1. Introduction
In view of the increasing demand for wireless information and data services, providing faster and reliable mobile access is becoming an important concern. Nowadays, not only mobile phones, but also laptops and PDAs are used by people in their professional and private lives. These devices are used separately for the most part that is their applications do not interact. Sometimes, however, a group of mobile devices form a spontaneous, temporary network as they move closer. This allows us to share information in the form of documents, presentations even when we are on the move or in a meeting [1]. This kind of spontaneous, temporary network referred to as mobile ad hoc networks (MANETs) sometimes just called ad hoc networks or multi-hop wireless networks, play an important role in our present life and will continue to help us in near future.
A mobile ad hoc network (MANET) is a spontaneous network that can be established without any fixed infrastructure or a topology. This means that all its nodes behave as routers and take part in its discovery and maintenance of routes i.e. nodes within each other’s radio range communicate directly via wireless links, while those that are not in each other’s radio range use other nodes as relays. Its routing protocol has to be able to manage with the new difficulties that an ad hoc network creates such as nodes mobility, limited power supply, quality of service, bandwidth issues, changing topology and security issues. These challenges set new requirements on MANET routing protocols and make them more vulnerable to attacks [2].
Ad hoc networks have a wide array of military and commercial applications. They are ideal in situations where installing an infrastructure network is not possible or when the purpose of the network is too transient or even for the reason that the previous infrastructure network was destroyed. Because of its ad hoc infrastructure, decentralized and dynamic topology, loopholes such as limited bandwidth, limited memory and limited battery power, it is very hard to achieve security. There are many solutions exist which cope up against loopholes and provide security up to a certain level in wired network but these solutions are not always suitable for wireless environment. Therefore ad-hoc network has its own issues and challenge over security, which cannot be tackled by the available wired security mechanism.
In MANETs, all the participating nodes are involved in the routing process. Since conventional routing protocols are designed for predefined infrastructure networks, which cannot be used in mobile ad hoc networks, so the new classes of routing protocols, i.e. ad hoc routing protocols were designed to accomplish the requirement of less infrastructure ad hoc network. In comparison to guided and unguided media, most of the traditional applications do not provide user level security schemes based on the fact that physical network wiring provides some level of security. The routing protocol sets the upper limit to security in any packet network. If routing is misdirected, the entire network will be paralyzed. This problem makes ad hoc networks more complex as the routing usually needs to trust on the trustworthiness of all nodes that are participating in the routing process [3].
One of the recent and biggest cyber attacks has been reported on Netflix, this is because broadband router has been subverted and “Digital N-bombs” slows the Internet worldwide. The attackers were throwing so much of the digital traffic that popular site like Netflix have reportedly disrupted access. Mathew Prince, chief executive of CloudFlare, one of firms dealing with “nuclear bombs” said it’s easy to cause so much damage. Spamhaus, an anti-spam organization, was hit by a wave of digital traffic that knocked its website offline.
Spamhaus’s work is believed to have launched the massive DDoS, attack to bring down to bring down the anti-spam group. The attackers sent a series of data requests to DNS severs, which help to direct web traffic around the world. After receiving legitimate requests (as these servers are accessed by authorized users), the servers responded by sending the required data to Spamhaus, which could not deal with the information that suddenly arrived. The attack was so large that it began clogging up the DNS servers, which in turn slowed down the Internet worldwide. The congestion was so heavy that it overwhelmed the DNS routers [4]. A flood of request to view a site at the same time will exceed its capacity-stopping it from loading. Spamhaus greater capacity turning to CloudFlare, spread traffic over larger bandwidth. However the attackers began targeting their attacks so they would be concentrated. Hence, the connection slowed down.
Recent wireless research indicates that the wireless MANET presents a larger security problem than conventional wired and wireless networks. Distributed Denial of Service (DDoS) attacks has also become a problem for users of computer systems connected to the Internet. A DDoS attack is a distributed, large-scale attempt by malicious users to flood the victim network with an enormous number of packets. This exhausts the victim network of resources such as bandwidth, computing power, etc. The victim is unable to provide services to its legitimate clients and network performance is greatly deteriorated [5].
Rest of the paper is organized as follows: Section 2 describes related work, Section 3 presents over of DDoS attacks, Section 4 describes MANET overview, Section 5 describes proposed prevention scheme, and finally, Section 6 concludes the paper and discusses some future work.
2. Related Work
In paper [6], Lu Han describes that the wireless ad hoc networks were first unfolded in 1990’s. Mobile ad hoc networks have been widely researched for many years. Mobile ad hoc networks are collection of two or more devices equipped with wireless communications and networking capability The Wireless ad hoc Networks do not have gateway rather every node can act as the gateway. Although, lots of research is done in this field, but the question is often raised, whether the architecture of mobile ad hoc networks is a fundamental flawed architecture.
Kamanshis Biswas in [7] mentioned that Mobile Ad Hoc Network (MANET) is a collection of communicating devices or nodes that wish to communicate without any fixed infrastructure. The nodes in MANET themselves are responsible for dynamically finding out other nodes in the network to communicate. Although ad hoc network is used for commercial uses due to their certain unique characteristics, but the main challenge is the vulnerability to security attacks. A number of challenges like dynamic network topology, stringent resource constraints, shared wireless medium, open peer-to-peer network architecture etc., are posed in MANET. As MANET is widely spread for the property of its capability in forming temporary network without any fixed infrastructure or centralized topology, security challenges has become a main concern to provide secure communication.
Andrim Piskozub in [8] gives main types of DoS attacks which flood victim’s communication channel bandwidth, is carried out their analysis and are offered methods of protection from these attacks. The DDoS attacks are considerably more effective than their DoS-counterparts because they allow performing such attacks simultaneously from several sites, that makes this attack more efficient and complicates searches of attacker. Attacker uses the client program, which, in turn, interacts with the handler program. The handler sends commands to the agents, which perform actual DoS attacks against indicated system-victim. This paper also describes various countermeasures that should be taken to prevent the network from DDoS attack.
Xianjun Geng in [9] describe that the notorious, crippling attack on e-commerce’s top companies in February 2000 and the recurring evidence of active network scanning, a sign of attackers looking for network weaknesses all over the Internet, are harbingers of future Distributed Denial of Service (DDoS) attacks. They signify the continued dissemination of the evil daemon programs that are likely to lead to repeated DDoS attacks in the foreseeable future. This paper gives information about the weaknesses in the network that DDoS attacks exploit the technological futility of addressing the problem solely at the local level.
In [10], Vicky Laurens et al. describe that due to financial losses caused by Distributed Denial of Service (DDoS) attacks; most defense mechanisms have been deployed at the network where the target server is located. This paper believes that this paradigm should change in order to tackle the DDoS threat in its basis: thwart agent machines participation in DDoS attacks. Paper consists of developing an agent to monitor the packet traffic rate (outgoing packets/incoming packets).The deployment is based upon characterizing TCP connections; normal TCP connections can be characterized by the ratio of the sent packets to the received packets from a given destination. The result shows that the traffic ratio values usually give larger values at the beginning of the run when there are not enough packets to make a decision that whether or not the traffic is legitimate. A low value for threshold allows for faster detection of attack, but also increases the false-positives.
In [11] Stephen M. Specht describe that Distributed Denial of Service (DDoS) attacks have become a large problem for the systems connected to the Internet. DDoS attackers take control over secondary victim systems and use them to launch a coordinated large-scale attack against primary victim systems. As a result of new countermeasures that are developed to prevent or mitigate DDoS attacks, attackers are constantly developing new methods to cheat on these new countermeasures.
This paper gives us information about DDoS attack models and proposed taxonomies to characterize the DDoS attacks, the software attacking tools used, and the possible countermeasures those are available. The taxonomy shows the similarities and patterns in different DDoS attacks, including new derivative attacks. It is essential, that as the Internet and Internet usage expand, more comprehensive solutions and countermeasures to DDoS attacks be developed, verified, and implemented more effectively and precisely. Thus, this paper describes that DDoS attacks make a networked system or service unavailable to legitimate users. These attacks are an annoyance at a minimum, or can be seriously damaging if a critical system is the primary victim. Loss of network resources causes economic loss, work delays, and loss of communication between network users. Solutions must be developed to prevent these DDoS attacks.
Qiming Li in his paper [12], mention that Distributed Denial of Service (DDoS) attacks pose a serious threat to service availability of the victim network by severely degrading its performance. There has been significant interest in the use of statistical-based filtering to defend against and mitigate the effect of DDoS attacks. Under this approach, packet census is monitored to classify normal and abnormal behavior. Under attack, packets that are classified as abnormal are dropped by the filter that guards the victim network. This paper gives the effectiveness of DDoS attacks on such statistical-based filtering in a general context where the attackers are smart. They first give an optimal policy for the filter when the statistical behaviors of both the attackers and the filter are static. Next, this paper considers cases where both the attacker and the filter can dynamically change their behavior, possibly depending on the perceived behavior of the other party.
In [13], the authors introduced a dynamic DoS attack, the one which can be characterized by exploiting the node mobility, dynamic power control, and compromised nodes to launch new DoS attacks dynamically. The authors have discussed static and dynamic DoS attacks. The DoS attacks launched on data link layer and on the layer above it, i.e. network layer is called as static DoS attack. Malicious nodes may be able to move around the entire network, to adjust transmission power dynamically, or even launch DoS attacks by compromising their cooperative neighbors.
In [14], the authors proposed a model to characterize the DDoS flooding attack and its traffic statistics. Also, they proposed an analytical model for looking for specific patterns of the attack traffic, aiming to check if there is an anomaly in the traffic and whether the attack is the DDoS attack and to find out the time when the attack is launched. The main aim of flooding attack is to paralyze the entire network by inserting overwhelming attack traffic (e.g. RREQ broadcasting) into the MANET. The advantage of this method is to detect DDoS attacks more effectively by traffic pattern identification proposed in their work.
In [15], the authors proposed a system which consists of a client detector and a server detector for producing warning of a DDoS attack. The client detector uses a Bloom filter-based detection scheme to generate accurate detection results and it consumes minimal storage and computational resources. Its main task is to monitor the TCP control packets entering and leaving a network. The detection scheme is developed from a modified hash table. The server detector, in an active state, assists the warning by sending requests to legitimate hosts. With the help of client detectors, a server detector can detect an upcoming DDoS attack at an early stage.
Antonio Challita in [16] describe different types of DDoS attacks, present recent DDoS defense methods and propose a unique approach to handle DDoS attack. Based on common defense principles and taking into account a number of DDoS attacks, the author find out several defense methods and categorize them according to several criteria. This paper proposes a simple-to integrate DDoS victim based defense method, Packet Funneling, whose main aim is to mitigate the effect of attack on the victim. In this approach, heavy traffic is checked before being passed to its destination node, thus preventing congestion in the network. This method is simple to integrate, requires no association between nodes, causes no overhead, and adds delays only in case of heavy network loads. The proposed packet funneling approach promises to be a suitable means of coping with DDoS traffic, with easy integration at lesser cost.
Mobile ad hoc networks are expected to be widely used in the near future. However, they are vulnerable to various security issues because of their dynamic characteristics. Malicious flooding attacks are the lethal attacks on mobile ad hoc networks. These attacks can severely occlude an entire network. To defend against these attacks, the authors propose a novel defence mechanism in mobile ad hoc networks. The proposed scheme increases the number of legitimate packet processing at each node and thus improves the end-to-end packet delivery ratio.
From the above literature survey, it is being concluded that the security attacks in MANETs can be categorized as active attacks and passive attacks.
• Active Attack is an attack when attacker node has to bear some energy costs in order to perform the threat. Nodes that perform active attacks with the aim of causing harm to other nodes by causing network outage are considered as malicious.
• Passive Attacks are mainly with the purpose of saving energy selfishly. Nodes that cause passive attacks with the aim of saving battery life for their own communications are considered to be selfish.
Various types of attacks in MANETs are: Modification, Impersonation, Fabrication, Eavesdropping, Replay, Denial of Service, Malicious Software, Lack of Cooperation, Denial of Service attack, and distributed denial of service attack. A number of proposals have been given by different researchers to handle these attacks but none crossed the benchmark because of dynamic characteristics of the MANET. A perfect solution needs to be proposed to handle the attacks and prevent the sensitive data of the user from mishandling.
Most ad hoc routing protocols are vulnerable to two categories, called external attacks and internal attacks. Internal attacks are initiated and executed by authorized node in the network, where as external attacks are performed by the node that they are not authorized to participate in the network. Another classification of attacks is related to protocol stacks, for instance, network layer attacks and some network layer attacks [17] are listed below in Table 1 [18].
3. DDoS Attack Overview
3.1. DDoS Attack Components
A DDoS (Distributed Denial-of-Service) attack is a distributed, large-scale attempt by malicious users to flood the victim network with an enormous number of packets. This kills the victim network of resources such as bandwidth, computing power, etc. The victim becomes unable to provide services to its legitimate clients and network performance is greatly affected. In brief, as the name suggests, the service to a legitimate user is being denied of the service by a malicious users by sending a large number of unwanted packets on a network or a single computer. The distributed format adds the “many to one” dimension that makes these attacks more difficult to prevent. A distributed denial of service attack is composed of four elements. First, it involves a victim, i.e., the target host that has been chosen to receive the brunt of the attack. Second, it involves the presence of the attack daemon agents. These are agent programs that actually conduct the attack on the target victim. Attack agents are usually installed on host computers. These attacker agents or the secondary victims affect both the target and the host computers [19-22].
The task of deploying these attack daemons requires the attacker to gain access and infiltrate the host computers. The third component of a distributed denial of
Table 1. Various network layer attack.
service attack is the control master program. Its task is to coordinate the attack. Finally, there is the real attacker, the mastermind behind the attack. By using a control master program, the real attacker can stay behind the scenes of the attack. The DDoS attack components and procedure is shown in Figure 1. The following steps take place during a distributed attack [2,19]:
• The real attacker sends an “execute” message to the control master program.
• The control master program receives the “execute” message and propagates the command to the attack daemons under its control.
• Upon receiving the attack command, the agent machines begin the attack on the victim.
3.2. Distributed Cooperative Architecture of DDoS Attacks
Before real attack traffic reaches the victim, the attacker must communicate with all its DDoS agents. Therefore, there must be control channels present in between the agent machines and the attacker machine. This cooperation between the two requires all agents to send traffic based on the commands received from the attacker. The attack network consists of the three components: attacker, agents, and control channels. In attack networks are divided into three types: the agent-handle model, the Internet Relay Chat (IRC)-based model and the reflector model [20,23].
The agent-handler model consists of three components: attacker, handlers, and agents. Figure 2 illustrates the typical architecture of the agent handler model. The main attacker sends control messages to the previously compromised agents through a number of handlers, guiding them to produce unwanted traffic to send it to the victim [2].
The only difference between the architecture of IRCbased model and the agent-handler model is in the former case, an IRC communication channel is used to connect the main attacker to agent machines [24], which is shown in Figure 3.
In the attack network architecture of the reflector model, the reflector layer creates a major difference from the basic DDoS attack architecture. In the request messages, the agents changes the source address field in the IP header to the victim’s address and thus replace the real agents’ addresses. Then, the reflectors will in turn generate response messages to the victim. As a result, the flooding traffic that finally reaches the victim computer or the victim network is not from a few hundred agents, but from a million reflectors. An exceedingly diffused reflector-based DDoS attack raises the bar for tracing out the real attacker by hiding the attacker behind a large number of reflectors [24].
3.3. DDoS Attack Taxonomy
There are a wide variety of DDoS attacks [22]. Two types of DDoS attacks are: Active and passive attack. Packet dropping is a type of passive attack in which node drops some or all of data packets sent to it for further forwarding even when no congestion occurs. There are two main classes of DDoS attacks: bandwidth depletion and resource depletion attacks. The classification of various DDoS attacks is shown in the Figure 4.
3.3.1. Bandwidth Depletion Attacks
A Bandwidth Depletion Attack is designed to flood the
Figure 2. Typical DDoS architecture (the agent handler model).
Figure 3. Architecture of IRC based DDoS attack.
victim network with unwanted traffic that prevents legitimate traffic from reaching the primary victim. Bandwidth depletion attacks can be characterized as flood attacks and amplification attacks [25,26].
1) Flood Attacks In a flood attack, zombies send a large volume of traffic to a victim system, so as to congest the victim system’s network bandwidth with IP traffic. The victim system slows down, crashes, or suffers from saturated network bandwidth, thereby preventing access by an authorized user. Flood attacks can be launched using both UDP (User Datagram Protocol) and ICMP (Internet Control Message Protocol) packets [27].
In a UDP Flood attack, a large number of UDP packets are sent to either random or specified ports on the victim system. The victim system tries to process the incoming data to determine which applications have requested data. If the victim system is not having any applications on the targeted port, it will send an ICMP packet to the sending system indicating a “destination port unreachable” message [28].
Often, the attacking DDoS tool will also spoof the source IP address of the attacking packets. This helps the secondary victims in hiding their identity since return packets from the victim system are not sent back to the zombies, but are sent back to the spoofed addresses. UDP flood attacks may also fill the bandwidth of connections located around the victim system.
An ICMP flood attack is initiated when the zombies send a huge number of ICMP_ECHO_REPLY packets (“ping”) to the victim system. These packets flag the victim system to reply to this message and the combination of traffic saturates the bandwidth of the victim’s network connection. During this attack, the source IP address of the ICMP packet may also be spoofed [29,30].
2) Amplification Attacks In amplification attack the attacker or the zombies send messages to a broadcast IP address, using this to cause all systems in the subnet reached by the broadcast address to send a reply to the victim system. The broadcast IP address feature is found on most routers; when a sending system specifies a broadcast IP address as the destination address, the routers replicate send the broadcast message directly, or use the agents to send the broadcast message to increase the volume of attacking traffic. If the attacker decides to send the broadcasting message directly, this attack helps the attacker with the ability to use the systems within the broadcast network as zombies without any need to install any agent software [2].
A DDoS Smurf attack is a type of an amplification attack where the attacker sends packets to a network amplifier, with the return address changed to the victim’s IP address. The attacking packets are typically ICMP ECHO REQUESTs, which are packets (similar to a
“ping”) that request the receiver to generate an ICMP ECHO REPLY packet [31]. The amplifier sends the ICMP ECHO REQUEST packets to all of the systems within the broadcast address range, and each of these systems will return an ICMP ECHO REPLY to the target victim’s IP address. This type of attack amplifies the original packet tens or hundreds of times [32].
Another example is the DDoS Fraggle attack, where the attacker sends packets to a network amplifier, using UDP ECHO packets [33]. There is a variation of the Fraggle attack where the UDP ECHO packets are sent to the port that supports character generation, with the return address spoofed to the victim’s echo service creating an infinite loop [34]. The UDP Fraggle packet will target the character generator in the systems reached by the broadcast address. These systems generate a character to send to the echo service in the victim system, which will send an echo packet back to the character generator, and the process repeats. This attack can generate more bad traffic and cause more damage than a Smurf attack.
3.3.2. Resource Depletion Attacks
A Resource Depletion Attack is an attack that is designed to tie up the resources of a victim system making the victim unable to process legitimate requests for service. DDoS resource depletion attacks involve the attacker sending packets that misuse network protocol communications or are malformed. Network resources are tied up so that none are left for legitimate users [35].
1) Protocol Exploit Attacks We give two examples, one misusing the TCP SYN (Transfer Control Protocol Synchronize) protocol, and the other misusing the PUSH + ACK protocol.
In a DDoS TCP SYN attack, the attacker gives instructions the zombies to send tons of TCP SYN requests to a victim server so as to tie up the server’s processor resources, and hence prevent the server from responding to the requests from legitimate user. The TCP SYN attack exploits the three-way handshake between the sending machine and the receiving machine by sending a huge number of TCP SYN packets to the victim system with changed source IP addresses, so the victim system responds to a non requesting system with the ACK + SYN. When a large volume of SYN requests are being processed by a server and none of the ACK + SYN responses are returned, the server eventually runs out of the computing resources such as the processor and memory resources, and is unable to respond to legitimate users [35].
In a PUSH + ACK attack, the attacking agents send TCP packets with the PUSH and ACK bits set to one. These triggers in the TCP packet header instruct the victim system to unload all data in the TCP buffer and send an acknowledgement message when complete. If this process is repeated with a number of agent machines, the receiving system cannot process the large volume of incoming packets and the victim system will eventually crash.
2) Malformed Packet Attacks A malformed packet attack is an attack where the attacker instructs the zombies to send incorrectly formed IP packets to the victim system in order to crash it. There are at least two types of malformed packet attacks [2,35].
In an IP address attack, the packet contains the same source and destination IP addresses. This can confuse the victim system and can cause it to crash. In an IP packet options attack, a malformed packet may randomize the optional fields within an IP packet and set all quality of service bits to one so that the victim system must use additional processing time to analyze the traffic. If this attack is multiplied, it can exhaust the processing ability of the victim system [2].
3.4. DDoS Attack Mechanism
As one of the major security problems in the current Internet, a denial-of-service (DoS) attack always attempts to prevent the victim from serving legitimate users. A distributed denial-of-service (DDoS) attack is a DoS attack which relies on multiple compromised hosts in the network to attack the victim. There are two types of DDoS attacks. The First type of DDoS attack aims at attacking the victim node so as to drop some or all of the data packets for further forwarding even when there is no congestion in the network, is known as Malicious Packet Dropping-based DDoS attack [36]. The second type of DDoS attack is based on a huge volume of attack traffic, which is known as a Flooding-based DDoS attack [36]. A flooding-based DDoS attack tries to clog the victim’s network bandwidth and other resources with real-looking but unwanted IP data. As a result of which, the legitimate IP packets cannot reach their destination node.
To amplify the effects and hide real attackers, DDoS attacks can be run in two different distributed and parallel ways. In the first one, the attacker compromises a number of agents and manipulates the agents to send attack traffic to the victim node. The second method makes it even more difficult to determine the attack sources because it uses reflectors. For example, a Web server can be reflector because it will return a HTTP response packet after receiving a HTTP request packet. The attacker sends request packets to servers and fakes victim’s address as the source address. Therefore, the servers will send back the response packets to the real victim. If the number of reflectors is large enough, the victim network will suffer exceptional traffic congestion [37].
Problems Due to DDoS Attacks:
• DDoS attack is an attempt to make a computer resource inaccessible to its legitimate users.
• The bandwidth of the Internet and a LAN may be consumed unwontedly by DDoS, by which not only the intended computer, but also the entire network suffers.
• Slow network performance (opening files or accessing web sites) due to DDoS attacks.
• Unavailability and inability to access a particular web site due to DDoS attacks.
• Gradual increase in the number of fake emails received due to DDoS attacks.
4. Mobile Ad Hoc Network (MANET) Overview
4.1. MANET Overview
A mobile ad hoc network (MANET) consists of a number of mobile hosts to carry out its basic functions like packet forwarding, routing, and service discovery without the help of an established infrastructure. Each node of an ad hoc network depends on another node in forwarding a packet to its destination, because of the limited range of each mobile host’s wireless transmissions. An ad hoc network uses no centralized administration. This ensures that the network will not stop its functioning just because one of the mobile nodes moves out of the range of the others. Because of the limited transmitter range of the nodes, multiple hops need to cooperate to reach other nodes. Every node in an ad hoc network must be willing to forward packets to other nodes. Thus, every node acts both as a host and as a router. The topology of ad hoc networks varies with time as nodes move in and out of the network. This topological instability requires a routing protocol to run on each node to create and maintain routes among the nodes [38].
Mobile Ad hoc Networks’ Usages: Wireless ad-hoc networks are mainly used in areas where a wired network infrastructure cannot fit in due to reasons such as cost or convenience. It can be very quickly deployed to support emergency requirements, connectivity on the go, shortterm needs, and coverage in undeveloped areas. Any day-to-day application such as electronic email and file transfer can be considered to be easily deployable within an ad hoc network environment.
In addition to this, there is no need to focus on the wide range of military applications possible with ad hoc networks. Even the technology was initially developed for the military applications. In such situations, the ad hoc networks having self-organizing capability can be effectively used where other technologies either fail or cannot be deployed effectively. Some well-known ad hoc network applications are:
Collaborative Work: For some business environments, the need for collaborative computing is sometimes more important outside office environments than inside. Moreover, it is often the case where people really need to have meetings to cooperate and exchange information on a project.
• Crisis-Management Applications: These arise as a result of natural disasters where the entire communications infrastructure is disordered and restoring communications quickly is essential. By using ad hoc networks, it becomes easy and quick to establish a communication channel than required for wired communications.
• Personal Area Networking and Bluetooth: A personal area network (PAN) is a short-range, localized network where nodes are usually associated with someone. These nodes could be attached to a pulse watch, belt, and so on. In such scenarios, mobility is only a major consideration when interaction among several PANs is the main issue.
Mobile Adhoc Network Usage and Characteristics: MANETs have a number of characteristics and challenges which are as follows [39]:
• Dynamic topologies: Nodes are free to move anywhere in the network. Thus, the network topology changes randomly and rapidly at unpredictable times, which is the main characteristic of a MANET.
• Bandwidth-constrained, variable capacity links: Wireless links will continue to have considerably lower capacity than their hardwired counterparts. Also, the actual throughput of wireless communications, after calculating for the effects of multiple accesses, multipath routing, noise, and interference conditions, is lesser than a radio’s maximum transmission rate.
• Energy-constrained operation: The nodes in a MANET may depend on batteries or other exhaustible means for their energy. For these nodes, an important optimization criteria system design may be energy saving.
• Security: Mobile wireless networks are highly prone to physical security threats because of its hop by hop routing, multipath routing and dynamically changing topology. Therefore, an increase in possibility of different attacks should be carefully considered.
Security goals for MANET: Security is an important issue for ad hoc networks especially for the more security-sensitive applications used in military and critical networks. An ad hoc network can be considered secure if it holds the following attributes:
• Availability: Ensures that the network manages to provide all services despite denial of service attacks. A denial of service attack can be launched at any layer of an ad hoc network. On the physical and media access control layer a malicious user can employ jamming in order to interfere with signals in the physical layer. On the network layer, a malicious user can disrupt the normal operation of the routing table in various ways that are presented in a following section. Lastly, on the higher layer, a malicious user can bring down high-level services such as the key management service.
• Confidentiality: Ensures that certain information is never disclosed to unauthorized users. This attribute is mostly desired when transmitting sensitive information such as military and tactical data. Routing information must also be confidential in some cases when the user’s location must be kept secret.
• Integrity: Guarantees that the message that is transmitted reaches its destination without being changed or corrupted in any way. Message corruption can be caused by either a malicious attack on the network or because of radio propagation failure.
• Authentication: Enables a node to be sure of the identity of the peer with which it communicates. When there is no authentication scheme a node can masquerade as some other node and gain unauthorized access to resources or sensitive information.
• Non-repudiation: Ensures that the originator of a message cannot refuse sending this message. This attribute is useful when trying to detect isolated compromised nodes.
4.2. Manet Routing Protocols
The routing protocols in ad hoc networks may be categorized as proactive routing protocols, reactive routing protocols, and hybrid routing protocols [40].
• Proactive Routing Protocols are those protocols, in which the routes are maintained to all the nodes, including those nodes to which packets are not sent. An example of proactive routing protocols in ad hoc networks is Optimized Link State Routing Protocol (OLSR).
• Reactive Routing Protocols are those protocols in which the route between the two nodes is constructed only when the communication occurs between the two nodes. Such type of routing protocols is ad hoc On Demand Distance Vector Routing Protocol (AODV) and Dynamic Source Routing Protocol (DSR) [41].
• Hybrid Routing Protocols are those protocols in which the combined approach of proactive routing and reactive routing are used for the route generation between the nodes. The Zone Routing Protocol (ZRP) is such a hybrid reactive/proactive routing protocols.
Figure 5 shows the categorization of various mobile ad hoc network routing protocols and their subtypes [42].