Abstract
Vehicular Ad Hoc Networks (VANETs) aim at enhancing road safety and providing a comfortable driving environment by delivering early warning and infotainment messages to the drivers. Jamming attacks, however, pose a significant threat to their performance. In this paper, we propose a novel Relative Speed Estimation Algorithm (RSEA) of a moving vehicle that approaches a transmitter ()-receiver () pair that interferes with their radio frequency (RF) communication by conducting a denial of service (DoS) attack. Our scheme is completely passive and uses a pilot-based received signal without hardware or computational cost to, firstly, estimate the combined channel between the transmitter-receiver and jammer-receiver and, secondly, to estimate the jamming signal and the relative speed between the jammer-receiver using the RF Doppler shift. Moreover, the relative speed metric exploits the angle of projection (AOP) of the speed vector of the jammer in the axis of its motion in order to form a two-dimensional representation of the geographical area. Our approach can effectively be applied for any form of the jamming signal and is proven to have quite accurate performance, with a mean absolute error (MAE) value of approximately compared to the optimal zero MAE value under different jamming attack scenarios.
1. Introduction
Autonomous vehicles, capable of navigating in unpredictable real-world environments with little human feedback, are a reality today [1]. Autonomous vehicle control imposes very strict security requirements on the wireless communication channels that are used by a fleet of vehicles [2]. This is necessary in order to ensure reliable connectivity [3]. Moreover, the Intelligent Vehicle Grid technology, introduced in [4], allows the car to become a formidable sensor platform, absorbing information from the environment, other cars, or the driver and feed it to other vehicles and infrastructure so as to assist in safe navigation, pollution control, and traffic management. The vehicle grid essentially becomes an Internet of Things (IoT) for vehicles, namely, the Internet of Vehicles (IoV) that is capable of making its own decisions when driving customers to their destinations [5].
The connected autonomous vehicles (CAVs) that use the wireless vehicle-to-vehicle (V2V) communication have become essential for the operation of a modern vehicle [6]. Wireless communications, however, are vulnerable to a wide range of attacks [7, 8]. An RF jamming attack consists of radio signals maliciously emitted to disrupt legitimate communications. Jamming attacks are a big threat to any type of wireless network. With the rise in safety-critical vehicular wireless applications, this is likely to become a constraining issue for their deployment in the future. A subcategory of jamming attacks is the denial of service (DoS) attacks, which are targeting the availability of network services. Of special interest are the mobile jammers, which impose an added strain on vehicular networks (VANETs). The accurate prediction of the behavior of the jammer such as its speed becomes critical for providing a swift reaction to an attack.
In this work, we propose a novel metric that captures the relative speed between the jammer () and the receiver (). We also propose the Relative Speed Estimation Algorithm (RSEA) that is a completely passive estimation method that uses pilot-based received signals at the receiver to, firstly, estimate the channel between the transmitter-receiver and jammer-receiver and, secondly, the jamming signal and thirdly, to estimate the relative speed between the jammer-receiver using the RF Doppler shift properly. This is the first work in the literature, according to our knowledge, that proposes an algorithm for speed estimation of malicious RF jammers.
1.1. Problem Statement
In addition to RF jamming, wireless communication between a transmitter () and a receiver can be impaired by unintentional interference and multiple access control (MAC) protocol collisions. Jammers can exhibit arbitrary behavior in order to disrupt and thwart communication with a form of DoS attack [9]. In the general case, RF jamming reduces the receiver signal to interference and noise ratio (SINR), a problem that can be addressed with classic communication algorithms. However, in several applications, it is critical to detect accurately the presence of a jammer, i.e., the precise reason behind the reduction in SINR, the packet delivery ratio (PDR), and more importantly, the nature of the attack. Consequently, it is difficult to determine whether the reason for the SINR reduction is an intentional jamming attack or unintentional interference. The challenge in detecting an RF jamming attack is that the information that is available for the jammer is typically minimal and it can be derived from the useful signal possibly mixed with other types of arbitrary interference in the area. By estimating the relative speed between a legitimate vehicle and a jammer, we can conclude if a high interference scenario has been provoked intentionally with the form of a DoS attack by an attacker that approaches the victim or has been provoked unintentionally by an area with significant RF interference. Specifically, if the estimated relative speed metric is around zero, we can infer that the jammer is moving at the same speed with the receiver. On the other hand, if the estimated relative speed has a high value, we can conclude that the jammer is moving at a quite different speed than that of the receiver. Of particular interest is the higher level behavior of a jammer, like its motion/movement relative to the - pair.
1.2. Our Solution
Using the jamming signal at the receiver, we estimate the relative speed metric () that is based on the difference or sum between the velocities of the jammer and the receiver. This passively estimated metric also includes information regarding the angle of projection (AOP) of the jammed signal. Our scheme uses only the signal at the receiver under the presence of a jammer to characterize the behavior/motion of the jammer (if the is approaching or moving away from the ) using the RF Doppler shift. We also adopt a pilot-based method for the channel estimation between - since it is suitable for fast varying channels, like VANETs, because the channel is directly estimated by training symbols or the pilot tone that are known a priori to the receiver.
The contributions of the paper are threefold:(i)A completely passive pilot-based scheme is proposed that is based on RF communication between - being interfered by a jammer in the area. However, we do not apply the proposed RSEA for estimating only the speed of the [10]. We try from this point-to-point communication to gather as much information as possible regarding jammer’s behavior, such as all the combined multipath channels among , jammer’s relative speed value, and the jamming signal.(ii)In addition, the proposed relative speed metric uses novel physical location features because it includes the AOP of the jammer.(iii)The effective usage of the estimated relative speed for a future jamming detection algorithm is outlined.
It has to be highlighted that the proposed RSEA can also be applied to any form of the jamming signal.
The rest of this paper is organized as follows. Section 2 presents the related work, whilst Section 3 analyzes the network topology, the system model analysis, and the wireless channel model. Section 4 presents the location-aware relative speed metric, and Section 5 analytically describes the proposed RSEA. Section 6 presents the experimental evaluation of the proposed RSEA and provides comparison between different scenarios. Section 7 justifies the experimental behavior of the proposed relative speed metric and describes real applications that the metric can be used. Finally, Section 8 concludes the paper and gives some directions for future work.
2. Related Work
2.1. RF Jamming
RF jamming has been extensively studied in the context of classical 802.11 networks without accounting for the particularities of car-to-car communications. Besides the differences in PHY design of 802.11p compared to other 802.11 amendments, the propagation conditions of VANETs are fundamentally different due to the highly dispersive and rapidly changing vehicular environment. A lot of different jamming attacks have been studied in VANETs [11]. The two most important categories of jamming attacks are the constant jamming and the reactive jamming. Constant jamming transmits randomly generated data on the channel without checking the state of the channel (idle or not). The reactive jamming happens only when the attacker senses activity on the channel. In [12], the authors observe that constant, periodic, but also reactive RF jammer can hinder communication over large propagation areas, which would threaten road safety. Reactive jamming attacks reach a high jamming efficiency and can even improve the energy efficiency of the jammer in several application scenarios [13, 14]. Also, they can easily and efficiently be implemented on commercially available off-the-shelf (COTS) hardware such as USRP radios [15–17]. But, more importantly, reactive jamming attacks are harder to detect due to the attack model, which allows the jamming signal to be hidden behind transmission activities performed by legitimate users [16, 18, 19].
A different category of attacks is the pilot-based attacks against OFDM and OFDMA signals [20]. These attacks seek to manipulate information used by the equalization algorithm to cause errors to a significant number of symbols. However, we do not evaluate this type of attack because the point of interest of this paper is the DoS attacks that are targeting the availability and not the integrity of packets. In order to be robust against pilot tone jamming attacks, OFDM and OFDMA systems must randomize their subcarrier locations and values. For the mitigation of this type of RF jamming attacks, optimal power allocation with user scheduling techniques is proposed [21], utilizing also the technique of uncoordinated frequency hopping (UFH) [22]. UFH implies the communication between transmitter and receiver through a randomly chosen frequency channel unknown for both agents. In [23], the authors highlight the secrecy level of wireless networks under UFH, showing the harmful security effect of broadband eavesdropper adversaries capable of overhearing in multiple frequencies. In order to stop such eavesdroppers, the authors propose the use of broadband friendly jammers that cause interference on eavesdroppers. The goal is to cause as much interference as possible to eavesdroppers that are located in unknown positions, while limiting the interference observed by the legitimate receiver. The information about the location and speed of friendly jammers is crucial for the above UHF schemes.
The effects of RF jamming can be alleviated using cooperative relaying schemes to where the vehicles outside of the jamming area serve as relays to help forward the received control channel signal to the victim vehicles through another jamming-free service channel [24]. However, the jamming scenarios that are used in this paper are limited since the location of the jammer is assumed to be known in advance (either being an RSU or a moving node). The antijamming V2V communication in CAV networks through power selection in conjunction with channel selection is analyzed in [25]. Specifically, a brain-inspired cognitive dynamic system (CDS) is applied to study V2V communications, and the general structure of cognitive risk control (CRC) is tailored to analyze and address the jamming problem in CAV networks. After that, the power control is carried out first using the reinforcement learning method, the result of which is then examined by the task-switch control. However, the mobility of vehicles and the vehicle speeds are not considered in the channel model and the complicity of the proposed method is questionable too. By analyzing these articles, we can conclude that the jammer’s speed is a crucial metric for all the techniques that try to address the jamming problem in RF communications in VANETs.
2.2. Localization
A lot of work has covered matters of localization, which is a fundamental challenge for any wireless network of nodes, in particular when nodes are mobile. In [26], the relative positions and velocities (PVs) are estimated up to a rotation and translation of an anchor-less mobile network, given two-way communication capability between all the nodes. A least-squares-based dynamic ranging algorithm is proposed, which employs a classical Taylor series-based approximation to estimate pairwise distance derivatives efficiently without the usage of Doppler shifts. However, this approach requires the existence of a cluster of nodes with predefined initial locations. On the contrary, the proposed RSEA algorithm does not require any initial information for the location of vehicles. In [27], the authors propose a dual-level travel speed calculation model, which is established under different levels of sample sizes. Wireless sensor networks (WSNs) are widely used to maintain the location information and rely on the tracking service only when their location changes. In the proposed approach in [28], the problem of tracking cooperative mobile nodes in wireless sensor networks is addressed with the calculation of Doppler shifts of the transmitting signal in combination with a Kalman filter (by performing a constrained least-squares optimization when a maneuver is detected). In [29], the authors suggest a method for joint estimation of the speed of a vehicle and its distance to a roadside unit (RSU) for narrowband orthogonal frequency-division multiplexing (OFDM) communication systems. Spatial filtering and a maximum-likelihood (ML) algorithm are developed for distance estimation. The vehicle speed is calculated using a kinematics model based on the estimated distance and angle of arrival (AOA) values. Comparing the aforementioned methods with our proposed speed estimation method, it is obvious that the RSEA is applicable to a VANET without any extra infrastructure such as WSNs or complex calculations like Kalman filters and without the need for deployment of RSUs for traffic recording. The localization of a smart jammer that is trying to hide his precise location has proved to be a difficult issue for the majority of the aforementioned works since position verification models are susceptible to statistical errors. The survey paper [30] notes the need for applying data fusion at the PHY layer of the 802.11p protocol of wireless access in vehicular environment (WAVE) signals with upper layers for a vehicle positioning, a method that our scheme is using.
2.3. Speed Estimation
Another group of papers proposes speed estimation systems that alert drivers about driving conditions and help them avoid joining traffic jams using multiclass classifiers. ReVISE in [31] proposes a multiclass SVM approach that uses features from the RF signal. The proposed experimental testbed must be established in a specific part of the road and is completed by two stable access points and two monitor points. However, it is doubtful whether it can be applied to a scenario with more than one vehicle in the specific area such as the scenario we are considering. Using a similar method, MUSIC [32] is a subspace-based AOA estimation algorithm that exploits the eigenstructure of the covariance matrix of the received signals on a multisignal classifier using a uniform circular array (UCA) antenna as extra hardware.
Covariance-based speed estimation schemes have also been used for the estimation of the maximum Doppler spread, or equivalently the vehicle velocity that is useful for improving the performance of handoff algorithms [33]. Specifically, the authors in [33] propose a velocity estimator based on spectral moments of in-phase and the quadrature-phase component or the squared envelope of the received signal. The proposed method has the least sample variance as compared to other covariance-based methods. However, all the covariance-based speed estimators do not assume shadowing in the channel model and the improvement of their performance comes at expense of more computational complexity and therefore an added delay in computation time. Such models are not easily applicable to a frequently changed V2V wireless channel with many vehicles and obstacles where a lot of shadowing and scattering effects exist. Only the authors in [10] propose a velocity estimator that uses the statistics of the instantaneous frequency (IF) of the received signal to estimate the velocity and takes also into account the distribution of the scattered component of the received signal and is also robust to path loss and shadowing. The only restrictive assumption of this method for being applied in a VANET environment is that, in order to estimate the velocity, prior estimation of directivity parameter of the incoming waves is needed. The authors in [34] proposed an algorithm that employs a modified normalized autocovariance of received signal power to estimate the speed of mobile nodes. The simulation results indicate that this algorithm is reliable to estimate the mobile speed with corresponding maximum Doppler shift up to 500 Hz. However, a great challenge of fast-moving communications such as V2V is the high Doppler shifts due to the relative motion between communicating vehicles.
In [35], an algorithm that estimates the speed of a mobile phone by matching time-series signal strength data to a known signal strength trace from the same road is introduced. The drawback of the correlation algorithm is the observation that the signal strength profiles along roads remain relatively stable over time, which is not so realistic for a VANET. Although the results are more accurate than previous techniques that are based on handoffs or phone localization, this method requires the travelers to have their mobile phones open during their travel. This is a limiting factor for a smart jammer, who has its phone inactive to remain undetected, in comparison with our proposed speed estimation method that can detect smart jammers. In [36], a method for the estimation of speed for mobile phone users using known WiFi signal-to-noise ratio (SNR) data from the past and time-domain features like mean, maximum, and autocorrelation is proposed. However, in a frequently changing environment such as a V2V channel, it is almost impossible that the SNR values remain constant. For this reason, the proposed RSEA algorithm does not require any training data about SNR or other PHY layer data, whilst in [37], two novel autocorrelation- (ACF-) based velocity estimators are used, without requiring knowledge of the SNR of the link. The drawback of both speed estimation techniques is that there is some dependence of velocity on estimator performance and there is also a limit to the velocity up to . On the contrary, our proposed speed estimation method can estimate quite large relative speeds without any speed limit.
In all the prior works, speed estimators that have been proposed include training procedures in order to estimate traffic congestion or other transportation performance metrics using sensor measurements. However, the speed estimation problem from a security perspective has been not widely investigated. Only, in [38], the authors try to estimate the AOA of the specular line of sight (LOS) component of signal received from a given single antenna transmitter using a predefined training sequence. The results show the optimality of the training-based ML-AOA estimator in the case of a randomly generated jamming signal. However, the drawback of this ML-AOA estimator is that this superior performance is subject to the availability of a perfect CSI and the knowledge of jammer’s strategy which is unlikely in a realistic system. Finally, the authors in [39] introduced a new algorithm to estimate the mobile terminal speed at base station (BS) in cellular networks. This helps BS in estimating the channel Doppler shift, using measured received signals at the BS. The performance of the proposed algorithm is modeled in a Terrestrial Trunked Radio (TETRA) network, and the simulation has shown acceptable results for a wide range of velocities and jammers. However, using this algorithm, the estimated Doppler shift depends on the carrier frequency which is much smaller in a cellular network (i.e., 396 MHz) compared to a VANET (i.e., 5.9 GHz). In contrast, in the speed estimation approached by this paper, the carrier frequency of a VANET is used without any impact on the performance of the speed estimation procedure.
Recently, extensive works present video-based speed estimation techniques using a single camera [40, 41]. Furthermore, speed estimation techniques are used by applications for traffic counting that are based on wireless magnetic sensor networks (WMSNs). The authors in [42] propose a system for traffic speed estimation which can effectively eliminate the geomagnetic background interference. A morphological filter is designed for removing the interference and extracting the magnetic signatures of vehicles. However, all the aforementioned works require specific infrastructure or sensor such as camera, RAdio Detection And Ranging (RADAR), Light Detection And Ranging (LIDAR), magnetic sensors, and Visible Light Detection and Ranging (ViLDAR) that built upon sensing visible light variation of the vehicle’s headlamp [43]. All these sensors have a pretty high cost. In contrast, our proposed method of speed estimation uses only the wireless signal at the for the estimation of the relative speed metric between and without any need for extra infrastructure. Last, a recent research [44] explores a novel technique which could estimate the speed of a vehicle by analyzing its influence on surrounding wireless signals from roadside wireless infrastructures, such as WiFi. To achieve this goal, in this paper, it is proposed and formulated a model to characterize the relationship between the phase and amplitude measurements and the vehicle speed. Based on the model, a method is developed that can detect the vehicle and estimate its speed accordingly using the frequency domain information involved in the spectrogram. However, this model estimates vehicle’s speed by analyzing the influence of the vehicle on surrounding wireless signals using two static roadside WiFi devices. In contrast, our proposed method estimates the relative speed between two moving vehicles that can be assumed as transmitter and receiver that interchange pilot signals using the V2V wireless communication without the need of any additional infrastructure.
The great majority of the works have used covariance-based speed estimators. Some of them do not take into account the shadowing effect of VANETs, others need initially sampling of the SNR links for a training procedure, and last some need perfect knowledge about the directivity of transmitted waves in order to estimate the receiver’s speed improving handover algorithms between transmitter and receiver under a typical microcellular system. However, this type of network is assumed to be relatively stable in contrast to a VANET where the V2V channel yields more rapid and more severe fading than cellular networks. All the remaining state-of-the-art papers for speed estimation use extra hardware infrastructure, WSNs, or RSUs for traffic recording and therefore for position or speed verification. Moreover, the speed estimation approaches that use RSUs are not applicable for estimating the speed of a jammer as indication of jamming in the area because a smart jammer may change its travel behavior (i.e., speed and direction) in order to look like a legitimate vehicle and remain undetected. Our proposed technique is the first in the literature, to the best of our knowledge, that uses only the unicast communication between two moving vehicles and for the prediction of the jammer’s speed and for future detection of a jamming attack without any initial knowledge about the location of vehicles or the channel conditions. Our method uses this point-to-point communication between - to gather as much information as possible regarding jammer’s behavior, such as all the combined multipath channels among jammer’s relative speed value, and jamming signal. The proposed system is dynamic and can be applied to any road topology for the jammer’s speed estimation. Moreover, there has been no prior work that combines a feature of the physical location, except of the AOA at the receiver, such as the AOP of the with its speed, in order to estimate relative speeds of two moving vehicles (jammer-receiver) during a jamming attack, using the channel Doppler shift value.
3. System Model and Preliminaries
3.1. Network Topology
We consider unicast V2V communication between transmitter and the receiver and a point-to-point V2V communication between a single jammer and the receiver. This simple scenario in a rural area is used for the initial verification of our system without high interference of other vehicles. In this area, a static obstacle already exists that impacts the communication between - and -.
The jammer transmits wireless packets/signals that may form a reactive jamming signal. We assume that the - pair of vehicles in our model moves at a constant speed for a period of time. This approach allows the modeling of platoons of vehicles that are formed by maintaining a constant distance with each other [2]. We assume that the jammer moves with a constantly increasing speed with the ultimate goal to approach the receiver and intervene in the effective communication zone of the - pair. AS it can be seen in the network topology of Figure 1, the distances between - in the y-axis and in the x-axis are and , respectively, together with the actual distance between - , which is the hypotenuse of the rectangular triangle that is formed. The motion of the vehicles in Figure 1 is characterized by the speed vectors . Only have the same direction, which is the direction of the x-axis. The jammer approaches the - with an AOP . So, the speed vector of the jammer is projected in the axis of the motion of vector with an AOP Figure 2(a). In this figure, we also notice that the AOP is not equal to zero. Moreover, the angle that is formed between the speed vector of the jammer and the wireless signal that travels between the and the is called the angle of departure (AOD) and is denoted as ϕ in Figure 2. In Figure 2(a), the line of sight (LOS) component between - has a AOD equal to zero, while the non-line of sight (NLOS) component between - has a AOD , which is different to zero in Figure 2(b).
(a)
(b)
3.2. System Overview
In our system model, K known pilot symbols that compose the symbol vector are being sent over consecutive K time instants from the transmitter to the receiver. At the same time, the jammer simultaneously transmits over consecutive K time instants K jamming symbols to the receiver that composes the symbol vector . So we consider the received vector at the receiver , which consists of the combined symbols that the receives from the transmitter and the jammer at K consecutive time instants. Therefore, for every time instant , the receiver signal is the summation of the pilot symbol sent by the transmitter and the symbol sent by the jammer . Using pilots, the LOS channel and the NLOS channels between are estimated by the receiver. The receiver can also define the specific value of parameter N, which is the total number of multipath rays. The wireless channel is assumed to be constant for the duration of the transmission of the K pilot symbols from to .
3.3. Attacker Model
We consider jammers that aim to block completely the communication over a link by emitting interference reactively when they detect packets over the air, thus causing a DoS attack. The jammers minimize their activity to only a few symbols per packet and use minimal, but sufficient power, to remain undetected. We assume that the jammer is able to sniff any symbol of the packet over the air in real time and react with a jamming signal that flips selected symbols at the receiver with high probability (see [45]).
The jammer is designed to start transmitting upon sensing energy above a certain threshold in order for a reactive jamming attack to succeed. We set the latter to as it is empirically determined to be a good trade-off between jammer sensitivity and false transmission detection rate, when an ongoing 802.11p transmission is assumed. So, the symbol vector that reaches at the from the after K time instants has the same length as the pilot symbol vector that reaches the from the after K time instants, provided that the jammer transmits only when senses a transmission from the transmitter. Each one of the K scalar values depends on the used power by the jammer. The jammer continuously transmits with the same transmission power, with the purpose of overloading the wireless medium thus representing a DoS attack [46]. This work assumes that the jammer continuously transmits the same jamming symbol to the receiver forming a simplified jamming signal of the form with length K and f a random unknown value to the receiver. Furthermore, the proposed RSEA can operate with a different form of the jamming signal. This is possible when the sends more pilot symbols to the Rx than the sum of the different unknown jamming symbols being sent by the jammer.
Recall that the main goal of this paper is to show how we can estimate the speed of a noncooperative malicious attacker that can eventually be used as extra useful information for the design of RF jamming detection schemes [47].
3.4. Channel Model
Multipath is the propagation phenomenon that results in radio signals reaching the receiving antenna by two or more paths. The multipath scenario illustrated in Figure 1 includes a static obstacle in order for the multipath effects to be considered in the communication between - and -. So, it exists the LOS component of the wireless signal being sent by the and and also the NLOS component. In the NLOS component, the AOP is not equal to zero and the AOD between the speed vector of the jammer and the NLOS ray is also not equal to zero (see Figure 2(b)). The phenomena of reflection, diffraction, and scattering due to the multipath give rise to additional radio propagation paths beyond the direct optical LOS path between the radio transmitter and receiver.
In our work, we adopt the Rician fading model, which is a channel model that includes path loss and also Rayleigh fading [48]. When a signal is transmitted, the channel adds Rician fading. The Rician fading model is particularly appropriate when there is a direct propagating LOS component in addition to the faded component arising from multipath propagation.
The Rician channel at time instant t is defined with the help of multiple NLOS paths, which is similar to the Rayleigh fading channel but with the addition of a strong dominant LOS component. Parameter q defines the channel between with and the channel between with . We define a complex Gaussian random variable that is uniform over the range and is fully specified by the variance . The Rician fading channel can be defined with the help of this random variable as
In the above equation, is the carrier frequency, is the maximum Doppler shift, is the incidence AOD between the vector of speed with the vector of the jamming signal, is the excess delay time for the LOS ray that travels between the two communicating nodes in channel , d corresponds to the distance between the two communicating nodes, and t is the current time instant. The first term corresponds to the specular LOS path arrival and the second to the aggregate of the large number of reflected and the scattered paths. Parameter k is the ratio of the energy in the specular path to the energy in the scattered paths; the larger the k is, the more deterministic the channel is [49]. Finally, in (1) is the amplitude associated with the LOS path, which is known at the receiver. Rician channel model is often a better model of representing fading compared to the Rayleigh model.
The channel response after K consecutive symbols sent by the jammer and the transmitter is as follows:
In above equation, the is a column vector. Moreover, is the symbol vector that the receives from the after K consecutive time instants and is the symbol vector that the receives from the after K consecutive time instants again. The symbol vectors have the same values, as defined above, for the l different paths of the respective channels, where . The represents the additive white Gaussian noise (AWGN) with zero mean. We assume also that the jammer and the transmitter send at very close time instants their symbols at the receiver, so that channels can remain stable for sending K symbols. Moreover, N is the overall multipath rays in the area. For the estimation of this parameter, we use the GEMV simulator [50]. For describing the modeled area, GEMV uses the outlines of vehicles, buildings, and foliage. Based on the outlines of the objects, it forms R-trees. R-tree is a tree data structure in which objects in the field are bound by rectangles and are hierarchically structured based on their location in space. Hence, GEMV employs a simple geometry-based small-scale signal variation model and calculates the additional stochastic signal variation and the number of diffracted and reflected rays based on the information about the surrounding objects. We must note that the wireless RF communication of the - pair and the - pair is taking place in a specific frequency band, according to the existing standard for automotive systems [51].
3.5. Transmission in the MAC/PHY Layer
We assume single carrier communication at the PHY. The 802.11p MAC also provides prioritized Enhanced Distributed Channel Access (EDCA) and can support applications by providing different levels of quality of service (QoS). In our model, only the 802.11p MAC EDCA AC[0] channel with higher priority is used for the pilots. The pilot beacons from the to the are transmitted with high probability of successful delivery, increasing the accuracy of the proposed RSEA at the same time. Any type of collisions at the wireless channel resulting from competing traffic is addressed by the MAC EDCA backoff mechanism for distances smaller than the carrier sensing (CS) range of . So we assume that our speed estimation algorithm has a correct reaction and for high interference situations from other vehicles.
4. Location-Aware Relative Speed Metric
One of the main novel ideas of this work is that we take into account the physical location of the Jx and Rx nodes and the direction of their motion when calculating the relative speed metric. In the general case, the does not move in the same direction as the (see Figure 1). For this case, includes the AOP (angle θ) of the between and . The geometry-aware metric takes into account the distance and the distance . So a rectangular triangle is formed by the sides . As it can be seen from Figure 1, the distance is the hypotenuse of the rectangular triangle, which means that . So, the speed of the (source) with respect to the speed, while the and the are moving in the same direction, is the relative speed between the two vehicles moving towards each other and is equal to the sum of their individual speed vectors . Moreover, is the unit length vector pointing from the to the . The relative speed of the and the can be defined as the following dot product:
To represent all the speed vectors of Figure 1 in two dimensions , we project the vector on the unit length vector . is in the direction of x-axis (see Figure 2). The projected vector is . On the other hand, is already a vector in the direction of the x-axis (see Figure 2), which has the same direction as the projection of . This allows the calculation of the relative speed between using the two vectors that have the same direction with the vector .
In (3), if we use the projection vector and the vector, we get the final version of our metric, which is given by
This is the metric in the direction of . The addition is justified by the fact that the vectors have the same direction. In the above equation, are the speed vectors of the and the , respectively. According to our model, if the approaches the receiver, increases. As the remains constant and the is constantly increasing, (4) is an increasing function and its maximum value indicates a nearby jamming attack.
As increases, the jammer approaches the receiver and when decreases, the jammer is moving away from the and the . If the and the are located on the same road, an actual straight line and the vectors have the same direction, then our metric is the sum between speed vectors (). Otherwise, if the vectors have opposite directions, our metric is estimated by the difference ().
Taking into account the direction of the relative to the direction of the , the general form of the above metric is as follows:
It is crucial to point out that the above metric is the actual value of the relative speed that will be used in the subsequent sections to model the Doppler shift between the jammer and the receiver.
5. Proposed Estimation Scheme
5.1. Estimation of the Combined Pilot/Jamming Signal
The channel between two nodes with jamming is captured in (2). For the proposed RSEA, a pilot-based method for channel estimation is used. So, the signals that receives from the and the jammer interfere additively. In (2), if we differentiate the one LOS component from the other NLOS components, we have the following equation:where the channel values and the symbol vectors represent the unique LOS component of the total N multipath values. If the NLOS multipath components are added,
In (7), the received vector is the convolution between and the pilot symbol vector and the convolution between and the jamming symbol vector . Moreover, the column received vector for the K received values for every time instant during which the receiver collects every pilot that is sent from the transmitter is given by
To estimate the channel between - , the channel between - , and the jamming symbol vector , the best we can do is to estimate the combined vector parameter:
Vector has the above form for the short time that is required by the receiver to collect all the K symbols of the pilot vector. Recall that for a short time duration, the wireless channel is assumed constant. So for all the K values of vector in (9), the parameters remain constant and only the jamming symbols may change depending on the form of the jamming symbol vector sent by the jammer. We use a MMSE estimator [52], which finds a better estimate from least squares (LS), in order the K values of to be estimated:where is the covariance matrix of the noise vector . Vector in (10) has K components each having N unknown multipath channel components. So, both the channels can be estimated and also the K values of the jamming signal can be estimated too.
If the simplified jamming signal is used , in which the jammer continuously sends the same jamming symbol, which is unknown to the , we have unknown values for the two channels with K equations in (9) and one unknown value for the jamming symbol f. So if the condition is valid, we can see that each one of the channel values out of N multipath values can be estimated with the elimination method for the solution of the linear system with K equations and unknown values in (9). The values of the wireless channels remain constant for each value of vector . Moreover, the above linear system can also be solved with a completely irregular form of the jamming signal provided that the length of the pilot symbol vector being sent from the to the is larger than the sum of the number of the unknown jamming symbols with the value of parameter (which is the double number of overall multipath rays in the area for the estimation of both channels) . We only utilize the LOS component of the vector for the estimation of the relative speed metric using Doppler shift. So, the useful part from vector that we need for the relative speed estimation through the Doppler shift is . If we only want to estimate the values of vector without the multipath values, the above conditions for the solution of the linear system in (8) can be simplified to for the simplified jamming signal form.
5.2. Proposed Algorithm
The proposed RSEA is presented in Algorithm 1. First, the specifies the number of multipath rays N in the area that the GEMV propagation model is used, as explained in subsection 3.4. Then, the RSEA is used for every time step with the transmission of a pilot that consists of symbols. In line 4 of the algorithm, the combined channel between the and the , with the intervention of the , is estimated from the vector using a MMSE estimator. Depending on the jamming signal, the inequality that must be valid for the RSEA system to be resolvable for all the N multipath values is different. In the final 10th line of the RSEA, the relative speed value is estimated. A component of the estimated vector of the combined LOS channels (each one of the K components of has the same combined channel values) can be combined with the ray-optical baseband complex number , which is the jamming signal that the finally receives from the . Specifically, the subtraction of the channel component from the value can be set equal to the ray-optical baseband complex number . The complex number characterizes the baseband form of the narrowband wireless channel. This narrowband wireless channel is a function of the relative speed between the jammer and receiver and the Doppler shift between the two moving objects.
|
5.3. Channel Model with Doppler Shift
In this subsection, we describe in more detail the wireless LOS combined channel model between - and -. The proposed relative speed value can be estimated using only the LOS combined channel models. The tracked LOS components also show fading characteristics, likely due to the ground reflection which cannot be resolved from the true LOS. For this reason, we choose the same model for the LOS component as for the discrete components. Small-scale fading characteristics do not affect significantly the communication between and , as compared to NLOS conditions and, therefore, the estimation procedure. So central to this paper is the introduction of the proposed metric in the channel model of (1), taking into account the path loss value at the receiver. This path loss value only depends on the distance between the communicating nodes and usually gets small values for a narrowband wireless channel. Let us consider the channel model such as defined by the for a ray transmitted between two nodes as [53]
In the above equation, q defines the channel between with and the channel between with , is the amplitude associated with the LOS path, represents the free space propagation loss [54], λ is the wavelength, the carrier frequency, is the maximum Doppler shift that depends on the metric such as in (3), is the incidence AOD between the vector of speed and the vector of the jamming signal, is the excess delay time that the ray travels between the two nodes, and t is the current time instant. We assume the LOS case for the communication between the jammer and the receiver, as can be seen in Figure 2(a). The LOS ray between the and the has the same direction with the speed vector of the jammer. As a consequence, the AOD is equal to zero (, in (11)). The observed frequency at the receiver is , which depends on the relative speed of the two vehicles (jammer and receiver) that we defined in the previous subsection. The baseband channel model for a ray transmitted between two nodes with the intervention of a jammer therefore becomes
We can see that the Doppler shift Hz that is observed in the can be equal to [55]
And the maximum Doppler shift is as follows:
Now, let be the time that is required for a signal to travel the distance d. Then, we can rewrite from (12) as
In the above equation, we use a fc = 5.9 GHz, which is the band dedicated to V2V communication. The channel is also the channel of a baseband signal in (15) and if has the following form:
To get our final signal model, we replace the path loss parameter with the following equation:where is the received power at a reference distance , which is a standard value at about 100 m, is the path loss exponent, which is equal to 2 for the pure LOS links, and d is the distance that the transmitted ray travels between the two communicating nodes. So, only depends on the distance d that the ray travels. We denote as the time interval between the current time instant and the preceding one, in which the RSEA is reapplied . Furthermore, if represents the channel between the - pair, the distance between the two nodes after the time interval is , when the jammer approaches the receiver. Substituting (17) into (16), can be rewritten as
In the above equation, the only unknown parameter is at time t. Reorganizing (18), we have the following equation:where . In the above equation, the only unknown parameter is .
For the LOS channel between, we know that the receiver moves with the same speed as the transmitter, such as a platoon of vehicles with two members. The above means that the Doppler phenomenon is nonexistent. Following (16) for the formulation of the channel without the existence of Doppler phenomenon, we can see that this channel only depends on the path loss component and the complex amplitude associated with the LOS path. The path loss component and the complex amplitude variable can be estimated by the receiver. So the can be represented by a complex number:
Reformulating the combined value of the LOS channels (, ) in (12) by combining equations (20), (19), we have the following equation:
5.4. Relative Speed Estimation
At this point, we have an estimate of the baseband channel between , which can be represented with a complex number. The final baseband signal that reaches at the receiver after the intervention of the jammer can be represented as . From Algorithm 1, we know that the jamming symbols of the symbol vector is part of the vector . So, if from the estimated combined value we subtract the channel , which can be estimated by the receiver, the value can be set equal to the baseband received signal at the receiver:
From the above equation, also
Reusing the (19) from the previous section, the ray-optical baseband complex number can be set equal towhere . The jamming signal is estimated by the receiver from Algorithm 1. So the are known values to the receiver. From the above equation, we can calculate the desired parameters :
From (25) and (26) and with the use of the Euler identity, we have the following equation:
In (27), there is only one unknown variable . So, we can calculate as
From the above equation, we can see that the estimated value depends only on the excess delay time that is caused by the Doppler phenomenon and not on the actual value of Doppler shift.
6. Performance Evaluation
6.1. Evaluation Setup
Our evaluation scenario is conducted on the outskirts of the city of Aachen, representing a real-world environment while assuming that this is a rural area. Our experimental setup considers unicast data transmissions in a network consisting of three nodes: a transmitter, a receiver, and a jammer, and V2X broadcast communication for 10 interfering vehicles outside of the CS range between the and the (distance more than 1000 m). Two different moving RF jamming attack scenarios are evaluated. Analyzing RF Jammer Behavior 1 VI-C, the - pair (see Figure 1) travels with a constant speed of approximately and with constant distance of approximately 20 m, as a platoon of vehicles. The is also moving on a side road with zero initial speed and accelerates to a maximum speed of 60 Km/h in order to approach the - pair. In RF Jammer Behavior 2 VI-D, the transmitter and the receiver travel with constant speed of approximately when the jammer approaches the crossroads, as illustrated in Figure 3, with accelerating speed and a maximum limit of .
Our experiments are conducted using the Veins-Sumo simulator [56] with the simulation parameters presented in Table 1 such as the initial distance between the jammer and the pair of -, ; the distance that separates the receiver from the transmitter throughout the course of the simulation ; the closest distance in which the jammer arrives relative to the - pair as well as the power of all the transmitted signals ; the time interval after RSEA is reapplied; and the specific value of the parameter N, which is the number of the multipath rays. Last, the standard reference distance is used for the estimation of the LOS path loss component.
As illustrated in Figure 3, there is a time interval , in which the transmitter can effectively communicate with the receiver. It starts with the “Start of Communication Zone” and ends with the “Start of the Effective Zone” of the . After the start of the effective zone of the , the jammer is located at distances smaller than 30 m away from the receiver and it can completely jam the communication between the and the by constructing a “black hole.” All the evaluation parameters are summarized in Table 2.
During the performance evaluation, we test our proposed RSEA with different SINR values for two real-life scenarios. When the jamming vehicle is approaching the - pair, the SINR is given by
The SINR level is measured by the receiver at the PHY layer. In the above equation, the noise power is the noise power. Moreover, the mean absolute error (MAE) between the real value and the estimated is calculated for both scenarios. This is the difference between the actual relative speed metric with the estimated relative speed metric :where i is an integer number that identified with the current time instant in which the real and the estimated variable have a specific value and is the number of measurements for the specific speed value. The MAE value gets its optimal zero value when the real is identified with the estimated. We assume this optimal value as a reference point for the MAE calculations for the rest of the paper.
6.2. Speed Estimator Comparison
All state-of-the-art recent papers from 2014 onwards for speed estimation, along with the proposed one, are summarized and compared under specific conditions in Table 3. These articles fall into some specific categories. Some of the papers use RSUs installed on the side of the road that can detect a vehicle and estimate its speed by analyzing the influence of the vehicle on surrounding wireless signals from roadside wireless infrastructures (see [27, 29, 44]). In the same category belong the articles that require static nodes with specific magnetic sensors to collect the earth magnetic field and estimate the speed of a vehicle by calculating the similarity of vehicle signatures between these static nodes (see [42]). Last, recent papers such as [43] use ViLDAR systems to estimate a vehicle’s speed using received light power (intensity) variations of a vehicle’s headlamps as transmitter and static photodetectors as receiver through visible light communication (VLC). Moreover, some papers need static cameras located at the roads for the speed estimation procedure ([40, 41]). However, these methods require the deployment of many RSUs or additional hardware to estimate vehicle speed over a large section of the road, and therefore, the cost of the methods is high. The methods that use RSUs for estimating the speed of an RF jammer are not applicable additionally because a smart jammer may change its travel behavior (i.e., speed and direction) in order to look like a legitimate vehicle and thus remain undetected. Another category of papers uses specific hardware embedded in the vehicle such as UCA antennas, RADAR, and LIDAR for the speed estimation [29]. These techniques are also very expensive. Some papers need also big or medium training data for the speed estimation using either complicated kinematic models [27] or the autocorrelation between two time series of WiFi signals using different samples of SNR data [36]. Similarly, some papers must use a proper (relatively large) window size for collecting training data for performing speed estimation [44]. A last category of articles deals with some of the limitations that impose on the speed estimation process. Specifically, some of the papers assume moving vehicles with speed limits of up to which corresponds to relatively low sampling rates required for the WiFi hardware used [29, 44]. However, a great challenge of V2V communication is the high Doppler shifts due to the fast-moving communicating vehicles. Such corresponding limiting factors for a VANET may be the high computational time or the applicability of the method only to relevant static nodes such as applications for estimating speed directly from signal strength profiles of mobile phones.
Concluding, it is obvious that the proposed RSEA method is the only method in the state-of-the-art literature that estimates the relative speed of a jammer with a completely passive scheme that is based on RF communication between - with the interference of a jammer in the area, without extra cost for adding sensors or hardware. Moreover, we can conclude that the proposed method is the only method in the literature that combines the physical orientation of the vehicles in the considering jamming scenario with the relative speed between - without extra sensors. Last, the proposed method is the only method that does not susceptible to high Doppler shift or relative speed values that are observed in V2V communication. It may be noted that, later in this section, the proposed RSEA will be evaluated on a wide range of jammer speed values.
6.3. Results of RF Jammer Behavior 1
In RF Jammer Behavior 1, we assume that the pair - moves with a high constant speed (50 Km/h) when the jammer accelerates with a higher maximum speed (60 Km/h), while transmitting a jamming signal with a simplified form to the receiver. The first figure of Figure 4(a) shows a comparison between the real and the estimated value. Specifically, by observing the start time of the steep slope of SINR in Figure 5(b), we can conclude that it coincides with the start of the jamming attack, 15.5 sec. The main reason for the sharp decrease of the SINR in our experiment is the jamming attack and not the interference from the entire environment. In that case, the total received power at the is also increased indicating the jamming attack. Moreover, in Figure 4(a), after 15.5 sec, for which is above , the SINR in Figure 5(b) has also a steep slope. So, the effective zone of communication between and is approximately sec, whilst after that it is corrupted for 13.5 sec. So, the “black hole” in the communication range between the and the is during the time interval (15.5 sec–29 sec). After 29 sec, we have the end of the attack. For this time interval (15.5 sec–29 sec), the MAE of our proposed RSEA increases to from the optimal MAE value (see Figure 6).
(a)
(b)
(a)
(b)
In Figure 4(a), we can see that reaches a maximum value, approximately , at the time instant 23.4 sec. At this time, is approaching the - pair in the main road, which is illustrated in Figure 3. The average MAE for the duration of RF Jammer Behavior 1 is approximately worse than the optimal value.
6.4. Results of RF Jammer Behavior 2
For the second evaluation scenario, we assume that the pair - travels with constant speed (48 Km/h), which is almost the same as the maximum speed of the jammer (50 Km/h) (see Figure 5). The jammer continuously transmits a random jamming symbol to the receiver. The start time of the jamming attack is at 18 sec during which the SINR appears to be decreasing from 5 dB to zero while starts to increase from to the “peak” value of . The time that is needed for the to approach the pair - is approximately sec. After that time, the jamming attack clearly has perfect results for 18 sec; from the 18 sec of the simulation until 36 sec, after that SINR increases more than 5 dB.
If the slope is positive, the approaches the , whilst if it goes to zero, is removed from the effective zone of communication between the and the . The “black hole” in the communication between the and the is around the time interval (18 sec–36 sec), during which the MAE value increases to approximately from the optimal MAE value.
In Figure 5, we can see that the average MAE for the complete duration of RF Jammer Behavior 2 is approximately worse than the optimal value, as it is shown also in Figure 6.
6.5. MAE Comparison between RF Jammer Behavior 1 and RF Jammer Behavior 2
The overall comparison of the MAE results between RF Jammer Behavior 1 (Jammer 1) and RF Jammer Behavior 2 (Jammer 2) is summarized in Table 4. Figure 6 shows that there is a quite small MAE, only greater than the MAE value at the start and end of simulation. However, when the jammer approaches the receiver, the MAE shows an increase of about from the optimal value for RF Jammer Behavior 1 and for RF Jammer Behavior 2. The phenomenon of the larger MAE at the time of the jamming attack for RF Jammer Behavior 1 compared to that of RF Jammer Behavior 2 is attributed to the fast varying nature of the metric because it changes with a higher rate, and thus, the channel between the and the changes frequently too. So, the longer the duration of the jamming attack lasts, the better the MAE results of the proposed RSEA are.
In order to test our previous results under more generic scenarios, the average MAE is estimated for different jammer speed values and different number of “hidden” nodes that are located at the edge of the CS range of the pair. Specifically, we conducted several simulations, for a range of jammer speed values between and number of “hidden” nodes between nodes. For these parameters, the MAE value increases at approximately from the reference zero MAE value with the maximum jammer speed value (see Figure 7(b)) and at approximately19.2% from the same reference value with the maximum number of “hidden” nodes, which is 50 nodes (see Figure 7(a)). For values greater than regarding the speed metric and 30 “hidden” nodes, the MAE was increasing with a higher rate. For smaller values of these two “side effect” values, the increase of MAE value is negligible. So these simulation results indicate that the back-off MAC/EDCA algorithm, using a safety-related high priority channel for the communication between , does not affect considerably the performance of the speed estimation algorithm. The jammer’s speed increase also affects but not significantly the proposed RSEA.
(a)
(b)
7. Discussion
In Section 6, we tested our proposed RSEA under different SINR values in order to represent realistic conditions. When there is a decreased steep slope of the SINR values, a jamming attack is conducted in the area. At the same time, the relative speed value , as defined in (4), presents an increased steep slope, indicating a jamming attack. Furthermore, when the jammer approaches the receiver, the MAE of the RSEA presents a significant increase due to the packet loss of the pilots sent by the to due to the presence of jammer. This results in the incorrect estimation of the stochastic V2V channel between and , increasing also the corresponding MAE of the value.
V2X communication generally uses broadcast messages, but in this paper, we use unicast RF communication between two nodes in order to perform jammer’s speed estimation. This type of communication is supported for advanced safety applications of autonomous vehicles by the Qualcomm’s Cellular Vehicle-to-Everything (C-V2X) technology [57]. The target of this paper is to evaluate the performance of the RSEA for a pair of moving nodes with limited conditions, having as a future objective to be used in a real-life VANET scenario for more than one pair of nodes. Peer-to-peer networks in VANETs are studied lately in many other works [58–61], focusing mostly on social networks message exchange, cooperative caching, or unicast video streaming.
Relative speed estimation results from our proposed RSEA can be collected from a Trusted Central Authority (TCA) that exists in the area. Analyzing these collected data records, the TCA makes deductions based on the SINR value, notifies approaching vehicles, and even proposes jamming-free routes [62].
8. Conclusion and Future Work
In this paper, we presented an algorithm for estimating the combined value of the relative speed between and in combination with the AOP of the , during a jamming attack. A simplified jamming signal is sent to the receiver by the jammer that contains an unknown symbol to the receiver K times. The proposed relative speed metric can capture both the speed of the jammer and its direction relative to the - movement. By predicting the above value, we can understand jammer’s behavior, for which does not have any information except for the combined signal that is received from and the interference caused by the attacker. Our proposed RSEA uses the physical metric of from RF communication in order to estimate the direction of the attacker. This metric is combined with the SINR value from the hardware (physical layer) in order for a real-life VANET scenario to be simulated. The MAE measured is being approximately only worse compared to the optimal zero MAE value under different jamming attach scenarios.
As future work, we plan to combine RSEA with other metrics from the PHY layer or the network layer, such as SINR, for developing an accurate cross-layer jamming detection scheme. The detection scheme will be capable of dealing with more than one pair of nodes that communicate in a broadcast form. This combined metric can be also used as an extra feature in a machine learning approach (see [63]), in which the vehicles of the area can be classified as cooperative or malicious, thereby forming a trusted vehicular network. The usage of the relative speed metric can also reduce false alarms and can provide additional information about the future position of a , such as the time that the attacker will approach the effective zone of communication. The above information extracted from our channel-based - analysis can decrease false alarms compared to jamming prediction schemes that are based only on the 802.11p PHY/MAC-related metrics (see the DJAVAN in [64]), concluding the physical geographical topology of the attacker. Last but not least, this metric is appropriate for a variety of jamming attacks.
Data Availability
The data used to support the findings of this study are available from the corresponding author upon request.
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this paper.