A game theory based multi layered intrusion detection framework for VANET

Highlights

• A multi-layered game theory based VANET intrusion detection framework is proposed.

• A novel clustering and CH election algorithm for VANET is proposed.

• A payment structure based on VCG mechanism is proposed for the CH election.

• Proposed framework achieves high detection rate and accuracy across wide range of attacks.

Abstract

Vehicular Ad-hoc Networks (VANETs) are vulnerable to various type of network attacks like Blackhole attack, Denial of Service (DoS), Sybil attack etc. Intrusion Detection Systems (IDSs) have been proposed in the literature to address these security threats. However, high vehicular mobility makes the process of formulating an IDS framework for VANET a difficult task. Moreover, VANETs operate in bandwidth constrained wireless radio spectrum. Therefore, IDS frameworks that introduce significant volume of IDS traffic are not suitable for VANETs. In addition, dynamic network topology, communication overhead and scalability to higher vehicular density are some other issues that needs to be addressed while developing an IDS framework for VANETs. This paper aims to address these issues by proposing a multi-layered game theory based intrusion detection framework and a novel clustering algorithm for VANET. The communication overhead of the IDS is reduced by using a set of specification rules and a lightweight neural network based classifier module for detecting malicious vehicles. The volume of IDS traffic is minimized by modeling the interaction between the IDS and the malicious vehicle as a two player non-cooperative game and adopting a probabilistic IDS monitoring strategy based on the Nash Equilibrium of the game. Finally, the proposed clustering algorithm maintains the stability of the IDS framework, which ensures that the framework scales up well to networks with higher vehicular densities. Simulation results show that the proposed framework achieves high accuracy and detection rate across wide range of attacks, while at the same time minimizes the overall volume of intrusion detection related traffic introduced into the vehicular network.

Introduction

The concept of enabling vehicles with the capability to make transportation infrastructure more secure and efficient has received immense attention in recent years. This has lead to the emergence of Vehicular Ad-hoc Networks (VANETs), which are formed on the fly by a network of vehicles equipped with multiple sensors and On Board Units (OBUs). The OBUs enable vehicles to connect with Road Side Units (RSUs) through a wireless short-range direct communication link based on the IEEE 802.11p radio frequency channel. VANET uses various type of notification messages like Post Crash Notification (PCN), Road Hazard Condition Notification (RHCN), Stopped/Slow Vehicle Advisor (SVA) etc., to provide vehicular communication.

VANET uses 75 MHz of Dedicated Short Range Communications (DSRC) spectrum at 5.9 GHz to support IEEE 802.11p standard for communication among vehicles. DSRC provides a communication range of 300–1000 m with a data rate of more than 27 Mbps and supports a vehicular mobility as high as 200 kmph [1]. The IEEE P1609 working group has proposed DSRC as IEEE 802.11p standard for Wireless Access in Vehicular Environment (WAVE) platform [2]. The DSRC based WAVE architecture supports two different protocol stacks namely, the WAVE Share Message Protocol (WSMP) and the traditional IPv6 protocol. Time sensitive and high priority communication are achieved using the WSMP, while the less demanding communication involving the UDP/TCP/IP data frames are achieved using the IPv6 protocol. As shown in Fig. 1, the DSRC spectrum band is divided into seven channels of 10 MHz each [3]. Channel 178 is the Control Channel (CCH), which is used for transmission of emergency messages. The other six channels numbered 172, 174, 176, 180, 182 and 184 are Service Channels (SCHs), which are used for both safety and non-safety applications. If the CCH channel is active, all vehicles are bound to stop their communication during CCH time frame to receive and transmit emergency messages on CCH channel.

VANETs use emergency broadcast messages for disseminating information about adverse road conditions and traffic accidents, which require communication between the member vehicles through open wireless medium. The attacker can exploit this broadcast nature of VANET to carry out various type of attacks like eavesdropping, interference, jamming, masquerading, packet replay, Denial of Service (DoS), impersonation, identity disclosure etc. [[4], [5], [6]]. Preventive security measures like digital signature, authentication and encryption are usually employed as the first line of defense to prevent and detect such attacks in VANETs. However, these preventive measures have several limitations. The attacker can easily circumvent them by modifying the attack signatures to avoid detection. Moreover, an insider attacker with valid cryptographic keys used for secure communication can render the preventive security measures obsolete. Additionally, they use handshake based authentication mechanisms, which incur high communication overhead. All these factors make preventive security measures inadequate for providing a comprehensive protection against various type of attacks in VANETs.

To address the drawbacks associated with the preventive security measures, an alternative security mechanism in the form of Intrusion Detection Systems (IDSs) have been proposed in the literature [[7], [8], [9], [10], [11]]. They complement the preventive security measures and act as a second line of defense against various type of attacks. IDSs have widely been deployed in wired networks with great results. However, unlike the wired networks with fixed infrastructure and static topology, VANETs are highly dynamic with intermittent network connectivity and constrained wireless bandwidth radio spectrum. All these issues make the task of formulating an efficient intrusion detection framework for VANET difficult and challenging. Therefore, any intrusion detection framework proposed for VANET must take the following key issues into consideration:

• Bandwidth constraints and IDS traffic volume: VANETs operate in a narrow bandwidth wireless radio spectrum. The entire bandwidth spectrum of the DSRC band (5.850–5.925 GHz) used for vehicular communication in VANET is only 75 MHz with a maximum theoretical throughput of 27 Mbps and a maximum transmission distance of 1000 m. Therefore, intrusion detection frameworks that introduce significant volume of IDS traffic and require pre stored information about the participating vehicles are not suitable for VANETs.

• Dynamic network topology: Network topologies in VANETs vary depending on the traffic density and vehicular mobility. This can cause high delays in dissemination of messages due to broadcast storm at high vehicular densities and disconnected network problems at low vehicular densities. Therefore, any intrusion detection framework proposed for VANET must adopt a suitable clustering algorithm for producing stable vehicular clusters to maintain the network’s stability.

• Communication overhead and scalability: The association of a vehicle with other vehicles and RSUs in VANET is usually short lived and intermittent. Therefore IDS frameworks that require high communication overhead are not suitable for VANETs. In addition, VANETs consist of a network of hundreds of vehicles and are designed for supporting real time safety related applications, which require them to be up and running all the time. Therefore, IDS frameworks designed for VANETs must be scalable to vehicular networks with high vehicular densities.

A good trade-off must be maintained between gathering enough information for effectively detecting network intrusions and preventing the overburdening of IDS’s logging component with high volume of IDS traffic in VANET. To achieve this trade-off, a novel clustering algorithm, a distributed Cluster Head (CH) election algorithm and a game theory based multi layered intrusion detection framework for VANET are proposed in this paper. In summary, the main contribution of this paper are as follows:

• We propose a distributed clustering algorithm that uses various vehicular information like velocities, reputation values, real time coordinates and direction of movement to generate stable vehicular clusters. Stable clusters enhance the robustness of the intrusion detection framework by providing vehicles enough time frame to exchange their data and thereby enabling them to make informed decisions.

• We propose a novel Cluster Head (CH) election algorithm that uses an incentive structure based on the Vickrey–Clarke–Groves (VCG) mechanism to motivate vehicles to actively participate in the CH election process by offering them payment in the form of reputation gain for taking up the role of the CH. Data packets of the reputed vehicles are given higher priority during data traffic routing.

• We propose a multi layered game theory based intrusion detection framework for VANET that uses a set of specification rules and a lightweight neural network based classifier module to detect various type of attacks in VANET.

• We model the interaction between the IDS and the malicious vehicle as a two player non-cooperative game, and adopt probabilistic monitoring strategies based on the NE of the game. Such game theoretic modeling minimizes the volume of IDS traffic in bandwidth constrained vehicular networks, without compromising the overall performance of the intrusion detection framework.

The rest of the paper has been organized in following way. Section 2 discusses related works on VANET intrusion detection frameworks and their drawbacks. Section 3 provides a detailed description of the proposed game theory based multi layered intrusion detection framework. Section 4 provides the experimental results and comparison analysis of the proposed framework with various other intrusion detection frameworks. Conclusion and future works are provided in Section 5.