Pervasive and Mobile Computing. Collaborative jamming and collaborative defense in cognitive radio networks

Transcription

1 Pevasive and Mobile Computing 9 (2013) Contents lists available at SciVese ScienceDiect Pevasive and Mobile Computing jounal homepage: Fast tack aticle Collaboative jamming and collaboative defense in cognitive adio netwoks Wenjing Wang a, Shameek Bhattachajee a, Mainak Chattejee a,, Kevin Kwiat b a Electical Engineeing and Compute Science, Univesity of Cental Floida, Olando, FL 32816, United States b Ai Foce Reseach Laboatoy, Infomation Diectoate, Rome, NY 13441, United States a t i c l e i n f o a b s t a c t Aticle histoy: Available online 29 June 2012 Keywods: Cognitive adio netwoks Jamming powe distibution Collaboative attacks Collaboative defense Spectum hopping In cognitive adio netwoks, cognitive nodes opeate on a common pool of spectum whee they oppotunistically access and use pats of the spectum not being used by othes. Though coopeation among nodes is desiable fo efficient netwok opeations and pefomance, thee might be some malicious nodes whose objective could be to hinde communications and disupt netwok opeations. The absence of a cental authoity o any policy enfocement mechanism makes these kinds of open-access netwok moe vulneable and susceptible to attacks. In this pape, we analyze a common fom of denial-of-sevice attack, i.e., collaboative jamming. We conside a netwok in which a goup of jammes ties to jam the channels being used by legitimate uses who in tun ty to evade the jammed channels. Fist, we compute the distibution of the jamming signal that a node expeiences by consideing a andom deployment of jammes. Then, we popose diffeent jamming and defending schemes that ae employed by the jammes and legitimate uses, espectively. In paticula, we model and analyze the channel availability when the legitimate uses andomly choose available channels and the jammes jam diffeent channels andomly. We popose a multitie poxy-based coopeative defense stategy to exploit the tempoal and spatial divesity fo the legitimate seconday uses in an infastuctue-based centalized cognitive adio netwok. Illustative esults on spectum availability ates show how to impove esiliency in cognitive adio netwoks in the pesence of jammes Elsevie B.V. All ights eseved. 1. Intoduction A cognitive adio netwok (CRN) is one of the pominent communication technologies that is touted to dive the next geneations of digital communications. Cognitive adio enabled devices have the capability to dynamically access, use, and shae the adio spectum in an oppotunistic manne, in both the licensed and unlicensed bands [1]. Though constant sensing and monitoing of the adio fequency spectum, these adios build a knowledge base of the spectum usage and lean the occupancy and vacancy of vaious bands. The vacant bands ae consideed available, and cognitive adios ae allowed to opeate on the best available channels. Howeve, the bands must be vacated when the pimay uses (i.e., the licenced ownes) of those bands begin tansmission. This eseach was suppoted by National Science Foundation, unde awad no. CCF and the Ai Foce Office of Scientific Reseach (AFOSR). Appoved fo Public Release; Distibution Unlimited: 88ABW dated 02 July Coesponding autho. addesses: wenjing@eecs.ucf.edu (W. Wang), shameek@eecs.ucf.edu (S. Bhattachajee), mainak@eecs.ucf.edu (M. Chattejee), kevin.kwiat@l.af.mil (K. Kwiat) /$ see font matte 2012 Elsevie B.V. All ights eseved. doi: /j.pmcj

2 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Though thee ae majo initiatives fom industy, academia, and policy egulatos on the dynamic, flexible, and efficient use of the adio spectum, thee ae cetain vulneability issues that need to be esolved befoe cognitive adio netwoks can be commecially deployed. Since the spectum is made available to unlicensed uses, it is expected that all such uses follow the egulatoy aspects and the shaing ules. One can think of a vaiety of ways which would make CRNs susceptible to attacks, some of which might be adically diffeent fom those fo taditional multi-channel wieless netwoks. In this eseach, we conside that both jammes and egula uses ae cognitive adio enabled, and that they opeate on a common pool of spectum. The egula uses continuously scan fo available channels and choose channels that ae available o not being jammed. The jammes, on the othe hand, ty to jam the channels that ae being used by the egula uses. We genealize the spectum availability at diffeent locations, i.e., the spectum availability at the jamme side is diffeent fom that at the egula use side, and the jamme has no clue which fequencies the tansmitte/eceive pai would use. Though Ref. [2] examines the jamming poblem in a single-cell IEEE netwok when a single cognitive jamme jams by sweeping all the available channels, such techniques cannot be diectly applied to CRNs. To analyze the cumulative effect of multiple jammes on a single eceive, we fist compute the jamming distibution fom a single jamme on that eceive. We then compute the joint distibution, assuming that the jammes do not employ any tansmit powe contol and that they collaboatively apply a sweeping attack to jam the channels. We conside that the jammes collaboate to distibute thei tansmit powe budget ove multiple channels fo maximizing thei jamming intefeence duing the data tansmission peiods of egula uses. Next, we conside an infastuctued netwok (e.g., IEEE netwok) in which the attacks ae launched at both the base station and the uses. The uses use impetuous and consevative fequency hopping to escape the attacks. We attempt to obtain the spectum availability ates analytically fo both hopping stategies at the base station as well as at the use side. Futhe, we popose a collaboative defense stategy in which the uses fom ties to exploit the tempoal and spatial divesity to avoid jamming. Numeical and simulation esults ae pesented to illustate the spectum availability ates when diffeent attack/defense stategies ae employed. We show the effects of the collaboative attack to eveal how the spectum availability ates change with diffeent paametes. Subsequently we discuss tade-offs between goodput and latency, and show that the communication goodput is geatly enhanced when using communication ties at the cost of latency. The est of the pape is oganized as follows. In Section 2, we discuss the vulneabilities of CRNs and some ecent woks that have been poposed to deal with them. In Section 3, we analyze the distibution of jamming intefeence as expeienced by a eceive fom multiple jammes. In Section 4, we discuss the system model of an infastuctued netwok. We show the effect of jamming and anti-jamming that exploits tempoal and spatial divesity though spectum hopping in Section 5. In Section 6, we show how coopeation can help minimize the jamming pobability. Numeical and simulation studies ae pesented in Section 7. We discuss some pefomance tade-offs in Section 8. Section 9 pesents ou conclusions and futue wok. 2. Peliminaies and elated eseach Just like taditional adios, cognitive adios ae susceptible to hamful intefeence and much moe. Events such as denialof-sevice (DoS) attacks could ende legitimate cognitive adios spectumless. This could easily be achieved if a malicious adio petends to be a pimay tansmitte and spoofs signals that esemble the signal chaacteistics of a licensed use. This is known as pimay use emulation attack which occus at the sensing slot. Since access is fee-fo-all in unlicensed bands, a malicious node can also ty to jam the signals duing the data tansmission slots. Thee ae seveal ways in which communications of a cognitive adio netwok infastuctue can be jeopadized; a common type of attack is denial-of-sevice [3]. In the context of wieless netwoks, DoS attacks ae usually manifested though adio jamming [4]. One of the ways fo adio jamming is the sweeping attack, in which the malicious nodes attack a channel iespective of the channel activity. Anothe altenative way of jamming is the scanning attack: the attackes fist take a constant time to sense the channel to detemine channel activity. The jamme will only jam the channel if it finds legitimate activity on the channel; othewise, it will hop to sense anothe channel until it finds a taget channel to jam. With advanced physical laye techniques, e.g., spead spectum and diectional antennas, it is feasible to defend the netwok fom attacks. Channel/fequency hopping is a popula anti-jamming appoach [5,6]. Anti-jamming hopping is based on the availability of multiple othogonal channels o non-ovelapping fequencies so that the tansmitte/eceive pai can switch, access, and communicate ove a diffeent channel in case the oiginal channel is jammed. The hopping can be tiggeed eithe eactively o poactively. In eactive hopping [5], the tansmitte/eceive pai switch to anothe channel when they obseve jamming, while in poactive hopping [6], the tansmitte and eceive hop thei channels as pe a hopping sequence that is peviously ageed upon. Howeve, it is cucial that all the netwok entities (nodes) shae a contol channel to exchange infomation such as the hopping sequence. Anti-jamming consideations, e.g., using andom assignment of cyptogaphic keys, and contol channel fequency hopping, ae also needed on that channel [7,8]. Theefoe, it is highly desiable that algoithms and potocols that ae devised fo anti-jamming ae distibuted in natue [9,10] o shaed key fee [11,12]. Thee is some body of wok that deals with guading against spuious signal sent ove channels fo disuption o sensoy manipulation [13 15]. In [16], whee the pimay incumbents ae TV stations, the authos popose a method of counteing such attacks by veifying the estimated location fom which the signal has been sent and compaing with aleady

3 574 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) known locations of pimay incumbents. In [14], a dedicated infastuctue-based defense against pimay use emulation is poposed in which an undelying senso netwok monitos malicious jamming on sensing slots. The wok in [17] discusses how pimay use emulation can be achieved by distibuting the total powe budget equally ove a subset of channels chosen fom set of available channels instead of just jamming one channel. Thee ae othe woks, such as [18], which conside ogue nodes that jam the seconday uses. A selective escape stategy as opposed to andom hopping is pusued by egula nodes to avoid jamming. This wok consides that channel usage statistics ae known and that thee is a tade-off between choosing good channels and avoiding jamming by the attacke. This situation is modeled as a dogfight in spectum in multiple stages. In the fist stage, the dogfight is modeled as a nomal zeo-sum game, and the Nash equilibium stategy (max min point) is obtained. Fo the multi-stage game, the dogfight is essentially a stochastic game with patial obsevations and impefect monitoing. The same authos, in [19], have focussed on the poblem of jamming and escaping unde unknown channel statistics and modelled it as a advesaial multi-amed bandit poblem. Lowe bounds on pefomance fo defendes, subject to seveal typical attack stategies, ae deived fo the single-defende case. Fo all the above-mentioned woks, the focus is mostly on jamming the sensing slot fo denying coect sensing decisions on an othewise available channel. Howeve, we focus on jamming fom a usability point of view, whee the jamming could be in any of the sensing o data tansmission slots. 3. Jamming signal distibution In this section, we analyze the effect of andomly distibuted jammes on a single eceive. We fist compute the effect of a single jamme and then sum the jamming signal stengths to compute the total intefeence as the jammes distibute thei tansmit powe budget ove multiple channels System model and assumptions We conside a netwok in which n legitimate uses and m jammes ae andomly scatteed ove a geogaphical egion. The seconday uses wok on fequency bands that ae not occupied by the pimay uses. We assume that both the goups (uses 1 and jammes) ae self-coodinated, i.e., they do not jam each othe within the goup. Also, the pimay uses do not jam the seconday uses. We assume that the jammes have no pio knowledge of the specific channels that ae being used by the egula uses. Even if they come to know about the channel that a egula use is using and ty to jam it, it is not necessay that the egula use will continue to use the same channel. In fact, all egula uses employ eithe a poactive o eactive appoach towads channel hopping. A jamme andomly selects a channel and uses its maximum tansmit powe to jam. We intend to obtain the statistical distibution of jamming powe fom a single jamme that a use expeiences. Then, we will find the expected total jamming at the use fom multiple jammes. To obtain the jamming powe distibution, we use the following assumptions and definitions. 1. All uses and jammes have omnidiectional tansmit and eceive antennas of the same gain. 2. The eceiving distance fom which a use can coectly ecove a tansmitted signal is R T. 3. The intefeence distance R I is defined as the maximum distance fom which a eceiving use can sense a caie. 4. R 0 is the minimum distance between two uses/jammes, i.e., no two uses/jammes could be with a distance of R 0 of each othe. 5. The jammes do not employ tansmit powe contol. Rathe, they use the maximum possible powe to cause maximum damage. If a jamme jams multiple channels, it distibutes the maximum powe equally ove all the channels. Fig. 1 shows use i as the use unde consideation. Use i can coectly decode any tansmission that lies with R T, i.e., its intended tansmitte (say j 2 ) must be within R T. Howeve, use i can be jammed by any jamme (say j 1 ) that lies within R I. The commonly used notation is shown in Table 1. Some of the tems will be defined late Jamming powe distibution Let us compute the pobability density function of the jamming signal fom a jamme that lies within distance R I fom eceive i. If R 0 is the minimum distance between two active nodes, then we can wite the cumulative distibution function (cdf) of the tansmitte eceive distance d, with unifomly andom distibuted jamme as well as egula nodes, as = d2 2 R 0 in (R F D (d) R 2 2 0, R] R 0 (1) = 1 d > R = 0 d R 0, 1 We use the wod use to efe to seconday use.

4 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 1. Intefeence model of jammes. Table 1 Notation. Symbol n m N j ρ n ρ m R T R R I R 0 N tot N M P t k Meaning Numbe of egula nodes Numbe of jamming nodes Expected numbe of jammes fo any node Density of egula nodes Density of jamming nodes Receiving distance of a node Maximum sensing ange Intefeence distance of a node Minimum distance between two nodes Total numbe of channels Numbe of channels at the uses side Numbe of channels at the base station side Total tansmit powe budget of a jamme Numbe of channels a jamme decides to attack whee andom vaiable (RV) d anges fom R 0 though R, whee R is the maximum sensing ange. Note that R T R I R. Thus the coesponding pobability density function is 2d = in (R f D (d) R 2 0, R] R 0 = 0 elsewhee. (2) We know that the eceived powe P at node i decays with the distance fom the jamme, i.e., P d α, whee α is the path loss exponent. If we define RV y d α, then the cdf of y is = 1 F D y 1 α in (R α, R α ] 0 F y (y) = 1 y R α (3) α = 0 y < R 0. Putting d = y 1 α 2α +1 f y (y) = 2y α(r 2 R 2) 0 in the cdf and diffeentiating with espect to y, we get in (R α, R α 0 ] = 0 elsewhee. Since the eceived powe vaies invesely with d, we define the distibution of eceived intefeence powe p,ji at node i due to a paticula jamme j with a fixed tansmit powe P t as p,ji = P t d α ji, R 0 < d ji R I. (4) (5)

5 576 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Now, P t being constant, p,ji is a RV in the inteval (P t R α I, P t R α 0 ). Thus the pobability distibution function (pdf) of the eceived jamming intefeence powe is given by 2p 2α +1 α = f p,ji (p ) αp 2α P tri p < P t R +1 α 0 t (R 2 I R 2) (6) 0 = 0 elsewhee. Similaly, we can obtain that the distibution of the eceived powe at node i due to a legitimate tansmitte T located within a distance of R T fom i is given by p,ti = P t d α Ti, R 0 < d Ti R T. The coesponding pdf of the intended eceived powe at node i fom legitimate tansmitte T is 2p 2α +1 α = f p,ti (p ) αp 2α in P trt p < P t R +1 α 0 t (R 2 T R2) 0 = 0 elsewhee. (7) (8) 3.3. Jamming powe distibution ove multiple channels Though concentating on a single channel could be vey effective, the jamme s success is based on the odds of selecting a channel that is in use by a egula node. To incease its chances of success, a jamme might decide to distibute its tansmit powe budget among multiple andomly selected channels. This appoach of equal powe patial band spoofing [17] has poved to be vey effective when the geogaphical distibution and the in-use channels of the egula nodes ae unknown to the jammes. Of couse, the dawback of such powe distibution could lead to insufficient intefeence powe on a channel that is indeed being used by a egula node. Since the jammes collaboate, we assume that all the jammes distibute thei powe equally ove a fixed set of channels and einfoce the intefeence powe on each channel fom vaious jamme locations. Fom a egula node s pespective, the jamming powe it expeiences on any channel (if it uses one of the jammed channels) is due to the jammes that ae within its intefeence ange R I. Thus, the expected numbe of such jammes is given by N j = πr 2 I ρ m πr 2 0 ρ m, whee ρ m is the density of the jammes, i.e., numbe of jammes pe unit aea. Note that the distibution obtained in Eq. (6) is due to a single jamme. To get the distibution of the total jamming powe, we have to add the eceived powe fom N j jammes. Thus, the total jamming powe is S Nj = p 1 + p p Nj. We can safely assume that the andom vaiables p 1, p 2,..., p Nj ae independent and identically distibuted (i.i.d.). Hence, to obtain the density function of the total jammed powe, we can use N j -fold convolution since S Nj is the sum of N j i.i.d. andom vaiables [28]. Thus, the density function of S Nj is given by (9) (10) f SNj (p ) = (f p1 f p2 f pnj )(p ), (11) with f SNj (p ) having a suppot ove the inteval [N j P t R α I, N j P t R α 0 ]. 4. Infastuctued system model With the distibution of the jamming known, we poceed to popose an infastuctue fo communication that would allow the uses to evade the jamming to some extent. Though ou analysis in Section 3.2 was geneic, we conside an infastuctue mode fo the hieachy in which the uses ty to connect to a base station using feely available channels. This model could be thought of as an IEEE netwok that consists of a base station and multiple consume pemise equipment in a cell. We conside a netwok in which n uses communicate with a base station (BS) as shown in Fig. 2. Fo the sake of discussion, we assume that the numbe of available channels at the base station side is M. Howeve, it is possible that not all of the M channels ae available at the seconday uses side, and we denote the fequencies available at the uses side as N channels, whee M N. Given this scenaio, we ae inteested in finding what potions of the communication between the base station and the uses ae jammed given m jammes. It is to be noted that the jammes coodinate among themselves to launch collaboative attacks.

6 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 2. Infastuctue system model. Befoe we can calculate which channels ae jammed, we need to know how the jammes jam and how the uses defend. We conside slotted time, in which the uses and the jammes take actions in each of the equal-length time slots. A time slot is the minimum unit of time we conside in this analysis. 2 As fa as the jammes ae concened, at evey slot, the m jammes will choose m diffeent fequencies to jam and will change the jamming set at the next slot. This type of jamming is called sweeping. Fom the egula uses pespective, they have two ways to defend. Impetuous hopping. The uses, like the jammes, choose a new set of fequencies at evey slot, iespective of jamming. This is also called poactive hopping. Consevative hopping. The unjammed uses will stay at the fequencies fo the next slot, while the jammed uses choose a set of new unused fequencies that exclude the jammed ones. This is also known as eactive hopping. Futhe, we intoduce a hypegeometic-like distibution function f (x, y, z, u, v), which epesents the pobability that, in a finite population of x unique items, and its subset z, whee z x, two independent unifomly distibuted dawings of y and u in x and z espectively shae v common items. z z v x u v whee f (x, y, z, u, v) = x y u v x y z u y v, is the binomial coefficient. (12) 5. Jamming and anti-jamming spectum hopping In this section, we analyze the expected spectum availability ates with espect to vaious paametes. The spectum availability ate ψ is defined as the atio of available (unjammed) spectum to the total spectum fom the uses pespective. A lage spectum availability ate implies highe anti-jamming efficiency. Depending on whee the jamming occus in the system, the analysis consists of two scenaios, i.e., jamming the base station and jamming the uses Base station being jammed When the jammes jam the spectum at the base station, the jammes see M available fequencies, while thee ae N candidate fequencies that the uses access. Based on the anti-jamming hopping stategies, we have the following obsevations. 2 Channel access time and switch time in the time slot ae not in the scope of this pape.

7 578 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 3. Fou jammes and uses. (a) Jammes choose maximum powe to tansmit, (b) jammes choose modeate powe with modeate numbe of channels to jam, (c) jammes choose lowe powe with many channels to jam. Lemma 1. When the uses adopt the impetuous hopping stategy, the spectum availability ate ψ I = 1 min(m,n) i=0 f (M,m,N,n,i) i. N Sketch of Poof. The pobability of i fequencies being jammed can be modeled using function f (). The poblem is to find the pobability that the two dawings shae i unique fequencies, given fequency dawings m fom M and n fom N. The pobability, which can be expessed as f (M, m, N, n, i), shows the pobability of jamming i channels. The summation ove i [0, min(n, m)] is the total pobability of jamming. To model the consevative hopping stategy, we constuct a Makov chain. Let state i be the state when i fequencies ae jammed. We assume that, when the consevative hopping stategy is adopted, in the next slot, j fequencies will be jammed. The tansitions ae chaacteized by pobability p ij, which futhe constuct a tansition matix P(p ij ). It is natual that this Makov chain is egodic, so the steady-state distibution = lim n P n, whee (π i )P = (π i ). The next lemma shows how to obtain the elements in the tansition matix and calculate the spectum availability ate. Lemma 2. When the uses adopt the consevative hopping stategy, the spectum availability ate ψ C = 1 tansition pobability p ij = j f (M, m, N i, n i, k)f (M k, m k, N n, i, j k). k=0 i iπ i N, and the Sketch of Poof. Conside the case when i fequencies ae jammed, and the hoppings by both uses and jammes esult in j fequencies being jammed. Fom the stategy desciption, i uses will choose fom a candidate fequency set of size N n M. Assume that, in the next slot, k of the n i uses that do not hop ae jammed. The pobability of jamming is given by f (M, m, N i, n i, k). Next, among the emaining i uses that hop, a total of j k uses ae jammed by a total of m k jammes. The fequency spaces fo both jammes and uses shink to M k and N n, espectively. Thus, the pobability of j k jamming in i hopping uses is f (M k, m k, N n, i, j k). The boundaies fo vaiable k ae jointly given by k [0, j] and the equiement of the binomial coefficient is that x y Uses being jammed When the jammes ae in the vicinity of the uses, the spectum they sense is almost the same as what the uses can access. Thus, the spectum space fo them to attack is educed to N. Theefoe, the spectum availability ates is the same as when the jammes ae at the base station, except fo eplacing M by N. In paticula, the spectum availability ate when the uses adopt the impetuous hopping stategy is ψ (U) I = 1 min(m,n) i=0 f (N, m, N, n, i) i, N and the spectum availability ate when the uses adopt the consevative hopping stategy is ψ (U) C obtained using the tansition pobability p (U) ij = j f (N, m, N i, n i, k)f (N k, m k, N n, i, j k). k=0 = 1 i iπ i, whee π N i is We will show the diffeence between the two cases in Section 7.1. When the total tansmit powe of the jamme is a constaint, the jamme can choose to jam a single channel o multiple channels. A jamming powe distibution on multiple channels implies moe channels being jammed i.e., as if thee ae additional jammes. Of couse, with multiple channels, the jamming ate is high, but the coveage is less. An illustative example is shown in Fig. 3, whee thee diffeent tansmit powes ae employed by the fou jamming nodes fo the same

8 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) geogaphical distibution of the jammes and the uses. The jammes ae shown using the solid dots and the uses ae shown using the non-solid dots. In case (a), the jammes tansmit with the maximum powe (P t ), each jamming only one channel but able to each most of the uses. In case (c), the jammes choose to distibute the powe to many channels, theeby only being able to each vey few uses but with a high pobability of jamming those uses. Clealy, thee is a tade-off, which is shown by case (b) Jamming tade-off A jamme can cove the maximum aea when it chooses to use the entie powe budget on a single channel. We have aleady denoted this maximum jamming distance as R I. Fom a use s pespective, any jamming fom beyond R I will have no impact. Thus, we can define the use eceive sensitivity, p sen, as the minimum jamming powe that affects it. In othe wods, any eceived powe that is less than p sen will have no jamming consequence. Thus, we can define the eceive sensitivity as p sen = P t R α I. Instead of focussing on a paticula channel, a jamme might choose to distibute the total powe budget on a subset of k channels so as to incease its chances of jamming a use. Such distibution of powe on k channels deceases the tansmit powe on each channel by a facto k, i.e., the tansmit powe fo each channel is P t, which in tun educes the coveage k distance fo the jamme. If we define R I,k as the coveage adius when the total powe is distibuted ove k channels, then it can be shown that 1 Pt /k α R I,k =. (14) p sen With R I,k as the intefeence ange, the expected numbe of uses that a jamme can taget on a paticula channel is N i = πr 2 I,k ρ n πr 2 0 ρ n, whee ρ n is the density of the uses Bound on the numbe of channels attacked (k) Though inceasing k means attacks on moe channels, it necessaily means less jamming powe to the uses. Note that it does not make sense fo the jammes to use a tansmit powe less than p sen. If k max is the maximum numbe of channels chosen to be attacked and P t /k max is the tansmit powe on each, then the jamme has to ensue that P t /k max R α 0 p sen, as R 0 is the closest a jamme could be to a use. Thus, we get (13) (15) (16) k max = P t p sen R α 0. (17) Pobability of jamming With the total powe distibuted ove k channels, we get the modified pdf (fom Eq. (6)) of the eceived jamming powe at any node i as 2α 2(p k f p,ji k (pk) = ) +1 Pt α(p t /k) 2α +1 (R 2 I,k R2) k R α I 0 = 0 elsewhee. p k < P t k R α 0 The sum of the eceived powe on channel k fom N j,k jammes is S k N j,k = p k 1 + p k p k Nj,k, whee N j,k = πr 2 I,k ρ m πr 0 ρ m is the modified numbe of jammes aound the vicinity of any egula node, with powe distibuted jamming stategy. Likewise, we can modify the density function fo the sum of the eceive powe as f S k N j,k (p k ) = (f p k 1 f p k 2 f p k N j,k )(p k ), with f S k N j,k (p k ) having a suppot ove [N j,k P t k R α I, N j,k P t k R α 0 ]. Now, the jamming will be effective if the total powe is geate than p sen. The pobability that the total eceived powe is moe than p sen is given by P(S k N j > p sen ) = Nj P t /k p sen f S k N j (p k ). (18) (19) (20) (21)

9 580 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 4. Coopeative defense among legitimate uses. Each jamme can jam one channel at a time. 6. Anti-jamming though coopeation Fom the pevious section, it is intuitive that the jammes can collaboate to jam a set of fequencies the moe jammes thee ae, the moe fequencies thee ae that can be jammed. Nonetheless, it is possible that some of the communication can suvive fom such attacks as long as the numbe of jammes is less than the numbe of available fequencies. This motivates us to exploe ways by which the uses can coopeatively exploit the unjammed fequencies. Coopeative communication [20,21] is one of the methods to chaacteize the means of coopeation between diffeent tansmitting entities in a wieless netwok. Coopeative communication is based on the idea that single-antenna uses in a multi-use scenaio can shae thei antennas in such a way that ceates a vitual multiple-input multiple-output (MIMO) system. With the help of the vitual MIMO system, all the uses can take advantage of the time, fequency, and space divesities to impove communication capacity, speed, and pefomance. In ou scenaio of combating the jammes, the fequency and space divesities of channel availability enable the uses to aggegate thei communication with the BS on the unjammed fequencies and elay infomation coopeatively Coopeation among legitimate uses Fo the time being, let us assume that the N available fequencies at the use end do not ovelap with the M fequencies at the base station side. Using the N fequencies, the uses can communicate among themselves. As shown in Fig. 4, we divide the n uses into two categoies: poxy uses (poxies) and followe uses (followes). The poxy uses act as elays between the followes and the BS that add anothe laye in the communication hieachy. Instead of connecting to the BS diectly, the followes connect to poxies fist and elay the infomation though poxies to the BS. The set of poxies can be eithe pe-selected o dynamically updated as long as thei identities ae evealed to all the followes. The coopeation among the uses woks in thee steps. Fist, the followes connect to the poxies and stoe the infomation to be sent to the BS at the poxies. Then, the poxies connect to the BS and act as elays fo the followes. Last, the poxies elay the infomation fom the BS back to the followes. Due to the boadcast natue of wieless communication, the poxies and followes must have an ageed sequence of hopping fequencies. With h poxies and n h followes, the followes take tuns to access the fequencies in goups of h. Each of the poxies listens to one fequency at a time. Afte n h iteations, each of the h poxies listens to each of the followes only once. Afte the communication between poxies and the BS, the poxies boadcast to the followes at h fequencies each time, and iteate ove available fequencies h times so that each followe can hea at least once. The connections among uses can be modeled with a fully connected bipatite gaph of h(n h) edges. Fo the m jammes, when the legitimate uses coopeate, the jammes will need to jam both the poxies and the followes. Let us assume that l of the jammes ae assigned to jam the communications between the poxy uses and the BS. The emaining of m l jammes ae esponsible fo jamming communications between followes and poxies. We take one communication cycle (i.e., one complete infomation exchange pocess between a followe use and the BS) as an example to analyze the channel availability ate. In the fist phase, the n h followes connect to h poxies in goups of h. All of the followe and poxy pais select unique channels out of the N available channels, since we assume that the uses collaboate. The m l jammes ae awae of the N available fequencies and ty to jam the communications. Since the poxies and followes agee on a sequence of

10 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) channel hopping, it can be viewed as the legitimate uses ae defending using impetuous hopping. The spectum jamming ate φ, which is defined as 1 ψ (spectum availability ate), can be deived fom Lemma 1. Fo a paticula followe, the communication between it and the poxy is unjammed as long as it connects to one of the k poxies successfully. The jamming ate can be expessed as φ 1 = (1 ψ I ) h = min(m l,n h) i=0 h f (N, m l, N, n h, i) i. (22) N In the second phase, the poxies talk to the BS on behalf of the followes. In this setting, l jammes ty to jam the bidiectional communication between h poxies and one BS, given M available fequencies. Accoding to ou analysis above, the jamming ate is φ 2 = 1 ψ I = min(l,h) i=0 f (M, l, N, h, i) i N. (23) Finally, afte the poxies successfully communicate with the BS, they elay the communication back to the followes. This pocess is the evese of the fist phase, whee h poxies ae tansmittes and n h followes ae eceives. Each of the poxies will ty to connect to each of the followes once. Due to the boadcast natue of the communication, multiple followes may connect to the same poxy at a time. Theefoe, when m l jammes ae pesent, the jamming ate is given as φ 3 = (1 ψ I ) h = min(m l,h) i=0 h f (N, m l, N, h, i) i. (24) N When we combine the thee phases, we can obtain the total spectum jamming ate with coopeative uses as φ = 1 (1 φ 1 )(1 φ 2 )(1 φ 3 ). (25) 7. Numeical and simulation study In this section, we show the effect of collaboative attacks on spectum availability ates. We also show how collaboative defense can be employed to counte such attacks Effect of collaboative attack We study how the spectum availability ate changes with diffeent paametes. A geneal obsevation is that consevative hopping (CH) povides moe spectum availability ate than impetuous hopping (IH). We implement a simulato based on C++ to lean the jamming popeties. Duing each ound, both the jammes and the uses choose a andom fequency fom a set of available fequencies known only to thei own goup. This ensues that none of the jammes o uses will jam within thei goup. A total of 10,000 ounds ae simulated. Fig. 5 epesents the simulation and analytical esults fo diffeent values of M, n, and m. The plots suggest a good match between the spectum availability ate deived fom ou modeling and that obtained fom the simulation. In addition, the figue shows that inceasing M impoves the spectum availability ate when the spectum size at the use side (N) is fixed. Fig. 6 is obtained when the numbe of uses is fixed and the numbe of attackes vaies. It clealy shows that the spectum availability ate deceases when moe attackes ae pesent in the netwok. It is obseved in Fig. 7 that the spectum availability ate inceases with inceasing N. Togethe with Fig. 5, this indicates that, when thee ae moe attackes than uses in the netwok, the spectum availability ate dops. The jamming at the use side is illustated in Fig. 8 with the same settings as in Fig. 7. The eason why the spectum availability ate deceases when jamming is at the use side is due to the educed spectum space the attackes can sense. Since the jammes know exactly what candidate fequencies ae available to the uses, the jamming is moe likely to be successful Collaboative defense Just as the attackes collaboate, we let the uses collaboate so that they can coopeatively fom a tie to avoid jamming. We study the spectum availability ate and compae with the pefomance of impetuous hopping (IH) stategy.

11 582 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 5. Spectum availability ate vesus M. Fig. 6. Spectum availability ate vesus m. A geneal obsevation made fom Figs. 9 and 10 is that, when uses coopeate, the spectum availability ate (ψ) is significantly geate than with the IH stategy. The obsevation indicates that coopeation can effectively educe the jamming pobability and impove the goodput of the netwok. When M and N incease, the spectum availability ate also inceases. This popety, which is same as ou obsevations in Figs. 5 and 7, shows the netwok pefomance gain fom a lage pool of available fequencies. It can be noted that, in Fig. 9, we only conside M N, as stated in the system model. Figs. 13 and 14 show some tade-offs between the numbe of jammes at diffeent locations. In Fig. 13, when moe jammes ae placed at the BS side, a decease of poxy uses will yield bette spectum availability ate, because it educes the pobability of poxy uses getting jammed. Fig. 14 suggests that, when a lage numbe of jammes ae pesent at the BS side, fewe poxies help incease the pefomance. Howeve, fom the jammes pespective, with the incease in poxies, moe jammes should be placed at the BS side Effect of jamming tade-off We study the tade-offs between numbe of nodes affected and the pobability of thei channels being jammed when a jamme distibutes the powe ove k channels. We define the attack utility poduct as the poduct of the numbe of channels jammed at each node and the numbe of nodes affected. We obseve that, while thee is an incease in the pobability of

12 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 7. Spectum availability ate vesus N. Fig. 8. Spectum availability ate when jammes ae at the use side. jamming of a single node, as k inceases, the numbe of uses affected by the jamme educes exponentially. We show the exponential eduction in numbe of nodes affected by a jamme in Fig. 11 fo diffeent values of α. We obseve a taget numbe of nodes of less than 7 if the numbe of channels attacked is moe than 10, fo α = 4. The high numbe of tagets nodes fo lowe values of α is evident, as fo lowe path loss exponent a signal fom the jamme eaches moe uses, but fo highe values of α we see a dop in the numbe of taget nodes. Next, we show the attack utility poduct, which we obseve to incease with incease in k in Fig. 12. We obseve that thee is significant linea incease in the attack utility poduct when the numbe of channel attacked by the distibuted powe budget inceases with k. 8. Discussions In this section, we show qualitatively the tade-offs between goodput and latency, and then we ague that scanning attacks ae special cases of sweeping attacks Goodput vesus latency When all the legitimate uses diectly connect to the BS, the uses can only exploit the fequency divesity. If the BS has multiple eceives, all the communication can be pefomed concuently, which minimizes the latency incued.

13 584 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 9. Spectum availability ate vesus M, when uses coopeate. Fig. 10. Spectum availability ate vesus N, when uses coopeate. Howeve, fom ou study, such diect communication suffes fom low spectum availability ates; thus the goodput is compomised. When the legitimate uses coopeate with each othe, communication is divided into ties. Fom the jammes pespective, they must also be divided into goups to jam communications between diffeent ties. Since a followe use can communicate with all the poxies at diffeent times, leaving duplicated copies of infomation on each of the poxies, communication obustness and goodput is geatly enhanced. In this case, it becomes hade fo the jammes to jam. Nonetheless, the dawback is the latency incued fom the duplicated communication. In ou example above, if we elax the assumption of N and M being mutually exclusive, n h + h = n exta time slots ae needed to pefom the infomation exchange among ties. The tade-off between goodput and latency can also lead to optimized design in CRNs. Depending on the equiements of the application, vaious paametes (e.g., coopeation vesus IH/CH, value of h) of the defending schemes can be set which yield diffeent goodput and latency pefomance.

14 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 11. Numbe of nodes affected ove channels attacked. Fig. 12. Attack utility poduct ove channels attacked Scanning attack vesus sweeping attack In ou analysis, we assume that the jammes use a sweeping attack, i.e., jamming the channel iespective of channel activity. Anothe type of jamming attack is a scanning attack [22]. In a scanning attack, the attackes fist take a constant time to sense the channel to detemine channel activity. The jamme will only jam the channel if it finds the channel having legitimate activity; othewise, it will hop to sense anothe channel until it finds a taget channel to jam. A scanning attack diffes fom a sweeping attack, and the jammes can apidly switch to a channel with legitimate communication if the scanning is sufficiently fast. Nonetheless, the uses can coopeatively use backgound communication ove unused fequencies to cove the intended communication. Fo examples, in ou discussion in Section 6.1, when the followe uses ae not taking thei tuns to connect to the poxies, they can mimic legitimate communication to occupy some cuently unused fequencies. Fom the jammes pespective, they ae deceived to jam those coveing fequencies, leaving the intended communication fequencies unjammed. If we have λ intended communication fequencies, µ coveing fequencies, and γ jammes, when the jammes scan and attack, it is equivalent to γ jammes sweeping and attacking ove

15 586 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) Fig. 13. Spectum availability ate vesus l. M = 20, N = 15, m = 8, n = 5. Fig. 14. Spectum availability ate vesus k. M = 20, N = 15, m = 10, n = 8. λ + µ fequencies on λ uses. Theefoe, a scanning attack can be egaded as a special case of a sweeping attack, and thus we can apply the same methods as we have shown with sweeping attacks to the analysis and defense of scanning attacks. 9. Conclusions and futue wok In this pape, we analyze the distibution of the jamming signals and study collaboative jamming attacks in cognitive adio netwoks. We deive the distibution of the total jamming powe a paticula use is likely to expeience with a collaboative jamming stategy by the jammes. We take the anti-jamming hopping stategy as an example and deive the spectum availability ates when the uses apply diffeent hopping stategies to defend themselves. We futhe popose a coopeative defense stategy which goups the uses into ties in ode to take advantage of the tempoal and spatial divesity. Based on the analysis, we conduct a numeical evaluation. The esults illustate that the spectum availability ate inceases with the total spectum at the base station and the spectum available to the uses, while it deceases when moe attackes/jammes ae pesent. When coopeation is assumed among the uses, the spectum availability ate can be

16 W. Wang et al. / Pevasive and Mobile Computing 9 (2013) geatly impoved. Howeve, the pefomance gain which infes bette goodput is coupled with an incease in communication latency. Though the pefomances of the poposed stategies have been evaluated numeically and though simulations, it would be inteesting to see how these stategies would fae when implemented in eal systems. Recent advances in cognitive adio hadwae pototypes using FPGA [23] and an open-souce softwae suite on commodity hadwae [24] would allow such implementations. In paticula, cognitive adio nodes can be pogammed to sense the channel and switch fequencies accoding to complex algoithms [25]. Futue investigations can take advantage of such technologies and deploy a cognitive adio testbed consisting of nodes simulating both jamme and legitimate use behavio. Testbeds can be used to validate and undestand the pefomance and effectiveness of any anti-jamming stategies. Futhe, a public esouce fo cognitive adio netwoks, e.g., Micosoft KNOWS [26], could be made use of, as that would povide a common platfom to compae vaious popositions. Othe wothwhile effots would be to conside moe ealistic channel/link emulation o simulation setup, e.g., using the famewok of NS3 [27], that would allow a compehensive softwae benchmak fo the evaluation of jamming and collaboative defense mechanisms in cognitive adio netwoks. Refeences [1] I.F. Akyildiz, W.Y. Lee, M.C. Vuan, S. Mohanty, Next geneation/dynamic spectum access/cognitive adio wieless netwoks: a suvey, Compute Netwoks 13 (2006) [2] A. Sampath, H. Dai, H. Zheng, B.Y. Zhao, Multi-channel jamming attacks using cognitive adios, in: IEEE ICCCN 2007, pp [3] T.X. Bown, A. Sethi, Potential cognitive adio denial-of-sevice vulneabilities and potection countemeasues: a multi-dimensional analysis and assessment, Mobile Netwoks and Applications 13 (2008) [4] W. Xu, W. Tappe, Y. Zhang, T. Wood, The feasibility of launching and detecting jamming attacks in wieless netwoks, in: ACM Mobihoc 2005, pp [5] S. Khattab, D. Mossé, R. Melhem, Jamming mitigation in multi-adio wieless netwoks: eactive o poactive? in: IEEE/ICST SecueComm [6] W. Xu, W. Tappe, Y. Zhang, Channel sufing: Defending wieless senso netwoks fom jamming and intefeence, in: IEEE IPSN 2007, pp [7] L. Lazos, S. Liu, M. Kunz, Mitigating contol-channel jamming attacks in multi-channel ad hoc netwoks, in: ACM WiSec 2009, pp [8] P. Tague, M. Li, R. Poovendan, Mitigation of contol channel jamming unde node captue attacks, IEEE Tansactions on Mobile Computing (9) (2009) [9] A. Chan, X. Liu, G. Noubi, B. Thapa, Contol channel jamming: esilience and identification of taitos, in: IEEE ISIT 2007, pp [10] M. Stasse, C. Poppe, S. Capkun, M. Cagalj, Jamming-esistant key establishment using uncoodinated fequency hopping, in: IEEE Symposium on Secuity and Pivacy 2008, pp [11] T. Jin, G. Noubi, B. Thapa, Zeo pe-shaed secet key establishment in the pesence of jammes, in: ACM MobiHoc, 2009, pp [12] C. Poppe, M. Stasse, S. Capkun, Jamming-esistant boadcast communication without shaed keys, in: USENIX Secuity Symposium [13] Z. Jin, S. Anand, K.P. Subbalakshmi, Mitigating pimay use emulation attacks in dynamic spectum access netwoks using hypothesis testing, ACM SIGMOBILE Mobile Computing and Communications 13 (2) (2009) [14] R. Chen, J.M. Pak, J.H. Reed, Defense against pimay use emulation attacks, in: Cognitive Radio Theoy and Applications, IEEE Jounal on Selected Aeas in Commun 26 (1) (2008) (special issue). [15] Yi Tan, Shamik Sengupta, K.P. Subbalakshmi, Analysis of coodinated denial-of-sevice attacks in IEEE netwoks, IEEE Jounal on Selected Aeas in Communications 29 (4) (2011). [16] R. Chen, J.M. Pak, Ensuing tustwothy spectum sensing in cognitive adio netwoks, in: 1st IEEE Wokshop on Netwoking Technologies fo Softwae Defined Radio Netwoks, vol. 25, 2006, Sept. 2006, pp [17] Q. Peng, P.C. Cosman, L.B. Milstein, Optimal sensing disuption fo a cognitive adio advesay, IEEE Tansactions on Vehicula Technology 59 (4) (2010). [18] H. Li, Z. Han, Blind dogfight in spectum: combating pimay use emulation attacks in cognitive adio systems with unknown channel statistics, in: IEEE ICC 2010, pp [19] H. Li, Z. Han, Dogfight in spectum: jamming and anti-jamming in multichannel cognitive adio systems, in: IEEE Globecomm 2009, pp [20] K.J.R. Liu, A.K. Sadek, W. Su, A. Kwasinski, Coopeative Communications and Netwoking, Cambidge Univesity Pess, [21] A. Nosatinia, T.E. Hunte, A. Hedayat, Coopeative communication in wieless netwoks, IEEE Communications Magazine 42 (10) (2004) [22] A.D. Wood, J.A. Stankovic, G. Zhou, DEEJAM: defeating enegy-efficient jamming in IEEE based wieless netwoks, in: IEEE SECON 2007, pp [23] S.M. Misha, D. Cabic, C. Chang, D. Willkomm, B. Van Schewick, A. Wolisz, R.W. Bodesen, A eal time cognitive adio testbed fo physical and link laye expeiments, in: IEEE DySpan 2005, pp [24] A. Gonzalez, C.R., C.B. Dietich, S. Sayed, H.I. Volos, J.D. Gaeddet, P. Max Robet, J.H. Reed, F.E. Kagh, Open-souce SCA-based coe famewok and apid development tools enable softwae-defined adio education and eseach, IEEE Communications Magazine 47 (10) (2009) [25] S. Sengupta, K. Hong, R. Chandamouli, K.P. Subbalakshmi, SpideRadio: a cognitive adio netwok with commodity hadwae and open souce softwae, IEEE Communications Magazine 49 (3) (2011) [26] Y. Yuan, P. Bahl, Ranvee Chanda, P.A. Chou, I. Feell, T. Mosciboda, S. Nalanka, Y. Wu, KNOWS: cognitive netwoking ove white spaces, in: IEEE DySpan 2007, pp [27] ns-3, [28] V.A. Dobushkin, Methods in Algoithmic Analysis, CRC pess, 2010.