Download as pdf or txt
Download as pdf or txt
You are on page 1of 6

DISTRIBUTED JAMMER NETWORK: IMPACT AND CHARACTERIZATION

Nihal Ahmed and Hong Huang


New Mexico State University
Las Cruces, NM, USA

ABSTRACT second Iraq war [6]. In general, future warfare will


increasingly depend on radio signal for command and
In this paper, we introduce a new denial-of-service attack control, weapons guidance, GPS navigation, etc. DJN can
on wireless networks: low-power, distributed jamming play an important role in future net-centric warfare.
network (DJN). DJN is composed of large number of low-
power jamming devices, which are deployed in proximity
to the target devices. DJN can cause significant damage to
target network performance with high energy efficiency. In
the paper, we provide a characterization of DJN,
demonstrate the effectiveness of DJN and provide a study
on the impact of various DJN parameters on jamming
effectiveness. 1

I. INTRODUCTION

Distributed jamming is realized by deploying a distributed Courtesy Zettl Research Group, LBNL and UCB
jammer network (DJN), which is composed of a large
number of tiny, low-power jammers, which are distributed Figure 1: Evolution of radio technology.
inside a target network and emit radio energy to disrupt its
communications. DJN is motivated by recent advancement DJN can have many civilian usages as well. Although
in the miniaturization of radios [1][2], see Figure 1. owning or using jammers is illegal in USA, and is
Today’s MEMS and NANO technology makes it possible tantamount to property theft (the property being the
to make jammers sufficiently small that a DJN can take the government owned frequency); it is legal and put into
form of a dust suspending in the air, forming a so-called sensible use in some other countries [4]. For example, in
“Jamming Dust,” in comparison with “Smart Dust”[3]. France, jammers are used in restaurants or theaters to
Miniaturization of jammers should be less challenging silence obnoxious cell phone users. In Italy, jammers are
than that of radio transceivers since jammers just emit used in exam rooms to frustrate potential cheaters. In
noise signal without requiring complex modulation, Mexico, jammers are deployed in churches to prevent
filtering and other signal processing functions. Therefore, disruption of sacred services. In such cases, deploying a
new miniature devices such as nanotube radio [2] may find low-power DJN instead of high-power ones is clearly
their first application in jamming dust. preferable due to health concerns. In fact in today’s world
of wireless device proliferation (cell phone, WiFi, WiMax,
1.1 Applications of DJN and Bloetooth devices, wireless game console, sensor
There can be many military/security applications for DJN. networks, etc.), DJN can spontaneously form in the
For example, DJN can be deployed to form a jamming crowded ISM bands since devices speaking different MAC
dust inside a terrorist-occupied building to disable the protocols are essentially jammers to one another within the
wireless communications capability of the enemy inside. same frequency band. This kind of jamming may already
DJN can also be deployed in front of moving troops to become a reality as indicated by the reported incident of
disrupt radio-triggered improvised explosive devices (IED) possible Xbox game console interfering with WiFi [5].
without depriving troops’ own communications capability
because of the low power DJN uses. Self-interference 1.2 Uniqueness and advantages of DJN
caused by jammers has posed difficult problems in the DJN is different from traditional jammers [13] used by the
military, which are typically located outside the target
©2009 IEEE network and cause inference by beaming high-power radio

1 of 6

Authorized licensed use limited to: KTH Royal Institute of Technology. Downloaded on September 16,2022 at 09:12:09 UTC from IEEE Xplore. Restrictions apply.
signal over long distance using directional antenna. DJN is II. DJN CHARACTERIZATION, JAMMING
also different from the kind of in-network jamming studied MECHANISM, AND SCALING BEHAVIOR
recently (summarized in Section 6), which uses jammers
of similar size as target network devices whereas DJN can In this section we describe characterization, jamming
use much smaller, lower-power devices than target mechanism and scaling behavior of DJN. First, we
network nodes. More importantly, existing works on describe our assumptions. We assume that radio antenna of
jamming are mostly from the perspective of individual both target network and DJN are omnidirectional. We
jammers. DARPA realized the importance of DJN in assume operation under adversarial conditions where no
future battlefields and founded the WolfPack program [8], knowledge about the target network device type and
which is essentially a high-power, large-node version of network protocols is available, and where the enemy
DJN but of which not much technical detail is available in device type or the enemy identity itself is not known a
the public. Despite DJN’s importance, not much work on priori, e.g., in terrorist attacks. In addition, target network
the subject has emerged in the research community. This packets can be encrypted to reveal little useful control
paper intends to advocate studying jamming from a information. Thus methods [9][10][11] that take advantage
network perspective, rather than from the perspective of of the knowledge about network protocols are not
individual jammers. That is, we ask the question: What is applicable here.
the impact of a network of jammers. A large number of
jammers have a network effect which can not be fully 2.1 DJN characterization
accounted by that of individual jammers. The network DJN is described by its temporal and spatial
approach is conducive to broaden the problem scope characteristics. Temporal characteristics relate to questions
considerably and increases the likelihood of obtaining such as: When and how long a jammer is active? Spatial
important/interesting results. characteristics relate to questions such as: how densely and
with what topology the DJN is deployed? For temporal
Compared with traditional jammers DJN have the characterization, we can use jamming intensity and
following advantages: First, DJN is robust because it is duration. Jamming intensity (I) is defined as the percentage
composed of a large number of devices with ample of time a jammer is active. Jamming period (P) is defined
redundancy. Second, DJN nodes emit low power, which is as how long a jammer stays active once activated. Using
advantageous because of health, self-interference these parameters, we can classify jammers as follows [12]:
concerns. Third, DJN is hard to detect because of nodes’ A constant jammer has 100% intensity. A periodic jammer
small size (the naked eye can not even see a nanotube has fixed intensity and period. A random jammer has
radio) and low power emission. Forth, DJN provides random intensity or period. A reactive jammer has
extended coverage with high energy efficiency. In Section intensity or jamming period that adapts to the channel state
4, we will show that using the same total amount of power, it observes.
a DJN of n nodes covers an effective area n1-2/α times
larger than that of a single jammer, where α is the path loss For spatial characterization of DJN, we can use node
exponent with a typical value of 4. So the typical power density and network topology. Node density is defined as
efficiency gain of DJN is n1/2, which is unbounded as n the number of jammers per unit area. DJN topology is
goes to infinity. simply the network topology of DJN, which can be
structured or random. For structured DJN topologies, a
1.3 Contribution and organization of the paper natural way to categorize them is according to how they
The contributions of the paper are the following: 1) We cut across the target network, since the purpose of DJN is
identify an effective jamming approach: DJN consisting of to disconnect, or cut, the target network. Some elementary
large number of low-power jammers that have important examples of cuts are shown in Figure 2, and are described
military and civilian applications. 2) We provide temporal as follows. A line cut is composed of jammers arranged in
and spatial characterization of DJN, introduce a new a line so as to cut the target network in half. A parallel cut
jamming mechanism: reactive-adaptive jamming, and is composed of two or more line cuts parallel to each other
provide a scaling relationship of DJN (Section II). 3) so as to cut the target network multiple times in the same
Using simulation, we investigate the impact of DJN direction. A cross cut is composed of two parallel cuts that
parameters such as number of jammers, DJN topology, and are perpendicular to each other so as to cut the target
node mobility on DJN effectiveness (Section III). We network in orthogonal directions. In contrast, a random
report related previous work in Section IV and conclude in topology is where jammers are deployed randomly in
section V. space.

2 of 6

Authorized licensed use limited to: KTH Royal Institute of Technology. Downloaded on September 16,2022 at 09:12:09 UTC from IEEE Xplore. Restrictions apply.
military applications, I = 30% is considered adequate [13].
Jammer parameter selections, of course, should depend on
the particular application in question, and here we assume
we can make appropriate selections. If target network does
not use error-correcting code, RAJ jams for one slot time,
ignores the ensuing period of busy channel (letting the
current damaged packet to finish), and begins to jam the
channel again when the channel returns busy after an idle
(a) (b) period (e.g., inter-frame time in IEEE802.11). Such
jamming can achieve very high jamming gain, i.e.,
expending a small amount of jamming energy to waste a
large amount of target network transmission energy.

2.3 DJN scaling behavior


The benefit of DJN will become evident from the
following scaling analysis. Let us consider n jammers,
each with power level of Pn. We impose the constraint of
(c) (d)
total power being P, so nPn = P. First, we introduce the
concept of jamming coverage area:
Figure 2. DJN topologies: line cut (a), parallel cut (b), cross cut
(c), random (d).
Definition 1. The jamming coverage area of a jammer is
defined as the area around the jammer where the received
2.2 DJN jamming mechanism
jamming power exceeds the threshold Pj,t, above which the
In this paper, we consider DJN composed of reactive
jammer causes significant interference with target
jammers, which are among the most effective jamming
devices 2 . The jamming coverage area of DJN is defined as
methods [12]. However, we propose a variant of reactive
all the area in the network where the received jamming
jammers called reactive-adaptive jammer (RAJ). RAJ is
power exceeds the threshold Pj,t.
reactive in the usual sense but it also adapts to target
network packet size, the detail of which is given below. A
Using standard radio path loss model with proper selection
RAJ senses a wide frequency range and jams the channel
of units so that the gain factor is 1, we can find the
on which it detects radio activity. Recent advancement in
jamming coverage area of a jammer as a ball with the
software defined radio and UWB radio provides
radius rn given by:
technology to make wideband sensing possible. The 1
temporal characteristics of a RAJ are its period P and Pn ⎛ Pn ⎞α
intensity I. Specifically, after sensing a busy channel, a = P or r = ⎜ ⎟
rnα
j ,t n
⎜ Pj ,t ⎟
jammer becomes active in I percentage of time in a period ⎝ ⎠
of P seconds after which the jammer restarts sensing again.
So the jamming coverage area of DJN is given by
Next we describe the choice of P and I in a RAJ. Since the
elementary transmission unit in a typical radio is its slot 2
time, P is chosen to be a slot time in target network, which ⎛ P ⎞α
is roughly 20/30 μs in IEEE 802.11/802.15 radios. Since An = po nπ rn2 = po nπ ⎜ n ⎟
⎜ Pj ,t ⎟
jamming stops once the channel is sensed to be idle and ⎝ ⎠
2 2
the sensing is performed at slot intervals, a RAJ
⎛ P ⎞α 1−
2 ⎛
P ⎞α
automatically adapts to target network packet size: large = po nπ ⎜ ⎟ = po n α π ⎜ ⎟
target network packet size causes RAJ jamming for a ⎜ nPj ,t ⎟ ⎜ Pj ,t ⎟
⎝ ⎠ ⎝ ⎠
longer duration whereas small target network packet size
causes RAJ jamming for a shorter duration, but both with In the above, po is the probability that individual jamming
constant intensity I. I is selected to be no less than the areas do not overlap. In the last term above, P/Pj,t is
redundancy provided by the target network error- constant, so we immediately have the following:
correcting code; so that the intensity of jamming is just
enough to ensure that every target network packet is 2
Pj,t depends on the target devices’ deployment and noise tolerance and is
destroyed without wasting unnecessary energy. In typical independent of n.

3 of 6

Authorized licensed use limited to: KTH Royal Institute of Technology. Downloaded on September 16,2022 at 09:12:09 UTC from IEEE Xplore. Restrictions apply.
is the following. The target network has 100 nodes
Proposition 1. Under the total power consumption uniformly randomly deployed in an area of 1500 by 1500
constraint, the jamming coverage area of DJN with n meters, with half of the nodes having CBR UDP sessions
jammers, An, scales as n1-2/α. with the other half of the nodes. All simulations are
• When α > 2, An strictly increases with n. repeated 10 times and the average results are recorded. The
• When α < 2, An strictly decreases with n MAC protocol used is IEEE802.11, and the routing
• When α = 2, An is invariant of n. protocol used is AODV.

The path loss exponent α ranges from 2 (light of sight


propagation in vacuum) to 6 (complex urban
environments). In the practical case where α > 2, we see
the scaling behavior (n1-2/α), favoring a large number of
jammers with low power level. Theoretically, with finite
total power, the jamming coverage area An goes to infinite
as n goes to infinite, as mentioned in the introduction
section. Practically, of course, that is not going to happen
because of the impracticality of making infinitely small
devices.

Table 1. Summary of simulation results


DJN parameters Jamming Performance
Num. of Jammers Increases with number of jammers,
with total jamming power fixed
DJN Topology Random topology is as good as any
regular topologies
Node Mobility Maximizes when target node and
jammer speeds are matched Figure 3. Throughput reduction ratio as a function of number of
jammers

III. SIMULATION STUDY

In the following, we provide simulation results, which


show how the parameters of DJN affect its effectiveness.
Since the temporal characteristics relate mostly to
individual jammer behavior that has accumulated much
previous research results, we focus on spatial characters
that relate to network-wide properties: the number of
jammers in DJN which represents jammer density with
fixed area, network topology of DJN, and the mobility of
DJN that is relevant to mobile ad hoc networks. The
principal metrics of DJN effectiveness are the throughput
reduction ratio and end-to-end delay addition ratio defined
as below:

Average throughput with DJN Figure 4. End-to-end delay addition ratio as a function of
Throughput redution ratio =
Average throughput without DJN number of jammers

Average delay with DJN 3.1 Impact of the number of jammers in DJN
End-to-end delay addition ratio = We start by uniformly randomly deploying 2 jammers with
Average delay without DJN
the same transmitting power as the target device (15 dbm).
Then we increase the number of jammers while reducing
Our simulation is performed using Qualnet [7]. Our main
jamming power, holding the total power consumed by the
findings are listed in Table 1. The setup of the simulation
jammers constant. From Figure 3, we can see at 20

4 of 6

Authorized licensed use limited to: KTH Royal Institute of Technology. Downloaded on September 16,2022 at 09:12:09 UTC from IEEE Xplore. Restrictions apply.
jammers, the throughput reduction ratio drops other; a cross cut composed of two line cuts perpendicular
precipitously. Given that the total power consumption is to each other, and a random topology. All the cuts extend
constant, the benefit of using a large number of low-power to the boundaries of the network. From simulation results
jammers (i.e., DJN) is evident. The trend is similar for shown in Figure 5 and 6, random topology is as effective
end-to-end delay, but without such dramatic changes, see in jamming performance as structured topologies (various
Figure 4. cuts). Therefore there is no need for elaborate topology
arrangement for DJN to be effective.

Figure 5. Throughput reduction ratio as a function of DJN Figure 7. Throughput reduction ratio as a function of target
topology node and DJN mobility

Figure 6. End-to-end delay addition ratio as a function of DJN Figure 8. End-to-end delay addition ratio as a function of target
topology node and DJN mobility

3.2 Impact of DJN topology 3.3 Impact of mobility


We deploy eight jammers in four topologies: a line cut; a Different from previous settings where the target and DJN
parallel cut composed of two line cuts parallel to each nodes are fixed, we make nodes move using the random

5 of 6

Authorized licensed use limited to: KTH Royal Institute of Technology. Downloaded on September 16,2022 at 09:12:09 UTC from IEEE Xplore. Restrictions apply.
waypoint mobility model. We fix the average speed of and target networks makes for intriguing problems, which
target network to be 10 m/s, and change the average speed cut across network layers: device placement, topology
of DJN nodes from 5, 10, 20, to 40 m/s, creating four control, power control, medium access, routing, and data
scenarios: Js < Ns, Js = Ns, Js > Ns, Js >> Ns, where Js transport. Investigating those problems can result in deeper
and Ns indicate the average speeds of DJN nodes and understanding of not only DJN but also wireless networks
target nodes, respectively. From simulation results shown in general. We believe a lot more interesting results can be
in Figure 7 and 8, DJN is most effective with its speed obtained from this approach and are currently working in
matched to that of the target network, and big mismatch in this direction.
speed (e.g., Js >> Ns) causes degradation in jamming
performance. REFERENCES
[1] B. Otis, Y.H. Chee, R. Lu, N.M. Pletcher, J.M. Rabaey, “An Ultra-Low
IV. RELATED PREVIOUS WORK Power MEMS-Based Two-Channel Transceiver for Wireless Sensor
Networks, in Proc. of IEEE Symp. VLSI Circuits, June 2004.
Much previous work on jamming focuses on the physical [2] J. Weldon, K. Jensen, and A. Zettl, “Nanomechanical radio transmitter,”
Phys. Stat. Sol. (b) 245 (10), 2323-2325. 2008.
layer [13]. Recently, papers on jamming in wireless [3] J. M. Kahn, R. H. Katz and K. S. J. Pister, “Mobile Networking for Smart
networks, especially wireless sensor network due to its Dust,” in Proc. of MobiCom 99, Seattle, WA, August 17-19, 1999.
vulnerability from field deployment, began to appear [14]. [4] http://news.bbc.co.uk/1/hi/magazine/3738652.stm
[5] http://games.slashdot.org/article.pl?sid=07/12/17/1514217
A game-theoretical analysis of a transmitter and a jammer [6] http://www.washingtonpost.com/wp-
transmitting to the same receiver was provided in [15]. dyn/content/article/2007/10/02/AR2007100202366_pf.html
[7] http://www.scalable-networks.com/
Denial of service or jamming at MAC layer was studied in [8] http://www.darpa.mil/STO/strategic/wolfpack.html
[9][10]. Jamming detecting and mapping in wireless [9] R. Negi and A. Perrig, “Jamming analysis of MAC protocols,” Carnegie
sensor networks was studied in [16][17]. Error correction Mellon Technical Memo, 2003.
[10] J. Bellardo and S. Savage, “802.11 denial-of-service attacks: Real
codes were proposed as counter-measure to jamming in vulnerabilities and practical solutions,
[18]. Four different jamming attack models (constant, in Proc. of the USENIX Security Symposium, pages 15-28, 2003.
deceptive, random, reactive jammers) and detection [11] X. Liu, R. Rajaraman, G. Noubir, B. Thapa, C. King and E.
Bayraktaroglu, “On the Performance of IEEE 802.11 under Jamming,” in
methods (using signal strength, carrier sensing time and Proc. of IEEE Infocom, April 2008.
packet delivery ratio) were presented in [12]. Two [12] W. Xu et al, “The Feasibility of Launching and Detecting Jamming
Attacks in Wireless Networks,” in Proc. of ACM Int’l. Symp. Mobile Ad
counter-measures (channel surfing and spatial retreats) Hoc Net. and Comp., 2005, pp. 46–57.
were proposed in [19]. An optimization formulation and a [13] C. Schleher, Electronic Warfare in the Information Age, MArtech House,
heuristic for jamming and defense strategies were 1999.
[14] A. D. Wood and J. A. Stankovic, “Denial of service in sensor networks,”
presented in [20]. A MAC-layer protocol DEEJAM was IEEE Computer, vol. 35, no. 10, pp. 54-62, 2002.
proposed to defeat four kinds of jamming (interrupt, [15] R. Mallik, R. Scholtz, and G. Papavassilopoulos, “Analysis of an on-off
activity, scan and pulse) in [21]. In [22] worm-hole among jamming situation as a dynamic game,” IEEE Trans. Commun., vol. 48,
no. 8, pp. 1360-1373, Aug. 2000.
sensor nodes was used to send out attack notification. A [16] A. Wood, J. Stankovic, and S. Son, “JAM: A jammed-area mapping
tree keying scheme in CDMA systems was proposed to service for sensor networks,” in Proc. of IEEE Real-Time Systems
Symposium, pages 286-297, 2003.
combat jamming in broadcast wireless networks [23]. [17] J. M. McCune, E. Shi, A. Perrig and M. K. Reiter,
Jamming in IEEE 802.11 networks was studied in [11]. “Detection of denial-of-message attacks on sensor network broadcasts,” in
The fundamental difference between our work and existing Proc. IEEE Symposium on Security and Privacy, 2005.
[18] G. Noubir and G. Lin, “Low-power DoS attacks in data wireless LANs
work is that we consider the problem from the perspective and countermeasures,” SIGMOBILE Mob. Comput. Commun. Rev.,
of a network of jammers, instead of that of individual 7(3):29-30, 2003.
jammers as typical with previous work. [19] W. Xu, T. Wood, W. Trappe, and Y. Zhang, “Channel surfing and spatial
retreats: defenses against wireless denial of service,” in Proc. of ACM
workshop on Wireless Security, pages 80-89, 2004.
V. CONCLUSION [20] M. Li, I. Koutsopoulos, and R. Poovendran, “Optimal jamming attacks
and network defense policies in wireless sensor networks,” in Proc. of
IEEE Infocom, May 2007.
In this paper we have introduced an effective method of [21] Anthony D. Wood, John A. Stankovic, and Gang Zhou, “DEEJAM:
jamming: DJN. We provided characterization and scaling defeating energy-efficient jamming in IEEE 802.15.4-based wireless
networks,” in Proc. of ACM SECON, 2007.
behavior of DJN, and studied the impact of DJN [22] M. Cagalj, S. Capkun, J.-P. Hubaux, “Wormhole-based anti-jamming
parameters on jamming effectiveness. We believe techniques in sensor networks,” IEEE Trans. on Mobile Computing, vol.
approaching the problem of jamming in wireless networks 6, no. 1, pp. 100-114, Jan. 2007.
[23] Jerry T. Chiang and Yih-Chun Hu, “Cross-layer jamming detection and
from a network perspective can broaden the research scope mitigation in wireless broadcast networks,” in Proc. of ACM MobiCom
significantly and can bring out some interesting results pages 346–349, New York, NY, USA, 2007.
otherwise unattainable by focusing on individual jammers.
As for future work, we think the interplay between DJN

6 of 6

Authorized licensed use limited to: KTH Royal Institute of Technology. Downloaded on September 16,2022 at 09:12:09 UTC from IEEE Xplore. Restrictions apply.

You might also like