
OQ! Yz`1 `z`c
S<Y

0N=9451!Y!9-yt1!&(J{'
2<
\2!R

JKC45$1iy|&?61 "{61S?"!N1C
"2!1S
E j C6


-61
!
5 1!&(f;!]2
E

Yz` /JK<

KE K
KE 
KE A
KE 
KE
EEE

Yz`c /JK<

KE K
KE K
KE A
KE ?
K
E 
EEE

z`!


&(!
&(!
&(!
!N1&(
&(!
EEE

FB
,: %;1 1B<A ,  
B #
&?  B( B

z`1
0#1S_T<N1
0%* "
P!"P
!"3yQ2Kq
!"
\5<6/
1S_"!N1561;f!K{45@1`;]1P%%
m;;1L/S_1P
J!
+

]2
*K<36
`O15
"fEY&?

!

]1
*!8<E SE845
1 6
_
LM-
3n Yz`
 oiN6$t
0--
in Yz`
 ?!o/8

C
<61 *h!
M<KE j ?
*h6
(Bn.
]=/1
o$
1T<!*M6 
1Xn+/KH

o3m1 
!"WE_,.
1?n
+1SoT;/


8 5!<


`!P
!"*fER1!
^&?;<8W9N1&(!R1K"3
O*<!!N1<8'4`@
*!:1K<@/K
<V1!"C#%1<
_
1*45VMF'N1 A E j _
*!3M!;1;1Li



]1
*!<aS<!& V
<&?;16/T3


]1*8qi0
<
&?|8=1!_61

_ /!<X


_V/
+S<6
:N1!
&(=J<&x1!&(tE
,Am!N1&('1K"@
1!-*N1<8=4`O
*$
&?;16/-1O1!
&( 0: ')% -/*.F %mf1/JK<(


8/45*
"(

;2!`

;/
 *HNL$i;= ?y  +,* #365-1#125418  +,* #365-1#1254{_
1@A49!./&?1
<1Y
;2
<8R<E SE85y K/E K8 K/E K%{085y KE A 8 K/E A<{085y KE 8
K/
E *{08\
<E3F91hnA<6/
o/8RtE E8\<
@1!C31TN=1SV
 LB&(5
6
+*8P
*!>1IN=V
<1
/*7!
(1&(
E
z`61
+SX
CaQhH!
:nA61/A
6;=
*g*!1S<o
N=
*!61
O1 "!S
61
+
_!T1#1*45 6
F.#32F.#QE5,
_/
+
</<! "S<(
C1!T1(
&?;16"K<yttE <E8m?Q&(K<={O

61
+0
V
V%0L>&?$
1
61&?SEG,A X;1;
!<
<&? CK45
 - 2: *.F6: * t!
3K&p"K<8R<E SE8 A
8\
1_
61
+1S@S<!&
*VN=-;2K"&?UiC0&?1!
4513
6 ?
 *8/<E SE82S!*!P1 >
81;=
9!-V;/<;=

61
+0
E
;= P;=0Q&(!1
W1!1<&(!L(
<i&?t8 <E S/E8
1S1O2!a!

;/"N1@Q
i!&"K<8\2/
!
2K 1
1K"S<!1STyt
62/SN=!HnA"S<o_2$n
+1S<o;!




"{5
51!5
6 ?
 *8112!!51_*!6/
_!2(1-&?/
1SO!S1&?
m1*C N=9]11*fERF910Q8 ;=*!C

&(LgN=i1**:N=Q!M$S< B<&(!La
<B&?Y

;/61
WE
,.:1?/

61

<a61
Q!*8\49?1*%?61
*X<LX1"
 ! #&4 # !96:
<6/1S$"Ni&(!vh1i!1<&(!Lh0
<B&?
T61
+"K <6/5;;%!
0W8 451
"V
*!3N=_;1;(C=<6/
1SC;
<
EY1O
;=
]2
_;
<t84`-
*!36
 <<2!
<6/1S$"N3Q!&(!<v!2h1
62/34b*!6/
@h1
0
<$&?/W?&?;/!<_1O;=&(
<E91^&?;8
Q!_ </
O61S ;
<
8  |824`
*H1V
6

<6/3/Q&(K<yQ1i
<&?;<8R"/*h
*[ 611
i10
49!#@1;1
m*</S O5
+1!<2{0E j 5
*i!
T1@;0

% *!6/
_!

!"1S?@1$n&?;="!q!2V
+"K
+
*!o
;2K1
'&?1SP1R<6/SP"N1m61;f!
8KQ*451S1R
&@
! D*65-1')F(* 0(254 %(-1F '0-1#3254$;/


-49C61
*MiN16H6
<
0
<H&?
Q!-45*X.4`#$


 K |EO1! ^&?;82Q!
 45VF5z Y!, v1A49!#f8/Hn -r 1 oT
 !"!
0#?1
P
;2K$451
"X1
*!
_2K (!-!`1<;=:
1
<

!(K&?;gS<1
+ V

?hV
O&?@
;2!E3
0


"S<L 8TQ!68`nQP_;1
+ AT

<1
81;=
 "S
!9
1
<
-iC
!&?

 1!OK 2!<;=o349

<1
+6
*v1v1<BN=B;K%*hXN=V1S1LB;*/
%<E
&?KL 8f:@45

T.4`#=8f9!: 61
H
61
-X
KS<_6& N=R!W61S "!N1561;f1K
8%4`
*!i<1  *!6/
1!T&?*!
6
1C*[ 611
Lvyt1*4dJ={_@61;f!
"#<
;
<E
_6/R<N)+
0<9C1
\
+61/LO
q_*T-N=\620
+"2
 S?\1 &?;=!" 1V
011S1S?

61
M 61
<$/

<?Q!P<1
P<6/S ;!
<
EYq
+*861
1SO S<%?

!\"1S81
+S811V62KM

1!<
821V&?1S
!S<&?
gyt<E SE845,   BR!
3X
J!

]2
*K !S
& Q!5;!
<="
 1K"C!2Bn.1!
+5S<N=o 
`

6
+1SgS<!& Q!(/K>



"{08Y49V
vJ/ L
45
0@61SO;!
<t8 45?;=!L(!2
m61S-"!N1
/Q&(K<$61
W82
M
6MN=;=&?1S(/
<
&?/
E5F91
545\;$
+491O[ 61
+nA451!/Q!&(!
@
161CN=P1
619T1`61S_"!N19_&(!#%9 61
<
/
 ef
0<<E o:F9
q]22/1S5
*CN=`6
*O
S &?!
N16
+Y61SO;!
<
Emr_0^/*8<61
1SO S<@<6/S ;!

<t8 495
*!?^/;1P1P*!6/
;1
1@S1&d
;2!

]12CPN=
+Y;=Q!&?S &?tEqF91
Y452S<%P
S Y-
S10"W;"
0

P'N161S  61
<3
<3P45


.4`#
E

5.2 Detecting Abnormal Activities in Other

1&(Layers
L?/
<?9!1`*L%
`!W45

`1A49#
8

E S/E8 ZMz>;!

<
8/1_;1;
!<
52(


8/
<E8
<*45
O@
&?!_;;<
"E51!_0^1!&?;1<8/1 "
C!" 
ZMz ;!
<
T
*g
< "X1@Q*451S$*!6/
OQO
;1
+

<1
8m13!"P61&CN=C-
"2!1`*[ 61
+
8Y
!"W61& N=09q1
&(!#ST_*[ 61
+
8/-!S
+*81
&?8\2X1(
&(
+CY?*[ 61
+
8\0
<EHF91 0:
65%(%

iN=15"S<@yt?161&CN=0{R!'

6/ `*[ 6
+
9N L
@<EYl


]2_<V
5"!
O1K"?

0N=
5 1!&(

< ^VyttE <EH
+!L1{TM*[ 6
+*EXh!1&(Lh/

<
&?//
*T1CN=P
<&?;6*f8%!
Y


]2Ym
6
+
8%&
O!$1K"/E
&?KL 8YK@1(45

(;;1
*!<vL *8m1("
V1!"

H61
 1O

C
1<0:
65%(%OyttE E8f1O


Q_*
"H


K{08113
*!M
"!31Q<*451S?Q*K6
R1-;1
+


<1
8q@"m61&CN= P[6
+
V1
&??

<8
961&CN=q!fef R


\*[ 6
+*W8!19K<"SP6/"!
 1Y

<8<`61&CN='!2
q1!q*[ 6
+*(y| L1{

0/
8WT!"\61&CN=Y

C0
8W
<EO
J!

]2
i"!
1!" 13/

N=
`P
"i
0/
11!&(
N=2*!
5R
P*[ 61
+
E

ZM! L K"
"#/
XS<1"K>/ef X
+"!
+
*@;1!
$2
&(!f[6
+
E 
_1Q*K6


N=*V!N=!< ! /

S1*O_
*!;6m1Y
+"!
+
*/N=2*\!1Y*[ 61
+
8
K"
"#
8W45X^&?1*M6
1S(1OQ*K6 6
8=45R1K<
KS<a/!<
32!71H1!&(*[ 61
+
E 1!V^!&?;1<8

<&?;2K*V45$1!&([6
+
5iZMz_H!;1;1

*K
<=

<8/
 !"!
0#
9-
<6/
-^/2!61
+<(&(L
%<O 61S< 6& N=P!\*[ 61
+
5$ <Li
1;=M!
&?<u2@-
 2
51O1/2.49#(2!
<&?
5&
&(! Lief 1/
E

6. MULTI-LAYER INTEGRATED INTRUF"SION

<2!L 8 DETECTION
,.
$61
v1K"I<AND
L J<RESPONSE
& 1h*49g*L%

10.49!# AN1
*?,A
P!2!L/U_F5z ` K, B
 ;2!
0#%0P1K"C!2(1
+

N2!
*7,.
(1L/UH
+L/
+&

* !"E F91
i
3N=
61
H
45* .4`#
8O!;1;1
*K L M]4P!
H
*!kef
0<L
;% W&( L!"
"#
82 !;1;
*K<
;=
]1
Y&?/61
8K<E S/E8

*/q
*K"_"61O
0
+L/
+&?
8K2*%m
N=O/%<;=0
i S<62K"31_&?



*


E
,.h345

(1A49!#/
8m10M!31H]149
@g;/

13


?&!"!
0#=E7c*49%0*89 61
<I
0I
1;;1
*!VL 9
9`<1L?*
N1<81
9

61

i?1
;/61
m

<W8 N16/`!
T


KL?N=
*!61
5
"!(!"
"#
8
Q!_0^1!&?;1<82$K"
"#i1!
@
0*!CM62!61!U*




Xn.N2!
0# A !oVM3

<8q&(LH
&};=0Q
L:S<
&(!-@ K4`-L 
82<E SE821CZMz;
<
E j O!

N=% 1!
&?@K"
"#/
_&(*LMN=?
*H& 61
"$*KT
1@;1;
!<aL *8'N=
*!61
@!91 
"1O
&( 
@Q!
&(!M*<!J!N1<8/2!V3-K4`*L%
EY15^!&?;1<8Q!
-
 K"
"#=8%1;;1
*!iL Y&(LC
0`%0L@[ 61
"#L
2KY_!S<561&CN=q!f1
&?S-

P
11
<1
R1K<P1

062m<;=0"!<
T!O1@;="!<
T<Ws O&(#%C
1
$y|!2

*! N=9
1
0* !
m0
"{0u%45*
\9K4`m*L%
8<45
"
Li<L(V&(KM!N=<6P-!&?<61 `\.4`#@"!J
]2
3yt C61&CN=-!9
"2!11q*[ 61
+
"{08W&(LM"#<@31S<0
451  
S<UO-616
62Li1S<3%<6&?<E
_%l2!V1hKa6110"N1
H & 6;:*L%
$
45

i1A49#
(!2h2!i!> 61
70
<>&?61
1*
9CN=_;1!
*VK5*
"VL 53
"V1/-qC.4`#=8
49O*3?
 !"2K 1  61
<H/
<H!23
;=<1

ef!
E j -61
-_Q*451Si S"KM

"1&?
C

_H130

?!v 61
B1!(Kef

3
1A49#=8 E S/E8 451lX
0
$k!"
"#<l1g<
1
Y61S;!
<
8 \1!
RYA!61
*K<
;


T$^/
62/@1?
&?;<&?
*1!&(!
61
T1

<& 1A49!#fu
 h1/g/

$yt
&?S<L1{i
*!T 61
 K$
1S<iJL 0*8E S/E84573
0
VK"
"#/
(a1H

?
0/

89*49(L 
(KM1!]1*WE>F9M0
<
&?61
(10X
717Q63%
+S<!<8<E SE8_NL
JK1S O
0V;/


<V;=

N1T!"
"#
5<
<H1
61S3;
<
8R1X
H
;=<1X3@K
"
"#TN LON
"#1S !



\& 19!ef2/1S-%yt
"{q!2
1JLS@1
i1 10.49!#(\1_
 *E

,.7
V!;1;<
"851H 61
</
l&?/61H!3*!
0
L O
+m*/
_3611
0g;/<;=L 8WN16/ 0
<:<X<1
L R
*!@N=91!*Cm/*CN LT
`& R*L%
E

i:]
+i
6(!O<6i^/;=&? "!5
*!
"8P4`HK4w1

 9
 2*4kJ<&<1TL i
Cyt1^0{9K4` L _NL
0t6*8!P O
;=
]1
-K4`5L PN1
*(<(1;;1
*!<
<1&?*E
F91(n.61S&? *o_%
<
Y!=150
<?&?/1K9-*490
 %5KV
1
+6
*B
<*45
EI,Aa1vnA
+1Sog;/


8
1@1&(L:

8\tE <E8R19 Q:nAL%
oM K(Q:n.<o
&wC6;1;=_JL 0 
-1
*$ i /!<H

!@
13K4`(%t8mQ!(^&?;1<8y KE 8K/
E *{C1*4xN=
&?
Vy K
E <8

K
E <8K%{0EO,.H!1-4`"/
8 /JK<:1!"i
3
*!
-
0^/"?&(KH;2

HJ<&x1T61;1;=0_%|E_H!1&(!
Li/
<i&?2N169J<&d161S&? *(1K"OQ!

<& N1
1ON=
-!mJ/1

TJ<&x1T61;1;=0_L 
_2
?
6TL  1g
*g&(#%(V&?!?Q!&?*h

E
F9O 6
M;=
 5?_--
 <;="K<C/

<>
g1
61
X<
 1iQ!&(!<B& 
L 
E

j  B1
M14
011S
8`V*49(L 
?*4 1v&?!
1a1(!1<&(!La/
<g&?1T<(1!O
T<g
!"H51i
6/  L (!2gQ!V2/
Lh61

@ 
/1
?J<&}1?*49CL 
8m1:1(!61S&? *:1@2K
!
?
<
J/
J/1
_&x-61;;=5L *E
F9&C61JL 0` S"K<i2!N1
`6
YT1L/U51!"
"#


2Ki$
_ .LM1$
- 
61*8=49T
*H!
0%ON=
0 ;=&(!1
(a&?
ON=g1S<C6(;=<
%i2
*490iQ
$;=<
%V"K
EI1(^!&?;1<8`:#%L>!"
"#h
+

2K:
2K(B&CL:"#%

< <P!_3&?N1361
!P(61
@ytNLM;1 L/

LX
NC1& ! 100{08'!2M1X6



&?M
+L/
+&
&?&(1
C:
2ht!
]1*>61S:/Q!&(!
EYk/
<3&?62K5&?<1!
P61
N=1K*8/<E S/E8

&?&(1i6
S<82
*!$
51
5% 13&?&?*/JKL
yttE <E8%N=0QYQ6R&(S9
*!CN=`<K{
*!61
`9/
<
&?/61`m1`61S-;/

m-K919SN2!20

:!23
;=<1
8=451
0$
M
6_M1 ^/
61
X!R1

<&?;&?
*$611*EO
 ^&?;<8f
61;;=<
CC6


K9
;=<11S-5]1P!JK&M845
0C
m5"!P%\2O&(L
6

*6
(VCP6/6
62!m&?K%&? 
-1g11
@6;f1K

-P<6S-"N1
ERc*49%0*8%f1P
` 2
*K<@2K
T61
95T
+L
+&b
J.49!-1
PN=(
&?;&?
W8*!
0i
6
<?;=Y
 m 10`
R45=1*%5Mn.
*!1oT%
!
!'6;1;=YL P2/
*!!
81!2 61
m10
<i&?6P
`<6/1S-;/

m
*!@
<
62/`2K\196/6
62!/6;f1K

&(LiN=-S&(K<E
7.
*% !S61*H2!T! LH

6 1A49#M45`1*% 61
j @2CONCLUSION

!N1.La1!?!B</%
!La
<6Jh^/;*EaF9
C

;=
J!L
6@Q!C45

?/1
?.4`#
E3,. 61
<a
0h
*

<&?;1&? W6
<O;< -

"11[ 61
Yyt
6
0T
1
0L;/
8R!61
*K<8'

6/VZMz8

6/@<6S8\
E {>
&?;/!<m`10.49!#-

6/.L Eqc*49%0\14g
01[ 61
& 6
+
N=`<<;=* &(!#%m 6
@/
<O49!# N=q\
45

_<A
1&? *E

F9/<6S<g6O
 6S3%
+S<!<W8'49 2*%
*45:2K
!VK
0
65Q!PN=`6
<i
<i?45

5/

(1A49#
O
161aN=(
+N16/*a!2g
 ;="!%EHb
+
"K
+
R<&(!LM
<H;;<
"X
<6JMN=O6
*WEF9
"!
T1L/

_1M<&(LM
0M
161MN=O1O
*
L:a*
"a(1g;=<

NLX61Sa
 <;=0"!<h45h

Ca1?10.49!#=EX16*8\ 61
<B/
<h
<6J
"!#%V;
3>510.49!#SHJL 0
?v!> S"K*B
<

+
L &(!110*E
z`6/ L 8149C!O
 6S?<6/_%
+S%K<HM1T!
"1

6

6
8/1-!1&(L(0
<i&?t81(&C61
L C S"KB;;%!
0WEMC!
"1
6/?
+62L 8'49(K
0]21SX
C
S>!2a;J!aH&?;&? O?1a
+62Lg

;=0Q&(!1
 &?;
!<
E?1!T1&(LX0
<:&?t8
4`@K@
+62LS(C0ef
%

1X

N.LX!`6O!;

;<
"QVN16/Sv1&(L/
<&?/
3H/1

<6/1S$;!
<
2XQCCJL 0
C!P45

10.49!# 
1S/ER,.@;1!
61K*8 495451]
+Y
61
`<@.4`O[ 61
+<
9!N=<6
<1
5<6S \452K9&(KV <6/1SO;!
<f
161
1
613X&(#<i 61
I/
<vef
0<<89!2h452K?

1 N=
+O<&(!L:/
<:&?qC3S%:61S3;!

|E3q2!L 849@45`
+61/LH1@0ef
%

S%!yttE <E8\
0
< "KK{45 1`& 61*L%RS"!?;;%!
0W8 !

49'
5
5;=Q!&(1
 ;=2!
E
8.
. j REFERENCES
E j E=z`1WE22!
+fe 
%_6 16
<E,.

60 #&4 
*
*65F 4 # 4)G - *-
4-/*.F.4865-1#325486:  24D*.F*.4 0 *08
'#< Fq8=z9T8  ?E=ZVS%!O6/Q&(E

A

E11
+*8 E1TE/cQ&?0L/*8OE <&(L*)+t82!23F_E=TE

<S<
+"Ke\E=
1
 q
\Q_^3;/




E1,.
 F 20.*(*+5#&4,G5% 2 D - *   ;!
25%(#&')! 254  *0')F #&-1;
654 +  F # 60;!82;1S
AK8A5>/8 W<
!&?
8=z9O8 5/E
,B B I
B z`<&?;16/ 
0.L R

E

TTE@E _<
$!23TE

"49!UN1!"fE1
+62/L(M6
1S
16/"W1A49#
PQ!1&(L31V&?
61
 /
<WE1,A
 F 20.*(*+5#&4,G5% 2 D - * -  ! *(0')F #&-1;  ;!
25%(#&')!C8
  /E

OTEc*<L 8 CE W61S*8TEZM

*N=<821VZ:E 0//EF91
!
"1
6/ R .4`#i%W6
<M/


+L
+&ME1F
01
*!W;=!*8fz`&?;160


-;2K&? *8_<
.Li\r4kZV^/
8261S61
+
 "KE

?"@E1,AS61W8OE1TE &?&?*8/!2 qE1TE q"!
E "!
"1
<M2!L

`l60AN1
*3 6
$0
<
;1;/%!
0WE !# F654%.60-1#3254%$24  2 D.-%$ 65F*
 ?E
 4,G5#&4 *(*.F #&4)G8 A)%y .{ 
>  8/8'ZMK
07


E'&%
<N1
8WzE 0
8=!2 E=ZV
*z91<E - 0
+5')!
2E
KNT@!1< L/&?<6
`;3C;WE <E N1tE S<K=8(&<61
 > /E

O 8
E E)&<1
<$!23CE2OE2ZM!U<E2_L/1&?
-
<6/

<6S@M<31
-45

_.4`#
E,.MF_E,.&?1
#
2icCE' W8
8 2#1: * 25!
' -1# 4)G82;1S

? 8> <E( 6 490
*&?
R61N

8 E

> E' 61&(!P2 B5EcCE ;1!ef!"WEk
J.49!T!
"1
6/
@
61;;=5&?
61
- 61
$
<E,.
 F 20 * *+5# 4)G5%
2 D - **+ - , 65-1#325486: 4D25F !965-1#324  *0')F.#&-1;  254D*.F(*.480 *08
;2S

  A5K /8  ?E

TF_8
E 1O!2VzE Y/0L E2F'&?;="W
*[ 611
-*K11S
231K"C*6
<V<&(!L3/
<WE1L 
# F654%.60-1#3254%$24 4D25F !96-1#3254 654 +  ;%(-/*.!  *0' F #&-1;!8
A/y {0816S<6
+
   /E

#K  j 8
E W<8 E-&E <8=!2,@E j E2ZV<#=E1k!" &?1S
"&?049#(Q!N161S@6
<$/
<V&?
E/,.
 F 20.*(*+5#&4,G5% 2 D - * .  ;!
25%(#&')! 254  *0')F #&-1;
654 +  F #60;!8fZML   /E

.OT
E ;;1&(8 E1*f81,"E "K.8)&E1c_1
8)@E 2t8
E=ZV
*z`61S/81 E j N=*8 E j N
+*81CE j L

"1Sf8
TE1z`6111S2!812VZ:E(/=

&(E BR<!62!S? 6


0M
+L/
+&?
mF91
 5>?1!;1C!e=A1  61


0M62K<E,.

  F 20 * *+5# 4)G5% 2 D - *00.0

1 L  1L 4D2F.!65-1#3254  ')F#6#1: # -1; 254D*.F*.4 0 *$6548+
L AK"KK/E
2
25%(#&-1#125418)&%62K@


ATF_E W61 *8TEFq!&(!681`E _1&M8/TE-&%!S%2K2W8

qE1r61&(!1W8cCE'&%*U8=TE 
8!2MF_E -!%0L E2

*!|&?  61
<V
0M^/;=5
+L/
+&}yt,AB {Y
]21f
"11
*!W;=*E1F'
"11
*!W;=*8fz`&?;16/
 N="KL 8 ,`,A02!2t82ZV1 \K#f8

1

z9Q!1/8WN61!H
L   AE

 O E/OE/ZMU<8'&E Y
"8'&E&
0/8/1? E E&<11
E
F91ef

Y</./&(1 N=1K9?61SO;!
<

Q!_&C611<;(45

<V
1A49#
E  25')F 4 6:
254  *: *0-/*+.L F*65%#&4  25! !$')4 #30(65-1#1254 %8=61S/E  /E

5 BPE1*L 1$zE  @E2F'E1l4lR
6 P<6/1S
;!
<
5Q!-!M1
-&?N1-45

_.4`#
E 
 *.F.%.25486:  25! !$')4 #30(65-1#125418 y A.{  )??8W;*E   E

?CZ:E !AL1!"L!2W8)&/E)&E- 
+0*8
8 R8E E=ZV61&?&?*8
Z:ETE BmNS8 qE- 6&(!*81

CE 6E B\^;=01

P45


1
*V;="!$V &?<N /<&? *E,.
 F20 *(*(+#&4)G5% 2 D    ! ;5!
25%(#&')! 254
2#1: *654 +

20(65-1#324 48+,*
*.4 +64 - 25!
8')-1#&4)G81;2!S<

  A>/8
z9&CNS<82ZM


"61

826SE   E

 ETE &?W8 E2ZV6 L 8/1 &
E -!
!/ W612KA
<
E

61S@
+"
%
!P<6/S@;!
<
E=,A
 F20 *(*(+#&4)G5% 2 D 4 -/*.F 4 *.-  20# *.-1;  ;!
2% # ' ! 254
 *.-%$ 2F 64 + 1 #&%(-1F # ')-/*(+  ;%(-/*.!  *(0')F #&-1;!82;2!S<

>? A8 V_S<8=z9Q!1/8W1NE    E

  mE)/=1<6V1/\E'&E1c-
E 
6/1S?!M1
.4`#
E

  /E
  *.-%$ 25F!8  3y %.{  A K8fr_K!-$