ARES: an Anti-jamming REinforcement System for 802.11 Networks

Konstantinos Pelechrinis, Ioannis Broustis, Srikanth V. Krishnamurthy, Christos Gkantsidis

ACM CoNEXT 2009

Launching DoS Attacks in WiFi networks is easy

2

Launching DoS Attacks in WiFi networks is easy

3

Alice senses medium busy

Launching DoS Attacks in WiFi networks is easy

4

Packet collisions

Launching DoS Attacks in WiFi networks is easy

5

Jammer can be:-Continuous-Intermittent: random or reactive

Xu et al [MobiHoc 2005]

Launching DoS Attacks in WiFi networks is easy

How to deal with jammers?

Frequency hopping ??

Two flavors: (a) Reactive, (b) Proactive

6

Frequency hopping is weak for current systems [WiOpt 2009]:

Only 4 jammers to block entire 5GHz spectrum

Launching DoS Attacks in WiFi networks is easy

7

Can we alleviate jamming effectswithout relying on frequency hopping?

Our Contributions/Findings

• Fixed rates are often preferable in the presence of a jammer Rate adaptation converges slowly

• Clear Channel Assessment (CCA) tuning is important: The transmitter can ignore jamming signals The receiver can latch on the desired signal more easily

• ARES: A measurement driven anti-jamming system which utilizes rate and power control techniques. ARES fights jammer, instead of trying to avoid it

• Testbed evaluations show the potentials of ARES: Up to 3x better performance

8

Roadmap

• Introduction

• Rate Control

• Power Control

• System architecture

• Evaluation

• Conclusions

9

Interaction between random jamming and rate control

10

Jamming effects last beyond the jammingperiod when rate control is used !

Rate Control: Fixed or Variable?

• In general, rate adaptation improves performance under benign condition.

• But, in the presence of an intermittent jammerThe rate control algorithm might be slow to converge to optimum rate

• Remedy: Fixed rate assignments increase immediately throughput

• But, performance depends on channel conditions11

How to decide when to allow rate adaptation and when not?

Deciding when to perform rate adaptation

• With perfect knowledge of: Application data rate Ra

Jammer’s distribution Rate control algorithm used Link quality (e.g., PDR) Effectiveness of jammer (measured via the throughput sustained on the

link)

we can analytically decide between fixed rate and rate control.

12

• Average throughput over a jamming cycle .

TJC

TJC T J Off T J On

Effectiveness of jammerRate control algorithmLink QualityApplication rate

Fixed rate provides high throughput gains

• Throughput gains are indeed viable in practice with fixed rates under the presence of random jamming.

13

Corollary: Use rate control only when the link is very “poor”.

E.g. for Ra=54Mbps, rate adaptation is preferred only if PDR is as low as 0.15 (for sample rate)

Practical algorithm for deciding when to rate control

• However, perfect knowledge is not realistic

• Our Markovian Rate Control (MRC) module is inspired from the analysis but does not require knowledge of any of the parameters.

14

-i = 0- keep track of rate R

- i++

Jamming

In: k

Jam off & i == k

Set rate at R

Jam off & i < k

Jamming

MRC performs well in practice

• Parameter k controls the performance of MRC.

• MRC can be tuned to give performance close to the “optimal”.

15

Roadmap

• Introduction

• Rate Control

• Power Control

• System architecture

• Evaluation

• Conclusions

16

Power Control

• Rate control removes transient jamming effects.• What about constant jamming effects?

Power Control: Power adaptationClear Channel Assessment (CCA) tuning

• Power adaptation helps only when:Transmitter is not in the jammer’s range.When low transmissions rates are used.

• Increasing CCA at the transceivers can restore the benign throughput with high probability.Care for avoiding starvation.

17

Increasing power helps when transmission rate is low

• Observation 1: Probability of accessing the medium does not depend on transmission power.

• Observation 2: Given that a packet is transmitted Power adaptation increases “Signal / Jamming Interference Ratio.” Improvements when low transmission rates are used.

18

Restricted solution. Ideal solution should be agnostic to:

Jammer’s rangeRate used

Dealing with high power jammers

• In the presence of a high power jammer The transmitter needs to be able to ignore jamming signals. The receiver must be able to decode the legitimate packet.

Tuning the transmission power increases the legitimate signal level at the receiver, but not very helpful when the jamming interference is also large enough.

• Observation 3: CCA threshold dictates both transmitting and receiving functionality Transmitter: total energy at the transmitter’s antenna < CCA idle

medium Receiver: signals with energy < CCA noise

Increasing the CCA threshold does NOT increase the SNR at the receiver. It helps the receiver latch on the legitimate signal.

19

Side effects of power control

• Care needs to be taken for possible side effects: Transmitter: unintentionally become a jammer starve other nodes

[Mahtre et al – Infocom 2007] : PCCA = constant

Receiver: blindly increasing CCA legitimate signals regarded as noise Upper bound at CCA value for not ignoring signals of interest

20

Connectivity starts to be compromised ! !

How to perform Power Control?

• Shadow fading variation Δ: Signal levels vary from their average value by ΔdBm.

• RSSIij is the signal level at node j due to the transmission of node i (i,j = T(transmitter), R(receiver) and J(jammer)).

• Heuristic for CCA on the link (CCAL): If max(RSSIJT, RSSIJR) ≤ min(RSSIRT, RSSITR) – Δ

CCAL = min(RSSIRT, RSSITR) – Δ

If max(RSSIJT, RSSIJR) ≤ min(RSSIRT, RSSITR) – 2Δ Link operates as in jamming free environment.

21

ARES: System Design

• ARES performs rate control and power control.• Rate control uses the Markov Rate controller. • Power control sets the CCA value based on the RSSIs and the value

for the shadow fading variation Δ.• Both rate and power control are measurement-driven heuristics.

22

Jammer detectedXu et al

[MobiHoc 2005]

Is CCA tuneable?

Yes

Power Control

Jamming resolved?

Rate Control

No

END

Yes

No

Roadmap

• Problem motivation• Our Contributions/Findings• Background/Related Studies• System Design

Rate Control Measurements Power Control Measurements

• Evaluation• Conclusions

23

Evaluation Setup

• Experimental evaluation on our indoor wireless testbed.

• Hardware used: Intel-2915 with ipw2200 driver/firmware (allows tuning CCA). EMP-8602 6G Ralink RT2860 (support 802.11n)

• Jammer implementation: Utilize Intel cards

CCA 0 dBm User space utility that sends broadcast packets back – to – back

24

Effect of rate control on 802.11n

• Rate Control only• Benchmark results: using analytical assessments • ARES: Improves performance by up to 100%

25

Mobile Jammer

• The jammer (constant) moves to the vicinity of the legitimates nodes, stays there for k seconds and leaves.

• ARES utilizes power control module Increased CCA to overcome the presence of the jammer Rate adaptation module is not of much benefit in this scenario.

• ARES increases throughput by >150%

26

Using rate control to avoid neighbor starvation

• ARES (MRC) improves neighbors’ AP throughput.• Avoid transmissions at lower rates during the sleeping cycles.

Neighbor APs and links have to wait less time to obtain the medium. Improved overall, networked setting performance

• With one neighbor AP (and one jammed) 23% improvement

• Adding more APs reduces the benefits due to increased contention.

27

Roadmap

• Problem motivation• Our Contributions/Findings• Background/Related Studies• System Design

Rate Control Measurements Power Control Measurements

• Evaluation• Conclusions

28

Conclusions

• Fixed rate assignments can be beneficial in jammed environments.

• Power level tuning helps only at low rates and low power jammers.

• Tuning the CCA threshold enables: The transmitter to ignore jamming signals The receiver capture the desired packet(s)

• Evaluations of our measurement driven prototype system shows that rate and power control can efficiently fight against the jammer. Frequency hopping tries to avoid the jammer.

29

THANK YOU !! QUESTIONS?

30