Technical Summary: Inferring Routing-Layer Defense Mechanisms from Observable Behavior in OLSR-Based MANETs

1. Problem Statement

Mobile Ad Hoc Networks (MANETs) utilizing proactive routing protocols like Optimized Link State Routing (OLSR) are vulnerable to routing-layer attacks, such as Node Isolation. While significant research exists on detecting these attacks, there is a critical gap in understanding whether deployed defense mechanisms can be detected by an adversary.

The core problem addressed is whether a passive adversary, observing only externally available control-plane and data-plane traffic, can infer the presence of a routing-layer defense. This is particularly challenging for "unobtrusive" defenses, such as the Fictive Mitigation mechanism, which operate entirely within standard protocol messages (e.g., HELLO, TC) without introducing new packet types. If an attacker can detect the presence of a defense, they can strategically decide whether to launch an attack, defer it, or adapt their tactics to evade detection.

2. Methodology

Defense Mechanism and Scenario

The study evaluates the detectability of the Fictive Mitigation mechanism, designed to counter Node Isolation Attacks in OLSR.

• Attack: An adversary manipulates Multi-Point Relay (MPR) selection to disconnect a victim node.
• Defense: Nodes monitor topological consistency in their 2-hop neighborhood. Upon detecting contradictions, they inject "fictitious" nodes into the perceived topology via HELLO and TC messages to restore connectivity.
• Observation Model: The adversary is modeled as a passive observer who overhears wireless transmissions. They cannot access internal node states (routing tables, MAC counters) or hardware metrics (energy, physical mobility).

Simulation and Data Collection

• Simulator: ns-3 with 50 nodes in a 750 × 1000 m² area.
• Configurations: Two regimes were tested: Static (constant positions) and Mobile (RandomWalk2dMobilityModel, 1.5–2.0 m/s).
• Operational Regimes: Four scenarios were simulated for each run:
  1. Baseline (benign)
  2. Attack-only
  3. Defense-only
  4. Combined Attack-Defense
• Dataset: 10,000 valid simulation runs per configuration (total 20,000 runs), yielding 80,000 labeled samples (40,000 per configuration). Each run produced four 40-second measurement windows.

Feature Engineering

Features were derived strictly from externally observable traffic (control-plane messages: TC, MID, HNA, HELLO; and data-plane flow statistics).

• Base Metrics: 33 metrics were retained from an initial 46, excluding internal/hardware-dependent data.
• Categories:
  1. Control-Plane Anomalies: Control packet rates, TC message structure (frequency, links per message), Normalized Routing Load (NRL), and Routing Overhead Ratio.
  2. Performance-Stability: Packet Delivery Ratio (PDR), Throughput, Latency, Jitter.
  3. Engineered Interactions: Ratios and non-linear transformations (e.g., Control-to-Data Ratio, Topology Dissemination Rate).
• Selection: Features were filtered via variance and correlation analysis, then ranked by four importance criteria (Mutual Information, ANOVA F-statistic, Random Forest, ExtraTrees).

Classification Framework

• Task: Binary classification (Defense Active vs. Defense Inactive).
• Models: Twelve classifiers were evaluated, including tree-based ensembles (Random Forest, XGBoost, CatBoost, LightGBM), boosting/bagging meta-estimators, linear models (Logistic Regression, Ridge), and SVM.
• Ensemble: A two-level stacking ensemble was constructed using probabilistic outputs from base models.
• Evaluation: 60/20/20 train/validation/test split at the simulation-run level to prevent data leakage. Performance was measured via Accuracy, F1, and AUC, with 95% confidence intervals estimated via cluster bootstrap resampling.

3. Key Results

In-Domain Performance

• Feasibility: Defense detection is feasible. Ensemble models achieved high accuracy in both static and mobile regimes.
  • Static: Stacking Ensemble accuracy = 0.8874 (AUC 0.9454).
  • Mobile: Stacking Ensemble accuracy = 0.9095 (AUC 0.9594).
• Mobility Impact: Contrary to intuition, ensemble performance improved under mobility. While linear models (e.g., Logistic Regression) collapsed under mobility (dropping to ~0.55 accuracy), tree-based ensembles leveraged the increased complexity of the joint feature space to improve discrimination.
• Feature Dynamics: Under mobility, univariate separability of delay/jitter features degraded significantly (Cohen's d dropped from ~1.1 to ~0.2), but the multivariate joint separability (Mahalanobis distance and LDA ratio) increased, which ensemble models successfully exploited.

Cross-Domain Generalization

• Asymmetry: Using the full 33-feature set, cross-domain transfer was highly asymmetric:
  • Mobile → Static: Robust (Accuracy ≈ 0.84).
  • Static → Mobile: Poor (Accuracy ≈ 0.67).
• Invariant Subset (Universal-4): By restricting the model to a compact subset of four features, cross-domain generalization became near-symmetric and robust:
  • Static → Mobile: 0.8639
  • Mobile → Static: 0.8589
  • Features: Average MPR Count, Average Advertised Links per TC Message, MAC Data Packet Rate, and Flow Throughput Standard Deviation.
• Ablation Analysis: The degradation in the full set was primarily driven by delay- and jitter-based metrics, which are highly sensitive to mobility-induced route churn. Removing these six features restored performance in the Static → Mobile direction without significantly affecting Mobile → Static.

4. Contributions and Significance

Primary Contributions

1. Demonstration of Detectability: The paper provides empirical evidence that even protocol-compliant, unobtrusive defenses (like Fictive Mitigation) leave a statistical footprint in observable routing behavior that can be detected by passive adversaries.
2. Cross-Domain Analysis: It identifies a critical asymmetry in defense detection across static and mobile regimes, showing that models trained on static data fail to generalize to mobile environments unless restricted to invariant features.
3. Invariant Feature Discovery: The study isolates a minimal set of four features (Universal-4) that maintain high detection accuracy across both static and mobile conditions, suggesting that protocol-level structural changes (MPR selection, topology advertisement) are more robust indicators than performance metrics (latency/jitter).

Significance and Claims

The authors claim that their findings have strategic implications for MANET security:

• Reconnaissance Capability: The results indicate that adversaries can use passive observation to infer the presence of routing-layer defenses. This allows attackers to make informed decisions about whether to proceed with an attack, potentially deferring or adapting their strategy to avoid triggering the defense.
• Design Implications: The study suggests that the design of routing-layer security mechanisms must consider observability. Even if a defense does not introduce new packet types, the aggregate behavioral changes it induces may be statistically distinguishable.
• Limitations: The authors modestly note that the findings are specific to the OLSR protocol and the Node Isolation attack scenario. They do not claim that all defenses are detectable or that these specific features apply universally to all MANET defense mechanisms without further validation.

In conclusion, the paper establishes that defense inference is a viable reconnaissance capability in MANETs, driven by subtle statistical deviations in control-plane dynamics that persist even under strict passive observability constraints.