Advisor: Professor Frank Y.S. Lin Present by J.W. Wang

1. Using honeynodes for defense against jamming attacks in wireless infrastructure-based networks Sudip Misra, Sanjay K. Dhurandher, Avanish Rayankula, Deepansh Agrawal Advisor: Professor Frank Y.S. Lin Present by J.W. Wang

2. NTU OPLab About this paper • Authors: Sudip Misra, Sanjay K. Dhurandher, Avanish Rayankula, Deepansh Agrawal • Title: Using honeynodes for defense against jamming attacks in wireless infrastructure-based networks, • Provenance: Computers & Electrical Engineering, Volume 36, Issue 2, March 2010, Pages 367-382,

3. NTU OPLab Agenda • Introduction • Existing techniques • Proposed solution • Simulation • Conclusions • Comments

4. Introduction

5. NTU OPLab Introduction • New medium, new attack • Jamming • Blocking of a communication channel • A subclass of the Denial-of-Service(DoS) attacks • One of the most feared forms of attacks in wireless networks

6. NTU OPLab Introduction(cont’) • Research topic: • Mitigation • Prevention • Categories of wireless network: • Wireless infrastructure-based networks(i.e., WLANs and cellular networks) • Infrastructure-less networks(i.e., ad hoc networks).

7. NTU OPLab Wireless infrastructure-based networks • Components: • Base-stations(or access points) • Mobile nodes • This work is restricted to jamming attacks in wireless infrastructure-based networks.

8. NTU OPLab Objective of this work • Propose an efficient algorithm to mitigate jamming attacks in wireless infrastructure-based networks. • Provide an efficient solution that can be easily incorporated in the existing network architecture • Achieve better robustness than the widely used Channel Surfing Algorithm by using honeynodes along with dynamic channel prediction in wireless infrastructure networks

9. NTU OPLab Jamming-based DoS attacks • Prevent networked nodes from communicating. • Carry out with a “jammer” • Classifications of jamming attacks: • Physical layer jamming • By ignoring MAC layer rules

10. NTU OPLab Jamming methods • Constant: Continuously sends random bits of data onto a channel. • Deceptive: Sends out valid packets at a very fast rate to the nearby nodes. Authentic nodes are thus deceived into believing that the jammer is also a legitimate node. • Random: This kind of jammer alternates between sleeping and jamming the channel of operation. • Reactive: This kind of jammer attacks only when it hears communication over the channel it is currently scanning.

11. NTU OPLab Jamming methods(cont’)

12. NTU OPLab Parameters in attack detection • Signal-to-Noise Ratio (SNR): • SNR refers to the ratio of signal power to the power of noise present in the received signal. • Packet Delivery Ratio (PDR): • The ratio of number of packets that were successfully delivered to their respective destination to the total number of packets sent out by the node. • Carrier Sense Time

13. NTU OPLab Parameters in attack detection(cont’)

14. NTU OPLab Parameters in attack detection(cont’)

15. NTU OPLab Steps of tackling jamming attacks • Attack detection: • The Physical-layer. • The MAC-layer • Attack mitigation: • Overcome the effects of the attack. • Attack prevention(seldom included): • Prevent the occurrence of an attack on the network.

16. Existing techniques

17. NTU OPLab Existing techniques • Channel Surfing • Spatial Retreats • Using Wormholes • Jammed region mapping • Spread Spectrum Techniques

18. NTU OPLab Channel Surfing • A spectral evasion mechanism: • Move to a different channel of operation. • On detection of an attack, the nodes: • Change the channel of operation based on a pre-defined pseudorandom sequence. • An access point frequently sends beacons to all its associated nodes to check if they are still with it or not.

19. NTU OPLab Channel Surfing(cont’)

20. NTU OPLab Spatial Retreats • Based on spatial evasion: • AP are immobile components • Move from the region of their current AP which is currently being jammed to the region of an emergency AP. • While moving away: • The nodes tries to connect to its jammed AP.

21. NTU OPLab Using Wormholes • Two or more attackers act as a single attacker through a coordinated attack mechanism. • With the help of a special communication link(worm hole). • A similar mechanism, when there are some nodes are jammed in a network, they: • Communicates through an un-jammed medium • Afterward, an attack mitigation followed.

22. NTU OPLab Jammed region mapping • Mapping out the jammed region with a protocol. • Based on the responses received by the nodes which lie on the boundary of the jammed region. • Mitigate the impact of a jammer by identifying and isolatingthe jammed region, and then trying to determine alternate routing paths for the data packets.

23. NTU OPLab Spread Spectrum Techniques • Traditional techniques: • Push maximum traffic into the minimum amount of bandwidth • Spread Spectrum: • Spreads the signal over a range of bandwidth in the widest possible manner. • Makes the communication very hard to be detected and jammed.

24. NTU OPLab Limitations of the existing techniques • Attack detection. • Most of the jamming attacks detected are false alarms • Some of the solutions allows a portion of the network to become inoperable. • These are not very popular, • as they affect the connectivity of the jammed nodes

25. NTU OPLab Limitations of the existing techniques(cont’) • Spatial Retreats • Involves physically moving • Restricts the mobility of the nodes. • Wormholes • Requires an additional secure channel between all node pairs • Spread spectrum • Extra costs for small quantity of information • High complexity

26. NTU OPLab Limitations of the existing techniques(cont’) • A missing aspect: • No prevention mechanisms.

27. Proposed solution

28. NTU OPLab Proposed solution • Providing a mechanism for attack prevention • Can be easily integrated into the existing network architecture

29. NTU OPLab Network Architecture • Involve following components: • Base-station • Mobile nodes • Honeynodes • Honeynode is the only new component added to the existing infrastructure.

30. NTU OPLab Honeynodes Jammer scans the channel • Secondary interfaces on base-stations • Guard the frequency of operation by: • Send out fake signals on a nearby frequency • Prevent the attacks by deceiving the attacking entity to attack the honeynode. 2400 MHz Honeynode 2405MHz Base Station

31. NTU OPLab Algorithm for proposed mechanism • If the mobile nodes or base-stations detects an attack, it: • changes its frequency of operation based on a pseudorandom sequence. • If the honeynode detects an attack, it: • Continues to send signals on that channel • Informs the base-station of the impending attack • Then the base-station issues a frequency change command to all its associated nodes. • Later on, the honeynode switches its frequency of operation to the new guard frequency.

32. NTU OPLab Algorithm for proposed mechanism(cont’)

33. NTU OPLab Algorithm for proposed mechanism(cont’)

34. NTU OPLab Contributions Jammer 1 • Introduced honeynodes into the network architecture • Eliminates the possibility of base station jamming • Base station jamming can occur only when: • base stations move from one frequency of operation to another. 2400 MHz Honeynode Run 2405MHz Base Station Hop Jammer 2 Jamming 2430 MHz Base Station

35. NTU OPLab Contributions(cont’) • Secondly, they have used a hybrid proactive and reactive frequency selection algorithm for frequency selection. • Proactive mechanisms: • Based on a pre-defined pseudorandom sequence • Reactive mechanisms: • Determine the next frequency of operation dynamically • While proactive mechanisms are fast, reactive mechanisms give better performance.

36. NTU OPLab Contributions(cont’) • A major constraint on a reactive mechanism: • requires an un-jammed communication link between all participating nodes • We employ a hybrid technique which follows the • proactive approach when mobile nodes or base stations are jammed • reactive mechanism in case the honeynode detects an attack.

37. NTU OPLab Attacker’s behavior

38. NTU OPLab Hybrid frequency selection algorithm • When normal nodes, i.e., mobile nodes and base-stations, detect an attack, • They use a pre-defined pseudorandom sequence for the selection of the next frequency. • This sequence is known to every ‘‘legal” node that is present on the network. • A reactive approach cannot be used in such a case because the regular communication channel would be under attack.

39. NTU OPLab Hybrid frequency selection algorithm(cont’) • When a honeynode detects an attack, • it alerts the base-station it is attached to about the imminent attack. • The base station • Maintains a ‘‘blacklist” of all frequencies recently jammed. • On receiving an alert from the honeynode, it selects a frequency that is farthest away from any blacklisted frequency amongst the list of available frequencies.

40. NTU OPLab Hybrid frequency selection algorithm(cont’) • When an attack is detected on a frequency • It is added to the ‘‘blacklist” of jammed frequencies • For time equal to risk_time.

41. NTU OPLab Hybrid frequency selection algorithm(cont’)

42. NTU OPLab Hybrid frequency selection algorithm(cont’)

43. NTU OPLab Hybrid frequency selection algorithm(cont’)

44. NTU OPLab Attack scenarios and respective defence strategies • Scenario 1: Only communicating mobile nodes are jammed. • Scenario 2: Mobile nodes and base-station are jammed. • Scenario 3: Honeynode is jammed.

45. NTU OPLab Only communicating mobile nodes are jammed

46. NTU OPLab Both mobile nodes and base-station are jammed

47. NTU OPLab Honeynode is jammed

48. Simulation

49. NTU OPLab Simulation • In order to determine how effective our proposed algorithm is, this work simulated the proposed algorithm along with the Channel Surfing Algorithm, to compare their respective performance under similar conditions.

50. NTU OPLab Simulation topology • Four BSs • Each BS having seven associated nodes. • The BSs connected to each other through a wired distribution system. • During the simulations, communications had been set up randomly between various nodes. • Introduce jammers into the scene and measure the performance metrics for various attack intensities.