Post on 04-Jun-2018
The Feasibility of Launching and DetectingJamming Attacks in Wireless Networks
Wenyuan Xu, Wade Trappe, Yanyong Zhang, Timothy Wood,WINLAB, Rutgers University
Mobihoc 2005
IAB, June 8th, 2005
2
Roadmap Motivation and Introduction
Jammer Models– Four models– Their effectiveness
Basic Statistics for Detecting
Improved Jamming Detection Strategy
Conclusions & Future works
3
Jamming Style DoS
Bob AliceHello … Hi …
4
Jamming Style DoS
Bob AliceHello … Hi …
@#$%)$*#@&…
Mr. X
5
Jammers
Jamming style DoS Attack:– Behavior that prevents other nodes from using the
channel to communicate by occupying the channel that they are communicating on
A jammer– An entity who is purposefully trying to interfere with
the physical transmission and reception of wireless communications.
Is it hard to build a jammer?
Mr. X
No! Haha…
Bob Alice
Hello … Hi …@#$%%$#
@&…
Mr. X
6
Jammers – Hardware Cell phone jammer unit:– Intended for blocking all mobile phone
types within designated indoor areas – 'plug and play' unit
Waveform GeneratorTune frequency to what ever you want
MAC-layer Jammer (our focus)Mica2 Motes (UC Berkeley)
8-bit CPU at 4MHz,128KB flash, 4KB RAM916.7MHz radioOS: TinyOS
Disable the CSMAKeep sending out the preamble
7
Jammers – Hardware Cell phone jammer unit:– Intended for blocking all mobile phone
types within designated indoor areas – 'plug and play' unit
Waveform Generator– Tune frequency to what ever you want
MAC-layer Jammer (our focus)Mica2 Motes (UC Berkeley)
8-bit CPU at 4MHz,128KB flash, 4KB RAM916.7MHz radioOS: TinyOS
Disable the CSMAKeep sending out the preamble
8
Jammers – Hardware Cell phone jammer unit:– Intended for blocking all mobile phone
types within designated indoor areas – 'plug and play' unit
Waveform Generator– Tune frequency to what ever you want
MAC-layer Jammer (our focus)– Mica2 Motes (UC Berkeley)
8-bit CPU at 4MHz,128KB flash, 4KB RAM916.7MHz radioOS: TinyOS
– Disable the CSMA– Keep sending out the preamble
The Jammer Models and Their Effectiveness
10
Jammer Attack Models
Need tosend m
Is channel
idle?Backoff
start tosend m
No
Yes
Is channel
idle?Backoff
No
Yes
Normal MAC protocol:
Need tosend m
start tosend m
Jammer:
11
Jammer Attack Models
Constant jammer:– Continually emits a radio signal– It can prevent legitimate nodes from getting hold of channel, if the
underlying MAC protocol determines whether a channel is idle or not by comparing the signal strength measurement with a fixed threshold.
Deceptive jammer:– Constantly injects regular packets to the channel without any gap
between concatenated packet transmissions– A normal communicator will be deceived into the receive state
&F*(SDJFFD(*MC*(^%&^*&(%*)(*)_*^&*FS…….
Payload …
Preamble CRC
PayloadPayload Payload Payload
12
Jammer Attack Models
Random jammer:– Alternates between sleeping and jamming
Sleeping period: turn off the radioJamming period: either a constant jammer or deceptive jammer
– Good for those jammers that do not have unlimited power supply
Reactive jammer:– No need to jam the channel if nobody is communicating– Stays quiet when the channel is idle, starts transmitting a radio
signal as soon as it senses activity on the channel.– Targets the reception of a message– Harder to detect
&F*(SDJF ^F&*D( D*KC*I^ …
…
Underling normal traffic
&F*(SDJ
Payload
^%^*&
Payload
CD*(&FG
Payload
13
Metrics & ImplementationGoal of jammer:– Interfere with legitimate wireless communications– Prevent a sender from sending out packets– Prevent a receiver from receiving a legitimate packets
Packet Send Ratio (PSR)– The ratio of packets that are successfully sent out by a legitimate
traffic source compared to the number of packets it intends to send out in MAC layer
Packet Delivery Ratio (PDR)– The ratio of packets that are successfully delivered to a destination
compared to the number of packets that have been sent out by thesender
Implementation platform:– Mica2 Motes– Disabled channel sensing and backoff operation in TinyOS MAC
protocol
14
Experiment SetupInvolving three parties:– Normal nodes:
Sender AReceiver B
– Jammer X
Parameters – Four jammers model– Distance
Let dXB = dXA
Fix dAB at 30 inches– Power
PA = PB = P X = -4dBm– MAC
Fix MAC thresholdAdaptive MAC threshold (BMAC)
Sender A
Receiver B
Jammer X
dXB
dAB
dXA
15
Experimental ResultsInvolving three parties:– Normal nodes:
Sender AReceiver B
– Jammer X
Parameters – Four jammers models– Distance
Let dXB = dXA
Fix dAB at 30 inches– Power
PA = PB = P X = -4dBm– MAC
Fix MAC thresholdAdaptive MAC threshold (BMAC)
3.260.9293.5799.5772.0
2.911.020.5377.1754.0
1.941.000.4374.3738.6
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Constant Jammer
99.53100.098.0099.2554.0
87.26100.058.0599.0044.0
0.00100.00.0099.0038.6m =
33bytes
99.87100.099.35100.072.0
99.87100.099.24100.054.0
0.00100.00.0099.0038.6m =
7bytes
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Reactive Jammer
16
Experimental ResultsInvolving three parties:– Normal nodes:
Sender AReceiver B
– Jammer X
Parameters – Four jammers models– Distance
Let dXB = dXA
Fix dAB at 30 inches– Power
PA = PB = P X = -4dBm– MAC
Fix MAC thresholdAdaptive MAC threshold (BMAC)
3.260.9293.5799.5772.0
2.911.020.5377.1754.0
1.941.000.4374.3738.6
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Constant Jammer
99.53100.098.0099.2554.0
87.26100.058.0599.0044.0
0.00100.00.0099.0038.6m =
33bytes
99.87100.099.35100.072.0
99.87100.099.24100.054.0
0.00100.00.0099.0038.6m =
7bytes
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Reactive Jammer
17
Experimental ResultsInvolving three parties:– Normal nodes:
Sender AReceiver B
– Jammer X
Parameters – Four jammers models– Distance
Let dXB = dXA
Fix dAB at 30 inches– Power
PA = PB = P X = -4dBm– MAC
Fix MAC thresholdAdaptive MAC threshold (BMAC)
3.260.9293.5799.5772.0
2.911.020.5377.1754.0
1.941.000.4374.3738.6
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Constant Jammer
99.53100.098.0099.2554.0
87.26100.058.0599.0044.0
0.00100.00.0099.0038.6m =
33bytes
99.87100.099.35100.072.0
99.87100.099.24100.054.0
0.00100.00.0099.0038.6m =
7bytes
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Reactive Jammer
18
Experimental ResultsInvolving three parties:– Normal nodes:
Sender AReceiver B
– Jammer X
Parameters – Four jammers models– Distance
Let dXB = dXA
Fix dAB at 30 inches– Power
PA = PB = P X = -4dBm– MAC
Fix MAC thresholdAdaptive MAC threshold (BMAC)
3.260.9293.5799.5772.0
2.911.020.5377.1754.0
1.941.000.4374.3738.6
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Constant Jammer
99.53100.098.0099.2554.0
87.26100.058.0599.0044.0
0.00100.00.0099.0038.6m =
33bytes
99.87100.099.35100.072.0
99.87100.099.24100.054.0
0.00100.00.0099.0038.6m =
7bytes
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Reactive Jammer
Basic Statistics for Detecting Jamming Attacks
20
Signal Strength P.1
Idea:– The signal strength distribution may be affected by the
presence of a jammer
Assume– Network devices can gather enough noise level
measurements during a time period prior to jamming and build a statistical model describing normal energy levels in the network.
Statistical model– Average signal value or the total signal energy over a
window– Signal strength spectral discrimination
Experiment platform:– Mica2 Motes (UC Berkeley) – Use RSSI ADC to measure the signal strength
21
Signal Strength P.2
-100
-80
-60CBR
-100
-80
-60MaxTraffic
-100
-80
-60Constant Jammer
-100
-80
-60
R
SS
I (dB
m)
Deceptive Jammer
-100
-80
-60Reactive Jammer
0 200 400 600 800 1000 1200 1400 1600-100
-80
-60
sample sequence number
Random Jammer
Normal traffic
Jammers
Basic average
detection doesn’t work !
Congested traffic
22
Signal Strength P.3
Basic Average and Energy Detection don’t work!How about spectral discrimination mechanism?– Higher Order Crossing (HOC)
The idea is to combine zero-crossing counts in stationary time series with linear filters .We calculated the first two higher order crossings for the time series.Window size: 240 samples
0 50 100 150 2000
50
100
150
200
HOC
D1
D2
CBRMaxTrafficConstant JammerDeceptive Jammer
0 50 100 150 2000
50
100
150
200
HOC
D1
D2
CBRMaxTrafficReactive JammerRandom Jammer
SS spectral discrimination doesn’t work !
23
Packet Delivery Ratio P.1
Carrier sensing time cannot detect reactive jammer.
Idea:– Determine whether the communication node can receive
packets in the way it should have had the jammer not been present.
– A non-aggressive jammer, which only marginally affects the PDR, does not need to be detected or defended against.
How much PDR degradation can be caused by non-jamming, normal network dynamics, such as congestion?
Experiment– Setup
3 MaxTraffic sources– Raw offered traffic rate: 19.38Kbps– Max allowed bandwidth: 12.364kbps
Measure PDR at receiver side– Result
PDR: 78%
MaxTrafficSender
Receiver
24
Packet Delivery Ratio P.2
The PDRs are low in the presence of jammers
PDR is effective in discriminating jamming from congested network scenario.
Low PDR can be caused by network dynamics:– Sender battery failure– Sender moving out of the
communication range
PDR cannot differentiate jamming attacks from other scenarios, such as, poor link quality.
3.260.9293.5799.5772.0
2.911.020.5377.1754.0
1.941.000.4374.3738.6
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Constant Jammer
99.53100.098.0099.2554.0
87.26100.058.0599.0044.0
0.00100.00.0099.0038.6m =
33bytes
99.87100.099.35100.072.0
99.87100.099.24100.054.0
0.00100.00.0099.0038.6m =
7bytes
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Reactive Jammer
0.000.000.000.0072.0
0.000.000.000.0054.0
0.000.000.000.0038.6
PDR(%)PSR(%)PDR(%)PSR(%)
FixMACBMACdxa (inch)
Deceptive Jammer
Jamming Detection with Consistency Checks
26
Signal Strength Consistency Checks P.1Goal — to discriminate jamming attacks from,– normal congested scenarios– other cases caused by poor link quality, sudden failures of nodes
Observation:– PDR is a relative good statistic, we can build some strategies upon
PDR to achieve enhanced jammer detection.– Normal scenarios:
High signal strength a high PDR Low signal strength a low PDR
– Low PDR:Hardware failure or poor link quality low signal strengthJamming attack high signal strength
Idea:– Node A checks whether all its neighbors share low PDRs with itself. – If at least one neighbor has high PDR, Node A is not jammed. – Otherwise, check whether the low PDR is consistent with the
ambient signal strength Node A measures. – If the PDR is low but signal strength is high, node A is jammed.– If both are low, probably there are other reasons.
27
Signal Strength Consistency Checks P.2Assumption:– A node is only responsible for detecting whether it is
jammed, and not its neighbors– The network is sufficiently dense, each node has several
neighbors– Each node maintains a neighbor list – All normal nodes in the network will send out heartbeat
beacons, such as routing updates.
Algorithm:{PDR(N): N Є Neighbors} = Mearsure_PDR()MaxPDR = max{PDR(N): N Є Neighbors}if MaxPDR < PDRThresh then
SS = Sample_Signal_Strength()CCheck = SS_ConsistencyCheck(MaxPDR, SS)if CCheck == False then
post NodeIsJammed() end
end
28
Signal Strength Consistency Checks P.3Sample_Signal_Strength() returns the maximum value of the signal strengths during the sampling window.
SS_ConsistencyCheck(MaxPDR, SS) performs a consistent checking to see whether the low MaxPDRvalues are consistent with SS, the signal strength measurements.
How does a consistency checking work?
Algorithm:
{PDR(N): N Є Neighbors} = Mearsure_PDR()MaxPDR = max{PDR(N): N Є Neighbors}if MaxPDR < PDRThresh then
SS = Sample_Signal_Strength()CCheck = SS_ConsistencyCheck(MaxPDR, SS)if CCheck == False then
post NodeIsJammed() end
end
29
Signal Strength Consistency Checks P.4Build a (PDR,SS) look-up table empirically– Measure (PDR, SS) during a guaranteed time of non-interfered
network.– Divide the data into PDR bins, calculate the mean and variance for
the data within each bin.– Get the upper bound for the maximum SS that world have
produced a particular PDR value during a normal case.– Partition the (PDR, SS) plane into a jammed-region and a non-
jammed region.
Experiment setup:– The sender power: -
5dBm– Data rate: 20packets/sec– Average PDR over 200
packets– SS were sampled every
1msec for 200msecs– Vary the DSR– PDR bins: (0,40) (40,90)
(90, 100)– PDR threshold 65%– 99% confidence bar
Jammed Region
PDR %
PDR VS. SS
SS
(dB
m)
30
Signal Strength Consistency Checks P.5Jammer setup:– Transmission power: -4dBm– The reactive jammer injects 20-byte long packets– The random jammer turns on for tj = U[0,31] and turns off for ts =
U[0,31]
The (PDR, SS) values for all jammers distinctively fall within the jammed-region
The more aggressive the jammer is, the more likely it will be detected.
The less aggressive the jammer is, the less damage it causes to the network.
Similarly, we can deploy a location information based consistency check to achieve an enhanced jamming detection.
Jammed Region
PDR %
PDR VS. SS
SS
(dB
m)
31
Conclusions:Due to the shared nature of the wireless medium, it is an easy feat for adversaries to perform a jamming-style denial of service against wireless networks.
We presented four different jammer attack models. We have studies the effectiveness of them by constructing prototypes using the MICA2 Mote platform and measured the PSR and PDR.
We have studied the issue of detecting jamming attacks.– We showed that a single measurement statistic is not enough to
identify the presence of a jammer. – We introduced the notion of consistency checks– We presented two enhanced jamming detection algorithms:
Employing signal strength as a consistency checkEmploying location information as a consistency check
32
Future Works:Investigate the effectiveness of different jamming attack models in other wireless devices, e.g. 802.11 devices, and study their effectiveness in different wireless network topology.– Infrastructured network– Ad-hoc network
Study the jamming detection mechanism in other scenarios: – Highly mobile jammers– Highly mobile network nodes
Validate the jamming detection mechanism in a large scale sensor network
We are building a large scale jamming resistant wireless sensor network (approximately 50 nodes)