Black hole attack

Black Hole Attack:
A malicious node advertises the wrong paths as good paths to the source node during the pathfinding process.
When the source selects the path including the attacker node, the traffic starts passing through the adversary node and this node starts dropping the packets selectively or in whole.
Black hole region is the entry point to a large number of harmful attacks.

1. SECURITY AGAINST BLACK HOLE ATTACK IN WIRELESS SENSOR NETWORK Presented By: Richa Kumari

2. Outlines : Introduction about ad hoc network Threat model of wireless sensor network Security goal in wireless sensor network Attacks in wireless sensor network Detecting black hole in wireless sensor network Black hole attacks prevention in WSNs Comparison of attacks in WSN Conclusion References

3. 1.Ad hoc network “Ad Hoc” is actually a Latin phrase that means “for this purpose”. In computer networking, an ad hoc network refers to a network connection established for a single session and does not require a router or a wireless base station . For example, if you need to transfer a file to your friend's laptop, you might create an ad hoc network between your computer and his laptop to transfer the file . If you need to share files with more than one computer, you could set up a mutli-hop ad hoc network .

4. Cont.. Ad Hoc Network

5. Characteristics A network without any base stations “infrastructure-less” Supports anytime and anywhere computing Self-organizing and adaptive Decreased dependence on infrastructure Each mobile host acts as a router Supports peer-to-peer communications Two topologies: Heterogeneous -Differences in capabilities Homogeneous or fully symmetric-all nodes have identical capabilities and responsibilities.

6. Conti… Heterogeneous Network Homogeneous Network

7. Mobile Ad hoc networks (MANETs) Mobile ad hoc networks are formed dynamically by an autonomous system of mobile nodes that are connected via wireless links. No existing fixed infrastructure or centralized administration – No base station. Mobile nodes are free to move randomly. Each node work as router.

8. MANET Applications Military communication Emergency Services Search and rescue operations Disaster recovery – Earthquakes, hurricanes. Educational Virtual classrooms or conference rooms and meeting. Home and Entertainment Home/office wireless networking. Personal Area network Multiuser games

9. Wireless Sensor Networks(WSNs ) A WSN is a heterogeneous system consists of hundreds or thousands low-cost and low-power Tiny sensors to monitoring and gathering information from deployment environment in real-time . Common functions of WSNs are including broadcast and multicast, routing, forwarding and route maintenance . The sensor's components are: sensor unit, processing unit, storage/memory unit, power supply unit and wireless radio transceiver; these units are communicating to each other.

10. Conti…

11. 2. THREAT MODEL OF WSNs Attacks B ased on A ccess L evel Active attacker: attacker does operations, such as : Injecting faulty data into the WSN, Packet modification, Unauthorized access, monitor, eavesdrop and modify resources and data stream, Creating hole in security protocols, Overloading the WSN . Passive attacker: passive attacker may do following functions: Attacker is gathers information from the WSN, Monitoring and eavesdropping from communication channel.

12. Conti… b) Attacks B ased on Attacking D evices Mote-class attacker: mote-class attacker is every one that using devices similar to common sensor nodes; this means, Using WSN's nodes (compromised sensor nodes) or access to similar nodes/motes. Laptop-class attacker: laptop-class attacker is every one that using more powerful devices than common sensor nodes, Access to high bandwidth and low-latency communication channel, Traffic injection, Passive eavesdrop on the entire WSN.

13. 3. SECURITY GOALS IN WSNs a) Primary Goals: Data Confidentiality: Means information access to only the authorized users and preventing access by the unauthorized users. If sensor nodes are not capable of keeping the data confidential, then any neighbouring node can transmit false information.(harmful to military application) Data Authentication: Data authentication is the ability of a receiver to verify that the data received by a correct sender . In WSN data can not only be tampered by the malicious nodes but the entire packet stream can be changed by false packets. So, a receiver must be able to identify if the data originated from the correct source or not .

14. Conti.. Data Availability: The principal of this is that resource should be available to authorized parties at all time. Data Integrity : It ensures that the received data are exactly same as sent by authorized entity, means no data modification, insertion, deletion or replay of the message. It confirms that the data is reliable and has not been altered or changed.

15. Conti.. b) Secondary Goals Data Freshness : Data freshness determines that the data is recent and no old packets have been replayed. Self-Organization : these sensor nodes must have self-organising capability so that they can dynamically organise according to the environment and situation. Secure Organization: Unfortunately , a malicious node can manipulate non secured location information by reporting false signal strengths, replaying signals.

16. 4.ATTACKS IN WSNs

17. Passive attacks The passive attack ( eavesdropping) listening and analyses exchanged traffic. This type of attacks is easier to realize and it is difficult to detect. The intention of the attacker can be extract the confidential information or the knowledge of the significant nodes in the network (cluster head node), by analysing routing information.

18. Conti… a ) Eavesdropping A malicious node simply overhears the data stream to gain knowledge about the communication content. When the network traffic transmits control information about the sensor network configuration that contains detailed information about the network. b ) Traffic Analysis: Malicious nodes can analyse the network traffic to determine which nodes have high activity.

19. Conti.. Once the highly active sensor nodes are discovered, the malicious nodes can cause harm to those sensor nodes. c ) Camouflage : Malicious nodes can hide in the sensor network by masquerading as normal sensor nodes. So they deceive the other sensor nodes and attract packets from them.

20. Active Attacks An active attack involves monitoring, listening and modification of the data stream by the malicious nodes. Active attacks cause direct harm to the network because they can manipulate the data stream . a) Routing attacks The attacks which act on the network layer are called routing attacks. These attacks occur while routing the messages. There are many types of routing attacks.

21. Conti.. Sybil Attack Attacker takes multiple Fake identities and use the identities of the others nodes in order to take part in distributed algorithms such as the election . These fake identities are known as Sybil nodes. Hello Flood Attack M any routing protocols use "HELLO " packet to discover neighboring nodes and thus to establish a topology of the network .

22. Conti… Attacker sending a flood of such messages to flood the network and to prevent other messages from being exchanged. Black Hole Attack: A malicious node advertises the wrong paths as good paths to the source node during the path finding process. When the source select the path including the attacker node, the traffic starts passing through the adversary node and this nodes starts dropping the packets selectively or in whole. Black hole region is the entry point to a large number of harmful attacks.

23. C onti...

24. Conti… Single Black Hole Attack: In this type of attack the malicious node individually attacks as a black hole node which hysterics into the routes between the source and the destination . Cooperative Black Hole Attack: In this type of attack, the malicious nodes act in a group. Unlike single black hole attack, here the multiple nodes absorb the packets sent for the destination node.

25. Conti.. grey hole attack: There are two ways in which a node can drop packets: It can drop all UDP packets. It can drop 50% of the packets or can drop them with probabilistic distribution. A grey hole attack affects one or two nodes in the network whereas a black hole attack affects the whole network.

26. Conti.. Wormhole Attack Wormhole attack is an attack on the routing protocol in which the packets or individual bits of the packets are captured at one location, tunnelled to another location and then replayed at another location .

27. Conti.. b) Denial of Service Attack This attack prevent the victim from being able to use all or part of their network connection. DoS attack allows an adversary to disrupt , or destroy a network, and also to diminish a network’s capability to provide a service. For example, a malicious node can send huge number of requests to a server. Due to the huge number of requests, the server will be busy in testing illegal requests and so, it will not be available for the legal users.

28. 5. DETECTING BLACK HOLE IN WSNs a) USING MOBILE AGENT Mobile Agent Mobile Agent is defined as a software component which is either a thread or a code carrying its execution state to perform the network function. B lack hole attack detection algorithm: To check the probability of the presence of black hole nodes ,

29. Conti..

30. Conti.. B) EXPONENTIAL TRUST BASED MECHANISM A table in the memory which stores the trust factor ( TF ) of each node. Initially, trust factor is 100 for every node.

31. Conti..

32. Proposed algorithm

33. 6. BLACK HOLE ATTACKS PREVENTION IN WSN Design and Implementation Let , N is the set of randomly deployed Sensor Nodes (SNs), N= {1,..., n }. N = Σ n i =1 N i Let, B is the set of Base Stations available in the network, which are more powerful than SNs, B= {B1,…, Bm} B = Σ m i =1 B i The Sensor network represented as a graph ,V = N∪ B where N represent the Sensor Node and B represents the Base Stations.

34. Conti.. two points in Euclidean n-space, then the distance from i to j or from j to i is given by , Si denote the set of SNs identified by Bi as a black hole nodes. I nitially all SNs in the network are added to the set Si, N={1,.......,n}.All the BSs in B get together and create the global black hole set as, s =∩ Si

35. Conti.. Remove the SNs from whom none of the BSs got any data packet. This procedure performs in the network by regular time interval. Black hole node does not forward any packet to the BSs. As a result no black hole node is going to be a part of the path from any non-black hole SN to a BS. Consequently, these nodes will not be removed from the set Si. Where { i | B i ∈ B }

36. 7 . COMPARISON OF ATTACKS IN WSN This comparison gives us an analysis of which attack can cause maximum harm to the system and decrease the reliability and security of the system .

37. 8 . CONCLUSION Wireless sensor networks are increasingly being used in military, environmental, health and commercial applications. Sensor networks are inherently different from traditional wired networks as well as wireless ad-hoc networks. Security is an important feature for the deployment of Wireless Sensor Networks . This presentation summarizes the attacks and their classifications in wireless sensor networks. We have also discussed black hole detection and prevention techniques.

38. 9 . REFERENCES William Stallings, Cryptography and Network Security Principles and Practices , Fourth Edition, Prentice Hall, 2005. Satyajayant Misra , Kabi Bhattarai and Guoliang Xue , " BAMBi : Blackhole Attacks Mitigation with Multiple Base Stations in Wireless Sensor Networks", publication in the IEEE ICC 2011 proceedings. A . Perrig , J. Stankovic and D. Wagner; Security in Wireless Sensor Networks; In Communications of the ACM Vol. 47, No. 6, 2004. J . Yick , B. Mukherjee and D. Ghosal ; Wireless Sensor Network Survey; Elsevier's Computer Networks Journal 52 (2292-2330); Department of Computer Science, University of California; 2008.