Joint reactive jammer detection and localization in an enterprise WiFi network

The deployment of wireless networks for Internet connectivity has been rapid during the last decade. Following this trend, enterprises utilize multiple access points (APs) in order to provide wireless connectivity to authorized users within its premises. However, wireless networks are extremely vulnerable to PHY/MAC layer attacks such as jamming. A jammer transmits electromagnetic energy on the medium in order to either block the access to any legitimate transmitter or cause collisions at the receiver (or both). One of the most advanced jamming models is that of reactive jamming. A reactive jammer does not constantly transmit energy on the air, but only jams when a legitimate (target) packet is on the medium, aiming at its collision at the receiver. Previous studies have shown that reactive jamming is one of the most difficult attack models to detect. In this work, we propose a scheme that performs both detection and localization of a reactive jammer in an enterprise WiFi network. In brief, a reactive jammer can virtually increase the interference range of the target AP and thus increase the busy times of nearby APs that use the same frequency. By quantifying this effect we are able to accurately detect the presence of a reactive jammer and perform a coarse grain localization of the jammer. Our simulation results show that our scheme can achieve high true positives and low false positives simultaneously. In addition, our coarse grain localization scheme exhibits error on the order of the AP coverage area.