A Comprehensive Review on Intrusion Detection and Prevention Schemes for Network Coding Enabled Mobile Small Cells

The initial concept of network coding was to improve bandwidth and information flow in a communication network by enabling the transitional nodes to code the packets in the transmission. Additional investigations have begun to investigate other advantages of network coding, such as energy efficiency, latency, durability, and poor safety.

For NC-enabled mobile small cells, Parsamehr et al. [1] devised a new intrusion detection / prevention technique. In the proposed scheme, pollution attacks are detected and mitigation steps are performed to reduce the chance of an intrusion incident in a zero-space Homomorphic Message Authentication Code (HMAC) scheme. For small mobile NC-enabled cells to reach their full potential, intrusion prevention systems are crucial for identifying and reducing pollution attacks. The proposed scheme drops the polluted data packets and the attacker has no possibility of distributing the corrupted packet on the network without identifying, to protect NC-enabled mobile cells against waste of energy and network resources. The attack identification and labelling of the attacker nodes is also not concentrated in the proposed model.

2.1 Intrusion detection models

Parsamehr et al. [2] Suggested an Intrusion Detection and Location-aware Prevention (IDLP) system that doesn't just locate and dump corrupted packets, but also identifies the correct position of the attacker to block/suspend them and avoid or limit the pollution of packets in future transfers. Identification and localization are accomplished via the IDLP technique, which utilises a MAC system with a homomorphic null-space for identification. The proposed model identifies the location of attackers but because of mobility nature, the attackers move from one location to the other which represents that the proposed model takes much time to find the perfect location of the intruder. To analyse the contents much care, need to be taken for identifying and avoiding malicious nodes in the network. Otherwise, the totally network performance will be degraded if any node is compromised.

Adat et al. [3] proposed a scheme to classify and locate adversaries in a network, network coding environment that enables mobile nodes. It also addresses a protocol to prevent adversaries from misleading the network. Identifying pollution attacks and avoiding further attacks is a priority for ensuring a high output in an environment allowed by network coding. The network efficiency can be significantly improved by adapting network coding to a huge small cell environment that identifies malicious nodes and makes their existence known to other nodes until malignancies are carried out. The proposed model provides a malicious network coding identifier for mobile small cells. The proposed model does not concentrate on identification of all kinds of attacks. The proposed model can identify a limited attack type that does not achieve better performance levels.

Roychoudhury et al. [7] presented a hierarchical framework that focuses Mutual authentication and key agreement (HGMAKA) protocol to enable the small cell-based heterogeneity architecture consistent with 5G networks to deliver MTC services. Because of this, it has been proved that the Message Authentication Code-based technique is both robust and flexible to heterogeneous network architecture while still using minimal resources. This model introduces HGMAKA, a hierarchical group-dependent shared authentication system, for machine-type interaction over the LTE network. This architectural model uses a heterogeneous femtocell system, which will be in line with future 5G networks, as well as a mobile femtocell network. A big network group intrusion detection is not the focus of the model.

Lawrence et al. [8] propose using the HMAC authentication technique. Systems for NC-supporting networking that not only identify and drop compromised packets but also recognise hostile nodes that launched the attack are now used as authentication. In order to enhance the efficiency of an NC-enabled network, nodes that detect malformed packets should be able to repair (solve) the mistakes they find. As a result, the number of attacks is reduced, and connectivity performance improves as a result. As a result, retransmission communication costs are eliminated, and throughput is increased. Now we have a system that can detect pollution attacks, repair corrupted nodes, and identify the sources of pollution assaults.

A novel homomorphic MAC-based wireless sensor network system known as Dual Homomorphic MAC was introduced by Esfahan, Alireza et al (Dual HMAC). This proposed approach would incorporate two tags: one to protect against data pollution assaults, and the other to identify pollution nodes. Because a few contaminated messages can ruin a bundle of genuine messages, network coding-activated intermediary pollution attacks are common. Data pollution assaults and partially tag pollution assaults in this scheme are both resisted by using two sorts of tags. The main redistribution model relates to partial defence against tag emissions. In addition, the system proposed experience low overhead communication and low overhead computing compared with other current systems. The proposed does not concentrate on tagging the pollution attacks to improve system performance.

Adversary network nodes can conduct pollution attacks on network coding because of this inherent vulnerability. Because even a good or authentic node's output is corrupted if even one of the receiving packets is malformed, packet pollution blows out very quickly. In order to detect pollution assaults, Charles et al. [12] proposed a new homomorphic signature method for the network coding environment. Any linear grouping of received packets can be signed using the homomorphic signature feature without addressing the validation authority. This research is based on an elliptic curve, which increases performance while also detecting assaults and authenticating data.

Yu et al. [13] suggested a homomorphic signature feature to allow the relay nodes to generate and validate received messages (signatures) and prohibit them from generating signatures for polluted nodes without the involvement of signing entities (source). Where as in other schemas the validation process is done at sink node only, but in this proposed method relay nodes can also validate. in this scheme, no extra safe communication channel is needed. The experimental findings indicate that their efficiency of verification is up to 10 times higher than other related works. Here we are using the source authentication and batch verification technique. Because each intermediate node's encoding operation can affect the original source's signatures, signatures are a preferable alternative in this approach.

Network Mobile small cells enabled for coding are regarded as prospective 5G networks, which can cover the urban environment on demand anywhere and in any devices at all times. Irrespective of the advantage of network coding in these networks, pollution attacks should be tackled prior network coding in small mobile 5G cells that reaches full potential. The intrusion detection and prevention technique proposed by Parsamehr et al. [20] is capable not only of detecting and preventing contaminant attacks but also for detecting the actual position of adverse nodes that cause pollution attacks. In the future, the author planned to expand the proposed IDPS to a collaborative IDPS which not only identifies the pollution attacks' source(s), but also to protect mobile small cells from being depleted on resources by mobile network coding when exposed to those attacks (such as CPU power, memory and battery level. The following Table 1 shows the limitations of intrusion detection models using H-MAC technique.

Table 1. Intrusion detection models

2.2 Network code analysis models

Ho et al. [14] explained how the random network coding is utilised to detect pollution assaults in an environment where it is random where it is distributed. In this case, no encryption functions are being applied. Randomly distributed nodes can choose from a finite field of random linear mappings on their own here. The packets can be verified with data and a hash symbol provided at the beginning of transmission by employing a packet-based randomised network coding technique. a good packet is one that a receiver receives with no changes made to the data and whose contents are unknown to anyone else. Network coding’s distributed randomization and path diversity lend support to this hypothesis. Since no cryptographic function is used here, the computational complexity will be relatively large.

A MAC homomorphic system randomised linear network coding subspace features and zero verification keys were suggested by Kehdi and Li [15]. Redundancy in the space domain improves the performance of randomised network coding. The author also suggested a novel and computational efficiency security approach known as Null Keys to discover pollution threats based on random linear network coding's subspace features. The participating nodes examine if a block is part of the subspace covered by the source blocks to ensure its integrity. A vector orthogonal to all possible permutations of the source blocks must be present at every node in order for this to be achievable. Null keys are vectors that are part of the source blocks' null space and are dispersed in a random manner by the source. Through simulations, he also shows that the Null Keys strategy is more effective in controlling the pollution spread than collective security using homomorphic hashing.

Torre et al. [22] presented an advanced Network Code (NCC) network content distribution frame, which benefit from the interplay of Mobile Clouds (MC) and Random Linear Networks (RLNC) coding, which reduces total energy consumption in the communication devices. Unknowns remain outside the scope of this research and have to be researched further. Examples include the construction of the MC, maximum nodes per cloud, the investigation of MC-interference, mobility and handover. Another problem is that UEs have active mobile antennas and Wi-Fi. The latest generation of mobile high-end gadgets presents this feature.

The network would be clogged with redundant, low-value packets that give no added value, and a lack of substitutes would leave it vulnerable to packet loss. The Newton-Raphson technique was used by Torre et al. [24] to develop a novel formal model that predicts how many losses a system will experience if the RLNC is implemented. The sender can select the minimum number of RLNC redundancies needed to keep packet loss to a manageable level. This research may examine a more complex architecture or a number of RLNC procedures for error correction. In addition, this research pens up fresh comparisons in similar situations across different optimization strategies.

They found that the chance of effective achievement was lower than the literature's approximation (Tsimbalo et al. [25] estimated it to be). The RLNC version also received a fresh performance evaluation, which was given by the researchers. This performance methodology is tested using extensive Monte Carlo simulations that look at how network and code parameters affect performance. Particularly for non-systematic RLNC, they demonstrate that the average square bound error for a 10-user network may be reduced to 910. It is possible to use the assumed limitation to the chance of good delivery for additional performance indicators, such as the mean decoding delay or energy efficiency. In addition, the findings can be applied to other network topologies, such as relays. To increase the boundaries' usefulness in non-systemic circumstances, it may be possible to reduce their complexity even further.

Error correction codes are employed to provide packet robustness. In particular, one of the most successful is random linear network coding. The network coding interaction with mobile clouds generates a mesh network in which nodes can receive information from different sources. RLNC was however optimised to enable D2D communications with an in-order delay. A new heterogeneous mesh network where nodes receive packets from various pathways has to be adapted by RLNC. In this study, Torre et al. [27] proposed a mechanism for enabling the simultaneous management of traditional RLNC protocols through several generations. Higher complexity studies must be developed which vary from sub-decoder to sub-decoder numbers, network conditions, code ratio, generation size, or packet size, among other parameters. In addition, it is also necessary to consider the capability of changing the optimum amount of sub decoders on the fly.

Pandi et al. [28] developed a new PACE RLNC approach that paces coded redundant package transmission throughout source symbols generation and evaluated it. The paced encoded packets can be used without waiting for the finishing of the generation to recover dropped source symbols. Compared to tail RLNC, rigorous simulation assessments show PACE-Uniform considerably reduces the average source symbolic latency while reaching almost the same chance of loss. The authors show additionally that the PACE-Burst generalises the pacing notion in redundant packet transmission and that the number of encoded packets in a burst can be controlled flexibly between the PACE-Uniform and the traditional tail RLNC. In conjunction with sparse RLNCs, another path is to consider the PACE technique, which can further speed up RLNC processing. The following Table 2 shows the limitations of network code analysis models using XOR and RLNC techniques.

2.3 Network communication models

These systems use a homomorphic hashing algorithm that the source applies to the communications. When sending the determined hash values between nodes, these systems frequently use additional secure channels. To verify midway nodes instantly, Krohn et al. [10] developed a well-known homomorphic hash method.

Table 2. Network code analysis models

The decentralisation key administration method built expressly to guarantee security in a network that benefits from NC-MSCs has been introduced by de Ree et al. [18]. They spread the Certificate Authority (CA) functions using secret thresholds in the key management scheme. A share of the master private key is delivered to each network node so that key management facilities are offered 'any time, everywhere.' Finally, the self-generated certification paradigm is used by the distributed CA. Thus, certificates may be issued and updated without the CA's dispersed interactions that decrease overhead transmission.

Liu et al. [19] Presented a D2D communication environment network-coding video distribution strategy. The H.264 video transmission uses network coding technology which can also provide safety for important video information. This allows recipients, especially in networks with interference, to decrypt the original video that is highly likely. Results from simulation reveal that after network coding, video quality is improved. The clinical and oncological translation potential of suggested protocols and algorithms should be excellent. In future study the author wants to examine and undertake task-based assessment of the proposed approaches on real patient data sets.

Device-to-device communication is a versatile technique which can discharge heightened traffic into 5G networks. There are, however, significant security problems due to its open nature. The LTE-A standard introduced methods for security and safety, including mutual authentication between EUs and the eNB. D2D communications, unfortunately, confront different threats: jamming, change of data, free retention and breach of privacy. Haus et al. [21] proposed architectures with a variety of security threats and needs for the LTE-D2D system and its applications. Furthermore, with the use of cellular networks, social trust and reputation should be brought into the system. It is also interesting to examine how device mobility in channel-based main agreement methods impacts key rates and entropy.

If mobile devices are close to one another and engaged in the same content, D2D networks such as Wi-Fi direct can be used opportunistically to establish a collaborative (and cooperating) cellular and D2D network infrastructure. However, understanding, quantifying, and leveraging the network coding potential for collaborating mobile devices in a cellphone/D2D arrangement is critical. It was studied by Keshtkarjahromi et al. [29] who came up with a solution that included two parts: (1) a network coding structure designed for cooperative portable devices in joint cellular/D2C settings, where the link capacity is identical, and (2) a network code achievement framework designed to restore the proposed system coding framework's packet completion times (i.e., the number of transmission slots).

Li et al. [30] suggested an adaptive RNC (ARNC)-based hybrid multicast and D2D transmission system to boost the network performance of a packet erasure channel. The suggested approach optimises the packet encoding structure in accordance with the network status such that User Equipment (UEs) can still decode meaningful data and regenerate new packets encoded to the D2D communications, although only a partial set of encoded packets are received. In this hybrid mode the effect of an erasure channel can be successfully eliminated and the total network output improved. The simultaneous broadcast of the multicast and D2D communications is considered for further investigation. Thus, the system model considers the signal interference noise ratio (SINR). In this case, the new scheduling and the RNC decoding strategy are being studied to maximise network performance. The following Table 3 shows the limitations of network communication models like D2D communication techniques.

Table 3. Network communication models

2.4 Collaborative models

To detect Firecol-based flood DDOS attacks and block attacks using Dynamic Growing Self-Organizing Tree, Poongodi and Bose [4] created an intrusion detection and prevention system (DGSOT). Firecol and DGSOT were used to detect and prevent processes in the proposed model's IDPS system, which was unique at the time. There are also comparisons between the conventional IDS and the delays and efficiency output measures. Distributed Denial of Service (DDoS) is the primary security threat in collaborative networks (DDOS). DDOS attacks aren't to blame for the poor performance of the network. Simulated outcomes suggest that the proposed technology enhances flood DDOS attack safety. According to the findings of the simulations, DGSOT is superior to Firecol for the identification and avoidance of intrusions (DGSOTFC). The proposed model concentrates on the DDoS attacks and not concentrated to identify attacks of other categories. The performance of the model is high in detecting DDoS attack but if any other attacks are identified in the network, the performance levels will be decreased.

Gkantsidis and Rodriguez [11] introduced an addition to Network Code-enabled Networks and by allowing cooperation verification further reduces the costs of the calculation of Hash Functions at each intermediate node. The homomorphic character of these signatures enables nodes to sign the receiving packets without touching the signing entity on a linear basis. The signature calculation covers the entire message increased.

Vasudevan et al. [17] examined network coding protection vulnerabilities and the subsequent countermeasures, in particular those imposed by pollution attacks. Due to the nature of coding and spreading through the entire network, specific attacks in network coding such as pollution attacks are extremely harmful. They harm the efficiency of bandwidth and even interrupt the correct decoding at receipt of any message. In addition, the authenticity of intermediate nodes in a wireless environment cannot be easily guaranteed and makes it easier for an intruder to join the network. There is a lot of research interest in the direction of secure network coding that leads to some interesting approaches. Most schemes, however, do not meet the necessary requirements or incur high device overheads. Schemes that effectively solve dense heterogeneous networks are still required for achieving better outcomes.

Network-coded cooperative systems for various cloud sizes were evaluated for their latency overhead, as described by Torre et al. [23]. Network traffic in 5G networks consists primarily of video data, with 5G networks containing heterogeneous data. The base station (BS) currently establishes one unicast connection to each user, which is inefficient because the BS sends repeated data to co-located users when users are close to one another and demand the same information (e.g., streaming services in stadiums, connecting information in trains, slide dissemination in conferences, etc.). Using Random Linear Network Coding (RLNC) and Mobile Clouds, Network-Coded Cooperative (NCC) networks improve network performance in the aforementioned circumstances. We have two things to provide in this paper: First, we describe a new approach for measuring latency that does not require synchronising the clocks within the computers. This approach as well as traditional timestamps is used to determine the latency in the NCC testbed. According to the findings, the average latency for three clients is 200 ms, whereas the average delay for four clients is 400 ms. In addition, we discovered a connection between packet loss and the number of clients in the MC.

Pandi et al. [26] demonstrated the combination of cooperative network coding and Random linear network coding, which allows for the use of dependable huge video cross-casting over regular LTE lines. The bulk of LTE traffic is discharged via Wi-Fi, enhancing the efficiency and size of the use of LTE canals. It shows how RLNC may be used to strengthen the stadium experience by broadcasting different user-choiced immediate playback systems. However, because of the logistical considerations, the stadium cannot be carried to CCNC's venue, but the demo includes all technical aspects. In the case of LTE receiving problems at the cited point, the demonstration is designed to reuse Ethernet connections and imitate the LTE connection with suitable loss models. The following Table 4 shows the limitations of co-operative/collaborative models

Table 4. Collaborative models

2.5 Block chain enables small cells

It was proposed by Adat et al. [5] that the upgraded block chain small cell environment may be protected from pollution attacks by using a network coding model instead. An introduction of overhead transmission and latency issues is provided, as well as the tiny SECRET block chain's design. Due to network coding, small mobile cells can play an important role in enhancing overall network performance. Small SECRET cells must be protected against pollutant attacks at all costs. Assailants can readily breach the conceptual model cryptography algorithms, which weaken the system's security levels. Digital signatures, hashing, and encryption techniques can all be used in conjunction with the proposed architecture to increase security levels, and polluted packets can be easily identified using HMAC and hashing techniques.

The SDN-based mobile cells were used by Adat et al. [6] to implement a secure network coding mobile cell that reduces overhead and time. This Security Scheme is modified by using this central unit as a security solution by some current approaches including Dual HMAC and Homo MAC. The proposed scheme follows similar message authentication systems, but uses the centralised controller's availability to cut computational and coordination costs across the networks. As the security problems must be addressed in advance, the work will focus specifically on security issues and examine an SDN based mobile small cell ecosystem enabled by network coding. In particular, the model addresses a message authentication code-based protection scheme against small cell SDN pollution attacks.

Adat et al. [31] proposed an “on block chain based secure network coding for mobile small cell. “This paper investigates the existing security architectures and proposes a secure network coding architecture that incorporates block chains to support efficient integrity schemes against pollution attacks. This block chain structure supports a homomorphic MAC-based integrity scheme against pollution attacks. Further, to avoid overburdening the end nodes, the block chain network only comprises the small cell heads and the end nodes connects to the small cell nodes as a central controller to communicate the tags. This architecture helps to reach a balance between the number of communication channels and storage and computational overhead on the end nodes for the integrity schemes and thus ensuring the maximum benefit of SECRET small cells.

Table 5. Block chain enhanced models

Shnaiwer et al. [32] have researched the cloud download improvements by using F-RANs to allow heterogeneous LTE and Wi-Fi technologies to enhance remote radio heads (eRRHs). They first define the problem of CBS as an optimization problem over a dual conflict graph, which has proven unworkable. Thus, as a weighted graphic colouring problem, they created an online variant of the CBS offloading issue in heterogeneous F-RANs. Then, they designed a new heuristic solution to this problem that supports Opportunistic Network Coding (ONC) which breaks it into two sub problems and individually addresses each under problem. The study can be extended in the formulation of CBS download problem by looking at the customer download rates from CBS. The joint problem of both completion time and CBS offloading could be further expanded. Table 5 shows the limitations of block chain enhanced models for intrusion detection.