Research Direction Introduction

1. Research Direction Introduction Advisor: Professor Frank Y.S. Lin Present by Hubert J.W. Wang

2. NTU OPLab Outline • Previous Comments • Problem Description

3. Previous Comments

4. NTU OPLab Previous Comments • Exploit Nodes’ Hearing Ranges • Multiple jammers • Topology planning • Budget allocation

5. NTU OPLab Exploit Nodes’ Hearing Ranges • Can we exploit nodes’ hearing ranges by adjusting transmission power? • : the minimum SNR(the threshold value required to decode a signal successfully.

6. NTU OPLab Exploit Nodes’ Hearing Ranges(cont’)

7. NTU OPLab Exploit Nodes’ Hearing Ranges(cont’) • Algorithm description Distance between A and J Suppose we know: A’s coordinates A’s hearing range(distance between A and B)

8. NTU OPLab Exploit Nodes’ Hearing Ranges(cont’) • Estimating the hearing range • Average of: • The location of the furthest remaining neighbor(lower bound) • The location of the nearest lost neighbor(upper bound) • Estimation error between:

9. NTU OPLab Exploit Nodes’ Hearing Ranges(cont’) • It’s possible to exploit nodes’ hearing ranges by adjusting transmission power. • Suppose B is a • Fully jammed neighbor of A • Inform B to increase its transmission power until the SNR received by A meets the threshold. • Partially jammed neighbor of A • Inform B to decreaseits transmission power until the SNR received by A meets the threshold.

10. NTU OPLab Multiple jammers • Assumption When jamming ranges overlapped, • the edge of the ranges will not become fuzzy(邊界不會模糊化 ) • the signal strength received by the nodes which are located in the overlapped area is dominated by the stronger one. NodeA Jammer JB’s signal strength is stronger in this case JB JA

11. NTU OPLab Multiple jammers(cont) • Challenges • The shape of overlapped jamming range的is irregular. The defender is not able to see the detailed jamming range figure. The defender only know the nodes which are being jammed. Thus, the defender can only sequentially make suggestions about the number of jammers in the network.

12. NTU OPLab Multiple jammers(cont) • Challenges • How to localize multiple jammer’s position? NodeC NodeA Some nodes are suitable to be used to localize jammers. But the others are not, they are located in overlapped jamming area. The question is, how do they know if they are located in the same jamming range? NodeB JA JB

13. NTU OPLab Multiple jammers(cont) • Challenges • Heterogeneous jammers. Some times the jamming area seems like there is only one jammer in the network. And the nodes are able to estimate the location of the jammer. Yes, the jammer is removed, but the network is still jammed. Because there are actually multiple jammers in the network. NodeB NodeC ? NodeA JB JF NodeF NodeD NodeE JA JC JE JD

14. NTU OPLab Multiple jammers(cont) • Jammer number estimation • Consider the effect on the jammed node’s ability to communicate NodeB Some nodes may not be able to be recognized. NodeC NodeA JB NodeF NodeD NodeE JA JC JD

15. NTU OPLab Multiple jammers(cont) • Jammer number estimation • Chart with graphical information Relatively high(compare to other observation points with similar distance) NodeC

16. NTU OPLab Other Previous Comments • Topology planning • Budget allocation

17. Problem Description

18. NTU OPLab Problem Description • Problem • Topology information gathering • Jamming attack • Environment • Infrastructure/Backbone WMNs • Role • Attacker • Defender

19. NTU OPLab Defender • Attributes • Nodes • Base Station • Mesh router(with 2 NICs) • Mesh client • Honeynode(with 3 NICs) • Guard Node

20. NTU OPLab Defender(cont’) • Attributes • Budget • Planning phase • Topology planning • Non-deception based • Deception based • Defending phase • Localization • Approximate • Precise

21. NTU OPLab Defender(cont’) • Strategies • Planning phase • Protect core nodes • Protect BS • Nodes with high population • Protect valuable information(ex. routing table, traffic) • Ensure QoS • Protect Traffic

22. NTU OPLab Defender(cont’) • Strategies • Defending phase • Real-time reaction • Priority of jammer removing • Minimize the total effectiveness of jamming • Retrieve QoS • Methods of jammer removing(precise or approximate) • Determined by its possibility of being approximated.

23. NTU OPLab Attacker • Attributes • Budget • Preparing phase • Node compromising • Jammer choosing • High quality jammers • Normal jammers • Capability • Capability of compromising nodes • Capability of recognizing fake info.

24. NTU OPLab Attacker(cont’) • Strategies • Preparing phase • Node compromising • Compromise core nodes • Be stealthy • Reduce QoS • Topology extending • Random

25. NTU OPLab Attacker(cont’) • Strategies • Attacking phase • Attacker’s Objective • Maximize attack effectiveness • QoS • Maximize number of jammed mesh routers • Random

26. NTU OPLab Scenario Base Station Mesh router Nodes with more defense resource Compromised mesh router Jammed mesh router Honeynode Jammer Attacker

27. NTU OPLab Scenario(cont’) • For attacker • Objective: • Maximize the effect to the network (Metrics of time and user numbers) • Incomplete information of the network • Budget limited • For defender • Objective: • Minimize the maximized negative effect cased by the attacker. • Maximize the budget • Budget limited

28. NTU OPLab Scenario(cont’) Assumptions: • The communications between mesh routers and between mesh routers and mesh clients use different communication protocol. • All the packets are encrypted. Thus, the attacker can’t directly obtain information in the communication channels. • The defender has complete information of the network which is attacked by a single attacker with different strategies. • The attacker is not aware of the topology of the network. Namely, it doesn’t know that there are honeynodes in the network and which nodes are important, i.e., the attacker only has incomplete information of the network.

29. NTU OPLab Scenario(cont’) Assumptions: • There are two kinds of defense resources, the non-deception based resources and the deception based resources. • There are multiple jammers in the network, and their jamming ranges might be overlapped. • When multiple jammers attack the same channel, the received signal strength at a jammed mesh router is dominated by the larger one. • 在jammer的電波之間沒有任何的疊加、抵消等作用，jamming range重疊後邊緣不會有任何改變。

30. NTU OPLab Scenario – Network Architecture Base Station Mesh router

31. NTU OPLab Scenario – Defender’s Planning Phase Base Station Mesh router BS I must protect Core Nodes Node with high population

32. NTU OPLab Scenario – Defender’s Planning Phase(cont’) • Why didn’t the defender protect all the nodes with high population? • Budget limited. • The effectiveness of doing so may not be the best. • There are other ways to deploy resources. Base Station Mesh router Nodes with more defense resource Honeynode Attacker I must protect Core Nodes F G E D A B C

33. NTU OPLab Scenario – Defender’s Planning Phase(cont’) Effect of the defense resource may be: Base Station • Reduce the probability of being compromised Mesh router Nodes with more defense resource Honeynode Attacker I must protect Core Nodes

34. NTU OPLab Scenario – Defender’s Planning Phase(cont’) Effect of the defense resource may be: Base Station • Prevent the attacker from getting close to the important nodes. Mesh router Nodes with more defense resource Honeynode Attacker I must protect Core Nodes

35. NTU OPLab Scenario – Defender’s Planning Phase(cont’) Effect of the defense resource may be: Base Station • Attract attacks to prevent it from getting close to the important nodes. Mesh router Nodes with more defense resource Honeynode Attacker I must protect Core Nodes

36. NTU OPLab Scenario – Defender’s Planning Phase(cont’) Effect of the defense resource may be: Base Station • Avoid attacks to prevent it from getting close to the important nodes. Mesh router Nodes with more defense resource Honeynode Attacker I must protect Core Nodes F G E D A B C

37. NTU OPLab Scenario – Attacker’s Preparing Phase • Initially, the attacker has following info: • Number of channels. • Signal power of each channel. • Traffic amount of each channel. • Defense strength of each mesh node. F D A C E B G 20 20 90 20 90 20 90 Signal Strength

38. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) The honeynode: Which channel is being attacked does not matter. F D A C E B G 20 20 90 20 90 20 90 Signal Strength

39. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) The attacker’s objective: Maximize attack effectiveness. F D The node with the strongest signal power Compromise core nodes. The initial node might be.. A C E B G 90 20 90 20 20 20 90 Signal Strength

40. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) Base Station Mesh router Nodes with more defense resource Compromised mesh router Honeynode Attacker H I F G J K L E D A B C

41. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) I E • After compromise a mesh router, the attacker has following info: • Number of channels. • Signal power of each channel. • Traffic amount of each channel. • Defense strength of each mesh node. • And… K J Being compromised, and obtained: routing table info Location info of the mesh router. Traffic info Number of users H L B F G D 90 90 90 20 90 20 90 90 20 20 20 A Signal Strength

42. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) I E • After compromise a mesh router, the attacker has following info: • Number of channels. • Signal power of each channel. • Traffic amount of each channel. • Defense strength of each mesh node. • Number of traffic sources K J Number of users H L 88 21 95 B F G 28 6 31 35 35 21 28 D 90 90 90 20 20 90 20 20 90 90 20 A Signal Strength

43. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) I E The attacker selects next hop with obtained info from compromised mesh routers if available. K J The node with the highest number of traffic sources H L 95 88 21 B F G 28 28 21 31 35 35 6 D 90 90 90 90 90 20 20 20 20 20 90 A Signal Strength

44. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) • The action of compromising a honeynode will has following results: • Succeed • Failed • Simply failed, or • Had been deceived. Base Station Mesh router Nodes with more defense resource Compromised mesh router Honeynode Attacker I H F G J K L E D A M N B C

45. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) E The attacker selects next hop with obtained info from compromised mesh routers if available. L N M K D C G 24 30 18 B 27 112 21 28 25 6 90 90 90 90 90 20 90 20 90 90 20 A Signal Strength

46. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) The defender will lead the attacker to: Unimportant area Nodes with greater defense strength. E However, the attacker was deceived by honeynode B. Thus, it obtained following fake info: Population of the honeynode. Traffic of the neighbors of the honeynode. N L K D M G C 18 30 24 B 112 25 90 28 21 6 27 90 90 90 90 20 90 90 90 20 20 A Signal Strength

47. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) E Relatively low traffic sources on important nodes. N L D K M G C 18 30 24 B 21 25 6 28 112 27 90 90 90 90 High traffic sources on unimportant nodes. Select node C as next hop 90 90 90 90 20 20 20 A Signal Strength

48. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) Base Station Mesh router Nodes with more defense resource Compromised mesh router Honeynode Attacker I H F G J K L E D A M N B Failed to compromise C

49. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) Base Station Mesh router Nodes with more defense resource Compromised mesh router Honeynode Attacker I H F G J K L E R Compromised 2nd choice node D D A M N B P Q C O

50. NTU OPLab Scenario – Attacker’s Preparing Phase(cont’) Select node N as next hop. But what will the attacker do if he compromised a honeynode? E Attackers with high capacity have greater probability to distinguish between true and fake. Q R P D O G C When the attacker compromised a honeynode, he may obtain: Only fake info Mixture of fake and true info. What should I do ? Just ignore it? Or attack the node they try to protect? 98 30 B 8 35 29 32 28 6 22 21 90 90 20 90 90 20 20 90 20 20 A Signal Strength