Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks Mingyan Li, Iordanis Koutsopoulos, Radha Poovendran (InfoComm ’07) Presented by Choi, Chang-Beom

Introductions (1/2) Characteristic of jamming attacks (DoS) ▫ No special hardware is needed in order to be launched ▫ It can be implemented by simply listening to the open medium and broadcasting in the same frequency band as the network ▫ If launched wisely, it can lead to significant benefits with small incurred cost for the attacker Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 2/$

Introductions (2/2) Vulnerabilities of Sensor Network ▫ Sensor networks rely on deployed miniature energy constrained devices to perform a certain task without a central powerful monitoring point Controllable Jamming Attacks ▫ Easy to launch and difficult to detect and confront ▫ Jammer controls probability of jamming and transmission range in order to cause maximal damage to the network Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 3/$

Modeling Assumptions(1/4) Sensor network model ▫ Each node cannot transmit and receive simultaneously ▫ There are always packets in each node’s buffer in each slot ▫ Sensor nodes are uniformly distributed in a region with spatial density ρ nodes per unit area ▫ Sensor network topology is static Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 4/$

Modeling Assumptions(2/4) Multiple access protocols are characterized by a common channel access probability γ for all nodes in a slot ▫ Probability that a packet is transmitted to j is γ/ n i Case of collision ▫ Receiver node j experiences collision if at least two nodes in its neighborhood transmit packet simultaneously ▫ Probability of collision  1 – Pr{only one or no neighbor transmits} = Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 5/$

Modeling Assumptions(3/4) Attacker model ▫ The objective of the jammer is to corrupt transmissions of legitimate nodes by causing packet collisions at receivers ▫ Jammer controls the probability q of jamming the area within its transmission range in a slot to control the aggressiveness of the attack ▫ Probability of collision Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 6/$

Modeling Assumptions(4/4) Attack detection model ▫ The monitoring mechanism  Determination of a subset of nodes that will act as network monitors  Employment of a detection algorithm at each monitor node ▫ Detection  During normal network operation, and in the absence of a jammer, it give a large enough training period (percentage of collisions)  Fix attention to a time window and check whether the percentage of collisions over this time window exceeds the learned long-term average or not  Wald’s Sequential Probability Ratio Test(SPRT)  A. Wald, Sequential Analysis, Wiley 1947 Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 7/$

Attacker Payoff(1/5) Instantaneous Payoff of the attacker U mI ▫ It depends on jamming probability q and network access probability γ ▫ Transmitters are uniformly distributed with density ργ ▫ Total number of transmitters in the jammed area A is Poisson distributed with spatial density λ = ργ which is A ργ ▫ The number of potential receivers is A ρ (1- γ ) ▫ The probability of success of an attempted transmission is Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 8/$

Attacker Payoff(2/5) Instantaneous Payoff of the attacker U mI ▫ The number of successful transmission links Y follows the binomial distribution ▫ Payoff for the jammer ▫ Instantaneous pay off for the attacker that jams with probability q ▫ The instantaneous payoff for the network in the absence of jammer Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 9/$

Attacker Payoff(3/5) Cumulative Payoff ▫ The number of jammed links until the jammer is detected and the notification message is transferred out of the jammed area ▫ The probability of successful channel access for a node on the route of the notification message in the presence of jamming ▫ Average waiting time for node before successful transmission Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 10/$

Attacker Payoff(4/5) Cumulative Payoff Let average number of hops needed to deliver the alarm out of area be H ▫ The Average time needed for the alarm to propagate out of the jamming area is where is the average number of neighbors of a node along the path The total time until the jamming activity stops is Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 11/$ Where D(q,r) is detection time

Attacker Payoff(5/5) Cumulative Payoff Cumulative payoff Cumulative payoff for the network Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 12/$

Constant Jamming Power and one monitor node ▫ The objective function is the total delay ▫ An adversary tries to maximize total delay by controlling q ▫ The network tries to minimize total delay by selecting γ Problem Formulation Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 13/$ Attacker Problem Network Problem

Problem Formulation Constant Jamming Power and one monitor node ▫ With perfect knowledge  Solution is determined by the energy and payoff constraints ▫ Without perfect knowledge  Approximate the solution of the max-min(min-max) problem Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 14/$ Attacker Problem Network Problem

Numerical Result For Lack of Knowledge Case Sensor node transmission range R = 20m Node density ρ = Energy constraint E/P = 500 Payoff threshold U 0 = 500 transmission Attacker transmission range R m = 200m Energy constraint E m /P m = 1000 Target payoff U 0 m = 500 p FA = 0.02, p D = 0.98 Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 15/$

Problem Formulation Constant Jamming Power and several monitor nodes ▫ Nodes can be classified in different classes C 1, … C k such that nodes in class C n have n neighbors ▫ Assign the role of monitor to nodes of a class with n* neighbors to minimize detection time Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 16/$ Detection delay balancing problem Since detection time is decreasing in q regardless of number of neighbors, the smallest feasible q imposed by the energy constraint is the solution for the attacker

Problem Formulation Controllable Jamming Power and several monitor nodes ▫ Jammer can choose transmission power level with probability q j such that ▫ With probability q 0 = 1 – q the jammer remains silent ▫ Different jamming power levels lead to different jamming area ▫ Monitor nodes located in outer zones  Perceive lower jamming probability, pass notification message faster ▫ Monitor nodes located in inner zones  Detect faster, delay in passing the message out of the jamming area Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 17/$

Problem Formulation Controllable Jamming Power and several monitor nodes ▫ Detection plus notification time for inner zone ▫ Detection plus notification time for outer zone Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 18/$ From numerical solutions for different, Optimal solution without knowledge of monitor neighborhood is to jam the inner region The theoretical proof or disproof of this observation is deferred for future study

Conclusion Controllable jamming attacks ▫ Easy to launch ▫ Difficult to detect and confront ▫ Comparisons between  Perfect knowledge of the attacker and network strategy  Lack of knowledge of the attacker and network strategy Further research ▫ Consider about multi-channel networks ▫ Find alternatives for modeling lack of knowledge for the attacker and the network ▫ Considering multiple potentially co operating attackers Optimal Jamming Attacks and Network Defense Policies in Wireless Sensor Networks 19/$