Zone-based clustering for intrusion detection architecture in ad-hoc networks

Setting up an IDS architecture on ad-hoc network is hard because it is not easy to find suitable locations to setup IDS's. One way is to divide the network into a set of clusters and put IDS on each cluster head. However traditional clustering techniques for ad-hoc network have been developed for routing purpose, and they tend to produce duplicate nodes or fragmented clusters as a result of utilizing maximum connectivity for routing. Most of recent clustering algorithm for IDS are also based on them and show similar problems. In this paper, we suggest to divide the network first into zones which are supersets of clusters and to control the clustering process globally within each zone to produce more efficient clusters in terms of connectivity and load balance. The algorithm is explained in detail and shows about 32% less load concentration in cluster heads than traditional techniques.