Alibi framework for identifying insider jamming attacks in half-duplex wireless local area networks

Nguyen, Hoang V.

Permalink

https://hdl.handle.net/2142/16889 Copy

Description

Title

Alibi framework for identifying insider jamming attacks in half-duplex wireless local area networks

Author(s)

Nguyen, Hoang V.

Issue Date

2010-08-20T18:00:55Z

Director of Research (if dissertation) or Advisor (if thesis)

Nahrstedt, Klara

Doctoral Committee Chair(s)

Nahrstedt, Klara

Committee Member(s)

• Campbell, Roy H.
• Vaidya, Nitin H.
• Yau, David

Department of Study

Computer Science

Discipline

Computer Science

Degree Granting Institution

University of Illinois at Urbana-Champaign

Degree Name

Ph.D.

Degree Level

Dissertation

Keyword(s)

• wireless security
• jamming attacks
• intrusion detection systems
• alibis
• system-level fault diagnosis
• wireless LANs

Abstract

"Recent advances in wireless communications and digital electronics have enabled rapid development of a variety of wireless network technologies, such as wireless LANs, home networks, multi-hop ad hoc networks, and sensor networks. Wireless networks, unfortunately, are vulnerable to radio jamming attacks (in short, ``jamming attacks'') due to the open and shared nature of wireless medium. In a jamming attack, an attacker injects a high level of noise into the wireless system which significantly reduces the signal-to-noise ratio (SINR) and reducing the probability of successful message receptions. Even though the spread spectrum technologies have raised the bar for the jamming defenses, they cannot deal with insider jammers who launch the stealthy and intelligent jamming attacks from compromised nodes. To cope with such dangerous insider jammers, the first and most important step is to identify them. In this dissertation, we consider the problem of identifying the insider jammers. Our approach to this problem is unique: we exploit the half-duplex nature of the attackers. Specifically, a half-duplex jammer has the following characteristics: - It cannot send on two different channels simultaneously due to a non-negligible channel switching time. - It cannot receive on two different channels simultaneously due to a non-negligible channel switching time. - It cannot send and receive on a channel simultaneously due to a non-negligible transmit-to-receive switching time. Therefore, when a compromised node jams, it cannot either send or receive any other packets. More importantly, if an honest node is observed doing a send or receive action at the same time of the jammed packet, it can arguably prove that it cannot be the cause of the jammed packet. In other words, the honest node obtains an ""alibi"". Alibi is ""a form of defense whereby a defendant attempts to prove that he or she was elsewhere when the crime in question was committed"". In the context of jamming attacks, an alibi for a node is a proof showing that an honest node could not commit a jamming action at a specific time because it was witnessed doing a legitimate action at the same time. We focus on exploring the alibi framework in dealing with insider jammers. We study various properties of the framework including detection accuracy, detection time, network availability and necessary conditions for the alibi framework to work. We also investigate different designs of the alibi framework such as sending-based alibis and receiving-based alibis and study their strengths and weaknesses. We evaluate the alibi framework by the analysis, simulations and MICAz experiments. To the best of our knowledge, the alibi framework is the first framework exploiting the half-duplex nature of the nodes to identify insider attackers."

Graduation Semester

2010-08

Permalink

http://hdl.handle.net/2142/16889

Copyright and License Information

Copyright 2010 Hoang Nguyen

Owning Collections