Computer Security – ESORICS 2012

Volume 7459 of the series Lecture Notes in Computer Science pp 145-162

A Probabilistic Framework for Localization of Attackers in MANETs

  • Massimiliano AlbaneseAffiliated withCenter for Secure Information Systems, George Mason University
  • , Alessandra De BenedictisAffiliated withDepartment of Computer Science, University of Naples “Federico II”
  • , Sushil JajodiaAffiliated withCenter for Secure Information Systems, George Mason University
  • , Paulo ShakarianAffiliated withDepartment of Electrical Engineering and Computer Science, United States Military Academy

* Final gross prices may vary according to local VAT.

Get Access


Mobile Ad Hoc Networks (MANETs) represent an attractive and cost effective solution for providing connectivity in areas where a fixed infrastructure is not available or not a viable option. However, given their wireless nature and the lack of a stable infrastructure, MANETs are susceptible to a wide range of attacks waged by malicious nodes physically located within the transmission range of legitimate nodes. Whilst most research has focused on methods for detecting attacks, we propose a novel probabilistic framework for estimating – independently of the type of attack – the physical location of attackers, based on the location of nodes that have detected malicious activity in their neighborhood. We assume that certain countermeasures can be deployed to capture or isolate malicious nodes, and they can provide feedback on whether an attacker is actually present in a target region. We are interested in (i) estimating the minimum number of countermeasures that need to be deployed to isolate all attackers, and (ii) finding the deployment that maximizes either the expected number of attackers in the target regions or the expected number of alerts explained by the solution, subject to a constraint on the number of countermeasures. We show that these problems are NP-hard, and propose two polynomial time heuristic algorithms to find approximate solutions. The feedback provided by deployed countermeasures is taken into account to iteratively re-deploy them until all attackers are captured. Experiments using the network simulator NS-2 show that our approach works well in practice, and both algorithms can capture over 80% of the attackers within a few deployment cycles.


Attacker localization MANET probabilistic framework