IEEE - Aerospace and Electronic Systems - February 2020 - 10

Interference and Intrusion in Wireless Sensor Networks
typically, depends on the strength of the transmitting
power or how "transparent" the approach needs to be.

CONVENTIONAL JAMMING ATTACKS
These active attacks, typically, aim to overpower the legitimate signal with spurious RF transmissions. While higher
jamming power increases attack effectiveness, it also
boosts detectability. As such, the adversary is typically
driven to optimize signal interference to maximize packet
loss, while minimizing total broadcast power. Such attacks
include the following.
1) The constant jammer continuously emits RF signals of
random data into the wireless medium without following any MAC protocol, can be readily detected and is
energy inefficient. However, this jammer can be easily
implemented and causes severe damage to a WSN, as
congestion or destruction of packets can be achieved
and the channel can appear permanently busy.
2) The deceptive jammer regularly transmits protocol
specific packets into the network without pausing
between successive packets, thereby preventing normal sources from transmitting successfully. Due to
the transmission of legitimate packets, it is more
difficult to detect than a constant jammer and can
cause considerable damage in WSNs adhering to
MAC protocols, which are sensing for channel
access or the presence/absence of a signal.
3) Random jammers sporadically transmit random packets of data and conserve energy by switching between
the jamming state, when jamming signals are emitted,
and the sleeping state, when all transmissions are
ceased. This unpredictable behavior makes this jammer difficult to mitigate and can cause similar levels
of damage as the constant and deceptive jammers.
4) A reactive jammer [19] operates in idle mode until
some legitimate activity is detected on the wireless
channel. An RTS/CTS jammer detects request to send
(RTS) messages and interferes with the channel to
block any clear to send (CTS) messages, thereby
denying further communications. Data acknowledgment jammers corrupt acknowledgment packets after
a transmission has been sensed in the network and
misleads nodes to decide that packets were undelivered, thereby invoking a retransmission and, potentially, resulting in the exhaustion of the power supply.
This is particularly effective in protocols, such as ZigBee, which use CSMA/CA.
5) Specific function jammers perform explicit functions,
depending on their calibration, and cause jamming on
either a specific channel or across an entire network,
while minimizing their energy consumption or
10

maximizing their attack effect. For example, followon jammers jam one specific frequency at a time and
maximize packet loss by continuously hopping
between the channel frequencies. These jammers can
be detected but are very effective, particularly in networks that use frequency hopping spread spectrum or
when identified spectrum holes [36] are used to
improve performance through spectrum sharing.
Another example is the channel-hopping jammer,
which follows a predefined pseudorandom sequence
of channels and starts jamming at different time slots
according to this sequence. By overwriting the
sequence, multiple channels can be jammed at the
same time. Finally, pulse noise jammers can be programmed to switch between different channels/bandwidths and conserve energy by temporarily halting
transmissions.

INTELLIGENT JAMMING ATTACKS
Intelligent jammers are a combination of a passive and an
active attack, as the jammer initially targets network privacy before inevitably targeting data packets. These devices are more likely to cause jamming but are harder to
implement than conventional jammers [29]. Protocol
aware and statistical jammers aim to determine the MAC
protocol being used by the victim's network in order to
launch energy efficient attacks [31]. Protocol aware jammers know the MAC layer operating rules and can deprive
legitimate nodes of access to the channel and can, potentially, affect services identifying free channels or spectrum
holes, used to, potentially, enhance spectrum coexistence [36]. Statistical jammers observe the packet interarrival time distribution and, based on its estimation, emit
pulses of jamming signals to disrupt communications
(DoS attack). Once the estimation is achieved, energy efficiency can be increased through pulse jamming. Collision
makers target the identified acknowledgment packets by
inhibiting transmissions. Certain intelligent jammers identify the cluster head/sinks by monitoring the network traffic and focus attacks on that specific node in an
''intelligent cluster head attack." Learning-based jammers, like LearJam, have been produced to attack low
duty cycle networks where nodes sleep most of the time (a
typical WSN characteristic) and consist of a learning
phase, wherein the node transmission pattern is observed,
and an attacking phase, where these transmissions are
compromised. Therefore, clearly attackers are now able to
learn the MAC and/or protocols in use by eavesdropping
(privacy attack) on the channel for some period of time.
This attack style could, for example, be launched on techniques for sensing the presence or absence of a signal
(CSMA/CA or spectrum sharing), by learning when a service should be idle and producing "dummy" packets to
avert potential transmissions.

IEEE A&E SYSTEMS MAGAZINE

FEBRUARY 2020

IEEE - Aerospace and Electronic Systems - February 2020

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - February 2020