Received Power Based Unmanned Aerial Vehicles (UAVs) Jamming Detection and Nodes Classification Using Machine Learning

1  Introduction

Drone or UAV are aircraft controlled remotely without a human on board. Drones have developed from military operations to support the defense system, by employing modern and advanced technologies (i.e., hardware and software) and become a lower-cost system, with smaller devices, high mobility, and easier to control. UAVs developed for military and civil applications are invariably involved in increasing numbers of incidents [1–5]. Furthermore, UAVs can be classified into various categories according to different criteria such as size, functionality, and wing configuration [6–10]. For example, wing configurations include fixed and rotary wings. The fixed wing can load with a high payload and travel for long distances with maximum speed and is used in the aviation industry. In contrast, rotary wings are equipped with multiple small rotors and can hover vertically and keep stable while flying.

Wireless communication, in addition to the advancing technologies used in UAVs, is an essential component of cybersecurity and has drawn increasing attention in recent years. Because the UAV can hover over the target area and transmit signals at high power, it may affect the communication channels available to legitimate nodes. This is known as the jamming attack in wireless networks. Jamming is one of the worst attacks due to being easy to launch and hard to detect [11–13]. Wireless sensor networks consist of an enormous number of nodes. These nodes exchange their data with each other through multi-hop. Where each node transfers collected data to the next hop until it reaches the sink or destination node.

Security challenges in WSN include jamming attacks, where the jammer transmits a signal towards the target channel, intends to decrease the Signal-to-Noise Ratio (SNR); increases Bit Error Rate (BER), and decreases the Packet Delivery Ratio (PDR) which cause preventing the node from communicating with its neighbors [14,15]. Moreover, by emitting a signal with high power that is considered noise on the receiver side, nodes within the jamming area or near the noise source may not assign themselves to the available channel due to the jamming signal. In this case, the node will keep sensing to find an available channel until its energy depletes or eliminates the jammer from the networks. On the other side, when a node receives collected data from its neighbor during the jammer transmission will be considered to receive a large amount of noise [16,17].

Jamming or intentional interference is classified into several types based on its operation and functionality [18,19]. Furthermore, jamming is an operation in the frequency or time domain. In frequency domain jamming, the jammer adjusts its frequency to disrupt a target channel. When there is more than one channel or subchannels located for WSN nodes, The Frequency Hopping Spread Spectrum (FHSS) technique is used to improve network performance and increase security levels especially when the noise level increases in one subchannel [20]. FHSS is based on the divided channel into subchannels and located narrow band for each subchannel. To avoid jamming, nodes may hop from a targeted subchannel during jamming attacks. However, when a jammer operates in the frequency domain, it may detect a subchannel before emitting a jamming signal. In the time domain, the jammer is starting to transmit and switching to sleep mode at a random time. For example, a constant jammer will keep transmitting a signal at high power until its physically removed from the networks. For a random jammer, the enemy emits a jamming signal at a random time [21,22]. It switches between active and transmitting modes at various times. Barrage, single tone, and successive pulse are other types of jamming attacks and defined for military or electronic warfare purposes, with the same functionality and operation represented in academia [23,24].

In this paper, we proposed a machine learning model for jamming detection and node classification during jamming attacks based on the received signal strength, and distance ratio. By selecting the appropriate features, a machine learning-based model can achieve high detection and classification accuracy. In comparison to centralized jamming detection techniques, the proposed model offers the highest accuracy since it uses only one node and one neighbor to estimate received powers and distance ratios.

The paper is organized, as follows: following the introduction, the literature review describes in Section 2, the jamming attack model describes in Section 3, the proposed jamming detection metrics discusses in Section 4, and the simulation and results are provided in Section 5. Finally, a conclusion is given in section 6.

2  Literature Review

The detection of deliberate interference or denial of service attacks (i.e., jamming attacks) on WSNs has been proposed in several research papers. In this paper, we investigate how to detect jamming once it emits a malicious signal. We developed an algorithm that classifies nodes during jamming attacks based on machine learning. Multiple studies suggested different approaches to detect jamming based on various measurement metrics.

Detecting a jammer using Bad Packet Ratio (BPR), PDR, and Energy Consumption Amount (ECA), as well as enhancement methods, was reported in [25]. Detection begins by checking the level of PDR, BPR, and ECA; if the values are below the threshold, jamming is considered. Otherwise, no jamming occurs. It relies on the determination and measurement of threshold values to perform this method. The detection mechanism can produce inappropriate results if threshold samples are too sensitive or inaccurate. The second algorithm improves the first algorithm and avoids its disadvantages. When abnormal, neighbor nodes exchange query and reply packets to detect jamming. It not only relies on the relationship between sampled parameters and defined thresholds in a node but also inquiries about neighbor’s parameters to detect jamming.

In [26], the authors proposed a machine-learning model for detecting and classifying four types of jamming. A drone attack was detected using signal-to-noise ratio, energy threshold, signal power, noise power, and Orthogonal frequency Division Multiplexing (OFDM) features; the SNR and energy threshold were used to measure the performance of the networks once a jamming attack begins. In addition, OFDM was recorded by the drone’s Software Defined Radio (SDR) for extracted image features and the number of pixels pooled to reduce computation time. However, the proposed model requires collaboration between the UAV receiver and the data extraction module to extract real-time signal features and images.

In [27] WSN jamming was detected using Exponentially Weighted Moving Average (EWMA) and Packet Inter-Arrival (IAT) features. Stepwise and statistical methods are employed on the cluster head to implement the suggested technique. However, a high level of computation was required by the cluster head for the proposed method.

In [28], the authors propose a method for detecting different types of jamming based on various parameters, including Total Packet Dropped (PDPR), the total packet received, and the total SNR. The presented algorithm relies on a centralized approach whereby each legitimate node sends PDPR, RSS, and SNR to the base station. On the base station, the fuzzy system inference system computes a Jamming Index (JI) based on the Mamdani model, which determines whether or not a node is jammed based on the computed jamming index.

In [29] the authors describe malicious interference countermeasures as a multi-user intelligent game and proposed Game with Post-Decision State (GPDS) anti-jamming secure computing using time-varying channels in the Mobile Edge Computing (MEC) networks. The Nash equilibrium gives the potential optimal channel selection strategy of a deep reinforcement learning multi-user random game with a proposed post-decision state. After multiple steps of training, mobile users can learn the optimal channel-switching strategy.

As proposed in [30], To maximize the quality of the UAV network, include mutual interference among UAVs and external malicious jammers. Multi-Agent Layered Q-Learning (MALQL) is presented as a method to reduce dimensionality and analyze asymptotic convergence in the action space. The proposed algorithm outperforms traditional multi-agent Q learning techniques due to different jamming strategies.

The method of [31] uses deep reinforcement learning and feature engineering to defend jamming in wireless networks. Spectral differences between adjacent time slots provide information about interference patterns, based on the analysis of spectral differences between adjacent time slots. The reinforcement learning environment, including the state space and reward function, is improved through feature engineering, reducing computational complexity effectively by integrating Deep Q Networks (DQNs) and Recurrent Neural Networks (RNNs).

Existing techniques have some drawbacks, such as (i) higher computational complexity at the base station when using a statically applied technique, (ii) network flooding when node information is broadcast to sink nodes, and (iii) inaccurate estimation of measurement metrics due to jamming signals. Considerable types of investigation offered centric node approaches; this strategy required collecting data from jammed nodes and was highly sensitive to noise power (or SNR). As a result of the following, our contribution differs from the literature:

•   There is no need to flood the networks or increase the communication overhead between legitimate nodes and base station.

•   It uses distributed techniques for detecting jamming and classifying nodes based on the information received from the jammer and the estimated distance ratios.

•   It can detect and classify nodes into jammed, unjammed, and edge nodes.

•   There is a reduction in computational complexity due to no need for implementing additional hardware or estimating measurement metrics such as packet delivery ratio, total packet drops, energy consumption, the total packet sent, etc.

3  System Model

The jammer UAV (J) uses a high-power signal to target the physical layer of communication to reduce the SNR below the receiver threshold (Y). We consider a jammer UAV hovering in three-dimensional spaces (xj,yj,zj) near the target area and transmitting its jamming signal (Sj) towards base stations on the ground as shown in Fig. 1. In the jamming region, nodes may receive considerable amounts of noise (SNR < Y), preventing the node from decoding the received packets and from transmitting its collected data due to the busy channel which is known as jammed nodes (Nj) located at position (xnj,ynj). A sensor nearby the target area is called a boundary node and is located at potion (xb,yb) and may receive the jamming signal with acceptable SNR (SNR > Y). An edge node (Ne) located at (xe,ye) exactly at the jamming region (SNR ≈ Y) and partially connected to its neighbor nodes. A crucial factor in detecting jamming techniques is the signal-to-noise ratio (SNR) as SNR=PrN.

Figure 1: Jammer UAV targeted ground-based base stations, where green stations represent unaffected nodes and blue represent jammed nodes inside the red circle. The sensing range is depicted by blue dots and the jamming region by red dots

Where N is the total noise received by the receiver node including the jamming signal and Pr is the node’s power received. For the jammer to successfully jam the target node, the jamming-to-signal ratio J/R is given as in Eq. (1):

J/S=PjGj4πR2PtGtσ(1)

where the jamming received power is depicted as Pj, and the node’s transmission power is Pt, R represented the distance between the anchor node and jammer, and the Gj and Gt represent the antenna gain for the jammer and transmitter, respectively. The power received by the node from its neighbor is described in decibel as in Eq. (2):

Pr=Pt+k−10log10⁡d+Xσ(2)

where d is the Euclidian distance between node and jammer as in Eq. (3):

d=(X−Xj)2+(Y−Yj)2+(Z−Zj)2(3)

And n is the path loss factor that depends on the physical environment when the signal propagates between two transceivers. The Gaussian noise with zero mean is denoted by Xσ. L1 and L2 in Fig. 2 represent the disconnected link due to the jamming effect. Where the djbanddeb depicted the distances between the jammer and the boundary node and from the edge to the boundary node, respectively and dje represents the distance between the jammer to the edge node. During the jamming attacks node’s received power is affected by the jamming power based on the jammer’s transmission power and its location as described in Eq. (4):

ST=S+Xσ+Sj+Xjσ(4)

where the ST represented the total signal received by the node and S node neighbor’s received signal, Sj is the received jamming signal. As shown in Table 1, the key parameters are defined.

Figure 2: A representation of the link quality and JRSS as the jammer moves. The red dots indicate the jamming signal received by the base station. Solid black lines represent the power received by the boundary node from its neighbor, and the dots represent the connection between the nodes

4  Proposed Jamming Detection Metrics

Now, we present a distributed jamming detection technique. In this method, nodes estimate jamming detection metrics by collaborating with their neighbors. The only input required to be sent by the node’s neighbor is the received signal strength (RSS). To detect the presence of a jammer UAV, RSS, and distance ratios were selected. The RSS is the power received by the node and is described in Eq. (2). When the node received power from its neighbor during jamming transmitting its signal, the node considers receiving a large amount of noise. This indicates not only other nodes transmitting a packet at the same time but also jamming targets the node. Therefore, the SNR and distance ratios are used as the main factor to detect the presence of jammers and classify nodes. SNR is also known as signal-to-jammer power ratio (SJR) in the presence of a jammer and is calculated as the ratio of received power to total noise including the jamming power. Nodes may have different SNR values depending on the amount of noise received as presented in Eq. (5):

SNR={Unaffectednode(Nbr),snr>γJammednode(Nj),snr<γEdge node(Ne)snr≈γ(5)

The distance ratio is based on the signal-to-noise ratio when the jamming signal affects boundary and edge nodes, which was introduced in [32]. As the jammer moves closer to a node, we observe that the SNR decreases to reach the system threshold value before becoming jammed. As a result, the SNR in the jamming region is approximately equal to the value of the system threshold. Alternatively, a jammed node means that SNR is below the threshold value when it receives a large amount of noise. Therefore, the distance ratio can be expressed as in Eq. (6):

SNR=Pr−N(6)

where N represents the total noise received including the jamming power as in Eq. (7):

N=Xjσ+Pj(7)

Therefore, the SNR and the distance ratio at the edge node are represented in the following equations:

SNRe=γ=Pr−PJE(8)

SNRe=γ=Pr−(PJ−10nlog10⁡(μ))(9)

μ=djedjb(10)

In this case, PJE is the jamming power received at the edge node. Based on the relationship between the power received and the distance, we estimate the jamming power received at the edge node. Therefore, the distance ratio (μ) is the distance ratio between the jammer and edge node dje, and from the jammer to the boundary node djb as in Eq. (10). Using Eq. (9), 10nlog10⁡(μ) is the amount of power needed to estimate the jamming power at the edge node based on the jamming power received by the boundary node. Since both distances are unknown, Eq. (9) is used to estimate the distance ratio (μ) as in Eq. (11):

μ=10(γ−Pr+Pj10n)(11)

where the estimated (μ) values vary depending on the node’s power received, total noise received, and the system threshold value. when the μ is equal to zero, the edge node location is where the jammer is located at the same position as the edge node. In this case, the dje is equal to zero which means the node is located inside the jamming region and becomes a jammed node. However, when the node is located at the edge of the jamming region, its SNR is equal to the system threshold value, and both distances are equal (dje=djb), the estimated distance ratio is equal to 1. On another hand, an unaffected node or unjammed node with a distance larger than the node’s sensing range may have acceptable SNR and distance ratio larger than one. Based on this, we have the following distance ratio detection parameter:

μ={0.9<μ<1,unjammednodeμ>1,jammednodeμ≈1,edgenode(12)

Furthermore, in the proposed jamming detection algorithm additional distance ratio metric was added to the dataset to classify nodes and analyze the dataset to increase the detection accuracy and differentiate between intentional and unintentional interference. Accordingly, the distance between a node and its neighbor is derived from the power received by the node, including the power of jamming. For each node, the original distance and the estimated distance between the boundary node and its neighbor are calculated to estimate the distance ratio (μb). It is assumed that WSN nodes are homogeneous and stationary, i.e., nodes do not change their position during a jamming attack. In this case, the distance ratio between the node and its neighbor is as in Eq. (13):

distbr=10(Pt−Pr10n)(13)

And the estimated distance during jamming attacks becomes as in Eq. (14):

dist¯br=10(Pt−PT10n)(14)

where PT is the total power received by the boundary node including the jamming signal and noise. Furthermore, the distance ratio μb from the node to its neighbor is computed as the following Eq. (15):

μb=10(−Pr+PT10n)(15)

Since the node’s transmission power and distance between nodes are known, Eq. (2) can be used to calculate the original power without noise or jamming power. Additionally, each node must calculate the received power to estimate the SNR. Whenever there is no jamming power received, the total power is approximately equal to the power received by the node. In this case, the distance ratio (μb) equals one and increases as the jammer moves towards the target node if exists. Additionally, we include how the SNR differs from the system threshold value (diffsnr), whose value varies depending on the position of the jammer and the transmission power as in Eq. (16):

diffsnr=SNR−γ={diffsnr>0,unjammednodediffsnr<0,jammednodediffsnr≈0,edgenode(16)

5  Simulation and Performance Evaluation

In this section, the machine learning model for jamming detection was evaluated using three different parameters as features with different scenarios. We considered the jammer UAV hovers over the target area in three-dimensional space (x,y,z) and the nodes are located at the position (x,y) as shown in Fig. 3. In the first scenario. We validated the proposed method by placing the jammer’s initial position in (45,30,20) at different transmission powers based on the type of jammer UAV used. The boundary node is located outside the jamming region at position (35,20,0), with a transmission power of −40 dBm and a sensing range of about 25 m. The neighbor node near the boundary node is located at position (25,25,0) with the same transmission power and sensing range as the boundary node. The input variables for the simulation regarding the WSN and different types of jammer UAVs are defined in Table 2.

Figure 3: An illustration of a network deployment with a jammer hovering around the target area. (a) Based stations randomly distributed on the ground and the initial position of the UAV (45,30,20), (b) the locations of the node and its neighbor (35,20,0) and (25,25,0) respectively, and (c) the 2D representation

5.1 Jamming Detection Metrics with Different Jammer

To evaluate and compare the proposed detection method with different jammers and parameters, the MATLAB simulation tool is used, as shown in Table 3. Different types of jammers considered to evaluate the proposed jamming detection metrics include constant jammers with low power (CONL), constant jammers with high power (CONH), random jammers with low power (RANL), random jammers with high power (RANH), reactive jammers with low power (REAL), and reactive jammers with high power (REAH). Based on the power received by the boundary node at each time step, Fig. 4 depicts the detection metrics with different types of jammers. For a constant jammer with low power −27 dBm, the trajectory moves around the target area near the boundary node in 200 steps and transmits a continuous jamming signal. The jammer is at the closest point to the target node in steps 1 and 195, while it is at the maximum distance from the boundary node in step 90. In this case, the node is depicted as a jammed node. At time steps 10 and 160 the node becomes an edge node as shown in Fig. 4a. Different types of jammer and measurement metrics are shown in Figs. 4b–4d. In the same Figure, the relationship between distance ratios μ,μb, and diffsnr while the jammer UAV hovers around the target node is represented. Positive diffsnr indicates that the node received less noise or weak jamming power and is categorized as an unjammed node since μ is less than one. A node is considered an edge node when its diffsnr is equal to zero and its μ is approximately one. Alternatively, nodes whose diffsnr is negative and whose μ is larger than one are considered jammed. Each time step, the jammer’s position is represented by the distance ratios in the same Figure. Since the distance ratios are estimated based on the distances, the distance ratios are unaffected by the type of jammer and the jamming signal level. Accordingly, the proposed jamming detection metrics are effective in detecting different types of jammers.

Figure 4: The UAV detection is based on distance ratios (μ,μb) and diffsnr with different jammer types. (a) CONL with −27 dBm, (b) CONH with −22 dBM, (c) RANL with −27 dBm, (d) RANH with −22 dBm, (e) REAL with −27 dBm, (f) REAH with −22 dBm

5.2 Performance Evaluation

Several types of datasets are generated for evaluating jamming detection accuracy, including CONL, CONH, RANL, RANH, REAL, and REAH. A transmission power of −22 dBm is set for high power and −27 dBm for low power transmission. Using four different machine learning algorithms, we analyze the detection of different jammers. Various metrics, such as confused matrix and accuracy rate, are used to demonstrate classification performance. True Positives (TP), False Positives (FP), True Negatives (TN), and False Negatives (FN) comprise the confusion matrix. The performance was evaluated using precision, recall, accuracy, and F-Measure. All algorithms are implemented in MATLAB and the measures are calculated as in the following equations:

Precision=TPTP+FP(17)

Recall=TPTP+FN(18)

F1=2∗Precision∗RecallPrecision+Recall(19)

Table 4 and Fig. 5 show output from Linear Discrimination (LD), Naive Bayes (NB), Support Vector Machines (SVM), and KNN when the jammer UAV hovers and transmits different power. A KNN algorithm performs better than other algorithms, consistently achieving 98.5% average accuracy and detecting and classifying nodes with 99.9% as testing accuracy; NB algorithms show the worst performance with 91.2% average accuracy and 89% average testing accuracy. Based on a different machine learning algorithm, Figs. 6 and 7 presents the performance of different types of jammers using precision, recall, F1 scores, True Positive (TP), and True Negative (TN). With an average precision of 98%, KNN outperforms all other algorithms in different types of jammers. In the presence of different types of jammers, LD and NB remain the worst algorithms for detecting and classifying nodes. Based on the evaluated scenario, KNN is the only algorithm with stable performance across different strategies.

Figure 5: Illustration of the average accuracy and testing accuracy with different machine learning algorithms (a) Average accuracy, and (b) Testing accuracy

Figure 6: Performance of algorithms for different types of jammers where the low power depicted by L and the high power is H. (a) Constant jammer, (b) Random jammer, and (c) Reactive jammer

Figure 7: Performance of algorithms for different types of jammers (a) TP and (b) TN

Table 5 shows the proposed method compared to the state of the art algorithm. the comparison is based on the detection metric, the jamming attack type, and the detection accuracy. It has been found that most of the proposed methods produce a high detection rate, similar to our approach. While most of these methods use multiple detection metrics, we have developed a technique that is based on distributed technique and requires less overhead for sensor nodes that are already resource constrained.

6  Conclusion

Detecting jamming UAVs and classifying nodes into jammed, unjammed, and edge nodes are presented in this paper. To generate the dataset, different types of jammers with different levels of the jamming signal were used. The three features were constructed based on distance ratios and received signal strength. In comparison, it was simpler and had a higher level of detection accuracy. Evaluation of the proposed technique was based on precision, recall, F1 score, and TP and TN. There is an average accuracy of 99.7% for the KNN algorithm, compared to DL, NB, and SVM algorithms. Moreover, because the proposed technique is based on distributed jamming detection, the nodes themselves decide on jamming detection. Based on our results, our proposed method is capable of detecting jamming attacks and classifying nodes with reduced complexity and overhead, and it does not flood the network with work. Further, the suggested detection metrics are based on distance ratios derived from power received and noise, including jamming signals, if present.

Acknowledgement: The authors extend their appreciation to the Deputyship for Research & Innovation, Ministry of Education in Saudi Arabia for funding this research work through the Project Number (IF-PSAU-2021/01/18707).

Funding Statement: This research work was funded by the Deputyship for Research & Innovation, Ministry of Education in Saudi Arabia through the Project Number(IF-PSAU- 2021/01/18707).

Conflicts of Interest: The authors declare that they have no conflicts of interest to report regarding the present study