Estimating the Relative Speed of RF Jammers in VANETs

Transcription

1 LATEST VERSION 01/01/2019 AT 03:00:11 1 Estimating the Relative Speed of RF Jammers in VANETs Dimitrios Kosmanos, Antonios Argyriou and Leandros Maglaras arxiv: v1 [s.cr] 31 De 2018 Abstrat Vehiular Ad-Ho Networks (VANETs) aim at enhaning road safety and providing a omfortable driving environment by delivering early warning and infotainment messages to the drivers. Jamming attaks, however, pose a signifiant threat to their performane. In this paper, we propose a novel Relative Speed Estimation Algorithm (RSEA) of a moving interfering vehile that approahes a Transmitter (T x) - Reeiver (Rx) pair, that interferes with their Radio Frequeny (RF) ommuniation by onduting a Denial of Servie (DoS) attak. Our sheme is ompletely sensorless and passive and uses a pilot-based reeived signal without hardware or omputational ost in order to, firstly, estimate the ombined hannel between the transmitter - reeiver and jammer - reeiver and seondly, to estimate the jamming signal and the relative speed between the jammer - reeiver using the RF Doppler shift. Moreover, the relative speed metri exploits the Angle of Projetion (AOP) of the speed vetor of the jammer in the axis of its motion in order to form a two-dimensional representation of the geographial area. This approah an effetively be applied both for a jamming signal ompletely unknown to the reeiver and for a jamming signal partly known to the reeiver. Our speed estimator method is proven to have quite aurate performane, with a Mean Absolute Error (MAE) value of approximately 10% ompared to the optimal zero MAE value under different jamming attak senarios. I. INTRODUCTION Autonomous vehiles, apable of navigating in unpreditable real-world environments with little human feedbak are a reality today [1]. Autonomous vehile ontrol imposes very strit seurity requirements on the wireless ommuniation hannels that are used by a fleet of vehiles [2],[3]. This is neessary in order to ensure reliable onnetivity [4]. Moreover, the Intelligent Vehile Grid tehnology, introdued in [5], allows the ar to beome a formidable sensor platform, absorbing information from the environment, other ars, or the driver, and feed it to other vehiles and infrastruture so as to assist in safe navigation, pollution ontrol and traffi management. The vehile grid essentially beomes an Internet of Things (IoT) for vehiles, namely the Internet of Vehiles (IoV), that is apable of making its own deisions when driving ustomers to their destinations [6]. Wi-Fi has beome essential for the operation of a modern vehile [7]. Wireless ommuniations, however, being vulnerable to a wide range of attaks [8]. A RF jamming attak onsists of radio signals maliiously emitted to disrupt Corresponding author: D. Kosmanos ( dikosman@uth.gr). D. Kosmanos and Antonios Argyriou are in the Department of Eletrial & Computer Engineering, University of Thessaly, Volos, Greee L. Maglaras is in the Department of Computing Tehnology, De Montfort University, Leiester, UK. legitimate ommuniations. Suh jamming is already known to be a big threat for any type of wireless network. With the rise in safety-ritial vehiular wireless appliations, this is likely to beome a onstraining issue for their deployment in the future. A subategory of the jamming attaks is the Denial of Servie (DoS) Attak, whih is targeting to the availability of network servies. Of speial interest are the mobile jammers, whih impose an added strain on vehiular networks (VANETs). Thus, the aurate predition of the behavior of the jammer suh as its speed, beomes ritial for providing a swift reation to an attak. In this work, we propose a novel metri that aptures the relative speed between the jammer (Jx) and the reeiver (Rx). We also propose the Relative Speed Estimation Algorithm (RSEA) that is a ompletely sensorless and passive estimation method that uses pilot-based reeived signals at the reeiver in order to, firstly, estimate the hannel between the transmitter-reeiver and jammer-reeiver, seondly the jamming signal and thirdly, to estimate the relative speed between the jammer-reeiver using the RF Doppler shift property. This is the first work in the literature, aording to our knowledge, that proposes an algorithm for speed estimation of maliious RF jammers. Problem Statement: In addition to RF jamming, wireless ommuniation between a transmitter (T x) and a reeiver (Rx) an be impaired by unintentional interferene and multiple aess ontrol (MAC) protool ollisions. Jammers an exhibit arbitrary behavior in order to disrupt and thwart ommuniation with a form of Denial of Servie (DoS) attak [9]. In the general ase, RF jamming redues the reeiver signal to interferene and noise ratio (SINR), a problem that an be addressed with lassi ommuniation algorithms. However, in several appliations it is ritial to detet aurately the presene of a jammer, i.e. the preise reason behind the redution in SINR, the paket-delivery-ratio (PDR), and more importantly, the nature of the attak. Consequently, it is diffiult to determine whether the reason for the SINR redution is an intentional jamming attak or unintentional interferene. The hallenge in deteting an RF jamming attak is that the information that is available for a jammer is typially minimal and derives from the useful signal possibly mixed with other types of arbitrary interferene in the area. Estimating the relative speed between a legitimate vehile and a jammer, we an onlude if a high interferene senario has been provoked intentionally with the form of a DoS attak by an attaker that approahes the vitim or has been provoked unintentionally by an area with signifiant RF interferene. Speifially, if the estimated relative speed metri is about 0, we an onlude that the jammer is moving with about the same speed with the

2 LATEST VERSION 01/01/2019 AT 03:00:11 2 Figure 1: The Network Topology in whih the orange vehile is the jammer that approahes the T x Rx pair from a AOP (θ) angle. This figure also inludes the multipath fading effets by a stati objet reeiver, having as result the jammer to approah the reeiver at some time instant. On the other hand, if the estimated relative speed gets a bigger quantity, we an onlude that the jammer is moving at quite different speeds than this of reeiver. Of partiular interest is the higher level behavior of a jammer, like its motion/movement relative to the T x - Rx pair. This information an be effetively utilized in order a moving DoS attaker to be lassified using Mahine Learning algorithms. Our solution: Using the jamming signal at the reeiver we estimate the relative speed metri () that is based on the differene or sum between the veloities of the jammer and the reeiver. This passively estimated metri also inludes information regarding the Angle of Projetion (AOP) of the jammed signal. Our sheme uses only the signal at the reeiver under the presene of a jammer to haraterize the behavior/motion of the jammer (if the Jx is approahing or moving away from the Rx) using the RF Doppler shift. We also adopt a pilot-based method for the hannel estimation between T x - Rx sine it is suitable for fast varying hannels, suh the VANETs, beause the hannel is diretly estimated by training symbols or the pilot tone that are known a priori to the reeiver. The ontributions of the paper are three-fold: A ompletely sensorless and passive pilot-based sheme is proposed that is based on RF ommuniation between T x Rx being interfered by a jammer in the area. However, we do not apply the proposed RSEA for estimating only speed of T x [10]. We try from this point-to-point ommuniation to gather as muh information as possible regarding jammer s behavior, suh as all the ombined multipath hannels among T x, Rx, Jx, jammer s relative speed value and the jamming signal; In addition, the proposed relative speed metri defines physial loation features, beause is ombined with the AOP of the jammer; The effetive usage of the estimated relative speed for a future jamming detetion algorithm is outlined; It has to be highlighted that the proposed RSEA an also be applied with a ompletely unknown jamming signal, in the ase where the T x sends more pilot symbols to the Rx than the sum of the number of different unknown to the reeiver jamming symbols being sent by the jammer with the speifi value of parameter 2N, whih is the double number of multipath rays in the area for the estimation of both two hannels between T x Rx and Jx Rx. The rest of this paper is organized as follows: Setion II presents the related work, whilst Setion III analyzes the network topology, the system model analysis and the wireless hannel model. Setion IV presents the loation aware relative speed metri and Setion V analytially desribes the proposed RSEA. Setion VI presents the experimental evaluation of the proposed RSEA and provides omparison between different senarios. Finally, Setion VIII onludes the paper and gives some diretions for future work. A. RF Jamming II. RELATED WORK RF jamming has been extensively studied in the ontext of lassial networks without aounting for the partiularities of ar-to-ar ommuniations. Besides the differenes in PHY design of p ompared to other amendments, the propagation onditions of VANET are fundamentally different due to the highly dispersive and rapidly hanging vehiular environment. A lot of kinds of jamming attaks has been studied in VANETs [11]. The two most important kinds of jamming attaks are the onstant jamming and the reative jamming. Constant jamming transmits random generated data on the hannel without heking the state of the hannel (Idle or not). However, the reative jamming jams only when it senses ativity on the hannel otherwise it stays idle. In [12] observe that onstant, periodi, but also reative RF jammer an hinder ommuniation over large propagation areas, whih would threaten road safety. Reative jamming attaks reah a high jamming effiieny and an even improve the energy-effiieny of the jammer in several appliation senarios [13],[14]. Also, they an easily and effiiently be implemented on COTS hardware suh as USRP radios [15],[16],[17]. But, more importantly, reative jamming attaks are harder to detet due to the attak model, whih allows jamming signal to be hidden behind transmission ativities performed by legitimate users [16],[18],[19]. A different kind of attaks are the pilot-based attaks against OFDM and OFDMA signals [20]. These attaks seek to manipulate information used by the equalization algorithm to ause errors to a signifiant number of symbols. However, we do not evaluate this type of attak beause the point of interest of this paper is the DoS attaks that are targeting to availability and no to integrity. In order to be robust against pilot tone jamming attaks, OFDM and OFDMA systems must randomize their subarrier loations and values. For the mitigation of this type of RF jamming attak optimal power alloation with user sheduling are proposed under reative jamming in the area [21], utilizing also the tehnique of unoordinated frequeny hopping (UFH) [22]. UFH implies the ommuniation between transmitter and reeiver through a randomly hosen frequeny hannel unknown for both agents. In [23] in order the serey level of wireless networks under

3 LATEST VERSION 01/01/2019 AT 03:00:11 3 UFH to be haraterized, showing the harmful seurity effet of broadband eavesdropper adversaries apable of overhearing in multiple frequenies. To be ountered suh eavesdroppers, we onsider the use of broadband friendly jammers that are available to ause interferene on eavesdroppers. The goal is to ause as muh interferene as possible to eavesdroppers that are loated in unknown positions, while limiting the interferene observed by the legitimate reeiver. However, the information about the loation and speed of frienly jammers are ruial for the above UHF shemes. B. Loalization A lot of work has overed matters of loalization, whih is a fundamental hallenge for any wireless network of nodes, in partiular, when nodes are mobile. In [24] the relative positions and veloities (PVs) are estimated up to a rotation and translation of an anhor-less network of mobile network, given twoway ommuniation apability between all the nodes. A least squares based dynami ranging algorithm is proposed, whih employs a lassial Taylor series based approximation to estimate pairwise distane derivatives effiiently without the usage of Doppler shifts. In [25], authors propose a dual-level travel speed alulation model, whih is established under different levels of sample sizes. Wireless sensor networks (WSNs) are widely used to maintain the loation information and rely on the traking servie only when their loation hanges. In the proposed approah in [26], the problem of traking ooperative mobile nodes in wireless sensor networks is addressed with the Doppler shifts of the transmitting signal in ombination with a Kalman filter, by performing a onstrained least-squares optimization when a maneuver is deteted. In [27], authors suggest a method for joint estimation of the speed of a vehile and its distane to a road side unit (RSU) for narrow-band orthogonal frequeny-division multiplexing (OFDM) ommuniation systems. Spatial filtering and a Maximum Likelihood (ML) algorithm is developed for distane estimation. The vehile speed is alulated using a kinematis model based on the estimated distane and Angle of Arrival (AOA) values. C. Speed Estimation Another lass of papers proposes speed estimation systems that alerts drivers about driving onditions and helps them avoid joining traffi jams using multi-lass lassifiers. ReVISE in [28] proposes a multi-lass SVM approah that uses features from the RF signal strength. Using a similar method, MUSIC [29] is a subspae based AOA estimation algorithm that exploits the eigen-struture of the ovariane matrix of the reeived signals on a multi-signal lassifier. Covariane-based speed estimation shemes have also been used for the estimation of the maximum Doppler spread, or equivalently, the vehile veloity that, is useful for improving handoff algorithms [30]. The authors in [31] proposed an algorithm that employs a modified normalized auto-ovariane of reeived signal power to estimate the speed of mobile nodes. However, the above ovariane-based speed estimator utilizes orrelation lags to improve performane whih omes at the expense of omputational omplexity. In [32] an algorithm that estimates the speed of a mobile phone by mathing time-series signal strength data to a known signal strength trae from the same road is introdued. The drawbak of the orrelation algorithm is the observation that the signal strength profiles along roads remain relatively stable over time. However, the results are more aurate than previous tehniques that are based on handoffs or phone loalization. In [33] a method for the estimation of speed for mobile phone users using WiFi Signal-to-Noise Ratio (SNR) and timedomain features like mean, maximum, and auto-orrelation is proposed. Whilst in [34] two novel autoorrelation (ACF) based veloity estimators are used, without requiring knowledge of the SNR of the link. In all the prior work, speed estimators that have been proposed inlude training proedures in order to estimate traffi ongestion or other transportation performane metris using sensor measurements. However, speed estimation problem from wireless RF ommuniation due to seurity issues has been not widely investigated. Only, in [35] the authors try to estimate the AOA of the speular line of sight (LOS) omponent of signal reeived from a given single antenna transmitter using a predefined training sequene. The results show the optimality of the training based Maximum Likelihood (ML) AOA estimator in the ase of a randomly generated jamming signal. However, the drawbak of this ML- AOA estimator is that superior performane is subjet to the availability of a perfet CSI. On the ontrary, authors in [36] introdued a new algorithm to estimate the mobile terminal speed at base station in ellular networks. This helps BTS in estimating the hannel Doppler shift, using measured reeived signals at the Base Station (BS). The Doppler shift estimation algorithm is improved by utilizing a speed estimation window that slides over bursts with overlaps and by introduing two different low and high thresholds for power level omparisons. The performane of the proposed algorithm is modeled in a Terrestrial Trunked Radio (TETRA) network and the simulation has shown aeptable results for a wide range of veloities and jammers. However, there has been no prior work that ombines a feature of the physial loation, suh as the AOP of the Jx with its speed in order to estimate relative speeds of two moving vehiles (jammer - reeiver) during a jamming attak, using the hannel Doppler shift value. The great majority of the works have used speed estimation in order to improve handover algorithms between transmitter and reeiver under a typial miro-ellular system with nonisotropi sattering [10] and for alulating the optimal tuning of parameters for systems that adapt to hanging hannel onditions. Our proposed tehnique is the first in the literature, to the best of our knowledge, that uses the uniast ommuniation between T x and Rx for the predition of the jammer s speed and for future detetion of a jamming attak. III. SYSTEM-MODEL & PRELIMINARIES A. Network Topology We onsider uniast V2V ommuniation between transmitter and the reeiver and a point-to-point V2V ommuniation between a single jammer and the reeiver. This simple senario

4 LATEST VERSION 01/01/2019 AT 03:00:11 4 in a rural area is used for the initial verifiation of our system without high interferene of other vehiles. In this area, a stati obstale already exists that impats the ommuniation between T x Rx and Jx Rx. The jammer transmits wireless pakets/signals that may form a reative jamming signal. We assume that the T x Rx pair of vehiles in our model moves with a onstant speed for a period of time. This approah allows the modeling of platoons of vehiles that are formed by maintaining a onstant distane with eah other [1]. We assume that the jammer moves with a onstantly inreasing speed with the ultimate goal to approah the reeiver and intervene in the effetive ommuniation zone of the T x Rx pair. As it an be seen in the network topology of Fig.1, the distanes between Jx Rx in the y axis dy (Jx Rx) and in the x axis dx (Jx Rx) together with the atual distane between Jx Rx d (Jx Rx), whih is the hypotenuse of the retangular triangle that is formed. The motion of the vehiles in Fig.1 is haraterized by the speed vetors ( u Rx, u Jx, u Tx ). Only u Rx, u Tx have the same diretion, whih is the diretion of the x axis. The jammer approahes the T x Rx with an AOP (θ). So, the speed vetor of the jammer is projeted in the axis of the motion of vetor u Rx with an AOP (θ) Fig.2a. In this figure we also notie that the AOP (θ) is not equal to zero. Moreover, the angle that is formed between the speed vetor of the jammer u Jx, and the wireless signal that travels between the Jx and the Rx, is alled the Angle of Departure (AOD) and is denoted as φ in Fig.2. In Fig.2a the Line of Sight (LOS) omponent between Jx - Rx has a AOD (φ) equal to zero, while the non Line of Sight (NLOS) omponent between Jx - Rx has a AOD (φ), whih is different to zero in Fig.2b. B. System Overview In our system model, K known pilot symbols that ompose the symbol vetor x pilot = [x pilot (1)...x pilot (K)] T = [1...1] T are being sent over onseutive K time instants from the transmitter to the reeiver. At the same time, the jammer simultaneously transmits over onseutive K time instants K jamming symbols to the reeiver that ompose the symbol vetor s = [s 1...s K ] T. So we onsider the reeived vetor at the reeiver y = [y(1)y(2)...y(k)] T, whih onsists of the ombined symbols that the Rx reeives from the transmitter and the jammer at K onseutive time instants. Therefore, for every time instant n (0, K] the reeiver signal y(n) is the summation of the pilot symbol sent by the transmitter x pilot (n) and the symbol sent by the jammer s n. Using pilots, the LOS hannel and the N 1 NLOS hannels between Jx Rx are estimated by the reeiver. The reeiver an also define the speifi value of parameter N, whih is the total numner of multipath rays. The wireless hannel is assumed to be onstant for the duration of the transmission of the K pilot symbols from T x to Rx. C. Attaker Model We onsider jammers that aim to blok ompletely the ommuniation over a link by emitting interferene reatively when they detet pakets over the air, thus ausing a Denial of Servie (DoS) attak. The jammers minimize their ativity to only a few symbols per paket and use minimal, but suffiient power, to remain undeteted. We assume that the jammer is able to sniff any symbol of the paket over the air in real-time and reat with a jamming signal that flips seleted symbols at the reeiver with high probability (see [37]). The jammer is designed to start transmitting upon sensing energy above a ertain threshold in order a reative jamming attak to be sueed. We set the latter to 86dBm as it is empirially determined to be a good tradeoff between jammer sensitivity and false transmission detetion rate, when an ongoing p transmission is assumed. So, the symbol vetor s that reahes at the Rx from the Jx after K time instants has the same length as the pilot symbol vetor that reahes the Rx from the T x after K time instants, provided that the jammer transmits only when senses a transmission from the transmitter. Eah one of the K salar values depends on the used power by the jammer. The jammer ontinuously transmits with the same transmission power, with the purpose of overloading the wireless medium representing, thus a DoS attak [38]. This work assumes that when the jammer ontinuously transmits the same jamming symbol to the reeiver forming a simplified jamming signal of the form s = [f...f] T with length K and f a random unknown value to the reeiver. Furthermore, the proposed RSEA an operate with ompletely unknown jamming signals. This is possible when the T x sends more pilot symbols to the Rx than the sum of the different unknown jamming symbols being sent by the jammer. Reall that the main goal of this paper is to show how we an estimate the speed of an non-ooperative maliatious attaker that an eventually be used as extra useful information for the design of a RF jamming detetion shemes [39]. D. Channel Model Multipath is the propagation phenomenon that results in radio signals reahing the reeiving antenna by two or more paths. The multipath senario illustrated in Fig.1 inludes a stati obstale in order for the multipath effets to be onsidered in the ommuniation between T x - Rx and Jx - Rx. So, it exists the LOS omponent of the wireless signal being sent by the Jx, T x and also the NLOS omponent. In the NLOS omponent the AOP (θ) is not equal to zero and the AOD (φ) between the speed vetor of the jammer and the NLOS ray is also not equal to zero (see Fig.2b). The phenomenons of refletion, diffration and sattering due to the multipath give rise to additional radio propagation paths beyond the diret optial LOS path between the radio transmitter and reeiver. In our work, we adopt the Riian fading model, whih is a hannel model that inludes path loss and also Rayleigh fading [40]. When a signal is transmitted the hannel adds Riian fading. The Riian fading model is partiularly appropriate when there is a diret propagating LOS omponent in addition to the faded omponent arising from multipath propagation. The Riian hannel at time instant t is defined with the help of multiple NLOS paths, whih is similar to the Rayleigh fading hannel but with the addition of a strong dominant LOS

5 LATEST VERSION 01/01/2019 AT 03:00:11 5 omponent. Parameter q defines the hannel between T x Rx with q = 1 and the hannel between Jx Rx with q = 2. We define a omplex Gaussian random variable ζ G that is uniform over the range [0, 2π] and is fully speified by the variane σ 2 q. The Riian fading hannel an be defined with the help of this random variable as: k h q [t] = k + 1 σ qe j(2π/λ)(f+f d,max os φ q)τ q δ(t τ q ) k + k + 1 ζ G In the above equation, f is the arrier frequeny, f d,max is the maximum Doppler shift, φ q the inidene AOD between the vetor of speed u Jx with the vetor of the jamming signal, τ q = d/ is the exess delay time for the LOS ray that travels between the two ommuniating nodes in hannel h q, d orresponds to the distane between the two ommuniating nodes and t is the urrent time instant. The first term orresponds to the speular LOS path arrival and the seond, to the aggregate of the large number of refleted and the sattered paths. Parameter k is the ratio of the energy in the speular path to the energy in the sattered paths; the larger k is, the more deterministi the hannel is [41]. Finally, k (γ q = k+1 σ q) in (1) is the omplex amplitude assoiated with the LOS path, whih is known at the reeiver. Riian hannel model is often a better model of representing fading ompared to the Rayleigh model. The hannel response y after K onseutive symbols sent by the jammer and the transmitter is: y = N 1 l=0 (1) (h 1 [l] x pilot [N l] + h 2 [l] s[n l]) + w (2) In above equation, the y is a K 1 olumn vetor. Moreover, x pilot is the symbol vetor that the Rx reeives from the T x after K onseutive time instants and s is the symbol vetor that the Rx reeives from the Jx after K onseutive time instants again. The symbol vetors ( x pilot [N l], s[n l]) have the same values, as defined above, for the l different paths of the respetive hannels, where l (0, N 1]. The w represents the additive white Gaussian noise (AWGN) with zero mean. We assume, also, that the jammer and the transmitter send at very lose time instants their symbols at the reeiver, so that h 1, h 2 hannels an remain stable for sending K symbols. Moreover, N is the overall multipath rays in the area. For the estimation of this parameter, we use the GEMV simulator [42]. For desribing the modeled area GEMV uses the outlines of vehiles, buildings and foliage. Based on the outlines of the objets, it forms R-trees. R-tree is a tree data struture in whih objets in the field are bound by retangles and are hierarhially strutured based on their loation in spae. Hene, GEMV employs a simple geometry-based small-sale signal variation model and alulates the additional stohasti signal variation and the number of diffrated and refleted rays based on the information about the surrounding objets. We must note that the wireless RF ommuniation of the T x - Rx pair and the Jx - Rx pair is taking plae in a (a) LOS ray of Jx-Rx ommuniation with φ = 0, θ 0 (b) NLOS ray of Jx-Rx ommuniation with φ 0, θ 0 Figure 2: Illustration of projetions of veloities u Jx on the vetor v. Two-dimensional sheme speifi frequeny band, aording to the existing standard for automotive systems[7]. E. Transmission in the MAC/PHY Layer We assume single arrier ommuniation at the PHY. The p MAC also provides prioritized Enhaned Distributed Channel Aess (EDCA), and an support appliations by providing different levels of Quality of Servie (QoS). In our model, only the p MAC EDCA AC[0] hannel with higher priority is used for the pilots. The pilot beaons from the T x to the Rx are transmitted with high probability of suessful delivery, inreasing the auray of the proposed RSEA at the same time. Any type of ollisions at the wireless hannel resulting from ompeting traffi is addressed by the MAC EDCA bakoff mehanism for distanes smaller than the Carrier Sensing (CS) range of 1000m. So we assume that our speed estimation algorithm has a orret reation and for high interferene situations from other vehiles. IV. LOCATION AWARE RELATIVE SPEED METRIC One of the main novel ideas of this work, is that we take into aount the physial loation of the Jx, Rx nodes and the diretion of their motion when alulating the relative speed metri. In the general ase, the Rx does not move in the same diretion as the Jx (see Fig.1). For this ase, inludes the

6 LATEST VERSION 01/01/2019 AT 03:00:11 6 AOP (angle θ) of the Jx between Jx and Rx. The geometryaware metri takes into aount the distane dy (Jx Rx) and the distane dx (Jx Rx). So a retangular triangle is formed by the sides dx (Jx Rx), d (Rx Jx), dy (Jx Rx). As it an be seen from Fig.1, the distane d (Jx Rx) is the hypotenuse of the retangular triangle, whih means that os (θ) = dx (Jx Rx) /d (Jx Rx). So, the speed of the Jx (Soure) with respet to the Rx speed, while the Jx and the Rx are moving in the same diretion, is the relative speed between the two vehiles moving towards eah other and is equal to the sum of their individual speed vetors u line = u Jx + u Rx. Moreover, v = length vetor pointing from the Jx to the T x. The relative speed of the Jx and the Rx an be defined as the following dot produt: utx u Tx is the unit = v u line (3) To represent all the speed vetors of Fig.1 in two dimensions (x, y), we projet the vetor u Jx on the unit length vetor v. The diretion of v is the x axis (see Fig.2). The projeted vetor is u Jx os (θ). On the other hand, u Rx is already a vetor in the diretion of the x axis (see Fig.2), whih has the same diretion as the projetion of u Jx. This allows the alulation of the relative speed between Jx Rx using the two vetors ( u Jx os (θ), u Rx ) that have the same diretion with the vetor v. In (3), if we use the projetion vetor u Jx os (θ) and the u Rx vetor, we get the final version of our metri, whih is: = u Jx (dx (Jx Rx) /d (Jx Rx) ) + u Rx = u Jx os (θ) + u Rx (4) This is the metri in the diretion of v. The addition is justified by the fat that the vetors u Jx os (θ), u Rx have the same diretion. In the above equation, u Jx, u Rx are the speed vetors of the Jx and the Rx, respetively. Aording to our model, if the Jx approahes the reeiver, os (θ) inreases. As the u Rx remains onstant and the u Jx is onstantly inreasing, (4) is an inreasing funtion and its maximum value indiates a nearby jamming attak. As inreases, the jammer approahes the reeiver and when dereases, the jammer is moving away from the T x and the Rx. If the Jx and the Rx are loated on the same road, an atual straight line and the vetors u Jx, u Rx, have the same diretion, then our metri is the sum between Jx Rx speed vetors ( u Jx + u Rx ). Otherwise, if the vetors u Jx, u Rx have opposite diretions, our metri is estimated by the differene ( u Jx u Rx ). Taking into aount the diretion of the Jx relative to the diretion of the Rx the general form of the above metri is: = u Jx os (θ) ± u Rx (5) It is ruial to point out that the above metri is the atual value of the relative speed that will be used in the subsequent setions to model the Doppler shift between the jammer and the reeiver. V. PROPOSED ESTIMATION SCHEME A. Estimation of the Combined Pilot/Jamming Signal The hannel between two nodes with jamming is aptured in (2). For the proposed RSEA a pilot-based method for hannel estimation is used. So, the signals that Rx reeives from the T x and the jammer interfere additively. In (2), if we differentiate the one LOS omponent from the other N 1 NLOS omponents, we have: r LOS = 1 x pilot [N] + 2 s[n] (6) Where, the hannel values 1 = h 1 [0], 2 [2] = h 2 [0] and the symbol vetors x pilot [N], s[n] represent the unique LOS omponent of the total N multipath values. If the NLOS multipath omponent is added: N 1 y = r LOS + (h 1 [l] x pilot [N l] + h 2 [l] s[n l]) + w (7) l=1 In (7), the reeived vetor y is the onvolution between h 1 and the pilot symbol vetor x pilot and the onvolution between h 2 and the jamming symbol vetor s. Moreover, the K 1 olumn reeived vetor y for the K reeived values for every time instant during whih the reeiver ollets every pilot that is sent from the transmitter is: y = r LOS[1] + N 1 l=1 (h1[l] + h2[l]s1[n l])... + w1... w K r LOS[K] + N 1 l=1 (h1[l] + h2[l]sk[n l]) (8) To estimate the hannel between T x - Rx (h 1 ), the hannel between Jx - Rx (h 2 ) and the jamming symbol vetor s, the best we an do is to estimate the ombined vetor parameter: z = N 1 l=0 (h 1[l]x pilot [N l] + h 2 [l]s 1 [N l])... N 1 l=0 (h 1[l]x pilot [N l] + h 2 [l]s K [N l]) (9) Vetor z has the above form for the short time that is required by the reeiver to ollet all the K symbols of the pilot vetor. Reall that for a short time duration, the wireless hannel is assumed onstant. So for all the K values of vetor z in (9), the parameters h 1 [l], h 2 [l], x pilot [N l] remain onstant and only the jamming symbols may hange depending on the form of the jamming symbol vetor sent by the jammer. We use a MMSE estimator [43], whih finds a better estimate from least squares (LS), in order the K values of z to be estimated: ˆ z = ( x H pilotcw 1 x pilot ) 1 x H pilotcw 1 y (10) C w is the ovariane matrix of the noise vetor w. Vetor z in (10) has K omponents eah having N unknown multipath hannel omponents. So, both the h 1, h 2 hannels an be estimated and also the K values of the jamming signal s an be estimated too. If the simplified jamming signal is used 1, in whih the jammer ontinuously sends the same jamming symbol, whih 1 s = [f...f] T

7 LATEST VERSION 01/01/2019 AT 03:00:11 7 is unknown to the Rx, we have 2N unknown values for the two hannels h 1, h 2 with K equations in (9) and one unknown value for the jamming symbol f. So if the ondition K > 2N + 1 is valid, we an see that eah one of the hannel values h 1, h 2 out of N multipath values an be estimated with the elimination method for the solution of the linear system with K equations and 2N unknown values in (9). The values of the wireless hannels h 1, h 2 remain onstant for eah value of vetor z. Moreover, the above linear system an also be solved with a ompletely unknown to the Rx jamming signal, provided that the length of the pilot symbol vetor x pilot being sent from the T x to the Rx is larger than the sum of the number of the unknown jamming symbols with the value of parameter 2N, whih is the double number of overall multipath rays in the area for the estimation of both h 1, h 2 hannels. We only utilize the LOS omponent of the vetor z for the estimation of the relative speed metri using Doppler shift. So, the useful part from vetor z that we need for the relative speed estimation through the Doppler shift is s 1 r LOS = (... ). If we only want to estimate s K the 1, 2 values of vetor r LOS without the multipath values, the above onditions for the solution of the linear system in (8) an be simplified to K > 4 for the simplified jamming signal form. B. Proposed Algorithm Algorithm 1 Relative Speed Estimation Algorithm (RSEA) 1: N % It is speified by the T x for the speifi area using the GEMV propagation model. 2: for Every time step (t RSEA ) A pilot signal with K = 2N + 2 symbols being sent from T x to Rx do 3: N % It is re-speified by the T x for the speifi area using the GEMV propagation model. 4: ˆ z MMSE( y, C 1 5: r LOS ( w ) s s K 6: if ((K > 2N +1) )) % and s has the simplified jamming signal form then 7: ˆ rlos ( s s values an be estimated. 8: ˆr LOS [1] 1 = (a 1 + b 1 j)s 9: end if ) %LOS omponents ) % The r LOS and z 10: ˆ Estimation % estimated relative speed value from (8) 11: end for The proposed RSEA is presented in Algorithm 1. First, the T x speifies the number of multipath rays N in the area that the GEMV propagation model is used, as explained in subsetion (III). Then, the RSEA is used for every time step with the transmission of a pilot that onsists of K = 2N + 2 symbols. In line 4 of the algorithm the ombined hannel between the T x and the Rx, with the intervention of the Jx, is estimated from the vetor y using a MMSE estimator. Depending on the jamming signal, the inequality that must be valid for the RSEA system to be resolvable for all the N multipath values is different. In the final 10th line of the RSEA, the relative speed value is estimated. A omponent ˆr LOS [1] of the estimated vetor of the ombined LOS hannels ˆ r 2 LOS an be ombined with the ray-optial baseband omplexnumber (a 1 + b 1 j)s 1, whih is the jamming signal that the Rx finally reeives from the Jx. Speifially, the subtration of the hannel 1 omponent from the ˆr LOS [1] value an be set equal to the ray-optial baseband omplex-number (a 1 + b 1 j)s 1. The omplex number (a 1 + b 1 j)s 1 haraterizes the baseband form of the narrowband wireless hannel. This narrowband wireless hannel is a funtion of the relative speed between the jammer and reeiver and the Doppler shift between the two moving objets. C. Channel Model with Doppler Shift In this subsetion, we desribe in more detail the wireless LOS ombined hannel model between T x - Rx and Jx - Rx. The traked LOS omponents also show fading harateristis, likely due to the ground refletion whih annot be resolved from the true LOS. For this reason, we hoose the same model for the LOS omponent as for the disrete omponents. So entral to this paper, is the introdution of the proposed metri in the hannel model of (1), taking into aount the pathloss value at the reeiver. This pathloss value only depends on the distane between the ommuniating nodes and usually gets small values for a narrowband wireless hannel. Let us onsider the hannel model suh as defined by the Rx for a ray transmitted between two nodes as [44]: 2 q=1 q (t, τ q) = 2 γ qpo qe j(2π/λ)(f+f d,max os φ q)τ q δ(t τ q) q=1 (11) In the above equation, q defines the hannel between T x Rx with q = 1 and the hannel between Jx Rx with q = 2, γ qi is the omplex amplitude assoiated with the LOS path and po q represents the free spae propagation loss [45], λ is the wavelength, f the arrier frequeny, f d,max is the maximum Doppler shift that depends on the metri suh as in (3), φ q is the inidene AOD between the vetor of speed u Jx and the vetor of the jamming signal, (τ q = d/) is the exess delay time that the ray travels between the two nodes, and t is the urrent time instant. We assume the LOS ase for the ommuniation between the jammer and the reeiver, as an be seen in Fig.2a. The LOS ray between the Jx and the Rx has the same diretion with the speed vetor of the jammer. 2 Eah one of the K omponents of r LOS has the same ombined hannel values

8 LATEST VERSION 01/01/2019 AT 03:00:11 8 As a onsequene the AOD is equal to zero (os φ q = 1, in (11)). The observed frequeny at the reeiver is f = f (1 + os φ q), whih depends on the relative speed of the two vehiles (jammer, reeiver) that we defined in the previous subsetion. The baseband hannel model for a ray transmitted between two nodes with the intervention of a jammer therefore beomes: 2 q=1 q (t, τ q ) = 2 q=1 j(2π/λ)f(1+ γ q po q e os φq)τq δ(t i τ q ) (12) We an see that the Doppler shift f Hz that is observed in the Rx an be equal with [46]: where, ω 2 = (2π/λ)(f )τ 2i. In the above equation, the only unknown parameter is. For the LOS hannel between T x Rx, we know that the reeiver moves with the same speed as the transmitter, suh as a platoon of vehiles with two members. The above means that the Doppler phenomenon is non-existent. Following (16) for the formulation of the hannel 1 without the existene of Doppler phenomenon, we an see that this hannel only depends on the path-loss omponent and the omplex amplitude assoiated with the LOS path. The path-loss omponent po 1 and the omplex amplitude variable γ 1 an be estimated by the reeiver. So the 1 an be represented by a omplex number: f = f os φ q And the maximum Doppler shift is: (13) f d,max = (14) Now, let τ q be the time that is required for a signal to travel the distane d. Then, we an re-write 2 from (12) as: j(2π/λ)f(1+ 2 (t, τ 2 ) = γ 2 po 2 e ) d d δ(t ( )) (15) In the above equation, we use a f = 5, 9Ghz, whih is the band dediated to V2V ommuniation. The hannel 2 (t, τ 2 ) is also the hannel of a baseband signal in (15) and if ( >> 1) has the form: j(2π/λ)(f 2 (t, τ 2 ) = γ 2 po 2 e ) d d δ(t ( )) (16) To get our final signal model, we replae the path-loss parameter po with equation: po = G 0,p ( d ref (17) d )np Where, G 0,p is the reeived power at a referene distane d ref, whih is a standard value at about 100m, n p is the path-loss exponent, whih is equal to 2 for the pure LOS links and d i is the distane that the transmitted ray travels between the two ommuniating nodes. So, po only depends on the distane d that the ray travels. We denote t = t RSEA i t RSEA i 1 as the time interval between the urrent time instant and the preeding one, in whih the RSEA is reapplied (t RSEA i 1 ). Furthermore, if 2 (t, τ 2 ) represents the hannel between the Rx - Jx pair, the distane between the two nodes after the time interval t is d = t, when the jammer approahes the reeiver. Substituting (17) into (16), 2 an be rewritten as: 2 (t, τ 2) = γ d ref 2G 0,p( t )2 e j(2π/λ)(f )τ 2 δ(t ( d )) (18) In the above equation, the only unknown parameter is at time t. Reorganizing (18) we have: d 2 ref 2 (t, τ 2 ) = γ 2 G 0,p ( 2 t 2 )δ(t (d ))(os (ω 2) + j sin (ω 2 )) (19) 1 (t, τ 1 ) = γ 1 po 1 e 0 = a T x Rx + b T x Rx j (20) Reformulating the ombined value of the LOS hannels ( 1, 2 ) in (12) by ombining equations (20), (19), we have: 2 q=1 q (t, τ qi) = γ 1po 1 D. Relative Speed Estimation d 2 ref + γ 2G 0,p( 2 t )δ(t ( d ))(os (ω2) 2 + j sin (ω 2)) (21) At this point we have an estimate of the baseband hannel 2 between Jx Rx, whih an be represented with a omplex number. The final baseband signal that reahes at the reeiver after the intervention of the jammer an be represented as (a 1 +b 1 j)s. From Algorithm (1), we know that the jamming symbols of the symbol vetor s is part of the vetor r LOS. So, if from the estimated ombined value ˆr LOS we subtrat the hannel 1, whih an be estimated by the reeiver, the value (ˆr LOS 1 = 2 s) an be set equal to the baseband reeived signal at the reeiver: ˆr LOS 1 = (a 1 + b 1 j)s (22) From the above equation, as well: 2 s = (a 1 + b 1 j)s (23) Reusing the (19) from the previous Setion, the ray-optial baseband omplex number (a 1 + b 1 j) an be set equal with: (a 1 + b 1j)s = γ 2G 0,p( d2 ref t )δ(t ( d ))(os (ω2)re(s) 2 + j sin (ω 2)Im(s)) (24) where, ω 2 = (2π/λ)(f )τ 2). The jamming signal s is estimated by the reeiver from Algorithm (1). So the Re(s), Im(s) are known values to the reeiver. From the above equation, we an alulate the desired parameters a 1, b 1 : a 1/(γ 2G 0,p( d2 ref δ(t ( d )) 2 t 2 )) = os ((2π/λ)(f )τ2) (25)

9 LATEST VERSION 01/01/2019 AT 03:00:11 9 Figure 3: Graphial Representation of the t eff from the T x Rx pair between the Communiation Zone and Effetive Zone of the Jx. b 1 /(γ 2 G 0,p ( d2 ref δ(t ( d )) 2 t 2 )) = sin ((2π/λ)(f ))τ 2) (26) From (25),(26) and with the use of the Euler identity, we have: os((2π/λ)(f ))τ 2) 2 + sin((2π/λ)(f ))τ 2) 2 = 1 (27) In (27) there is only one unknown variable. So, we an alulate as: = 4 G2 0,p γ2 2 d4 ref δ(t ( d ))2 t 4 (a b2 1 ) (28) From the above equation, we an see that the estimated value depends on the exess delay time τ 2 = d that is aused by the Doppler phenomenon. A. Evaluation Setup VI. PERFORMANCE EVALUATION Our evaluation senario is onduted on the outskirts of the ity of Aahen, representing a real-word environment; while assuming that this is a rural area. Our experimental setup onsiders uniast data transmissions in a network onsisting of three nodes: a transmitter, a reeiver and a jammer, and V2X broadast ommuniation for 10 interfering vehiles outside of the CS range between the T x and the Rx (distane more than 1000m). Two different moving RF jamming attaks senarios are evaluated. Analyzing RF Jammer Behavior 1 VI-B, the T x - Rx pair (see Fig.1) travels with a onstant speed of approximately 50Km/h and with onstant distane of approximately 20m, as a platoon of vehiles. The J x is also moving on a side road with zero initial speed and aelerates to a maximum speed of 60Km/h in order to approah the T x - Rx pair. In RF Jammer Behavior 2 VI-C the transmitter and the reeiver travel with onstant speed of approximately 48Km/h when the jammer approahes the rossroads, as illustrated in Fig.3, with aelerating speed and a maximum limit of 50km/h. Our experiments are onduted using the Veins-Sumo simulator [47] with the simulation parameters presented in Table I suh as: The initial distane between the jammer and the pair of Rx - T x, d Jx Rx, the distane that separates the reeiver from the transmitter throughout the ourse of the simulation d Tx R x. The losest distane in whih the jammer arrives relative to the T x - Rx pair as well as the power of all the transmitted signals P Tx,J x. The time interval t after RSEA is reapplied. The speifi value of the parameter N, whih is the number of the multipath rays. Last, the standard referene distane d ref is used for the estimation of the LOS path loss omponent. As illustrated in Fig.3, there is a time interval t eff, in whih the transmitter an effetively ommuniate with the reeiver. It starts with the Start of Communiation Zone and ends with the Start of the Effetive Zone of the Jx. After the start of the effetive zone of the Jx, the jammer is loated at distanes smaller than 30m away from the reeiver and it an ompletely jam the ommuniation between the T x and the Rx by onstruting a Blak hole. All the evaluation parameters are summarized in Table II. During the performane evaluation we test our proposed RSEA with different SINR values for two real-life senarios. When the jamming vehile is approahing the T x - Rx pair, the SINR is: SINR = h 1 x pilot 2 h 2 s 2 + σ 2 n (29) The SINR level is measured by the reeiver at the PHY layer. In the above equation, the noise power σn 2 is the noise power. Moreover, the Mean Absolute Error (MAE) between the real value and the estimated is alulated for both senarios. This is the differene between the atual relative speed metri with the estimated relative speed metri. ˆ MAE = 1 ns i ˆ i (30) where i is an integer number that identified with the urrent time instant in whih the real and the estimated variable have a speifi value and ns = 10 is the number of measurements for the speifi speed value. The MAE value gets its optimal zero value when the real is identified with the estimated. We assume this optimal value as a referene point for the MAE(%) alulations for the rest of the paper. B. Results of RF Jammer Behavior 1 In RF Jammer Behavior 1, we assume that the pair T x - Rx moves with a high onstant speed (50 Km/h) when the jammer aelerates with a higher maximum speed (60 Km/h), while transmitting a jamming signal with a simplified form to the reeiver. The first figure of Fig.4a shows a omparison between the real and the estimated value. Speifially, by observing the start time of the steep slope of SINR in Fig.5b, we an onlude that it oinides with the start of the jamming attak, the 15.5 se. The main reason for the sharp derease of the SINR in our experiment is the jamming attak and

10 LATEST VERSION 01/01/2019 AT 03:00:11 10 Table I: Simulation Parameters Evaluation Parameters in Veins Simulator Values d Tx,Rx 20m [CW [min], CW [max]] [3,7] Vehile s Transmission Range m Initial d Jx Rx 300m CS range of p protool 1000m Interfering vehiles outside of CS range T x Rx 10 d Jx Rx at Blak hole 25m P T x,jx 100mW Minimum sensitivity (P th ) -69dBm to -85dBm f 5.9GHz Doppler shift for = 120km/h ±655.5 Hz d ref 100m t 2s N 4 Table II: Evaluation senario parameters Independent parameters RF jammer 1 RF jammer 2 T x - Rx veloity 50 Km/h 48 Km/h Jx veloity 60 Km/h 50 Km/h t eff 15.5 se 18 se Blak hole of ommuniation 13.5 se 18 se Time of peak 23.4 se 25 se not the interferene from the entire environment. Moreover, in Fig.4a, after 15.5 se, for whih is above 20 rad*m/s, the SINR in Fig.4b has also a steep slope. So, the effetive zone of ommuniation between T x and Rx is approximately t eff = 15.5 ses, whilst after that it is orrupted for 13.5 ses. So, the blak-hole in the ommuniation range between the T x and the Rx is during the time interval (15.5 ses- 29 ses). After 29 ses, we have the end of the attak. For this time interval (15.5 ses- 29 ses), the MAE of our proposed RSEA inreases to 23% from the optimal MAE value (see Fig 6). In Fig.4a, we an see that reahes a maximum value, approximately 32.5 rad* m/s, at the time instant 23.4 se. At this time, Jx is approahing the T x - Rx pair in the main road, whih is illustrated in Fig.3. The average MAE for the duration of RF Jammer Behavior 1 is approximately 13% worse than the optimal value. C. Results of RF Jammer Behavior 2 For the seond evaluation senario, we assume that the pair T x - Rx travels with onstant speed (48 Km/h), whih is almost the same as the maximum speed of the jammer (50 Km/h) (see Fig.5). The jammer ontinuously transmits a random jamming symbol to the reeiver. The start time of the jamming attak is at 18 ses during whih the SINR appears to be dereasing from 5dB to zero while starts to inrease from 20 rad*m/s to the peak value of. The time that is needed for the Jx to approah the pair T x - Rx is approximately t eff = 18 ses. After that time, the jamming attak learly has perfet results for 18 ses; from the 18 ses of the simulation until 36 ses, after that SINR inreases more than 5 db. If the slope is positive, the Jx approahes the Rx, whilst if it goes to zero, Jx is removed from the effetive zone of ommuniation between the T x and the Rx. The blak-hole in the ommuniation between the T x and the Rx is around the time interval (18 ses - 36 ses), during whih the MAE value inreases to approximately 18% from the optimal MAE value. In Fig.5, we an see that the average MAE for the omplete duration of RF Jammer Behavior 2 is approximately 10% worse than the optimal value, as it is shown also in Fig.6 D. MAE omparison between RF Jammer Behavior 1 and RF Jammer Behavior 2 The overall omparison of the MAE results between RF Jammer Behavior 1 (Jammer 1) and RF Jammer Behavior 2 (Jammer 2) is summarized in Table III. Fig.6 shows that there is a quite small MAE, only 15% greater than the MAE value at the start and end of simulation. However, when the jammer approahes the reeiver the MAE shows an inrease of about 23% from the optimal value for RF Jammer Behavior 1 and 18% for RF Jammer Behavior 2. The phenomenon of the larger MAE at the time of the jamming attak for RF Jammer Behavior 1 ompared to that of RF Jammer Behavior 2 is attributed to the fast varying nature of the metri, beause it hanges with a higher rate and thus, the hannel between the Jx and the Rx hanges frequently too. So, the longer the duration of the jamming attak lasts the better the MAE results of the proposed RSEA are. For the duration of the effetive Communiation Zone between T x - Rx ( t eff ) the average MAE was only 8% worse than the zero MAE value for RF Jammer Behavior 1 and 6% for RF Jammer Behavior 2. As the jammer approahes the reeiver at a distane of approximately 30m, it ould suessfully affet the effetive ommuniation between T x Rx. For the time interval of a Blak hole in ommuniation between T x - Rx, the average MAE inreases to 23% from the optimal value for RF Jammer Behavior 1 and 18% for RF Jammer Behavior 2. When the overall average MAE, for the duration of the simulation is measured, an average MAE 13% worse than the zero MAE value for RF Jammer Behavior 1 is observed and 10% worse than the same referene point for RF Jammer Behavior 2. An average MAE for our sheme for all senarios an be estimated and is about 13% worse than the optimal MAE value. Finally, it an be onluded from the simulation results that neither the jamming signal form nor the different Jx and T x Rx pair speeds affet the speed estimation results signifiantly. Moreover, the insertion of 10 hidden nodes further away from the CS range of T x Rx does not seem to affet the speed estimation values that are presented. A hidden node oupies the wireless medium through the MAC/EDCA bakoff mehanism (see III-E), in very rare ases. In these ases, the T x Rx ommuniation is disrupted, foring the RSEA to use the signal that Rx reeives from this node for the ombined hannel estimation and finally, for the estimation. In order to test our previous results under more generi senarios, the average MAE is estimated for different jammer speed values and different number of hidden nodes that are loated at the edge of the CS range of the T x Rx pair.