IARS' International Research Journal

Information security has been more prominently considered under product approach in which this is considered as a framework of products providing different functionalities or features of information security like information availability, authenticity, non-repudiation, etc. But there is another important view point of information security. This is the Process View of information security in which the information security is considered as a process rather than a product. The process approach provides the benefits of repetitiveness, simplicity, and also statistically measureable and controllable. One can statistically manage the process for its maturity and capability. This white paper talks about understanding the information security as a process and then understanding the concepts of process maturity and capability for Information Security in organizations

Kakkar, Alpana

Punhani, Ritu

  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 1 
Process Capability 
and Maturity in 
Information 
Security 
Alpana Kakkar, Ritu Punhani, Deepak Jain 
IARS' International Research Jorurnal. 
 
International Association of Research Scholars,  
29 Aug. 2011. Web. 08 Sep. 2011. 
<http://irj.iars.info/index.php/82800102201105>
Process Capability and Maturity  
in Information Security 
Alpana Kakkar, Ritu Punhani, D. Jain 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 2 
 
 Process Capability 
and Maturity in 
Information Security 
Alpana Kakkar 
Deputy Director, Institute of Information Technology,  
Amity University, Noida, U.P – India 
Ritu Punhani 
Asstt. Professor, Institute of Information Technology,  
Amity University, Noida, U.P – India 
D. Jain 
HCL Technologies Ltd., India 
 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 3 
Process Capability and Maturity in  
Information Security  
Abstract 
Information security has been more prominently considered under product approach in which 
this is considered as a framework of products providing different functionalities or features of 
information security like information availability, authenticity, non-repudiation, etc. But there 
is another important view point of information security. This is the Process View of 
information security in which the information security is considered as a process rather than a 
product. The process approach provides the benefits of repetitiveness, simplicity, and also 
statistically measureable and controllable. One can statistically manage the process for its 
maturity and capability. 
This white paper talks about understanding the information security as a process and then 
understanding the concepts of process maturity and capability for Information Security in 
organizations. 
Understanding Process of Information Security 
Process is a set of ordered repeatable steps that are executed to accomplish specific tasks. 
Any process has very specific entry and exit criteria. A process addresses problems and 
solutions in a structured way including interrelationships and dependencies. 
Information security has been more prominently considered under product approach in which 
this is considered as a framework of products providing different functionalities or features of 
information security like information availability, authenticity, non-repudiation, etc. But there 
is another important view point of information security. This is the Process View of 
information security in which the information security is considered as a process rather than a 
product. 
This is well proven that the people who understand the value and purpose of focused and 
effective processes (i.e. have a process mindset) can create a well-run business complete with 
the required checks and balances. Inherent in these organizations will be a foundation and 
culture that will be poised to exponentially grow with the improved productivity, quality, and 
reduced chaos. 
This makes the process mindset of information security more important. In this process 
mindset of information security, the information security framework can be considered as a 
process providing repeatability, continuity, and simplicity. 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 4 
Understanding Process Capability 
One must understand that process control is not same as process capability. The AT&T 
Statistical Quality Control Handbook states, ―The natural behavior of the process after 
unnatural disturbances are eliminated is called the process capability.‖ The handbook 
emphasizes that a process capability study is a systematic investigation of a process by using 
control charts to determine its state of control, checking any lack of control for its cause and 
taking action to eliminate any nonrandom behavior when justified in terms of economics or 
quality.  
Process control talks about the stable nature of the process using agreed performance 
measures of the process over a given distribution of time and hereby address the inner voice 
of the process. This signifies that the process performs in an expectable distribution and 
hereby shows a stable behavior. 
The process capability on the other hand talks about how good the process is. This in fact 
takes in it the ―voice of customer‖ in terms of specification limits and ―voice of process‖ in 
terms of control limits of the process. 
The objective of process capability is to get as close to the theoretical best variation that the 
process can achieve by eliminating special causes of variation, so that only common causes 
are acting on the process, and then to reduce these to a minimum whenever possible. 
Understanding Process Maturity 
Process maturity is an indication of how close a process is to being complete, and capable of 
continuous improvement through quantitative measure and feedback. In today's business 
environment many organizations face the challenge of complying with regulatory, industry or 
contractual standards. The challenge is not just about complying but the organizations must 
also prove their compliance. Most competitive businesses around the globe are focusing on 
their processes for quality improvement, cost reduction and delivery-time reduction. They 
also are looking at other ways of achieving an edge over competitors, and for this they 
believe on making their processes more and more mature. 
Organizations never hesitate to go for third party international standards and process audits 
for timely assessment of their process maturity and this in fact has made the international 
standard process maturity certification like CMM, CMMi, ISO, PCMM, ITIL, COPC etc. 
very popular. 
Understanding in minimum words, the maturity of a process indicates the directive efforts of 
the entire team to meet the common goal. For the overall effort to be successful, decisions 
and actions must be coordinated among individuals and between groups. They also must be 
consistent and yield satisfactory results at reasonable cost. Generally businesses follow an 
approach or framework which is a top down structure from planning to action, as illustrated 
in Figure 1. 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 5 
For the overall effort to be successful, decisions and actions must be coordinated among 
individuals and between groups. They also must be consistent and yield satisfactory results at 
reasonable cost. Generally businesses follow an approach or framework which is a top down 
structure from planning to action, as illustrated in Figure 1. 
Understanding CMM 
The Capability Maturity Model (CMM) was originally intended to characterize processes 
involved in software development that affect the quality of the code that is produced. In a 
nutshell, the lowest CMM level (level 0) is called ―nonexistent;‖ there is no awareness of the 
need for systematic development processes. At the highest level (level 5), development 
processes are optimized by being implemented, monitored and managed throughout an entire 
organization. The Software Engineering Institute (SEI) validated this model by empirically 
showing the relationship between processes in real-world software development settings and 
quality metrics such as number of bugs per 1000 lines of code.  
In 1987, Software Engineering Institute of Carnegie Mellon University – USA started the 
project for introducing CMM or Capability Maturity Model as a reference for an objective 
evaluation of different software devices‘ ability to perform for the government. Capability 
Maturity Model (CMM v1.0), the very first CMM, was developed and released in August of 
1990.  
This reference model is a five level assessment model developed with a focus to illustrate the 
best practices regarding engineering and management, specifically in software development. 
It is proved to be an evolutionary model of the movement of any software developing group 
or organization. 
Capability Maturity Model  
The capability maturity model (CMM) is not a process model for software development but is 
a model that describes the maturity of the organization or the team developing the software 
and the process of development. The CMM was defined by the Software Engineering 
Institute (SEI) of Carnegie Mellon University along with many other organizations with an 
intention of measuring the efficiency and sense of maturity of the process of development. 
In its structure, CMM categorizes hierarchically software-developing organizations on the 
basis of the maturity of their process, in five distinct levels (Figure 2). Each of these levels is 
defined with set of associated process goals. These levels are defined here. 
1. Initial: The first and lower most CMM level is known as ‗initial‘. At this level, 
most of the processes run on ad-hoc practices and the success of the process depends 
on the expertise of developers. But the success history does not repeat so often in any 
defined manner. This is due to the unavailability or non-adoption of any formal 
method with retainable documentations. The process at the initial level is disorganized 
and crisis probable.  
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 6 
2. Repeatable: The second-lowest level of the CMM is named as ‗repeatable‘. At this 
level, strategies for carrying out the development process are formally planned and 
the development is tracked. As the name of the level suggests, the process is 
repeatable for its success because of formal planning. 
3. Defined: At the third level from the bottom of the hierarchy in CMM, the 
‗defined‘ level, the process of development is formally defined at all levels of 
organization. A formal organizational constitution is defined, which is followed at all 
levels of development to develop a formal management control over the process. 
4. Managed: At the next level of CMM, organizations establish metrics and 
measured controls over the process. This leads to a fair management of the process 
with quantitative definitions of goals and process to achieve these goals. 
5. Optimization:The top most level of CMM is ‗optimization‘, where the goal of the 
organization is not only the user satisfaction and development of highly efficient 
software but also contribution to their social and ethical responsibilities towards 
software practices in a formal manner. At this level, organizations work for the 
betterment of not only the products but also of the process. This level in CMM has a 
set goal of making improvements in traditional processes of software development.  
The CMM is important to compare the software-engineering processes for maturity of their 
approach and efforts to improve the software products and development processes for better 
quality and better process control. It is used as a guideline for software process improvement 
efforts. The CMM categorizes software-development organizations on the basis of their 
contribution to the software market in terms of improvement in the software product quality 
by enhancing the development life cycle process. It specifies the ethical and social 
responsibilities associated with the development procedures for software. It describes the 
parallel importance of process improvements along with product improvement as user 
satisfaction. It also introduces hierarchy in software industry, based on maturity of the work 
of organization. Some major responsibilities defined at each level of CMM are mentioned in 
Figure 3. 
Focus of CMM 
Not surprisingly, the CMM model is also widely applied to information security practices to 
the point that it has become a major basis for measuring the performance of an information 
security practice. There is a certain intuitive goodness to the CMM model; as one goes to 
higher CMM levels, more processes that appear to systematically address risk are present. At 
level 2, for example, processes are repeatable but intuitive; comprehension the nature of risk 
and the need for security is just starting to happen. At level 3, there are defined processes, as 
evidenced by an organization-wide security risk management policy and the emergence of 
security training and awareness. 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 7 
At the time of development and release, the main focus of CMM was to aid the US 
government in evaluating software providers‘ abilities to handle large projects. They were 
interested to ensure the measurability of capability of the software development groups to 
produce high quality and reliable software products by following well defined, properly 
controlled, and highly mature development processes. 
The focus was to ensure more established and advanced processes for software development 
with lesser flaws in scheduling and budgeting of the projects. Also, there were needs to 
improve the quality of the product with lesser defects by improving in the development 
process. CMM reference model improved the things and helped in providing effective 
solutions to most of these challenges. 
Applying CMM on Information Security Process 
The CMM model has been applied to information security practices for at least a decade. But 
assessments of information security practices often find that the information security 
processes seldom reach the highest level of 04 or 05. These processes face high challenges 
and usually are found to reach only to the CMM levels of 02 or maximum 03 
Dr. Eugene Schultz finds several reasons for this [2]: 
1. Failure on the part of information security managers (ISMs) to truly understand the 
nature of the business(es) that they are supposed to defend, support and enable. 
Without a genuine understanding of the business itself as well as the business 
processes involved, a large gap between senior management‘s and the ISM‘s 
expectations is likely to develop, something that almost always costs information 
security practices in terms of credibility, leverage, and resources needed to effectively 
manage risk. 
2. A general lack of knowledge regarding information security management. Too often 
technically competent people are pushed into information security management with 
any kind of appropriate information security management knowledge and skills. 
Many lack even the most basic knowledge of security, let alone security management. 
The result is inevitable—―barking up the wrong tree‖ (or sometimes simply 
wallowing in indecision) when it comes to managing security risk correctly and 
efficiently. 
3. Obstacles imposed by senior management. Senior management‘s lack of knowledge 
concerning information security is one of the most formidable obstacles to the 
maturity of information security practices. Without suitable knowledge, senior 
management is unlikely to adequately support information security efforts in terms of 
elevating the ISM position to a suitable level within the organization, signing off on 
policies, standards and procedures, providing adequate resources, and more. 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 8 
4. Lack of oral communication and interpersonal skills on the part of ISMs. Although 
many ISMs excel in oral communication and interpersonal skills, some do not. The 
people factor is essential in on-the-job success (not just in information security, but 
also in just about every job and task); communication and interpersonal skills are thus 
essential if ISMs are going to bring their practices to levels of greater maturity. 
5. Failure to set proper security goals for information security practices and to monitor 
and report progress. Too often ISMs do not set appropriate goals for their information 
security programs, or it they do, they do not design and put in place processes for 
monitoring and communicating (e.g., to senior management) the degree to which 
goals are or are not being met. 
6. Failure to cooperate with and leverage other, similar functions within organizations. 
Other functions within organizations such as physical security and audit have many 
common interests and goals with information security. Given that resources available 
to information security are almost invariably limited, cooperating closely with and 
leveraging these other functions in mitigating risk is the most logical course of action. 
Some ISMs neglect doing this, however. 
There are additional reasons that information security practices do not achieve greater levels 
of CMM maturity. The ones I have presented are in my mind the most critical ones, however. 
Conclusion 
Information security can be understood as a process mind set also. The concepts of process 
capability and maturity can be applied to processes of information security also. The 
implementation of CMM in information security processes can make this more mature and 
capable, but this faces many challenges and need more researches and practices to be 
implemented. 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 9 
Figures and Tables 
 
Figure 1: A general business framework 
 
 
 
 
Figure 2: 5-Level Process Maturity Reference Model (CMM) 
  Vol. 1, No. 2, 2011 
        ISSN 1839-6518  82800102201105 
www.irj.iars.info  Page 10 
 
Figure 3: Responsibilities defined at each step of CMM 
 
 
References 
1. D. Jain (2008), Software Engineering: Principles & Practices, Oxford University 
Press 
2. Eugene Schultz (Jan 2008) The Capability Maturity Model in Information Security; 
DOI: http://blog.emagined.com/2008/01/17/the-capability-maturity-model-in-
information-security 
3. James LaPiedra (2011), The Information Security Process Prevention, Detection and 
Response, Global Information Assurance Certification Paper, GIAC directory of 
certified professionals. 
4. Juhi Vasisht (2006), A Process Mindset: A Foundation for Information Security, 
Technical Enterprises, Inc., The ISSA Journal, January 2006 
5. Kakkar, Alpana, Ritu Punhani, and D. Jain, (2011) ―HARVESTING THE WEB TO 
PROCURE SECURE INFORMATION FOR ENTERPRISE‖ IARS‘ International 
Research Journal, DOI: http://irj.iars.info/index.php/82800101201105 
6. Karen Ferraiolo (2000), The Systems Security Engineering Capability Maturity 
Model, ISSEA 
7. Kelley Dempsey, Arnold Johnson, Ronald Johnston, Alicia Clay Jones, Angela 
Orebaugh, Matthew Scholl, and Kevin Stine (2011), Information Security Continuous 
Monitoring (ISCM) for Federal Information Systems and Organizations, Computer 
Security Division, Information Technology Laboratory, National Institute of 
Standards and Technology, U.S. Department of Commerce, Gaithersburg, MD, USA. 
8. Mark C. Paulk and Michael D. Konrad (1994), MEASURING PROCESS 
CAPABILITY VERSUS ORGANIZATIONAL PROCESS MATURITY, Software 
Engineering Institute, Carnegie Mellon University, Pittsburgh 
9. Mitchell Rowton (2011), Information Security as a Process, PacketSource — Security 
White Papers, DOI: http://www.packetsource.com/article/policy-
guides/38249/information-security-as-a-process 
10. S.W. Smith, Eugene H. Spafford (2004), Grand Challenges in Information Security: 
Process and Output, IEEE SECURITY & PRIVACY, IEEE COMPUTER SOCIETY. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 


English

Process Capability and Maturity in Information Security

Mobile Ad hoc networks are often used in places with little or no infrastructure. However its very nature of being dynamic and infrastructure less makes it vulnerable to many of the security related issues. In this paper we make use of the vulnerability present in the AODV protocol to present a new kind of Man in the Middle attack for MANETs namely, â€œThe Paris Attackâ€

Jain, Mohit

K, VISHNU

Paris Attack in 
Wireless Ad Hoc 
Network 
Vishnu K.; Mohit Jain  
IARS' International Research Jorurnal. International Association of Research 
Scholars, 08 Feb. 2011. Web. 08 Feb. 2011. 
<http://irj.iars.info/index.php/82800101201102>. Abstract: Mobile Ad hoc 
networks are often used in places with little or no infrastructure. However its 
very nature of being dynamic and infrastructure less makes it vulnerable to 
many of the security related issues. In this paper we make use of the 
vulnerability present in the AODV protocol to present a new kind of Man in 
the Middle attack for MANETs namely, “The Paris Attack”.  
Paris Attack in Wireless Ad Hoc Network 
Mohii tt   Jaiin,,   Vii shnu  K  
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 2 
 
 
Paris Attack in Wireless 
Ad Hoc Network 
 
Mohit Jain 
Maharaja Surajmal Institute of Technology 
New Delhi, India 
 
Vishnu K. 
Maharaja Surajmal Institute of Technology 
New Delhi, India 
 
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 3 
Paris Attack in Wireless Ad Hoc Network 
 
Abstract 
Mobile Ad hoc networks are often used in places with little or no infrastructure. However 
its very nature of being dynamic and infrastructure less makes it vulnerable to many of 
the security related issues. In this paper we make use of the vulnerability present in the 
AODV protocol to present a new kind of Man in the Middle attack for MANETs namely, 
“The Paris Attack”. 
Keywords: Mobile Ad hoc Networks; Black Hole; Routing; AODV; Routing Table. 
Introduction  
A mobile Ad hoc network (MANET) is a network formed by a collection of nodes that 
are free to move around (mobile), leave and join the network at their wish. This kind of a 
network is beneficiary at places where building up an infrastructure is not feasible. Due 
to this lack of proper infrastructure and dynamic nature of MANETs it is prone to many 
security issues.  
AODV [2] is one of the main routing protocols that are currently being used. Since 
AODV is a reactive protocol, whenever a node is ready to make a data transmission (say 
source node S) to any other node (say Destination node D) it starts the route discovery 
process. This is done by broadcasting a Route Request Packet (RREQ) to all of its 
neighbors. These packets are further transmitted to its neighbors and so on, until a node is 
found which has a fresh enough route to the Destination node (D) or the Destination node 
itself. In the either case the node replies back with a Route Response (RREP) to the node 
from which it received the RREQ. This RREP is further transmitted in the reverse 
direction till it reaches the Source node (S). The intermediate nodes update their routing 
tables whenever they receive an RREQ or an RREP packet with the next hop 
information. 
Once the RREP packet reaches the Source node (S) it starts routing the data packets to 
the node from which it first received the RREP. This is because it is usually the shortest 
path. The packet is further passed on according to the next hop information of the 
intermediate nodes till it reaches the Destination node. Some researchers [3-11] discuss 
the vulnerabilities in Ad hoc routing protocols and the attacks that can be launched. The 
AODV protocol is vulnerable to many of the attacks. Some of them are The Black Hole 
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 4 
attack [3], Gray Hole Attack [6, 7], Rushing Attack [11], Worm Hole Attack [8-10] etc.  
A Black hole is a node that always answers positively for a Route Request (RREQ) even 
though it does not necessarily have a route. However once the data packets are routed 
through this node, it silently drops all the packets. A Black hole usually has a high 
probability of being chosen as a route because of two reasons:  It doesn’t have to check 
its routing table each time a RREQ is made to it. This reduces the computation time for 
the RREQ packet. It answers positively for every route request. On the other hand a Gray 
Hole is a node which behaves as normal node till a certain point of time but turns 
malicious later on. Also a Gray hole does not necessarily drop all the data packets, as in 
the case of a Black Hole. It may be selective towards specific nodes or specific kind of 
packets. Hence it is much more difficult to detect a Gray Hole in comparison to a Black 
Hole.  
In this paper we present a new kind of attack for an ad hoc network that has the chances 
of being chosen as a valid route as high as that of a Black Hole & the stealth in the 
network much more than that of a Gray hole. The primary motive of the paper is to 
present a mechanism to intercept all the local network traffic around the malicious node 
without being detected. The rest of the paper is organized as follows. In section 2, we 
survey the related work. In section 3 the network model is given. In section 4, the 
proposed Methodology for the Attack is given. Finally in Section 5 we conclude and 
discuss future work. 
Related Work 
Recent researches have proposed many edible solutions to the above mentioned attacks. 
Many other attacks have also been proposed such as the Worm Hole Attack, the Rushing 
Attack, etc. Some of them have been briefed up below. 
As explained earlier Juan [3] proposed the black hole injection attack in AODV 
according to which the malicious node replies positively for every RREP and hence gets 
into the route. It then silently drops all the data packets to be forwarded .Deng [4] has 
proposed an algorithm to prevent black hole attacks in ad hoc networks. Further S. 
Ramaswamy [5] proposed a solution to counter even the co-operative black hole attack. 
Since then many other solutions [4-7] have also been proposed. In case of a gray hole 
attack [6], it is a variation of the black hole, in which the nodes are initially not malicious 
but turns malicious later on. Also in such an attack the gray node may selectively drop 
data packets which make it further difficult to detect it. In order to counter this attack 
S.Banerjee [6] proposed that the total data traffic be divided into small sized blocks and 
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 5 
then perform an end to end checking. Many others [6-7] have also proposed various 
solutions. 
In case of a wormhole attack [10], a node selectively transfers the packets that have 
routing information from one side of the network onto the other side by using a link. This 
shields the nodes near by the attackers from using any other alternative routes that has 
more than one or two hops. Hence making sure all the packets are routed through this 
link. Once, this tunnel is chosen for data transmission the attackers can drop/modify the 
data packets, selectively. A few solutions [8-10] have been proposed to counter 
wormholes as well. 
And then there is the rushing attack [11] where an intermediate node rushes the 
forwarding of RREQ without updating its own routing table. This way it increases its 
chance of being chosen as a possible route. Once the communication link is established 
through this malicious node, it may behave similar to a worm hole by 
dropping/modifying data packets. In order to defeat the rushing attack many solutions 
have been proposed. One such solution proposed by Hu [11] randomizes and delays the 
forwarding of RREQ packets so that an RREQ rushing attacker cannot dominate other 
members during the RREQ phase. 
Further there is the Check Sum Tamper attack [14] and the Port Change attack [13] 
where an intermediate node alters specific fields of the data packets that are being routed 
through it in a way that makes this data corruption stealthy and difficult to detect. The 
data corruption gives an overall effect of the data packets being dropped, however 
physically there is no packet dropping. 
Network Model 
We assume that the network nodes are randomly deployed across the network. We also 
assume that communication is based on an on-demand routing protocol such as AODV. 
Methodology 
Our proposed attack mechanism is a variation of the Black Hole Attack. The major 
difference being that, in a Black Hole attack, the malicious node necessarily drops all the 
data packets that are being routed through it and does not have any valid route to the 
destination. But in our proposal the intention of the attack is to make the malicious node 
an intermediate node. This attack can be used to further pile up other attacks in MANETs 
such as the Port Change Attack [13] or the Check Sum Tamper Attack [14].  
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 6 
The attack approach proposed in this paper structures in three successive stages “Figure 
1”: 
 STEP1: When the source node S wants to route the data packets to the destination 
D, it floods the network with RREQ packets “Figure 2”. This is a common step in 
the functioning of any reactive protocol (such as AODV) as explained in Section 
1. Whenever the node needs to route a packet it finds the route to its destination 
by flooding the RREQ and expects a RREP soon. The first node to reply with a 
RREP is chosen as the shortest route and the data is routed through it. 
 STEP2: The malicious node (P) answers positively for every RREQ message it 
encounters with a RREP “Figure 3”. Note that the malicious node (P) doesn't have 
to look into its Routing table to reply with a RREP packet which saves the RREQ 
processing time. This move is the same as that of a Black Hole Attack. However 
the difference is observed because of Step 3.  
 STEP3: The malicious node simultaneously finds a valid route itself to each of 
the victim node's destination (this is where the attack differs), by itself 
broadcasting a RREQ packet in search of a route to the destination node “Fig3”, 
“Fig4”.This RREQ is flooded to all other neighboring nodes except the one from 
which it received the earlier RREQ. This way the attacker has a valid route of 
each of the nodes it acts as an Intermediate Node “Figure 5”. 
Since in Step 2 the attacking node (P), doesn't have to check its routing table, it is usually 
the first to respond to the RREQ in most cases and gets chosen as one of the routing 
nodes. Hence the motive of this attack, which is to intercept all of the local network 
traffic, is fulfilled. 
The advantage of the extra link established is that the malicious node doesn't necessarily 
have to drop the intercepted data packets. Instead the node can corrupt the data packets 
by altering the data. This node would then be like the gateway to all the other local nodes. 
Hence Paris Attack can act as a precursor or a 1
st
 stage to inject a malicious data 
intercepting node of any other Man in the Middle (MITM) attack [13, 14] above it. 
Another option is for the node to choose to be a silent Sniffer as in the case of a hacker 
which also may prove fatal to the Network Security. 
It must be mentioned here that P can carry out other different types of attack by simply 
changing the way it manipulates the intercepted packets. The extra link also makes the 
detection mechanism more difficult. This will be more evident after the discussion below 
on detection strategies of other attacks. 
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 7 
Now here is why this attack proposal stands distinct. None of the detection methods used 
to detect a Black Hole, Gray Hole or a Worm Hole can be used to detect the Paris Attack.  
In a traditional Black Hole attack the data packets are plainly dropped and hence the 
detection is easier. Let's look into some of the Black Hole detection methods and see why 
they don't apply here.  
Deng et al [4] initially proposed an algorithm to prevent Black Holes. According to their 
algorithm any node receiving a RREP from an intermediate node crosschecks with the 
next hop on the route if it has a link to the node that sent the RREP and if it also has a 
link to the Destination node. Now in case of a Black Hole it gets caught as there isn't any 
valid route but in our proposed attack since a valid route and the link does exist, this 
detection algorithm would fail. 
Later on S. Ramaswamy [5] extended the above detection method by intensive cross 
checking to solve co-operative Black Holes too. But since the basic idea of cross 
checking is the same, even this detection method would fail.  
Then S. Banerjee [6] proposed an algorithm for detection of Black/Gray holes. The main 
idea being the flow of traffic was monitored by the neighbors of each node. However as 
we see in our attack as long as there is no explicit packet dropping the traffic flow is 
maintained and the attack can't be detected. 
Further Marti [1] proposed the watchdog/pathrater algorithm in which every node has a 
watchdog which listens to the node's packet forwarding promiscuously. In case any of the 
nodes starts dropping the packet above a threshold, the watchdog accuses it to be 
malicious. Once again in this algorithm the watchdog can detect the malicious node only 
if there is a packet drop.  
Gonzalez [12] also uses a similar concept in which the principal idea is the conservation 
of flow, meaning all packets sent to a node and not destined to that node are expected to 
exit the node. This is not violated in the Paris Attack and hence safe from detection. 
Hence as we see most of the algorithms designed to detect other malicious attacks 
wouldn't suffice in detecting this attack. This makes Paris Attack stealthier than any other 
know attacks.  
Conclusion and Future Work 
In this paper we have fully presented the methodology of a new kind of attack in an ad 
hoc network. As future work we hope to  
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 8 
 Develop simulations to analyze the performance of the above attack. 
 Develop an efficient solution to the above proposed attack. 
 
Figures and Tables 
 
 
Figure 1: Representation of different nodes 
 
 
 
Figure 2: RREQ Flooding by Source Node. 
 
 
Figure 3: RREP by Attacker + RREQ in 
search of a valid route to D. 
 
    
     
     
 
 
 
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 9 
 
 
Figure 4: RREP by D to the Attacker P. 
 
 
Figure 5: Final route from S to D 
 
References 
1. S.Marti, T.J. Giuli, K. Lai, and M. Baker, “Mitigating Routing Misbehavior in 
Mobile Ad Hoc Networks”. In Proceedings of the Sixth Annual ACM/IEEE 
International Conference on Mobile Computing and Networking (MOBICOM 
2000), August 2000.  
2. Charles E. Perkins, and Elizabeth M. Royer, “Ad-hoc On-Demand Distance 
Vector (AODV) Routing,” Internet Draft, November 2002. 
3. Juan-Carlos Ruiz, Jesús Friginal, David de-Andrés, “Black Hole Attack Injection 
in Ad hoc Networks”, Instituto de las TIC Avanzadas (ITACA) Universidad 
Politécnica de Valencia, Campus de Vera s/n, E-46022, Valencia, Spain 
4. Hongmei Deng, Wei Li, and Dharma P. Agrawal, ”Routing Security in Wireless 
Ad Hoc Network”, IEEE Communications Magzine, vol. 40, pp. 70-75, 2002. 
5. Sanjay Ramaswamy, Huirong Fu, Manohar Sreekantaradhya, John Dixon, and 
Kendall Nygard, ”Prevention of Cooperative Black Hole Attack in Wireless Ad 
Hoc Networks”. In Proceedings of 2003 International Conference on Wireless 
Networks (ICWN’03), Las Vegas, Nevada, USA, pp. 570-575. 
6. Sukla Banerjee “Detection/Removal of Cooperative Black and Gray Hole Attack 
in Mobile Ad-Hoc Networks” Proceedings of the World Congress on Engineering 
and Computer Science 2008 WCECS 2008, October 22 - 24, 2008, San Francisco, 
USA 
7. Piyush Agrawal, R. K. Ghosh, Sajal K. Das, “Cooperative Black and Gray Hole 
Attacks in Mobile Ad Hoc Networks” In Proceedings of the 2nd international 
  Vol. 1, No. 1, 2011 
        ISSN 1839-6518  82800101201102 
www.irj.iars.info  Page 10 
conference on Ubiquitous information management and communication, Pages 
310-314, Suwon, Korea, 2008. 
8. Ritesh Maheshwari, Jie Gao and Samir R Das, “Detecting Wormhole Attacks in 
Wireless Networks Using Connectivity Information”, Department of Computer 
Science, Stony Brook University Stony Brook. 
9. L.Lazos, R. Poovendran, C. Meadows, P. Syverson , L.W.Chang, “Preventing 
Wormhole Attacks on Wireless Ad Hoc Networks: A Graph Theoretic 
Approach”, University of Washington, Seattle, Washington, Naval Research 
Laboratory, Washington, DC 
10. Y.-C. Hu, A. Perrig, and D. B. Johnson, “Packet Leashes: A Defense against 
Wormhole Attacks in Wireless Networks”, IEEE INFOCOM, 2003. 
11. Y.-C. Hu, A. Perrig, and D. B. Johnson, “Rushing Attacks and Defense in 
Wireless Ad Hoc Network Routing Protocols”, ACM WiSe’03 in conjunction 
with MOBICOM’03, pages 30– 40, 2003. 
12. Oscar F. Gonzalez, Michael Howarth, and George Pavlou, “Detection of Packet 
Forwarding Misbehavior in Mobile Ad-Hoc Networks”, Center for 
Communications Systems Research, University of Surrey, Guildford, UK. 
Integrated Network Management, 2007. IM '07. 10
th
 IFIP/IEEE International 
Symposium on May 21, 2007. 
13. Vishnu K, Mohit Jain and Shalini Jain, “A new Attack proposal for wireless Ad 
hoc Networks”, International Journal of Computer Science and Network Security 
(IJCSNS) Vol. 10  No. 8  pp. 146-148 
14. Vishnu K, “A new kind of Transport Layer attack in Wireless Ad hoc Networks”, 
Wireless Communications, Networking and Information Security (WCNIS), IEEE 
International Conference 2010 
 
 
– END – 
 
 
 


Paris Attack in Wireless Ad Hoc Network

The Malaysian Parliament comprises the King (Yang Di-Pertuan Agung), the Senate (Dewan Negara) and the House of Representatives (Dewan Rakyat). The Parliament is the highest legislative authority that formulates laws applicable to the nation as a whole. It is responsible for drafting bills, passing federal laws, making amendments to the constitution, examining the governmentâ€™s policies and, approving federal government expenditure and new taxes. Participation in parliamentary debates is exclusively meant for Members of Parliament (MPs) who have competed and won in the general elections at their respective parliamentary constituencies. The Parliament serves as a forum to debate and discuss issues pertaining to national interests

Not a member yet

Process Capability and Maturity in Information Security

Paris Attack in Wireless Ad Hoc Network

Discourse, Politeness and Ethnic Sensitivities in Malaysian Parliament

151

173