MOJO: A Distributed Physical Layer Anomaly Detection System for WLANs Richard D. Gopaul CSCI 388

Authors Anmol Sheth Christian Doerr Dirk Grunwald Richard Han Douglas Sicker Department of Computer Science University of Colorado at Boulder Boulder, CO, 80309

Problem Existing deployments provide unpredictable performance Wireless Networks –Cheap –Easy to deploy Two Classes –Planned deployments (large companies) –Small scale chaotic deployments (home users)

Reasons for Unpredictable Performance Noise and Interference –Co-channel interference, Bluetooth, Microwave Oven, … Hidden Terminals –Node location, Heterogeneous Transmit Powers Capture Effects –Simultaneous transmission MAC Layer limitations –Timers, Rate adaptation, … Heterogeneous Receiver Sensitivities

Problems With Existing Solutions Wireless networks encounter time-varying conditions –A single site survey is not enough Cannot distinguish or determine root cause of problem –Existing tools for diagnosing WLANs only look at MAC layer and up –Aggregate effects of multiple PHY layer anomalies –Results in misdiagnosis, suboptimal solution

How Faults Propagate in the Network Stack

Contributions of this paper: Attempts to build a unified framework for detecting underlying physical layer anomalies Quantifies the effects of different faults on a real network Builds statistical detection algorithms for each physical effect and evaluates algorithm effectiveness in a real network testbed

System Architecture Provide visibility into PHY layer Faults observed by multiple sensors Based on an iterative design process –Artificially replicated faults in a testbed –Measured impact of fault at each layer of network stack

MOJO Distributed Physical Layer Anomaly Detection System for WLANs Design Goals: –Flexible sniffer deployment –Inexpensive, $ + Comms. –Accurate in diagnosing PHY layer root causes –Implements efficient remedies –Near-real-time

Initial Design Main components: –Wireless sniffers –Data collection mechanism –Inference engine Diagnose problems, Suggest remedies Data collection and inference engine initially centralized at a single server

Operation Overview Wireless sniffers sense PHY layer –Network interference, signal strength variations, concurrent transmissions –Modified Atheros based Madwifi driver run on client nodes Periodically transmit a summary to centralized inference engine. Inference engine collects information from the sniffers and runs detection algorithms.

Sniffer Placement Sniffer placement key to monitoring and detection –Sniffer locations may need to change as clients move over time –Cannot assume fixed locations, suboptimal monitoring Multiple sniffers, merged sniffer traces necessary to account for missed data

Prototype Implementation Uses two wireless interfaces on each client –One for data, the other for monitoring –Second radio receives every frame transmitted by the primary radio Avg. sniffer payload of 768 bytes/packet –1.3KB of data every 10 sec. –< 200 bytes/sec.

Detection of Noise Caused by interfering wireless nodes or non devices such as microwave ovens, Bluetooth, cordless phones, … Signal generator used to emulate noise source –Node A connected to access point and signal generator using RF splitter Node A

Detection of Noise Power of signal generator increased from - 90 dBm to -50 dBm Packet payload increased from 256 bytes to 1024 bytes in 256 byte steps 1000 frames transmitted for each power and payload size setting

RTT vs. Signal Power RTT stable until -65 dBm Beyond -50 dBm 100% packet loss

% Data Frames Retransmitted Signal power set to -60 dBm

Time Spent in Backoff and Busy Sensing of Medium

Detection of Noise Noise floor sampled every 5 mins. for a period of 5 days in a residential environment.

Hidden Terminal and Capture Effect Both caused by concurrent transmissions and collisions at the receiver In the Hidden Terminal case, nodes are not in range and can collide at any time In Capture Effect, the receivers are not necessarily hidden from one another –Why would they transmit concurrently?

Contention window set to CWmin (31 usec) on receiving a successful ACK Backoff interval selected from contention window Clear Channel Assessment time is 25 usec 6 usec region of overlap Hidden Terminal and Capture Effect

Experiment Setup: –Node B higher SNR than node A at AP –Node C not visible to node B or node A –Rate fallback disabled –Node pairs A-B or A-C generating TCP traffic to DEST node –TCP packets varied in size from Bytes –10 test runs for each payload size, 5.5 and 11 Mbps Hidden Terminal and Capture Effect

Experimental Results Hidden Terminal and Capture Effect

Detection Algorithm Executed on a central server Sliding window buffer of recorded data frames

Detection Accuracy Time synchronization is essential time synchronization protocol +/- 4 usec measured error

Long Term Signal Strength Variations of AP Different hardware = different powers and sensitivities Transmit power of AP varied, 100mW, 5mW

Detection Algorithm Signal strength variations observed by one sniffer are not enough to differentiate –Localized events, i.e. fading –Global events, i.e. change in TX power of AP Multiple distributed sniffers needed Experiments show three distributed sensors are sufficient to detect correlated changes in signal strength

Observations From Three Sniffers AP Power Reduced

Detection Accuracy vs. AP Signal Strength AP Power changed once every 5 mins.

Conclusion MOJO, a unified framework to diagnose physical layer faults in based wireless networks. Experimental results from a real testbed Information collected used to build threshold based statistical detection algorithms for each fault. First step toward self-healing wireless networks?