1. ARES: an Anti-jamming REinforcement System for 802.11 Networks Konstantinos Pelechrinis, Ioannis Broustis, Srikanth V. Krishnamurthy, Christos Gkantsidis ACM CoNEXT 2009

2. Launching DoS Attacks in WiFi networks is easy 2

3. 3 Alice senses medium busy

4. Launching DoS Attacks in WiFi networks is easy 4 Packet collisions

5. Launching DoS Attacks in WiFi networks is easy 5 Jammer can be: -Continuous -Intermittent: random or reactive Xu et al [MobiHoc 2005]

6. Launching DoS Attacks in WiFi networks is easy How to deal with jammers? Frequency hopping ?? Two flavors: (a) Reactive, (b) Proactive 6 Frequency hopping is weak for current systems [WiOpt 2009]: Only 4 jammers to block entire 5GHz spectrum

7. Launching DoS Attacks in WiFi networks is easy 7 Can we alleviate jamming effects without relying on frequency hopping?

8. Our Contributions/Findings Fixed rates are often preferable in the presence of a jammer  Rate adaptation converges slowly Clear Channel Assessment (CCA) tuning is important:  The transmitter can ignore jamming signals  The receiver can latch on the desired signal more easily ARES: A measurement driven anti-jamming system which utilizes rate and power control techniques.  ARES fights jammer, instead of trying to avoid it Testbed evaluations show the potentials of ARES:  Up to 3x better performance 8

9. Roadmap Introduction Rate Control Power Control System architecture Evaluation Conclusions 9

10. Interaction between random jamming and rate control 10 Jamming effects last beyond the jamming period when rate control is used !

11. Rate Control: Fixed or Variable? In general, rate adaptation improves performance under benign condition. But, in the presence of an intermittent jammer The rate control algorithm might be slow to converge to optimum rate Remedy: Fixed rate assignments increase immediately throughput But, performance depends on channel conditions 11 How to decide when to allow rate adaptation and when not?

12. Deciding when to perform rate adaptation With perfect knowledge of:  Application data rate R a  Jammer’s distribution  Rate control algorithm used  Link quality (e.g., PDR)  Effectiveness of jammer (measured via the throughput sustained on the link) we can analytically decide between fixed rate and rate control. 12 Average throughput over a jamming cycle. Effectiveness of jammer Rate control algorithm Link Quality Application rate

13. Fixed rate provides high throughput gains Throughput gains are indeed viable in practice with fixed rates under the presence of random jamming. 13 Corollary: Use rate control only when the link is very “poor”. E.g. for R a =54Mbps, rate adaptation is preferred only if PDR is as low as 0.15 (for sample rate)

14. Practical algorithm for deciding when to rate control However, perfect knowledge is not realistic Our Markovian Rate Control (MRC) module is inspired from the analysis but does not require knowledge of any of the parameters. 14 -i = 0 - keep track of rate R - i++ Jamming In: k Jam off & i == k Set rate at R Jam off & i < k Jamming

15. MRC performs well in practice Parameter k controls the performance of MRC. MRC can be tuned to give performance close to the “optimal”. 15

16. Roadmap Introduction Rate Control Power Control System architecture Evaluation Conclusions 16

17. Power Control Rate control removes transient jamming effects. What about constant jamming effects? Power Control:  Power adaptation  Clear Channel Assessment (CCA) tuning Power adaptation helps only when:  Transmitter is not in the jammer’s range.  When low transmissions rates are used. Increasing CCA at the transceivers can restore the benign throughput with high probability.  Care for avoiding starvation. 17

18. Increasing power helps when transmission rate is low Observation 1: Probability of accessing the medium does not depend on transmission power. Observation 2: Given that a packet is transmitted  Power adaptation increases “Signal / Jamming Interference Ratio.”  Improvements when low transmission rates are used. 18 Restricted solution. Ideal solution should be agnostic to: Jammer’s range Rate used

19. Dealing with high power jammers In the presence of a high power jammer  The transmitter needs to be able to ignore jamming signals.  The receiver must be able to decode the legitimate packet.  Tuning the transmission power increases the legitimate signal level at the receiver, but not very helpful when the jamming interference is also large enough. Observation 3: CCA threshold dictates both transmitting and receiving functionality  Transmitter: total energy at the transmitter’s antenna < CCA  idle medium  Receiver: signals with energy < CCA  noise  Increasing the CCA threshold does NOT increase the SNR at the receiver.  It helps the receiver latch on the legitimate signal. 19

20. Side effects of power control Care needs to be taken for possible side effects:  Transmitter: unintentionally become a jammer  starve other nodes  [Mahtre et al – Infocom 2007] : P  CCA = constant  Receiver: blindly increasing CCA  legitimate signals regarded as noise  Upper bound at CCA value for not ignoring signals of interest 20 Connectivity starts to be compromised ! !

21. How to perform Power Control? Shadow fading variation Δ: Signal levels vary from their average value by ΔdBm. RSSI ij is the signal level at node j due to the transmission of node i (i,j = T(transmitter), R(receiver) and J(jammer)). Heuristic for CCA on the link (CCA L ):  If max(RSSI JT, RSSI JR ) ≤ min(RSSI RT, RSSI TR ) – Δ CCA L = min(RSSI RT, RSSI TR ) – Δ  If max(RSSI JT, RSSI JR ) ≤ min(RSSI RT, RSSI TR ) – 2Δ  Link operates as in jamming free environment. 21

22. ARES: System Design ARES performs rate control and power control. Rate control uses the Markov Rate controller. Power control sets the CCA value based on the RSSIs and the value for the shadow fading variation Δ. Both rate and power control are measurement-driven heuristics. 22 Jammer detected Xu et al [MobiHoc 2005] Is CCA tuneable? Yes Power Control Jamming resolved? Rate Control No END Yes No

23. Roadmap Problem motivation Our Contributions/Findings Background/Related Studies System Design  Rate Control Measurements  Power Control Measurements Evaluation Conclusions 23

24. Evaluation Setup Experimental evaluation on our indoor wireless testbed. Hardware used:  Intel-2915 with ipw2200 driver/firmware (allows tuning CCA).  EMP-8602 6G  Ralink RT2860 (support 802.11n) Jammer implementation:  Utilize Intel cards  CCA  0 dBm  User space utility that sends broadcast packets back – to – back 24

25. Effect of rate control on 802.11n Rate Control only Benchmark results: using analytical assessments ARES: Improves performance by up to 100% 25

26. Mobile Jammer The jammer (constant) moves to the vicinity of the legitimates nodes, stays there for k seconds and leaves. ARES utilizes power control module  Increased CCA to overcome the presence of the jammer  Rate adaptation module is not of much benefit in this scenario. ARES increases throughput by >150% 26

27. Using rate control to avoid neighbor starvation ARES (MRC) improves neighbors’ AP throughput. Avoid transmissions at lower rates during the sleeping cycles.  Neighbor APs and links have to wait less time to obtain the medium.  Improved overall, networked setting performance With one neighbor AP (and one jammed) 23% improvement Adding more APs reduces the benefits due to increased contention. 27

28. Roadmap Problem motivation Our Contributions/Findings Background/Related Studies System Design  Rate Control Measurements  Power Control Measurements Evaluation Conclusions 28

29. Conclusions Fixed rate assignments can be beneficial in jammed environments. Power level tuning helps only at low rates and low power jammers. Tuning the CCA threshold enables:  The transmitter to ignore jamming signals  The receiver capture the desired packet(s) Evaluations of our measurement driven prototype system shows that rate and power control can efficiently fight against the jammer.  Frequency hopping tries to avoid the jammer. 29

30. THANK YOU !! QUESTIONS? 30