Research Direction Introduction

Research Direction Introduction

Advisor: Professor Frank Y.S. LinPresent by Hubert J.W. Wang1OutlineIntroductionMotivationProblem Description2010/10/72NTU OPLab2IntroductionBackgroundThe rapid advancement of wireless technologies has enabled a broad class of new applications.

Some of the applications are safety-critical or life-critical such as:Patient trackingTraffic monitoringEmergency rescue and recoveryEtc.

Availability has became a critical issue in wireless network.2010/10/74NTU OPLab4Jamming attackDefinitionsJamming is any attack to deny service to legitimate users by generating noise or fake protocol packets or legitimate packets but with spurious timing.[1]Jamming refers to blocking of a communication channel with the intent of preventing the ow of any information.[2]Jamming attacks exploit the shared nature of the wireless medium in order to prevent devices from communicating or receiving.[4].

2010/10/75NTU OPLab5Jamming attack(cont)Nature of wireless networks.CountermeasuresMitigationPrevention

2010/10/76NTU OPLab6Wireless Mesh NetworkA WMN is dynamically self-organized and self-configured, with the nodes in the network automatically establishing and maintaining mesh connectivity among themselves.

Wireless Mesh Networks(WMNs) consist of :Mesh routersMesh clients

The integration of WMNs with other networks can be accomplished through the gateway and bridging functions in the mesh router.2010/10/77NTU OPLab7Wireless Mesh Network(cont)ArchitecturesInfrastructure/Backbone WMNs2010/10/78NTU OPLab

8Wireless Mesh Network(cont)ArchitecturesClient WMNs2010/10/79NTU OPLab

9Wireless Mesh Network(cont)ArchitecturesHybrid WMNs2010/10/710NTU OPLab

10Wireless Mesh Network(cont)CharacteristicsMulti-hop wireless networkExtend the overage range with out sacrificing the channel capacityProvide non-line-of-sight(NLOS) connectivity among the users with out direct line-of-sight links.Multiple radiosIntegrationMobility2010/10/711NTU OPLab11Motivation12Literature Survey Jamming Attack[4]Jamming sensor networks: attack and defense strategiesW. Xu, et al., Network, IEEE, vol. 20, pp. 41-47, 2006Models of jammers:Constant jammerDeceptive jammerRandom jammerReactive jammerDetection Strategies:PDRCarrier sensing timeSignal strength

2010/10/713NTU OPLab13Literature Survey Countermeasures[2]Using honeynodes for defense against jamming attacks in wireless infrastructure-based networksS. Misra, et al., Computers & Electrical Engineering, vol. 36, pp. 367-382, 2010

Mitigation techniquesChannel SurfingSpatial RetreatsUsing WormholesMapping jammed regionsSpread Spectrum Techniques

2010/10/714NTU OPLab14Literature Survey Countermeasures(cont)The general approaches used for tackling jamming attacks consist of the following steps:Attack detectionAttack mitigationAttack prevention

Using honeynodes to prevent jamming attack from affecting the communication channel:Sending fake traffic on a nearby channel2010/10/715NTU OPLab15Literature Survey Countermeasures(cont)2010/10/716NTU OPLab

2405MHzBase Station2400 MHzHoneynodeJammer 12430 MHzBase StationHopRunJammingJammer 216Literature Survey Countermeasures(cont)2010/10/717NTU OPLab2405 MHzBase Station2400 MHzHoneynodeJammerJamming2425 MHzBase Station2420 MHzHoneynodeJammerJammingRandomScan17Literature Survey Jammer localizationThree challenges of jammer localizationJammers will not comply with localization protocols.[6]Require special infrastructure(e.g. ultrasound, infrared or laser infrastructures).[5-7]Jamming has disturbed network communication.[6]Unable to transmit the localization info out or the jamming area.Should not require extensive communication among network nodes.2010/10/718NTU OPLab18Literature Survey Jammer localization(cont)[5]Lightweight Jammer Localization in Wireless Networks: System Design and ImplementationK. Pelechrinis, et al., Global Telecommunications Conference, 2009. GLOBECOM 2009. IEEE, 2009, pp. 1-6.Simple localization method which relies on PDRDistributed

2010/10/719NTU OPLab19Literature Survey Jammer localization(cont)

2010/10/720NTU OPLab20Literature Survey Jammer localization(cont)[6]Localizing jammers in wireless networksH. Liu, et al., IEEE International Conference on, 2009, pp. 1-6Existing range-free techniquesCentroid Localization(CL)

Weighted Centroid Localization(WCL)

The accuracy of those method is extremely sensitive to node densities.

2010/10/721NTU OPLab

21Literature Survey Jammer localization(cont)Virtual Force Iterative Localization(VFIF)Use CL to perform initial positionRe-estimate the location until the estimated jammers position is closed to the real location

TerminationWhen the jammed region contains all the jammed nodes andall boundary nodes falls out of the region.IterationThe jammed nodes will pull the jammed region toward themselves,while the boundary nodes will push the jammed region away from them2010/10/722NTU OPLab22Literature Survey Jammer localization(cont)

2010/10/723NTU OPLab23Literature Survey Jammer localization(cont)Pull and Push function2010/10/724NTU OPLab

24Literature Survey Jammer localization(cont)

2010/10/725NTU OPLab25Literature Survey Jammer localization(cont)[7]Wireless Jamming Localization by Exploiting Nodes Hearing RangesZ. Liu, et al., Distributed Computing in Sensor Systems. vol. 6131,2010, pp. 348-361

Hearing-range-based localization schemeA jammer may reduce the size of a nodes hearing range2010/10/726NTU OPLab26Literature Survey Jammer localization(cont)The effect of Jamming on the Communication Range2010/10/727NTU OPLab

27Literature Survey Jammer localization(cont)The effect of Jamming on Network Topology2010/10/728NTU OPLab

28Literature Survey Jammer localization(cont)Jammer Localization Algorithm

where is the hearing range of node A

2010/10/729NTU OPLab

29Literature Survey Jammer localization(cont)Estimating the hearing rangeAverage of:The location of the furthest remaining neighbor(lower bound)The location of the nearest lost neighbor(upper bound)

Estimation error between:2010/10/730NTU OPLab

30Literature Survey Jammer localization(cont)The nodes that can contribute to the jamming localization have to satisfy the following requirements:They have a reduced hearing range.The new hearing range under jamming attack can be estimated.They are able to transmit the new hearing range out of the jammed range.2010/10/731NTU OPLab31Problem Description32Problem DescriptionProblemJamming attackEnvironmentInfrastructure/Backbone WMNsRoleAttackerDefender

2010/10/733NTU OPLab33DefenderAttributesNodesBase StationMesh router(with 2 NICs)Mesh clientHoneynode(with 3 NICs)Guard Node2010/10/734NTU OPLab34Defender(cont)AttributesBudgetPlanning phaseNon-deception basedDeception basedDefending phaseLocalizationApproximatePrecise2010/10/735NTU OPLab35Defender(cont)StrategiesPreventing the attacker from obtaining topology information.Distracting the attackerReal-time reaction

2010/10/736NTU OPLab36AttackerAttributesBudgetPreparing phaseMainly small-scale jammersMainly large-scale jammersAttacking phaseCompromising mesh router2010/10/737NTU OPLab37Attacker(cont)StrategiesPreparing phaseNode compromisingDefense resources orientedEasiest to findJammingRange orientedUser number orientedTraffic oriented

2010/10/738NTU OPLab38Scenario2010/10/739NTU OPLab

Base StationMesh routerHoneynodeCompromised mesh routerJammed mesh routerJammerAttacker39

Scenario Defender Strategy 1(Preventing)2010/10/740NTU OPLab

Base StationMesh router

Which mesh router is important?40

Scenario Defender Strategy 1(Preventing)(cont)2010/10/741NTU OPLab

Near Base Station?

Base StationMesh router41Scenario Defender Strategy 1(Preventing)(cont)2010/10/742NTU OPLab

The one with the most users?

Base StationMesh router42

Scenario Defender Strategy 1(Preventing)2010/10/743NTU OPLab

the one with the highest connectivity?

Base StationMesh router43Scenario Defender Strategy 1(Preventing)(cont)2010/10/744NTU OPLab

Or the one with the most traffic?

Base StationMesh router44

Scenario Defender Strategy 2(Distracting)2010/10/745NTU OPLab

Where to distract the jammer?

Base StationMesh router45Scenario Defender Strategy 2(Distracting)(cont)2010/10/746NTU OPLab

Base StationMesh routerHoneynode

The region with the most users?46Scenario Defender Strategy 2(Distracting)(cont)2010/10/747NTU OPLab

Or the region with the most traffic?

Base StationMesh routerHoneynode47

Scenario Defender Strategy 3(Real-time reaction)2010/10/748NTU OPLab

How to localize a jammer?

Base StationMesh routerJammed mesh routerJammer48

Scenario Defender Strategy 3(Real-time reaction) (cont)2010/10/749NTU OPLab

Approximate the jammers location by the change of the range of boundary nodes.

Base StationMesh routerJammed mesh routerJammer49

Scenario Defender Strategy 3(Real-time reaction) (cont)2010/10/750NTU OPLab

Send out a guard node to discover the precise hearing range of boundary nodes

Base StationMesh routerJammed mesh routerJammer

Gotcha!50Scenario Attacker Strategy2010/10/751NTU OPLab

Which mesh router should I compromise?

Base StationMesh routerCompromised mesh routerAttacker51Scenario Attacker Strategy 1(Defense resource oriented)2010/10/752NTU OPLab

Well, must not those who looks strong.

Base StationMesh routerCompromised mesh routerAttacker52Scenario Attacker Strategy 2(Easiest to find)2010/10/753NTU OPLab

Maybe the one with the strongest signal power is a good choice

Base StationMesh routerCompromised mesh routerAttacker53Scenario Attacker Strategy(Jamming)2010/10/754NTU OPLab

Which mesh router should I jam?

Base StationMesh routerCompromised mesh routerAttacker54Scenario Attacker Strategy 3(Range oriented)2010/10/755NTU OPLab

The more the better.

Base StationMesh routerCompromised mesh routerAttackerJammed mesh router55Scenario Attacker Strategy 4(User number oriented)2010/10/756NTU OPLab

Base StationMesh routerCompromised mesh routerAttackerJammed mesh routerReady to meet customers complaints?56Scenario Attacker Strategy 5(Traffic oriented)2010/10/757NTU OPLab

Base StationMesh routerCompromised mesh routerAttackerJammed mesh router

57Scenario Effect of jamming range2010/10/758NTU OPLab

Okay, there are still some boundary nodes.

Base StationMesh routerCompromised mesh routerAttackerJammed mesh router

58Scenario Effect of jamming range2010/10/759NTU OPLabApproximation is impossible. There is no boundary nodes.

Base StationMesh routerCompromised mesh routerAttackerJammed mesh router

59The EndThanks for your attention.2010/10/760NTU OPLab60ReferencesReferences[1]D. J. Thuente and M. Acharya, "Intelligent Jamming in Wireless Networks with Applications to 802.11b and Other Networks " in Proc. of IEEE MILCOM, 2006.[2]S. Misra, et al., "Using honeynodes for defense against jamming attacks in wireless infrastructure-based networks," Computers & Electrical Engineering, vol. 36, pp. 367-382, 2010.[3]I. F. Akyildiz, et al., "Wireless mesh networks: a survey," Computer Networks, vol. 47, pp. 445-487, 2005.[4]W. Xu, et al., "Jamming sensor networks: attack and defense strategies," Network, IEEE, vol. 20, pp. 41-47, 2006.[5]K. Pelechrinis, et al., "Lightweight Jammer Localization in Wireless Networks: System Design and Implementation," in Global Telecommunications Conference, 2009. GLOBECOM 2009. IEEE, 2009, pp. 1-6.[6]H. Liu, et al., "Localizing jammers in wireless networks," in Pervasive Computing and Communications, 2009. PerCom 2009. IEEE International Conference on, 2009, pp. 1-6.[7]Z. Liu, et al., "Wireless Jamming Localization by Exploiting Nodes Hearing Ranges," in Distributed Computing in Sensor Systems. vol. 6131, R. Rajaraman, et al., Eds., ed: Springer Berlin / Heidelberg, 2010, pp. 348-361.

2010/10/762NTU OPLab62