Resilience To Jamming Attacks: Rabat Anam Mahmood

ITTC
Rabat Anam Mahmood
Resilience To Jamming Attacks
Rabat Anam Mahmood

Department of Electrical Engineering & Computer Science
rabat@ittc.ku.edu
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Outline
Feasibility of Launching & Detecting Jamming
Attacks in Wireless Networks
Adaptive Radio Channel Allocation for
Supporting Coexistence of 802.15.4 & 802.11b
Defending Against Jamming Attacks in Wireless
Local Area Networks
References
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Outline
Defending Against Jamming Attacks in
Wireless Local Area Networks
References
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Definitions and Characteristics
A jammer is an entity who is purposefully trying to interfere
with the physical transmission and reception of wireless
communications
A jammer continuously emits RF signals to fill a wireless
channel so that legitimate traffic will be completely blocked
Common characteristics for all jamming attacks is that
their communications are not compliant with MAC protocols
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Packet Send Ratio
The ratio of packets that are successfully sent out by
a legitimate traffic source compared to the number
of packets it intends to send out at the MAC layer
Reason
Channel busy
Transmission delayed
New packets dropped when buffer space is full
Packets that are too long in the buffer, timeout
N packets to send; M sent successfully
PSR = M/N
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Packet Delivery Ratio
The ratio of packets that are successfully delivered to
a destination compared to the number of packets
that have been sent out by the sender
Reason
Destination may not be able to decode a received
packet due to interference
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Jamming Attack Models
Constant Jammer
Deceptive Jammer
Random Jammer
Reactive Jammer
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Constant Jammer
Continuously emits a radio signal

Sends out random bits to the channel
Does not follow any MAC layer etiquette
Does not wait for the channel to become idle
14 August 2008
Jamming Attacks
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Deceptive Jammer
Constantly injects regular packets to the channel
Normal nodes will be deceived by the packets
Normal nodes just check the preamble and remain
silent
Jammer can only send out preambles
14 August 2008
Jamming Attacks
10
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Random Jammer
Alternates between sleeping and jamming
After jamming for tj units of time, it turns off its radio
and enters sleeping mode
After sleeping for ts units of time, it wakes up and
resumes jamming (constant or deceptive)
tj and ts may be random or fixed intervals-energy
conservation
14 August 2008
Jamming Attacks
11
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Reactive Jammer
Jammer stays quiet when the channel is idle
Jammer starts transmitting a radio signal as soon as
it senses activity on the channel
Does not conserve energy because the jammers
radio must be continuously on in order to sense the
channel
However, it is harder to detect
14 August 2008
Jamming Attacks
12
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Level of Interference
Distance between jammer and nodes
Relative transmission power of the jammer and
nodes
MAC protocol employed by the nodes
14 August 2008
Jamming Attacks
13
ITTC
Rabat Anam Mahmood
Jamming Attacks
Wireless Networks
Detecting Jamming Attacks
Signal Strength
Carrier Sensing Time
Packet Delivery Ratio
14 August 2008
Jamming Attacks
14
ITTC
Rabat Anam Mahmood
Jamming Attacks
Outline
References
14 August 2008
Jamming Attacks
15
ITTC
Rabat Anam Mahmood
Radio Channel Allocation

Coexistence of 802.15.4 and 802.11b
Coexistence
Ability of one system to perform a task in a given
shared environment where other systems may or
may not be using the same set of rules.
Solution
Multiple radio channels for the coexistence of
802.15.4 LR WPAN and 802.11b WLAN
14 August 2008
Jamming Attacks
16
ITTC
Rabat Anam Mahmood

802.11b has a radio transmission range of
100m
802.15.4 has a radio transmission range of
10m
Large area and long distance interference for
802.15.4 by 802.11b
Performance degradation of 802.15.4 by 92%
(a study shows)
14 August 2008
Jamming Attacks
17
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
18
ITTC
Rabat Anam Mahmood

IEEE 802.11b has 11 channels
Each channel has a frequency range of 22 MHz
IEEE 802.15.4 has 16 channels
Each channel is 5 MHz apart

Each channel has a frequency range of 3 MHz
Frequencies of each 802.11 channel overlaps with

frequency ranges for four different 802.15.4
channels
Channels 25 & 26 can be used where frequent
interference of 802.11b is expected
14 August 2008
Jamming Attacks
19
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
20
ITTC
Rabat Anam Mahmood

Packet entering interference, at A

Radio channel switched
Switching table used
Packet leaving interference, at B
Radio channel switched again
Advantage
Small overhead for switching channels
Same routing path used
14 August 2008
Jamming Attacks
21
ITTC
Rabat Anam Mahmood

Interference Detection
Clear channel assessment or energy detection
provided as RSSI (Received Signal Strength Indicator)
services in 802.15.4.
RSSI services called periodically or on demand when
a sudden degradation of user throughput below a
threshold is detected
If RSSI confirms that the energy level on a current
channel is above the threshold, channel interference
is recognized
14 August 2008
Jamming Attacks
22
ITTC
Rabat Anam Mahmood

Group Formation
Nodes broadcast Group Formation messages to the
immediate neighbors
Due to interference nodes may or may not receive
GF message
Nodes change the current radio channel
Border nodes provide channel conversion for the
group.
14 August 2008
Jamming Attacks
23
ITTC
Rabat Anam Mahmood

Tear Down
Nodes in a group periodically check if the previous
channel is clear of interference.
If so, a tear down message is sent to all the nodes in
a group and the group is torn down.
14 August 2008
Jamming Attacks
24
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
25
ITTC
Rabat Anam Mahmood

Interference size represents the number of
nodes in interference
Success rate is percentage value relative to
without interference
14 August 2008
Jamming Attacks
26
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
27
ITTC
Rabat Anam Mahmood

The percentage value is the delay increase
relative to the delay without interference
Since packets are routed through the
interference area, the delay is not increased
much
14 August 2008
Jamming Attacks
28
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
29
ITTC
Rabat Anam Mahmood

Comparison between packet delays of AODV
and AODV plus (adaptive scheme)
Due to adaptive scheme, lower packet delay is
attained
14 August 2008
Jamming Attacks
30
ITTC
Rabat Anam Mahmood

Conclusion
Performance degradation by interference is mainly
caused from changing routing path.
The overhead for switching radio channels is very
small
Hence, by employing the adaptive scheme, routing
does not need to find a new path when it hits into an
interference area.
14 August 2008
Jamming Attacks
31
ITTC
Rabat Anam Mahmood
Jamming Attacks
Outline
References
14 August 2008
Jamming Attacks
32
ITTC
Rabat Anam Mahmood
Defend Against Jamming Attacks

Wireless Jamming Attacks
RTS Jamming
CTS Jamming
Solution
Cumulative-Sum-based (CUSUM) Detection Method
14 August 2008
Jamming Attacks
33
ITTC
Rabat Anam Mahmood

RTS Jamming
Jammer occupies channel by continuously sending
RTS frames with large NAV to AP
AP replies with CTS which can be heard by nearby
nodes
Neighbor nodes will keep silent for a period of time
indicated by NAV
Neighbor nodes can hardly occupy the channel
14 August 2008
Jamming Attacks
34
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
35
ITTC
Rabat Anam Mahmood

CTS Jamming
Jammer sends CTS frames with spoofed ID which is
as same as AP
AP unaware of this behavior
Jammer uses directional antenna
Jammer remains far away from the AP
Neighbor nodes assume AP is busy (hidden node
problem) and will remain silent
Neighbor nodes never get a chance to occupy the
channel
14 August 2008
Jamming Attacks
36
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
37
ITTC
Rabat Anam Mahmood

Defending against RTS/CTS attacks
Two separate data windows for RTS & CTS

Size of the window is fixed
Source ID information of the frame is recorded
Source ID of the CTS frame is checked in the CTS
window
Source ID also checked in the RTS window
Different score given to each frame using a function
Smallest index gains the highest score
14 August 2008
Jamming Attacks
38
ITTC
Rabat Anam Mahmood

CUSUM Method
Sequential Detection Change Point method
Mean value of some variable under surveillance will
change from negative to positive whenever a change
occurs.
14 August 2008
Jamming Attacks
39
ITTC
Rabat Anam Mahmood

Channel is nearly fairly shared among nodes
Source ID distribution of CTS / RTS frames is
uniform
If a node constantly occupies the channel,
uniform distribution will change
CUSUM is applied to detect changes in CTS
window
When a change point is detected,
corresponding CTS frames are suspicious
14 August 2008
Jamming Attacks
40
ITTC
Rabat Anam Mahmood

14 August 2008
Jamming Attacks
41
ITTC
Rabat Anam Mahmood

Conclusion
CUSUM can accurately detect RTS/CTS jamming
attacks with little computation and storage cost
Although these attacks cannot totally prevent other
nodes from communication, they can seriously
degrade the network throughput
These attacks have lower traffic rates than normal
jamming attack and are more difficult to detect
14 August 2008
Jamming Attacks
42
ITTC
Rabat Anam Mahmood
Jamming Attacks
Outline
References
14 August 2008
Jamming Attacks
43
ITTC
Rabat Anam Mahmood
Jamming Attacks
References
http://www.winlab.rutgers.edu/~trappe/Papers/
JamDetect_Mobihoc.pdf
http://ieeexplore.ieee.org/iel5/10422/33099/01
559004.pdf?arnumber=1559004
http://www.springerlink.com/content/l2qp0215r
1268p4t/fulltext.pdf
14 August 2008
Jamming Attacks
44

Resilience To Jamming Attacks: Rabat Anam Mahmood

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Resilience To Jamming Attacks: Rabat Anam Mahmood

Hochgeladen von

Copyright:

Verfügbare Formate

ITTC

Rabat Anam Mahmood