This paper presents a simple local medium access control protocol, called , for multi-hop wireless networks with a single channel that is provably robust against adaptive adversarial jamming. The wireless network is modeled as a unit disk graph on a set of nodes distributed arbitrarily in the plane. In addition to these nodes, there are adversarial jammers that know the protocol and its entire history and that are allowed to jam the wireless channel at any node for an arbitrary @math -fraction of the time steps, where @math is an arbitrary constant. We assume that the nodes cannot distinguish between jammed transmissions and collisions of regular messages. Nevertheless, we show that achieves an asymptotically optimal throughput if there is a sufficiently dense distribution of nodes.
@cite_30: Radio jamming in wireless sensor networks is an effective means by which an attacker can disrupt communication between sensor nodes. The purpose of such an attack can be to delay or prevent nodes from reporting their readings to the basestation, to deplete vital network resources such as energy, or both. This paper presents MULEPRO (MULti-channel Exfiltration PROtocol), a fully distributed network based protocol designed to rapidly exfiltrate data from a jammed area. MULEPRO targets sensor network applications that require an immediate and robust response to radio jamming denial-of-service (DoS) attacks. It works by automatically and efficiently assigning nodes to different channels in the jammed area in order to defeat an attacker. We have extensively evaluated MULEPRO under avariety of attack configurations. These tests show that even when the attacker uses a channel hopping strategy MULEPRO can effectively exfiltrate data.
@cite_37: Built upon a shared wireless medium, wireless network is particularly vulnerable to jamming attacks. The ability to recover from attacks and maintain an acceptable level of service degradation is a crucial aspect in the design of a wireless network. To address this issue, this paper investigates the network restoration solutions via the joint design of traffic rerouting, channel re-assignment, and scheduling. Efficient routing and channel assignment schemes can relieve the interference caused by both the normal network nodes and the jamming nodes. Therefore, based on the necessary conditions of schedulability, we first formulate the optimal network restoration problem as linear programming problem, which gives an upper bound on the achievable network throughput. After we solve the LP problems, we have a set of flows assigned to edges that have been assigned to different channels. And based on the LP solutions, we provide a greedy scheduling algorithm using dynamic channel assignment, which schedules both the network traffic and the jamming traffic. In particular, we consider two strategies, namely global restoration and local restoration, which can support a range of tradeoffs between the restoration latency and network throughput after restoration. To quantitatively evaluate the impact of jamming attacks during and after restoration, we define two performance degradation indices, transient disruption index (TDI) and throughput degradation index (THI). Finally, extensive performance evaluations are performed to study the impact of various jamming scenarios in a multi-hop multi-channel wireless network.
@cite_18: One critical issue in multihop ad hoc networks is the medium access control (MAC). The IEEE 802.11 MAC protocol is originally designed for fully connected, one-hop ad hoc networks but not for multihop ad hoc networks. In addition to the well known hidden-terminal problem, we found that IEEE 802.11 also suffers from an erroneous reservation problem which occurs when RTS-CTS exchange fails but the channel is incorrectly reserved. In this paper, we propose a jamming-based MAC (JMAC) protocol that is not only free from both hidden-terminal and the erroneous reservation problems but also allows more concurrent transmission reception activities for stations within each other's transmission range. The idea behind the JMAC is to separate source stations' traffic from destination stations' traffic into different channels (i.e., dividing the shared medium into two channels), and explicitly signal the channel status by jamming the channels. Simulation results show that the JMAC can provide higher channel utilization when system is in high traffic load and the frame size is medium or large.
@cite_33: A typical wireless sensor node has little protection against radio jamming. The situation becomes worse if energy-efficient jamming can be achieved by exploiting knowledge of the data link layer. Encrypting the packets may help prevent the jammer from taking actions based on the content of the packets, but the temporal arrangement of the packets induced by the nature of the protocol might unravel patterns that the jammer can take advantage of even when the packets are encrypted. By looking at the packet interarrival times in three representative MAC protocols, S-MAC, LMAC and B-MAC, we derive several jamming attacks that allow the jammer to jam S-MAC, LMAC and B-MAC energy-efficiently. The jamming attacks are based on realistic assumptions. The algorithms are described in detail and simulated. The effectiveness and efficiency of the attacks are examined. Careful analysis of other protocols belonging to the respective categories of S-MAC, LMAC and B-MAC reveal that those protocols are, to some extent, also susceptible to our attacks. The result of this investigation provides new insights into the security considerations of MAC protocols.
@cite_7: In this paper, we address the following question: given a specific placement of wireless nodes in physical space and a specific traffic workload, what is the maximum throughput that can be supported by the resulting network? Unlike previous work that has focused on computing asymptotic performance bounds under assumptions of homogeneity or randomness in the network topology and or workload, we work with any given network and workload specified as inputs.A key issue impacting performance is wireless interference between neighboring nodes. We model such interference using a conflict graph, and present methods for computing upper and lower bounds on the optimal throughput for the given network and workload. To compute these bounds, we assume that packet transmissions at the individual nodes can be finely controlled and carefully scheduled by an omniscient and omnipotent central entity, which is unrealistic. Nevertheless, using ns-2 simulations, we show that the routes derived from our analysis often yield noticeably better throughput than the default shortest path routes even in the presence of uncoordinated packet transmissions and MAC contention. This suggests that there is opportunity for achieving throughput gains by employing an interference-aware routing protocol.
@cite_8: We consider a scenario where a sophisticated jammer jams an area in a single-channel wireless sensor network. The jammer controls the probability of jamming and transmission range to cause maximal damage to the network in terms of corrupted communication links. The jammer action ceases when it is detected by a monitoring node in the network, and a notification message is transferred out of the jamming region. The jammer is detected at a monitor node by employing an optimal detection test based on the percentage of incurred collisions. On the other hand, the network computes channel access probability in an effort to minimize the jamming detection plus notification time. In order for the jammer to optimize its benefit, it needs to know the network channel access probability and number of neighbors of the monitor node. Accordingly, the network needs to know the jamming probability of the jammer. We study the idealized case of perfect knowledge by both the jammer and the network about the strategy of one another, and the case where the jammer or the network lack this knowledge. The latter is captured by formulating and solving optimization problems, the solutions of which constitute best responses of the attacker or the network to the worst-case strategy of each other. We also take into account potential energy constraints of the jammer and the network. We extend the problem to the case of multiple observers and adaptable jamming transmission range and propose a intuitive heuristic jamming strategy for that case.
@cite_41: Summary One critical issue in multihop ad-hoc networks is the medium access control (MAC). The IEEE 802.11 MAC protocol is originally designed for fully connected, one-hop ad-hoc networks but not for multihop ad-hoc networks. In addition to the well known hidden-terminal problem, we found that IEEE 802.11 also suffers from an erroneous reservation problem which occurs when RTS-CTS exchange fails but the channel is incorrectly reserved. In this paper, we propose a jamming-based MAC (JMAC) protocol that is not only free from both the hiddenterminal and the erroneous reservation problems but also allows more concurrent transmission receipt activities for stations within each other’s transmission range. The idea behind the JMAC is to separate source stations’ traffic from destination stations’ traffic into different channels (i.e. dividing the shared medium into two channels), and explicitly signal the channel status by jamming the channels. Simulation results show that although the channel division incurs some cost, the advantages of being free from the erroneous reservation and the hidden-terminal problems, and the benefits of more concurrent transmissions will compensate the cost and provide higher channel utilization when data frame size is median or large. Copyright # 2004 John Wiley & Sons, Ltd.
@cite_10: 
@cite_42: 802.11a, b, and g standards were designed for deployment in cooperative environments, and hence do not include mechanisms to protect from jamming attacks. In this paper, we explore how to protect 802.11 networks from jamming attacks by having the legitimate transmission hop among channels to hide the transmission from the jammer. Using a combination of mathematical analysis and prototype experimentation in an 802.11a environment, we explore how much throughput can be maintained in comparison to the maintainable throughput in a cooperative, jam-free environment. Our experimental and analytical results show that in today's conventional 802.11a networks, we can achieve up to 60 of the original throughput. Our mathematical analysis allows us to extrapolate the throughput that can be maintained when the constraint on the number of orthogonal channels used for both legitimate communication and for jamming is relaxed.
@cite_32: Mobile communication systems are often susceptible to high level of noise injected by adversaries, known as jamming attack. Jamming is difficult to prevent in broadcast networks because a user that can decode a transmission can also jam the transmission. In this paper, we describe a code tree system that helps the physical layer circumvent jammers. This system works with any spread-spectrum communications system. In our system, the transmitter has more information than any single receiver. Each receiver cooperates with the transmitter to detect any jamming that affects that receiver. Our scheme mitigates the jamming attack while allowing the transmitter to transmit on fewer codes than the number of users. We simulated our system in a theoretical setting using MATLAB. The result shows significant improvement over naively transmitting on a single shared code.
@cite_24: Jamming is a very effective denial-of-service attack that renders most higher-layer security mechanisms moot - yet it is often ignored in WSN design. We show that an interrupt jamming attack is simple to perpetrate in software using a MICAz mote, is energy efficient and stealthy for the jammer, and completely disrupts communication. Solutions are needed to mitigate this insider threat even if more powerful attackers are not thwarted. We present DEEJAM, a novel MAC-layer protocol for defeating stealthy jammers with IEEE 802.15.4-based hardware, to address this problematic area. It layers four defensive mechanisms to hide communication from a jammer, evade its search, and reduce its impact. Given the difficulty of modeling the physical layer accurately in simulation, we evaluate DEEJAM instead on the MICAz mote. We show the performance of the protocol against successively more complex attacks: interrupt jamming, activity jamming, scan jamming, and pulse jamming. Results show that DEEJAM defeats the otherwise devastating interrupt jammer, and achieves a packet delivery ratio of 88 in the presence of a pulse jammer. To the best of our knowledge, this work is the first to confront multiple types of jamming on common WSN hardware with solutions that are shown empirically to enable continued communication despite an ongoing attack.
@cite_27: This paper considers the problem of an attacker disrupting an encrypted victim wireless ad hoc network through jamming. Jamming is broken down into layers and this paper focuses on jamming at the Transport Network layer. Jamming at this layer exploits AODV and TCP protocols and is shown to be very effective in simulated and real networks when it can sense victim packet types, but the encryption is assumed to mask the entire header and contents of the packet so that only packet size, timing, and sequence is available to the attacker for sensing. A sensor is developed and tested on live data. The classification is found to be highly reliable for many packet types. The relative roles of size, timing, and sequence are discussed along with the implications for making networks more secure.
@cite_5: In this paper, we address the problem of cross-layer denial of service attack in wireless data networks. We introduce SPREAD -a novel adaptive diversification approach to provide resiliency against such attacks. SPREAD relies on a mechanism-hopping technique, which can be seen as a multi-layer extension of the frequency-hopping technique. We apply a game-theoretic framework for modeling the interaction of the communicating nodes and the adversaries and analyze the proposed approach. We reason about the advantages of SPREAD against various types of jammers and demonstrate the effectiveness of our approach in the case of IEEE 802.11 protocol stack by studying the EIFS attack, periodical jamming and a Packet-Size Game. As an example, we show that mechanism-hopping over two instances of IEEE 802.11 can achieve several orders of magnitude gain in throughput over a single-instance network under the EIFS attack.
@cite_15: In this paper we investigate the problem of maintaining connectivity under jamming in multihop ad hoc wireless networks. Connectivity is measured using a connectivity index, which indicates the probability that there exists a path between two nodes. We first show that connectivity can be drastically reduced with a relatively small number of jammers. We show that using sectored antennas can maintain connectivity in the presence of a significantly higher number of jammers at the expense of higher average number of hops. Finally, we show that mobility allows further resiliency to jamming.
@cite_34: Wireless networks are built upon a shared medium that makes it easy for adversaries to launch jamming-style attacks. These attacks can be easily accomplished by an adversary emitting radio frequency signals that do not follow an underlying MAC protocol. Jamming attacks can severely interfere with the normal operation of wireless networks and, consequently, mechanisms are needed that can cope with jamming attacks. In this paper, we examine radio interference attacks from both sides of the issue: first, we study the problem of conducting radio interference attacks on wireless networks, and second we examine the critical issue of diagnosing the presence of jamming attacks. Specifically, we propose four different jamming attack models that can be used by an adversary to disable the operation of a wireless network, and evaluate their effectiveness in terms of how each method affects the ability of a wireless node to send and receive packets. We then discuss different measurements that serve as the basis for detecting a jamming attack, and explore scenarios where each measurement by itself is not enough to reliably classify the presence of a jamming attack. In particular, we observe that signal strength and carrier sensing time are unable to conclusively detect the presence of a jammer. Further, we observe that although by using packet delivery ratio we may differentiate between congested and jammed scenarios, we are nonetheless unable to conclude whether poor link utility is due to jamming or the mobility of nodes. The fact that no single measurement is sufficient for reliably classifying the presence of a jammer is an important observation, and necessitates the development of enhanced detection schemes that can remove ambiguity when detecting a jammer. To address this need, we propose two enhanced detection protocols that employ consistency checking. The first scheme employs signal strength measurements as a reactive consistency check for poor packet delivery ratios, while the second scheme employs location information to serve as the consistency check. Throughout our discussions, we examine the feasibility and effectiveness of jamming attacks and detection schemes using the MICA2 Mote platform.
@cite_13: 
@cite_12: Wireless sensor networks are built upon a shared medium that makes it easy for adversaries to conduct radio interference, or jamming, attacks that effectively cause a denial of service of either transmission or reception functionalities. These attacks can easily be accomplished by an adversary by either bypassing MAC-layer protocols or emitting a radio signal targeted at jamming a particular channel. In this article we survey different jamming attacks that may be employed against a sensor network. In order to cope with the problem of jamming, we discuss a two-phase strategy involving the diagnosis of the attack, followed by a suitable defense strategy. We highlight the challenges associated with detecting jamming. To cope with jamming, we propose two different but complementary approaches. One approach is to simply retreat from the interferer which may be accomplished by either spectral evasion (channel surfing) or spatial evasion (spatial retreats). The second approach aims to compete more actively with the interferer by adjusting resources, such as power levels and communication coding, to achieve communication in the presence of the jammer.
@cite_11: It has long been recognized that complete jamming of wireless networks can be realized by generating continuous noise with sufficient power in the vicinity of the wireless network. There are many disadvantages of this approach including high energy requirements and a high probability of detection. The purpose of this paper is to show that similar jamming effectiveness can be achieved with very low energy requirements and low probability of detection. We discuss various measures of performance for jamming and the role of authentication in denial of service attacks. Then we study and simulate, using OPNET 11.5, the effect of periodic jamming on throughput for an 802.11b network. We add intelligence to the jammer by using knowledge of the protocol and exploiting crucial timings and control packets. Intelligent jamming is shown to be more efficient than continuous jamming in terms of signal duration. The next approach is to use a node or two to exploit the backoff timer to create a denial of service attack. Finally, we discuss how these attacks can be applied to networks with protocols such as MILSTD- 188-220D.
Due to the topic's importance, wireless network jamming has been extensively studied in the applied research fields @cite_30 @cite_27 @cite_32 @cite_37 @cite_33 @cite_8 @cite_5 @cite_42 @cite_13 @cite_11 @cite_24 @cite_12 @cite_34 , both from the attacker's perspective @cite_32 @cite_33 @cite_8 @cite_34 as well as from the defender's perspective @cite_30 @cite_27 @cite_32 @cite_8 @cite_5 @cite_42 @cite_24 @cite_34 ---also in multi-hop settings (e.g. @cite_7 @cite_15 @cite_18 @cite_41 @cite_10 ).