MAC Layer Attacks in Wireless Sensor Networks (a simple case)

Introduction

Wireless jamming have been studied for many years. Particularly, there is an extensive early work focused on 802.11 networks, just to name a few [1]-[3], since these are still the most common wireless networks. However, and more recently, wireless sensor networks will dominate the wireless networks, because, of the emergence of Internet Of Things (IoT). The IoT is expected to connect every device the Internet. The emergence of Wireless Sensor Networks (WSN) have opened many opportunities in the areas of machine-to-machine (M2M)[4],[5]. The nature of wireless communications and its expected extensive deployment, makes such networks vulnerable to jamming attacks. Jamming attacks are characterized by a malicious node sending a burst of strong signal, with the sole intent of destroying legitimate traffic that transits a network [6]. The impact of such an attacks are severe:

• they affect routing paths, causing network reliability to drop;

• jamming also increase the energy consumption in the network, because a node not receiving any ACK from the medium access control would continuously sending a packet.

Such attacks are perhaps easier to detect on Wi-Fi networks since the location of the access points are well knows, and normally cover smaller networks. In WSN, the scale of the problem is larger. WSN are in many cases deployed into factories, wildness and streets to monitor vital information of the environment or an industrial process. Therefore, it is important to study the effects of jamming on such networks.

In recent years, much attention have been devoted to research in energy-efficient communications. Many efficient medium access control (MAC) prototypes have been proposed [7]-[11]. However, little attention was given to the issues related to the deployment and operating wireless sensor networks. With large scale deployments envisioned in the future, new challenges arise.

Goals

In this work we consider a simple example of data jamming in WSN. The adversary (illegitimate node) also runs the same MAC and routing protocol as the legitimate nodes. We depart from previous approaches, because we do not use selective jamming [6], since we consider it energy-wasteful. The need to decode and analyze packets as it done for example in [6], it is a bad idea in WSN. Because, in networks such as WSN, energy conservation is a key aspect. We, therefore, address the case where the the jammer is only interested in disrupting network activity.

Contributions

In this project we address the effects of jamming attacks on multihop wireless sensor networks. More specifically, we consider the effects of jamming on end-to-end packet latency, and on energy consumption of nodes that are part of the routing paths. To this end, we make the following contributions:

• First we design, and implement a small scenario for jamming attacks in wireless sensor networks.

• Secondly, we analyze and evaluate the impact of jamming attacks on the end-to-end delay, and network reliability.

Problem formulation and models

This section addresses the problem formulation and describes the models we use.

Figure 1: Network scenario topology under study. One data packet source node is communicating via wireless with the destination (sink node ). A Collection Tree routed at the sink is used to route the packets through intermediate nodes. With the full knowledge of the communication protocols used in the network, two intruder nodes are able to be part of that routing three (nodes and ). With probability the intruders behave as jammers, while with the remaining probability they behave as legitimate nodes.

Problem formulation

We consider a network in Figure 1. The sink node and the source node communicate over a wireless sensor network. Two jammer nodes are part of the same wireless network posing as legitimate nodes. These jammers are also part of the routing tree. To save energy, both nodes do not use any packet classification. To hide their activities as well as to save energy, jammer nodes use jamming probability (probability of jamming) to send a train of packets (jamming signal). We are interested in analyzing the effect of jamming into the end to end packet delay. In our example, the attacker does not use a special hardware, it is made of the same hardware as the legitimate nodes. The effectiveness of the attack comes from the fact that the attacker have full knowledge of the implementation and the internal workings of the communication protocols.

Network model

We consider a network of wireless capable nodes, that communicate over wireless. At boot up, nodes form a Collection tree to route packets to the sink. The tree is formed using an open-stack and well-known implemented version of the Collection Tree Protocol (CTP) [12]. While the routing metric is the expected transmission count (ETX) [13]. Since packets traverse many hops to reach destinations, any disruption in one of the routing nodes, causes an increase into the end to end packet delay. For simplicity, we consider that packets are not encrypted, or intruder nodes have no intention of modifying the contents of a packet. Instead, they are interested in disrupting the network.

Apart from the source node, intermediate nodes do not generate data packets. However, they generate routing information packets needed to update the network topology. Although the model we present here is very simple, we restrict ourselves to a single data traffic source. Because, it gives a good insight into the problem under study, since a more complicated model can be derived from this model. On the other hand, it is hard to analyze the effect of jamming if the packets are coming from multiple sources.

Adversary model

In our model, the adversary have a full knowledge of the network, MAC and the routing protocols, since those protocols are open-source [7], [12], [14], [15]. Therefore, the adversary is also able to be part of the routing tree. To avoid detection, the adversary does not modify any packets. To jam packets, the adversary uses a probabilistic approach: With probability the adversaries behave as illegitimate nodes, and consequently send a variable burst of jamming packets. While with probability they behave as legitimate nodes. For our evaluations, the size of the burst varies between 30 and 35 packets, and each packet is 127 bytes (the maximum packet size allowed in IEEE 802.15.4 networks).

Impact and effectiveness of jamming attacks

Impact of jamming attacks

1. On packet end-to-end latency: The presence of a burst of packets on the medium (air) not addressed to any of the legitimate nodes, causes these nodes to back off and return into the inactive mode. The presence of many adversary nodes, when they jam the medium one after the other, renders the medium unusable for long periods of time. Any legitimate traffic traversing the network will suffer long queuing delays at the intermediate nodes. As a result the end-to-end latency of such traffic increases dramatically.

1. On energy consumption: Now lets briefly change our focus on energy-consumption. Jamming attacks increase the the energy-consumption 16. Consider a simple example as a unicast packet on the transmission buffer of a legitimate node. Such a node will attempt to deliver that packet to the next hop. Now consider that a node makes a CCA and the channel is considered clear, however, when attempting to send that packet (CCA time packet transmission time) it always collides. After the maximum number of attempts per path, that node will try to select another path to forward that packet. This is exactly the effect of having and in the network. The conclusion is that nodes that are part of the routing path whose transmitted packets are jammed will have their energy budget increased.

Effectiveness of Jamming Attacks

1. Single node jammer (ineffective): Throughout our experimental evaluation, we observed that probabilistic jamming with a single jammer is not effective. Common techniques such as CCA, transmission phase-lock are enough to smooth the effects of presence of a jammer in the network. In figure 2 it shows our network scenario in operation. The upper corner shows the network topology. The network routing tree is visible, and node 4 routes its packets through nodes 8, 7 and finally 1. The upper center display shows the network output for debugging purposes only.’ The lower display it shows the timeline.

Figure 2: The timeline shows the actual network operation with active and inactive periods shown (radio ON/OFF). It also displays the clear channel assessment (CCA appears as a short radio activation). The blue rectangles are packet transmissions, while the green rectangles are packet receptions. The red rectangles are collisions or interfered packets.

1. Two or more jammer nodes (effective): In this case, we illustrate the case where jamming completely disrupts all traffic in the network. The two jammer nodes activate one after another bringing all network traffic to halt. In the figure 3 after node 2 has finished jamming node 4 attempts to transmit a packet using the last known best path (). However, node 5 have no valid path to forward the packet, and it returns it to node 4. Node 4 detects a routing loop, and tries fast path discovery. Another jammer node (node 2) enters into activity which causes node 4 to waste energy before giving up. This case captures effective jamming, because not only data traffic but routing paths become inconsistent due to jamming.

Results

Evaluation scenario desription

In Figure 1 node 4 has a data rate of one packet a second. Intermediate nodes do not generate any data traffic, only routing related traffic. At the destination (node 1) we record the average throughout, the packet end-to-end latency. Depending on the activity of the intermediate nodes, we are able to analyze the network in real time. Each jammer contains a task that is activated probabilistically. We vary the jamming probability from 0 (no jamming) to 0.7 (total disruption). However, since all jammers are battery powered, using a larger jamming probability would increase their energy consumption, limiting the duration of the attacks to some hours.

Network throughput

We measure the network throughput in snapshots of 10 seconds. This way we were able to capture instants of time when the jammers disrupt the network. In Figure 4 we show such network output using different jamming probabilities. The x − axis is the elapsed time, while the y − axis is the network through in a snapshot of 10 seconds.

Figure 4. We measure the network throughput in snapshots of 10 seconds.

Packet end-to-end latency

This result is very important for network design, since it provides insights of the expected packet end-to-end latencies. A designer of control applications over wireless, could for example use these results to set an optimal sampling period when the network is under attack (see for example Figure 6). In Figure 5 each packet contains a time-stamp which records the time it was generated, and the time it was received at the destination. This information allowed us to compute the end to end latency for each packet. Because, intermediate nodes were configured to not discard packets.

Figure 5. End-to-end latency due to jamming attacks

Figure 6. CDF of the end-to-end latency due to jamming attacks

Conclusion and final remarks

Final remarks

The results demonstrated the main weakness of single channel MAC layer protocol. They give a compeling case, why channel hopping is more resilient against only to fight interference and channel fading, but it is also an effective measure against jamming attacks.

References