[PPT] - Channel Surfing and Spatial Retreats: Defenses against Wireless PowerPoint Presentation

SLIDE 1

Channel Surfing and Spatial Retreats: Defenses against Wireless Denial of Service

W enyuan Xu, Tim othy W ood, W ade Trappe, Yanyong Zhang W I NLAB, Rutgers University I AB 2 0 0 4

SLIDE 2

2

I AB 1 1 / 1 8 / 2 0 0 4

Roadmap

Motivation and Introduction Detection

– MAC Layer Detection – PHY Layer Detection

DoS Defenses

– Channel Surfing – Spatial Retreat

Conclusions Ongoing works

SLIDE 3

3

I AB 1 1 / 1 8 / 2 0 0 4

Jamming Style DoS

Bob Alice Hello … Hi …

SLIDE 4

4

I AB 1 1 / 1 8 / 2 0 0 4

Jamming Style DoS

Bob Alice Hello … Hi … @#$%%$#@& …

Mr. X

SLIDE 5

5

I AB 1 1 / 1 8 / 2 0 0 4

Jamming Style DoS

Bob

Alice Hello … Hi … @# $ % % $ # @&…

Mr. X
Alice and Bob are DoS attacked by

malicious Mr. X.

A story for the problem of wireless

denial of service attack we focus on.

– Alice and Bob two communicating nodes, A and B. –

Mr. X an adversarial interferer X.

–

Mr. X’s insane behavior the jamming

style DoS. – People and nodes in wireless network both communicate via shared medium.

Jamming style DoS Attack:

– Behavior that prevents other nodes from using the channel to communicate by

ccupying the channel that they are

communicating on

A B X1 RX1 X2

w2

SLIDE 6

Slide 5 w2 DoS: An attack on a system or portion of a system that results in at least the temporary inability of others to use the system for its intended purpose

wenyuan, 9/22/2004

SLIDE 7

6

I AB 1 1 / 1 8 / 2 0 0 4

Jamming Style DoS

Bob

Alice

Hello …

Hi …

@# $ % % $ # @&…

Mr. X

Jam m ing style DoS: 2 styles

– MAC-layer DoS

Bypass the MAC protocol, repeatedly send out packets Introduces packet collision

– PHY-layer DoS

Jam transmission channel by emitting energy in the frequency band corresponding to the channel

Australian CERT [ 0] :

Previously, attacks against the availability of IEEE 802.11 networks have required specialised hardware and relied on the ability to saturate the wireless frequency with high-power radiation, an avenue not open to discreet attack. This vulnerability makes a successful, low cost attack against a wireless network feasible for a semi-skilled attacker.

A common example: turning on the Microwave is a piece of cake.

This vulnerability m akes a successful, low cost attack against a w ireless netw ork feasible for a sem i-skilled attacker

[ 0] AusCERT,"AA-2004.02-denial of service vulnerability in IEEE 802.11 wireless devices", http: / / www.auscert.org

SLIDE 8

7

I AB 1 1 / 1 8 / 2 0 0 4

Our Jammers

MAC-layer Jammer

– Mica2 Motes (UC Berkeley)

8-bit CPU at 4MHz, 512KB flash, 4KB RAM 916.7MHz radio OS: TinyOS

– Disable the CSMA – Keep sending out the preamble

PHY-layer Jammer

– Waveform Generator – Tune frequency to 916.7MHz

Sync Pream ble Packet

SLIDE 9

8

I AB 1 1 / 1 8 / 2 0 0 4

Handling Jamming: Strategies

What can you do when your channel is occupied?

– In wired network you can cut the link that causes the problem, but in wireless… – Make the building as resistant as possible to incoming radio signals? – Find the jamming source and shoot it down? – Battery drain defenses/ attacks are not realistic!

Protecting networks is a constant battle between the

security expert and the clever adversary.

Therefore, we take motivation from “The Art of War” by

Sun Tze:

– He w ho cannot defeat his enem y should retreat.

Detection Strategies

– MAC Detection – PHY Detection

Retreat Strategies:

– Spectral evasion – Spatial evasion

SLIDE 10

Detection: MAC Layer and PHY Layer

SLIDE 11

10

I AB 1 1 / 1 8 / 2 0 0 4

DoS Detection—MAC Layer

Idea:

– Want to use channel state information to detect whether a jamming has occurred.

CSMA (TinyOS)

– Senses the channel until it detects the channel is idle. – If collision, wait for a random time. (no exponential backoff)

Adversary Model:

– We assume there is only one stationary adversary, who blasts on a single channel at any time.

Observation:

– Normal scenario: nodes can pass the CSMA after some time – DoS scenario: nodes might never passes the CSMA

Challenges:

– How to discriminate a legitimate traffic jam from illegitimate traffic? – What is a good model to minimize the probability of a false positive?

Thresholding is the “bread and butter” of detection theory

(Neyman-Pearson, Bayesian inference).

– Sensing time?

Adversary Model: There is one stationary adversary, who continuously blasts on a single channel at a time.

SLIDE 12

11

I AB 1 1 / 1 8 / 2 0 0 4

Empirically setting the threshold

Problem with theoretically setting

threshold: Its hard to model more complicated MACs!

Let each network device collect statistics

regarding waiting time D

Experiment

– ns-2 simulator – 802.11 protocol – Disabled the MAC layer retransmission – Two nodes, A and B, collected the statistical data – Using some streams (from sender Si to receiver Ri) to increase the interfering traffic

Observation:

– When only a few streams exist, A can get the channel quickly with high probability – As the number of streams increases, the competition for channel becomes more intense, thus taking longer for A to acquire the channel

A B S1 S2 S3 R1 R2 R3

Sensing Tim e ( m s) Cum ulative Distribution of Sensing Tim e Cum ulative Distribution

SLIDE 13

12

I AB 1 1 / 1 8 / 2 0 0 4

DoS Detection – PHY Layer

Idea:

– Want to use PHY layer information to detect whether a jamming has occurred

Observations:

– Ambient noise levels in normal (including congested) scenarios and abnormal scenarios are statistically different.

Challenges:

– How to capture the time variant properties efficiently? – What is a good model to use for minimizing the probability of a false positive?

Network devices can sample noise levels prior to DoS attack

and build a statistical model describing usual energy levels in the network.

– Discrimination between normal noise level measurements and abnormal data by employing the various features of the data. – Tools:

statistics: Spectral Discrimination
statistics: Distributional Discrimination

2

χ

2

ψ

SLIDE 14

13

I AB 1 1 / 1 8 / 2 0 0 4

Platform:

– Mica2 Motes (UC Berkeley) – Use RSSI ADC to measure the signal strength – The values are in inverse relationship to power (signal strength)

Three scenario

– No communicator – Three communicators (obey CSMA) – Use waveform generator as jammer No communicator Three communicators Jammer

The noise level time series with a jammer and without a jammer are different

DoS Detection – PHY Layer

Tim e

SLIDE 15

Defenses: Channel Surfing and Spatial Retreats

SLIDE 16

15

I AB 1 1 / 1 8 / 2 0 0 4

Network Types

DoS detection can be employed by a

single node, however, DoS defenses are group activities.

Three different network scenarios are

concerned:

– Two party radio communication

Baseline case

– Infrastructured wireless network

Consist of two types of device: access points

and mobile devices

Access points communicate with each other

via wired infrastructure

Mobile devices communicate via the access

point to other mobile devices

– Mobile Ad Hoc Wireless Networks

Composed of mobile devices without access

points

Mobile devices can communicate to each
ther via multi-hop routing protocol

A B C D E F G H I J K L X A B X0 AP0 AP1 AP2 C D X1

A B X1 RX1 X2

SLIDE 17

16

I AB 1 1 / 1 8 / 2 0 0 4

Dos Defenses– Channel Surfing

Adversary Model:

– We assume there is only one stationary adversary, who blasts on a single channel at any time.

Objective:

– In case we are blocked at a particular channel, we want to resume the normal wireless communication with other legal nodes.

Channel Surfing:

– If we are blocked at a particular channel, we can resume our communication by switching to a different (and hopefully safe) channel that does not overlap current channel. – Inspired by frequency hopping techniques, but operates at the link layer

System Issues:

– Must have ability to choose multiple “orthogonal” channels:

Prevents Interference
Practical Issue: PHY specs do not necessarily translate into correct

“orthogonal” channels

Example: MICA2 Radio recommends: “choose separate channels with a

minimum spacing of 150KHz” but… ..

Adversary Model: There is one stationary adversary, who continuously blasts on a single channel at a time.

SLIDE 18

17

I AB 1 1 / 1 8 / 2 0 0 4

Throughput VS. Channel Assignment

Receiver Sender I nterferer

Sender sends the packet as

fast as it can.

Receiver counts the packet

and calculates the throughput

The radio frequency of the

sender and receiver was fixed at 916.7MHz.

Increased the interferer’s

communication frequency by 50kHz each time.

When the Jammer’s

communication frequency increases to 917.5MHz, there is almost no interference

SLIDE 19

18

I AB 1 1 / 1 8 / 2 0 0 4

Throughput VS. Channel Assignment

Sender W ave generator I nterferer Receiver

SLIDE 20

19

I AB 1 1 / 1 8 / 2 0 0 4

Dos Defenses– Channel Surfing

System Issues (cont.):

– “Orthogonal” channels:

The fact is that we need at least 800KHz to escape the interference. Therefore, explicit determination of the amount of orthogonal channels is important.

– How to determine which channel to hop?

The adversary X may periodically stop its interference and try to find the new channel the nodes are currently on. Goal: Maximize the delay before X finds out the new channel Therefore, using next available channel is NOT good! Use a (keyed) pseudo-random channel assignment!

Basic Channel Surfing Algorithm: Both parties detect DoS

independently, and change to a pre-determined channel and establish communication there

SLIDE 21

20

I AB 1 1 / 1 8 / 2 0 0 4

Two Party Radio Communication

Prototype:

– Two Berkeley motes A and B – A sends out a packet to B every 200msecs – Measure the packet delivery rate = # recv/ # sent – Used waveform generator as jammer X – A and B try to detect the DoS attack periodically

Code:

task void checkDos() { sent = call SendMsg.send( TOS_BCAST_ADDR, sizeof(uint16_t), &beacon_packet); if(!sent){ if(+ + failures< thresh) post checkDos(); else post changeChan(); } else { failures = 0; } }

A B X1 RX1 X2

Trial Num ber ( Tim e) Channel Surfing Experim ent Packet Delivery Rate

Jam m er turned

n

Change channel 1 0 .5 1 .5

SLIDE 22

21

I AB 1 1 / 1 8 / 2 0 0 4

DoS Defenses – Spatial Retreats

Adversary Model:

– We assume there is only one stationary adversary, who blasts on a single channel at any time.

Objective:

– No channel to switch to...then find a new place to reestablish connectivity! – What will you do when your nearby microwaves almost kills the wireless connection of your laptop?

Spatial Retreats:

– In order to resume our communication under the jamming style attack, we should move to a place that is outside of the jamming regions

System Issues:

– Where to move? – How to ensure that both parties leave the adversary’s interference range? – How to maintain radio connectivity following a spatial retreat? – How to adapt to non-circular jamming regions?

Adversary Model: There is one stationary adversary, who continuously blasts on a single channel at a time.

SLIDE 23

22

I AB 1 1 / 1 8 / 2 0 0 4

Two Party Radio communication

ther?

– Let B be master and A be

slave. Only slave moves

– A moves along x-axis (toward B, never beyond B)

What if moving into the interference range again?

tops moving along the x-axis, moving along y-axis

A B X Y X B’ A1

SLIDE 29

28

I AB 1 1 / 1 8 / 2 0 0 4

Two Party Radio communication

Three stage protocol:

– Establish Local coordinates – Exit the interference Region – Move into Radio Range

What if they bypass each

ther?

– Let B be master and A be

slave. Only slave moves

– A moves along x-axis (toward B, never beyond B)

What if moving into the interference range again?

tops moving along the x-axis, moving along y-axis

A B X Y X B’ A2 A1

SLIDE 30

29

I AB 1 1 / 1 8 / 2 0 0 4

A B X Y X B’ A2 A1

Two Party Radio communication

Three stage protocol:

– Establish Local coordinates – Exit the interference Region – Move into Radio Range

What if they bypass each

ther?

– Let B be master and A be

slave. Only slave moves

– A moves along x-axis (toward B, never beyond B)

What if moving into the interference range again?

– stops moving along the x- axis, moving along y-axis

A’ A3 A4

SLIDE 31

30

I AB 1 1 / 1 8 / 2 0 0 4

Conclusions:

Due to the shared nature of the wireless medium, it is an

easy feat for adversaries to perform a jamming-style denial of service against wireless networks

We proposed two approaches that a single node may

employ to detect a DoS Attack

– MAC layer: monitoring the sensing time – PHY layer: observing the noise levels in the channel

We have presented two different strategies to defend

against the jamming style of DoS attacks

– Channel-surfing: changing the transmission frequency to a range where there is no interference from the adversary – Spatial retreat: moving to a new location where there is no interference

SLIDE 32

31

I AB 1 1 / 1 8 / 2 0 0 4

Ongoing works:

Study the detection strategies

– Jammer turns on for 95% of the time and keeps silent for the rest of 5% of the time – Jammer will start to jam only if someone is sending out the message

Investigate the channel-surfing and spatial retreat

algorithm in new wireless network topologies:

– Infrastructured wireless networks – Ad-hoc network

Study the defenses against DoS with other issues:

– High mobility – High redundant (in sensor network)

A large scale (approximately 50 nodes) jamming-tolerant

sensor network is being developed and results will be reported soon.

SLIDE 33

32

I AB 1 1 / 1 8 / 2 0 0 4

Other Investigations

Many wireless security threats are being addressed

– Secure routing protocol, Temporal Key Integrity Protocol (TKIP), 802.1x, privacy… … – Validation of the possibility of DDOS in wireless by mathematical models.[ 1] – Using FAIR-MAC to prevent nodes from monopolizing the channel. Prerequisite: every node follows the fair MAC protocol.[ 2] – DOMINO: System for Detection Of greedy behavior in the MAC layer of IEEE 802.11 public Networks. [ 3]

However, the jamming style DoS is not well studied

– Australian CERT announced the issue of MAC layer weaknesses in 802.11 MAC. [ 0] – Mapping a jamming-area for sensor networks.[ 4]

[ 1] Q. Huang, H. Kobayashi, and B. Liu, “Modeling of Distributed Denial of Service Attacks in Wireless Network”, IEEE Pacific Rim Conference on Communications, Computers and Signal Processing [ 2] V. Gupta, S. Krishnamurthy, and M. Faloutsos, “Denial of Service Attacks at the MAC layer in Wireless Ad Hoc Network’, IEEE Milcom 2002, Anaheim, California, October 7-10, 2002 [ 3] M. Raya, J. Hubaux, and I. Aad, “DOMINO: a system to detect greedy behavior in IEEE 802.11 hotspots”, 2004, MobiSYS, pp.84-97 [ 4] A. Wood, J. Stankovic, and S. Son,”JAM: A jammed-area Mapping Service for Sensor Networks”, 2003, 24th IEEE International Real-Time Systems Symposium, pp.287-297