IEEE - Aerospace and Electronic Systems - February 2020 - 6

Interference and Intrusion in Wireless Sensor Networks
type of attack and the associated detection process. Hereafter,
critical WSN applications and an adopted WSN protocol are
used as a case study to provide a review of WSN vulnerabilities, security and attacks, including coexistence intrusion.
Notably, this article discusses WSN attacks in terms of both
the unlawful transmitter and the noncompliant spectrum
user. Whilst existing research focuses on malicious spectral
intrusions in terms of jamming attacks, this article highlights
the idea of using coexisting signals as malicious intruders.
This article's contribution is expanded by highlighting the
need to focus on WSN jamming for IoT penetration testing
and deployment security.

SIGNAL MODEL
Here, the IEEE 802.15.4 based wireless protocol for low
rate wireless personal area networks (LR-WPAN), ZigBee, is the chosen signal model, since, currently, it is the
de facto standard for WSNs (as almost all available commercial and research sensor nodes are equipped with ZigBee transceiver chips [27]). The operating topology is
either star, mesh or peer-to-peer and, in each case, is selforganizing, self-repairing, dynamic, and can exploit clustering approaches [15]. Cluster heads are, typically, used
as relay nodes which aggregate and forward data to a centralized sink. An example is using nanosatellites as relay
nodes (cluster head), allowing access to remote areas by
using the nanosatellites as links between each cluster and
centralized sink [7]. ZigBee is constructed using the PHY
and MAC from IEEE 802.15.4 and uses a protocol-specific network layer, application support sublayer, and
application object layer [28]. Relevant PHY parameters
are shown in Table 1 and three different frequency bands
are supported: a 2.4 GHz band (16 channels), a 915 MHz
band (10 channels), and an 868 MHz band (1 channel).
Here, the 2.4 GHz band is selected and the 16 available
2 MHz wide channels, which range from
2400!2483.5 MHz and have an interchannel gap of
3 MHz, have center frequencies as per (1), where Fc and i
are the center frequency and channel number, respectively
Fc ¼ 2405 þ 5ði À 11ÞMHz; for i ¼ 11; 12; . . . ;26:

(1)

These frequencies are transmitted in the unlicensed
ISM frequency band and must coexist with various signals
including Bluetooth, numerous LR-WPAN, wireless local
area networks, and wireless metropolitan area networks.
Due to the unlicensed operation, global availability, and
relatively long-range, the ISM frequency band is the first
choice for wireless LAN solutions. To gain access to the
wireless channel, ZigBee uses carrier sense multiple
access with collision avoidance (CSMA/CA). Prior to
transmitting a packet, devices perform a clear channel
assessment to ensure the channel is available. This
6

Table 1.

ZigBee PHY Parameters
Parameter:

2.4 GHz PHY Value:

Number of channels

Channel spacing/width
Data | Symbol rate

5 MHz

2 MHz

250 kb/s

62:5 ksymbols/s

2 Mchips/s

Chip rate
Modulation

O-QPSK

Pulse shaping

Half sine/normal raised
cosine

Spreading

DSSS

Maximum packet
length

133 B

technique is particularly vulnerable to DoS attacks and
spectrum-sharing difficulties.
ZigBee uses direct sequence spread spectrum (DSSS)
to split each outgoing byte into two 4-bit symbols, four
most significant bits and four least significant bits. Each
symbol is spread to a 32-bit pseudonoise sequence from a
predefined mapping table. Chip sequences are encoded
using offset quadrature phase-shift keying (O-QPSK) with
half-sine/normal raised cosine pulse shaping. Matlab simulations, using random payload bits, produced the example in-phase and quadrature phase (IQ) data in Figure 1(a)
and associated IQ diagram, which illustrates the constant
envelope nature of the signal, in Figure 1(b). The equivalent energy-per-bit ðEb Þ can be calculated using the period
over which one byte is broadcast ðTByte Þ and (2), where C
is the signal power in Watts.
Eb ¼

TByte Ã C
J/bit
8

(2)

The packet error rate (PER) for a ZigBee signal in a zero
mean additive white Gaussian noise (AWGN) channel was
calculated to illustrate normal operation (see Figure 2). A
range of energy-per-bit-to-noise ratios ðEb =N0 Þ were applied
using a ZigBee frame (see Table 2) with a randomized payload. The predicted PER was calculated using the probability
of receiving an incorrect symbol ðPe Þ, given 16 unique
DSSS pseudonoise codes and an AWGN channel. Assuming
a matched filter receiver, the symbol error probability can be
expressed as (3), where s in (4) is the variance, erfðÞ is the
error function, and L is the number of codes. The corresponding PER is estimated using (5), where NBytes is the number
of bytes per packet
Z
Pe ¼ 1 À

IEEE A&E SYSTEMS MAGAZINE

eÀ ðÀ1þyÞ
2s 2
pﬃﬃﬃﬃﬃ
ﬃ
2ps
À1
1

LÀ1
1 1
y
þ erf pﬃﬃﬃ
dy
2 2
2s

(3)

FEBRUARY 2020

IEEE - Aerospace and Electronic Systems - February 2020

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - February 2020