Anti-Jamming for Embedded Wireless Networks

Miroslav Pajic and Rahul MangharamDepartment of Electrical and Systems Engineering

University of Pennsylvania{pajic, rahulm}@seas.upenn.edu

ABSTRACTResilience to electromagnetic jamming and its avoid-ance are difficult problems. It is often both hard todistinguish malicious jamming from congestion in thebroadcast regime and a challenge to conceal the activ-ity patterns of the legitimate communication protocolfrom the jammer. In the context of energy-constrainedwireless sensor networks, nodes are scheduled to max-imize the common sleep duration and coordinate com-munication to extend their battery life. This resultsin well-defined communication patterns with possiblypredictable intervals of activity that are easily detectedand jammed by a statistical jammer. We present ananti-jamming protocol for sensor networks which elimi-nates spatio-temporal patterns of communication whilemaintaining coordinated and contention-free communi-cation across the network. Our protocol, WisperNet, istime-synchronized and uses coordinated temporal ran-domization for slot schedules and slot durations at thelink layer and adapts routes to avoid jammers in thenetwork layer. Through analysis, simulation and exper-imentation we demonstrate that WisperNet reduces theefficiency of any statistical jammer to that of a randomjammer, which has the lowest censorship-to-link utiliza-tion ratio. WisperNet has been implemented on theFireFly sensor network platform.

Categories and Subject DescriptorsC.2 [Computer Systems Organization]: Computer-Communication Networks—Wireless communication

General TermsSecurity, Design, Algorithms

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies arenot made or distributed for profit or commercial advantage and that copiesbear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.IPSN’09, April 15–18, 2009, San Francisco, California, USA.Copyright 2009 ACM 978-1-60558-371-6/09/04 ...$5.00.

KeywordsAnti-jamming, MAC protocol, wireless sensor networks

1. INTRODUCTIONJamming is the radiation of electromagnetic energy

in a communication channel which reduces the effec-tive use of the electromagnetic spectrum for legitimatecommunication. Jamming results in a loss of link reli-ability, increased energy consumption, extended packetdelays and disruption of end-to-end routes. Jammingmay be both malicious with the intention to block com-munication of an adversary or non-malicious in the formof unintended channel interference. In the context ofembedded wireless networks for time-critical and safetycritical operation such as in medical devices and indus-trial control networks, it is essential that mechanismsfor resilience to jamming are native to the communica-tion protocol. Resilience to jamming and its avoidance,collectively termed as anti-jamming, is a hard practi-cal problem as the jammer has an unfair advantage indetecting legitimate communication activity due to thebroadcast nature of the channel. The jammer can thenemit a sequence of electromagnetic pulses to raise thenoise floor and disrupt communication. Communica-tion nodes are unable to differentiate jamming signalsfrom legitimate transmissions or changes in communica-tion activity due to node movement or nodes poweringoff without some minimum processing at the expense oflocal and network resources.

In the case of energy-constrained wireless sensor net-works, nodes are scheduled to maximize the commonsleep duration and coordinate communication to ex-tend their battery life. With greater network synchro-nization, the communication is more energy-efficient asnodes wake up from low-power operation just before thecommon communication interval. Such coordination in-troduces temporal patterns in communication with pre-dictable intervals of transmission activity. Channel ac-cess patterns make it efficient for a jammer to scan andjam the channel only during activity intervals. The jam-mer can time its pulse transmission to coincide with the

preambles of packets from legitimate nodes and thushave a high censorship to channel utilization ratio whileremaining difficult to detect. The jammer is thus able toexploit the temporal patterns in communication to dis-rupt a transmission of longer length of legitimate trans-missions with a small set of jamming pulses.

For nodes in fixed locations, a jammer can select re-gions with heavier communication activity or denserconnectivity to increase the probability that a randomjamming pulse results in corrupting an on-going trans-mission. Nodes in the proximity of the jammer willendure a high cost of operation in terms of energy con-sumption and channel utilization with a low messagedelivery rate. They must either physically re-locate orincrease the cost of their links so the network may adaptits routes.

Methods for anti-jamming must therefore address threatsdue to both temporal patterns at the link layer and spa-tial distribution of routes in the network layer. Ourgoal in designing WisperNet, an anti-jamming proto-col is to reduce or eliminate spatio-temporal patterns incommunication while maintaining energy-efficient, coor-dinated and collision-free operation in multi-hop wire-less sensor networks. We achieve this by incorporatingcoordinated temporal randomization for slot schedulesand slot durations between each node and its k-hopneighbors. This prevents the jammer from predictingthe epoch and length of the next activity on the chan-nel. Such mechanisms reduce the effectiveness of anystatistical jammer to that of a random pulse jammer.While temporal randomization prevents statistical jam-mers from determining any useful packet inter-arrivaldistribution for preemptive attacks, it still has an effi-ciency of a random jammer and can achieve censorshipwhich increases linearly with channel utilization andjamming activity. To avoid such random jammers whichare co-located near nodes with active routes, we employadaptive routing to select paths such that the highestpossible end-to-end packet delivery ratios are achieved.We combine the above temporal and spatial schemes ina tightly synchronized protocol where legitimate nodesare implicitly coordinated network-wide while ensuringno spatio-temporal patterns in communication are ex-posed to external observers.

In the context of multi-hop embedded wireless net-works, which are battery-operated and require low-energyconsumption, we require the following properties fromthe anti-jamming protocol:

1. Non-predictable schedules: Transmission in-stances (e.g. slot assignments) are randomized and non-repeating to prevent the jammer from predicting thetiming of the next slot based on observations of channelactivity. In this way, even if the jammer successfullyestimates slot sizes, it has to transmit pulse attacks at

an interval of the average slot duration to corrupt com-munication between nodes.

2. Non-predictable slot sizes: Slots are randomlysized on a packet-by-packet basis in order to prevent thejammer from estimating the duration of channel activityfor energy efficient reactive jamming. This requirementfurther reduces the jammer’s lifetime as it will need toemploy the smallest observed slot duration as its jam-ming interval.

3. Coordinated and scheduled transmission: Thecommunication schedule according to which a node trans-mits is known to all of its legitimate neighbors so theycan wake up to receive the message during its trans-mission slot. This also prevents nodes from turning ontheir receiver when no legitimate activity is scheduledand hence reduces the likelihood of a jammer drainingthe energy of a node.

4. Coordinated changes of slot sizes: All nodesmust be aware of the current and next slot sizes. This isvery important because any incompatibility or synchro-nization error would disable communication between le-gitimate nodes.

5. Collision-free transmission: Communication mustsatisfy the hidden terminal problem so that a transmitslot of a given node does not conflict with transmit slotsof nodes within its k-hop interference range.

The rest of this paper is organized as follows: In Sec-tion 2, we provide a background and related work forenergy efficient protocols and energy efficient jammingschemes. In Section 3, we provide an overview of theWisperNet anti-jamming protocol and describe the co-ordinated temporal randomization scheme. In Section4, we describe the WisperNet coordinated spatial adap-tation scheme. Section 5 describes our implementationexperiences and experimental results followed by theconclusion.

2. BACKGROUND AND RELATED WORKTo understand the inherent tradeoff between energy

efficient link protocols with well-defined schedules andtheir susceptibility to jamming attacks, we first describethe different types of jammers and their impact on var-ious types of link layer protocols. We then highlight aparticular class of statistical jammers and their impacton energy-efficient sensor network link protocols.

2.1 Jammers and Trade-offs with Jamming2.1.1 Comparison of Jamming ModelsIn [1] and [2], Xu et al. introduce four common types

of jammers: constant, random, reactive and deceptive.Constant jammers continually emit a jamming signaland achieve the highest censorship of packets corruptedto total packets transmitted. The constant jammer,

however, is not energy-efficient and can be easily de-tected and localized. The random jammer is similar tothe constant jammer but operates at a lower duty cy-cle with intervals of sleep. A random jammer transmitsa jamming signal at instances derived from a uniformdistribution with a known minimum and maximum in-terval. The censorship ratio of the random jammer isconstant and invariant to channel utilization. At lowduty cycles, the random jammer is difficult to detectand avoid. A reactive jammer keeps its receiver alwayson and listens for channel activity. If a known preamblepattern is detected, the reactive jammer quickly emitsa jamming signal to corrupt the current transmission.Reactive jammers, while effective in corrupting a largeproportion of legitimate packets, are not energy efficientas the receiver is always on.

Another type of reactive jammer uses a simple phys-ical layer energy detector as sensing and wake-up ra-dios. These agile jammers wait until channel activity isdetected and then jam. Although energy to ‘listen’ islower, this behavior is also energy inefficient since anykind of channel activity triggers a transmission of a jam-ming pulse. Due to physical layer delays these jammersare effective in jamming the fraction of packets that aregreater than a certain threshold length.

A deceptive or protocol-aware jammer is one that hasknowledge of the link protocol being used and the de-pendencies between packet types. Such a jammer ex-ploits temporal and sequential patterns of the protocoland is very effective.

In [3], a statistical jamming model is described wherethe jammer first observes temporal patterns in chan-nel activity, extracts a histogram of inter-arrival timesbetween transmissions and schedules jamming pulsesbased on the observed distribution. This results in avery effective jammer that is not protocol-aware andis also difficult to detect. A statistical jammer choosesits transmission interval to coincide with the peak inter-arrival times and is thus able to maximize its censorshipratio with relatively little effort. Fig. 1(a) illustratesthe relative censorship ratio and the energy-efficiency ofthe different jammers. Fig. 1(b) illustrates the relativestealth or difficulty in detection. We observe that thestatistical jammer has a high censorship ratio with both

(a) (b)

Figure 1: Jammer’s Energy efficiency vs. (a)Censorship ratio (b) Stealth

energy-efficient and stealthy operation and hence focuson combating such jamming.

2.1.2 Techniques for Robust TransmissionThe traditional defenses against jamming include spread

spectrum techniques[4] and frequency hopping at thephysical layer. While these techniques are importantphysical layer mechanisms for combating jamming, ad-ditional protection is required at the packet-level. Asin the case of standard wireless protocols such as IEEE802.11 and Bluetooth, the jammer may know the pseudo-random noise code or frequency hopping sequence.

There have been several efforts to make communica-tion in sensor networks more robust in the presence ofa jammer. In [5], Wood et al. described DEEJAM, alink layer protocol that includes several schemes for ro-bust IEEE 802.15.4 based communication for reactiveand random jammers. While mechanisms such as cod-ing and fragmentation are proposed, the jammer stillhas a competitive advantage in that it may increase thepower of its jamming signal and a single jamming sig-nal is capable of jamming multiple links in the vicinity.The authors assume that reactive jammers can be con-sidered energy-efficient. Current radio transceivers withthe IEEE 802.15.4 physical layer of communication, usealmost the same, if not greater, energy for receiving asthey do for transmission [6].

In cases where resilience to jamming is not possible,it is useful to detect and estimate the extent to whichthe jammer has influence over the network. A jammed-area mapping protocol is described in [7] which can beused to delineate regions affected by a jammer. Suchinformation can ultimately be used for network routing.One of the requirements of the protocol is that everynode knows its own position along with positions of allits neighbors. WisperNet, does not require such positionand direction information and directly computes routeswith the highest end-to-end packet delivery rate.

2.2 Impact of Jamming on MAC ProtocolsWe now investigate the characteristics of different classes

of sensor network link protocols and the impact of ajammer on each class.

Figure 2: Comparison of robustness to jammingand energy efficiency of sensor MAC protocols

2.2.1 Energy-Efficient MAC ProtocolsSeveral MAC protocols have been proposed for low-

power operation for multi-hop wireless mesh networks.Such protocols may be categorized by their use of timesynchronization as asynchronous [8], loosely synchronous [9,10] and fully synchronized protocols [11, 12]. In gen-eral, with a greater degree of synchronization betweennodes, packet delivery is more energy-efficient due tothe minimization of idle listening when there is no com-munication, better collision avoidance and eliminationof overhearing of neighbor conversations.

Asynchronous protocols such as Carrier Sense Mul-tiple Access (CSMA) are susceptible to jamming both atthe transmitter (busy channel indication) and at the re-ceiver (energy drain). The Berkeley MAC (B-MAC) [8]protocol performs excellent in terms of energy conserva-tion and simplicity in design. B-MAC supports CSMAwith low power listening (LPL) where each node peri-odically wakes up after a sample interval and checks thechannel for activity for a short duration of 0.25ms. If thechannel is found to be active, the node stays awake toreceive the payload following an extended preamble. Us-ing this scheme, nodes may efficiently check for neighboractivity while maintaining no explicit schedule which astatistical jammer may exploit.

Loosely-synchronous protocols such as S-MAC [9]and T-MAC [13] employ local sleep-wake schedulesknow as virtual clustering between node pairs to coor-dinate packet exchanges while reducing idle operation.Both schemes exchange synchronizing packets to informtheir neighbors of the interval until their next activityand use CSMA prior to transmissions. S-MAC resultsin clustering of channel activity and is hence vulnerableto a statistical jammer.

Synchronous protocols such as RT-Link [12], uti-lize hardware based time synchronization to preciselyand periodically schedule activity in well-defined TDMAslots. RT-Link utilizes an out-of-band synchronizationmechanism using an AM broadcast pulse. Each node isequipped with two radios, an AM receiver for time syn-chronization and an 802.15.4 transceiver for data com-munication. A central synchronization unit periodicallytransmits a 50µs AM sync pulse. Each node wakesup just before the expected pulse epoch and synchro-nizes the operating system upon detecting the pulse.

0 50 100 150 200 2500

0.02

0.04

0.06

0.08

0.1

Interarrival times [ms]

Prob

abilit

y

Figure 3: SMAC PDF for 15% utilization

As the out-of-band sync pulse is a high-power (30W)signal with no encoded data, it is not easily jammed bya malicious sensor node.

In general, RT-Link outperforms B-MAC which inturn out-performs S-MAC in terms of battery life acrossall event intervals [12]. Fig. 2 shows the relative nodelifetimes for 2AA batteries and similar transmission dutycycles. Here node lifetimes for CSMA, S-MAC, B-MAC,and RT-link are 0.19, 0.54, 0.78 and 1.5 years respec-tively for a network of 10 nodes with a 10s event sam-ple period (based on measurement values from [12], [9]).While RT-Link nodes communicate in periodic and well-defined fixed-size time slots, a statistical jammer is ableto easily determine the channel activity schedule andduration of each scheduled transmission. An attackercan glean the channel activity pattern by scanning thechannel and schedule a jamming signal to coincide withthe packet preamble at the start of a time slot.

2.2.2 Statistical JammingWe focus on the statistical jammer’s performance with

S-MAC and RT-Link as both result in explicit patternsin packet inter-arrival times. We do not consider B-MAC as we aim to leverage the more energy-efficientRT-Link as a base synchronized link-layer mechanismfor WisperNet. We simulated a network of 10 nodes ineach case, with a 3ms average transmission duration.In the case of S-MAC, we observe that all nodes quicklyconverge on one major activity period of 215ms. InFig. 3, we also notice a spike close to 2ms. This is theinterval between the transmission of control packets anddata packets at the start of an activity period. In thecase of RT-Link, we simulated four flows with differentrates and hence observe 4 distinct spikes in Fig. 4. Theother spikes with lower intensity are harmonics due tomultiples of 32 slots in a frame. In both cases we observedistinct inter-arrival patterns which enable a statisticaljammer to efficiently attack both protocols.

2.3 AssumptionsWe make several assumptions in the design and eval-

uation of WisperNet. We assume the jammer is asenergy-constrained as a legitimate node and must main-tain a stealth operation with a low duty-cycle. All pack-ets exchanged between nodes are encrypted with a group

0 10 20 30 40 500

0.05

0.1

0.15

0.2

0.25

Interarrival times [ms]

Proba

bility

Figure 4: RT-Link PDF for 15% utilization

key shared by legitimate nodes and hence the jammeris not protocol-aware. We consider both malicious andnon-malicious jamming and do not differentiate betweenthem as the anti-jamming mechanisms are native to thelink and network protocol. The transmission power is0dBm (1mW) and in the worst case (with maximumpower link jamming) the nominal packet delivery rateis never below 2̃0%. This has been demonstrated in pre-vious experiments [12]. For simplicity, we presume thatinterference range is equal to the transmission range ofone hop. This restriction does not limit our results. Weassume all communication is between a central gatewayand each of the nodes across one or more hops.

3. ANTI-JAMMINGWITHCOORDINATEDSPATIO-TEMPORALRANDOMIZATION

An effective approach to diminish the impact of astatistical jammer on TDMA-based MAC protocols isto eliminate the possibility to extract patterns in com-munication. These patterns appear as a result of theuse of fixed schedules which are set when a node joinsa network and are assumed to repeat till the networkis disbanded. Such simple and repetitive patterns aremaintained with tight time synchronization and resultin minimal energy consumption, deterministic end-to-end delay and perhaps maximal transmission concur-rency. In order to limit the impact of statistical jammingbut still benefit from the above energy and timelinessperformance, we maintain the time synchronization butchange the schedule, transmission duration and routesin a randomized yet coordinated manner.

Two components of the WisperNet protocol are Co-ordinated Temporal Randomization (WisperNet-Time)and Coordinated Spatial Adaptation (WisperNet-Space),which perform different actions in the temporal and spa-tial domains respectively. WisperNet-Time is designedto defeat statistical jammers. By randomizing the com-munication in time, a statistical jammer’s performanceis reduced to that of a random jammer as the distribu-tion of packet inter-arrival times is flat. No timing-basedscheme can reduce the probability of being jammed bya random pulse jammer. In this case, the only way todecrease the jamming impact is by avoiding the jammedareas using WisperNet-Space. WisperNet-Space imple-ments adaptive network routing as a jamming avoid-ance mechanism to use links which are less affectedby the jammer, if possible. Both WisperNet-Time andWisperNet-Space incorporate on-line algorithms wherethe network is continuously monitored and node opera-tions are adjusted in time and space.

3.1 WisperNet-Time: Co-ordinated TemporalRandomization

The main requirement for the proposed protocol is the

provision of tight time synchronization between nodes.In order to keep coordination between nodes, all nodeshave to be informed about current network state interms of current slot schedule, current slot duration andcurrent active network topology. We achieve this bybuilding upon the FireFly sensor network platform [14]and using the basic synchronization mechanisms adoptedin the RT-Link protocol. All communication with RT-Link is in designated time slots. 32 time slots form aframe and 32 frames form a cycle. The time sync pulse isreceived once every cycle. Each FireFly node is capableof both hardware-based global time synchronization andsoftware-based in-band time sync. A second require-ment for WisperNet is that changes in state should re-quire minimum gateway-to-node communication and nostate information exchange between nodes. All commu-nication must be encrypted and authenticated so thatan eavesdropper may not be able to extract the logicalstate of the network. We describe the authenticationand implicit coordination scheme in the following sec-tion and the synchronization mechanism in the Imple-mentation section.

3.1.1 Schedule RandomizationThe first step toward schedule randomization is a prun-

ing of the physical network topology graph into a di-rected acyclical graph. Fig. 5(a) shows an example net-work topology graph, where each edge represents phys-ical wireless link between two nodes. The physical net-work topology is logically pruned by disabling desiredlinks. In order to logically remove a link, a node is sched-uled to sleep during that particular neighbor’s transmis-sion, thereby ignoring that transmission. By forming adirected acyclic graph we are able to efficiently assignnon-colliding schedules that can be changed for everyframe, as shown in Fig. 5(b). Links marked by thedashed line are inactive but must be accounted for byany graph coloring algorithm.

The algorithm for schedule randomization is orga-nized in a distributed manner. Every node uses a Pseudo-Random Function (PRF) to obtain its transmission sched-ule from the current network key and its node ID. Thetransmission schedule consists of different slot indexesthat can be used for transmission to neighboring nodes.

(a) Physical networktopology

(b) Logical network topology

Figure 5: (a)Example network topology (b)collision-free, frame-to-frame transmit schedule

Figure 6: Generation of keys at the gateway, us-ing a one-way hash function.

The schedule changes for every frame (i.e. 32 slots) andduring a frame, a node transmits only on the time-slotsdetermined by its PRF output. After transmission, ev-ery node goes to sleep, setting its sleep timer to wakeup for the earliest receive or transmit slot. In this wayenergy consumption is reduced to minimum.

To obtain non-repeating schedules, but with full co-ordination between nodes, the PRF computed by everynode uses the current active network key along withits node ID. Once in a cycle, between two synchroniza-tion pulses, the gateway broadcasts the active keys forthe next cycle. The keys, members of the one-way keychain, are generated during gateway’s initialization andare stored in its memory. All keys from this chain arecalculated from randomly chosen last key Kn by repeat-edly applying one-way function F (as shown in Fig. 6):

Kj = F (Kj+1), j = 0, 1, 2, ...n− 1.

As F is a one-way function, all previous members ofchain (K0, K1, ..., Kj−1) can be calculated from somechain element Kj but subsequent chain members Kj ,Kj+1,...,Kn [15] cannot be derived. This authenticationscheme is similar to [16, 17] but its use for scheduling isnew.

We use the SHA1-HMAC[18] keyed-hash function togenerate the current slot schedule. Therefore, for sched-ule computation HMAC(ID, Kj) is used, where Kj

presents currently active network key (member of theone-way key chain). SHA1-HMAC outputs 160 bitswhich are used to specify the schedule of transmissionslots for each of the 32 frames. These 160 bits are di-vided into 32 groups of 5-bits, where the node’s transmitschedule in i-th frame (i = 0, 1, 2, ...31) is determined byi-th group of 5 bits. These 5 bits represent the randomlyselected slot index in each of the 32 frames.

Figure 7: Implicit conflict resolution

Implicit Schedule Conflict ResolutionThis approach for determining the transmission sched-ule locally can introduce a problem of potential inter-ference that may occur when neighboring nodes are as-signed the same random slot. To prevent this, everynode, in addition to its schedule, calculates a slot prece-dence (or priority) for every transmission. The prece-dence for the i-th frame’s transmission schedule is de-termined by (32−i)-th 5 bits group (i.e. reverse order ofthe transmission schedule). Since the number of framesis even, the transmission schedule and precedence arenever extracted from same group of bits. Therefore, tocompute its schedule in one sync period with 32 frames,each node has to calculate exactly one SHA1-HMACfunction for itself, and one SHA1-HMAC per node forall nodes in its k-hop interference range. We assume thenode IDs of all k-hop neighbors are known (when nodejoins the network it broadcast its ID to all its neighborsin k-hop range). Given the IDs for all nodes in its k-hopradius, a node calculates the schedule and precedencefor all of neighbors as shown in Figure 7. After sched-ule conflicts are resolved implicitly based on the higherprecedence, the node follows the combined transmit andreceive schedule in a single vector.

3.1.2 Slot size randomizationEven though the statistical jammer uses energy effi-

cient pulse attacks, the proposed schedule randomiza-tion reduces its efficiency to that of a random jammer.However, with the schedule randomization, an adver-sary is able to estimate slot sizes from the probabilitydistribution function (PDF) of packet inter-arrival times[3]. This statistical jamming scheme allows the jammerto transmit short pulse attacks at beginning of each slot,therefore corrupting all communication attempts. Al-though this jamming scheme is less energy efficient thana fixed schedule TDMA protocol, it is still more efficientthan a random jammer.

Slot size randomization is implemented in a similarmanner to slot schedule randomization, using SHA1-HMAC, as schedule randomization, but with one im-portant difference. Instead of using the last revealedkey for the slot size calculation, every node uses a sharedpredefined key, Kslot, and the network’s state countercnt. Therefore, for slot size randomization the PRF is

Figure 8: Slot size randomization on a frame-by-frame basis

calculated as HMAC(cnt, Kslot). The cycle counter istransmitted in the header of each packet and is incre-mented every cycle. Kslot is intentionally a local key sothat a node joining the network will be able to synchro-nize its slot sizes after receiving one legitimate packet.The SHA1-HMAC’s output, which is also calculated ona frame-by-frame basis, defines the slot size for the nextframe as shown in Fig. 8. The network’s state counterrepresents the number of sync pulses received by thenetwork, and its value is exchanged between neighbor-ing nodes in the header of every packet. Here we assumethat every sync pulse is received as it is a global andhigh-power AM pulse. Therefore it is only nodes whowant to join an already operational network need to beinformed about current network counter. The proposedcoordinated slot size randomization scheme assures thatall nodes know the current frame’s slot sizes and allowsthem to calculate an accurate time interval for theirtransmissions/receptions.

If a key from the key chain is used for slot size cal-culation instead a predefined one, in cases when nodedoes not receive a key from the gateway would resultin complete loss of synchronization. Without correctinformation about a slot size, nodes that do not knowthe current frame size are not able to schedule them-selves to wake-up for the expected sync pulse. With thepredefined key used for slot size calculations, nodes arealways able to know size of each frame, therefore theycan schedule their awakening on time.

Slot sizes have values from a discrete set, where theset size is determined by the number of PRF outputbits. The number of values used for slot sizes and rel-ative distance between them have direct influence onPDF of packet inter-arrivals times. The goal of our anti-jamming scheme is to have a uniform PDF, or at leasta PDF with spikes flattened as much as possible, whichdoes not allow timing information extraction. It is rec-ommended that at least 8 slot sizes with small relativedifference between them be used.

Slot size randomization requires additional memoryresources if nodes need to send some fixed-size datablock in a fixed time interval. In this case slot sizescan be both smaller and bigger than the size necessaryfor data block transmission, which can result in lowernetwork utilization in former case or data congestion inlater case. In the latter case, a portion of the data avail-able for transmission will have to be buffered in node’sinternal queue till the next transmission slot occurs. Inthis case, the average slot size must be larger than slotsize needed for one data block transmission. The sizeof the queue needed in every node is directly connectedwith ratio between these two sizes.

3.2 WisperNet-Time: Performance AnalysisWe now investigate the impact of channel utilization

on the PDF of packet inter-arrival times. We also deter-mine the buffering needs due to randomized slot sizingand its impact on the end-to-end delay. Finally we lookat the censorship ratio vs. jammer’s lifetime for RT-Link, S-MAC and WisperNet.

We conducted a simulation in Matlab on a protocolwith structure similar to RT-Link [12], where each cycleconsists of 32 frames and each frame consists of 32 slots.At the beginning of every cycle a sync pulse is trans-mitted. We have simulated a system where slot sizeshave uniform distribution with values in range [1 5]ms.A maximum slot size of 5ms is chosen to match themaximum message size of 128 bytes for IEEE 802.15.4transceiver with data rate of 250kbps[6]. 128 bytes canbe sent with transmission duration of 4.2ms and the restof the slot time is used for inter-slot processing and forguard times. A simulation for 10000 sync cycles wascarried out, which on an average lasts 50 minutes.

We first simulated the influence of the link utiliza-tion factor (U ) on the PDF of inter-arrival times andshow that it has very little influence with the proposedscheme. This is one of the major benefits of WisperNet-Time, because for other protocols the only way to reducespikes in the PDF is to reduce the utilization factor, asproposed in [3]. Results for PDF of inter-arrival timesare shown in in Fig. 9 for U = 50%, where slot sizes wererandomly chosen from one of the 32 possible values indesired span. While channel utilization has an effect tothe PDF, it is to a signficantly smaller extent than inB-MAC’s case. We observe that the peak of the PDF isless than 2% and no patterns can be extracted by thejammer. With U below 50%, a small increment can be

0 10 20 30 40 500

0.5

1

Interarrival times [ms]Cum

ulat

ive

Dis

tribu

tion

0 10 20 30 40 500

0.005

0.01

0.015

0.02

0.025

Interarrival times [ms]

Prob

abilit

y

75% utilization50% utilization25% utilization

50% utilization

Figure 9: (Top) PDF of inter-arrival times forWisperNet. (Bottom) Corresponding CDF.

seen on spikes in (5 10]ms interval. Also with integermultiples of some slot sizes within [1 5]ms interval, in-fluence of U can almost be ignored. Due to the uniformdistribution for all three cases of U it is not possible toextract slot sizes.

3.2.1 Impact on End-to-end DelayTo analyze how the slot size changes affect the end-

to-end delay, we simulated a 1-dimension chain with 20nodes. In every frame, each node forwards the previ-ously received data to next node. If the slot size issmaller than necessary to transmit the backlogged data,the maximum allowed packet size is sent and a rest ofthe data is buffered. In a simulated chain, the sourcenode periodically receives fixed size data blocks with asmaller size than for an average slot size (e.g. 3ms).

Fig. 10 presents PDF and CDF of delay at last nodefor different slot’s size quantizations. We observe thatwith finer quantization of slot sizes, the distribution in-terval of the last node has not only a smaller maximumdelay but also a smaller possible set of delay values thatcan be expected. The reason is that finer quantizationallows better data distribution per packets and there-fore reduces the delay caused with packets fragmenta-tion. Expectedly, this randomization introduced someadditional delay. In a TDMA system with a constantslot size of 3ms, the delay at the last node would be20 · 3ms = 60ms. Here average delay is around 75ms,but with 95% probability interval [67 88]ms. This showsthat randomization introduces some variability into thecommunication end-to-end delay estimation.

The first node requires a buffer with an additional 512bytes of memory for data queuing while all other requirean additional buffer for one maximum sized packet.

3.2.2 Comparative Analysis of MAC ProtocolsFig. 14 presents the relationship between the jam-

mer’s lifetime (LIFE) and censorship ratio (CR) for com-munication in its range. We simulated the influenceof two types of jammers - statistical jammers (SJ) andrandom jammers (RJ) - on different kinds of protocols.Both these types of jammers transmit 150µs-long pulse

50 60 70 80 90 100 110012345

Delay [ms]

Prob

abilit

y [%

]

50 60 70 80 90 100 1100

0.5

1

Delay [ms]Cum

ulat

ive

Dis

tribu

tion

95% region Step 0.5

Step 0.2Step 0.1

Step 0.5Step 0.2Step 0.1

Figure 10: Message delay and its CumulativeDistribution at last node, for 20 nodes chain

attacks. We modeled these attacks with a 90% suc-cess rate of packet corruption in cases when jammingpulse is transmitted during a node’s communication.For RT-Link and WisperNet-Time, we used the previ-ously described protocols, while for the Random Sched-ule TDMA (RSTDMA) we also used 32 slots per frame,where every slot is 3ms long. All protocols are simulatedfor systems with 25% of network utilization.

As we expected, for RT-Link and S-MAC, the SJ’slifetime is very high. As shown, RSTDMA is easilyjammed and the SJ enjoys the longest lifetime. In ad-dition, the slot size randomization component decreasesthe jammer’s lifetime, for almost 0.1 years at 50% CR.Note that differences between LIFE-CR curve for SJand RJ are caused only by the fact that SJ does nottransmit pulses in intervals smaller than 1ms, which,in this case, is the smallest slot size (only parameterthat can be extracted from input signal statistics). Weobserve that schedule randomization has a significantlyhigher impact on the jammer’s lifetime than does slotsize randomization. This justifies our decision to usea pre-stored key for the latter’s calculations, while us-ing keys from the gateway’s one-way chain for former.If some nodes are captured and compromised, only thepredefined slot-size key would risk being extracted.

4. WISPERNET-SPACE:COORDINATEDSPATIALADAPTATION

We now discuss spatial aspect of anti-jamming. Forthe WisperNet-Space, we consider a dense sensor net-work where each node is modeled as a unit disk graph.The network is represented as an undirected graph G(V, E)where V is a set of nodes (vertices) and E a set of links(edges). For each link e = e(u, v), k weights (or costs)wj(u, v), (j = 1, 2, ..., k) are associated. For a tree T ingraph G, the aggregate weight Wj(T ) is defined as

Wj(T ) =!

e∈T

wj(e), j = 1, 2, ..., k

Weights associated with each link describe the differenttypes of costs which may include the network’s para-functional properties, such as reliability of network com-munication, or delay and energy consumption of a sen-sor network.

In general a set L ⊆ V of terminal nodes is given andthe objective is to find a connected subgraph, spanningall the terminals with minimal aggregate weights for allj = 1, 2, ...k. If only one weighting function is consid-ered, L = V and the connected subgraph is required tobe a tree, then the problem is defined as a MinimumSpanning Tree problem (MST). The MST problem canbe solved using known algorithms (Kruskal’s, Boruvka’s,etc) [19]. If L ̸= V and also only one weighting functionis considered, problem is equivalent to Steiner minimal

0 1 2 3 4 5 6 720

30

40

50

60

70

80

90

100

Jammer’s Lifetime [years]

Cen

sors

hip

Rat

io [%

]

0.4 0.6 0.8 1 1.220

30

40

50

60

70

80

Jammer’s Lifetime [years]

Cen

sors

hip

Rat

io [%

]

RSTDMA withStatisticalJammerWnT withStatisticalJammerWnT withRandomJammerRT Link withStatisticalJammerS−MAC withStatisticalJammer

zoomed

(b)(a)

Figure 11: (a) Dependency between jammer’s lifetime and Censorship Ratio and (b) zoomed

tree problem (SMT). SMT is a NP-complete problem,but several heuristics exist which resolve SMT problemin both a centralized and a distributed manner.

For WisperNet-Space we only considered network re-liability, so we associate a reliability weight function foreach link in network. We define the weight of each linkto be a function of the packet loss ratio and hence aimto derive routes which connect all essential nodes us-ing most reliable links. The continuous execution of thecost minimization function, essentially allows evasion oflinks under the influence of a random jammer.

The network’s reliability is measured in terms of itsPacket Delivery Ratio (PDR) which is defined as theratio of packets that are successfully delivered to a des-tination [2]. PDR can be perceived as the probabilityof error-free communication between two nodes. Thus,the reliability of a path P in the given network can bedefined as a

"

e∈P PDR(e). Our goal is to achieve max-imum reliability on a path P , which is equivalent tomaximizing

ln#

e∈P

PDR(e) =!

e∈P

lnPDR(e).

With PDR(e) ≤ 1 for path P , our goal is to minimize$

e∈P |lnPDR(e)|. Therefore, the reliability weight forsome link e = e(u, v) is defined as

wr(u, v) = |lnPDR(u, v)|.

4.1 Active topology updateFor adaptive routing in WisperNet-Space, we use a

MST-Steiner heuristic to solve the SMT problem. Allactive nodes periodically send the PDRs for all their ac-tive links to the gateway. After receiving a link’s weight,the gateway updates its weight table for all existing linksin the network. Since the PDR is not defined for inactive(not used) links, these links keep same weights as theyhad prior to activation of the present network topology.Their weights can not be reset to zero, since that wouldallow some heavily jammed links to become competitivefor network routing right in next iteration.

In order to defend against mobile jammers, the weights

of unused network’s links are processed in time with aleaky integrator. To avoid situations where some pre-viously heavily jammed link still has a high weight al-though the jammer that caused it has moved away, forevery link e = e(u, v) and the current active subgraphT , the reliability weight for the next network topologycalculation is defined as:

wr(u, v) =

%

|lnPDR(u, v)|, e ∈ Tρ · wr(u, v), e /∈ T

ρ (0 < ρ < 1) is a leaky constant that determines a speedof network’s adaptation to jammers’ mobility. It is notrecommended to set a very small value for ρ, since some-thing similar to previously described situation can hap-pen, when a jammed link can be repeatedly included inactive topology after very short duration. For examplewith ρ = 0.8 reliability weight for unused link would bereduced by 20% for every calculation of network topol-ogy, which would allow inclusion of the jammed link intonew topology after only a few iterations. If all jammershave fixed positions, ρ can be set to 1.

After updating its weights table, the gateway calcu-lates the new active topology with minimum costs toreach all Steiner points (i.e. active nodes). To distributethe information about active links, we used the Prufercode (sequence) [19], a unique sequence associated witha tree, which for a tree with N vertices contains N−2 el-ements. In addition to this code, we send a second codesequence that maps the node ID of the active nodes tothe index of the N − 2 sequence. In a case of densenetworks, with N nodes, from which the Steiner tree isderived, a much smaller number of nodes (M) may beactive. Therefore for all M nodes from the Steiner tree,different temporal IDs are assigned from 1 : M interval,and for that tree, a Prufer code with M − 2 elements isderived. Along with this sequence and number of activenodes, M , a look-up table with size M is sent, wherei-th position in this table contains ID of a node, thatis indexed as i while creating the Prufer code sequence.In this way only 2 ·M − 1 values are sent from gatewayand can be encapsulated within one maximum-sized 128byte IEEE 802.15.4 packet.

4.2 Topology Maintenance and UpdatesWisperNet-Space computes a new network topology

every 128 cycles. Given the average slot size of 3msand 1024 slots/cycle, the topology update occurs every6.4 minutes on average. The current active topology in-cludes a subset of the node population as active nodes

and the unused node, which are not part of the activetopology, are considered inactive nodes. The key chal-lenge during a topology update is to activate the inactivenodes, which operate at a very low duty cycle.

At the beginning of the new topology distribution allcurrently active nodes are informed about new activetopology by a broadcast from the gateway. To acti-vate inactive nodes, which are to be part of the topol-ogy update, 8 slots after the sync pulse are reserved forasynchronous communication. We refer to these 8 slotsin each cycle to be the ‘topology configuration’ frame.Thus topology maintenance and updates account for a0.78% overhead.

Algorithm 1 describes the gateway’s procedure fortopology dissemination. The generated message withthe information about new network topology is distributedover the network using all active links. Since some cur-rently inactive nodes may be part of next active topol-ogy, the mechanism to inform them is included.

Algorithm 1 Gateway procedure descriptionwhile 1 do

if NewWeightArrive thenUpdate Weight Tableif AllReceived or TopologyT imerOn then

TableUpdated← 1end if

end ifif TableUpdated then

SMTCalculateSpreadingScheduleFloodNetwork

end ifend while

All nodes that are used for activation of the inac-tive nodes along with the new topology receive 3-bitindex of the slot dedicated for its transmission, in the8 slots ‘configuration’ frame. Using this index, eachnodes schedule its transmission of the new configura-tion to neighboring node and keep on transmitting it onthe same slot in every ‘configuration’ frame. Once allits required neighboring nodes (i.e. currently active orinactive nodes that need to be activated) are heard re-transmitting the new topology update, a node is assuredthat its topology has been successfully updated.

All inactive nodes wake up after every sync pulse, andlisten for the first 8 slots in a cycle. If the message forits activation is received, a node switches to active mode

and executes the active mode’s algorithm.Since new topology is computed once in 128 cycles,

1024 configuration slots are available for both activa-tion of dormant nodes and also for association of newlyadded nodes. Our experiments showed that for networkswith less than 500 nodes all inactive nodes are activatedin the first 10% of these slots. Given this, we allowedthe last 20% of these slots (i.e. configuration slots 820-1024) to be used as contention slots for addmission ofnew nodes only. These slots enable nodes that want tojoin the network to announce their presence to neigh-boring nodes (via a HELLO packet in RT-Link), so thatthey can be initially included as inactive nodes in thenetwork.

4.3 WisperNet-Space: Performance AnalysisIn order to evaluate the performance of WisperNet-

Space under random jamming attacks we first simulatedan SMT network with a random topology. A networkwith 400 randomly distributed nodes in a 4km x 4kmsquare was analyzed. We also randomly distributed ninejamming nodes, each with the same RF characteristicsas network’s nodes. To emphasize the jamming effect inorder to test WisperNet-Space’s adaptation, the jam-mers’ link utilization is set to 50%. We implemented acommunication protocol so that all neighboring nodesexchange exactly one message per frame. Changes innetwork routes for both SMT and MST components areperformed once in 100 frames. In our experiments weused a value of 0.999 for ρ, which decreases reliabilityweight of unused link by 1% for every period of 96 sec-onds (on average).

Fig. 12(a) presents the initial network topology andthe initial routes. The terminal nodes and the areas un-der attack by the jammers are highlighted. We observea large number of active links are under attack. Theaverage censorship ratio for this network is 9% for thisstartup configuration. The censorship ratio decreases toless than 1% as the routes adapt to more realible pathsand it can not go below this minimum value. The bestconfiguration (Fig. 13) includes 0 links jammed in bothdirection and 2 links jammed in only one direction.

We observed that at some intermediate moments (forexample moments t1 and t2 as seen in Fig. 12(b) and cor-

0 2000 4000 6000 8000 100000

5

10Number of links jammed in both direction

Link

s

0 2000 4000 6000 8000 100000

10

20Number of links jammed in only one direction

Frame number

Link

s

t1 t2

Figure 13: Number of links jammed in 2/1 di-rection used for communication

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

(a) Network topology - beginning

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

(b) At an intermediate time t1

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

1

1

1

1

1

1

1

1

1 1

11

1

1

11

11

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1 1

1

1

1

1

1

1

1

1

11

1

1

1

1

1

1

1

1

1

11

1

1

1

1

1

1

1 1

1

1

1

1

1

111

1

1

1

1

111

1

1

1

11

1

1

1

1

11

61.221

1

68.0945

1

1

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44 45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147148

149

150

151

152

153

154155

156

157

158

159

160

161

162

163

164

165

166167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210211

212

213

214

215

216

217

218

219

220

221

222223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300 301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361362

363

364

365

366

367

368

369

370

371

372

373

374375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

(c) Network topology - best

Figure 12: Network topology; green links - actual, ‘physical’ links; red - links used for Steiner tree;blue nodes - terminal nodes (members of set L); dark gray area - area under jammers’ influence

responding Fig. 14) network routes with more jammedlinks were chosen, which directly resulted in increase ofthe overall censorship ratio. This is more prominent atthe beginning of the WisperNet-Space’s operation whenall links start with the same minimum weight (0). Wesee in Fig. 12(b), three links are jammed in both direc-tions in the top-right corner. As this procedure of refin-ing the route continues and more links are evaluated forthe first time, the algorithm will choose jammed linksonly if its weight, due to the leaky integrator, drops be-low a threshold that would make the aggregate weightof a subgraph smaller than the aggregate weight of thecurrently used subgraph. We observe these spikes in thenetwork’s censorship ratio in Fig. 14. Fig. 12(c) presentsthe best solution where only two links from highlightedarea, jammed in only one direction, are used for rout-ing. Over the course of the adaptation for one hour, weobserver that the number of active links does not varymuch. We also noticed the stretch factor of the networkpath lengths was always ≤1.3.

5. IMPLEMENTATIONANDEVALUATIONThe WisperNet anti-jamming protocol was implemented

on a network of FireFly sensor nodes[14]. Each nodeconsists of a microcontroller, an IEEE 802.15.4, 2.4 GHztransceiver and multiple sensors. FireFly nodes have anadd-on AM radio receiver for receiving an out-of-bandAM sync pulse. In order to achieve the highly accuratetime synchronization required for TDMA at a packetlevel granularity, we use a carrier-current AM trans-mitter to provide an out-of-band time synchronizationpulse. The time synchronization transmitter (a sepa-rate module) plugged into the wall-outlet and used thebuilding’s power grid as an extended AM antenna andwas thus able to cover the entire building. Nodes weresynchronized with a 50µs pulse that was transmittedevery 10 seconds from the AM transmitter (see [14] fordetails). The AM pulse has a jitter of ≤ 150µs.

We implemented our jamming avoidance scheme in-corporating SHA1, SHA1-HMAC, gateway schedule up-dates and neighbor information exchange in 8-bit fixed-point C for the Atmel ATMEGA32L microcontrollerand a 16-bit 16MHz TI MSP430F22x microcontroller.Each node ran the nano-RK[20] real-time operating sys-tem and the RT-Link[12] link protocol. The RT-LinkTDMA cycle includes 32 frames which in turn are com-posed of 32 slots. The slot size were assigned values from[1 5]ms. In our tests, every node attempts to transmitone message per frame.

We observe that most of the current hardware plat-forms used for wireless sensor networks development arenot CPU-constrained, but have a memory limitation.Our implementation of the SHA1-HMAC function re-quired only 3 additional 160-bit buffers as the compari-son of schedules and precedences is done iteratively forall the node’s neighbors. The SHA1-HMAC functionrequired 12.5ms for calculations on TI’s MSP430F22xmicrocontroller. For networks where maximal node’sdegree in a network is N , every node, in the worstcase, needs to execute SHA1-HMAC function (N2 + 1)times for schedule calculation and once more for slotsize computation in every sync period. For example ifN = 5, in worst case 27 SHA1-HMAC function exe-cutions are needed, which results in 337.5ms of CPUtime used for these calculations in every sync period,where one sync period contains 32 · 32 = 1024 slots,

0 10 20 30 40 50 60 70 80 90 1000

1

2

3

4

5

6

7

8

9

10Averaged Censorship Ratio

Network configurations

Cen

sors

hip

ratio

[%]

t2t1

Figure 14: Averaged network’s censorship ratioon 100 blocks, for implemented Steiner tree

Figure 15: Experimental setup with 3 nodes

with sizes from 1ms to 5ms. Therefore in the worst caseless than 33% of CPU processing is used for these calcu-lations, while on average less than 11% is used. The im-plemented schedule randomization procedure uses 276bytes of flash memory and 400 bytes of RAM. As onlytwo nodes’ schedules are required at once, this requiresonly 236 bytes for additional code size with 40 bytes ofdata pre-initialized in flash.

In Fig. 15, we connected three nodes to the oscillo-scope to display the transmit and receive activity. Twonodes were programmed to be a transmit and receivepair to show the coordinated and collision-free schedulerandomization. A third node was programmed to raisea signal on every slot to provide a reference of the slotboundaries. In Fig. 16, the top signal on the oscilloscopeis triggered by the transmit pin of the transmitter andthe middle signal is triggered by the receive pin on thereceiver. The signal at the bottom is triggered on everyslot interval to provide a reference of the slot bound-aries. We observe that the schedule is both coordinatedand changes on a frame-by-frame basis.

5.1 LimitationsThe WisperNet-Spatial routing scheme is centralized

and will not scale well in large networks (>500 nodes)under moderate to heavy attack as the message from thegateway may not get through. While several distributedheuristics for the MST problem exist, they require alarge amount of information with respect to shortestpaths from a node to all other nodes in the network.These schemes are not conducive to energy-constrainedand memory-constrained sensor networks. We aim toexplore distributed solutions further.

6. CONCLUSIONIn this paper we proposed the WisperNet anti-jamming

protocol which uses Coordinated Temporal Randomiza-tion of transmissions (WisperNet-Time) to reduce thecensorship ratio of a statistical jammer to that of arandom jammer. A second component of WisperNetis Coordinated Spatial Adaptation (WisperNet-Space),where network routes are adapted continually to avoidjammed regions (and hence random jammers).

Through simulation and experiments, we demonstrate

that WisperNet is able to effectively reduce the impactof statistical and random jammers. Unlike coding-basedschemes, WisperNet is resilient to jamming even un-der moderate to high link utilization with ≤2% cen-sorship rate for the network topologies explored in thiswork. The schedules derived from WisperNet are non-repeating, with randomized packet lengths while main-taining coordinated and collision-free communication.WisperNet has been implemented on a network of Fire-Fly sensor nodes with tightly synchronized operationand low operation overhead.

7. REFERENCES[1] W. Xu, W. Trappe, Y. Zhang, and T. Wood. The feasibility of

launching and detecting jamming attacks in wireless networks.In ACM MobiHoc, 2005.

[2] W. Xu, T. Wood, W. Trappe, and Y. Zhang. Channel Surfingand Spatial Retreats: Defenses against Wireless Denial ofService. In ACM WiSe, pages 80–89, 2004.

[3] Y. W. Law et al. Energy-efficient link-layer jamming attacks. InACM SASN, 2005.

[4] A. J. Viterbi. Spread Spectrum Communications: Myths andRealities. In IEEE Comm. Magazine, 2002.

[5] A. D. Wood, J. A. Stankovic, and G. Zhou. DEEJAM:Defeating Energy-Efficient Jamming. IEEE SECON, 2007.

[6] Texas Instruments Inc. Chipcon CC2420 Data Sheet, 2003.[7] A. D. Wood, J. A. Stankovic, and S. H. Son. JAM: A Jammed

Area Mapping for Sensor Networks. In IEEE RTSS, 2003.[8] J. Polastre, J. Hill, and D. Culler. Versatile Low Power Media

Access for Wireless Sensor Networks. SenSys, November 2005.[9] W. Ye, J. Heidemann, and D. Estrin. An energy-efficient MAC

protocol for wireless sensor networks. IEEE INFOCOM, 2002.[10] A. El-Hoiydi and J. Decotignie. WiseMac: An Ultra Low Power

MAC Protocol. ISCC, 2004.[11] L.F.W. van Hoesel and P.J.M. Havinga. A lightweight medium

access protocol for wireless sensor networks. INSS, 2004.[12] A. Rowe, R. Mangharam, and R. Rajkumar. RT-Link: A

Time-Synchronized Link Protocol for Energy ConstrainedMulti-hop Wireless Networks. IEEE SECON, 2006.

[13] T. Dam and K. Langendoen. An adaptive energy-efficient macprotocol for wireless sensor networks. SenSys, November 2003.

[14] R. Mangharam, A. Rowe, and R. Rajkumar. FireFly: ACross-layer Platform for Real-time Embedded WirelessNetworks. Real-Time System Journal, 37(3):183–231, 2007.

[15] B. Schneier. Applied Cryptography. John Willey Inc., 1996.[16] A. Perrig and et. al. SPINS: Security Protocols for Sensor

Networks. Wireless Networks, 8(5):521–534, 2002.[17] A. Perrig, R. Canetti, D. Tygar, and D. Song. The TESLA

Broadcast Authentication Protocol. Cryptobytes, 5(2), 2002.[18] H. Krawczyk, M. Bellare, and R. Canetti. HMAC:

Keyed-Hashing for Message Authentication. RFC 2104, 1997.[19] B. Y. Wu and Kun-Mao Chao. Spanning Trees and

Optimization Problems. Chapman and Hall, CRC Press, 2004.[20] A. Eswaran, A. Rowe, and R. Rajkumar. Nano-RK: Energy

aware Resource centric RTOS. IEEE RTSS, 2005.

Figure 16: WisperNet-Time on Oscilloscope