A Flow-Based Network Monitoring Framework for Wireless Mesh Networks - PowerPoint PPT Presentation

1 / 17
About This Presentation

A Flow-Based Network Monitoring Framework for Wireless Mesh Networks


For proactive routing protocols like OLSR, attacker can advertise a modified routing table, leading all traffic towards an intended address or to generate loops. – PowerPoint PPT presentation

Number of Views:21
Avg rating:3.0/5.0
Slides: 18
Provided by: Preferred2


Transcript and Presenter's Notes

Title: A Flow-Based Network Monitoring Framework for Wireless Mesh Networks

A Flow-Based Network Monitoring Framework for
Wireless Mesh Networks
  • Authors
  • Feiyi Huang, Yang Yang, University College London
    Liwen He, British Telecom Group CTO
  • Presented by
  • Sheetal Gupta
  • CMSC 681 Fall 2007

  • Wireless Mesh Networks
  • Vulnerabilities and Security Challenges
  • Proposed MeshFlow Framework
  • MeshFlow Record Structure
  • Record Creation
  • Record Management
  • Record Analysis
  • Implementation Issues
  • Conclusion

Wireless Mesh Networks (WMN)
  • Are an extension of wireless ad hoc and sensor
  • Has a hybrid network infrastructure with a
    backbone and an access network.
  • It is a group of self-organized and
    self-configured mesh clients and routers
    interconnected via wireless links.
  • Applications digital home, community and
    neighborhood networking, enterprise networking,
    emergency and disaster networking.

Wireless Mesh Networks (WMN)
  • Mesh clients can be user devices with wireless
    network card, like PCs laptop, PDAs and mobile
    phones. They have limited energy, computing power
    and radio range.
  • Mesh routers are usually more powerful in terms
    of computation and communication capabilities and
    have continuous power supply.
  • They normally are static and provide access
    points to supply internet connections for
  • User traffic from client is transmitted through a
    multihop, wireless path to its destination
    client-to-client (CC), client-to-router (CR) and

Wireless Mesh Networks (WMN)
  • Wireless mesh backbone network is formed by ad
    hoc mode interconnections of mesh routers.
  • When new or existing router joins or leaves the
    backbone, the network self-organizes and
    self-configures accordingly.
  • In WMN, usually there is one static mesh router
    and a number of mesh clients that are either
    static or mobile.

Vulnerabilities and Challenges
  • Security attacks can be in the physical, MAC and
    network layers.
  • Physical layer Radio frequency jamming
    Attackers can generate jamming signals to
    interfere with communications on wireless
  • MAC layer attack In contention based MAC
    protocols, a small back-off interval gives the
    user the advantage of gaining access to the
    wireless channel quickly. Another attack is
    continuously broadcasting busy tone signals
    causing other users to be in waiting status for a
    long period.
  • Network layer For reactive routing protocols
    like AODV, the node list in the route request
    (RREQ) and route reply (RREP) can be fabricated,
    replaced or deleted. For proactive routing
    protocols like OLSR, attacker can advertise a
    modified routing table, leading all traffic
    towards an intended address or to generate loops.
    Attacker can steal all packets, produce a
    sink-hole by selectively discarding packets.

Vulnerabilities and Challenges(cont.)
  • Denial of Service (DoS) attack Handshake
    messages, other access control packets in the MAC
    layer, routing tables and route discovery packets
    in the network layer can be easily falsified to
    exclude vital fields, include a non-existing
    source or destination or replace by malformed
  • MAC message exchange and route discovery
    procedures will be suspended by these unreadable
    packets and tables.
  • As a result, additional requests from other
    devices will not be responded to by these
    terminals which are struggling to resolve these
    packets and tables.
  • DoS attack can be achieved more easily by
    flooding attacks ICMP flooding, synchronize
    packet in TCP flooding and UDP flooding. In WMN
    flooding is more damaging because of weaker
    network devices.

MeshFlow Framework
  • All these performance degradations will be
    reflected in the network traffic change.
  • By monitoring the traffic change situation, an
    attack can be actively monitored.
  • In a WMN the concept of network traffic flow is
    extended and defined as MeshFlow.
  • The MeshFlow framework is designed to generate,
    transmit and analyze MeshFlow records.

MeshFlow Framework(cont.)
  • MeshFlow record is a special kind of packet and
    contains a summary of the properties of packets
    passing through a mesh router.
  • Fields included are source and destination
    addresses, next-hop address, number of bytes,
    packets, transport protocols and previous
    transmission delay summation.
  • MeshFlow Creation - On each mesh router, part of
    the memory is separated to construct a MeshFlow
    cache dedicated to MeshFlow record creation and
  • When a packet travels through the router, its
    transmission information is extracted and
    comprises a MeshFlow record.
  • If 2 packets have the same source, destination,
    next-hop address and the same transport protocol,
    their transmission information is aggregated into
    one record by aggregating the number of packets,
    bytes and delay duration.

MeshFlow Framework (cont.)
  • MeshFlow Management - When a MeshFlow record is
    created it is stamped to indicate starting time
    of the record.
  • An aging mechanism is implemented to calculate
    the overall active duration of the record.
  • The records are then exported to a dedicated
    collector and analyzer and permanently deleted
    from the MeshFlow cache.

MeshFlow Framework (cont.)
  • MeshFlow analysis After exporting the records
    from all routers to the collector, an entire
    network picture can be constructed.
  • User monitoring When a packet travels through a
    multi-hop path consisting of mesh routers,
    records are created on each router. On
    aggregating records, the complete transportation
    path of a packet can be derived, including
    source, destination and all intermediate routers.
    So a comprehensive investigation of each traffic
    flow is achieved.
  • Router monitoring When records are aggregated
    based on mesh routers, traffic transported on
    each of its channels can be illustrated clearly.

MeshFlow Framework (cont.)
  • MeshFlow analysis (cont.)
  • Security Protection An attack scenario leads to
    abnormal traffic. These can be detected by
    analyzing the MeshFlow records and matching with
    attack signatures. For example, in a flooding
    attack there is burst traffic toward the same
    destination. In MAC abuse there will be no
    successful transmissions for that access network.
    Protection can be achieved by further action like
    letting the flood-generating router block the
    corresponding attack traffic.
  • Application and Service Monitoring Different
    network applications usually are performed by
    separate transport protocols. MeshFlow records
    can be aggregated for each application at each
    router. Inappropriate resource utilization is
    reallocated to balance different applications
    performed on each router.

Implementation Issues
  • Unavoidably the MeshFlow framework induces extra
    overhead on the network.
  • Careful designing to suit specific network
    scenarios is required.
  • Two static parameters must be determined.
  • MeshFlow record structure Different fields are
    used for different monitoring and analysis. It is
    not necessary to generate a complete record for
    every scenario.
  • Collection method Three methods possible.
  • Dedicated cable line Each router had a
    dedicated cable line
  • Distributed antenna The MeshFlow collector has
    antennas deployed around the entire backbone
  • Multi-hop relaying Records are exported as
    normal packet transmissions via multi-hop
    router-to-router wireless links, finally reaching
    the collector.

Implementation Issues (cont.)
  • Two dynamic parameters must be determined
  • Packet sampling rate For each incoming packet
    at a router, information is either extracted
    immediately or ignored, depending on sampling
  • Time-based Extract information from packets at
    some time intervals
  • Packet-based Sample one packet after ignoring a
    certain number
  • Terminal-based More frequent sampling for
    packets from terminals having a bad history.
  • Exportation time interval
  • Idle Export if a record is idle for a certain
  • Active if a record if active for too long
  • Oldest record exported when Mesh cache is
    heavily loaded.

  • We reviewed security challenges, attacks in the
    physical, MAC and network layers of Wireless Mesh
    backbone and access Networks.
  • We defined a new concept of MeshFlow and proposed
    a flow-based network monitoring framework to
    tackle the security issues in WMNs.

  • A Flow-Based Network Monitoring Framework For
    Wireless Mesh Networks, Feiyi Huang, Yang Yang,
    University College London, Liwen He, British
    Telecom Group CTO

Thank you!
  • Questions?
Write a Comment
User Comments (0)
About PowerShow.com