# A Statistical Approach to Detect Jamming Attacks in Wireless Sensor Networks
## 5 EWMA Algorithm  
Jamming attacks in WSNs are perpetrated by malicious nodes in the network, with the aim to disrupt or interfere with the transmission and receipt of legitimate wireless signals among sensor nodes. Jamming attack affect the statistical features (for instance mean and variance) of a packet flow with temporal fluctuations. Statistical process control (SPC), can therefore be used to detect this anomaly by observing series of statistically homogeneous events. SPC has been used over the years for monitoring processes and controlling the quality of manufacturing processes. SPC techniques can detect changes in the process mean, process variance and the relationship between multiple variables, which can be either univariate or multivariate [32], CUSUM control charts, Shewhart control charts and EWMA control charts are examples of univariate SPC techniques which are often used in detecting shifts in mean values. EWMA, which was proposed by [PERSON] [33], is an efficient statistical technique used in detecting small shifts in time-series data. It functions by first defining a threshold that delimits a standard behaviour before periodically handling updates on average of the observed data traffic [34]. EWMA is also characterised with its low complexity because the weighted average only needs to be updated for each newly observed data. The advantage EWMA has over other SPC techniques is that it combines current and historical data in a way that small shifts in time-series can be detected easily and quickly. On the other hand, other control charts such as Shewhart chart only consider the most current observations while neglecting the historical data [35]. EWMA use a weighing constant, lambda (\(\lambda\)), to determine the importance of both current and historical observations and to determine its sensitivity to small or gradual process drift. EWMA can be computed using [14]:  
\[z(t)=\lambda\cdot x(t)+(1-\lambda)\cdot z(t-1)\qquad\qquad t=1,\;2,\;3\ldots n \tag{1}\]where: \(z(t)\) is the mean of the historical data, \(x(t)\) is the observation at time \(t\), \(n\) represents the number of observations to be monitored including \(z(0)\) and \(\lambda\) is the smoothing constant (\(0<\lambda\leq 1\)) that determines the depth of the EWMA. The value of \(\lambda\) is used to determine how well the older data influences the calculation of the EWMA statistics. For instance, when \(\lambda\) has a value of 1, this means that only recent measurements influence the EWMA. Therefore, a large value of \(\lambda=1\) appends more weight to recent observations and older observations get less weight, while a small value of \(\lambda\) gives more weight to older observations [14]. Several values for \(\lambda\) have been suggested by previous authors, however the value of \(\lambda\) is not only dependent on the size of the mean shift, but also on the in-control Average Run Length [14]. Most often, a value less than 0.5 is taken for \(\lambda\), however, using a very small value of \(\lambda\) might result in the algorithm being insensitive to attacks characterized by moderate intensity or having small duration. Therefore, in practice, \(\lambda\) is usually between 0.2 and 0.5. The estimated variance of the EWMA statistic can be approximated using:  
\[\sigma_{z}^{2}=\sigma_{x}^{2}\cdot\left(\frac{\lambda}{2-\lambda}\right) \tag{2}\]  
where \(\sigma\) is the standard deviation obtained from the historical data. The control chart centre line is the target value, therefore the upper control limit (UCL) and lower control limits (LCL) can be determined using the equation below:  
\[UCL_{z}=z_{0}+f\cdot\sigma_{z}\hskip 28.452756 ptLCL_{z}=z_{0}-f\cdot\sigma_{z} \tag{3}\]  
where the factor \(f\) is set to be equal to 3-sigma control limits. The aim of this work is to determine the allowed EWMA values of the traffic in WSN which when exceeded are considered as a statistical anomaly thus signifying the presence of a jamming attack.