Konstantinos Pelechrinis

Denial of Service Attacks in Wireless Networks: The Case of Jammers

The shared nature of the medium in wireless networks makes it easy for an adversary to launch a Wireless Denial of Service (WDoS) attack. Recent studies, demonstrate that such attacks can be very easily accomplished using off-the-shelf equipment. To give a simple example, a malicious node can continually transmit a radio signal in order to block any legitimate access to the medium and/or interfere with reception. This act is called jamming and the malicious nodes are referred to as jammers. Jamming techniques vary from simple ones based on the continual transmission of interference signals, to more sophisticated attacks that aim at exploiting vulnerabilities of the particular protocol used. In this survey, we present a detailed up-to-date discussion on the jamming attacks recorded in the literature. We also describe various techniques proposed for detecting the presence of jammers. Finally, we survey numerous mechanisms which attempt to protect the network from jamming attacks. We conclude with a summary and by suggesting future directions.

Lightweight Jammer Localization in Wireless Networks: System Design and Implementation

Jamming attacks have become prevalent during the last few years, due to the shared nature and the open access to the wireless medium. Finding the location of a jamming device is of great importance for restoring normal network operations. After detecting the malicious node we want to find its position, in order for further security actions to be taken. Our goal in this paper is the design and implementation of a simple, lightweight and generic localization algorithm. Our scheme is based on the principles of the gradient descent minimization algorithm. The key observation is that the Packet Delivery Ratio (PDR) has lower values as we move closer to the jammer. Hence, the use of a gradient-based scheme, operating on the discrete plane of the network topology, can help locate the jamming device. The contributions of our work are the following: (a) We demonstrate, through analysis and experimentation, the way that the jamming effects propagate through the network in terms of the observed PDR. (b) We design a distributed, lightweight jammer localization system which does not require any modifications to the driver/firmware of commercial NICs. (c) We implement and evaluate our localization system on our 802.11 indoor testbed. An attractive and important feature of our system is that it does not rely on special hardware.

Experimental characterization of 802.11n link quality at high rates

802.11n has made a quantum leap over legacy 802.11 systems by supporting extremely higher transmission rates at the physical layer. In this paper, we ask whether such high rates translate to high quality links in a real deployment. Our experimental investigation in an indoor wireless testbed reveals that the highest transmission rates advertised by the 802.11n standard typically produce losses (or even outages) even in interference-free environments. Such losses become more acute and persist at high SNR values, even at low interference intensity. We find that these problems are partly due to bad configurations that do not allow exploitation of spatial diversity, partly due to the wider 802.11n channels that expose these sensitive high rates to more interference. We show that these problems can be alleviated using the 802.11n MAC layer enhancements jointly with packet size adaptation.

ARES: an anti-jamming reinforcement system for 802.11 networks

Dense, unmanaged 802.11 deployments tempt saboteurs into launching jamming attacks by injecting malicious interference. Nowadays, jammers can be portable devices that transmit intermittently at low power in order to conserve energy. In this paper, we first conduct extensive experiments on an indoor 802.11 network to assess the ability of two physical layer functions, rate adaptation and power control, in mitigating jamming. In the presence of a jammer we find that: (a) the use of popular rate adaptation algorithms can significantly degrade network performance and, (b) appropriate tuning of the carrier sensing threshold allows a transmitter to send packets even when being jammed and enables a receiver capture the desired signal. Based on our findings, we build ARES, an Anti-jamming REinforcement System, which tunes the parameters of rate adaptation and power control to improve the performance in the presence of jammers. ARES ensures that operations under benign conditions are unaffected. To demonstrate the effectiveness and generality of ARES, we evaluate it in three wireless testbeds: (a) an 802.11n WLAN with MIMO nodes, (b) an 802.11a/g mesh network with mobile jammers and (c) an 802.11a WLAN with TCP traffic. We observe that ARES improves the network throughput across all testbeds by up to 150%.

Detecting Selfish Exploitation of Carrier Sensing in 802.11 Networks

Recently, tuning the clear channel assessment (CCA) threshold in conjunction with power control has been considered for improving the performance of Wireless LANs. However, CCA tuning can be exploited by selfish nodes in order to obtain an unfair share of the available bandwidth. In particular, by increasing the CCA threshold, a selfish client can manipulate the carrier sensing mechanism to ignore the presence of other transmissions on the medium; consequently, it increases the probability of accessing the medium and therefore obtains a higher, unfair share of the available bandwidth. In this paper, we propose a novel approach to detect this misbehavior in WLANs. A key insight that leads to our approach is that a misbehaving node that has increased its CCA is unlikely to recognize low power receptions as legitimate packets; by intelligently sending low power probe messages, an AP can detect a misbehaving node with high probability. In a nutshell, our contributions are as follows: (a) We are the first to quantify the impact of selfish CCA tuning via extensive experimentation (b) We propose a novel lightweight scheme for detecting selfish nodes that inappropriately increase their CCA thresholds; we call our scheme CMD (for Carrier sensing Misbehavior Detection) (c) We perform extensive evaluations on an indoor 802.11 WLAN testbed to demonstrate that CMD detects misbehaving users with very high accuracy (approximately 95 % of the time). Furthermore, it only incurs a false positive rate of less than 5 % 1 .

Customized tour recommendations in urban areas

The ever-increasing urbanization coupled with the unprecedented capacity to collect and process large amounts of data have helped to create the vision of intelligent urban environments. One key aspect of such environments is that they allow people to effectively navigate through their city. While GPS technology and route-planning services have undoubtedly helped towards this direction, there is room for improvement in intelligent urban navigation. This vision can be fostered by the proliferation of location-based social networks, such as Foursquare or Path, which record the physical presence of users in different venues through check-ins. This information can then be used to enhance intelligent urban navigation, by generating customized path recommendations for users. In this paper, we focus on the problem of recommending customized tours in urban settings. These tours are generated so that they consider (a) the different types of venues that the user wants to visit, as well as the order in which the user wants to visit them, (b) limitations on the time to be spent or distance to be covered, and (c) the merit of visiting the included venues. We capture these requirements in a generic definition that we refer to as the TourRec problem. We then introduce two instances of the TourRec problem, study their complexity, and propose efficient algorithmic solutions. Our experiments on real data collected from Foursquare demonstrate the efficacy of our algorithms and the practical utility of the reported recommendations.

Downlink capacity of hybrid cellular ad hoc networks

Augmenting cellular networks with shorter multihop wireless links that carry traffic to/from a base station can be expected to facilitate higher rates and improved spatial reuse, therefore potentially yielding increased wireless capacity. The resulting network is referred to as a hybrid network. However, while this approach can result in shorter range higher rate links and improved spatial reuse, which together favor a capacity increase, it relies on multihop forwarding, which is detrimental to the overall capacity. In this paper, our objective is to evaluate the impact of these conflicting factors on the overall capacity of the hybrid network. We formally define the capacity of the network as the maximum possible downlink throughput under the constraint of max-min fairness. We analytically compute the capacity of both one- and two-dimensional hybrid networks with regular placement of base stations and users. While almost no capacity benefits are possible with linear networks due to poor spatial reuse, significant capacity improvements with two-dimensional networks are possible in certain parametric regimes. Our simulations also demonstrate that in both cases, if the users are placed randomly, the behavioral results are similar to those with regular placement of users.

VICO: A framework for configuring indoor visible light communication networks

Visible light communications (VLC) are gaining popularity and may provide an alternative means of communications in indoor settings. However, to date, there is very little research on the deployment or higher layer protocol design for VLC. In this paper, we first perform channel measurements using a physical layer testbed in the visible light band to understand its physical layer characteristics. Our measurements suggest that in order to increase data rates with VLC (1) the beam width of a communicating link can be shrunk, and (2) the transmission beam can be tuned to point towards the target recipient. We then perform Matlab simulations to verify that the human eye is able to accommodate the changes brought by shrinking a beam or by tuning the beam direction appropriately. As our main contribution, we then design a configuration framework for a VLC indoor local area network, which we call VICO; we leverage the above features towards achieving the highest throughput while maintaining fairness. VICO first tunes the beamwidths and pointing angles of the transmitters to configurations that provide the highest throughput for each client. It then tries to schedule transmissions while accounting for conflicts and the VLC PHY characteristics. Finally, it opportunistically tunes the idle LEDs to reinforce existing transmissions to increase throughput to the extent possible. We perform extensive simulations to demonstrate the effectiveness of VICO. We find that VICO provides as much as 5-fold increase in throughput compared to a simple scheduler that does not exploit the possible variations in beamwidth or beam-angle.

Auto-configuration of 802.11n WLANs

Channel Bonding (CB) combines two adjacent frequency bands to form a new, wider band to facilitate high data rate transmissions in MIMO-based 802.11n networks. However, the use of a wider band with CB can exacerbate interference effects. Furthermore, CB does not always provide benefits in interference-free settings, and can even degrade performance in some cases. We conduct an in-depth, experimental study to understand the implications of CB. Based on this study we design an auto-configuration framework, ACORN, for enterprise 802.11n WLANs. ACORN integrates the functions of user association and channel allocation, since our study reveals that they are tightly coupled when CB is used. We show that the channel allocation problem with the constraints of CB is NP-complete. Thus, ACORN uses an algorithm that provides a worst case approximation ratio of [EQUATION] with Δ being the maximum node degree in the network. We implement ACORN on our 802.11n testbed. Our experiments show that ACORN (i) outperforms previous approaches that are agnostic to CB constraints; it provides per-AP throughput gains from 1.5x to 6x and (ii) in practice, its channel allocation module achieves an approximation ratio much better than [EQUATION].

Gaming the jammer: Is frequency hopping effective?

Frequency hopping has been the most popularly considered approach for alleviating the effects of jamming attacks. In this paper, we provide a novel, measurement-driven, game theoretic framework that captures the interactions between a communication link and an adversarial jammer, possibly with multiple jamming devices, in a wireless network employing frequency hopping (FH). The framework can be used to quantify the efficacy of FH as a jamming countermeasure. Our model accounts for two important factors that affect the aforementioned interactions: (a) the number of orthogonal channels available for use and (b) the frequency separation between these orthogonal bands. If the latter is small, then the energy spill over between two adjacent channels (considered orthogonal) is high; as a result a jammer on an orthogonal band that is adjacent to that used by a legitimate communication, can be extremely effective. We account for both these factors and using our framework we provide bounds on the performance of proactive frequency hopping in alleviating the impact of a jammer. The main contributions of our work are: (a) Construction of a measurement driven game theoretic framework which models the interactions between a jammer and a communication link that employ FH. (b) Extensive experimentation on our indoor testbed in order to quantify the impact of a jammer in a 802.11a/g network. (c) Application of our framework to quantify the efficacy of proactive FH across a variety of 802.11 network configurations. (d) Formal derivation of the optimal strategies for both the link and the jammer in 802.11 networks. Our results demonstrate that frequency hopping is largely inadequate in coping with jamming attacks in current 802.11 networks. In particular, we show that if current systems were to support hundreds of additional channels, FH would form a robust jamming countermeasure1.