ARES: an Anti-jamming REinforcement System for 802.11 Networks

1. ARES: an Anti-jamming REinforcement System for 802.11 Networks Konstantinos Pelechrinis, Ioannis Broustis, Srikanth V. Krishnamurthy, Christos Gkantsidis ACM CoNEXT 2009

2. Launching DoS Attacks in WiFi networks is easy

3. Launching DoS Attacks in WiFi networks is easy Alice senses medium busy

4. Launching DoS Attacks in WiFi networks is easy Packet collisions

5. Launching DoS Attacks in WiFi networks is easy • Jammer can be: • Continuous • Intermittent: random or reactive Xu et al [MobiHoc 2005]

6. Launching DoS Attacks in WiFi networks is easy How to deal with jammers? Frequency hopping ?? Two flavors: (a) Reactive, (b) Proactive Frequency hopping is weak for current systems [WiOpt 2009]: Only 4 jammers to block entire 5GHz spectrum

7. Launching DoS Attacks in WiFi networks is easy Can we alleviate jamming effects without relying on frequency hopping?

8. Our Contributions/Findings • Fixed rates are often preferable in the presence of a jammer • Rate adaptation converges slowly • Clear Channel Assessment (CCA) tuning is important: • The transmitter can ignore jamming signals • The receiver can latch on the desired signal more easily • ARES: A measurement driven anti-jamming system which utilizes rate and power control techniques. • ARES fights jammer, instead of trying to avoid it • Testbed evaluations show the potentials of ARES: • Up to 3x better performance

9. Roadmap • Introduction • Rate Control • Power Control • System architecture • Evaluation • Conclusions

10. Interaction between random jamming and rate control Jamming effects last beyond the jamming period when rate control is used !

11. Rate Control: Fixed or Variable? • In general, rate adaptation improves performance under benign condition. • But, in the presence of an intermittent jammer The rate control algorithm might be slow to converge to optimum rate • Remedy: Fixed rate assignments increase immediately throughput • But, performance depends on channel conditions • How to decide when to allow rate adaptation and when not?

12. Deciding when to perform rate adaptation • With perfect knowledge of: • Application data rate Ra • Jammer’s distribution • Rate control algorithm used • Link quality (e.g., PDR) • Effectiveness of jammer (measured via the throughput sustained on the link) we can analytically decide between fixed rate and rate control. • Average throughput over a jamming cycle . Rate control algorithm Link Quality Application rate Effectiveness of jammer

13. Fixed rate provides high throughput gains • Throughput gains are indeed viable in practice with fixed rates under the presence of random jamming. • Corollary: Use rate control only when the link is very “poor”. • E.g. for Ra=54Mbps, rate adaptation is preferred only if PDR is as low as 0.15 (for sample rate)

14. Practical algorithm for deciding when to rate control • However, perfect knowledge is not realistic • Our Markovian Rate Control (MRC) module is inspired from the analysis but does not require knowledge of any of the parameters. In: k Jam off & i < k Jamming - i++ Set rate at R • i = 0 • keep track of rate R Jam off & i == k Jamming

15. MRC performs well in practice • Parameter k controls the performance of MRC. • MRC can be tuned to give performance close to the “optimal”.

16. Roadmap • Introduction • Rate Control • Power Control • System architecture • Evaluation • Conclusions

17. Power Control • Rate control removes transient jamming effects. • What about constant jamming effects? Power Control: • Power adaptation • Clear Channel Assessment (CCA) tuning • Power adaptation helps only when: • Transmitter is not in the jammer’s range. • When low transmissions rates are used. • Increasing CCA at the transceivers can restore the benign throughput with high probability. • Care for avoiding starvation.

18. Increasing power helps when transmission rate is low • Observation 1: Probability of accessing the medium does not depend on transmission power. • Observation 2: Given that a packet is transmitted • Power adaptation increases “Signal / Jamming Interference Ratio.” • Improvements when low transmission rates are used. • Restricted solution. • Ideal solution should be agnostic to: • Jammer’s range • Rate used

19. Dealing with high power jammers • In the presence of a high power jammer • The transmitter needs to be able to ignore jamming signals. • The receiver must be able to decode the legitimate packet. • Tuning the transmission power increases the legitimate signal level at the receiver, but not very helpful when the jamming interference is also large enough. • Observation 3: CCA threshold dictates both transmitting and receiving functionality • Transmitter: total energy at the transmitter’s antenna < CCA  idle medium • Receiver: signals with energy < CCA  noise • Increasing the CCA threshold does NOT increase the SNR at the receiver. • It helps the receiver latch on the legitimate signal.

20. Side effects of power control • Care needs to be taken for possible side effects: • Transmitter: unintentionally become a jammer  starve other nodes • [Mahtre et al – Infocom 2007] : PCCA = constant • Receiver: blindly increasing CCA  legitimate signals regarded as noise • Upper bound at CCA value for not ignoring signals of interest Connectivity starts to be compromised ! !

21. How to perform Power Control? • Shadow fading variation Δ: Signal levels vary from their average value by ΔdBm. • RSSIij is the signal level at node j due to the transmission of node i (i,j = T(transmitter), R(receiver) and J(jammer)). • Heuristic for CCA on the link (CCAL): • If max(RSSIJT, RSSIJR) ≤ min(RSSIRT, RSSITR) – Δ CCAL = min(RSSIRT, RSSITR) – Δ • If max(RSSIJT, RSSIJR) ≤ min(RSSIRT, RSSITR) – 2Δ • Link operates as in jamming free environment.

22. ARES: System Design • ARES performs rate control and power control. • Rate control uses the Markov Rate controller. • Power control sets the CCA value based on the RSSIs and the value for the shadow fading variation Δ. • Both rate and power control are measurement-driven heuristics. Is CCA tuneable? No Rate Control Jammer detected Xu et al [MobiHoc 2005] END No Yes Yes Jamming resolved? Power Control

23. Roadmap • Problem motivation • Our Contributions/Findings • Background/Related Studies • System Design • Rate Control Measurements • Power Control Measurements • Evaluation • Conclusions

24. Evaluation Setup • Experimental evaluation on our indoor wireless testbed. • Hardware used: • Intel-2915 with ipw2200 driver/firmware (allows tuning CCA). • EMP-8602 6G • Ralink RT2860 (support 802.11n) • Jammer implementation: • Utilize Intel cards • CCA  0 dBm • User space utility that sends broadcast packets back – to – back

25. Effect of rate control on 802.11n • Rate Control only • Benchmark results: using analytical assessments • ARES: Improves performance by up to 100%

26. Mobile Jammer • The jammer (constant) moves to the vicinity of the legitimates nodes, stays there for k seconds and leaves. • ARES utilizes power control module • Increased CCA to overcome the presence of the jammer • Rate adaptation module is not of much benefit in this scenario. • ARES increases throughput by >150%

27. Using rate control to avoid neighbor starvation • ARES (MRC) improves neighbors’ AP throughput. • Avoid transmissions at lower rates during the sleeping cycles. • Neighbor APs and links have to wait less time to obtain the medium. • Improved overall, networked setting performance • With one neighbor AP (and one jammed) 23% improvement • Adding more APs reduces the benefits due to increased contention.

28. Roadmap • Problem motivation • Our Contributions/Findings • Background/Related Studies • System Design • Rate Control Measurements • Power Control Measurements • Evaluation • Conclusions

29. Conclusions • Fixed rate assignments can be beneficial in jammed environments. • Power level tuning helps only at low rates and low power jammers. • Tuning the CCA threshold enables: • The transmitter to ignore jamming signals • The receiver capture the desired packet(s) • Evaluations of our measurement driven prototype system shows that rate and power control can efficiently fight against the jammer. • Frequency hopping tries to avoid the jammer.

30. THANK YOU !! QUESTIONS?