Gaining Insight on Friendly Jamming in a Real-World IEEE 802.11 Network

12 Pages·2014·4.02 MB·English

Gaining Insight on Friendly Jamming in a Real-World IEEE
802.11 Network
Daniel S. Berger∗, Francesco Gringoli†, Nicolò Facchi†,
Ivan Martinovic‡, and Jens Schmitt∗
∗DISCOLab,UniversityofKaiserslautern,Germany
†CNIT-DII,UniversityofBrescia,Italy
‡UniversityofOxford,UnitedKingdom
{berger,jschmitt}@cs.uni-kl.de,
{francesco.gringoli,nicolo.facchi}@ing.unibs.it,
[email protected]
ABSTRACT 1. INTRODUCTION
Frequency jamming is the fiercest attack tool to disrupt Radio frequency jamming is commonly understood as a
wireless communication and its malicious aspects have re- severethreattothesecurityandavailabilityofwirelessnet-
ceived much attention in the literature. Yet, several re- works. Suchintentionalinterferenceeffectivelydisruptscom-
cent works propose to turn the table and employ so-called municationonthephysicallayermakingmitigationhard. In
friendly jamming for the benefit of a wireless network. For themilitarycontext,jammingisanestablishedprimitiveto
example, recently proposed friendly jamming applications block an enemy’s communication, and even practical hand-
includehidingcommunicationchannels,injectionattackde- booksonthistopicareavailable[1–3,25]. Thesamethreat,
fense, and access control. however, also applies to the availability of civilian commu-
This work investigates the practical viability of friendly nication networks and received significant research interest
jammingbyapplyingitinareal-worldnetwork. Tothatend, (e.g., [21,23,24,27,38]). Seen from the attacker’s perspec-
weimplementedareactiveandframe-selectivejammerona tive,jammingisasimple,yeteffectivetool. However,these
consumer grade IEEE 802.11 access point. Equipped with arealsodesiredpropertiesfordefensetoolsofasystemand
this, we conducted a three weeks real-world study on the thusthequestionariseswhynotviewjammingasaprotec-
jammer’s performance and side-effects on legitimate traffic tion tool.
(thecostofjamming)inauniversityofficeenvironment. Our This question has recently motivated many researchers
resultsprovidedetailedinsightsoncrucialfactorsgoverning to envision positive use cases of jamming in wireless net-
the trade-off between the effectiveness of friendly jamming works (cf. a list of proposals in Table 1). Such positive
(weevaluatedupto13jammers)anditscost. Inparticular, use cases, however, have different requirements on the jam-
we observed – what we call the power amplification phe- ming technique. In the traditional attack setting, the jam-
nomenon – an effect that aggravates the known hidden sta- merattemptstoblockanycommunicationusuallyonlysub-
tion problem when the number of jammers increases. How- ject to stealthiness or energy constraints [23,24]. On the
ever, we also find evidence that this effect can be alleviated other hand, realistic scenarios in which jamming is used
by collaboration between jammers, which again enables ef- to benefit network operations introduce an orthogonal re-
fective and minimally invasive friendly jamming. quirement: minimal invasiveness. In particular, in order to
coexist with other legitimate networks, only specific trans-
missions should be targeted, whereas the impact on other
CategoriesandSubjectDescriptors
transmissions should be minimal. We henceforth denote by
C.2.1[Computer Communication Networks]: Network friendly jamming such use cases in which jamming is used
Architecture and Design—Wireless communication for the good and strives to be minimally invasive.
Whiletherearedifferentjammingtechniques(cf. adiscus-
sioninSection2),minimalinvasivenessrequiresreactiveand
Keywords
frame-selective jamming. Reactive jamming has been char-
friendly jamming; jamming for good; defensive jamming; acterizedtobeenergy-efficientandeffective[40],andismore
reactive jamming; IEEE 802.11; Wi-Fi; WLAN likely to comply with legal regulations1. Actually apply-
ingfriendlyjamminginpractice,however, facesmanychal-
Permissiontomakedigitalorhardcopiesofallorpartofthisworkforpersonalor lenges. Reactive and frame-selective jamming poses strict
classroomuseisgrantedwithoutfeeprovidedthatcopiesarenotmadeordistributed
timing constraints, and involves further engineering issues
forprofitorcommercialadvantageandthatcopiesbearthisnoticeandthefullcitation
for which solutions have begun to emerge in recent years.
onthefirstpage. Copyrightsforcomponentsofthisworkownedbyothersthanthe
author(s)mustbehonored.Abstractingwithcreditispermitted.Tocopyotherwise,or 1Forexample,themaximumdutycycle(thefractionofone
republish,topostonserversortoredistributetolists,requirespriorspecificpermission
secondatransmitterisactive)iscommonlylimitedtosmall
and/[email protected].
WiSec’14,July23–25,2014,Oxford,UK. values [10]. We briefly remark, however, that jamming, in
general, is a sensitive topic. For example, in the US the
Copyrightisheldbytheowner/author(s).PublicationrightslicensedtoACM.
operation,marketing,orsellingofcontinuousjammerssuch
ACM978-1-4503-2972-9/14/07...$15.00.
as GPS jammers, or cell phone blockers is prohibited [11].
http://dx.doi.org/10.1145/2627393.2627403.
Related Work Technology Problem addressed Js Methodology
Jamming for good [22] 802.15.4 fake messages, unauth. comm. 3+ implementation and evaluation
WiFire [36] 802.15.4 unauthenticated comm. 2 implementation and evaluation
IMD shield [12] (propriet.) unauth. comm.,eavesdropping 1 implementation and evaluation
JammingforThroughput[7] 802.11 performance: hiddenterminals 1 theoretical analysis
Ally Friendly Jamming [31] 802.11 unauthenticated comm. 2+ analysis,implementation,andevaluation
Defend your home [6] 802.15.4 unauth. comm., fake messages 1 implementation and evaluation
Shout to Secure [16] 802.11 eavesdropping 1 simulation
iJam [13] 802.11 key generation 1 implementation
Secure Wi-Fi Zones [17] 802.11 eavesdropping 4+ theoretical analysis and implementation
Wire-Tap Channel (indep.) eavesdropping 1 theoretical analysis, implementations
Table 1: This study is concerned with scenarios requiring a minimally invasive and distributed jamming
system(andanIEEE802.11b/gnetwork). Similarscenariosareassumedin[6,7,12,22,31,36],whereas[13,16,
17]andalsotheWire-TapChannelscenario(umbrellatermcoinedbyWyner[39],seealso[8,20,30,33,41,42])
usually do not assume minimal invasiveness, e.g., the whole channel is often continuously blocked.
Hence, a critical issue is whether friendly jamming works m] −60
asdesiredunderreal-world conditions,i.e.,undermultipath B −70
d −80
effectsandattenuation,orfastchannelfadinginadynamic S [ −90
environment. On a high level, this is thus the key question S−100
R
we address in this paper: Is friendly jamming practically
3000 4000 5000 6000 7000
viable in a real-world 802.11 network? time [us]
Answeringthisquestionbyareal-worldmeasurementstudy,
Figure2: Aparticularchallengeoffriendlyjamming
we delve into the details of two issues, the performance of
is to enable coexistence with other legitimate net-
jamminganditsrelatedcost. Aswewillseethesetwohave
works’traffic(e.g.,nottojamthebeaconinthecen-
to be traded off against each other and the details of that
ter) while accurately jamming target frames (here:
trade-off depend on several factors that we investigate. We
all of the short frames).
base our measurement study on the most widely deployed
wireless communication standard, IEEE 802.11. To that
end, we implemented a friendly jammer by modifying the 5. In additional simulations based on our measurements
microcodeofthewirelesschipsetinacustomer-gradeaccess weinvestigatedmorethoroughtheunderlyingreasons
point, which has been certified to comply with legal regula- why perfect jamming is often infeasible.
tions on power and spectral density requirements. Over a
Therestofthispaperisstructuredasfollows. InSection2
period of three weeks we ran a friendly jamming scenario,
wegivenanintroductiontofriendlyjamming. Thesetupof
recordedallmessagesexchangedatdifferentvantagepoints,
ourexperimentsisintroducedinSection3andisfollowedby
and investigated the jammer’s performance as well as neg-
ourmainresultsinSection4. Section5containsatechnical
ative side-effects on legitimate traffic. By this, we hope to
analysis of jamming success. We discuss related work in
provide an understanding of friendly jamming“in the wild”
Section 6 and conclude in Section 7.
andthusfosterfurtherresearchinthispromisingandinter-
esting domain2.
2. FRIENDLYJAMMING:
Specifically,wecollectedthefollowingmaininsightsfrom
our real-world study: CONCEPTSANDCONSTRAINTS
There are several techniques to disrupt a wireless trans-
1. We found clear evidence that a large number of jam-
mission. The most fundamental approach addresses the
mers is required to ensure high hit ratios.
physical layer on which intentional interference causes er-
2. The sequence of unjammed frames possesses a memo- rors when decoding a transmission’s data. In this section
ryless property – rendering predictions based on past we describe enabling techniques for (radio frequency) jam-
observationsinefficient,whichmakestheirexploitation ming; in particular, we focus on a description of reactive
harder (which is good). jamming as the technique, which lies at the foundation of
friendlyjamming. Weconcludethissectionwithanoutlook
3. The cost of friendly jamming lies mainly in what we on evaluation aspects for our real-world study.
call the power amplification effect, which results in an
2.1 Proactivevs. ReactiveJamming
aggravation of hidden station problems.
There is a variety of techniques to create intentional in-
4. Collaboratively selecting the best jammers can boost terference. Continuously emitting a high power signal, for
theeffectivenessofmultiplejammerswhileminimizing example, requires a lot of power and does not admit other
the cost of jamming. uses of the channel. Other approaches are deceptive jam-
ming(deceivingstationsthatthechannelisoccupied),ran-
2Wedistributeaready-torunversionofourimplementation
dom jamming (randomly alternating between sleeping and
onourprojectpagehttp://www.ing.unibs.it/~openfwwf/
friendlyjammer/. Italsoholdscondensedresulttablesand jamming), and reactive jamming [24,40]. In reactive jam-
samples of the measurement data – we ask for brief email ming, the interfering signal is emitted only when another
inquirytoobtainthefullsourcecodeandmeasurementdata. signalisdetected. Thiscanbedoneselectivelybyanalyzing
−50 detect analyze react
m]
B−70
d
[−90
S
RS−110 TRAIN SFD PLCP CTL DUR ADDR1 ADDR2 SEQ# ADDR3 ADDR4 DATA
7960 7970 time [us] 7980 7990 8000
Figure1: Left: inorderforthejammingframeFjam tosuccessfullyinterferewiththetargetframeFtarget (i.e.,
to render it irrecoverable) it is necessary that the superimposed signal’s power P is significantly higher
jammed
than Ptarget. Right: reactive jamming involves three steps: detecting the signal by means of the training
sequence, analyzing the signal to decide whether or not to jam, and, if so, emitting the jamming signal.
signalsandinterferingonlywithcertainones. Therefore,re- interest. Another question poses itself for friendly jamming
activejammingisthemostattractivejammingtechniquefor in a security setting: is an attacker on the network able to
friendly jamming and can yield minimally invasive applica- predict jamming misses (which could then be exploited)?
tions. This technique is often considered the most sophisti- This predictability constitutes the main attack vector on
catedjammingtechnique[24]andentailsseveralchallenges. friendly jamming systems and, accordingly, should be kept
as low as possible. Finally, we argue that an experimen-
2.2 ReactiveJammingChallenges tal friendly jamming deployment has to be considered from
Reactive jamming starts with the task of channel sensing aworst-caseperspective. Therefore,ourexperimentalsetup
in order to detect a target frame (a signal in IEEE 802.11 assumesarandomplacementofjammersinsteadofchoosing
terminology). The target frame’s detection and further de- preoptimized jammer positions.
codingcanonlybeachievedbyjammerswhicharewellposi-
tionedwithregardtothearrivingsignal(tobespecific: the
3. EXPERIMENTALSETUP
target signal arrives with high signal-to-noise-ratio (SNR)).
Thisposition,withrespecttothesenderandenvironmental Apracticalevaluationofthefactorsdescribedinthepre-
conditions,isthusanimportantfactorforjammingsuccess. vious section requires a realistic implementation and evalu-
Afterhavingdetectedthesignal,thejammerstartsthede- ations in a complex radio communication environment. In
codingandanalysisinordertotakeajammingdecision. In thissectionwebrieflyintroduceourrealizationofafriendly
arealisticscenario,thejammerneedstodistinguishbetween jammer,somemicrobenchmarkstoensurethesystem’sba-
target frames and legitimate frames (Figure 2). While the sicoperation,andthedeploymentusedfortheresultinSec-
jamming hit ratio (#jammedframes/#sentframes) of tion 4.
the former needs to be maximized, the impact of jamming
3.1 JammerHardwareandImplementation
on the latter shall remain small. This trade-off is further
constrained by the fact that the decision has to be taken In order to encounter realistic hardware constraints, we
very fast. We recall these timing constraints by consider- implemented the reactive jammer for our experiments on
ing,say,aframecomprisingamedium-sized100BytesUDP cheap customer-grade hardware that has been certified to
packet. If this frame is transmitted at the fastest 802.11g complywithregulatoryrules. Westartwithabriefdescrip-
ModulationandCodingScheme(MCS),itsdurationisonly tion of this jammer.
48µs. If we further assume that the jamming decision de- Our jammer is implemented directly on the Network In-
pends on bits in the MAC header (e.g., the sender’s MAC terfaceCard(NIC)ofthepopularWRT54GLplatform. Ac-
address), the remaining part of the frame is even another cess to this resource was facilitated by an open source mi-
24µs shorter. In the remaining time, the jammer’s decision crocodefortheaccesspoint’sIEEE802.11NIC(releasedby
codehastobeexecuted,thehardwareneedstoswitchfrom theOpenFWWF[14]project). Thismicrocodereplacesthe
receive to transmission mode, and the jamming signal has proprietaryBroadcomimageandallowsdirectcontrolofall
to be emitted. medium access, decoding, and encoding operations subject
Once the signal is emitted, successful jamming depends to some (humble) hardware constraints due to the micro-
onthetargetframe’sMCSandthejammingsignal’spower. controller’s original purpose. Similarly to [5,28] we altered
While higher power drives high jamming success, this fac- thereceivepathintheassemblycodeandcompiledthejam-
tor is subject to legal regulations and is a crucial factor for mer’sfunctionalityinourownmicrocodethatwouldberun
the detrimental impact on legitimate traffic. A final aspect directly on the NIC.
concerns the systems view of jamming as concurrent jam- AprincipaladvantageoftheBroadcomNICthatweused
merscanimproveuponboththetargetframedetectionand isthatthemicrocodecananalyzeaframewhilestillreceiv-
the jamming signal’s power level. Therefore, the number of ingit: thisfeatureenablesustoimplementflexiblefiltering
concurrent jammer is another important success factor. rules to decide whether or not to emit a jam signal. For
example, the check can be based on matching an incoming
2.3 EvaluatingFriendlyJamming
frame’s header to a dynamic bit mask dynamically config-
In comparison to an attacker’s perspective on jamming, ured from the host system. The experiments in Section 4,
friendlyjammingdemandsabroaderevaluationscope. While however,arebasedonasimplematchofaframe’stransmit-
the jammer’s hit ratio (and corresponding factors) are an teraddress. Afterthejammingdecisionhasbeenpositively
importantperformanceaspect,weadditionallyhavetocon- evaluated,thejammerabortsthecurrentreception,switches
sider some friendly jamming specific aspects. In particular, to transmission mode, and delivers the jam frame to a se-
estimating the cost of jamming in terms of potential nega- rializer, which further handles its emission through the RF
tivesideeffectsonotherlegitimatetransmissionsisofgreat circuitry. The jam signal has to be a standard compliant

dist 1 Jammer 2 Jammers 3 Jammers
5.4m 98.93% (±0.19) 100.0% (±0.00) 99.98% (±0.02) 0j
6.7m 98.57% (±0.85) 99.95% (±0.04) 100.0% (±0.01) 72 172 272 372 472 572 672 772 872 972 1072
8.1m 77.03% (±12.30) 98.37% (±0.29) 99.43% (±0.14) 3j
2 102 202 302 402 502 602 702 802 902 1002
7j
Table 2: Open-space hit ratio (97.5% confidence in-
tervals) under 1−4 jammers and different distances. 65 165 265 365 465 565 665 765 865 965 1065
13j
100 ● ● ● ● ● ● ● ● ● ● ● 38 138 238 338 438 538 638 738 838 938 1038
hit ratio [%] 468000● ● ● re●ceimmmvefmcalorirdsdele Fraebiqgouuvirereetm7o:ebnSetleoqfwour:ens0ec,ve3e,nrau7l,mc1bo3enrjcaudmriramegnerrtasmj.asImnvmieseaurcashl.i,zFberlatohcmke
20 bar: valid checksum, white bar: jammed.
0 1 2 3 4 5 6 7 8 9 10 11 12 13
# jammers
mers60 mers
Figure5: Thehitratioissignificantlylowerin-doors m m400
a a
than in open-space due to attenuation. (0 jammers 3 j40 7 j300
corresponds to packet loss without jamming.) mple − 20 mple − 120000
sa sa 0
MCS.Toaccuratelytracksent,received,andvalid-checksum 20 40 60 0 100 200 300 400
theoretical − geometric distribution theoretical − geometric distribution
statistics, we implemented corresponding low-level counters
that were not impacted by the operation system.
Figure 8: Quantile-quantile plots show good corre-
Insummary,oursetupwascarefullycraftedtoobtainre-
spondence with a geometric distribution for seven
liable target traffic and accurate measurements.
jammers (right) but not for three jammers (left).
3.4 MeasurementData
The experiments were conducted over a three week pe- thejammers. Note,however,thatintheopen-spaceenviron-
riod In November and December 2013 to observe different mentonemaygrosslyunderestimatethenumberofjammers
conditionsandutilizationofthewirelesschannel. Timewas necessaryfortherealisticenvironment. Weobservedthata
dividedintoshortexperimentseachofabout150s,wherein single jammer significantly impacts the target packet rate.
eachexperimentarandomnumberandselectionofjammers Nevertheless,somepositionsclosetothetargetreceiveryield
wereactivateduniformlyfromallpossiblecombinations. In lowhitratios–anobservationthatcanbepartlyexplained
total, this setup generated 13660 experiments with about by the high and irregular attenuation of the office environ-
350GB of measurement data comprising almost 370 million ment(alsoseetheanalysisinSection5). Duetothis,asingle
target frames and 490 million legitimate-traffic frames. jammer’s hit ratio lies between 60−90% (averaged over all
This concludes our description of the experimental setup positions). At least three jammers are required to sustain
and we next report on the insights obtained in this setting. anaveragehitratioabove90%,sevenjammersfor99%,and
the hit ratio graph’s slope only flattens out for more than
4. RESULTS ON FRIENDLY JAMMING IN eleven jammers. This appears to be robust across receivers
at different proximities, which yielded distinct packets loss
THEREALWORLD
rates without any jammers (19−48% at 12−75m, cf. Fig-
In this section, we investigate the trade-off between jam- ure4). Thesefiguresareprobablyhigherthanexpectedand
ming performance and the cost of friendly jamming under must be taken as caveat for friendly jamming applications.
(worst case) random selection of jammer positions; while Position-Dependence. In a open-space testbed the hit ra-
thejammingperformanceincreaseswiththenumberofjam- tiomonotonicallydecreaseswiththejammer’sdistancefrom
mers, the cost of jamming also goes up. We also find evi- thereceiver;incontrasttothis,in-doorbehaviorisquiteer-
dence that friendly jamming can overcome the constraints ratic and there are weak positions even close to a target
of this trade-off by collaboration schemes that heuristically receiver (cf. Figure 6(left)). The impact of these weak po-
select the most appropriate subset of jammers. sitions is more pronounced for robust MCSs (those which
Theconfidenceintervalsthroughoutthissectiongive97.5% are based on direct sequence spread spectrum), and lower
confidencebasedonthet-distribution. Westartbydescrib- numbers of jammers. For example, the hit ratio when av-
ing performance aspects of friendly jamming under the fac- eraging over random placement of three jammers decreases
tors discussed in Section 2. significantly for the robust MCS 1Mb/s, as shown in Fig-
ure 6(center). Already for seven jammers, this issue mostly
4.1 TheJammingPerformance
disappears as it is more likely that a good position is in-
A direct metric to determine a jammer’s performance is cluded in the active jammer set.
the hit ratio for which Figures 5 and 6 show a selection of Invariance to Seasonal Effects. Figure 6(right) shows the
significant factors. average rate of legitimate traffic and the hit ratio of three
Number of Jammers. We first evaluate the effect of the and seven jammers over the measurement period. While
numberofjammersbeingused. Bothinanidealopen-space the legitimate traffic rate shows the expected habitual vari-
environment(Table2)andourdynamicindoorsetting(Fig- ations,thehitratioremainsprettystableforboththreeand
ure 5), an increasing number of jammers increases the hit sevenjammers. Forthreejammers,weobservesomeexcep-
ratio due to improving the detection and emitted power of tions to this, e.g., on November 20 the hit ratio of three
100●rate ● ● ● ● ● ● ● 100 b/s] 2
hit ratio [%]257505 ● 51641 hit ratio [%]468000 recemmivfmaeirdrdle day−avg [M 1
1000rate●1 3 ●distanc●e: ●ja6m●●mer t●o re●ce●iver 9[m] ● ●12 10200 1adapte6r rate1 [1Mmbcplos5se]4 hit ratio [%]10678900000 ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ●
hit ratio [%]257505 ● 516141 ● ● hit ratio [%]468000 recemmmivfmcaeloirdsrdele hit ratio [%]107890000 ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ●re●c●emmmiv●efmcalroirds●dele
0 20 60
10 20 1 6 11 54 Mon 18−Nov Mon 25−Nov Mon 02−Dec
distance: jammer to receiver [m] adapter rate [Mbps]
Figure 6: Left: in open space a single jammer’s hit ratio decreases monotonically with the distance (top),
whereas the indoor evaluation shows erratic behavior (bottom), indicating the need for careful real-world
deployments. Center: robustadapterrates(MCSs)suchas1Mb/shaveatremendousimpactonthehitratio
of three jammers (top), but less on seven jammers (bottom). Right: while the legitimate traffic’s throughput
showsweeklypatterns(top),thehitratioofthree(center)andseven(bottom)jammersremainalmoststable.
s
jammers goes down significantly due to some untraceable target
eventsaboutwhichwecouldonlyspeculate. Note,however, r target transmission
that we observe no impact on seven jammers. ● target jamming signal
Temporal Distribution of Misses. Besides the hit ratio, r jammer
anothermetrictodetermineajammer’sperformancecanbe s leg legitimate transmission
basedontemporalcorrelationsofmissedframes. Ifjamming leg time
is used to block an attacker from sending, e.g., malicious
packets,thenrunsofconsecutivelymissedframesconstitute Figure 9: Assume that a target transmission and
a greater threat compared to the case in which the same a remote legitimate transmission would be inter-
numberofframeswasmissedspread-outovertime. Figure7 ference free without jammer. Nevertheless, a jam-
shows a sequence number diagram of representative traces, mer located between them may interfere with both
which depicts how increasing the number of jammers yields transmissions: intentionally, with the target trans-
amoreuniformdistributionofthemissedframesoverthese- mission; collaterally, with the legitimate transmis-
quencenumberspace. Weformalizethisaspectbyastochas- sion. We call this effect power amplification.
ticmissmodel. Thequantile-quantileplotsinFigure8show
that for seven jammers, the geometric distribution yields a
Inordertoassessthiscost,wedistinguishlegitimateframes
goodfit. Sincethegeometricdistributionismemoryless,i.e.,
from target frames (and, possibly, jamming signals) in our
having observed any number of past misses does not yield
measurement data. This required some attention because
information about a future miss, this property ensures that
fragments resulting from the target and jammers’ frames
the prediction of future target frame misses (attack oppor-
couldnoteasilybedistinguishedfromactuallegitimateframes
tunities) is hard – even when an attacker is able to observe
duetohighbiterrorlevels. Weusedatwo-runprocedureon
thefriendlyjammingsystemoveralongtime. However,our
the measurement data: the first run discovered valid legit-
analysis shows that at least seven jammers are required to
imate transmitter MAC addresses, and the actual analysis
provide this property. For example, three active jammers
wascarriedoutonasecondruninwhichframeswithsmall
are not enough to enforce this property (Figure 8(left)).
Hamming distance from the legitimate addresses were con-
This section gave an overview on global jamming perfor-
sidered. This analysis was also verified selectively down to
manceaspects. Notethatthespecificvaluesofthehitratio
the bit level of individual frames.
dependonourimplementation,whichwedeliberatelybased
Loss of Legitimate Traffic and Power Amplification. In-
on cheap customer-grade hardware as a feasibility study.
creasingthenumberofjammersaffectslegitimatedifferently
However, we argue that some of the fundamental proper-
depending on their respective positions (with regard to the
tiespresentedinthissectionapplytoamuchbroadersetof
target sender and the jammers). We attribute this effect to
jammers, which adhere to FCC or EU regulations.
what we call the power amplification effect: the jammers
The next section focuses on an orthogonal aspect – how
can significantly increase the interference radius of any tar-
invasive is friendly jamming.
gettransmission. Thiscanbeseenbyconsideringascenario
(seeFigure9foranillustration)inwhichalegitimatesender
islocatedfarawayfromthetargetsenderandtransmissions
4.2 TheCostofFriendlyJamming
of the two senders would be free of interference. Assume a
In this section, we investigate the side effects of friendly jammer is located between the two senders and can receive
jamming on legitimate traffic in the network. Note that le- andinterferewithtransmissionsofbothsenders. Ifthelegit-
gitimateframeshavenotbeentargetedbytheframe-selective imate sender starts a transmission, the target source could
jammers; instead, any adverse effect on legitimate traffic is possibly start a concurrent transmission as well. Without
collateral – the cost of friendly jamming. jammers, both transmissions may proceed without prob-

hit ratio [%]10889900505 ● ● ● ● ● malized packet loss [%]104680000 ● ● ● ● ● srr−x−−cclrlsts 1164 111164 221164 331164 441164 551164 661164 771164 881164 991164 11001164
75 rnd s−clsr−clsrx−rtideal nor rnd s−clsr−clsrx−rtideal 18 118 218 318 418 518 618 718 818 918 1018
ideal
Figure 14: Left: the hit ratio of the proposed 98 198 298 398 498 598 698 798 898 998 1098
jammer-collaboration schemes. Right: the packet
Figure 15: Sequence number diagrams shows the
loss of far-away packets (affected by the power am-
effectivenessofthecollaborationschemesalreadyfor
plificationphenomenon)normalizedtorandomjam-
three jammers – compare to Figure 7.
mer configurations with the same hit ratio.
power amplification effects. The latter is measured as the
the (re)associations of individual stations, and found that normalizedpacketlossoffar-awaypacketswherenormaliza-
there is a small number of significantly affected stations. tionisdonetoconfigurationsthatyieldthesamehitratio4.
Figure 13(right) depicts that there exist some far-away sta- The simple s-cls scheme significantly increases the jam-
tions that loose connectivity more likely with an increasing ming performance and also reduces the effect of the power
number of active jammers. Interestingly, we also found ev- amplification phenomenon. We attribute this improvement
idence of a close-by station, which is more badly affected to the fact that the receiver and the sender are positioned
when there is a small jammer count. close to each other and far-away jammers are efficiently ex-
In summary, we again emphasize the trade-off between cluded. The extension, the r-cls scheme, yields a slightly
jamming performance and the cost of jamming: enabling a better hit ratio than s-cls and can reduce the packet loss
largernumberofjammersisnecessarytoboostthehitratio even further. However, we remark that this scheme is less
but also increases the collateral damage to legitimate traf- practical than s-cls. The third practical scheme rx-rt can
fic. Whilenotunexpected,weobtaineddetailedquantitative outperform s-cls slightly, but with overlapping confidence
statementsonthecostofjamminginareal-world802.11net- intervals. While all collaboration schemes improve signif-
work. These results were obtained under the assumption of icantly over random jammer selection, their hit ratios are
randomjammerplacement–alimitationajammingsystem 2.5−4%belowtheideal case–indicatingsomefurtherroom
might be able to overcome, and which we investigate in the for improvement and more sophisticated schemes.
following section. We also compared sequence number diagrams of the four
proposed collaboration schemes. Figure 15 displays the dif-
4.3 JammerCollaborationSchemes
ferences of the schemes with respect to this performance
In this section, we show the potential of jammer collab- metric. It again also shows the gap in performance to the
oration, by which we mean that jammers are selected ac- ideal case. Nevertheless, while the misses of the random
cording to some deterministic rule instead of randomly as jammer selection do not possess the memoryless property
above. Thispromisestoimprovethehitratiowhileremain- ofthegeometricdistribution,themissesofallcollaboration
ingmarginallyinvasive,basedontheprevioussection’sfind- schemes come closer (r-cls) or achieve it (s-cls, rx-rt).
ingthatthejammer’spositioniscriticaltoboththeperfor- We also studied the schemes for seven jammers. In that
manceandcostoffriendlyjamming. Weinvestigatethispo- case, the mean hit ratio is about 98.95% for s-cls, 99.41%
tential by comparing three practical collaboration schemes for r-cls, 99.62% for rx-rt, and 99.95% for the ideal case.
to the theoretic optimum observed in our experiments. This completes the measurement analysis, and we next
The simplest idea is to select the jammer closest to the address the jamming success in more detail.
sender (e.g., realized by trilateration) and is called s-cls. If
the jamming system can observe bidirectional communica- 5. DETAILEDANALYSISOFJAMMING
tionattemptsbetweentargets,thejammersmaybeableto SUCCESS
infer the location of the intended receiver and the jammers
closest to the receiver can be selected. One can expect the In the previous section, we observed friendly jamming to
correspondingscheme,r-cls,toimprovethehitratiobecause hit target traffic only imperfectly as there will always be
respectivejammerswouldbeclosertothereceiverandthus some successfully received frames under power constraints.
theirjamsignalsarrivewithhigherenergy. Ourthirdprac- Thisfindingholdsevenunderveryfavorableconditions: the
ticalschemeisbasedontheideatoselectjammersbasedon long-term hit ratio in a static environment (at night) with
their reception quality. More specifically, the scheme rx-rt large numbers of jammers with constant jamming power
selects those jammers that received the highest number of never reaches 100%. Under the assumption that only de-
targetframes. Whilethisheuristiconlyconsidersthechan- tection, reaction time, and power determine jamming suc-
nelfromthereceivertothejammer,onemayspeculatethat cess (for fixed MCS and other conditions), one may wonder
it also corresponds to better jamming positions in general. why this is the case. This section investigates explanations
We evaluate these schemes’ performance with three jam- forthissomewhatmysteriousfinding. Inparticular,wealso
mers. The theoretical ideal scheme, which always picks the address the reason why jamming affects frame differently
most successful jammers based on a posteriori knowledge, despite equal power levels.
and the average performance of random jammer placement 4If scheme x achieves a hit ratio of 90%, the normalized
are considered as ground truth. Figure 14 compares the hit packetlossofxis: (packetlossofx)/(packetlossofrandom
ratio of the schemes and the magnitude of their respective jammer configuration, which yields a 90% hit ratio)

dfriaffmereesnt dfriaffmereesnt
Figure 19: The simulated hit ratio for different
frames (averaged over all symbol alignments) shows
that two jammers significantly increase the hit ratio
for low to medium jam amplitudes.
tion that any symbol alignment can occur with the same
probability. Figure 19 shows that doubling the number of
jammersmorethandoublesthehitratio;forexample,when
the amplitude is 50%, a single jammer’s hit ratio is maxi-
Figure 18: An explanation for the observation that mally20%,butwithtwojammersahitratioof40−90%can
jamming is only sometimes successful at the same beobtained. Thisisduetothefactthatunfavorablesymbol
jamming power: the jamming success depends on alignmentsforseveraljammersatthesametimebecomein-
both the relative amplitude (jamming signal to tar- creasinglyunlikelysincethejammersbehaveindependently
getsignal)and thesymbolalignment. Foreachsym- (a probabilistic explanation results from the superposition
bol, four alignments are displayed: jamming is suc- of uniform distributions which result in low probability for
cessful for exact bit alignment (0%) and small devi- simultaneously bad alignments).
ation (25%, 75%). Jammed packets are often decod-
able for an alignment corresponding to a 50% sym- 6. RELATEDWORK
bol delay (the peaks). Top: single frame, bottom:
Friendlyjammingrelatestoavarietyofresearchtopicsin
entire trace with shades of gray corresponding to
the field of radio communication. In this section, we briefly
jamming/decoding probability.
reviewpreviousworkonfriendlyjammingapplications,eval-
fullBarkerchipsequences(2µs,22chips),butfindthatthe uations, and studies on interference properties.
jammingsuccessisdeterminedmostlybythealignmentwith Friendly Jamming Applications. Recentproposalscanbe
respect to each symbol. roughly grouped into two main categories based on their
Wenextextendthesameanalysistoadditional27frames. intentions: 1) jamming for blocking unauthorized commu-
We can interpret this analysis stochastically as the proba- nications [6,12,22,31,36], and 2) jamming for improving
bilitythatframescanbedecodedforaspecificcombination secrecy of communications [12,16,17,33] (see also works on
of alignment and jam amplitude. Figure 18(bottom) shows theWire-TapChannelduetoWyner[39]).Thefirstcategory
that, in principle, the findings obtained for a single frame isthemostrelevantmotivationourstudy. Forexample,Gol-
carry over to the other frames in our trace. However, note lakotaetal.[12]andBrownetal.[6]proposetousereactive
that there are subtle differences. For example, the minimal jammingtoblockunauthorizedcommandsfrombeingtrans-
jam amplitude required increases by 3−5% and the pa- mittedtoimplantablemedicaldevices(IMDs)ortodevices
rameter regions indicating jamming success are less clearly in the smart home. Similarly, Wilhelm et al. [36] rely on
defined. At the highest evaluated jamming amplitude of reactive jamming to enforce rules similar to a firewall. All
120%,someframescanstillbedecodedforaparticularcon- friendly jamming proposals of this category share the goal
figuration that corresponds to an alignment close to a full ofjammingonlyparticularframesintheairmotivatingthus
Barker sequence (close but not exactly bit alignment). the evaluation of the cost of jamming in Section 4.2.
We also extended the simulations to the case of two jam- The second category also employs jamming as a tool but
mers: thesamemethodasbeforeisused,butthejamframe addresses a different use case. Intentional interference en-
issuperimposedtwice(independently)withall28framesin suresthateavesdroppingisrenderedinfeasiblesincethejammed
the capture. We explored the space of all possible symbol- messages cannot be decoded. Authorized nodes, however,
alignments for both jam frames and consider the fraction can successfully receive the messages as the interfering sig-
of decodable packets for an equal amplitude for both jam nalisknowntothem(asasharedsecret): thesenodescancel
signals. Figure 20 shows the improvement of a two-jammer outtheinterferingsignaltorecovertheoriginalmessage. An
configuration over a single jammer for low relative jam am- interesting work by Kim et al. [17] defines a computational
plitudes of 37%, 59%, or 74% (from left to right). While model to optimize the arrangement of jammers protecting
most frames can be decoded for a single jammer, two jam- an area around an access point. Their setting differs from
mersimprovethejammingsuccessratesignificantly. Never- our setting in that the jammers continuously emit a jam
theless, the actual effectiveness still depends on the respec- signal and the corresponding negative impact on other net-
tive symbol alignments: the jammers are successful if their works can only be controlled by power settings and the use
alignment corresponds to delays close to 50%, as expected. ofdirectionalantennas(andisnotevaluatedintheirwork).
Finally, we connect the pieces of symbol alignment, jam Evaluation of Friendly Jamming. Previous works mainly
amplitude,andthenumberofjammers: weconsiderthehit implemented reactive jamming on software defined radio
ratioastheaverageprobabilityresultingundertheassump- (SDR)platforms(e.g.,[4,6,36,37])anddidnottargetrealis-