Anomaly-based intrusion detection of jamming attacks, local versus collaborative detection

Abstract

We present intrusion detection algorithms to detect physical layer jamming attacks in wireless networks. We compare the performance of local algorithms on the basis of the signal-to-interference-plus-noise ratio (SINR) executing independently at several monitors, with a collaborative detection algorithm that fuses the outputs provided by these algorithms. The local algorithms fall into two categories: simple threshold that raise an alarm if the output of the SINR-based metrics we consider deviates from a predefined detection threshold and cumulative sum (cusum) algorithms that raise an alarm if the aggregated output exceeds the predefined threshold. For collaborative detection, we use the Dempster-Shafer theory of evidence algorithm. We collect SINR traces from a real IEEE 802:11 network, and with the use of a new evaluation method, we evaluate both the local and the Dempster-Shafer algorithms in terms of the detection probability, false alarm rate, and their robustness to different detection threshold values, under different attack intensities. The evaluation shows that the cusums achieve higher performance than the simple threshold algorithms under all attack intensities. The Dempster-Shafer algorithm when combined with the simple algorithms, it can increase their performance by more than 80%, but for the cusum algorithms it does not substantially improve their already high performance.

A data fusion technique to detect wireless network virtual jamming attacks

“…The DS theory does not require prior knowledge, enables a way of measuring ignorance, when the evaluated data cannot be allocated within the normal or abnormal hypothesis. Furthermore, it has also proved to be a viable solution in cases where it is impossible to apply classical sensor fusion techniques, such as Kalman filter or Bayesian networks, or even when it is virtually impossible to find a pattern in the system behaviour to build an appropriate model [15]. Although DS theory inflicts additional computational load when computing mass functions, reducing the number of hypothesis to three makes this theory applicable to a live detection system.…”

“…In [15] the authors propose a distributed solution to detect jamming attacks at the physical layer. In detail, the method is based on the detection of changes in the statistical characteristics of the Signal to Noise Ratio (SNR).…”

Denial-of-Service Attacks in Wireless Networks Using Off-the-Shelf Hardware

“…Based on this, we deploy a cumulative-sum (cusum) algorithm [14] able to detect abrupt changes of the SINR. In previous works [15,11,16,17] we show that maximum performance, in terms of false alarms/detection probability, is achieved when considering the maximum minus the minimum values of SINR within a short and long windows. Cusum is defined as:…”

A novel cheater and jammer detection scheme for IEEE 802.11-based wireless LANs

“…In [10], the authors use anomaly-based intrusion detection algorithm to investigate the presence of a jammer. The intrusion detection algorithm uses SINR based statistical analysis.…”