An Assessment of Security Mechanisms Against Reactive Jammer Attack In Wireless Sensor Networks

International Journal in Foundations of Computer Science & Technology (IJFCST), Vol. 3, No.3, May 2013
DOI:10.5121/ijfcst.2013.3303 31
An Assessment of Security Mechanisms Against
Reactive Jammer Attack In Wireless Sensor
Networks
Ramya Shivanagu1
, Deepti C2
1
M.Tech Student, Department of Information Science Engineering
The Oxford College of Engineering, Bangalore, India
ramya.shivanagu@gmail.com
2
Asst Professor Department of Information Science Engineering
The Oxford College of Engineering, Bangalore, India
deeptic82@gmail.com
ABSTRACT
Wireless sensor networks have been widely applied to various domains such as environmental monitoring
and surveillance. Since wireless sensor networks utilize open transmission media, they are prone to radio
jamming attacks. These attacks are easy to launch but difficult to defend. These attacks may lead to low
network throughput because of jamming signals. Failure of data transmission in sensor networks is due to
corruption of packets by reactive jammers. A number of defence techniques have been proposed in recent
years to deal with these jammer attacks. However, each defence technique is suitable for only a limited
network range and specific jamming conditions. This paper proposes an adaptive approach to detect and
isolate the reactive jammers by using status messages and trigger identification service.
KEYWORDS
Wireless Sensor Networks, Jamming types, Reactive Jammer, Jamming Detection, Jamming Isolation
1. INTRODUCTION
Wireless sensor networks consists of low-cost, low-power and multifunctional sensor nodes that
work together to sense the surrounding environment. Some sensors have a capability to perform
data processing. Due to the instructive nature of WSNs, they are exposed to many attacks like
Wormhole attack[1], Sybil attack[2], Black-hole attack[3] and Jamming attack[4]etc. As wireless
signals travel through shared medium, an adversary can inject false messages or emit radio
frequency (RF) signals in order to prevent authenticated wireless devices from communicating
with each other.

32
1.1. Different Jamming Attacks
Fig 1: Types of Jammers
Figure 1 shows several types of jammers namely constant jammer, deceptive jammer, random
jammer, reactive jammer. The constant jammer [5] emits unwanted radio signals to the wireless
medium. This jammer keeps the channel busy preventing valid nodes from communicating with
each other. The deceptive jammer [6] uses misleading jamming techniques to attack the wireless
sensor nodes. The random jammer [7] is inactive state for an arbitrary time and make itself active
to jam the network for an arbitrary time. The reactive jammer [8] listens for on-going activity on
the channel if so it will send unwanted data to its neighbouring nodes otherwise it will be in sleep
mode.
1.2. Characteristics of Reactive Jammer Model
The reactive jammer wakes up only when there is an on-going transmission on the channel
otherwise it remains in sleep mode. The reactive jamming happens in such a way that the WSN's
are not immediately aware of it. The WSN might detect failure of communication easily but
detection of jammer attack is complicated.
1.3. Reactive Jamming
Fig 2: The reactive jamming

33
Reactive jamming attacks are considered one of the most intelligent jamming strategies. The
reactive jamming attack in figure 2 is one such DoS security threat in which a malicious node
(jammer) quietly scans all the available channels in a wireless network to sense any activity. If a
signal is detected from a legitimate node on any channel, the reactive jammer starts injecting
noise on that channel in order to interfere with all the receivers in its range. This results in a
drastic decrease in the signal to noise ratio and drop in the communication throughput of the
network.
2. IMPLEMENTATION APPROACH
2.1. Network Model and Jammer Model
The wireless sensor network have n sensor nodes with a base station (depends on the size of the
network).Each sensor node has omni-directional antennas with limited energy, memory storage
and computational capabilities along with r radios that adds up to a total of k channels throughout
the network, where k>r. The reactive jammer nodes can sense an ongoing transmission on the
network to decide whether to launch a bad signal or not depending on the power of the sensor
signal. Here an internal attacker model is used, in which the malicious nodes send unwanted data
to its neighboring and wants to participate in the network activities. This selfish nodes decreases
the network throughput by corrupting the valid packet.
2.2. Sensor model
Fig 3: Categorization of Sensor Nodes
Based on jamming status, the sensor nodes made into four types as shown in Figure 3.Trigger
Node TN is a sensor node which makes the jammer to awakes, victim nodes VN are sensor nodes
within the range R of jammer, boundary nodes BN and unaffected nodes are free from the
jammers.
3. VARIOUS DETECTION METHODS FOR REACTIVE JAMMING
3.1. Transmitter-Based Detection
Different detection approaches of reactive jamming exist. For example , a network node A
sending a signal to node B is considered. To apply the decision algorithm [9] the transmitter has
to determine the following three metrics,

34
a)PDR (Packet Delivery Ratio): Traditional approaches for the detection of jamming in wireless
sensor networks use the packet delivery-ratio (PDR) and the received ambient signal strength as
the main decision criteria. Jamming is detected as soon as the (averaged) PDR exceeds a pre-
defined threshold. Although these approaches are well-suited for the detection of proactive (long-
term) jamming, they are not sufficient for protection against targeted reactive jamming. At the
transmitter side, the PDR can be calculated by how many acknowledgements it receives and total
number of ACK received.
PDR sender= Total number of ACK received by sender
----------------------------------------------------
ACK sent by the receiver
b)RSSI (Received Signal Strength Indication): In wireless sensor networks, received signal
strength indicator compares the signal level with the threshold value which is defined previously.
c) Noise: Detection of jamming signal will possible by calculating Signal-to-noise ratio on the
network, this is applicable only to pro-active jammers.
SNR= Signal power
------------------
Noise power
3.2. Receiver-Based Detection
The main difference between receiver-based and transmitter-based detection lies in the
computation of the PDR. Although in transmitter based detection, the transmitter knows the exact
number of data frames sent. This information is not known a priori at the receiver since several
frames might get lost during transmission. Therefore, it is necessary that the data frames contain
additional information which enables the receiver to determine the total number of sent frames.
This can be achieved by adding a sequence number to every single data frame.
PDR receiver= Packet passed CCR
--------------------------
Received packet
3.3. Dedicated Detection
In case of dedicated detection, the RSSI and PHY rate are read from the acknowledgement frames
arriving from the receiver, i.e. node B. The noise level is taken from arbitrary frames arriving at
the monitor. Based on the gathered statistics over several ACK frames, the monitor then applies
the decision algorithm. Finally, the node responsible for jamming detection announces his
decision to the other participating nodes in a broadcast frame. This broadcasting is then repeated
whenever the decision changes in future.
3.4. Cooperative Detection
This detection scheme is the combination of all the previous three strategies. In this case, the
technique is to share all the information at all nodes with each other and to make a decision based
on this broader view. This means that every participating node in the ad hoc network gathers its
own information, independently using any of the above techniques and shares the data with its
neighbours.

35
3.5. Proposed Algorithm for Efficient Detection
Fig 3: Simple Status Report Message
For detecting the reactive jammers, every sensor node periodically sends a control details
message to the base station. There is a possibility that jammers may be activated during this
period . Because of this event occurred on the network, the victim nodes will not send the control
message to the base station based on this the base station can decide whether reactive jamming
attack has occurred in the network or not by comparing the received report messages to a per-
stored threshold. When the status report message is generated by each sensor node, they can
locally obtain their jamming status to determine the value of the label field. If the sensor node
hears the jamming signals, it will not send the messages to base station, but will initialise the
label as Victim. On the other hand, if the sensor node cannot sense jamming signals, its report
will be sent to the base station as normally expected. However, the sensor node is labelled as
boundary node in its status report if it does not receive the ACK from its neighbour node on the
next hop of the route within a time out period. It retries for two more retransmissions.
If the status report is successfully delivered to the base station with label Boundary Node, the
corresponding node is regarded as unaffected. All the messages are queued in the buffer of the
intermediate nodes and forwarded in an FCFS manner. The TTL value is reduced by 1 per hop for
each message, and the message will be dropped once its TTL = 0. The base station waits for the
status report from each node in a period of length P. If no reports have been received from a node
v with a maximum delay time, then v will be regarded as victim.
4. DIFFERENT APPROACHES FOR ISOLATING THE REACTIVE
JAMMER
4.1. Avoidance Techniques
4.1.1. Channel Hopping
When jammed, communicating nodes hop on to a new channel independently and try to get
synchronized with other participants. However, when any node is unable to communicate for a
certain period of time, it starts listening on other channels in order to sense whether its
neighbouring nodes have hopped on due to jamming or not. Another technique worth mentioning
in this regard that provides urgent and robust response to the jamming attack is known as
MULEPRO(MULti channel Exfiltration Protocol [11]). It is designed to quickly exfiltrate the
sensed data from jammed region to the area which is currently in the jammed area. This technique
is suitable for many types of network applications like perimeter and infrastructure defence
system, homeland security systems, battlefield sensing systems etc.

36
4.1.2. Spatial Retreat
Spatial retreat is a mechanism to physically evade the jammed area. The rationale behind this
strategy is that all nodes try to estimate the jammed region based on the detection algorithm and
flee physically to a safer place. Based on their estimation about the jammed region, nodes
independently opt for shortest path to avoid being jammed and move accordingly.
i. Jammed Area Mapping (JAM)
This mechanism employs scattered approach to draw the jammed area so communication with
that part of the network node can be avoided during specification of routes . Once, legitimate
nodes are out of the jammed region, they try to relocate to unaffected areas and hence, may
change their direction and speed according to the predefined algorithm [12].
ii. Node Escape
This technique is for the physical escape of the node from the jamming location. The Main
requirement is to move away from the jammed area and periodically sense the medium if it has
become interference free. This procedure is repeated till node reaches to an unaffected location
[13].
4.2. Other Techniques
Another strategy targets prediction of nodes which are about to be jammed and hence should be
removed from routing in a wireless network. This strategy uses LEACH[14] as its base routing
protocol and uses JAM for predictive determination of jamming holes.
DEEJAM [15] protocol is an amalgamation of frame masking, channel hopping, packet
fragmentation and redundant encoding in order to avoid all four types of jamming classes.
DEEJAM is effective in reducing pulse jam attack. However the extra computational overhead in
these approaches is unresolved. Swarm intelligence is yet another strategy finding its popularity
in field of wireless routing. One such Swarm based methodology is simulation of ants behaviour
in path translation to a food source. This method is very effective and energy efficient as it is
based on a natural process of pheromone laying to determine optimum routes. However
implementation details of this process are pretty complex, as volatility of this process and
intelligent learning is little difficult to model.
4.3. Proposed Algorithms for Isolating the Reactive Jammer
This paper proposes a fresh implementation move towards defence of the network against
reactive jamming attack i.e. trigger identification service. This approach attempts to reduce the
transmission overhead as well as the time complexity. The advantage that this approach seeks to
achieve is the elimination of additional hardware .The requirement of the mechanism is to send
simple status report messages from each sensor and the information regarding the geographic
locations of all sensors maintained at the base station. The identification of the trigger nodes can
help to design a better routing protocol by making these nodes only receivers to avoid the
reactive jammers. In this work, an isolation of reactive jammers can be done by identifying the
trigger nodes through the group testing technique.

37
Fig 4: Overall Operation of the Proposed Algorithm
The Figure4 shows overall operation of the proposed algorithm for reactive jamming attack. The
set of sufferer nodes is first identified and grouped into several testing teams. Once the group
testing is made at the base station testing procedure is executed locally to identify the node as a
trigger or non trigger. The identification outcomes can be stored locally for routing schemes or
can be sent to base station for jamming localization process.
4.3.1. Trigger Detection By Using Group Testing
To find all trigger nodes in the network, the sensor nodes need to broadcast one by one and listen
to the feasible jamming signal. But this individual detection method increases the time
complexity for the detection in a large pool of victim nodes. this method may return wrong
detection values in the presence of mobile jammers. In this case, the network throughput would
be significantly decreased. Therefore, to precisely find out these triggers from a large pool of
victim nodes is the most challenging part of the proposed protocol, for which the idea of group
testing can be applied. The reactive jammers immediately broadcast jamming signals once it
senses the sensor signal. Here the assumption made is that, at least one of the broadcasting
wounded nodes is a trigger, which will sense part of the jamming signals, and vice versa.
Fig 5: Flow of the Group Testing
The encrypted testing schedule is executed over all the victim nodes after it has been designed at
the base station based on the set of boundary nodes and stored as a message (shown in Table 1)
which is broadcasted to all the boundary nodes. The broadcasting of the testing schedule message
adopts a routing mechanism similar to reverse path forwarding as shown in Figure 5. All the
status report messages relayed to the base station will record all the nodes’ IDs on their routing
paths.

38
TABLE 1 Message Containing Trigger Detection schedule
Time Slot Channel Node List
0 F1 V1,V3,........Vn
'
'
0 Fm V2,V5,.......Vn
1 F1 V2,V4,......Vn-2
'
'
After receiving this message from base station, each boundary node broadcasts this message
using simple flooding method to its nearby jammed area. All the victim nodes execute the testing
schedule and designate themselves as nontriggers or triggers. Table 1 shows that in each time slot
t, v sets of victim sensors can be tested. The selection of these sets involves a two-level grouping
procedure.
First-level, the entire set of victims are divided into several interference-free testing groups. Here,
interference free means that the transmissions of the victim nodes in one testing group should not
interfere with the other victim node transmission cited in a different testing group. Therefore, by
attempting broadcast from victim nodes in each testing group and monitoring the jamming signals
it can be concluded that any members in this group are triggers. In addition, all the tests schedule
messages can be executed by all victim nodes simultaneously without interference from each
other.
Second-level, within each testing team, victim nodes are further divided into multiple testing
groups. This is can be done by creating a randomized disjunction matrix[16] mapping, where
each column is a sensor node and each matrix row is a testing group. This work proves that all the
testing teams are interference free, then the testing with different teams can be executed
simultaneously. Message complexity will be reduced by considering information of boundary and
victim nodes as input.
5. SIMULATION RESULT
The simulation result shows the performance evaluation of end-to-end delay and throughput of
the network. Preventing reactive jammers by trigger identification service is simulated using
network simulator NS2 on 900×900 square filed with n=10 sensor nodes. Each sensor node has to
send control information to the base station periodically for every five seconds, this makes the
reactive jammer to wake up and start sending random signal to its neighbouring nodes. Reactive
jammer is selected randomly for the purpose of simulation from a large set of sensor nodes. Due
to this, victim nodes won't send control information to the base station. After that base station
calculates the jammed area and the reactive jammer on the network based on boundary node and
global topology status. Isolation is done by identifying the trigger node in a large set of victim
nodes. The victim node broadcast control information to identify that it has been jammed through
labelling themselves as trigger node. Trigger nodes are then configured as only receiver so that
jammer do not wake up.
5.1. End- to -End Delay
The end-to-end delay is defined as difference between the time at which the packet is received the
base station minus the actual time at which the packet is sent. End-to-End delay shown in the
Figure 6, as the number of nodes increases, delay is not gradually increased.

39
Fig 6: End-to-End delay
5.2. Throughput
The throughput(unit of throughput is Mbps) of the network is shown in Figure 7 with varying
number of nodes. The simulation results illustrate that when the number of sensor nodes
increases the better throughput is achieved.
Fig 7: Throughput
6. CONCLUSION
In this paper, a trigger identification service for reactive jamming attack in wireless sensor
network is simulated to achieve minimum end-to-end delay and to increase the throughput of the
network. It has been shown that delay is reduced by using group testing method. Trigger
identification requires all testing groups to schedule the detection algorithm and after that
performed group testing for isolating reactive jammers. Furthermore, investigation into more
stealthy and energy efficient jamming models with simulations indicates robustness of the present
proposed scheme.

40
REFERENCES
[1] “Protocols For Detection And Removal Of Wormholes For Secure Routing And Neighbourhood
Creation In Wireless Ad Hoc Networks By Thaier Saleh Hayajneh Bsc Ee , Jordan University of
Science & Technology , 1997 MS ECE , Jordan University of Science & Technology,” 2009.
[2] Stetsko, L. Folkman, and V. Matyas, “Neighbor-Based Intrusion Detection for Wireless Sensor
Networks,” 2010 6th International Conference on Wireless and Mobile Communications, no. May,
pp. 420–425, Sep. 2010.
[3] H. Jadidoleslamy, “a comparison of physical attacks on,” vol. 2, no. 2, pp. 24–42, 2011.
[4] J. R. S. S and d. Thilagavathy, “security threats and jamming attacks of multi channel wireless,” vol.
2, pp. 27–31, 2012.
[5] W. Xu et al., “Channel Surfing and Spatial Retreats: Defenses Against Wireless Denial of Service,”
Proc. 2004 ACM Wksp. Wireless Security, 2004, pp. 80–89.
[6] W. Xu et al., “The Feasibility of Launching and Detecting Jamming Attacks in Wireless Networks,”
mobihoc ’05: Proc. 6th ACM Int’l. Symp. Mobile Ad Hoc Net. And Comp., 2005, pp. 46–57.
[7] Y. Law et al., “Link-Layer Jamming Attacks on S-Mac,” Proc. 2nd Euro. Wksp. Wireless Sensor
Networks, 2005, pp. 217–25.
[8] Wood and J. Stankovic, “Denial of Service in Sensor Networks,” IEEE Comp., vol. 35, no. 10, Oct.
2002, pp. 54–62.
[9] T. Sandholm, “Terminating Decision Algorithms Optimally.”,2012
[10] S. Sodagari and T. C. Clancy, “An Anti-Jamming Strategy for Channel Access in Cognitive Radio
Networks.”, 2010
[11] S. Khattab, D. Mosse, and R. Melhem, “Modeling of the Channel-Hopping Anti-Jamming Defense in
Multi-Radio Wireless Networks,” Proceedings of the 5th International ICST Conference on Mobile
and Ubiquitous Systems: Computing, Networking and Services, 2008.
[12] W. Xu, W. Trappe, Y. Zhang, and T. Wood, “The feasibility of launching and detecting jamming
attacks in wireless networks,” Proceedings of the 6th ACM international symposium on Mobile ad
hoc networking and computing - MobiHoc ’05, p. 46, 2005.
[13] B. Y. W. Xu, “Defending Wireless Networks From Radio Interference Attacks Defending Wireless
Networks From Radio Interference Attacks,” 2007.
[14] E. Campus and N. Tebal, “Reed Solomon Coding for Frequency Hopping Spread Spectrum in
Jamming Environment Othman Sidek and Abid Yahya Collaborative MicroElectronic Design
Excellence Center,” vol. 5, no. 10, pp. 1281–1284, 2008.
[15] I. W. Networks, A. D. Wood, J. A. Stankovic, and G. Zhou, “DEEJAM : Defeating Energy-Efficient
Jamming in.”
[16] Y. Xuan, Y. Shen, I. Shin, and M. T. Thai, “A Graph-theoretic Framework for Identifying Trigger
Nodes against,” vol. 6, no. 1, pp. 1–14, 2007.
[17] T. V. Project, U. C. Berkeley, X. Parc, K. Fall, and E. K. Varadhan, “The ns Manual (formerly ns
Notes and Documentation) 1,” no. 3, 2009.
Authors
Miss Ramya Shivanagu received her Bachelor of Engineering in Information
Science and Engineering in 2010. Currently She is a M.Tech student in Computer
Networking Engineering from Visvesvaraya Technological University at The
Oxford Collage of Engineering, Bangalore. Her research interests are wireless
sensor networks and Network Security.
Mrs Deepti C received her Bachelor of Engineering in Electronics and
Communication in 2004. She received her M.Tech in Computer Network
Engineering with distinction from Visvesvaraya Technological University in
2009.She is a PhD student in Electronics and Communication Engineering at
Christ University, Bangalore. Currently she also holds a faculty position as
Assistant Professor, Department of ISE, The Oxford College of Engineering. Her
main research interests are signal processing, wireless sensor networks and
wireless network security.

An Assessment of Security Mechanisms Against Reactive Jammer Attack In Wireless Sensor Networks

More Related Content

What's hot (20)

Viewers also liked (15)

Similar to An Assessment of Security Mechanisms Against Reactive Jammer Attack In Wireless Sensor Networks (20)

More from ijfcstjournal (20)

Recently uploaded (20)

An Assessment of Security Mechanisms Against Reactive Jammer Attack In Wireless Sensor Networks