Detection and Prevention of Malicious Nodes ON and OFF the Route in Wireless Sensor Networks

16
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 9, Number 23 (2014) pp. 22523-22538 © Research India Publications http://www.ripublication.com Paper code: 28847 IJAER Detection and Prevention of Malicious Nodes ON and OFF the Route in Wireless Sensor Networks Muthumayil K ( Corresponding author ) Department of information technology,PSNA College of Engineering&Technology, Dindigul, Tamilnadu,India – 624622. Tel : +91-9791877835 E-mail : [email protected] Manikandan S Department of Computer application,R.M.D Engineering College, R.S.M.Nagar, GummidipoondiTaluk, Tiruvallur District, Tamilnadu,India – 601 206. Tel : +91-9443423079E-mail : [email protected] Rajamani V Department of Electronics and Communication Engineering, VeltechMutitech Dr. Rangarajan Dr. SakunthalaEngg. College, Avadi, Chennai, Tamilnadu, India - 600 062 Tel : +91-9442883851 E-mail : [email protected] Abstract The main focus of this study is to develop an impregnable routing in Wireless Sensor Network (WSN) for increasing the throughput of the network. There are two kinds of attacks detected and eliminated from the network: sinkhole and Sybil. Sinkhole and Sybil attacks interrupt the normal nodes and intermediate nodes in the route as well as damage the data transmission process, thereby reducing the throughput of the network within the network area. Many existent studies provide detection and prevention mechanisms separately for individual attacks within the network. The existing system provides a leader-based IDS mechanism to detect and prevent the sinkhole attack. The sinkhole attack occurs ON the route and the Sybil attack occurs OFF the route while the data are transmitted from source node to destination node. This paper proposes an IBSSDP [Information Based Sinkhole, Sybil Detecting and Preventing] approach to detect and prevent the sinkhole and Sybil simultaneously in the network during route discovery and data transmission. Keywords: Security; WSN; Sinkhole; Sybil; Throughput, Routing.

Transcript of Detection and Prevention of Malicious Nodes ON and OFF the Route in Wireless Sensor Networks

International Journal of Applied Engineering Research ISSN 0973-4562 Volume 9, Number 23 (2014) pp. 22523-22538 © Research India Publications http://www.ripublication.com

Paper code: 28847 IJAER

Detection and Prevention of Malicious Nodes ON and OFF the Route in Wireless Sensor Networks

Muthumayil K ( Corresponding author ) Department of information technology,PSNA College of Engineering&Technology,

Dindigul, Tamilnadu,India – 624622. Tel : +91-9791877835 E-mail : [email protected]

Manikandan S

Department of Computer application,R.M.D Engineering College, R.S.M.Nagar, GummidipoondiTaluk,

Tiruvallur District, Tamilnadu,India – 601 206. Tel : +91-9443423079E-mail : [email protected]

Rajamani V

Department of Electronics and Communication Engineering, VeltechMutitech Dr. Rangarajan Dr. SakunthalaEngg. College,

Avadi, Chennai, Tamilnadu, India - 600 062 Tel : +91-9442883851 E-mail : [email protected]

Abstract

The main focus of this study is to develop an impregnable routing in Wireless Sensor Network (WSN) for increasing the throughput of the network. There are two kinds of attacks detected and eliminated from the network: sinkhole and Sybil. Sinkhole and Sybil attacks interrupt the normal nodes and intermediate nodes in the route as well as damage the data transmission process, thereby reducing the throughput of the network within the network area. Many existent studies provide detection and prevention mechanisms separately for individual attacks within the network. The existing system provides a leader-based IDS mechanism to detect and prevent the sinkhole attack. The sinkhole attack occurs ON the route and the Sybil attack occurs OFF the route while the data are transmitted from source node to destination node. This paper proposes an IBSSDP [Information Based Sinkhole, Sybil Detecting and Preventing] approach to detect and prevent the sinkhole and Sybil simultaneously in the network during route discovery and data transmission. Keywords: Security; WSN; Sinkhole; Sybil; Throughput, Routing.

22524 Muthumayil K et al

Introduction A wireless sensor network is a collection of nodes organized into a cooperative network [1]. Each node possesses processing capability (one or more microcontrollers, CPUs, or DSP chips), and contains multiple types of memory (program, data, and flash memories), an RF transceiver (usually with a single omnidirectional antenna), a power source (e.g., batteries and solar cells), and accommodates various sensors and actuators. The nodes communicate wirelessly and are often self-organized after being deployed in an ad hoc fashion. Systems of thousands or even tens of thousands of nodes are anticipated. Such systems could potentially revolutionize the way we live and work. Broadband wireless access (BWA) networks, which are based on IEEE protocol 802.16, have become the best way to meet the needs of residences and small businesses for high-speed Internet, multimedia, and voice services. This standard adopts the binary truncated exponential backoff algorithm (EBA) with adjustable contention window size to solve collisions of bandwidth requests (REQ). The IEEE 802.16 Medium Access Control (MAC) protocol that establishes the bandwidth assigned for the uplink channel mainly conforms to two regions: contention and reservation. The former is used by subscriber stations (SS) to transmit REQ to the base station (BS) and the latter is used to transmit data information from SSs in reserved slots to minislots. The efficiency of the MAC protocol depends greatly on the bandwidth assigned to the contention access. A high number of contention slots (CSs) assigned to this region reduces the bandwidth for data transmission in the delineated region. In contrast, a small number of contention slots gives rise to an increased number of collisions during high traffic loads, resulting in degradation of system performance. The IEEE 802.16 MAC protocol specification does not define any mechanism for bandwidth allocation; this task has been left open to individual implementations and vendor differentiations. In a perilous networking situation, adversaries may compromise link security or attempt to simulate legitimate nodes to perform malicious actions. Providing data encryption in communications is the first step in securing the network. Traditional public key schemes [2, 3] are not feasible because of processor and battery limitations in the sensor nodes; this makes symmetric cryptography very appealing. Recently, several key pre-distribution schemes (KPS) have been proposed to establish common keys, which are requisite for symmetric cryptosystems. In KPSs, nodes are preloaded with key information prior to deployment. After deployment, nodes form secure communication links with neighbor nodes with a probability that is based on the key information shared between the two nodes. Related Work K. Romer and F. Mattern [2004] posit that world-wide communications are power-restricted because of the diversified sensory and connection devices which provide support by coordinating commands so that information is retained in the central sink node. This approach is known as multi-hop routing. Potential inconveniences with this approach include a relaying problem; there is a progressive decline of per-node

Detection and Prevention of Malicious Nodes ON and OFF 22525

capacity because each node has to carry the transit traffic as well as the proximate originated traffic. The predictable multi hop WSN may be vulnerable to a variety of security attacks [5] due to the existence of malicious attackers and compromised nodes. C. Karlof and D. Wagner [2003] dictate that Sybil attacks occur when a single target node impersonates multiple extra Sybil identities. Methods of detecting the Sybil attackers are related to methods of defending against malicious attacks upon anonymous routing protocols, as explained by J. R. Douceur [2002]. This allows the target node's identification to remain distinct from rest of the nodes in its system. Nodes forward messages to each other to facilitate connectivity. Routing protocols are traced to follow the path end-to-end through the supportive network [8, 9]. Moreover, permitting an unauthenticated tackle creates vulnerability to a string of other attacks, including spoofing, route direction, and error fabrication [10]. A Sybil attack may lead to correlations in connectivity patterns [11]; when the underlying Sybil node shifts, then all of its Sybil identity nodes should shift simultaneously. In the case of a mobile network, the solutions can decide ybil the commencement of Sybil by moving multiple nodes by analyzing the MAC layer collision, which is provided in [1]. The common results directly verify the identity and detect Sybil attacks by using resource testing [12], which takes advantage of limitations on statement, computation, and storage and restricts them by a specified time-frame. B. N. Levine et.al., [12] propose a scheme that manages a real-time system which detects an attack through radio resource testing, where the verifier selects a path at random to listen to and repeats the assessment after each attempt. A probabilistic proposal is provided for detecting such nodes. An attack in an ad hoc network is facilitated by the accessibility of fake identities that may further lead to a large scale attack occurring simultaneously with a distributed denial of service (DDoS) attack [13]. Sensor network readings are computed by query protocols whereby the network returns the reading of each and every sensor. Kotz, et al [14] convey concerns regarding the use of NS2 to simulate mobile networking, Additionally, a series of simulations for an ad hoc network were conducted by using the NS2 network simulator in [15]. Existing System D. Udaya Suriya Rajkumar and V.rajamani [21] state that it is motivated on the spasm recognized as sinkhole attack which is deliberated as the major threat in WSN which plunders the complete announcement and data damage among a pair of nodes as S- basis node and a D- terminus node. In order to effectively sense and evade sinkhole attacks, they develop a leader-based intrusion detection system (LBIDS). In this method, a leader is chosen for each collection of nodes within the network, according to area; it associates and calculates the conduct of every node, cogently implementing the proposed discovery module and observing each node´s conduct within the collection, monitoring for any sinkhole attacks.

22526 Muthumayil K et al

Problem Statement In our method, instead of checking malicious nodes and deploying LBIDS after developing the routing protocol for the network security, a new secured routing protocol, which provides a successful attack-free routing, is deployed. This protocol focuses on sinkhole and Sybil attacks. Sinkhole Attack The sinkhole attack, also known as the Spartan attack, prevents its target from gaining complete and correct sensing data, creating a vulnerability to grave threats to higher-layer applications. The sinkhole node tries to draw as many as possible, if not all, data packets from the source node. Sometimes the sinkhole node can become vulnerable, causing selective forwarding and packet dropping as shown in Figure 1.

Figure 1: Sinkhole Attack [Node 2]

4.1 Sybil Attack The Sybil attack is more hazardous than the sinkhole attack because the Sybil node tries to glean all of the data from any intermediate nodes by showing a duplicated fake ID representing it as a normal node in the network, as shown in Figure 2.

A

2

A

A

A

1

A

A A

A 3 S D

A

A A

Sinkhole

Detection and Prevention of Malicious Nodes ON and OFF 22527

Figure 2: Sybil Attack Proposed Approach The proposed information-based sinkhole and Sybil detection and prevention (IBSSDP) approach detects and prevents malicious nodes ON the route and OFF the route from the source node to the destination node. The sinkhole attack is available ON the route and the Sybil attack is available OFF the route. The proposed approach detects and eliminates the sinkhole and Sybil nodes concurrently and increases the throughput of the network. The step-wise procedure carried out in the proposed approach is depicted in Figure 3. Consider a WSN named N, with M number of nodes deployed in a random manner throughout the defined 1200 × 1200 network range. The sensor nodes are treated equally and initially termed as A. Two nodes from the network, source S and destination D, transmit the data from the source node to the destination node in the form of packets. Any given data packet should be transmitted through a particular route discovered by selecting authenticated dynamic nodes within the network. The next-nearest neighbor node is selected from the source node and retained as the intermediate node number 1. The intermediate node number 1 finds the next-nearest neighbor and retains it as intermediate node number 2; this sequence is repeated until we reach the destination node. The intermediate nodes can be chosen by sending a request to the entire next level of

22528 Muthumayil K et al

nodes and selecting a node that replies sooner than the other nodes; it may safely be assumed that the first replying node is located nearest to the requesting node. The request node’s request time, the replying node’s ID, time of reply, and the reply received time are entered into routing table [Rtable] for further verification. Ultimately, the routing table has all the information regarding the transmission from source node to destination node and the intermediate nodes’ details, along with times of request and response, respectively.

Figure 3: System Model for the Proposed Approach

Sinkhole Detection A node activity denotes the behavior or the characteristics of the node. Any node should receive a data packet and reply within a stipulated time. In the same manner, each pair of nodes can pass the data packet with respect to the response method. In this paper, a node is selected as a neighbor node through the route discovery process, and the nodes produce a packet-level acknowledgment at the time of receipt and of passing the data packet. The round trip time of a data packet-based communication can be verified by configuring and deploying the RTS/CTS mechanism in the MAC layer of the network. According to the round trip time variance, the sinkhole node is detected when the acknowledgement is not received from any node in the route after the sinkhole node is shown in Figure-4.

Network Construction

Check for sinkhole

Apply Remedy for Sinkhole

Route Discovery

Check for Sybil

Remedy for Sybil

Apply Prevention for Sinkhole and Sybil

Transmit the Data

Detection and Prevention of Malicious Nodes ON and OFF 22529

Figure 4: Sinkhole Node Detection by RTS/CTS Figure 4 depicts a sinkhole attack where it shows that, in the route S->1->2->3->D, S is the source node and D is the destination node; S transmits the data to D through nodes 1, 2, and 3. Node 2 accumulates all the information and does not transmit to other nodes. It behaves like a sink and retains all the data, which can be obtained by the RTS, CTS mechanism’s round trip time. 5.2 RTS/CTS Mechanism: The most widely used MAC protocol in MANETs is the IEEE 802.11 DCF (CSMA/CA with RTS/CTS) mechanism. In 802.11, mobile nodes try to avoid collisions by using carrier sensing before transmission. If the channel is busy, the node will defer transmission and enter a back off mode. Otherwise, the nodes will begin the RTS/CTS dialog process to capture the channel and then transmit the packets. The CSMA/CA scheme effectively reduces the number of possible collisions. RTS/CTS is also helpful because it reserves the channel spatially and temporarily. RTS/CTS exchange is helpful in avoiding the hidden terminal problem, because any node overhearing a CTS message cannot transmit for the entire duration of the transfer. However, this process severely limits the available bandwidth. Measurements show that the flow can only obtain about 2% of the available bandwidth. In fact, such artificial restrictions may exhaust the wireless link resources. For example, as Figure 5 shows, the two data flows are compatible, but this is not the case with the CSMA/CA scheme [17]. Collisions may also happen and may degrade performance in some cases. This situation is exacerbated when the mobile ad hoc networks are in a state of high density. A simple solution to overcome this deficiency is to broadcast CTS or its variation multiple times, so that more nodes clear the channel for the initiating node, as proposed by [18]. However, the simulation study shows that the potential gain of this strategy is outweighed by the corresponding overhead. In the power consuming mechanism (PCM), RTS/CTS packets are transmitted with a max power level Pmax. Data packets, however, are transmitted with a lower power level. In order to avoid a potential collision caused by the reduced carrier sensing zone, during the DATA packet transmission. PCM periodically increases the

S 1 2 3

D

Request

22530 Muthumayil K et al

transmission power to Pmax. ACK packets are transmitted with the minimum required power to reach the source node. Figure 5 shows the power level used in PCM. In the MAC layer, unnecessary collisions should be avoided because retransmissions require additional power consumption and further increase packet delay. MAC protocols based on RTS/CTS, such as [19] and [20], have been proposed to alleviate these problems. However, as the number of mobile terminals increases, more energy will be consumed for channel contention and network performance will degrade quickly. Additionally, as explained in the following, RTS/CTS-based protocols do not completely solve the hidden terminal and exposed terminal problems. 5.3 Remedy for Sinkhole: Level 1: For every node A, B, nodes A and B are nationals if they are inside each other’s communication range R. They are also called adjacent or neighbor nodes. Level 2: For every node A, B, nodes A and B are neighboring nodes, if the distance between them is DAB, which is

퐷 =푅 − 푑

푉(푅 − 푑) (1)

Where R is the transmission range, d is the distance between nodes A and B, and V is the average speed of the node. Level 3: All the nodes in the network have a counter variable initially set to 0, where the agent node collects the information from the nodes every time. The agent can leave and join with any node in the network; when the agent leaves one node, the counter is incremented. Clearly, the counters specify the number of occurrences by an agent; if two agents have the information of the same node (node A), the information of node B contained in the agent that has a higher counter will be updated. Level 4: All the nodes in the network contain their own ID, and they communicate with other nodes with the help of an agent. Here, the agent packet contains certain conditional parameters, such as DAB, counter, and so on. Agents can share the information contained in agent packets with other agents. These conditional parameters should be updated before the agents leave.

Detection and Prevention of Malicious Nodes ON and OFF 22531

Figure 5: Data packets are transmitted with a periodically increased power level

5.4 Sybil Attack Detection After the route discovery, data transmission occurs on the route and the routing information is stored in the R-table. When the data transmission process starts at the source, the node sends data packets to the next node by verifying the R-table that consists of the information regarding the intermediate nodes. Because all the nodes are assumed to be sensor nodes, those located very close the other nodes can perceive information and communicate messages. In this project, a normal sensor node A is nearest to node 1 available on the route. Because it is very close to node 1, it can sense all the information regarding node1. Node A collects all the information about node 1 and changes its ID to mirror that of node 1 and sends a reply message to the source node. By this process, the source node is hidden from the original node 1 and becomes the node1 Sybil. 5.4.1 Solution of Sybil Attack We propose a novel approach to detect a Sybil attack in the network and to avoid it. Every modern sensor node has a unique radio frequency physical device and frequency value. Although there are two nodes behaving as node 1, the radio frequencies of these nodes are different. Because the source node needs to verify Sybil node identities, each node in the route can be assigned a different channel to broadcast messages. The source node can then randomly select a channel to monitor. If the neighbor that was assigned that channel is legitimate, it will detect this message. Suppose the s of the verifier’s n neighbors are actually Sybil nodes; there is then the probability of choosing to listen to a channel that is not being transmitted, and thus detecting a Sybil node. Conversely, the probability of not detecting a Sybil node

22532 Muthumayil K et al

is . If the test is repeated for r rounds, then the chance of no Sybil nodes being

detected is . Suppose that, in a node's set of n neighbors, there are S Sybil nodes, M malicious nodes, and G good (correct) nodes, then a node can only test C neighbors one at time. Of these C neighbors, there are S Sybil nodes, M malicious nodes, and G good (correct) nodes, and the probability of a Sybil node being detected is 푷풓 = ∑ 푷풓(푺,푴,푮)푷풓(풅풆풕풆풄풕풊풐풏 |푺,푴,푮)풂풍풍 푺,푴,푮 …………….. (2)

= ∑풔푺

풎푴

품푮 푺 (풎 푴)

풏풄 풄풂풍풍 푺,푴,푮 (3)

This test is repeated for r rounds, choosing a random subset to test and a random channel to listen in each round. The probability of a Sybil node being detected is, 푷풓( 풅풆풄풐풏풕풕) = ퟏ − 푷풓(풏풐풏풅풆풕풆풄풕풊풐풏)ퟏ풓풐풖풏풅풓 (4) = ퟏ − (ퟏ − 푷풓((푷풓)ퟏ풓풐풖풏풅풓 ……………….. (5)

= ퟏ − ퟏ − ∑풔푺

풎푴

품푮 푺 (풎 푴)

풏풄 풄풂풍풍,푺,푴,푮 풓 ………………. (6)

According the probability ratio, the Sybil node can be controlled in any network topology of the WSN. 1. Simulation Settings The parameters used in our simulation are shown in Table-1. A few nodes are selected and given multiple identities; these act as Sybil nodes.

Table 1. Simulation Parameters initialized in NS-2 software

Area 1200 x 1200

Nodes 10, 20, 30, 40, 50, 100

Packet Size 50

Transmission Protocol AODV

Application Traffic CBR – TCP - UDP

Simulation Time 50 ms

Queue Type Drop-Tail

Propagation Model Two Ray Ground

Antenna Model Omni Antenna

Routing Protocol AODV

Detection and Prevention of Malicious Nodes ON and OFF 22533

Initial Energy 100 J

Types of Attacks Sinkhole, Sybil, General The proposed approach is developed in the form of programming procedures in TCL language and configured in the back end software NS-2.34. There are five rounds of simulated operations that are brought about by changing the number of nodes in the network. The numbers of nodes are 10, 20, 30, 40, and 50 in each round 1 through 5, respectively.

Figure 6: Number of Sinkhole Node Detection –Existing vs. Proposed approach Initially, at every round, the sinkhole node detection procedure is applied to verify the answers and ascertain the performance of the proposed approach, comparing it with the existing approach. The existing approach finds the sinkhole node from the second round onwards. The proposed system does not detect any nodes as malicious nodes; in the fourth and fifth rounds, one sinkhole node is detected. The activities of the malicious nodes that can be found in the network is higher in the existing system and lower in the proposed system, as depicted in Figure 6.

22534 Muthumayil K et al

0

1

2

3

4

5

10 20 30 40 50

Num

ber

of S

ybil

Nod

e D

etec

tion

Tiime Interval

Existing System

Proposed System

0

0.5

1

1.5

10 20 30 40 50

Num

ber

mal

icio

us n

ode

dete

cted

Time Interval

Number of Sinkhole, Sybil Attack Nodes Detected

sinkhole

sybil

Figure 7: Number of Sybil Node Detection –Existing vs. Proposed approach

Second, at every round, the Sybil node detection procedure is applied. It verifies the answers to ascertain the performance of the proposed approach, comparing it with the existing approach. The existing approach finds more Sybil nodes from the first round onwards. The proposed system does not detect any nodes as malicious nodes until the third round; in the fourth and fifth rounds, one Sybil node is detected. The activities of the malicious nodes that can be found in the network are more prevalent in the existing system and less so in the proposed system, as depicted in Figure 7. Third, at every round, the IBSSDP is applied to verify the answers and ascertain the performance of the proposed approach. The proposed system does not detect any nodes as malicious nodes until the third round; in the fourth and fifth rounds, one Sybil node is detected. The activities of the malicious nodes that can be found in the network are scarce in the proposed system, and as it happens, the number of nodes increases gradually as depicted in Figure 8.

Figure 8: Number of Sinkhole, Sybil Node Detection using Proposed Approach

Detection and Prevention of Malicious Nodes ON and OFF 22535

Figure 9: Comparison of Packet Transmission Existing vs. Proposed Approach

In the proposed system, the success rate of the data packet transmission is higher than in the existing system. Additionally, the number of packets gradually increases according to the number of nodes deployed in the network. The packet transmission comparison of the existing system with the proposed system is graphically displayed in Figure 9.

Figure 10: Packet Success Transmission Before and After Deployment of Proposed Approach The performance evaluation, in terms of the success rate of data packet transmission after deployment of the proposed system, is higher in the network when compared with transmission performance before deployment of the proposed system. Furthermore, the number of packets gradually increases according to the number of

22536 Muthumayil K et al

nodes deployed in the network. The comparison of packet transmission before and after deployment of the proposed system in the network is graphically illustrated in Figure 10.

Figure 11: Energy Remains in the Network before and After Deployment of Proposed Approach A comparison of the performance evaluation in terms of the remaining energy in the network before deploying the proposed approach in the network and after deploying the proposed approach in the network shows that the overall energy remaining in the network gradually decreases according to the number of nodes after deploying the proposed approach in the network, but it fluctuates greatly before deploying the proposed approach in the network. The proposed approach introduced in this paper gives the best performance in terms of data transmission, energy, and malicious node detections. This has been proved in the simulated output using NS-2 software. Conclusion This paper provides the best solution for combatting the sinkhole combined with Sybil attack in a WSN. It shows that, instead of detecting and preventing each kind of attack in the network, a procedure should analyze the attacks using a traditional approach that detects and eliminates the attacks ON the route and OFF the route in the WSN. According to our results, the performance of this approach is superior to all existing approaches. In the future, the preferred approach should be LBIDS for preventing any kind of attack on the network, energy conservation notwithstanding.

Detection and Prevention of Malicious Nodes ON and OFF 22537

References [1] Piro,C., Shields,C., and Levine.B. N., 2006,“Detecting the Sybil attack in

mobile ad hoc networks,” Secure Comm and Workshops, pp. 1–11. [2] Diffie.W., and Hellman,M., 1976, “New directions in cryptography,” IEEE

Transactions on Information Theory, vol. IT-22. [3] Rivest,R. Shamir,A., and Adleman,L.1978, “A method for obtaining digital

signatures and public-key crypto systems,” Communications of the ACM, vol. 21, No. 2, pp. 120-126.

[4] Romer,K., andMattern,F.Dec.2004, “The design space of wireless sensor networks,” Wireless Communications, IEEE, vol. 11, no. 6, pp. 54–61.

[5] Gupta,P., and Kumar,P. R., Mar. 2000,“The capacity of wireless networks,” IEEE Transactions on Information Theory, vol. 46, no. 2, pp. 388–404.

[6] Karlof,C., and Wagner,D., 2003,“Secure routing by wireless sensor networks: attacks and counter-measures,” Ad Hoc Networks, vol. 1, no. 2-3, pp.293–315.

[7] Douceur,J. R., 2002,“The Sybil attack,” Proceedings for the 1st International workshop Peer-to-Peer Systems (IPTPS 02).

[8] Mathewson,N.,Syverson,P., and Dingledine,R., August 2004,“TOR: The second-generation onion router,”In Proc. USENIX Security Symp.

[9] Perkins,C.E., and Royer,E. M., Feb. 1999,“An ad hoc on demand distance vector routing,” In Proc. WMCSA.

[10] Johnson,D., and Maltz,D., 1996, “Dynamic source routing in an ad hoc wireless network,” Mobile Computing, volume 353.Kluwer Academic Publishers.

[11 Hu,Y., and Perrig,A., May/June2004,“A survey of secured wireless ad hoc routing,” IEEE Security & Privacy, 2(3):28–39.

[12] Levine,B. N., Shields,C., and Margolin,N. B.,2006,“A survey of solutions to the Sybil attack,” University of Massachusetts Amherst, Amherst, MA Tech report, vol. 52.

[13] Piro,C., Shields,C., and Levine,B. N., Aug.2006, “Detecting the Sybil attack in mobile ad hoc networks,” Secure Comm. and Workshops, pp. 1–11.

[14] Newsome,J., Shi,E., Song,D., and Perrig,A., 2004,“The Sybil attack in sensor networks: analysis and defenses,” Proceedings of the Third International Symposium on Information Processing in Sensor Networks, pp. 259–268.

[15] Dhaval Gada, Rajat Gogri, Punit Rathod, Zalak Dedhia, Nirali Mody, SugataSanyal, Ajith Abraham, September, 2004, “A Distributed Security Scheme for Ad Hoc Networks,” ACM Crossroads, Special Issue on Computer Security. Volume 11, No. 1, pp. 1-10.

[16] Madden,S., Franklin,M. J., Hellerstein,J. M., and Hong,W., 2002,“TAG: A Tiny Aggregation Service for ad hoc sensor networks,” ACM SIGOPS Operating Systems Review of - OSDI '02: Proceedings of the 5th Symposium on Operating the System Designs and Implementation Volume 36 Issue SI, Pages 131-146.

[17] Kotz,D., Newport,C., Gray,R.,Liu,J., Yuan,Y., and Elliott,C., October 2004,“Experimental evaluation of wireless simulation Assumptions,”, In Proc. ACM/IEEE Intl .Symp on Modeling, Analysis and Simulation of Wireless & Mobile System(MSWiM), pages 78–82.

22538 Muthumayil K et al

[18] McCanne,S., and Floyd,S.,“Network Simulator Version 2,” http://www.isi.edu/nsnam/ns.

[19] http://userver.ftw.at/ toumpis/ad hoc course/ [20] Poojary,N., Krishnamurthy,S. V.,and Dao,S., 2001,“Medium access control in a

network of ad hoc nodes with heterogeneous transmit power capabilities,” (Helisinki).

[21] Udaya,D.,SuriyaRajkumar, and RajamaniVayanaperumal, , 2013,“A leader based monitoring approach for sinkhole attack in wireless sensor network,” Journal of Computer Science vol. 9, no. 9, pp 1106-1116.