PRIDE: A practical intrusion detection system for resource constrained wireless mesh networks

As interest in wireless mesh networks grows, security challenges, e.g., intrusion detection, become of paramount importance. Traditional solutions for intrusion detection assign full IDS responsibilities to a few selected nodes. Recent results, however, have shown that a mesh router cannot reliably perform full IDS functions because of limited resources (i.e., processing power and memory). Cooperative IDS solutions, targeting resource constrained wireless networks, impose high communication overhead and detection latency. To address these challenges, we propose PRIDE (Practical Intrusion Detection system for resource constrained wireless mesh networks), a non-cooperative real-time intrusion detection scheme that optimally distributes IDS functions to nodes along traffic paths, such that intrusion detection rate is maximized, while resource consumption is below a given threshold. We formulate the optimal IDS function distribution as an integer linear program and propose algorithms for solving it effectively and fast (i.e., practical). We evaluate the performance of our proposed solution in a real-world, department-wide, mesh network. An earlier version of this article appeared in ICICS 2013 (Hassanzadeh et al., 2013) and the current article is significantly extended with new technical contents. (C) 2016 Elsevier Ltd. All rights reserved.