A natural basis for the detection of a wireless random reactive jammer (RRJ) is the perceived violation by the detector (typically located at the access point (AP)) of the carrier sensing protocol underpinning many wireless random access protocols (e.g., WiFi). Specifically, when the wireless medium is perceived by a station to be busy, a carrier sensing compliant station will avoid transmission while a RRJ station will often initiate transmission. However, hidden terminals (HTs), i.e., activity detected by the AP but not by the sensing station, complicate the use of carrier sensing as the basis for RRJ detection since they provide plausible deniability to a station suspected of being an RRJ. The RRJ has the dual objectives of avoiding detection and effectively disrupting communication, but there is an inherent performance tradeoff between these two objectives. In this paper we capture the behavior of both the RRJ and the compliant stations via a parsimonious Markov chain model, and pose the detection problem using the framework of Markov chain hypothesis testing. Our analysis yields the receiver operating characteristic (ROC) of the detector, and the optimized behavior of the RRJ. While there has been extensive work in the literature on jamming detection, our innovation lies in leveraging carrier sensing as a natural and effective basis for detection.N. An and S. Weber are with the Reactive jamming, Markov chain model, large deviations principle, hypothesis testing
I. INTRODUCTIONJamming attacks are a widely recognized threat to wireless networks. As a type of denialof-service attack, wireless jamming leverages the broadcast nature of the wireless medium and emits jamming signals either to prevent other (compliant) users from accessing the network, or to corrupt ongoing transmissions. There are three major types of jammers [2]: i) constant jammer, which constantly sends jamming signals, ii) random jammer, which randomly alternates between jamming and idle states, and iii) reactive jammer, which emits jamming signals upon sensing any ongoing traffic over the wireless channel. Compared with the first two types, the reactive jammer (RJ) is more sophisticated in that it achieves high jamming efficiency by only disrupting ongoing transmissions, which in general also lowers the risk of detection [2]. A RJ faces an inherent tradeoff in the dual objectives of effectively degrading network throughput and in avoiding detection: as the "aggressiveness" of the jamming is increased, it increases the effectiveness of the disruption, but at the same time increases the ease with which behavior not compliant with carrier sensing is detected. This detection is often based upon changes in network performance statistics such as the packet delivery rate (PDR), received signal strength (RSS), packet delivery delay, etc. However, the presence of hidden terminals (HT), i.e., transmissions detectable by the access point (AP) but not the sensing station, complicates the jamming detection problem, as the AP cannot always disambiguate whet...