A novel cheater and jammer detection scheme for IEEE 802.11-based wireless LANs

The proliferation of IEEE 802.11 networks has made them an easy and attractive target for malicious devices/adversaries which intend to misuse the available network. In this paper, we introduce a novel malicious entity detection method for IEEE 802.11 networks. We propose a new metric, the Beacon Access Time (BAT), which is employed in the detection process and inherits its characteristics from the fact that beacon frames are always given preference in IEEE 802.11 networks. An analytical model to define the aforementioned metric is presented and evaluated with experiments and simulations. Furthermore, we evaluate the adversary detection capabilities of our scheme by means of simulations and experiments over a real testbed. The simulation and experimental results indicate consistency and both are found to follow the trends indicated in the analytical model. Measurement results indicate that our scheme is able to correctly detect a malicious entity at a distance of, at least, 120 m. Analytical, simulation and experimental results signify the validity of our scheme and highlight the fact that our scheme is both efficient and successful in detecting an adversary (either a jammer or a cheating device). As a proof of concept, we developed an application that when deployed at the IEEE 802.11 Access Point, is able to effectively detect an adversary. (C) 2015 Elsevier B.V. All rights reserved.Postprint (author's final draft

Robust Wireless Communication for Multi-Antenna, Multi-Rate, Multi-Carrier Systems

Abstract Today's trend of migrating radio devices from hardware to software provides potential to create flexible applications for both commercial and military use. However, this raises security concerns, as malicious attackers can also be generated easily to break legitimate communications. In this research work, our goal is to design a robust anti-jamming radio framework. We particularly investigate three different aspects of jamming threats: high-power jammers, link attacks on rate adaptation, and jamming in multicarrier systems. The threats of high-power jamming to wireless communications today are realistic due to the ease of access to powerful jamming sources such as the availability of commercial GPS/WiFi/cellular devices on the market, or RF guns built from microwave ovens' magnetron. To counter high-power jamming attacks, we develop SAIM which is a hybrid system capable of resisting jammers of up to 100,000 times higher power than legitimate communication nodes. The system robustness relies on our own antenna structure specially designed for anti-jamming purpose. We develop an efficient algorithm for auto-configuring the antenna adaptively to dynamic environments. We also devise a software-based jamming cancellation technique for appropriately extracting original signals, which is more robust than traditional MIMO approaches, as pilot signals are not required in SAIM. In spite of the robustness of SAIM, our design is more appropriate for malicious environments with powerful jammers, where mechanical steering is feasible, e.g., military applications. Residential and commercial wireless communication systems are still vulnerable to even limited-power jamming, as in today's standard wireless protocols, rate information is exposed to adversaries. Rate-based attacks have been demonstrated to severely degrade the networks at very low cost. To mitigate rate-based attacks, we develop CBM, a system capable of hiding rate and -at the same time -increasing resiliency against jammers up to seven times higher than regular systems, where rate is exposed. We achieve the resiliency boost by generalizing Trellis Coded Modulation to allow non-uniform codeword mapping. We develop an efficient algorithm for finding good non-uniform codes for all modulations in {BPSK, QPSK, 8-PSK, 16-QAM, 64-QAM}. To conceal rate information, we devise an efficient method for generating cryptographic interleaving functions. In recently deployed communication networks such as WiFi and LTE systems, MIMO and OFDM are the two main techniques for increasing bandwidth efficiency. While MIMO increases the channel capacity by spatial processing on multiple received signals, OFDM mitigates impacts of dynamic variations in wide-band channels and allows frequency reuse with overlapping carriers. Synchronization is a key for high-throughput performance in MIMO and OFDM systems. In this work, we study impacts of jamming attacks specifically targeting to control channels in WiFi and LTE networks. Our study focuses on efficient techniques for both jamming and anti-jamming in multicarrier systems

Cascading attacks in Wi-Fi networks: demonstration and counter-measures

Wi-Fi (IEEE 802.11) is currently one of the primary media to access the Internet. Guaranteeing the availability of Wi-Fi networks is essential to numerous online activities, such as e-commerce, video streaming, and IoT services. Attacks on availability are generally referred to as Denial-of-Service (DoS) attacks. While there exists signif- icant literature on DoS attacks against Wi-Fi networks, most of the existing attacks are localized in nature, i.e., the attacker must be in the vicinity of the victim. The purpose of this dissertation is to investigate the feasibility of mounting global DoS attacks on Wi-Fi networks and develop effective counter-measures. First, the dissertation unveils the existence of a vulnerability at the MAC layer of Wi-Fi, which allows an adversary to remotely launch a Denial-of-Service (DoS) attack that propagates both in time and space. This vulnerability stems from a coupling effect induced by hidden nodes. Cascading DoS attacks can congest an entire network and do not require the adversary to violate any protocol. The dissertation demonstrates the feasibility of such attacks through experiments with real Wi-Fi cards, extensive ns-3 simulations, and theoretical analysis. The simulations show the attack is effective both in networks operating under fixed and varying bit rates, as well as ad hoc and infrastructure modes. To gain insight into the root-causes of the attack, the network is modeled as a dynamical system and its limiting behavior is analyzed. The model predicts that a phase transition (and hence a cascading attack) is possible when the retry limit parameter of Wi-Fi is greater or equal to 7. Next, the dissertation identifies a vulnerability at the physical layer of Wi-Fi that allows an adversary to launch cascading attacks with weak interferers. This vulnerability is induced by the state machine’s logic used for processing incoming packets. In contrast to the previous attack, this attack is effective even when interference caused by hidden nodes do not corrupt every packet transmission. The attack forces Wi-Fi rate adaptation algorithms to operate at a low bit rate and significantly degrades network performance, such as communication reliability and throughput. Finally, the dissertation proposes, analyzes, and simulates a method to prevent such attacks from occurring. The key idea is to optimize the duration of packet transmissions. To achieve this goal, it is essential to properly model the impact of MAC overhead, and in particular MAC timing parameters. A new theoretical model is thus proposed, which relates the utilization of neighboring pairs of nodes using a sequence of iterative equations and uses fixed point techniques to study the limiting behavior of the sequence. The analysis shows how to optimally set the packet duration so that, on the one hand, cascading DoS attacks are avoided and, on the other hand, throughput is maximized. The analytical results are validated by extensive ns-3 simulations. A key insight obtained from the analysis and simulations is that IEEE 802.11 networks with relatively large MAC overhead are less susceptible to cascading DoS attacks than networks with smaller MAC overhead

Synoptic analysis techniques for intrusion detection in wireless networks

Current system administrators are missing intrusion alerts hidden by large numbers of false positives. Rather than accumulation more data to identify true alerts, we propose an intrusion detection tool that e?ectively uses select data to provide a picture of ?network health?. Our hypothesis is that by utilizing the data available at both the node and cooperative network levels we can create a synoptic picture of the network providing indications of many intrusions or other network issues. Our major contribution is to provide a revolutionary way to analyze node and network data for patterns, dependence, and e?ects that indicate network issues. We collect node and network data, combine and manipulate it, and tease out information about the state of the network. We present a method based on utilizing the number of packets sent, number of packets received, node reliability, route reliability, and entropy to develop a synoptic picture of the network health in the presence of a sinkhole and a HELLO Flood attacker. This method conserves network throughput and node energy by requiring no additional control messages to be sent between the nodes unless an attacker is suspected. We intend to show that, although the concept of an intrusion detection system is not revolutionary, the method in which we analyze the data for clues about network intrusion and performance is highly innovative

Optimal Channel-Switching Strategies in Multi-channel Wireless Networks.

The dual nature of scarcity and under-utilization of spectrum resources, as well as recent advances in software-defined radio, led to extensive study on the design of transceivers that are capable of opportunistic channel access. By allowing users to dynamically select which channel(s) to use for transmission, the overall throughput performance and the spectrum utilization of the system can in general be improved, compared to one with a single channel or more static channel allocations. The reason for such improvement lies in the exploitation of the underlying temporal, spatial, spectral and congestion diversity. In this dissertation, we focus on the channel-switching/hopping decision of a (group of) legitimate user(s) in a multi-channel wireless communication system, and study three closely related problems: 1) a jamming defense problem against a no-regret learning attacker, 2) a jamming defense problem with minimax (worst-case) optimal channel-switching strategies, and 3) the throughput optimal strategies for a group of competing users in IEEE 802.11-like medium access schemes. For the first problem we study the interaction between a user and an attacker from a learning perspective, where an online learner naturally adapts to the available information on the adversarial environment over time, and evolves its strategy with certain payoff guarantee. We show how the user can counter a strong learning attacker with knowledge on its learning rationale, and how the learning technique can itself be considered as a countermeasure with no such prior information. We further consider in the second problem the worst-case optimal strategy for the user without prior information on the attacking pattern, except that the attacker is subject to a resource constraint, which models its energy consumption and replenishment process. We provide explicit characterization for the optimal strategies and show the most damaging attacker, interestingly, behaves randomly in an i.i.d. fashion. In the last problem, we consider a group of competing users in a non-adversarial setting. We place the interaction among users in the context of IEEE 802.11-like medium access schemes, and derive decentralized channel allocation for overall throughput improvement. We show the typically rule-of-thumb load balancing principle in spectrum resource sharing can be indeed throughput optimal.PhDElectrical Engineering: SystemsUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttp://deepblue.lib.umich.edu/bitstream/2027.42/108949/1/qingsi_1.pd