1. Enhancing Critical Infrastructure Protection with innovative SECurity framework
Denial-of-Service Jammer Detector
Training Course
Worldsensing
The research leading to these results has received funding from the European Union’s Horizon 2020 Research and Innovation Programme, under Grant Agreement no

2. Wireless everywhere
Wireless networking plays an important role in achieving ubiquitous computing where network devices embedded in environments provide continuous connectivity and services, thus improving human’s quality of life. However, due to the exposed nature of wireless links, current wireless networks can be easily attacked by jamming technology. Jamming can cause Denial-of-Service (DoS) problem that may result in several other higher-layer security problems, although these are often not adequately addressed.
© May 2018

3. Jamming
Jamming makes use of intentional radio interferences to harm wireless communications by keeping communicating medium busy, causing a transmitter to back-off whenever it senses busy wireless medium, or corrupted signal received at receivers. Jamming mostly targets attacks at the physical layer but sometimes cross-layer attacks are possible too.
© May 2018

4. The problem
Jammers are malicious wireless nodes planted by an attacker to cause intentional interference in a wireless network. Depending upon the attack strategy, a jammer can either have the same or different capabilities from legitimate nodes in the network, which they are attacking. The jamming effect of a jammer depends on its radio transmitter power, location and influence on the network or the targeted node.
© May 2018

5. Jamming techniques There are four main types of jamming signals:
CONTINUOUS WAVE: RF sinusoidal narrowband signal with constant amplitude and constant frequency.
FREQUENCY MODULATED: RF sinusoidal signal with constant amplitude and variable frequency that sweeps service band frequencies.
© May 2018

6. Jamming techniques
PULSED SIGNALS: Intermittent RF signal that has several harmonic components split in the entire service band.
WIDEBAND: Transmits a band of frequencies that is large with respect to the bandwidth of a single emitter.
© May 2018

7. Wireless bands in CI
The following communication bands are frequently used in critical infrastructures:
© May 2018

8. Jamming in practise Jammers can:
Prevent your cell phone from operating, making it impossible to emit or receive calls or messages
Prevent connections to the internet blocking digital payments and data transmission from a device
Freezing the image on CCTV systems and security cameras
Tamper with car central locking systems to facilitate robbery
Prevent correct positioning to be received for GPS, making it impossible to track or locate a transportation mean and making it digitally invisible
© May 2018

9. Jamming in hospital infrastructure case
© LAIRD
© May 2018

10. Jamming in train infrastructure case
© GUMUSKAYA
© May 2018

11. The solution
DoSSensing provides a device that is capable of detecting different types of radio jammer signals at the physical layer and inform the users that a particular jammer is performing an attack. It will visually provide the jammer type and estimated power over time for a particular frequency or wireless channel.
The users can then identify the threat and approach the area to find the jammer device. Having several devices on that area will better help to identify and find the threat that will be pointed out by more than one detector.
© May 2018

12. The solution
The monitoring tool helps identify whenever a jamming attack is taking place.
© May 2018

13. The solution
© May 2018

14. The solution
© May 2018

15. The solution
WIRELESS JAMMER DETECTOR: Detection of different types of radio frequency jamming attacks by analyzing the radio signal at the physical layer.
ATTACK LOGGER: Logs and also communicates the jamming attacks detected, including type of jammer, jammer to noise ratio, timestamp and frequency. It is integrated with ATOS XL-SIEM solution.
CONFIGURABLE: By default, the jammer detector analyses the WiFi 2.4 GHz band. However, it can be configured to analyze any frequencies between 1 MHz to 6 GHz
PORTABLE: Software solution is portable to different processing environments to generate real time results using configurable bandwidth.
PLUG & MONITOR: Plug the detector and monitor any anomalies affecting your wireless networks, through our visualization environment.
© May 2018

16. The solution – General architecture
SDR module
Processing Board
Monitoring Server
Visualization Tool
Antenna: used to capture the radiofrequency spectrum analogically
SDR Module: it measures the wireless signals and transforms the wave to digital samples
Processing Board: processes all the sampled data real time in order to make a decision whether there is a jamming signal or not
Monitoring Server: it gathers detection decisions, post processes them and stores them so that they can be visualized
Visualization Tool: used to present the detection results in a user friendly interface
© May 2018

17. The solution – The code
The code for the DoS Jammer Detector Sensor provided by Worldsensing in the framework of the CIPSEC project is OpenSource and can be found in the following repository:
This software will allow users to connect a HackRf One to the processing board, perform the detection and visualize the detection results via standard output. In addition, the jammer_msg_rx executable is an example application that reads detection events from a Linux queue and prints them on standard output. This application shows how to retrieve the events in case the solution wants to be extended as it is done on the DoS Sensing solution.
Note: the public repository does not include any Monitoring Server or Visualization Tool code. The output decisions obtained may need to be refined.
© May 2018

18. The solution – The code (output) - No Jammer
Main software (sdrjd executable) Example consumer (jammer_msg_rx)
© May 2018

19. The solution – The code (output) - Jammer
Main software (sdrjd executable) Example consumer (jammer_msg_rx)
© May 2018

20. In Detail: Detection Algorithm
Brief description of the steps taken place for the detection of the jamming attacks.
STEPS:
Compute the noise floor estimation.
Create the spectrogram: representation in frequency.
Project the measure into time domain (FT).
Compute mean of the measures.
Binarize the measures.
FT to perform the decision making process.
Decision Algorithm
© May 2018

21. In Detail: Decision Algorithm
© May 2018

22. In detail: The Hardware
© May 2018

23. In detail: The platform - No jammer
© May 2018

24. In detail: The platform - Jammer Detected
© May 2018

25. Thank you for your attention,