Localizing Jammer in an Indoor Environment by Estimating Signal Strength and Kalman Filter

Localizing a jammer in an indoor environment in wireless sensor networks becomes a significant research problem due to the ease of blocking the communication between legitimate nodes. An adversary may emit radio frequency to prevent the transmission between nodes. In this paper, we propose detecting the position of the jammer indoor by using the received signal strength and Kalman filter (KF) to reduce the noise due to the multipath signal caused by obstacles in the indoor environment. We compare our work to the Linear Prediction Algorithm (LP) and Centroid Localization Algorithm (CL). We observed that the Kalman filter has better results when estimating the distance compared to other algorithms.


Introduction
Wireless sensor networks (WSNs) are utilized in different fields including healthcare monitoring, industrials, military, air pollution, water quality monitoring, security monitoring, wearable devices, internet of things, and more [1] [2].WSNs are developing as multi-hop networks where each sensor gathers and transfers information to the next hop sensor until it reaches the destination node or the sink.WSNs are designed to share the communication medium, which is vulnerable to several attacks, such as a jamming attack, Danial of Service (DoS), eavesdropping, a man in the middle attack.Jamming attacks are the most severe W. Aldosari, M. Zohdy DOI: 10.4236/wet.2018.92003 21 Wireless Engineering and Technology attacks on WSNs due to ease of launch.A jamming attack may block the sensors from communicating with their neighbor by emitting its signal with high power to prevent a legitimate node from transmitting its data [3].Locating a jammer in WSNs is very important to support the improvement of existing countermeasures.In an indoor environment, applications using the wireless communication are rapidly increased, such as health monitoring, internet of things applications, and monitoring secured place inside the building.Because the WSNs are designed as multi-hop networks, the sensor forwards its information to the next hop node until it is received by the destination.Therefore, routing protocol is designed to find the shortest path between the sender and the sink node before the transmitter starts transmitting its collected data.By detecting the jammer location, the routing protocol is forced to avoid the jamming region which causes repeated messages due to delivery failure [4].Other reasons for locating the jammer position are capturing, eliminating and isolating jammer from the network, or finding a stranger in a secured place.
Jamming attacks in WSNs have been intensively studied and defined as a stranger transmitting signal with high power to inject a false signal, override the legitimate node's message, or isolate nodes from the network [5].Furthermore, the jammer may use many techniques by adjusting its frequency.Jammers are classified into two major types: frequency domain and time domain.During a frequency domain attack, the jammer transmits its radio signal towards the target by adjusting its frequency to harm the channel, or many channels, based on its jamming strategy.During time domain attack, the jammer emits its signal periodically, which means it has two states: Sleep state and jammed state.This type of jammer is more difficult to detect because when it sleeps, we cannot tell if it exists or not.Classification of jamming attacks is described as follows [6]: A constant jammer is a frequency jamming attack.In a continuous jammer attack, a jammer emits a continuous signal with random bits which makes the channel too busy for legitimate nodes to transmit their data.A random jammer transmits the constant random data to its target.This type of attack is a time domain because the jammer sends its jamming signal periodically and then switches to sleep mode.A different kind of time domain is a reactive jammer.A jammer keeps sensing the channel until it becomes active, then it starts transmitting its jamming signal.The last type of frequency jamming attack is a deceptive jammer.Unlike the constant jammer, a deceptive jammer transmits regular data towards its target.
Several algorithms have been proposed as anti-jamming attacks in wireless communication, such as the Frequency Hopping Spread Spectrum (FHSS) and the Direct Sequence Spread Spectrum (DSSS) [7].Both FHSS and DSSS are based on a secret shared key between nodes or sensors before exchanging their information [8].While the sensors were randomly deployed and dynamically jointed the network, the shared secret key is infeasible when the jammer is present and blocks the communication and isolated nodes from the network before agreed upon shared key.Furthermore, due to the restricted resources in Wireless Engineering and Technology WSNs, like memory and energy, the DSSS and FHSS are not suitable.
Indoor localization is challenging due to multipath signals caused by surrounding objects.When the signal propagates between two transceivers, it may have reflected, diffracted, or scattered before being received by the next hop node.The Non-Line-of-Sight (NLOS) [9] is the signal received by the receiver node after being reflected by objects.Due to the change of the signal path and angle degree, the detecting location techniques, such as angle of arrival, time of arrival, difference time of arrival, results in wrong distance estimation.Therefore, estimating the distance using the jammer received signal strength is significantly more accurate.
Existing location detecting technology, such as a Global Position System (GPS), may not work correctly due to the weakness of the signal inside the building [10].Some localization techniques need additional hardware such as sonar, infrared [11], Time of Arrival (ToA), Difference Time of Arrival (DToA), and Angle of Arrival (AoA) [12] [13] [14].These are difficult due to the restricted resources in the sensor node, including energy consumption, memory, processing, and bandwidth.Most of the jammer localization algorithms are focusing on detecting jammer location in public areas or outdoor environments and according to Yu et al. [15] identifying jammer position using nodes located within a jammer transmission range that is being jammed by the jammer.The jammed nodes measure the distance from the jammer using received signal strength acquired from the jammer.The boundary node adjusts its transmission power more than the jammer to be able to receive jammed node messages.Unfortunately, this approach consumes node power, which is unacceptable due to the constrained resources in WSNs.Plechrinis et al. [16] evaluated jammer location using Packet Delivery Ratio (PDR).Nodes near to the jammer have a weaker value of PDR.This found by examining all PDR and finding the smallest PDR, which indicates a node near the jammer location.In other words, their algorithm utilized the search technique to determine the closest boundary node to the jammer.This method obtained the nearest sensor to the jammer, not the jammer location.When the jammer was using high transmission power to jam sensors, the closest boundary node was located far away from jammer's location.[17] [18] a different method involved Centroid Localization (CL) and Weighted Centroid Localization (WCL) algorithms detecting jammer position by averaging jammed node coordinates, which were located within jammer transmission range.CL and WCL are very sensitive to their location and number of isolated nodes.In this work, we proposed detecting the position of an indoor jammer by estimating jammer's received signal strength and Kalman filter.The main challenges to locating a jammer in an indoor environment are the received JRSS not being pure and have considerable noise produced by the surrounding environment.Moreover, due to signal path loss and the reflected signal, while propagating from the transmitter to the receiver, more effort of computing the jammer location was added.Therefore, the Kalman filter was utilized in this work to reduce noise, and the path loss model was used to estimate the distance between Wireless Engineering and Technology anchor node and advisory.We compared our work to linear prediction and centroid localization to analyze the effect of noise, jammed node positions and number for locating the jammer's position.
This paper is organized as follows: the network model and types of nodes in general model and jammed launch is discussed in section 2. In section 3, the path loss model, NLOS, and Sight-of-Line (SOL) are presented.The Linear Prediction, Centroid Localization, and Kalman filter are discussed in sections 5, 6 and 7 respectively.Section 8 includes the analysis and simulation results.Section 9 concludes this paper.

Network Model
We considered the sensors deployed randomly over a small area in an indoor environment.All sensors in our proposal are classified as having the following characteristics:

General Network Model
Multi-hop.Each node must pass the data collected to its neighbor to the sink node.
Stationary.All nodes have fixed position and remain not change after node deployed.
Neighbor-Aware.Each node knows its neighbor position by exchanging the location information.
Location-Award.A node can detect its location coordinate after sensors are deployed.
Homogenous.The sensor has an omnidirectional antenna and transmits with the same power level.

The Effect of Jamming Signal Model
Unaffected node: All nodes that are outside the jammer's transmission range, and they can receive a packet from all their neighbors.
Jammed nodes: Any sensors within the jammer's transmission range.A node cannot receive a message from its neighbor.
Boundary node: A node can receive a packet from part of its neighbor.A boundary node can also measure the jammer Received Signal Strength from oncoming messages.We estimate the jammer position using the boundary nodes, where they can receive the jammer's received signal strength.Figure 1 shows the network model effect by the jamming signal.Nodes and jammer are distributed randomly in our network.This figure contains unjammed nodes, jammed nodes, boundary nodes, and the jammer.

Log-Normal Shadowing Model
Wireless communication is susceptible to several challenges as signals travel from the transmitter to the receiver.Not only can the signal suffer from noise Wireless Engineering and Technology and interference, but also from the reflection, diffraction, and scattering [19].Due to the multipath signal caused by obstacles and surrounding objects in an indoor place, as shown in Figure 2, we use a Log-distance path loss model to estimate the distance between the boundary node and the jammer.The Log-normal shadowing model is an extension to Friis free space Equation (1).
( ) ( ) where ( ) r P d is received signal power at distance d, t P is the transmission's signal power, r G and t G tare the system gain, λ is the wavelength and d is the distance between sender and receiver.The Log-normal model can be presented in the following forms: ( ) ( ) where n is the path loss exponential where there is a change from one environment to another.In an indoor place, the path loss exponential is between 2-3.X σ is zero-mean Gaussian distributed random variable.
( ) where i d is the estimated distance from filtered JRSS.

Linear Prediction
Linear prediction is one way to predict a future value from a series of data [20] [21] [22].In this paper, we use the linear prediction method to estimate jammer Received Signal Strength from a considerable noise caused by a multipath signal and the surrounding environment as follows.

 ( ) [ ]
where n p = is the system order.e is the error from the estimated JRSS, also called a residual signal.
Each boundary node is set to capture a series of JRSS at time N, so our data set contains N number of JRSS.By solving linear algebra for (6), we obtained the order coefficient a as follows.
( ) where X denotes the LP JRSS at time instant N, and Y is the value we want to predict. Figure 3 shows the JRSS filtered by linear prediction with three different boundary nodes, which are located in different positions.The accuracy of the estimated signal is based on how large the noise received by the boundary node, and where it is located.

Centroid Localization Algorithm
Centroid Localization (CL) is used to localize a sensor by averaging all nodes around the target node.The localization error using CL is based on the density and location of jammed nodes [23].If the jammed nodes spread around the target as shown in Figure 1, the estimation position may be near to the original location.However, if most of the jammed nodes located on one side, the estimated position will appear on that side.CL is described as follows: ( ) where N is the number of jammed nodes.

Kalman Filter
The Kalman filter was developed by Rudolf Kalman in 1960.The Kalman filter is ( ) Prediction Computing Kalman gain ( ) Updating filter ( ) where k Z is the jammer's received signal strength received by a boundary node at time k, and ˆk X is the Kalman filter output after k times during the process.
In our case, the observed JRSS at each boundary node is ˆk

Position Calculation
Computing jammer coordinates directly using captured JRSS resulted in the wrong position.In this section, we localize a jammer in three different methods: the Kalman filter, linear prediction, and centroid localization algorithm.To eliminate noise from the JRSS effected by surrounding environment and obstacles in an indoor place, the Kalman filter, and linear prediction come in to play.
Moreover, centroid localization performs a position estimation by averaging all jammed nodes, so the noisy distance is not considered in the computation.
However, CL is sensitive to the jammed nodes positions and a number of jammed nodes.In the following, we estimate the jammer distance by converting the JRSS captured by each node to distance using the Log-Normal Shadowing model (4) as follows: ( ) ( ) where ˆi d is the estimated distance computed at each boundary node i.The Euclidean distance formula ( 19) is used to find the distance between the anchor and target, as shown in Figure 5, Where ( ) x y is the known boundary node posi- tion and ( ) x y is the jammer's unknown location.To locate a target position, we use the Mean Square Error (MSE).The MSE is a mathematical technique to solve linear equations with n unknown variables corresponding to n Equations , 1, 2, ˆ3, , ( ) where the ( ) x y the boundary node location and ( ) x y is the jammer location

Simulation Environment
In our network model, we simulate the effect of the jamming attack in an indoor environment to evaluate the reliability of localizing a jammer in an area of 100 m × 100 m using MATLAB.The network nodes were randomly distributed with a transmission range of 25 m and sensing a range of 15 m.The jammer location was evaluated in a different situation with a transmission range of 30m and randomly placed.We studied and evaluated three different algorithms including the

Results
The mean square error (MSE) was used to evaluate the efficiency of the Kalman filter to locate the jammer in an indoor environment compared to linear prediction and centroid localization algorithms.During the experiment run time, we generated different samples of jammer received signal strength (JRSS) captured by the boundary nodes.The jammer and the nodes are randomly placed in the network.The density of the network nodes differed for each runtime to evaluate the efficiency of localizing the jammer.For the first experiment we analyzed, the network density was set to 50 nodes, the nodes and jammer were deployed randomly, and the jammer's transmission range was 35m.We studied the Kalman filter and linear prediction by increasing the number of input to 50, 100, and 200 samples as shown in Figure 6 case (a), (b), and (c) respectively.In Figure 7, KF significantly decreased the error compared to LP.For example, the mean distance error of boundary node 13 sharply reduced over the period.In case (a), KF  Finally, we analyzed the impact of the jammer localization performance of the algorithms.Figure 8 shows the target coordinates error affected by varying the node density and jammer location.We placed the jammer in three different positions and then decreased the number of the node to 20 sensors.We can see that, because the node density does not contribute to the KF and LP output, the KF performance is better compared to LP.However, CL is based on the number of jammed nodes while the jammer location changed from one place to another.

Conclusion
In this paper, we estimate the jammer position using KF, and we compared its performance with similar algorithms, such as LP and CL.The mean distance error is very small in KF compared to LP.The CL shows better performance than LP when the jammed nodes distributed around the jammer.LP remained steady over the changes in the samples of JRSS, the density of the networks, and the location of the jammer.The KF performed better when the vast samples were taken to KF as an input and can detect the target with high accuracy compared to LP and CL.

Figure 1 .
Figure 1.Network model under a jamming attack.

Figure 3 .
Figure 3. JRSS filtered by LP in three different boundary nodes.
process noise, k R is the covariance of observation noise, k B and k u are the control input, and K is the Kalman filter gain.Because we measure the JRSS of the fixed position jammer, k A become an identity matrix and B and u were set to zero. Figure 4 shows the JRSS captured by three different boundary nodes and filtered by the Kalman filter.Each anchor node was located at a different distance and received the JRSS with varying amounts of noise.W. Aldosari, M. Zohdy DOI: 10.4236/wet.2018.9200327 Wireless Engineering and Technology

Figure 4 .
Figure 4. JRSS filtered by KF in three different boundary nodes.

Figure 5 .
Figure 5. Illustrates distance estimation.There are four boundary nodes, five jammed nodes, and the jammer.The positions of the anchor are known.

Figure 7 .
Figure 7. (x, y) Jammer coordinates error when fixed jammer location and change samples input of KF, LP, and CL to 50, 100 and 200.

Figures 9 (
Figures9(a)-(c) shows the influence of the number and location of jammed nodes on CL.For example, in case (a) three jammed nodes were placed inside the jammer's transmission range, and the location error is significant compared to case (b) and (c).In case (c), 8 jammed nodes contributed in CL algorithms, which gives a high accuracy of detecting the jammer location compared to LP.

Figure 8 .
Figure 8. Illustrates the performance of KL, LP, and CL when jammer location randomly deployed in three different positions, and the density of node is 20 nodes.

Figure 9 .
Figure 9.Estimated jammer position in three different scenarios.
and changed the density of the network nodes, jammer's transmission range and the nodes sensing range.For every experiment, we ran the simulation several times to evaluate the location accuracy affected by surrounding noise and a multipath signal.

Table 1
compares different boundary nodes and the performance of these three algorithms: KF, LP, and CL.Table2shows the estimated location in three techniques and the Mean Squared Error.

Table 1 .
Comparison of JRSS and the estimated distance between KF, LP, and CL with 11 jammed nodes and eight boundary nodes.

Table 2 .
Mean (x, y) coordinates error with 11 jammed nodes and eight boundary nodes.