# A Statistical Approach to Detect Jamming Attacks in Wireless Sensor Networks
## 1 Introduction  
WSNs in recent times have expanded their range of applications from their initial deployment for battlefield intelligence surveillance to areas such as emergency response support, meteorological weather forecasting, security applications and factory automation, just to mention a few. WSNs consists of small and inexpensive sensor nodes without an existing infrastructure. They are often used to sense, process, transmit and receive information from the area they are deployed before it is conveyed to a base station. A typical WSN consists of hundreds to thousands of sensor nodes which can be categorized according to their structure (topology) and the environment in which they are deployed. Structurally, WSNs can be categorized according to the placement of the sensor nodes in the deployed environment [1]. These nodes can be of equal capacity, while others have varying capacity, depending on the architecture. The three main types of WSN structure are flat-based (tree), cluster-based and hierarchical [2]. Furthermore, the environments where the sensor nodes are deployed in a WSN can be grouped into five classes, namely: underground WSNs, terrestrial WSNs, underwater WSNs, multi-media WSNs and mobile WSNs [3]. The sensor nodes in a WSN are often deployed in remote, harsh and inaccessible areas and are often characterized by their resource constraints such as limited power, limited storage, limited bandwidth and short communication range. These, coupled with the vulnerability of the wireless medium (i.e., open and shared) have made sensor nodes susceptible to different security attacks suchas the denial of service (DoS). A recent case of DoS attack on DYN, a major DNS provider, was reported on the 21 st of October 2016 [4]. The Dyn DDoS attack was orchestrated by a botnet known as Mirai malware, which infected around 100,000 malicious terminal nodes and were mostly internet of things (IoT) devices. Experts have identified this distributed form of DoS as the most catastrophic DoS attack so far, with a magnitude in the range of 1.2 Tbps. Jamming attacks are a form of DoS attack where an adversary transmits a high-range signal to disrupt communication. Generally, jamming can occur unintentionally in a wireless medium through situations such as noise, interference and collision [5], however, a jamming attack in a WSN is a deliberate attempt by an adversary to interfere with the physical transmission of signals during a communication process. The main aim of a DoS attack is to direct malicious signals towards the sensor nodes' communication channels to deplete their resources such as the battery life, bandwidth, and storage in order to prevent transmitted sensor data from reaching its destination, thereby affecting its long-term availability [6]. A jamming attack in a WSN is catastrophic as it does not require any special hardware device or software to be perpetrated [5]. It can be carried out by passively listening to the wireless medium in order to broadcast on the same frequency band as that of the legitimate transmitting signal. A typical jamming attack is characterized by high energy efficiency, low detection probability, and anti-jamming resistance [7]. In WSNs, the physical layer and the MAC layer are the common targets of DoS jamming attacks. In the physical layer jamming attack, an adversary with a high transmission power signal can jam the communication medium, as most WSN deployments operate on a single frequency. Most traditional defence techniques rely on using a spread spectrum to mitigate physical layer jamming attacks. This technique is resource intensive and does not directly fit in WSNs due to the energy constraints of the sensor nodes. The access layer jamming attack, on the other hand, is perpetrated by either corrupting the control packets or deliberately reserving the communication channel for a maximum allowable number of slots, to ensure other nodes experience a lower throughput as a result of not being able to access the communication channel.