EM Monitoring and Classification of IEMI and Protocol-Based Attacks on IEEE 802.11n Communication Networks

Abstract

The development of connected devices and their daily use are today at the origin of the omnipresence of Wi-Fi wireless networks. However, these Wi-Fi networks are often vulnerable, and can be used by malicious people to disturb services, intercept sensitive data or to gain access to system. In railways, trains are now equipped with wireless communication systems for operational purposes or for passenger services. In both cases, defense strategies have to be developed to prevent misuses of the networks. The first objective of this study is to propose a monitoring solution, which is independent of the communication networks, to detect the occurrence of attacks. The second objective is to develop a method able to classify attacks of different types: the intentional electromagnetic interference (IEMI), i.e., jamming attacks, and the protocol-based attacks. This study focuses on the IEEE 802.11n Wi-Fi protocol. To perform these analyses, we propose to monitor and to analyze electromagnetic (EM) signals received by a monitoring antenna and a receiver collecting EM spectra. After that, we build a classification protocol following two steps: the first consists in the construction of a Support Vector Machine (SVM) classification model using the collected spectra and the second step uses this SVM model to predict the class of the attack (if any). A timebased correction of this prediction using the nearest neighbors is also included in this second step.

Characterization of IEEE 802.11 Communications and Detection of Low-Power Jamming Attacks in Noncontrolled Environment Based on a Clustering Study

“…Previous works were performed in an anechoic chamber to analyse the feasibility of detecting jamming attacks by supervised classification approaches. These experiments were carried out without any other interferences in the Wi-Fi frequency band and showed that relatively low jamming signals could be detected by SVM classification [8]. However, the same supervised approach, of our previous works, applied on measurement under realistic conditions, i.e.…”

“…In the PCA representation, each point corresponds to one spectrum. In [8], the experiments were performed in a anechoic chamber (without any other emissions than the Wi-Fi communication and the jamming signal), the PCA and the representation in the two first components showed the separation of the situations with and without jamming. In this present article, we also calculate the PCA over the spectra obtained in a realistic environment with and without jamming signals.…”

“…Indeed, by the supervised method, the acquisitions have to be labeled as " with jamming" or "without jamming" but it is not sufficiently precise to distinguish the variety of the realistic conditions due to the presence of other ISM ambient emissions. Due to these, the models constructed in [8] cannot be applied to estimate the state of the communication. Furthermore, Figure 5 shows the difficulties to discriminate a standard communication with the one under a jamming signal.…”

Susceptibility of LoRa Communications to Intentional Electromagnetic Interference with Different Sweep Periods

“…The commercial jammers are generally based on voltage-controlled oscillators (VCO), which allow them to jam a given frequency band by emitting a radiofrequency signal that repetitively and quickly sweeps the targeted frequency band. The effects of this type of jammer on Wi-Fi networks were already analyzed and evaluated [12,13]. However, its impacts on LoRa communications are still unknown.…”

Non-invasive Optimal Coupling Upon Detection of a Local Change of Impedance in a Cable Network

“…Standardization offers a certain protection level against standardized attacks but attackers may develop their own strategies according to their technological expertise and imagination [2]. This a major concern regarding advanced digital technologies within smart grids [3], wire communications [4] (introducing repetitive crosstalk disturbances), wireless communications [5] [6], autonomous vehicles [7]. From the point of view of risk analysis or attack optimization, evaluation of worse or more favorable configurations are also the subject of questions.…”