# A Statistical Approach to Detect Jamming Attacks in Wireless Sensor Networks
## 6 Simulation and Results  
In this section, we simulate the jamming attack, a physical and MAC layer DoS attack that emits electromagnetic radiation into the communication channel to reduce the effective use of spectrum for legitimate transmission. The consequence of this is the indiscriminate consumption of resources and draining of the battery life of legitimate sensor nodes in WSN. For our simulation, we use the Community Resource for Archiving Wireless Data at Dartmouth \"CRAWDAD\" jamming attack dataset [36], which is made up of different jamming attacks obtained from a rural area located around Aachen in Germany. The CRAWDAD dataset is made up of constant jammers that vary in distance and attenuation, periodic jammers with varying attenuation, reactive jammers and cases of no jamming. The dataset consists of attributes such as node ID, source node ID, distance, time, packet size, transmit power, and received signal strength indicator. The behavioural pattern of jamming attack can be determined by studying the IAT attribute of packets in a traffic flow. The cluster head monitors the member nodes in its cluster. To achieve this, the member nodes send information sensed to the cluster head. The cluster head in turn measures the IAT of the packet received before profiling a normal pattern during the non-jamming attack period. In a similar vein, the cluster heads send aggregated data to the base station and the base station measures the packet IAT metric to generate a normal profile during the non-jamming period. During the jamming attack period, our proposed EWMA algorithm is used to detect the jamming attacks in WSNs. We conduct experiments using packets of the non-jamming profile and jamming profiles for three different jamming attacks, namely; constant jamming, periodic jamming and reactive jamming. To analyse our work, we use the analyse-it tool [37]. For our trace simulation for constant jamming, we have used a jammer located 30 m from the target node to test the efficiency of our proposed algorithm. Table 1 shows the values of the out-of-control signals, process parameter and the process control statistics. Figure 3 shows the EWMA plot of the IAT metric against the packet number using 20 non-jamming packets and 20 packets of constant jamming attacks. Figure 2: EWMA DoS jamming detection framework in WSN. From Figure 3, it can be observed that our proposed method detects the jamming attack on the 21 st packet, which is the start point of our simulated constant jamming attack traffic. Similarly, for a periodic jamming attack at 20 dB attenuation for 50 non-jamming attack packets and 50 periodic jamming attacks, we test the efficiency of our proposed algorithm as shown in Figure 4.  
From the graph of EMWA of the packet IAT against the packet number in Figure 4, it can be seen that there was a drift in the IAT sequence during the start of the jamming attack on the 51 st packet. This shows that our proposed algorithm detects the change, thus tracking the periodic jamming attack. For reactive jamming attack, we use 50 packets for the non-jamming attacks and 50 packets for reactive jamming. Our algorithm has detected a shift in the traffic pattern during the jamming attack on packet number 51 which is the starting point of our simulated reactive jamming attack as shown in Figure 5 of the EWMA plot for IAT against packet number. The shift detected exceeded the \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Jamming Attacks**} & \multicolumn{3}{c}{\(n\)} & \multirow{2}{*}{**Mean**} & \multirow{2}{*}{**\(\sigma\)**} & \multirow{2}{*}{**Detection Point (pck no)**} \\ \cline{2-2} \cline{5-7}  & **Jamming** & & & & & \\ \hline Constant & 20 & 20 & 0.2 & 0.0538 & 0.021 & 21 st \\ Periodic & 50 & 50 & 0.2 & 0.0039 & 0.0129 & 51 st \\ Reactive & 50 & 50 & 0.2 & 0.00313 & 0.0128 & 51 st \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Detection parameters for different jamming attacks. Figure 4: EWMA plot of the IAT metric against packet number for periodic jamming attack.