An analytical approach to real-time misbehavior detection in IEEE 802.11 based wireless networks

The distributed nature of the CSMA/CA based wireless protocols, e.g., the IEEE 802.11 distributed coordinated function (DCF), allows malicious nodes to deliberately manipulate their backoff parameters and thus unfairly gain a large share of the network throughput. The non-parametric cumulative sum (CUSUM) test is a promising method for real-time misbehavior detection due to its ability to quickly find abrupt changes in a process without any a priori knowledge of the statistics of the change occurrences. While most of the existing schemes for selfish behavior detection depend on heuristic parameter configuration and experimental performance evaluation, we develop a Markov chain based analytical model to systematically study the CUSUM based scheme for real-time detection of the backoff misbehavior. Based on the analytical model, we can quantitatively compute the system configuration parameters for guaranteed performance in terms of average false positive rate, average detection delay and missed detection ratio under a detection delay constraint. Moreover, we find that the short-term fairness issue of the 802.11 DCF impacts the transition probabilities of the Markov model and thus the detection accuracy. We develop a shuffle scheme to mitigate the short-term fairness impact on the sample series, and investigate the proper shuffle period (in terms of observation windows) that can maintain the randomness in each node's backoff behavior while resolving the short-term fairness issue. We present simulation results to confirm the accuracy of our theoretical analysis as well as demonstrate the performance of the developed real-time detection scheme.