15
M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen Cheng a , Ping Li a , Sencun Zhu b,1 and Don Torrieri c a School of Mechatronical Engineering, BeiJing Institute of Technology, Beijing 100081, China b Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA 16802,US c US Army Research Laboratory, Adelphi, MD 20783 US Abstract. Jamming is one of the most severe attacks in wireless sensor networks (WSNs). While existing countermea- sures mainly focus on designing new communication mechanisms to survive under jamming, a proactive solution is to first localize the jammer(s) and then take necessary actions. Unlike the existing work that focuses on localizing a single jammer in WSNs, this work solves a multi-jammer localization problem, where multiple jammers launch collaborative attacks. We develop two multi-jammer localization algorithms: a multi-cluster localization (M-cluster) algorithm and an X-rayed jammed-area localization (X-ray) algorithm. Our extensive simulation results demon- strate that with one run of the algorithms, both M-cluster and X-ray are efficient in localizing multiple jammers in a wireless sensor network with small errors. Keywords. Multi-jammer localization, wireless sensor networks, clustering, skeletonization. 1. Introduction As sensor nodes with networking capabilities be- come commercially available in recent years, wire- less sensor networks (WSNs) have been increas- ingly used in industrial and civilian applications as well as in military applications; e.g., indus- trial process monitoring and control, environment and habitat monitoring, traffic control, and bat- tlefield surveillance [13]. When sensor networks are deployed in unattended or adversarial envi- ronments, security becomes a major concern [2]. Jamming, which is one of the most serious secu- rity threats in the field of WSNs, occurs when an adversary simply disregards the medium access protocol by continually transmitting on a wire- less channel. The jamming is assumed to originate from sources embedded within the WSN or from compromised sensors. Jamming can easily prevent normal devices from communicating with legiti- mate MAC operations, introduce packet collisions that force repeated backoffs, or even jam trans- 1 Corresponding Author. Tel.:+10(814)865 0995 E-mail address: [email protected], lip- [email protected], [email protected],[email protected]. missions [34]. However, it is challenging to defend against jamming, because WSNs suffer from many constraints, including low computation capability, and limited memory and energy resources. To protect the communication in WSNs, many algorithms have been proposed to detect and defend against jamming, such as detection by jamming measurements [34], jamming evasion by channel surfing [35], and spread spectrum [28]. Most of these algorithms only detect jamming or try to keep the wireless sensor network work- ing under jamming. Among the countermeasures against jamming, determining a jammer’s loca- tion within a wireless sensor network is critical to launching certain security actions against the adversary, e.g., deactivating the jamming device, isolating the jammer, or even destroying it. Only a few works have attempted to identify the phys- ical locations of jammers in a wireless sensor net- work, and most of them [22,18,29] only focus on the scenario of a single jammer. A more severe jamming often involves more than one jammer. Multiple adversaries may attack the network at the same time, or even one adver- sary may use multiple wireless devices to achieve a better jamming effect. This multi-jammer scenario

M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

M-cluster and X-ray: Two Methods for Multi-JammerLocalization in Wireless Sensor Networks

Tianzhen Cheng a, Ping Li a, Sencun Zhu b,1and Don Torrieri c

a School of Mechatronical Engineering, BeiJing Institute of Technology, Beijing 100081, ChinabDepartment of Computer Science and Engineering, Pennsylvania State University, University Park, PA16802,UScUS Army Research Laboratory, Adelphi, MD 20783 US

Abstract. Jamming is one of the most severe attacks in wireless sensor networks (WSNs). While existing countermea-sures mainly focus on designing new communication mechanisms to survive under jamming, a proactive solution isto first localize the jammer(s) and then take necessary actions. Unlike the existing work that focuses on localizinga single jammer in WSNs, this work solves a multi-jammer localization problem, where multiple jammers launchcollaborative attacks. We develop two multi-jammer localization algorithms: a multi-cluster localization (M-cluster)algorithm and an X-rayed jammed-area localization (X-ray) algorithm. Our extensive simulation results demon-strate that with one run of the algorithms, both M-cluster and X-ray are efficient in localizing multiple jammersin a wireless sensor network with small errors.

Keywords. Multi-jammer localization, wireless sensor networks, clustering, skeletonization.

1. Introduction

As sensor nodes with networking capabilities be-come commercially available in recent years, wire-less sensor networks (WSNs) have been increas-ingly used in industrial and civilian applicationsas well as in military applications; e.g., indus-trial process monitoring and control, environmentand habitat monitoring, traffic control, and bat-tlefield surveillance [13]. When sensor networksare deployed in unattended or adversarial envi-ronments, security becomes a major concern [2].Jamming, which is one of the most serious secu-rity threats in the field of WSNs, occurs whenan adversary simply disregards the medium accessprotocol by continually transmitting on a wire-less channel. The jamming is assumed to originatefrom sources embedded within the WSN or fromcompromised sensors. Jamming can easily preventnormal devices from communicating with legiti-mate MAC operations, introduce packet collisionsthat force repeated backoffs, or even jam trans-

1Corresponding Author. Tel.:+10(814)865 0995E-mail address: [email protected], [email protected], [email protected],[email protected].

missions [34]. However, it is challenging to defendagainst jamming, because WSNs suffer from manyconstraints, including low computation capability,and limited memory and energy resources.

To protect the communication in WSNs,many algorithms have been proposed to detectand defend against jamming, such as detectionby jamming measurements [34], jamming evasionby channel surfing [35], and spread spectrum [28].Most of these algorithms only detect jammingor try to keep the wireless sensor network work-ing under jamming. Among the countermeasuresagainst jamming, determining a jammer’s loca-tion within a wireless sensor network is criticalto launching certain security actions against theadversary, e.g., deactivating the jamming device,isolating the jammer, or even destroying it. Onlya few works have attempted to identify the phys-ical locations of jammers in a wireless sensor net-work, and most of them [22,18,29] only focus onthe scenario of a single jammer.

A more severe jamming often involves morethan one jammer. Multiple adversaries may attackthe network at the same time, or even one adver-sary may use multiple wireless devices to achieve abetter jamming effect. This multi-jammer scenario

Page 2: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

would make the existing jammer localization al-gorithms inapplicable [22,18,29]. More specifically,we define the multi-jammer scenario as collabora-tive jamming by multiple jammers whose jammingregions overlap. All the individually jammed areasare then merged and can be regarded as a singlejammed area. Any separate jammed area wouldonly be considered as the single-jammer scenario.This multi-jammer scenario raises new challengesto jammer localization, as multiple jammers needto be localized in a more complex setting.

In this work, we develop two algorithms todeal with the multi-jammer localization problemin WSNs: a multi-cluster localization (M-cluster)algorithm and an x-rayed jammed-area localiza-tion (X-ray) algorithm. The M-cluster algorithmis based on the grouping of jammed nodes witha clustering algorithm, and each jammed-nodegroup is used to estimate one jammer location.The X-ray algorithm relies on the skeletonizationof a jammed area, and uses the bifurcation pointson the skeleton to localize jammers. We made acomprehensive study of our algorithms under var-ious conditions determined by node density, jam-mer transmission power, jammer deployment, andnumber of jammers. Our simulation results showthat M-cluster and X-ray can achieve a mean lo-calization error of 6.5 meters and 5 meters, re-spectively, in the two-jammer scenario. comparedwith the mean error of 38.5 meters in a baselinescheme, M-cluster and X-ray improve the localiza-tion accuracy by 80% and 86%, respectively.

The rest of the paper is organized as follows.We review related work in Section 2, and intro-duce our multi-jammer scenario with network andjammer models in Section 3. Then, we describeour algorithms in Section 4, and show the simula-tion results in Section 5. In Section 6, we give fur-ther discussions and talk about future work. Weconclude our paper in Section 7.

2. Related Work

2.1. Jamming Detection

Jamming detection gives one the knowledge ofthe presence of jammers in a wireless network.The existing jamming detection methods enhancenetwork protection by triggering countermeasuresand providing relevant information. In [34], Xu et

al. studied four different jamming models based onjamming behaviors (constant, deceptive, random,or reactive), and examined different measurementson detecting jamming, including packet send ra-tio (PSR), packet delivery ratio (PDR), signalstrength, and carrier sensing time. Cakiroglu etal. [3] proposed two algorithms for detecting ajamming, which are based on bad packet ratio(BPR), packet delivery ratio (PDR), energy con-sumption amount (ECA), and neighboring nodeconditions. Li et al. [14] proposed a sequential jam-ming detection technique that works when an in-creased number of message collisions are observedduring an observation window, compared withthe previously learned long-term average. Misraet al. [20] selected packets dropped per terminal(PDPT) and signal-to-noise ratio (SNR) as the in-put to their fuzzy inference system. Based on theMamdani model, the system outputs the jammingindex (JI) of each node. Strasser et al. [25] sug-gested a method for detecting a reactive jammerthrough received signal strength (RSS) and bit er-ror rate (BER) sampling.

2.2. Countermeasures against Jamming

Spread-spectrum (SS) physical-layer techniquesusing direct-sequence or frequency-hopping spreadspectrum [28] are well-known countermeasuresagainst communication jamming. These solutionsrequire that both the sender and the receiver sharethe same key and the same pseudorandom func-tion to generate a hopping or spreading sequence.UFHSS [26] and UDSSS [26] deal with the prob-lem of key establishment without pre-shared se-cret under jamming. Jamming and (unintentional)interference are further thwarted by the applica-tion of forward error-correcting codes and specialcoding methods [28].

For WSNs, Wood et al. [32] proposed DEE-JAM, a new MAC-layer protocol for defendingagainst stealthy jammers using IEEE 802.15.4-based hardware. Xu et al. [35] presented two tech-niques, called channel surfing and spatial retreats.The main idea is to increase the resistance to jam-ming by avoiding the interference as much as pos-sible in either the transmission frequency domainor the spatial domain.

Chiang and Hu [7] introduced a technique tomitigate jamming for broadcast applications byadopting a binary key tree to control code se-

Page 3: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

quences in DSSS. Dong and Liu [9] introduceda jamming-resistant broadcast system that or-ganizes receivers into multiple channel-sharingbroadcast groups and isolates malicious receiversusing adaptive re-grouping. Jiang et al. [12]proposed a compromise-resilient anti-jammingscheme called split-pairing to deal with insiderjamming in a one-hop network setting. Liu andNing [17] proposed an encoding method calledBitTrickle to defend against broadband and high-power reactive jamming. Tague et al. [27] pro-posed a framework for control channel accessschemes using the random assignment of crypto-graphic keys to hide the location of control chan-nels in the presence of insider jammers. Wang etal. [30] proposed a delay-bounded adaptive onlineUFH algorithm for anti-jamming wireless commu-nication.

2.3. Localization against Jamming Devices

A few jammer-localization algorithms have beenproposed for WSNs. Pelechrinis et al. [22], basedon packet delivery ratio (PDR) and gradientdescent methods, designed and implemented alightweight jammer localization algorithm. Theirapproach can find out the nearest node to thejammed area. Liu et al. developed a jammer lo-calization algorithm called Virtual Force Itera-tive Localization (VFIL) [16] and another algo-rithm [18] that exploits nodes’ hearing ranges.Torrieri proposed a direction-finding and local-ization method based on the special characteris-tics of spread-spectrum communications and mul-tiple antennae [11,24]. Cheng [6] proposed a newjammer localization algorithm, called Double Cir-cle Localization (DCL). DCL uses two classicconcepts in geometry, minimum bounding circle(MBC) and maximum inscribed circle (MIC), tosolve the jammer localization problem. All theseworks focused on jammer localization in the con-text of a single jammer, and did not study themulti-jammer scenario in WSNs.

Recently, Liu et al. [15] tried to address thecase of two jammers coexisting in wireless net-works by leveraging the network topology changescaused by jamming. They studied the jammingeffects under two jammers and developed an ap-proach to localize jammers under comprehensivesimulations. However, their work does not have de-

tails about how to address the scenario with morethan two jammers.

In our recent work [5], we also made a pre-liminary study of this multi-jammer localizationproblem by proposing the X-ray method. In thiswork, we significantly extended our previous workin the following ways. First, we introduce a newtechnique called M-clustering for multi-jammer lo-calization. A comparative study has been madefor M-clustering, X-ray and a baseline scheme(as shown in Section 5). Pros and Cons of M-clustering and X-ray are also discussed (in Section6). Second, we propose a method for jammer num-ber estimation without the knowledge of jammertransmission range (in Section 3.3). Further, weshow through simulation that our algorithms cantolerate well the errors caused by false estimationof jammer number.

3. The Case of Multiple Jammers in WirelessSensor Networks

3.1. Effects of Multiple Jammers

Jamming is defined as the act of intentionally di-recting electromagnetic energy towards a commu-nication system to disrupt or prevent signal trans-mission [21]. Wireless devices can successfully re-ceive information based on the signal-to-noise ra-tio (SNR) (SNR = Psignal/Pnoise), where P is theaverage power. Noise represents the undesirableelectromagnetic spectrum collected by antennasincluding the electromagnetic energy from jam-ming. If the SNR of a received message is below aminimum SNR threshold, the message cannot becorrectly extracted and decoded from radio sig-nals. Accordingly, the receiver is considered to bejammed.

The multi-jammer scenario can be describedas follows. Multiple jammers perform collabora-tive jamming in WSNs, and they have overlap-ping jammed areas. We do not consider the scenar-ios of a single jammer or multiple jammers withnon-overlapping jammed areas. Indeed, these lat-ter two scenarios can be simply solved by an exist-ing single-jammer localization algorithm [16,18].

Compared with a single-jammer strategy, amulti-jammer strategy has several advantages toan adversary. First and the foremost, under the

Page 4: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

0 10 20 30 40 500

0.5

1

1.5

2

2.5x 10

4

Overall Power (W)

Jam

med

are

a (m

2 )

five jammersthree jammerstwo jammersone jammer

Fig. 1. Jammed area comparison of the single-jammerand multi-jammer strategies. X axis represents theoverall jamming power used by the jammer strategies.Jammers in one strategy share out the overall jam-ming power.

same overall budget of power, the multi-jammerstrategy is more power-efficient than the single-jammer strategy because of the rapid attenua-tion of jamming signals. In Figure 1, we comparethe size of jammed areas in four strategies un-der the same overall power : one, two, three andfive jammers. For simplicity, the jammed area in amulti-jammer strategy is the sum of jammed areascaused by all the jammers. As the overall power isfixed, if more jammers are used, each jammer willbe assigned less power (1/n of the overall power,where n is the number of jammers ). Figure 1shows that, under the same overall power budget,more jammers result in a larger jammed area (i.e.,a better jamming effect). However, from the per-spective of a defender, more jammers mean morejamming-attack strategies, and hence more chal-lenges to protect communication and to localizejammers.

We further show a possible topology in amulti-jammer scenario. In Figure 2, according totheir connectivity, sensor nodes in the network aredivided into three categories: (a) jammed node,which has no communication with its neighbornodes; (b) unaffected node, whose connectivityhas not been affected by jamming; (c) boundarynode, whose neighbor nodes are partially jammed.These nodes are represented in black, white andgrey dots, respectively. We note that, in the regionwhere two jammed areas meet, the electromag-netic environment is very complex. In our work,we use the sum of received signal strength of alljamming signals as the jamming power at each

Jammed NodeJammer Un affected Node

Boundary Node Jammed range

Fig. 2. An illustration of three jammers with overlap-ping jamming region in the wireless sensor network.

Base station

Unaffected

nodes

Boundary

nodes

Jammed nodes

Layer

L1

L2

L3

L4

Collect node state information and perform

our localization algorithms;

Provide node state information to layer L1;

Entity Roles in our algorithms

Provide jammer information to layer L1 and

layer L2

Transmit and/or listen to channels for

transmission opportunity

Fig. 3. An overview of the network entities and their rolesin our algorithms

node. Therefore, as the powers of the differentjamming signals accumulate, some nodes near tothe intersection areas of jammed regions also be-come jammed.

3.2. Network and Multi-jammer Models withAssumptions

Network Model. In this paper, we first assumethat WSNs are randomly deployed and static,and a base station is deployed to gather informa-tion and runs our multi-jammer localization al-gorithms. Nodes are assumed to know their ownlocations and can detect jamming. Some existingtechniques might be used to provide such informa-tion [19,34]. Also, every node maintains a neigh-bor list and has such information as their loca-tions and activeness (jammed or not). By periodi-cally broadcasting a beacon message, this list canbe easily obtained, and any change of the statusof neighbors will be updated. In Fig. 3, we showthe different types of entities and their roles in thenetwork at the time of jamming.

Page 5: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

Radio Propagation Channel Model. In our work,we use the radio propagation channel model inwhich the ratio of received to transmitted powerin dB is given by

Pr

PtdB = 10 log10K − 10γ log10

d

d0− ψdB , (1)

where ψdB is a zero-mean Gaussian-distributedrandom variable that models the shadowing, K isa unitless constant that depends on the antennacharacteristics and the average channel attenua-tion, d0 is a reference distance for the far-field an-tenna, γ is the power-law attenuation or path-lossexponent, and fading is neglected [10,28]. In thesimulations, the shadowing is neglected by settingψdB = 0 dB, but both shadowing and fading willbe considered in future work. The power-law at-tenuation is γ = 3.71, and K = 31.54.. The radiotransmission is assumed to be omnidirectional.Multi-Jammer Model. Multiple jammers work to-gether and transmit either the same or differentjamming power levels. All jammers are deployedwith their locations fixed. To model the deploy-ment of multiple jammers in WSNs, we imposea constraint from the adversary’s viewpoint. As-sume there are n jammers in a wireless sensor net-work, the distance Dij between jammer i and itsnearest-neighbor jammer j should follow this con-dition:

Dij ∈ [ω(Ri +Rj), (Ri +Rj)], (2)

where Ri and Rj are the transmission ranges ofjammer i and jammer j, respectively. ω ∈ (0, 1) isa variable. In general, a smaller ω implies closerdistance between two nodes. Unless specified, ωis set to 0.5 in this work, and we will study howthis parameter affects performance in our simu-lation section. Under this condition, jamming re-gions are merged, and the jamming impact is op-timized. Note that although multiple jammers canbe deployed very closely to one another (i.e., witha small ω), such deployments would waste the po-tential ability to jam more nodes. Moreover, whendeploying multiple jammers very closely, localiz-ing one of them would be more likely to exposethe other ones that are close. Indeed, the jammersthat are overly close can be treated as a single jam-mer. Jammers without overlapping jammed areas(i.e., ω = 1) will be not considered in this paper,

R

tR tR

R

Fig. 4. Determining the parameter λ which is to beused in estimating the number of jammers.

as each of them can be localized individually as asingle jammer [16,18].

3.3. Jammer Number Determination

In this paper, we will mainly focus on determiningthe locations of multiple jammers at one time withthe number of jammers already known. How to ac-curately detect the number of jammers in WSNsin our multi-jammer scenario could be an inter-esting but undecidable problem as jammers canvary their transmission powers. As such, we ad-dress this problem with heuristic approaches un-der different knowledge assumptions. We will alsoshow the impact of false number estimations inthe simulation section.

The scenario with the jammer-transmission-range knowledge.

Under the approximate propagation model,the jammed area by each individual jammer iscircular. We first roughly estimate the averagejammed area of one jammer, then use it to esti-mate the number of jammers existing in the actualjammed area. In Fig. 4, R is the average trans-mission range of a jammer, and 2tR is the aver-age distance between two jammers. The averagejamming area of a single jammer without consid-ering overlapping is SSingleJammer = πR2. Theaverage jamming area of one jammer consideringoverlapping is Savg = λSSingleJammer, which iscalculated as SSingleJammer minus the area of theshadowed zone in the figure. Hence, we can deriveλ = (1−arccos(t)/π+t

√1− t2/π). By correlating

t with the concept of ω in Eq.(2), we can expressit as t = (1+ω)/2. Using the parameter λ, a roughestimate of the jammer number is

Njammer = ⌈ SJammedArea

λSSingleJammer⌉ (3)

Page 6: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

where ⌈x⌉ denotes the smallest integer greaterthan or equal to x. After the number of jammersin the network is estimated, we run our multi-jammer localization algorithms.

The scenario without the jammer-transmission-range knowledge. First, if multiple jammers se-quentially turn on to launch jamming [15], the po-sition of the first jammer could be estimated bya single-jammer localization algorithm, and thejammer’s transmission range could be obtained.Second, if jammers simultaneously turn on, basedon the shape of the jammed area, we can analyzethe width of multiple parts of the jammed areaand estimate the extent of jammer’s transmissionrange. Because of the rapid attenuation of radiosignals, the range of significant jamming powershould have an upper limit, RJmax, (indeed, this iswhy we have multiple jammers) as well as a lowerlimit, RJmin. To jam the regular wireless commu-nication between two good nodes, the lower limitof jammers’ transmission range generally shouldbe larger than good node’s transmission range,Rnode. Here we set RJmin ≥ 1.5Rnode. Then wecan estimate the jammer number as follows:

Njammer ∈ [SJammedArea

πR2Jmax

,SJammedArea

λπR2Jmin

]. (4)

Figure 5 shows our simulation results aboutour jammer-number detection method. The x axisrepresents the number of simulations in differentjammer number scenarios, while the y axis is thenumber of jammers. Here ω = 0.5. In Fig. 5, ev-ery circle represents the actual jammer number inevery simulation, and every (red) dot is the es-timated jammer numbers based on Eq.(3). Alto-gether, four multi-jammer scenarios are simulated(i.e., 2, 3, 4 and 5 jammers), where each scenarioshows 50 simulation results. From the simulationresults, we observe that our method works cor-rectly in both the 2- and 3-jammer scenarios. Ithas only 3 false detections among all 50 simula-tions in the 4-jammer scenario, where the esti-mated numbers become 3 instead of 4. There arealso 3 false detections in the 5-jammer scenario,where two numbers become 6 instead of 5. We ob-serve that circles spread out when jammer num-ber increases. This is because the jammed areasare overlapped in more complex ways when jam-mer number increases, making our previous wayof estimating λ less accurate. As it is very diffi-

0 50 100 150 200

2

3

4

5

6

Simulations

Jam

mer

Nu

mb

er

SSREJN

Fig. 5. Jammer-number determination in differentmulti-jammer scenarios.

cult, if not impossible, to estimate the jammingnumber perfectly under various jamming strate-gies, we will instead show the impact of false num-ber detection on the performance of our jammerlocalization algorithms in Section 5.

4. Two Multi-jammer Localization Algorithms

In this section, we present two algorithms formulti-jammer localization, M-cluster and X-ray.As we will see through algorithm descriptions andsimulations: M-cluster is an efficient algorithm,but its localization accuracy is affected by the dis-tribution of sensor nodes in the network. Hence,we design X-ray to improve the localization accu-racy, at the cost of higher computational complex-ity and the assumption that a jammed-area map-ping protocol such as JAM [31] is available in thenetwork.

4.1. The Multiple Cluster Localization(M-cluster) Algorithm

We will describe our first multi-jammer localiza-tion algorithm for WSNs, called Multi-cluster Lo-calization Algorithm (M-cluster), which dividesjammed nodes into different clusters based onclustering algorithms and the number of jammersin the network.

Motivation. In a multi-jammer scenario, jammedareas covered by different jammers overlap andthey together form a large jammed area. If we di-rectly run an existing single-jammer localizationalgorithm, the result will be inaccurate. However,if we can first find out the jammed area belong-ing to each jammer, we can then apply a single-jammer localization algorithm to localize each

Page 7: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

Normal node

Jammed node

Jammer

(a)Three jammers exist in WSNs (b)Three clusters generated by MC

(c) Three jammers location are

estimated.

Estimated jammer by MC

Fig. 6. Overview of the multi-cluster localization algorithm

in WSNs.

jammer. Accordingly, we develop our M-cluster al-gorithm, which groups jammed nodes into clustersand applies the centroid localization (CL) algo-rithm [16] to estimate each jammer’s location. TheM-cluster algorithm involves the following threesteps, as depicted in Fig. 6:

4.1.1. Feature Selection or Extraction.

Clustering algorithms divide a group of objectsinto subgroups based on similarity measures. Ev-ery clustering algorithm is based on the indexof similarity or dissimilarity between data points,where the similarity or dissimilarity measures relyon descriptions of data points with features. Toclassify jammed nodes, M-cluster first needs tochoose features. Feature selection chooses distin-guishing features from a set of candidates, whilefeature extraction utilizes some transformations togenerate useful and novel features from the orig-inal ones. Both feature selection and feature ex-traction are very important to the effectiveness ofclustering applications. A different clustering cri-terion or clustering algorithm, even for the samealgorithm but with different selection of param-eters (features), may cause completely differentclustering results.

In our M-cluster algorithm, for N jammednodes with d features, we build an N × d pat-tern matrix to represent the pending data, anduse the Euclidean distance to describe quantita-tively the similarity of two data points or twoclusters. The Euclidean distance between nodesnx = (x1, x2, ..., xd)

T and ny = (y1, y2, ..., yd)T is

calculated as

D(nx, ny) = (d∑

j=1

(xj − yj)2)1/2. (5)

where x, y are features belonging to nx and ny, re-spectively. In this paper, we select the coordinatesof jammed nodes as one feature for the similaritymeasure. Although some other features may alsobe applied, such as received signal strength (RSS),packet deliver ratio (PDR) and so on, they are dif-ficult to be obtained in a jammed wireless sensornetwork. As such, we do not choose them in thiswork.

4.1.2. Selection of Clustering Algorithms.

The next step is to choose an appropriate cluster-ing algorithm to do the grouping by optimizinga criterion function. A criterion function is con-structed with the similarity measures of featuresselected or extracted in the previous step. Clus-tering techniques are generally classified as parti-tional clustering and hierarchical clustering, basedon the properties of the generated clusters [33].Partitional clustering directly divides data pointsinto some pre-specified number of clusters with-out the hierarchical structure, while hierarchicalclustering groups data with a sequence of nestedpartitions, either from singleton clusters to a clus-ter including all individuals or vice versa. In hi-erarchical clustering the goal is to produce a hi-erarchical series of nested clusters, ranging fromclusters of individual points at the bottom toan all-inclusive cluster at the top, generating atree structure called a dendrogram. However, inthe scenario of jammed-nodes clustering, we wantto produce a one-layer partition of the jammednodes without any hierarchical structures. Hence,we choose the partitional clustering approaches togrouping nodes. Meanwhile, as jammed areas haveoverlaps with each other in the multi-jammer sce-nario, nodes in the jammed area may be affectedby more than one jammer. As such, jammed nodesmay also belong to more than one cluster.

Therefore, the fuzzy partitional clustering ismuch more suitable for this special situation, asall data points in the data set are allowed tobelong to all clusters with a degree of member-ship. In our multi-jammer localization problem,we use a classic clustering algorithm, Fuzzy c-Means (FCM) [33], which performs clustering ina fuzzy way (i.e., objects can belong to multiple

Page 8: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

clusters in a certain degree). FCM attempts to finda partition, represented as c fuzzy clusters, for aset of data objects xj ∈ ℜd, j = 1, . . . , N , whileminimizing a cost function:

J(U,M) =

c∑i=1

N∑j=1

(uij)αD2

ij , (6)

where

• U = [uij ]c×N is the fuzzy partition ma-trix and uij ∈ [0, 1] is the membership co-efficient of the jth object in the ith clusterthat satisfies the following two constraints:∑c

i=1 uij = 1, ∀j, which assures the sameoverall weight for every data point, and0 <

∑Nj=1 uij < N, ∀i, which assures no

empty clusters;• M = [m1, . . . ,mc] is the cluster prototype(mean or center) matrix;

• α ∈ [1,∞) is the fuzzification parameterand a larger α favors fuzzier clusters;

• Dij = D(xj ,mi) is the Euclidean distancebetween xj and mi.

4.1.3. Localization Calibration.

Next, M-cluster computes cluster centers accord-ing to the output of FCM partition. Only nodes inone cluster can be used in the centroid localization(CL) algorithm to compute the centroid of thiscluster. Based on the knowledge of jammer trans-mission range or its scope, M-cluster improves re-sults by producing an imitation for each jammedarea, which is a circular area centered at the esti-mated location of each jammer. If the estimationperfectly matches the real location of the jammer,then no boundary nodes should be covered by theimitated jammed area. Hence, if some boundarynodes are covered, M-cluster moves some clustercenters to improve the final estimation accuracy.

More specifically, let us assume that a set ofboundary nodes {(Xi, Yi)} are covered by the im-itation, a corresponding jammer location estima-tion is (Xe, Ye), and node (Xm, Ym) is a boundarynode in {(Xi, Yi)} that is nearest to the estima-tion. Then, the new coordinate of the jammer isestimated as

(Xe, Ye) = (Xe+Dstep×Xe−Xm

Dem, Ye+Dstep×Ye−Ym

Dem),

Normal node

Jammed node

Jammer

Estimated jammer by XRay

(a) Jammed area mapped with a convex polygon

(b) Jammed area skeletonization

(c) Determination of the jammers’ locations

Fig. 7. An overview of X-Ray multi-jammer localizationalgorithm in WSNs.

where Dstep is a constant step distance, and Dem

is the distance between node m and the estima-tion. M-cluster does this improvement iterativelyuntil no boundary node is falsely covered. Afterthis improvement, M-cluster outputs the final es-timations of jammers’ locations.

4.2. The X-rayed Jammed-Area Localization(X-ray) Algorithm

In this section, we describe our second multi-jammer localization algorithm, called an x-rayedjammed-area localization (X-ray) algorithm, whichskeletonizes jammed areas and estimates jam-mer locations based on the bifurcation points onskeletons of jammed areas. Here, we show anoverview of the x-rayed jammer localization algo-rithm. As Fig. 7 shows, this X-ray algorithm canbe divided into three phases: jammed-area map-ping, jammed-area skeletonization and jammer-location determination. A more detailed algorith-mic flowchart is shown in Fig. 8.

4.2.1. Jammed-Area Mapping.

Wood et al. [31] have presented “JAM”, a jammed-area mapping service, which can roughly producea jammed area. However, since their work mostlyfocuses on jammer detection, node communica-tion and protocol design, the precise jammed areais not defined clearly. As sensor nodes in WSNsare interspersed in a target field, and there are alot of blank spaces between sensors, it is a chal-lenge to generate the jammed area simply and pre-

Page 9: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

Jammed area

mapping

Jammed area

skeletonization

Locating

bifurcation

points

K-means

clustering

Jammer location

estimation

Result improving

Output Final

jammer locations

Nodes in WSNs

Fig. 8. An algorithmic flowchart of X-Ray

cisely. In X-ray, we compute a convex polygon ofjammed nodes as a jammed area for the processthat will follow. A convex polygon, also called aconvex hull or a convex envelope in mathematics,is defined as a polygon with all its interior anglesless than 180◦; that is, all the vertices of the poly-gon will point outwards, away from the interiorof the shape. Algebraically, the convex hull of Xcan be characterized as the set of all the convexcombinations of finite subsets of points from X,as in the following formula:

Hconvex(X) = {k∑

i=1

αixi | xi ∈ X,αi ∈ ℜ,

αi ≥ 0,

k∑i=1

αi = 1, k = 1, 2, ...} (7)

We show this step in Figure 7(a), where the three-jammer jammed area is denoted by a convex poly-gon enveloping all jammed nodes. Only the spaceenveloped by the convex polygon is regarded asthe jammed area.

Although some contour-tracing algorithmscan be used to identify and produce the jammedarea, they mostly process integral images in pix-els [4]. However, here we only obtain images com-posed by a cluster of points, and all pixels are sep-arate, so contour tracing algorithms will be un-able to identify the jammed area. Hence, in thisjammed-area identification scenario, we computethe convex polygon of all jammed-node points inthe field as the jammed area. This has a few ad-vantages for our localization algorithm. First, theconvex polygon is simple and easily computed.

There are many existing schemes to compute theconvex hull of points that can be operated unam-biguously and efficiently [23,8]. The complexity ofthe corresponding algorithms is usually estimatedin terms of n, which is the number of input points,and h, which is the number of points on the con-vex hull. Second, using a convex polygon may re-duce the impact of much noise and fluctuation onthe boundary of the jammed area while conserv-ing most of the information about the jammedarea; consequently, the skeletonization algorithm(the next step) will easily process the jammed-areamap. This is because most skeleton algorithmsare sensitive to boundary deformation; that is,little noise or a variation of the boundary oftengenerates redundant skeleton branches that mayseriously disturb the topology of the skeleton’sgraph [1].

Through simulations, we also notice that someunjammed nodes may be covered by our convexhull in certain scenarios, which leads to concavecases. To address this concave problem, we com-pute the convex hull of the miscovered nodes, andsubtract this area from the original convex hull ofthe entire jammed area, as in the following equa-tion:

Hconcav = Hconcex −Hmiscovered.

4.2.2. Jammed-Area Skeletonization.

In shape analysis, the skeleton (or topologicalskeleton) of a shape is a thin version of that shapethat is equidistant to its boundaries. The skele-ton can serve as a representation of the shape (itcontains all the information necessary to recon-struct the shape). A formal definition is as follows:a skeleton is the locus of the centers of all maximalinscribed hyper-spheres (i.e., discs and balls in 2Dand 3D, respectively). An inscribed hyper-sphereis maximal if it is not covered by any other in-scribed hyper-sphere. All points on the final skele-ton will have the same distance to more than oneboundaries of the jammed area. Specifically, ourX-ray algorithm will leverage the skeletonizationmethod proposed by Xiang [1], which can pro-duce a stable skeleton without spurious branches,and therefore provide accurate skeleton informa-tion for the following process. More details can befound in the reference [1].

Page 10: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

4.2.3. Jammer-Location Determination andImprovement.

As shown in Figure 7(b), we can see the skele-ton of the jammed area has multiple bifurcationpoints (or skeleton joints), which are introducedby angles on the convex polygon of the jammedarea. Due to the discrete distribution of sensornodes in a WSN, on the edge of the jammer’s in-fluence region, the jammed area has no smoothcircular edge; hence, the skeleton of the jammedarea has branches (bifurcations) at the extrem-ity of the main skeleton. These branches conservethe location information of the jammers. Based onthe coordination information of these bifurcationpoints on the skeleton, X-ray can roughly localizethe multiple jammers in WSNs. Then the bifurca-tion points can be divided into groups based ona K-means clustering algorithm. Finally, the cen-troid of the coordinates of all points in one groupis considered as the estimated location of a jam-mer.

Once the locations of jammers are computed,X-ray calibrates the result based on some specificheuristics. First, as in the M-cluster algorithm, weconsider the falsely covered boundary nodes andcalibrate the result in a similar way. Second, wediscover that when many bifurcation points be-long to one jammer, the clustering technique mayfalsely divide them into two clusters, resulting intwo jammers. X-ray discovers this error by usinga filter that measures the distance between twoestimated jammers. As we previously discussed inSection 3, for the purpose of jamming a greaterarea with the same number of jamming devices,an adversary should separate the jamming devicesmore. As such, for two estimated jammers i, j,whose distance satisfies the following condition:

Dij ∈ {d|d < ω(Ri +Rj)}, (8)

where R is the transmission range of jammers andω is the constant variable used in Eq. 2, X-raymakes the following calibration. These two esti-mated jammer locations will be merged into one,whose coordinate is the central of the two esti-mated jammer locations. Then X-ray generates animitation of the jamming area with one fewer jam-mers. Due to the lack of one jammer, this imi-tation might miss some jammed nodes. If so, X-ray records these jammed nodes that are uncov-

ered by the imitation and computes their averagecoordinate as another estimated jammer location.After finishing this calibration, X-ray reports thelocations of multiple jammers.

5. Performance Evaluation

In this section, we first show our simulation setupand performance metrics, and then compare ourmulti-jammer localization algorithms under vari-ous network conditions as a function of networknode density, jammer transmission power, jammerdeployment scenario, and number of jammers inWSNs.

A random-selection multi-jammer localiza-tion scheme. For the purpose of comparison, wepropose a naive random-selection multi-jammerlocalization scheme as the baseline scheme. Thisrandom scheme localizes jammers based on thecoordinates of jammed nodes. After the numberof jammers is estimated, it randomly chooses theirlocations.

5.1. Simulation Setup and Performance Metrics

In our simulation with MATLAB, we deploy sen-sor nodes in a 400-by-400 meter region, with thenormal communication range of each node set to30 meters. Jammers are randomly located in thecenter of this field, following the distance con-straint stated in Section 3. Unless specified, trans-mission ranges of jammers are set the same (60meters), and the number of jammers is set tothree. For our radio propagation channel model,we set some typical values for the parametersK = 31.54 and γ = 3.71. To find out the per-formance of our algorithms under different nodedistributions, we use two network deployments:simple deployment and mesh deployment. In sim-ple deployment, following a uniform distributionnodes are randomly disseminated in the region,while nodes may congregate at some spots andmiss other areas. In mesh deployment, to increasethe coverage of the network, the region is meshedinto smaller grids, while nodes are divided accord-ing to the number of grids. The nodes are uni-formly deployed in each grid. For each experiment,we generate 1000 network topologies to obtainhigher accuracy.

Page 11: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

2 4 5 0

5

10

15

20

25

Jammer Number (c)

Err

or(m

eter

)

X−ray (mesh)M−cluster (mesh)X−ray (simple)M−cluster (simple)

400 500 6005

10

15

20

Node Density (a)

Err

or(m

eter

)

X−ray (mesh)M−cluster (mesh)X−ray (simple)M−cluster (simple)

60 70 805

10

15

20

Transmission Range(b)

Err

or(m

eter

)

X−ray (mesh)M−cluster (mesh)X−ray (simple)M−cluster (simple)

Fig. 9. Impacts of different conditions on X-ray and M–cluster in multi-jammer localization: (a) Node density,(b) Jammer transmission range, (c) Jammer number.

To measure the performance of the algo-rithms, we use localization error as the metric,which is defined as the Euclidean distance be-tween the estimated jammer locations and thetrue locations. More specifically, let (xt, yt) bethe true location of a jammer, and (xe, ye) beits estimated location. The localization error isErr =

√(xe − xt)2 + (ye − yt)2). We show both

the cumulative distribution functions (CDF) ofaverage localization errors and bar charts of themean localization errors of 1000 simulations.

5.2. Evaluation Results

Impact of node density. First, we study the im-pact of node density on the performance of ouralgorithms. In this part, we adjust the total num-ber of nodes by setting it to 400, 500 and 600, re-spectively and calculate the mean errors for bothM-cluster and X-ray. Two scenarios of simple de-ployment and mesh deployment are shown in thesame figure. From Figure 9(a), we observe that X-ray has consistently better performance than M-cluster in all node density and node deploymentsetups. In the mesh deployment scenario, X-ray’smean errors fall between 6 to 9 meters, while M-cluster’s mean errors fall between 8 to 11 meters.M-cluster has a greater improvement in the local-ization accuracy as the node deployment modelchanges from the simple style to the mesh style;in other words, M-cluster is more influenced bythe deployment style of sensor nodes in WSNs.Meanwhile, both M-cluster and X-ray have betterperformance when node density increases.

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error (meter) (a)

CD

F

X−rayM−clusterRandom

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error (meter) (b)

CD

F

X−rayM−clusterRandom

Fig. 10. Impact of different node density with thetransmission range set to 60 meter: (a) N=400, (b)N=600.

We also provide a view of CDF curves for bothour algorithms and the random scheme in Fig-ure 10. Here, we only show the performances in the400 and 600 node cases under the simple deploy-ment model. Again we observe that X-ray has thebest performance, 90% of the time X-ray can esti-mate the three jammers’ locations with mean er-rors less than 15 meters, while M-cluster achieves20 meters 90% of the time. The results of bothalgorithms improve when node density increaseswhile no clear influence is observed on the randomscheme.

Impact of jammer transmission range. Tostudy the impact of jammer transmission rangeon the performance of our algorithms, we evaluatethese algorithms in two settings: same fixed trans-mission ranges and random transmission ranges.In the fixed transmission range scenario, we fixthe jammer’s transmission ranges at 60, 70 and 80meters, respectively. In the random transmissionrange scenario, the jammer transmission rangesare randomly chosen from a certain range in[60, 80], respectively. (Once the transmission rangeis chosen, it would not change in that simulation).As a result, each jammer has a different transmis-sion range. From Figure 9(b), the mean-error fig-ure, we observe that, with the increase of jammertransmission range, X-ray has reduced localiza-tion errors, while the error of M-cluster increases.This is an interesting observation, and it can beexplained as follows. As the jammer transmissionrange increases, the jammed area becomes bigger;as a result, more sensor nodes are covered in thejammed region. For X-ray, a bigger jammed areawill lead to a larger boundary consisting of morejammed nodes, so more branches on the skeletonof the jammed area will be created and X-ray canthen obtain more information about the jammers,improving the final estimation accuracy. For M-

Page 12: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error(meter) (b)

CD

F

X−rayM−clusterRandom

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error(meter)(a)

CD

F

X−rayM−clusterRandom

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error(meter)(c)

CD

F

X−rayM−clusterRandom

Fig. 11. Impact of different jammer transmissionranges: (a) R=60, (b) R=80, (c) R∈[60,80].

cluster, a bigger jammed area covers more spaceand nodes. It is likely that more non-uniformlydeployed nodes are introduced into the jammedarea, negatively affecting the results of M-cluster.

The CDF performance curves of all algorithmsunder different jammer ranges are shown in Fig-ure 11. In Figure 11(a) and (b), the jammer trans-mission ranges are set to 60 and 80 meters withthe simple deployment model. We observe that asthe transmission range of the jammers increases to80 meters, both M-cluster and the random schemehave visible performance declines, while X-ray hasa little improvement. As we explained previously,the increment of jammers’ transmission range hasdifferent impacts on X-ray and M-cluster. In Fig-ure 11(c), we show the performance of these algo-rithms under the condition of random transmis-sion range of jammers, which means each jammerin the network randomly chooses its transmissionrange (R ∈ [60, 80]). Under this condition, X-raystill achieves a 15-meters estimation error at 90%times, while M-cluster achieves 20 meters at 90%times.

Impact of jammer deployment. As introducedin Eq. 2, we use ω to denote the overlapping degreeof multiple jammers. To study the impact of jam-mer deployment, we change the deployment con-dition, ω, in Eq. 2, from 0.3 to 0.7. The transmis-sion range is set to 60 meters with 500 nodes ran-domly deployed in the field. In Figure 12(a) and(b), both M-cluster and X-ray have better local-

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error(meter)(d) N=4

CD

F

X−rayM−clusterRandom

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error(meter)(c) N=2

CD

F

X−rayM−clusterRandom

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error (meter)(b) w=0.7

CD

F

X−rayM−clusterRandom

0 10 20 30 40 50 60 70 800

0.2

0.4

0.6

0.8

1

Error (meter)(a) w=0.3

CD

F

X−rayM−clusterRandom

Fig. 12. (1) Impact of different jammer deployments:(a) ω = 0.3, (b) ω = 0.7. (2) Impact of different jam-mer numbers: (c) N=2, (d) N=4.

ization performance when ω increases from 0.3 to0.7. As ω denotes the overlapping degree of jam-mers in WSNs, the result indicates that our algo-rithms have better performance when jammers areless overlapping. This is because when overlappingdegree becomes smaller, jammers get farther awayfrom one another. Thus, the overlapping effectsbecome less and the differentiation of jammers be-comes easier. Meanwhile, in Figure 12(b), we ob-serve that M-cluster has a big improvement whenthe overlapping degree decreases. When jammedregions are less overlapping, clustering algorithmcan group jammed nodes more accurately.

Impact of jammer numbers. We also studythe effect of the number of jammer numbers byvarying it from 2 to 5. In all the cases, we set thejammer transmission range to 60m and deploy 500nodes in the field. The results are shown in Fig-ure 9(c), where X-ray has the best performance inall situations and the mean errors under the meshdeployment are below 15 meters when the jam-mer number is increased to 5. We observe that theperformance of all algorithms decrease with morejammers. Figures 12(c) and (d) show the CDFcurves of the algorithms’ performance when thereare 2 and 4 jammers in the network. We observethat when there are two jammers to be localized,more than 90% of the times X-ray can estimatethe jammers’ locations with an error less than 10

Page 13: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

0 20 40 60 80 1000

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Error(meter)(a)

CD

F

XrayClusterrandom

0 20 40 60 800

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Error(meter)(b)

CD

F

XrayClusterrandom

Fig. 13. The limit of our algorithms w.r.t. number ofjammers (a) N=8, (b) N=10.

meters, and M-cluster reaches 13 meters accuracy90% of the time.

We also show how the performance of our al-gorithms degrades when the number of jammersfurther increases. The results are presented in Fig-ure 13, where the number of jammers is 8 and 10,respectively. We observe that in these cases, theerrors of our two algorithms approach 30m and40m, respectively. Whether such big errors are ac-ceptable or not depends on the application sce-narios. If one considers localization errors cannotexceed half of transmission range, 10 could be theupper limit for jammer number in our algorithms.

In this part, we also studied the negative im-pact of false jammer number determination on theperformance of our algorithms. In Figure 14, weshow that the CDF of localization errors when thetrue number of jammers, Nt, is 3, but the esti-mated jammer number, Ne, is (a)2, and (b)4 (inthese two cases, we compute the localization errorswithout considering the missed or double countedone.). From the simulation result, we can observethat due to the false detection of the jammer num-ber, both our algorithms have a decline in local-ization accuracy, but X-ray still has estimation er-rors below 19m at 90% times, and M-cluster below21m at 90% times.

6. Discussion and Future Work

In this paper, we focus on addressing the multi-jammer localization problem where multiple jam-mers perform collaborative jamming in WSNswith overlapping jammed areas. While our resultsshow some promise, fully addressing this problemstill requires much effort. Next we discuss some ofthe issues as well as possible solutions.

0 10 20 30 40 50 60 70 800

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Error (meter)(b)

CD

F

X−rayM−ClusterRandom

0 10 20 30 40 50 60 70 800

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Error (meter) (a)

CD

F

X−rayM−ClusterRandom

Fig. 14. Impact of jammer-number false detection: (a)Ne = 2, (b) Ne = 4.

The first challenge is that attackers may useother types of jamming devices that are more pow-erful, e.g., using directional antennae. In the caseof directional antenna, the jammed area might be-come more irregular, causing higher localizationerrors. Torrieri has proposed a direction-findingand localization method based on multiple an-tennae [11,24]. His scheme is more resistent tosuch jamming attacks but currently only worksfor a single jammer. How to combine his schemewith our algorithms for multi-jammer localizationcould be an interesting direction for our futurework.

The second challenge is how to determinejammer number in WSNs precisely. In our work,through computing the size of a jammed areawhile assuming an adversary attempts to maxi-mize the coverage of jamming with a fixed num-ber of jamming devices, we use two simple waysto identify the number of jammers. These algo-rithms are efficient but likely result in increasederrors as the jammer number goes up. Note thatwhen the jammed areas are disconnected, each in-dividual area can be treated separately with ouralgorithms. Therefore, the question is how to ac-curately determine the number of jammers withinone large jammed area. Clearly, if the adversarydoes not want to maximize his jamming effect, hemay deploy some jamming nodes very closely (i.e.,violating our distance constraint). As a result, wemay not be able to accurately estimate the num-ber. Indeed, if the jamming nodes simultaneouslyvary their transmission powers so that they dis-guise their number or if an unjammed area is to-tally surrounded by jammed areas (hence no in-formation about the unjammed nodes can be ob-tained), jammer-number identification could be-come an undecidable problem.

Page 14: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

Fortunately, our ultimate goal is to localizethe jammers, not to estimate their numbers. Assuch, we can have some additional mechanisms toimprove the accuracy. First, we may overcome thelimitation by scanning the results of the possiblejammer numbers (considering not only the calcu-lated jammer number n, but also the numbers n−1and n + 1), and choose the best matched estima-tion result. Second, the defender is not limited toa single round of localization. It can iteratively lo-calize the jammers in a jammed area until no jam-mer remains. That is, after each round of local-ization, the localized jammers will be removed ordestroyed immediately and the localization algo-rithm will be run again when jamming continues.Third, we may improve the localization accuracyof our algorithms. In M-cluster, we only choosethe coordinates of jammed nodes as the cluster-ing features; however, some other information maybe used to improve final partitions; e.g., RSS ofjammed nodes.

In our simulation results, we discover M-cluster is not as good as X-ray under the proposeddifferent conditions. However, compared with X-ray, M-cluster has some considerable advantageson computational complexity (much less compu-tation than X-ray) and practical flexibility (no re-liance on the availability of a jammed-area map-ping service [31] that is itself very complex). Inour M-cluster algorithm, we choose node coordi-nates as the feature used in clustering algorithms,while other characteristics might be extracted toimprove the grouping results. This is our futuredirection to improve the M-cluster algorithm. Inthe X-ray algorithm, we choose the convex enve-lope to compute the jammed area, as it is efficientand suitable to derive a unique simple skeleton bythe skeletonization technique. However, some in-formation may be unavailable due to the require-ment of convexity. A future improvement of X-ray would be to generate a more accurate jammedarea that can preserve the most information ofjammers. In conclusion, choosing M-cluster or X-ray is primarily a trade-off between localizationaccuracy and computational requirements.

7. Conclusion

This paper studied a multi-jammer localizationproblem in wireless sensor networks and pro-

posed two multi-jammer localization algorithms:M-cluster and X-ray. The algorithms attempt todetermine the locations of multiple jammers inWSNs in one run. We made our comprehensivesimulation and comparison, and applied our al-gorithms under variable conditions including dif-ferent node densities, transmission ranges, over-lapping degrees, and jammer numbers. The sim-ulation results show that our algorithms achievegood performance in localizing the jammers underthe diverse situations. Future directions include animproved jamming propagation model with shad-owing and fading, more accurate determination ofjammer number, and further improvement of bothX-ray and M-cluster.

Acknowledgement We thank the reviewers fortheir valuable feedback which greatly helped im-prove the work. The work of Sencun Zhu was sup-ported in part by the grant W911NF-11-2-0086from the Army Research Laboratory (ARL) andthe U.S. NSF CAREER 0643906. The views andconclusions contained here are those of the au-thors and should not be interpreted as necessarilyrepresenting the official policies or endorsements,either express or implied, of ARL or NSF.

References

[1] X. Bai, L. J. Latecki, and W.-Y. Liu. Skeleton prun-ing by contour partitioning with discrete curve evo-

lution. In IEEE Trans. Pattern Anal. Mach. Intell.,pages 449–462, 2007.

[2] Z. Bankovic, J. M. Moya, A. Araujo, D. Fraga, J. C.Vallejo, and J.-M. de Goyeneche. Distributed intru-

sion detection system for wireless sensor networksbased on a reputation system coupled with kernelself-organizing maps. Integr. Comput.-Aided Eng.,17(2):87–102, Apr. 2010.

[3] M. Cakiroglu and A. T. Ozcerit. Jamming detectionmechanisms for wireless sensor networks. In InfoScale’08: Proceedings of the 3rd international conferenceon Scalable information systems, pages 4:1–4:8, 2008.

[4] F. Chang, C.-J. Chen, and C.-J. Lu. A linear-timecomponent-labeling algorithm using contour tracingtechnique. In Computer Vision and Image Under-standing, pages 206 – 220, 2004.

[5] T. Cheng, P. Li, and S. Zhu. Multi-jammer localiza-tion in wireless sensor networks. In Proceedings ofInternational Conference on Computational Intelli-

gence and Security (CIS), 2011.[6] T. Cheng, P. Li, and S. Zhu. An algorithm for jammer

localization in wireless sensor networks. In Proceed-ings of The 26th IEEE International Conference on

Page 15: M-cluster and X-ray: Two Methods for Multi-Jammer ...sxz16/papers/icae_jamming.pdf · M-cluster and X-ray: Two Methods for Multi-Jammer Localization in Wireless Sensor Networks Tianzhen

Advanced Information Networking and Applications(AINA), 2012.

[7] J. T. Chiang and Y.-C. Hu. Dynamic jamming miti-

gation for wireless broadcast networks. In IEEE In-focom, 2008.

[8] T. H. Cormen, C. Stein, R. L. Rivest, and C. E.Leiserson. Introduction to Algorithms. McGraw-Hill

Higher Education, 2nd edition, 2001.[9] Q. Dong and D. Liu. Adaptive jamming-resistant

broadcast systems with partial channel sharing. InProceedings of the International Conference on Dis-

tributed Computing Systems (ICDCS), 2010.[10] A. Goldsmith. Wireless Commulications. Cambridge

University Press, 2005.

[11] A. Habib and M. Rupp. Antenna selection in po-larized multiple input multiple output transmissionswith mutual coupling. Integrated Computer-AidedEngineering, pages 299–312, 2012.

[12] X. Jiang, W. Hu, S. Zhu, and G. Cao. Compromise-resilient anti-jamming for wireless sensor networks. InWirel. Commun. Mob. Comput., volume 17. WirelessNetworks, 2011.

[13] J. Kim, H. Jeon, and J. Lee. Network managementframework and lifetime evaluation method for wire-less sensor networks. Integrated Computer-Aided En-gineering, pages 165–178, 2012.

[14] M. Li, I. Koutsopoulos, and R. Poovendran. Opti-mal jamming attacks and network defense policiesin wireless sensor networks. In INFOCOM’07: Pro-

ceedings of the 26th IEEE International Conferenceon Computer Communications., pages 1307 – 1315,2007.

[15] H. Liu, Z. Liu, Y. Chen, and W. Xu. Localizing

multiple jamming attackers in wireless networks. InICDCS’11: Proceedings of Int’l Conference on Dis-tributed Computing Systems, pages 517–528, 2011.

[16] H. Liu, W. Xu, Y. Chen, and Z. Liu. Localizing jam-

mers in wireless networks. In PERCOM’09: Proceed-ings of the 2009 IEEE International Conference onPervasive Computing and Communications, pages 1–6, 2009.

[17] Y. Liu and P. Ning. Bittrickle: Defending againstbroadband and high-power reactive jamming attacks.In Proceedings of IEEE International Conference onComputer Communications (Infocom), 2012.

[18] Z. Liu, H. Liu, W. Xu, and Y. Chen. Wireless jam-ming localization by exploiting nodes’ hearing ranges.In DCOSS’10: Proceedings of the International Con-

ference on Distributed Computing in Sensor System,pages 348–361, 2010.

[19] G. Mao, B. Fidan, and B. D. O. Anderson. Wirelesssensor network localization techniques. In Comput.

Netw., volume 51, pages 2529–2553, 2007.[20] S. Misra, R. Singh, and S. V. R. Mohan. Informa-

tion warfare-worthy jamming attack detection mech-anism for wireless sensor networks using a fuzzy in-

ference system. In Sensors, volume 10, pages 3444–3479, 2010.

[21] A. Mpitziopoulos and D. Gavalas. An effective de-fensive node against jamming attacks in sensor net-

works. In Security and Communication Networks,

volume 2, pages 145–163, 2009.[22] K. Pelechrinis, M. Iliofotou, and S. V. Krishna-

murthy. Attacks in wireless networks: The case of

jammers. In IEEE Commun. Surveys Tuts., vol-ume 13, 2011.

[23] F. P. Preparata and S. J. Hong. Convex hulls offinite sets of points in two and three dimensions. In

Commun. ACM, 1977.[24] S. Roger, C. Ramiro, A. Gonzalez, V. Almenar, and

A. Vidal. An efficient gpu implementation of fixed-complexity sphere decoders for mimo wireless sys-

tems. Integrated Computer-Aided Engineering, pages41–350, 2012.

[25] M. Strasser, B. Danev, and S. Capkun. Detection of

reactive jamming in sensor networks. In ACM Trans.Sen. Netw., volume 7, pages 16:1–16:29, 2010.

[26] M. Strasser, C. Popper, and S. Capkun. Efficientuncoordinated fhss anti-jamming communication. In

MobiHoc’09: Proceedings of the tenth ACM interna-tional symposium on Mobile ad hoc networking andcomputing, pages 207–218, 2009.

[27] P. Tague, M. Li, and R. Poovendran. Mitigation

of control channel jamming under node capture at-tacks. In IEEE Transactions on Mobile Computing,volume 8, 2009.

[28] D. Torrieri. Principles of spread-spectrum communi-

cation systems. In 2nd ed., Springer, 2011.[29] D. Torrieri. Direction finding of a compromised node

in a spread-spectrum network. In MILCOM: Pro-

ceedings of the IEEE Military Communications Con-ference, 2012.

[30] Q. Wang, P. Xu, K. Ren, and X.-Y. Li. Delay-bounded adaptive ufh-based anti-jamming wireless

communication. In INFOCOM’11: Proceedings of theIEEE International Conference on Computer Com-munications, 2011.

[31] A. D. Wood, J. A. Stankovic, and S. H. Son. Jam:

A jammed-area mapping service for sensor networks.In RTSS’03: Proceedings of the 24th IEEE Interna-tional Real-Time Systems Symposium, pages 286 –297, 2003.

[32] A. D. Wood, J. A. Stankovic, and G. Zhou. Deejam:Defeating energy-efficient jamming in ieee 802.15.4-based wireless networks. In Proceedings of IEEESECON’07, 2007.

[33] R. Xu and D. Wunsch. Clustering. Wiley-IEEEPress, 2008.

[34] W. Xu, K. Ma, W. Trappe, and Y. Zhang. Jamming

sensor networks:attacks and defense strategies. InIEEE Network, 2006.

[35] W. Xu, W. Trappe, and Y. Zhang. Channel surf-ing: defending wireless sensor networks from interfer-

ence. In IPSN ’07: Proceedings of the 6th interna-tional conference on information processing in sen-sor networks, pages 499–508, 2007.