# A Statistical Approach to Detect Jamming Attacks in Wireless Sensor Networks
## 1 Introduction
Cases of jamming attacks at the network and transport layer have also been reported [5], where malicious packets are injected on certain routes and SNY flooding attacks are directed towards the sensor nodes to consume their resources. Detecting jamming attacks in WSNs has been an ongoing research trend over the past decade as commonly proposed methods rely on dedicated devices or algorithms imbedded within the sensor nodes. These methods often use information obtained a priori about the communication behaviour during normal and jammed condition, which can be tracked using indicators and metrics obtained from different layers [8]. Example of these metrics are the received signal strength obtained at the physical layer and the packet delivery ratio at the application layer. Recently deployed methods have proposed a cross-layer architecture [9] to ease the collection of jamming attack indicators while other proposed methods have combined two or more metrics [10] to significantly improve the detection of jamming attacks. Closely related works have proposed packet inter-arrival time as a metric in WSN to detect jamming attack situations. Wispernet, an anti-jamming technique for WSNs, was proposed in [11] to prevent jammers from predicting the length of activity on the channel and epoch. This ensures that the useful packet inter-arrival distribution cannot be determined and used to pre-empt an attack. Packet inter-arrival time has also been used in [12] to determine the most appropriate distribution at the cluster heads and relay nodes. Additionally, EWMA has also been proposed in the literature to detect the abnormal network traffic during the case of DoS attacks. An adaptive EWMA which uses an adaptive weighing function has been proposed in [13], as opposed to the constant weighting EWMA algorithm, to smoothen accidental errors to retain the exceptional mutation. Threshold-based EWMA has been proposed in [14] for intrusion detection based on their intensity. Most of the past works have used two or more metrics to determine the presence of jamming attacks in WSNs and have also adopted a cooperative/distributed defence deployment approach by deploying the detection system on the ordinary member nodes, cluster heads and base station. This tends to add an extra overhead on an already resource constrained sensor node. Therefore, in this work, we harness the potential of EWMA, a statistical process control technique, to detect the mean shifts in event intensity during jamming attack in WSNs using the packet inter-arrival time (IAT). EWMA monitors and compares the observed packet sequence features against a normal profile obtained a priori to detect when a change has occurred. The choice of EWMA as opposed to other change-point methods is because EWMA combines both current and historical data to detect small and significant changes in time-series that can be detected easily and promptly. More importantly, the deployment of EWMA using packet IAT is lightweight, therefore it is perfectly suited to sensor nodes in WSNs that are characterised by energy constraints. The main contributions of this work are as follows:  
* We present a novel jamming detection scheme by proposing EWMA for auto correlative data that observes the packet IAT which depends on the values that appear prior to or later in a series. * We propose IAT as the sole metric to detect jamming attacks in WSN which reduces the complexity by offering a lightweight technique. * Our proposed technique is a stepwise approach and deployed on the cluster head to detect jamming attacks in the member nodes and in the base station to detect jamming attacks in the cluster heads. The rest of the paper is organised as follows: in Section 2, we present related work while in Section 3, we describe different jamming attack models in WSNs. Section 4 highlights the different possible metrics for detecting jamming attacks in WSNs while in Section 5, we present our proposed application of EWMA to detect DoS jamming attacks in WSNs.