SWANS: SDN-based Wormhole Analysis using the Neighbor Similarity for a Mobile ad hoc network (MANET)

In managing a large-scale mobile ad hoc network (MANET), real-time root cause analysis of system events is difficult, as it requires vast measurement and processing resources. Software-defined management and control for a MANET promise to enhance their performance, scalability, and flexibility. However, a wormhole attack is one of the most challenging yet detrimental security issues in a software-defined MANET. As most of the existing security countermeasures are designed mainly for wired SDNs using network topologies, a software-defined MANET cannot directly use them.This paper proposes an SDN-based Wormhole Analysis using the Neighbor Similarity (SWANS) approach as a novel wormhole countermeasure in a Software-defined MANET. As SWANS analyses the similarity of neighbor counts at a centralized SDN controller, it apprehends wormholes not only without requiring any particular location information but also without causing significant communication and coordination overhead. SWANS also countermeasures various false-positive and false-negative scenarios generated by the Link Layer Discovery Protocol (LLDP) vulnerability. We performed extensive studies via both analysis and simulations. Our simulation results show that SWANS can efficiently detect various intelligent wormhole attacks, keeping low false-positive and false-negative rates.