On effective sampling techniques in host-based intrusion detection in tactical MANET

A tactical Mobile Ad Hoc Network MANET demands a robust, diverse and resilient communication and computing infrastructure which enables network-centric operation with minimal downtime. Nevertheless, tactical MANET poses great security risks because mobile nodes are deployed in open hostile environments and wireless communication makes the information accessible to an adversary attacking the tactical MANET. Cyber attack monitoring and detection in the tactical MANET is challenging because of limited resources and its infrastructure-less network environment. To address these issues, we first introduce the host-based detection architecture to monitor and detect cyber attacks against the tactical MANET. We then develop two sampling techniques and discuss other techniques to balance trade-offs between detection accuracy and consumption of network resources. We also analyse the impact of detection accuracy versus sampling techniques and associated parameters. We conduct extensive real-world experiments and simulation studies. Our data validates our theoretical findings well.