1. DK presents Division of Computer Science, KAIST
The Feasibility of Launching and Detecting Jamming Attacks in Wireless Networks
Wenyuan Xu, Wade Trappe, Yanyong Zhang and Timothy Wood
MobiHoc 2005
DK presents
Division of Computer Science, KAIST
CS710 (Fall, 2006) -- DK

2. Jamming Attack Jammer? (/-_-)/ ~!@#$#$% Alice Bob Jammer X
An entity who is purposefully trying to interfere with the
physical transmission and reception of wireless communications.
How are you?
(/-_-)/
Alice
I am fine, thank you.
Bob
Jammer X
continuously emit a signal on the channel.
Jammer prevents a real traffic source from sending out a packet,
And prevents the reception of legitimate packets.
CS710 (Fall, 2006) -- DK

3. Outline Motivation: MAC-layer weaknesses in 802.11 Is it feasible?
[2] Australian CERT, AA
“Denial of service vulnerability in IEEE devices.”
Is it feasible?
Jamming metrics: (1) packet send, (2) delivery ratio
Jamming attack models
Detecting jamming attacks
Basic statistics
Jamming detection with consistency checks
Concluding remarks
CS710 (Fall, 2006) -- DK

4. Jamming Metrics PSR, packet send ratio PDR, packet delivery ratio m
only m of them go through = = n
Intends to send out n messages
Never senses
the channel
as idle
drop ~ buffer full
drop ~ timeout
MAC buffer
0, if no packets are received. =
Number of packets pass the CRC check
Number of packets received
CS710 (Fall, 2006) -- DK

5. Jamming Attack Models Constant jammer Deceptive jammer Random jammer
Continually sends out random bits without following any MAC etiquette.
Deceptive jammer
Send a continuous stream of preamble bits
(0xAA in Tiny OS.)
Random jammer
After jamming for tj time,
enters a “sleeping” mode for ts time.
Reactive jammer
Stays quiet, starts jamming as soon as
it senses activity on the channel.
Alice
Jammer
Berkeley MICA2
Mote platform
Bob
CS710 (Fall, 2006) -- DK

6. PSR and PDR Results
PSR and PDR Results (%) for different jammer models.
Distance
(inch)
BMAC SenSys2004
1.1.1 MAC
PSR
PDR
38.6
74.37
0.43
1.00
1.94
Constant Jammer
Distance
(inch)
BMAC
1.1.1 MAC
PSR
PDR
38.6
0.00
Deceptive Jammer
Distance
(inch)
BMAC
1.1.1 MAC
PSR
PDR
38.6
99.00
0.00
100.00
Reactive Jammer
CS710 (Fall, 2006) -- DK

7. ∴ PSR and PDR Results Jamming is effective So then, how to detect?
CS710 (Fall, 2006) -- DK

8. Basic Statistics for Detecting Jam
(1) Received signal strength
CBR 5.28kbps
Normal
scenario
MaxTraffic 6.46kbps
Constant Jammer
dBm
Deceptive Jammer
Jammer
In an IEEE system RSSI is the received signal strength in a wireless environment, in arbitrary units. RSSI can be used internally in a wireless networking card to determine when the amount of radio energy in the channel is below a certain threshold at which point the network card is clear to send (CTS). Once the card is clear to send, a packet of information can be sent. The end-user will likely observe an RSSI value when measuring the signal strength of a wireless network through the use of a wireless network monitoring tool like Network Stumbler.
Reactive Jammer
Random Jammer
CS710 (Fall, 2006) -- DK

9. Basic Statistics for Detecting Jam
(2) Signal strength spectral discrimination
[15] Time Series Analysis by High order crossings (HOC)
Cosntant and
Deceptive Jammer
Normal,
Reactive, and
Random Jammer D2 D2
Normal scenario D1 D1
CS710 (Fall, 2006) -- DK

10. Basic Statistics for Detecting Jam
(3) Carrier sensing time
Keep track of time it spends waiting for the channel to become idle.
Cumulative Distribution of Carrier Sensing Time
MaxTraffic
Constant and
Deceptive Jammer
MaxTraffic
Reactive and
Random Jammer
Sensing Time (ms)
Sensing Time (ms)
CS710 (Fall, 2006) -- DK

11. Basic Statistics for Detecting Jam
(4) Packet delivery ratio (PDR)
PDR can be used to differentiate jamming from congestion:
Under network congestion, PDR is still around 78%.
PDR is not effective for other network dynamics:
sender battery failure, or
sender moving out of the receiver’s communication range.
0, if no packets are received. =
Number of packets pass the CRC check
Number of packets received
CS710 (Fall, 2006) -- DK

12. Basic Statistics for Detecting Jam∴
Statistics built upon individual measurements may lead to false conclusions.
CS710 (Fall, 2006) -- DK

13. PDR with Consistency Check – (1)
PDR with “signal strength consistency” check
Observed PDR
Observed signal strength
Typical Scenarios
0 or Low
Low
neighbor failure or absence
High
node jammed
Jammed region (PDR, SS)
above the 99% SS confidence
intervals.
SS (dBm)
Conduct a simple regression
to build a relationship
(PDR, SS)
PDR %
CS710 (Fall, 2006) -- DK

14. PDR with Consistency Check – (2)
PDR with location consistency check
Requires the support of GPS [7] or other localization techniques. [3, 19]
Let every node periodically advertise its current location, and
keep track of both the PDR and the location of neighbors.
Jammed region (PDR, d)
neighbor is in short distance,
but corresponding PDR is low.
Distance (inch)
PDR %
CS710 (Fall, 2006) -- DK

15. Concluding Remarks Shared nature of wireless medium allows
non-cryptographic security threats likes
“radio interference attacks”
Shows effectiveness of four jamming strategies using
PSR and PDR
Detecting the presence of jamming attacks
PDR and
Signal strength consistency checks and
Location consistency checks.
CS710 (Fall, 2006) -- DK

16. Thank You! Any question? For more discussion:
DK, Rm4423,
CS710 (Fall, 2006) -- DK