# Estimating the Relative Speed of RF Jammers in VANETs

Authors: Dimitrios Kosmanos; Antonios Argyriou; Leandros Maglaras
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Vehicular Ad Hoc Networks (VANETs) aim at enhancing road safety and providing a comfortable driving environment by delivering early warning and infotainment messages to the drivers. Jamming attacks, however, pose a significant threat to their performance. In this paper, we propose a novel Relative Speed Estimation Algorithm (RSEA) of a moving vehicle that approaches a transmitter (Tx)-receiver (Rx) pair that interferes with their radio frequency (RF) communication by conducting a denial of service (DoS) attack. Our scheme is completely passive and uses a pilot-based received signal without hardware or computational cost to, firstly, estimate the combined channel between the transmitter-receiver and jammer-receiver and, secondly, to estimate the jamming signal and the relative speed between the jammer-receiver using the RF Doppler shift. Moreover, the relative speed metric exploits the angle of projection (AOP) of the speed vector of the jammer in the axis of its motion in order to form a two-dimensional representation of the geographical area. Our approach can effectively be applied for any form of the jamming signal and is proven to have quite accurate performance, with a mean absolute error (MAE) value of approximately 10% compared to the optimal zero MAE value under different jamming attack scenarios.


---

## Body

## 1. Introduction

Autonomous vehicles, capable of navigating in unpredictable real-world environments with little human feedback, are a reality today [1]. Autonomous vehicle control imposes very strict security requirements on the wireless communication channels that are used by a fleet of vehicles [2]. This is necessary in order to ensure reliable connectivity [3]. Moreover, the Intelligent Vehicle Grid technology, introduced in [4], allows the car to become a formidable sensor platform, absorbing information from the environment, other cars, or the driver and feed it to other vehicles and infrastructure so as to assist in safe navigation, pollution control, and traffic management. The vehicle grid essentially becomes an Internet of Things (IoT) for vehicles, namely, the Internet of Vehicles (IoV) that is capable of making its own decisions when driving customers to their destinations [5].The connected autonomous vehicles (CAVs) that use the wireless vehicle-to-vehicle (V2V) communication have become essential for the operation of a modern vehicle [6]. Wireless communications, however, are vulnerable to a wide range of attacks [7, 8]. An RF jamming attack consists of radio signals maliciously emitted to disrupt legitimate communications. Jamming attacks are a big threat to any type of wireless network. With the rise in safety-critical vehicular wireless applications, this is likely to become a constraining issue for their deployment in the future. A subcategory of jamming attacks is the denial of service (DoS) attacks, which are targeting the availability of network services. Of special interest are the mobile jammers, which impose an added strain on vehicular networks (VANETs). The accurate prediction of the behavior of the jammer such as its speed becomes critical for providing a swift reaction to an attack.In this work, we propose a novel metric that captures the relative speed between the jammer (Jx) and the receiver (Rx). We also propose the Relative Speed Estimation Algorithm (RSEA) that is a completely passive estimation method that uses pilot-based received signals at the receiver to, firstly, estimate the channel between the transmitter-receiver and jammer-receiver and, secondly, the jamming signal and thirdly, to estimate the relative speed between the jammer-receiver using the RF Doppler shift properly. This is the first work in the literature, according to our knowledge, that proposes an algorithm for speed estimation of malicious RF jammers.


### 1.1. Problem Statement

In addition to RF jamming, wireless communication between a transmitter (Tx) and a receiver can be impaired by unintentional interference and multiple access control (MAC) protocol collisions. Jammers can exhibit arbitrary behavior in order to disrupt and thwart communication with a form of DoS attack [9]. In the general case, RF jamming reduces the receiver signal to interference and noise ratio (SINR), a problem that can be addressed with classic communication algorithms. However, in several applications, it is critical to detect accurately the presence of a jammer, i.e., the precise reason behind the reduction in SINR, the packet delivery ratio (PDR), and more importantly, the nature of the attack. Consequently, it is difficult to determine whether the reason for the SINR reduction is an intentional jamming attack or unintentional interference. The challenge in detecting an RF jamming attack is that the information that is available for the jammer is typically minimal and it can be derived from the useful signal possibly mixed with other types of arbitrary interference in the area. By estimating the relative speed between a legitimate vehicle and a jammer, we can conclude if a high interference scenario has been provoked intentionally with the form of a DoS attack by an attacker that approaches the victim or has been provoked unintentionally by an area with significant RF interference. Specifically, if the estimated relative speed metric is around zero, we can infer that the jammer is moving at the same speed with the receiver. On the other hand, if the estimated relative speed has a high value, we can conclude that the jammer is moving at a quite different speed than that of the receiver. Of particular interest is the higher level behavior of a jammer, like its motion/movement relative to the Tx-Rx pair.


### 1.2. Our Solution

Using the jamming signal at the receiver, we estimate the relative speed metric (Δu) that is based on the difference or sum between the velocities of the jammer and the receiver. This passively estimated metric also includes information regarding the angle of projection (AOP) of the jammed signal. Our scheme uses only the signal at the receiver under the presence of a jammer to characterize the behavior/motion of the jammer (if the Jx is approaching or moving away from the Rx) using the RF Doppler shift. We also adopt a pilot-based method for the channel estimation between Tx-Rx since it is suitable for fast varying channels, like VANETs, because the channel is directly estimated by training symbols or the pilot tone that are known a priori to the receiver.The contributions of the paper are threefold:(i)
A completely passive pilot-based scheme is proposed that is based on RF communication betweenTx-Rx being interfered by a jammer in the area. However, we do not apply the proposed RSEA for estimating only the speed of the Tx [10]. We try from this point-to-point communication to gather as much information as possible regarding jammer’s behavior, such as all the combined multipath channels among Tx,Rx,Jx, jammer’s relative speed value, and the jamming signal.(ii)
In addition, the proposed relative speed metric uses novel physical location features because it includes the AOP of the jammer.(iii)
The effective usage of the estimated relative speed for a future jamming detection algorithm is outlined.It has to be highlighted that the proposed RSEA can also be applied to any form of the jamming signal.The rest of this paper is organized as follows. Section2 presents the related work, whilst Section 3 analyzes the network topology, the system model analysis, and the wireless channel model. Section 4 presents the location-aware relative speed metric, and Section 5 analytically describes the proposed RSEA. Section 6 presents the experimental evaluation of the proposed RSEA and provides comparison between different scenarios. Section 7 justifies the experimental behavior of the proposed relative speed metric and describes real applications that the metric can be used. Finally, Section 8 concludes the paper and gives some directions for future work.


## 1.1. Problem Statement

In addition to RF jamming, wireless communication between a transmitter (Tx) and a receiver can be impaired by unintentional interference and multiple access control (MAC) protocol collisions. Jammers can exhibit arbitrary behavior in order to disrupt and thwart communication with a form of DoS attack [9]. In the general case, RF jamming reduces the receiver signal to interference and noise ratio (SINR), a problem that can be addressed with classic communication algorithms. However, in several applications, it is critical to detect accurately the presence of a jammer, i.e., the precise reason behind the reduction in SINR, the packet delivery ratio (PDR), and more importantly, the nature of the attack. Consequently, it is difficult to determine whether the reason for the SINR reduction is an intentional jamming attack or unintentional interference. The challenge in detecting an RF jamming attack is that the information that is available for the jammer is typically minimal and it can be derived from the useful signal possibly mixed with other types of arbitrary interference in the area. By estimating the relative speed between a legitimate vehicle and a jammer, we can conclude if a high interference scenario has been provoked intentionally with the form of a DoS attack by an attacker that approaches the victim or has been provoked unintentionally by an area with significant RF interference. Specifically, if the estimated relative speed metric is around zero, we can infer that the jammer is moving at the same speed with the receiver. On the other hand, if the estimated relative speed has a high value, we can conclude that the jammer is moving at a quite different speed than that of the receiver. Of particular interest is the higher level behavior of a jammer, like its motion/movement relative to the Tx-Rx pair.


## 1.2. Our Solution

Using the jamming signal at the receiver, we estimate the relative speed metric (Δu) that is based on the difference or sum between the velocities of the jammer and the receiver. This passively estimated metric also includes information regarding the angle of projection (AOP) of the jammed signal. Our scheme uses only the signal at the receiver under the presence of a jammer to characterize the behavior/motion of the jammer (if the Jx is approaching or moving away from the Rx) using the RF Doppler shift. We also adopt a pilot-based method for the channel estimation between Tx-Rx since it is suitable for fast varying channels, like VANETs, because the channel is directly estimated by training symbols or the pilot tone that are known a priori to the receiver.The contributions of the paper are threefold:(i)
A completely passive pilot-based scheme is proposed that is based on RF communication betweenTx-Rx being interfered by a jammer in the area. However, we do not apply the proposed RSEA for estimating only the speed of the Tx [10]. We try from this point-to-point communication to gather as much information as possible regarding jammer’s behavior, such as all the combined multipath channels among Tx,Rx,Jx, jammer’s relative speed value, and the jamming signal.(ii)
In addition, the proposed relative speed metric uses novel physical location features because it includes the AOP of the jammer.(iii)
The effective usage of the estimated relative speed for a future jamming detection algorithm is outlined.It has to be highlighted that the proposed RSEA can also be applied to any form of the jamming signal.The rest of this paper is organized as follows. Section2 presents the related work, whilst Section 3 analyzes the network topology, the system model analysis, and the wireless channel model. Section 4 presents the location-aware relative speed metric, and Section 5 analytically describes the proposed RSEA. Section 6 presents the experimental evaluation of the proposed RSEA and provides comparison between different scenarios. Section 7 justifies the experimental behavior of the proposed relative speed metric and describes real applications that the metric can be used. Finally, Section 8 concludes the paper and gives some directions for future work.


## 2. Related Work

### 2.1. RF Jamming

RF jamming has been extensively studied in the context of classical 802.11 networks without accounting for the particularities of car-to-car communications. Besides the differences in PHY design of 802.11p compared to other 802.11 amendments, the propagation conditions of VANETs are fundamentally different due to the highly dispersive and rapidly changing vehicular environment. A lot of different jamming attacks have been studied in VANETs [11]. The two most important categories of jamming attacks are the constant jamming and the reactive jamming. Constant jamming transmits randomly generated data on the channel without checking the state of the channel (idle or not). The reactive jamming happens only when the attacker senses activity on the channel. In [12], the authors observe that constant, periodic, but also reactive RF jammer can hinder communication over large propagation areas, which would threaten road safety. Reactive jamming attacks reach a high jamming efficiency and can even improve the energy efficiency of the jammer in several application scenarios [13, 14]. Also, they can easily and efficiently be implemented on commercially available off-the-shelf (COTS) hardware such as USRP radios [15–17]. But, more importantly, reactive jamming attacks are harder to detect due to the attack model, which allows the jamming signal to be hidden behind transmission activities performed by legitimate users [16, 18, 19].A different category of attacks is the pilot-based attacks against OFDM and OFDMA signals [20]. These attacks seek to manipulate information used by the equalization algorithm to cause errors to a significant number of symbols. However, we do not evaluate this type of attack because the point of interest of this paper is the DoS attacks that are targeting the availability and not the integrity of packets. In order to be robust against pilot tone jamming attacks, OFDM and OFDMA systems must randomize their subcarrier locations and values. For the mitigation of this type of RF jamming attacks, optimal power allocation with user scheduling techniques is proposed [21], utilizing also the technique of uncoordinated frequency hopping (UFH) [22]. UFH implies the communication between transmitter and receiver through a randomly chosen frequency channel unknown for both agents. In [23], the authors highlight the secrecy level of wireless networks under UFH, showing the harmful security effect of broadband eavesdropper adversaries capable of overhearing in multiple frequencies. In order to stop such eavesdroppers, the authors propose the use of broadband friendly jammers that cause interference on eavesdroppers. The goal is to cause as much interference as possible to eavesdroppers that are located in unknown positions, while limiting the interference observed by the legitimate receiver. The information about the location and speed of friendly jammers is crucial for the above UHF schemes.The effects of RF jamming can be alleviated using cooperative relaying schemes to where the vehicles outside of the jamming area serve as relays to help forward the received control channel signal to the victim vehicles through another jamming-free service channel [24]. However, the jamming scenarios that are used in this paper are limited since the location of the jammer is assumed to be known in advance (either being an RSU or a moving node). The antijamming V2V communication in CAV networks through power selection in conjunction with channel selection is analyzed in [25]. Specifically, a brain-inspired cognitive dynamic system (CDS) is applied to study V2V communications, and the general structure of cognitive risk control (CRC) is tailored to analyze and address the jamming problem in CAV networks. After that, the power control is carried out first using the reinforcement learning method, the result of which is then examined by the task-switch control. However, the mobility of vehicles and the vehicle speeds are not considered in the channel model and the complicity of the proposed method is questionable too. By analyzing these articles, we can conclude that the jammer’s speed is a crucial metric for all the techniques that try to address the jamming problem in RF communications in VANETs.


### 2.2. Localization

A lot of work has covered matters of localization, which is a fundamental challenge for any wireless network of nodes, in particular when nodes are mobile. In [26], the relative positions and velocities (PVs) are estimated up to a rotation and translation of an anchor-less mobile network, given two-way communication capability between all the nodes. A least-squares-based dynamic ranging algorithm is proposed, which employs a classical Taylor series-based approximation to estimate pairwise distance derivatives efficiently without the usage of Doppler shifts. However, this approach requires the existence of a cluster of nodes with predefined initial locations. On the contrary, the proposed RSEA algorithm does not require any initial information for the location of vehicles. In [27], the authors propose a dual-level travel speed calculation model, which is established under different levels of sample sizes. Wireless sensor networks (WSNs) are widely used to maintain the location information and rely on the tracking service only when their location changes. In the proposed approach in [28], the problem of tracking cooperative mobile nodes in wireless sensor networks is addressed with the calculation of Doppler shifts of the transmitting signal in combination with a Kalman filter (by performing a constrained least-squares optimization when a maneuver is detected). In [29], the authors suggest a method for joint estimation of the speed of a vehicle and its distance to a roadside unit (RSU) for narrowband orthogonal frequency-division multiplexing (OFDM) communication systems. Spatial filtering and a maximum-likelihood (ML) algorithm are developed for distance estimation. The vehicle speed is calculated using a kinematics model based on the estimated distance and angle of arrival (AOA) values. Comparing the aforementioned methods with our proposed speed estimation method, it is obvious that the RSEA is applicable to a VANET without any extra infrastructure such as WSNs or complex calculations like Kalman filters and without the need for deployment of RSUs for traffic recording. The localization of a smart jammer that is trying to hide his precise location has proved to be a difficult issue for the majority of the aforementioned works since position verification models are susceptible to statistical errors. The survey paper [30] notes the need for applying data fusion at the PHY layer of the 802.11p protocol of wireless access in vehicular environment (WAVE) signals with upper layers for a vehicle positioning, a method that our scheme is using.


### 2.3. Speed Estimation

Another group of papers proposes speed estimation systems that alert drivers about driving conditions and help them avoid joining traffic jams using multiclass classifiers. ReVISE in [31] proposes a multiclass SVM approach that uses features from the RF signal. The proposed experimental testbed must be established in a specific part of the road and is completed by two stable access points and two monitor points. However, it is doubtful whether it can be applied to a scenario with more than one vehicle in the specific area such as the scenario we are considering. Using a similar method, MUSIC [32] is a subspace-based AOA estimation algorithm that exploits the eigenstructure of the covariance matrix of the received signals on a multisignal classifier using a uniform circular array (UCA) antenna as extra hardware.Covariance-based speed estimation schemes have also been used for the estimation of the maximum Doppler spread, or equivalently the vehicle velocity that is useful for improving the performance of handoff algorithms [33]. Specifically, the authors in [33] propose a velocity estimator based on spectral moments of in-phase and the quadrature-phase component or the squared envelope of the received signal. The proposed method has the least sample variance as compared to other covariance-based methods. However, all the covariance-based speed estimators do not assume shadowing in the channel model and the improvement of their performance comes at expense of more computational complexity and therefore an added delay in computation time. Such models are not easily applicable to a frequently changed V2V wireless channel with many vehicles and obstacles where a lot of shadowing and scattering effects exist. Only the authors in [10] propose a velocity estimator that uses the statistics of the instantaneous frequency (IF) of the received signal to estimate the velocity and takes also into account the distribution of the scattered component of the received signal and is also robust to path loss and shadowing. The only restrictive assumption of this method for being applied in a VANET environment is that, in order to estimate the velocity, prior estimation of directivity parameter of the incoming waves is needed. The authors in [34] proposed an algorithm that employs a modified normalized autocovariance of received signal power to estimate the speed of mobile nodes. The simulation results indicate that this algorithm is reliable to estimate the mobile speed with corresponding maximum Doppler shift up to 500 Hz. However, a great challenge of fast-moving communications such as V2V is the high Doppler shifts due to the relative motion between communicating vehicles.In [35], an algorithm that estimates the speed of a mobile phone by matching time-series signal strength data to a known signal strength trace from the same road is introduced. The drawback of the correlation algorithm is the observation that the signal strength profiles along roads remain relatively stable over time, which is not so realistic for a VANET. Although the results are more accurate than previous techniques that are based on handoffs or phone localization, this method requires the travelers to have their mobile phones open during their travel. This is a limiting factor for a smart jammer, who has its phone inactive to remain undetected, in comparison with our proposed speed estimation method that can detect smart jammers. In [36], a method for the estimation of speed for mobile phone users using known WiFi signal-to-noise ratio (SNR) data from the past and time-domain features like mean, maximum, and autocorrelation is proposed. However, in a frequently changing environment such as a V2V channel, it is almost impossible that the SNR values remain constant. For this reason, the proposed RSEA algorithm does not require any training data about SNR or other PHY layer data, whilst in [37], two novel autocorrelation- (ACF-) based velocity estimators are used, without requiring knowledge of the SNR of the link. The drawback of both speed estimation techniques is that there is some dependence of velocity on estimator performance and there is also a limit to the velocity up to 185km/h. On the contrary, our proposed speed estimation method can estimate quite large relative speeds without any speed limit.In all the prior works, speed estimators that have been proposed include training procedures in order to estimate traffic congestion or other transportation performance metrics using sensor measurements. However, the speed estimation problem from a security perspective has been not widely investigated. Only, in [38], the authors try to estimate the AOA of the specular line of sight (LOS) component of signal received from a given single antenna transmitter using a predefined training sequence. The results show the optimality of the training-based ML-AOA estimator in the case of a randomly generated jamming signal. However, the drawback of this ML-AOA estimator is that this superior performance is subject to the availability of a perfect CSI and the knowledge of jammer’s strategy which is unlikely in a realistic system. Finally, the authors in [39] introduced a new algorithm to estimate the mobile terminal speed at base station (BS) in cellular networks. This helps BS in estimating the channel Doppler shift, using measured received signals at the BS. The performance of the proposed algorithm is modeled in a Terrestrial Trunked Radio (TETRA) network, and the simulation has shown acceptable results for a wide range of velocities and jammers. However, using this algorithm, the estimated Doppler shift depends on the carrier frequency which is much smaller in a cellular network (i.e., 396 MHz) compared to a VANET (i.e., 5.9 GHz). In contrast, in the speed estimation approached by this paper, the carrier frequency of a VANET is used without any impact on the performance of the speed estimation procedure.Recently, extensive works present video-based speed estimation techniques using a single camera [40, 41]. Furthermore, speed estimation techniques are used by applications for traffic counting that are based on wireless magnetic sensor networks (WMSNs). The authors in [42] propose a system for traffic speed estimation which can effectively eliminate the geomagnetic background interference. A morphological filter is designed for removing the interference and extracting the magnetic signatures of vehicles. However, all the aforementioned works require specific infrastructure or sensor such as camera, RAdio Detection And Ranging (RADAR), Light Detection And Ranging (LIDAR), magnetic sensors, and Visible Light Detection and Ranging (ViLDAR) that built upon sensing visible light variation of the vehicle’s headlamp [43]. All these sensors have a pretty high cost. In contrast, our proposed method of speed estimation uses only the wireless signal at the Rx for the estimation of the relative speed metric Δu between Jx and Rx without any need for extra infrastructure. Last, a recent research [44] explores a novel technique which could estimate the speed of a vehicle by analyzing its influence on surrounding wireless signals from roadside wireless infrastructures, such as WiFi. To achieve this goal, in this paper, it is proposed and formulated a model to characterize the relationship between the phase and amplitude measurements and the vehicle speed. Based on the model, a method is developed that can detect the vehicle and estimate its speed accordingly using the frequency domain information involved in the spectrogram. However, this model estimates vehicle’s speed by analyzing the influence of the vehicle on surrounding wireless signals using two static roadside WiFi devices. In contrast, our proposed method estimates the relative speed between two moving vehicles that can be assumed as transmitter and receiver that interchange pilot signals using the V2V wireless communication without the need of any additional infrastructure.The great majority of the works have used covariance-based speed estimators. Some of them do not take into account the shadowing effect of VANETs, others need initially sampling of the SNR links for a training procedure, and last some need perfect knowledge about the directivity of transmitted waves in order to estimate the receiver’s speed improving handover algorithms between transmitter and receiver under a typical microcellular system. However, this type of network is assumed to be relatively stable in contrast to a VANET where the V2V channel yields more rapid and more severe fading than cellular networks. All the remaining state-of-the-art papers for speed estimation use extra hardware infrastructure, WSNs, or RSUs for traffic recording and therefore for position or speed verification. Moreover, the speed estimation approaches that use RSUs are not applicable for estimating the speed of a jammer as indication of jamming in the area because a smart jammer may change its travel behavior (i.e., speed and direction) in order to look like a legitimate vehicle and remain undetected. Our proposed technique is the first in the literature, to the best of our knowledge, that uses only the unicast communication between two moving vehiclesTx and Rx for the prediction of the jammer’s speed and for future detection of a jamming attack without any initial knowledge about the location of vehicles or the channel conditions. Our method uses this point-to-point communication between Tx-Rx to gather as much information as possible regarding jammer’s behavior, such as all the combined multipath channels among Tx,Rx,Jx, jammer’s relative speed value, and jamming signal. The proposed system is dynamic and can be applied to any road topology for the jammer’s speed estimation. Moreover, there has been no prior work that combines a feature of the physical location, except of the AOA at the receiver, such as the AOP of the Jx with its speed, in order to estimate relative speeds of two moving vehicles (jammer-receiver) during a jamming attack, using the channel Doppler shift value.


## 2.1. RF Jamming

RF jamming has been extensively studied in the context of classical 802.11 networks without accounting for the particularities of car-to-car communications. Besides the differences in PHY design of 802.11p compared to other 802.11 amendments, the propagation conditions of VANETs are fundamentally different due to the highly dispersive and rapidly changing vehicular environment. A lot of different jamming attacks have been studied in VANETs [11]. The two most important categories of jamming attacks are the constant jamming and the reactive jamming. Constant jamming transmits randomly generated data on the channel without checking the state of the channel (idle or not). The reactive jamming happens only when the attacker senses activity on the channel. In [12], the authors observe that constant, periodic, but also reactive RF jammer can hinder communication over large propagation areas, which would threaten road safety. Reactive jamming attacks reach a high jamming efficiency and can even improve the energy efficiency of the jammer in several application scenarios [13, 14]. Also, they can easily and efficiently be implemented on commercially available off-the-shelf (COTS) hardware such as USRP radios [15–17]. But, more importantly, reactive jamming attacks are harder to detect due to the attack model, which allows the jamming signal to be hidden behind transmission activities performed by legitimate users [16, 18, 19].A different category of attacks is the pilot-based attacks against OFDM and OFDMA signals [20]. These attacks seek to manipulate information used by the equalization algorithm to cause errors to a significant number of symbols. However, we do not evaluate this type of attack because the point of interest of this paper is the DoS attacks that are targeting the availability and not the integrity of packets. In order to be robust against pilot tone jamming attacks, OFDM and OFDMA systems must randomize their subcarrier locations and values. For the mitigation of this type of RF jamming attacks, optimal power allocation with user scheduling techniques is proposed [21], utilizing also the technique of uncoordinated frequency hopping (UFH) [22]. UFH implies the communication between transmitter and receiver through a randomly chosen frequency channel unknown for both agents. In [23], the authors highlight the secrecy level of wireless networks under UFH, showing the harmful security effect of broadband eavesdropper adversaries capable of overhearing in multiple frequencies. In order to stop such eavesdroppers, the authors propose the use of broadband friendly jammers that cause interference on eavesdroppers. The goal is to cause as much interference as possible to eavesdroppers that are located in unknown positions, while limiting the interference observed by the legitimate receiver. The information about the location and speed of friendly jammers is crucial for the above UHF schemes.The effects of RF jamming can be alleviated using cooperative relaying schemes to where the vehicles outside of the jamming area serve as relays to help forward the received control channel signal to the victim vehicles through another jamming-free service channel [24]. However, the jamming scenarios that are used in this paper are limited since the location of the jammer is assumed to be known in advance (either being an RSU or a moving node). The antijamming V2V communication in CAV networks through power selection in conjunction with channel selection is analyzed in [25]. Specifically, a brain-inspired cognitive dynamic system (CDS) is applied to study V2V communications, and the general structure of cognitive risk control (CRC) is tailored to analyze and address the jamming problem in CAV networks. After that, the power control is carried out first using the reinforcement learning method, the result of which is then examined by the task-switch control. However, the mobility of vehicles and the vehicle speeds are not considered in the channel model and the complicity of the proposed method is questionable too. By analyzing these articles, we can conclude that the jammer’s speed is a crucial metric for all the techniques that try to address the jamming problem in RF communications in VANETs.


## 2.2. Localization

A lot of work has covered matters of localization, which is a fundamental challenge for any wireless network of nodes, in particular when nodes are mobile. In [26], the relative positions and velocities (PVs) are estimated up to a rotation and translation of an anchor-less mobile network, given two-way communication capability between all the nodes. A least-squares-based dynamic ranging algorithm is proposed, which employs a classical Taylor series-based approximation to estimate pairwise distance derivatives efficiently without the usage of Doppler shifts. However, this approach requires the existence of a cluster of nodes with predefined initial locations. On the contrary, the proposed RSEA algorithm does not require any initial information for the location of vehicles. In [27], the authors propose a dual-level travel speed calculation model, which is established under different levels of sample sizes. Wireless sensor networks (WSNs) are widely used to maintain the location information and rely on the tracking service only when their location changes. In the proposed approach in [28], the problem of tracking cooperative mobile nodes in wireless sensor networks is addressed with the calculation of Doppler shifts of the transmitting signal in combination with a Kalman filter (by performing a constrained least-squares optimization when a maneuver is detected). In [29], the authors suggest a method for joint estimation of the speed of a vehicle and its distance to a roadside unit (RSU) for narrowband orthogonal frequency-division multiplexing (OFDM) communication systems. Spatial filtering and a maximum-likelihood (ML) algorithm are developed for distance estimation. The vehicle speed is calculated using a kinematics model based on the estimated distance and angle of arrival (AOA) values. Comparing the aforementioned methods with our proposed speed estimation method, it is obvious that the RSEA is applicable to a VANET without any extra infrastructure such as WSNs or complex calculations like Kalman filters and without the need for deployment of RSUs for traffic recording. The localization of a smart jammer that is trying to hide his precise location has proved to be a difficult issue for the majority of the aforementioned works since position verification models are susceptible to statistical errors. The survey paper [30] notes the need for applying data fusion at the PHY layer of the 802.11p protocol of wireless access in vehicular environment (WAVE) signals with upper layers for a vehicle positioning, a method that our scheme is using.


## 2.3. Speed Estimation

Another group of papers proposes speed estimation systems that alert drivers about driving conditions and help them avoid joining traffic jams using multiclass classifiers. ReVISE in [31] proposes a multiclass SVM approach that uses features from the RF signal. The proposed experimental testbed must be established in a specific part of the road and is completed by two stable access points and two monitor points. However, it is doubtful whether it can be applied to a scenario with more than one vehicle in the specific area such as the scenario we are considering. Using a similar method, MUSIC [32] is a subspace-based AOA estimation algorithm that exploits the eigenstructure of the covariance matrix of the received signals on a multisignal classifier using a uniform circular array (UCA) antenna as extra hardware.Covariance-based speed estimation schemes have also been used for the estimation of the maximum Doppler spread, or equivalently the vehicle velocity that is useful for improving the performance of handoff algorithms [33]. Specifically, the authors in [33] propose a velocity estimator based on spectral moments of in-phase and the quadrature-phase component or the squared envelope of the received signal. The proposed method has the least sample variance as compared to other covariance-based methods. However, all the covariance-based speed estimators do not assume shadowing in the channel model and the improvement of their performance comes at expense of more computational complexity and therefore an added delay in computation time. Such models are not easily applicable to a frequently changed V2V wireless channel with many vehicles and obstacles where a lot of shadowing and scattering effects exist. Only the authors in [10] propose a velocity estimator that uses the statistics of the instantaneous frequency (IF) of the received signal to estimate the velocity and takes also into account the distribution of the scattered component of the received signal and is also robust to path loss and shadowing. The only restrictive assumption of this method for being applied in a VANET environment is that, in order to estimate the velocity, prior estimation of directivity parameter of the incoming waves is needed. The authors in [34] proposed an algorithm that employs a modified normalized autocovariance of received signal power to estimate the speed of mobile nodes. The simulation results indicate that this algorithm is reliable to estimate the mobile speed with corresponding maximum Doppler shift up to 500 Hz. However, a great challenge of fast-moving communications such as V2V is the high Doppler shifts due to the relative motion between communicating vehicles.In [35], an algorithm that estimates the speed of a mobile phone by matching time-series signal strength data to a known signal strength trace from the same road is introduced. The drawback of the correlation algorithm is the observation that the signal strength profiles along roads remain relatively stable over time, which is not so realistic for a VANET. Although the results are more accurate than previous techniques that are based on handoffs or phone localization, this method requires the travelers to have their mobile phones open during their travel. This is a limiting factor for a smart jammer, who has its phone inactive to remain undetected, in comparison with our proposed speed estimation method that can detect smart jammers. In [36], a method for the estimation of speed for mobile phone users using known WiFi signal-to-noise ratio (SNR) data from the past and time-domain features like mean, maximum, and autocorrelation is proposed. However, in a frequently changing environment such as a V2V channel, it is almost impossible that the SNR values remain constant. For this reason, the proposed RSEA algorithm does not require any training data about SNR or other PHY layer data, whilst in [37], two novel autocorrelation- (ACF-) based velocity estimators are used, without requiring knowledge of the SNR of the link. The drawback of both speed estimation techniques is that there is some dependence of velocity on estimator performance and there is also a limit to the velocity up to 185km/h. On the contrary, our proposed speed estimation method can estimate quite large relative speeds without any speed limit.In all the prior works, speed estimators that have been proposed include training procedures in order to estimate traffic congestion or other transportation performance metrics using sensor measurements. However, the speed estimation problem from a security perspective has been not widely investigated. Only, in [38], the authors try to estimate the AOA of the specular line of sight (LOS) component of signal received from a given single antenna transmitter using a predefined training sequence. The results show the optimality of the training-based ML-AOA estimator in the case of a randomly generated jamming signal. However, the drawback of this ML-AOA estimator is that this superior performance is subject to the availability of a perfect CSI and the knowledge of jammer’s strategy which is unlikely in a realistic system. Finally, the authors in [39] introduced a new algorithm to estimate the mobile terminal speed at base station (BS) in cellular networks. This helps BS in estimating the channel Doppler shift, using measured received signals at the BS. The performance of the proposed algorithm is modeled in a Terrestrial Trunked Radio (TETRA) network, and the simulation has shown acceptable results for a wide range of velocities and jammers. However, using this algorithm, the estimated Doppler shift depends on the carrier frequency which is much smaller in a cellular network (i.e., 396 MHz) compared to a VANET (i.e., 5.9 GHz). In contrast, in the speed estimation approached by this paper, the carrier frequency of a VANET is used without any impact on the performance of the speed estimation procedure.Recently, extensive works present video-based speed estimation techniques using a single camera [40, 41]. Furthermore, speed estimation techniques are used by applications for traffic counting that are based on wireless magnetic sensor networks (WMSNs). The authors in [42] propose a system for traffic speed estimation which can effectively eliminate the geomagnetic background interference. A morphological filter is designed for removing the interference and extracting the magnetic signatures of vehicles. However, all the aforementioned works require specific infrastructure or sensor such as camera, RAdio Detection And Ranging (RADAR), Light Detection And Ranging (LIDAR), magnetic sensors, and Visible Light Detection and Ranging (ViLDAR) that built upon sensing visible light variation of the vehicle’s headlamp [43]. All these sensors have a pretty high cost. In contrast, our proposed method of speed estimation uses only the wireless signal at the Rx for the estimation of the relative speed metric Δu between Jx and Rx without any need for extra infrastructure. Last, a recent research [44] explores a novel technique which could estimate the speed of a vehicle by analyzing its influence on surrounding wireless signals from roadside wireless infrastructures, such as WiFi. To achieve this goal, in this paper, it is proposed and formulated a model to characterize the relationship between the phase and amplitude measurements and the vehicle speed. Based on the model, a method is developed that can detect the vehicle and estimate its speed accordingly using the frequency domain information involved in the spectrogram. However, this model estimates vehicle’s speed by analyzing the influence of the vehicle on surrounding wireless signals using two static roadside WiFi devices. In contrast, our proposed method estimates the relative speed between two moving vehicles that can be assumed as transmitter and receiver that interchange pilot signals using the V2V wireless communication without the need of any additional infrastructure.The great majority of the works have used covariance-based speed estimators. Some of them do not take into account the shadowing effect of VANETs, others need initially sampling of the SNR links for a training procedure, and last some need perfect knowledge about the directivity of transmitted waves in order to estimate the receiver’s speed improving handover algorithms between transmitter and receiver under a typical microcellular system. However, this type of network is assumed to be relatively stable in contrast to a VANET where the V2V channel yields more rapid and more severe fading than cellular networks. All the remaining state-of-the-art papers for speed estimation use extra hardware infrastructure, WSNs, or RSUs for traffic recording and therefore for position or speed verification. Moreover, the speed estimation approaches that use RSUs are not applicable for estimating the speed of a jammer as indication of jamming in the area because a smart jammer may change its travel behavior (i.e., speed and direction) in order to look like a legitimate vehicle and remain undetected. Our proposed technique is the first in the literature, to the best of our knowledge, that uses only the unicast communication between two moving vehiclesTx and Rx for the prediction of the jammer’s speed and for future detection of a jamming attack without any initial knowledge about the location of vehicles or the channel conditions. Our method uses this point-to-point communication between Tx-Rx to gather as much information as possible regarding jammer’s behavior, such as all the combined multipath channels among Tx,Rx,Jx, jammer’s relative speed value, and jamming signal. The proposed system is dynamic and can be applied to any road topology for the jammer’s speed estimation. Moreover, there has been no prior work that combines a feature of the physical location, except of the AOA at the receiver, such as the AOP of the Jx with its speed, in order to estimate relative speeds of two moving vehicles (jammer-receiver) during a jamming attack, using the channel Doppler shift value.


## 3. System Model and Preliminaries

### 3.1. Network Topology

We consider unicast V2V communication between transmitter and the receiver and a point-to-point V2V communication between a single jammer and the receiver. This simple scenario in a rural area is used for the initial verification of our system without high interference of other vehicles. In this area, a static obstacle already exists that impacts the communication betweenTx-Rx and Jx-Rx.The jammer transmits wireless packets/signals that may form a reactive jamming signal. We assume that theTx-Rx pair of vehicles in our model moves at a constant speed for a period of time. This approach allows the modeling of platoons of vehicles that are formed by maintaining a constant distance with each other [2]. We assume that the jammer moves with a constantly increasing speed with the ultimate goal to approach the receiver and intervene in the effective communication zone of the Tx-Rx pair. AS it can be seen in the network topology of Figure 1, the distances between Jx-Rx in the y-axis and in the x-axis aredyJx-Rx and dxJx-Rx, respectively, together with the actual distance between Jx-Rx dJx-Rx, which is the hypotenuse of the rectangular triangle that is formed. The motion of the vehicles in Figure 1 is characterized by the speed vectors u→Rx,u→Jx,u→Tx. Only u→Rx,u→Tx have the same direction, which is the direction of the x-axis. The jammer approaches the Tx-Rx with an AOP θ. So, the speed vector of the jammer is projected in the axis of the motion of vector u→Rx with an AOP θ Figure 2(a). In this figure, we also notice that the AOP θ is not equal to zero. Moreover, the angle that is formed between the speed vector of the jammer u→Jx and the wireless signal that travels between the Jx and the Rx is called the angle of departure (AOD) and is denoted as ϕ in Figure 2. In Figure 2(a), the line of sight (LOS) component between Jx-Rx has a AOD ϕ equal to zero, while the non-line of sight (NLOS) component between Jx-Rx has a AOD ϕ, which is different to zero in Figure 2(b).Figure 1
The network topology in which the orange vehicle is the jammer that approaches theTx-Rx pair from a AOP θ angle. This figure also includes the multipath fading effects by a static object.Figure 2
Illustration of projections of velocitiesuJx on the vector v⟶. Two-dimensional scheme. (a) LOS ray of Jx-Rx communication with ϕ = 0, θ ≠ 0. (b) NLOS ray of Jx-Rx communication with ϕ ≠ 0, θ ≠ 0.
(a)
(b)


### 3.2. System Overview

In our system model,K known pilot symbols that compose the symbol vector x⟶pilot=xpilot1,…,xpilotKT=1,…,1T are being sent over consecutive K time instants from the transmitter to the receiver. At the same time, the jammer simultaneously transmits over consecutive K time instants K jamming symbols to the receiver that composes the symbol vector s⟶=s1,…,sKT. So we consider the received vector at the receiver y⟶=y1y2,…,yKT, which consists of the combined symbols that the Rx receives from the transmitter and the jammer at K consecutive time instants. Therefore, for every time instant n∈0,K, the receiver signal yn is the summation of the pilot symbol sent by the transmitter xpilotn and the symbol sent by the jammer sn. Using pilots, the LOS channel and the N−1 NLOS channels between Jx−Rx are estimated by the receiver. The receiver can also define the specific value of parameter N, which is the total number of multipath rays. The wireless channel is assumed to be constant for the duration of the transmission of the K pilot symbols from Tx to Rx.


### 3.3. Attacker Model

We consider jammers that aim to block completely the communication over a link by emitting interference reactively when they detect packets over the air, thus causing a DoS attack. The jammers minimize their activity to only a few symbols per packet and use minimal, but sufficient power, to remain undetected. We assume that the jammer is able to sniff any symbol of the packet over the air in real time and react with a jamming signal that flips selected symbols at the receiver with high probability (see [45]).The jammer is designed to start transmitting upon sensing energy above a certain threshold in order for a reactive jamming attack to succeed. We set the latter to−86dBm as it is empirically determined to be a good trade-off between jammer sensitivity and false transmission detection rate, when an ongoing 802.11p transmission is assumed. So, the symbol vector s⟶ that reaches at the Rx from the Jx after K time instants has the same length as the pilot symbol vector that reaches the Rx from the Tx after K time instants, provided that the jammer transmits only when senses a transmission from the transmitter. Each one of the K scalar values depends on the used power by the jammer. The jammer continuously transmits with the same transmission power, with the purpose of overloading the wireless medium thus representing a DoS attack [46]. This work assumes that the jammer continuously transmits the same jamming symbol to the receiver forming a simplified jamming signal of the form s⟶=f,…,fT with length K and f a random unknown value to the receiver. Furthermore, the proposed RSEA can operate with a different form of the jamming signal. This is possible when the Tx sends more pilot symbols to the Rx than the sum of the different unknown jamming symbols being sent by the jammer.Recall that the main goal of this paper is to show how we can estimate the speed of a noncooperative malicious attacker that can eventually be used as extra useful information for the design of RF jamming detection schemes [47].


### 3.4. Channel Model

Multipath is the propagation phenomenon that results in radio signals reaching the receiving antenna by two or more paths. The multipath scenario illustrated in Figure1 includes a static obstacle in order for the multipath effects to be considered in the communication between Tx-Rx and Jx-Rx. So, it exists the LOS component of the wireless signal being sent by the Jx and Tx and also the NLOS component. In the NLOS component, the AOP θ is not equal to zero and the AOD ϕ between the speed vector of the jammer and the NLOS ray is also not equal to zero (see Figure 2(b)). The phenomena of reflection, diffraction, and scattering due to the multipath give rise to additional radio propagation paths beyond the direct optical LOS path between the radio transmitter and receiver.In our work, we adopt the Rician fading model, which is a channel model that includes path loss and also Rayleigh fading [48]. When a signal is transmitted, the channel adds Rician fading. The Rician fading model is particularly appropriate when there is a direct propagating LOS component in addition to the faded component arising from multipath propagation.The Rician channel at time instantt is defined with the help of multiple NLOS paths, which is similar to the Rayleigh fading channel but with the addition of a strong dominant LOS component. Parameter q defines the channel between Tx−Rx with q=1 and the channel between Jx−Rx with q=2. We define a complex Gaussian random variable ζG that is uniform over the range 0,2π and is fully specified by the variance σq2. The Rician fading channel can be defined with the help of this random variable as(1)hqt=kk+1σqej2π/λfc+fd,maxcosϕqτqδt−τq+kk+1ζG.In the above equation,fc is the carrier frequency, fd,max is the maximum Doppler shift, ϕq is the incidence AOD between the vector of speed u⟶Jx with the vector of the jamming signal, τq=d/c is the excess delay time for the LOS ray that travels between the two communicating nodes in channel hq, d corresponds to the distance between the two communicating nodes, and t is the current time instant. The first term corresponds to the specular LOS path arrival and the second to the aggregate of the large number of reflected and the scattered paths. Parameter k is the ratio of the energy in the specular path to the energy in the scattered paths; the larger the k is, the more deterministic the channel is [49]. Finally, γq=k/k+1σq in (1) is the amplitude associated with the LOS path, which is known at the receiver. Rician channel model is often a better model of representing fading compared to the Rayleigh model.The channel responsey⟶ after K consecutive symbols sent by the jammer and the transmitter is as follows:(2)y⟶=∑l=0N−1h1lx⟶pilotN−l+h2ls⟶N−l+w⟶.In above equation, they⟶ is a K×1 column vector. Moreover, x⟶pilot is the symbol vector that the Rx receives from the Tx after K consecutive time instants and s⟶ is the symbol vector that the Rx receives from the Jx after K consecutive time instants again. The symbol vectors x⟶pilotN−l,s⟶N−l have the same values, as defined above, for the l different paths of the respective channels, where ∀l∈0,N−1. The w⟶ represents the additive white Gaussian noise (AWGN) with zero mean. We assume also that the jammer and the transmitter send at very close time instants their symbols at the receiver, so that h1,h2 channels can remain stable for sending K symbols. Moreover, N is the overall multipath rays in the area. For the estimation of this parameter, we use the GEMV simulator [50]. For describing the modeled area, GEMV uses the outlines of vehicles, buildings, and foliage. Based on the outlines of the objects, it forms R-trees. R-tree is a tree data structure in which objects in the field are bound by rectangles and are hierarchically structured based on their location in space. Hence, GEMV employs a simple geometry-based small-scale signal variation model and calculates the additional stochastic signal variation and the number of diffracted and reflected rays based on the information about the surrounding objects. We must note that the wireless RF communication of the Tx-Rx pair and the Jx-Rx pair is taking place in a specific frequency band, according to the existing standard for automotive systems [51].


### 3.5. Transmission in the MAC/PHY Layer

We assume single carrier communication at the PHY. The 802.11p MAC also provides prioritized Enhanced Distributed Channel Access (EDCA) and can support applications by providing different levels of quality of service (QoS). In our model, only the 802.11p MAC EDCA AC[0] channel with higher priority is used for the pilots. The pilot beacons from theTx to the Rx are transmitted with high probability of successful delivery, increasing the accuracy of the proposed RSEA at the same time. Any type of collisions at the wireless channel resulting from competing traffic is addressed by the MAC EDCA backoff mechanism for distances smaller than the carrier sensing (CS) range of 1000m. So we assume that our speed estimation algorithm has a correct reaction and for high interference situations from other vehicles.


## 3.1. Network Topology

We consider unicast V2V communication between transmitter and the receiver and a point-to-point V2V communication between a single jammer and the receiver. This simple scenario in a rural area is used for the initial verification of our system without high interference of other vehicles. In this area, a static obstacle already exists that impacts the communication betweenTx-Rx and Jx-Rx.The jammer transmits wireless packets/signals that may form a reactive jamming signal. We assume that theTx-Rx pair of vehicles in our model moves at a constant speed for a period of time. This approach allows the modeling of platoons of vehicles that are formed by maintaining a constant distance with each other [2]. We assume that the jammer moves with a constantly increasing speed with the ultimate goal to approach the receiver and intervene in the effective communication zone of the Tx-Rx pair. AS it can be seen in the network topology of Figure 1, the distances between Jx-Rx in the y-axis and in the x-axis aredyJx-Rx and dxJx-Rx, respectively, together with the actual distance between Jx-Rx dJx-Rx, which is the hypotenuse of the rectangular triangle that is formed. The motion of the vehicles in Figure 1 is characterized by the speed vectors u→Rx,u→Jx,u→Tx. Only u→Rx,u→Tx have the same direction, which is the direction of the x-axis. The jammer approaches the Tx-Rx with an AOP θ. So, the speed vector of the jammer is projected in the axis of the motion of vector u→Rx with an AOP θ Figure 2(a). In this figure, we also notice that the AOP θ is not equal to zero. Moreover, the angle that is formed between the speed vector of the jammer u→Jx and the wireless signal that travels between the Jx and the Rx is called the angle of departure (AOD) and is denoted as ϕ in Figure 2. In Figure 2(a), the line of sight (LOS) component between Jx-Rx has a AOD ϕ equal to zero, while the non-line of sight (NLOS) component between Jx-Rx has a AOD ϕ, which is different to zero in Figure 2(b).Figure 1
The network topology in which the orange vehicle is the jammer that approaches theTx-Rx pair from a AOP θ angle. This figure also includes the multipath fading effects by a static object.Figure 2
Illustration of projections of velocitiesuJx on the vector v⟶. Two-dimensional scheme. (a) LOS ray of Jx-Rx communication with ϕ = 0, θ ≠ 0. (b) NLOS ray of Jx-Rx communication with ϕ ≠ 0, θ ≠ 0.
(a)
(b)


## 3.2. System Overview

In our system model,K known pilot symbols that compose the symbol vector x⟶pilot=xpilot1,…,xpilotKT=1,…,1T are being sent over consecutive K time instants from the transmitter to the receiver. At the same time, the jammer simultaneously transmits over consecutive K time instants K jamming symbols to the receiver that composes the symbol vector s⟶=s1,…,sKT. So we consider the received vector at the receiver y⟶=y1y2,…,yKT, which consists of the combined symbols that the Rx receives from the transmitter and the jammer at K consecutive time instants. Therefore, for every time instant n∈0,K, the receiver signal yn is the summation of the pilot symbol sent by the transmitter xpilotn and the symbol sent by the jammer sn. Using pilots, the LOS channel and the N−1 NLOS channels between Jx−Rx are estimated by the receiver. The receiver can also define the specific value of parameter N, which is the total number of multipath rays. The wireless channel is assumed to be constant for the duration of the transmission of the K pilot symbols from Tx to Rx.


## 3.3. Attacker Model

We consider jammers that aim to block completely the communication over a link by emitting interference reactively when they detect packets over the air, thus causing a DoS attack. The jammers minimize their activity to only a few symbols per packet and use minimal, but sufficient power, to remain undetected. We assume that the jammer is able to sniff any symbol of the packet over the air in real time and react with a jamming signal that flips selected symbols at the receiver with high probability (see [45]).The jammer is designed to start transmitting upon sensing energy above a certain threshold in order for a reactive jamming attack to succeed. We set the latter to−86dBm as it is empirically determined to be a good trade-off between jammer sensitivity and false transmission detection rate, when an ongoing 802.11p transmission is assumed. So, the symbol vector s⟶ that reaches at the Rx from the Jx after K time instants has the same length as the pilot symbol vector that reaches the Rx from the Tx after K time instants, provided that the jammer transmits only when senses a transmission from the transmitter. Each one of the K scalar values depends on the used power by the jammer. The jammer continuously transmits with the same transmission power, with the purpose of overloading the wireless medium thus representing a DoS attack [46]. This work assumes that the jammer continuously transmits the same jamming symbol to the receiver forming a simplified jamming signal of the form s⟶=f,…,fT with length K and f a random unknown value to the receiver. Furthermore, the proposed RSEA can operate with a different form of the jamming signal. This is possible when the Tx sends more pilot symbols to the Rx than the sum of the different unknown jamming symbols being sent by the jammer.Recall that the main goal of this paper is to show how we can estimate the speed of a noncooperative malicious attacker that can eventually be used as extra useful information for the design of RF jamming detection schemes [47].


## 3.4. Channel Model

Multipath is the propagation phenomenon that results in radio signals reaching the receiving antenna by two or more paths. The multipath scenario illustrated in Figure1 includes a static obstacle in order for the multipath effects to be considered in the communication between Tx-Rx and Jx-Rx. So, it exists the LOS component of the wireless signal being sent by the Jx and Tx and also the NLOS component. In the NLOS component, the AOP θ is not equal to zero and the AOD ϕ between the speed vector of the jammer and the NLOS ray is also not equal to zero (see Figure 2(b)). The phenomena of reflection, diffraction, and scattering due to the multipath give rise to additional radio propagation paths beyond the direct optical LOS path between the radio transmitter and receiver.In our work, we adopt the Rician fading model, which is a channel model that includes path loss and also Rayleigh fading [48]. When a signal is transmitted, the channel adds Rician fading. The Rician fading model is particularly appropriate when there is a direct propagating LOS component in addition to the faded component arising from multipath propagation.The Rician channel at time instantt is defined with the help of multiple NLOS paths, which is similar to the Rayleigh fading channel but with the addition of a strong dominant LOS component. Parameter q defines the channel between Tx−Rx with q=1 and the channel between Jx−Rx with q=2. We define a complex Gaussian random variable ζG that is uniform over the range 0,2π and is fully specified by the variance σq2. The Rician fading channel can be defined with the help of this random variable as(1)hqt=kk+1σqej2π/λfc+fd,maxcosϕqτqδt−τq+kk+1ζG.In the above equation,fc is the carrier frequency, fd,max is the maximum Doppler shift, ϕq is the incidence AOD between the vector of speed u⟶Jx with the vector of the jamming signal, τq=d/c is the excess delay time for the LOS ray that travels between the two communicating nodes in channel hq, d corresponds to the distance between the two communicating nodes, and t is the current time instant. The first term corresponds to the specular LOS path arrival and the second to the aggregate of the large number of reflected and the scattered paths. Parameter k is the ratio of the energy in the specular path to the energy in the scattered paths; the larger the k is, the more deterministic the channel is [49]. Finally, γq=k/k+1σq in (1) is the amplitude associated with the LOS path, which is known at the receiver. Rician channel model is often a better model of representing fading compared to the Rayleigh model.The channel responsey⟶ after K consecutive symbols sent by the jammer and the transmitter is as follows:(2)y⟶=∑l=0N−1h1lx⟶pilotN−l+h2ls⟶N−l+w⟶.In above equation, they⟶ is a K×1 column vector. Moreover, x⟶pilot is the symbol vector that the Rx receives from the Tx after K consecutive time instants and s⟶ is the symbol vector that the Rx receives from the Jx after K consecutive time instants again. The symbol vectors x⟶pilotN−l,s⟶N−l have the same values, as defined above, for the l different paths of the respective channels, where ∀l∈0,N−1. The w⟶ represents the additive white Gaussian noise (AWGN) with zero mean. We assume also that the jammer and the transmitter send at very close time instants their symbols at the receiver, so that h1,h2 channels can remain stable for sending K symbols. Moreover, N is the overall multipath rays in the area. For the estimation of this parameter, we use the GEMV simulator [50]. For describing the modeled area, GEMV uses the outlines of vehicles, buildings, and foliage. Based on the outlines of the objects, it forms R-trees. R-tree is a tree data structure in which objects in the field are bound by rectangles and are hierarchically structured based on their location in space. Hence, GEMV employs a simple geometry-based small-scale signal variation model and calculates the additional stochastic signal variation and the number of diffracted and reflected rays based on the information about the surrounding objects. We must note that the wireless RF communication of the Tx-Rx pair and the Jx-Rx pair is taking place in a specific frequency band, according to the existing standard for automotive systems [51].


## 3.5. Transmission in the MAC/PHY Layer

We assume single carrier communication at the PHY. The 802.11p MAC also provides prioritized Enhanced Distributed Channel Access (EDCA) and can support applications by providing different levels of quality of service (QoS). In our model, only the 802.11p MAC EDCA AC[0] channel with higher priority is used for the pilots. The pilot beacons from theTx to the Rx are transmitted with high probability of successful delivery, increasing the accuracy of the proposed RSEA at the same time. Any type of collisions at the wireless channel resulting from competing traffic is addressed by the MAC EDCA backoff mechanism for distances smaller than the carrier sensing (CS) range of 1000m. So we assume that our speed estimation algorithm has a correct reaction and for high interference situations from other vehicles.


## 4. Location-Aware Relative Speed Metric

One of the main novel ideas of this work is that we take into account the physical location of the Jx and Rx nodes and the direction of their motion when calculating the relative speed metric. In the general case, theRx does not move in the same direction as the Jx (see Figure 1). For this case, Δu includes the AOP (angle θ) of the Jx between Jx and Rx. The geometry-aware metric takes into account the distance dyJx−Rx and the distance dxJx−Rx. So a rectangular triangle is formed by the sides dxJx−Rx,dRx−Jx,dyJx−Rx. As it can be seen from Figure 1, the distance dJx−Rx is the hypotenuse of the rectangular triangle, which means that cosθ=dxJx−Rx/dJx−Rx. So, the speed of the Jx (source) with respect to the Rx speed, while the Jx and the Rx are moving in the same direction, is the relative speed between the two vehicles moving towards each other and is equal to the sum of their individual speed vectors Δu⟶line=u⟶Jx+u⟶Rx. Moreover, v⟶=u⟶Tx/uTx is the unit length vector pointing from the Jx to the Tx. The relative speed of the Jx and the Rx can be defined as the following dot product:(3)Δu=v⟶Δu⟶line.To represent all the speed vectors of Figure1 in two dimensions x,y, we project the vector u⟶Jx on the unit length vector v⟶. v⟶ is in the direction of x-axis (see Figure 2). The projected vector is u⟶Jxcosθ. On the other hand, u⟶Rx is already a vector in the direction of the x-axis (see Figure 2), which has the same direction as the projection of u⟶Jx. This allows the calculation of the relative speed between Jx−Rx using the two vectors u⟶Jxcosθ,u⟶Rx that have the same direction with the vector v⟶.In (3), if we use the projection vector u⟶Jxcosθ and the u⟶Rx vector, we get the final version of our metric, which is given by(4)Δu=u⟶JxdxJx−RxdJx−Rx+u⟶Rx=u⟶Jxcosθ+u⟶Rx.This is theΔu metric in the direction of v⟶. The addition is justified by the fact that the vectors u⟶Jxcosθ,u⟶Rx have the same direction. In the above equation, u⟶Jx,u⟶Rx are the speed vectors of the Jx and the Rx, respectively. According to our model, if the Jx approaches the receiver, cosθ increases. As the u⟶Rx remains constant and the u⟶Jx is constantly increasing, (4) is an increasing function and its maximum value indicates a nearby jamming attack.AsΔu increases, the jammer approaches the receiver and when Δu decreases, the jammer is moving away from the Tx and the Rx. If the Jx and the Rx are located on the same road, an actual straight line and the vectors u⟶Jx,u⟶Rx have the same direction, then our metric is the sum between Jx−Rx speed vectors (u⟶Jx+u⟶Rx). Otherwise, if the vectors u⟶Jx,u⟶Rx have opposite directions, our metric is estimated by the difference (u⟶Jx−u⟶Rx).Taking into account the direction of theJx relative to the direction of the Rx, the general form of the above metric is as follows:(5)Δu=u⟶Jxcosθ±u⟶Rx.It is crucial to point out that the above metric is the actual value of the relative speed that will be used in the subsequent sections to model the Doppler shift between the jammer and the receiver.


## 5. Proposed Estimation Scheme

### 5.1. Estimation of the Combined Pilot/Jamming Signal

The channel between two nodes with jamming is captured in (2). For the proposed RSEA, a pilot-based method for channel estimation is used. So, the signals that Rx receives from the Tx and the jammer interfere additively. In (2), if we differentiate the one LOS component from the other N−1 NLOS components, we have the following equation:(6)r⟶LOS=h1LOSx⟶pilotN+h2LOSs⟶N,where the channel values h1LOS=h10,h2LOS2=h20 and the symbol vectors x⟶pilotN,s⟶N represent the unique LOS component of the total N multipath values. If the NLOS multipath components are added,(7)y⟶=r⟶LOS+∑l=1N−1h1lx⟶pilotN−l+h2ls⟶N−l+w⟶.In (7), the received vector y⟶ is the convolution between h1 and the pilot symbol vector x⟶pilot and the convolution between h2 and the jamming symbol vector s⟶. Moreover, the K×1 column received vector y⟶ for the K received values for every time instant during which the receiver collects every pilot that is sent from the transmitter is given by(8)y⟶=rLOS1+∑l=1N−1h1l+h2ls1N−lrLOSK+∑l=1N−1h1l+h2lsKN−l+w1...wK.To estimate the channel betweenTx-Rxh1, the channel between Jx-Rxh2, and the jamming symbol vector s⟶, the best we can do is to estimate the combined vector parameter:(9)z⟶=∑l=0N−1h1lxpilotN−l+h2ls1N−l∑l=0N−1h1lxpilotN−l+h2lsKN−l.Vectorz⟶ has the above form for the short time that is required by the receiver to collect all the K symbols of the pilot vector. Recall that for a short time duration, the wireless channel is assumed constant. So for all the K values of vector z⟶ in (9), the parameters h1l,h2l,xpilotN−l remain constant and only the jamming symbols may change depending on the form of the jamming symbol vector sent by the jammer. We use a MMSE estimator [52], which finds a better estimate from least squares (LS), in order the K values of z⟶ to be estimated:(10)z⟶^=x⟶pilotHCw−1x⟶pilot−1x⟶pilotHCw−1y⟶,where Cw is the covariance matrix of the noise vector w⟶. Vector z⟶ in (10) has K components each having N unknown multipath channel components. So, both the h1,h2 channels can be estimated and also the K values of the jamming signal s⟶ can be estimated too.If thesimplified jamming signal is used s⟶=f,…,fT, in which the jammer continuously sends the same jamming symbol, which is unknown to the Rx, we have 2N unknown values for the two channels h1,h2 with K equations in (9) and one unknown value for the jamming symbol f. So if the condition K>2N+1 is valid, we can see that each one of the channel values h1,h2 out of N multipath values can be estimated with the elimination method for the solution of the linear system with K equations and 2N unknown values in (9). The values of the wireless channels h1,h2 remain constant for each value of vector z⟶. Moreover, the above linear system can also be solved with a completely irregular form of the jamming signal provided that the length of the pilot symbol vector x⟶pilot being sent from the Tx to the Rx is larger than the sum of the number of the unknown jamming symbols with the value of parameter (which is the double number of overall multipath rays in the area for the estimation of both h1,h2 channels) 2N. We only utilize the LOS component of the vector z⟶ for the estimation of the relative speed metric using Doppler shift. So, the useful part from vector z⟶ that we need for the relative speed estimation through the Doppler shift is r⟶LOS=h1LOS+h2LOSs1…h1LOS+h2LOSsK. If we only want to estimate the h1LOS,h2LOS values of vector r⟶LOS without the multipath values, the above conditions for the solution of the linear system in (8) can be simplified to K>3 for the simplified jamming signal form.


### 5.2. Proposed Algorithm

The proposed RSEA is presented in Algorithm1. First, the Tx specifies the number of multipath rays N in the area that the GEMV propagation model is used, as explained in subsection 3.4. Then, the RSEA is used for every time step with the transmission of a pilot that consists of K=2N+2 symbols. In line 4 of the algorithm, the combined channel between the Tx and the Rx, with the intervention of the Jx, is estimated from the vector y⟶ using a MMSE estimator. Depending on the jamming signal, the inequality that must be valid for the RSEA system to be resolvable for all the N multipath values is different. In the final 10th line of the RSEA, the relative speed value is estimated. A component r^LOS1 of the estimated vector of the combined LOS channels r⟶^LOS (each one of the K components of r⟶LOS has the same combined channel values) can be combined with the ray-optical baseband complex number a1+b1js1, which is the jamming signal that the Rx finally receives from the Jx. Specifically, the subtraction of the channel h1LOS component from the r^LOS1 value can be set equal to the ray-optical baseband complex number a1+b1js1. The complex number a1+b1js1 characterizes the baseband form of the narrowband wireless channel. This narrowband wireless channel is a function of the relative speed Δu between the jammer and receiver and the Doppler shift between the two moving objects.Algorithm 1:Relative Speed Estimation Algorithm (RSEA).
(1)
N% It is specified by the Tx for the specific area using the GEMV propagation model.
(2)
for Every time step
t
RSEA A pilot signal with K=2N+2 symbols being sent from Tx to Rxdo
(3)
N% It is respecified by the Tx for the specific area using the GEMV propagation model.
(4)
z⟶^ ← MMSE (y⟶,Cw−1)
(5)
r⟶LOS ← h1LOS+h2LOSs1…h1LOS+h2LOSsK %LOS components
(6)
if ((K>2N+1)) % and s⟶ has the simplified jamming signal form then
(7)
r⟶^LOS ← h1LOS+h2LOSs…h1LOS+h2LOSs % The r⟶LOS and z⟶ values can be estimated.
(8)
r^LOS1−h1LOS=a1+b1j s
(9)
end if
(10)
Δu^ Estimation % estimated relative speed value from (8)
(11)
end for


### 5.3. Channel Model with Doppler Shift

In this subsection, we describe in more detail the wireless LOS combined channel modelh1LOS+h2LOS between Tx-Rx and Jx-Rx. The proposed relative speed value Δu can be estimated using only the LOS combined channel models. The tracked LOS components also show fading characteristics, likely due to the ground reflection which cannot be resolved from the true LOS. For this reason, we choose the same model for the LOS component as for the discrete components. Small-scale fading characteristics do not affect significantly the communication between Tx and Rx, as compared to NLOS conditions and, therefore, the Δu estimation procedure. So central to this paper is the introduction of the proposed metric Δu in the channel model of (1), taking into account the path loss value at the receiver. This path loss value only depends on the distance between the communicating nodes and usually gets small values for a narrowband wireless channel. Let us consider the channel model such as defined by the Rx for a ray transmitted between two nodes as [53](11)∑q=12hqLOSt,τq=∑q=12γqpoqej2π/λfc+fd,maxcosϕqτqδt−τq.In the above equation,q defines the channel between Tx−Rx with q=1 and the channel between Jx−Rx with q=2, γq is the amplitude associated with the LOS path, poq represents the free space propagation loss [54], λ is the wavelength, fc the carrier frequency, fd,max is the maximum Doppler shift that depends on the Δu metric such as in (3), ϕq is the incidence AOD between the vector of speed u⟶Jx and the vector of the jamming signal, τq=d/c is the excess delay time that the ray travels between the two nodes, and t is the current time instant. We assume the LOS case for the communication between the jammer and the receiver, as can be seen in Figure 2(a). The LOS ray between the Jx and the Rx has the same direction with the speed vector of the jammer. As a consequence, the AOD is equal to zero (cosϕq=1, in (11)). The observed frequency at the receiver is f′=fc1+Δu/ccosϕq, which depends on the relative speed Δu of the two vehicles (jammer and receiver) that we defined in the previous subsection. The baseband channel model for a ray transmitted between two nodes with the intervention of a jammer therefore becomes(12)∑q=12hqLOSt,τq=∑q=12γqpoqej2π/λfc1+Δu/ccosϕqτqδt−τq.We can see that the Doppler shiftΔf Hz that is observed in the Rx can be equal to [55](13)Δf=Δufccosϕqc.And the maximum Doppler shift is as follows:(14)fd,max=Δuc.Now, letτq be the time that is required for a signal to travel the distance d. Then, we can rewrite h2LOS from (12) as(15)h2LOSt,τ2=γ2po2ej2π/λfc1+Δu/cd/cδt−dc.In the above equation, we use afc = 5.9 GHz, which is the band dedicated to V2V communication. The channel h2LOSt,τ2 is also the channel of a baseband signal in (15) and if Δu/c≫1 has the following form:(16)h2LOSt,τ2=γ2po2ej2π/λfcΔu/cd/cδt−dc.To get our final signal model, we replace the path loss parameterpo2 with the following equation:(17)po2=G0,pdrefdnp,where G0,p is the received power at a reference distance dref, which is a standard value at about 100 m, np is the path loss exponent, which is equal to 2 for the pure LOS links, and d is the distance that the transmitted ray travels between the two communicating nodes. So, po2 only depends on the distance d that the ray travels. We denote Δt=tiRSEA−ti−1RSEA as the time interval between the current time instant and the preceding one, in which the RSEA is reapplied ti−1RSEA. Furthermore, if h2LOSt,τ2 represents the channel between the Rx-Jx pair, the distance between the two nodes after the time interval Δt is d=ΔuΔt, when the jammer approaches the receiver. Substituting (17) into (16), h2LOS can be rewritten as(18)h2LOSt,τ2=γ2G0,pdrefΔuΔt2ej2π/λfcΔu/cτ2δt−dc.In the above equation, the only unknown parameter isΔu at time t. Reorganizing (18), we have the following equation:(19)h2LOSt,τ2=γ2G0,pdref2Δu2Δt2δt−dccosω2+jsinω2,where ω2=2π/λfcΔu/cτ2. In the above equation, the only unknown parameter is Δu.For the LOS channel betweenTx−Rx, we know that the receiver moves with the same speed as the transmitter, such as a platoon of vehicles with two members. The above means that the Doppler phenomenon is nonexistent. Following (16) for the formulation of the channel h1LOS without the existence of Doppler phenomenon, we can see that this channel only depends on the path loss component and the complex amplitude associated with the LOS path. The path loss component po1 and the complex amplitude variable γ1 can be estimated by the receiver. So the h1LOS can be represented by a complex number:(20)h1LOSt,τ1=γ1po1e0=aTx−Rx+bTx−Rxj.Reformulating the combined value of the LOS channels (h1LOS, h2LOS) in (12) by combining equations (20), (19), we have the following equation:(21)∑q=12hqLOSt,τqi=γ1po1+γ2G0,pdref2Δu2Δt2δt−dccosω2+jsinω2.


### 5.4. Relative Speed Estimation

At this point, we have an estimate of the baseband channelh2LOS between Jx−Rx, which can be represented with a complex number. The final baseband signal that reaches at the receiver after the intervention of the jammer can be represented as a1+b1js. From Algorithm 1, we know that the jamming symbols of the symbol vector s⟶ is part of the vector r⟶LOS. So, if from the estimated combined value r^LOS we subtract the channel h1LOS, which can be estimated by the receiver, the value r^LOS−h1LOS=h2LOSs can be set equal to the baseband received signal at the receiver:(22)r^LOS−h1LOS=a1+b1js.From the above equation, also(23)h2LOSs=a1+b1js.Reusing the (19) from the previous section, the ray-optical baseband complex number a1+b1j can be set equal to(24)a1+b1js=γ2G0,pdref2Δu2Δt2δt−dccosω2Res+jsinω2Ims,where ω2=2π/λfcΔu/cτ2. The jamming signal s⟶ is estimated by the receiver from Algorithm 1. So the Res,Ims are known values to the receiver. From the above equation, we can calculate the desired parameters a1,b1:(25)a1γ2G0,pdref2δt−d/c/Δu2Δt2=cos2πλfcΔucτ2,(26)b1γ2G0,pdref2δt−d/c/Δu2Δt2=sin2πλfcΔucτ2.From (25) and (26) and with the use of the Euler identity, we have the following equation:(27)cos2πλfcΔucτ22+sin2πλfcΔucτ22=1.In (27), there is only one unknown variable Δu. So, we can calculate Δu as(28)Δu^=G0,p2γ22dref4δt−d/c2Δt4a12+b124.From the above equation, we can see that the estimatedΔu^ value depends only on the excess delay time τ2=d/c that is caused by the Doppler phenomenon and not on the actual value of Doppler shift.


## 5.1. Estimation of the Combined Pilot/Jamming Signal

The channel between two nodes with jamming is captured in (2). For the proposed RSEA, a pilot-based method for channel estimation is used. So, the signals that Rx receives from the Tx and the jammer interfere additively. In (2), if we differentiate the one LOS component from the other N−1 NLOS components, we have the following equation:(6)r⟶LOS=h1LOSx⟶pilotN+h2LOSs⟶N,where the channel values h1LOS=h10,h2LOS2=h20 and the symbol vectors x⟶pilotN,s⟶N represent the unique LOS component of the total N multipath values. If the NLOS multipath components are added,(7)y⟶=r⟶LOS+∑l=1N−1h1lx⟶pilotN−l+h2ls⟶N−l+w⟶.In (7), the received vector y⟶ is the convolution between h1 and the pilot symbol vector x⟶pilot and the convolution between h2 and the jamming symbol vector s⟶. Moreover, the K×1 column received vector y⟶ for the K received values for every time instant during which the receiver collects every pilot that is sent from the transmitter is given by(8)y⟶=rLOS1+∑l=1N−1h1l+h2ls1N−lrLOSK+∑l=1N−1h1l+h2lsKN−l+w1...wK.To estimate the channel betweenTx-Rxh1, the channel between Jx-Rxh2, and the jamming symbol vector s⟶, the best we can do is to estimate the combined vector parameter:(9)z⟶=∑l=0N−1h1lxpilotN−l+h2ls1N−l∑l=0N−1h1lxpilotN−l+h2lsKN−l.Vectorz⟶ has the above form for the short time that is required by the receiver to collect all the K symbols of the pilot vector. Recall that for a short time duration, the wireless channel is assumed constant. So for all the K values of vector z⟶ in (9), the parameters h1l,h2l,xpilotN−l remain constant and only the jamming symbols may change depending on the form of the jamming symbol vector sent by the jammer. We use a MMSE estimator [52], which finds a better estimate from least squares (LS), in order the K values of z⟶ to be estimated:(10)z⟶^=x⟶pilotHCw−1x⟶pilot−1x⟶pilotHCw−1y⟶,where Cw is the covariance matrix of the noise vector w⟶. Vector z⟶ in (10) has K components each having N unknown multipath channel components. So, both the h1,h2 channels can be estimated and also the K values of the jamming signal s⟶ can be estimated too.If thesimplified jamming signal is used s⟶=f,…,fT, in which the jammer continuously sends the same jamming symbol, which is unknown to the Rx, we have 2N unknown values for the two channels h1,h2 with K equations in (9) and one unknown value for the jamming symbol f. So if the condition K>2N+1 is valid, we can see that each one of the channel values h1,h2 out of N multipath values can be estimated with the elimination method for the solution of the linear system with K equations and 2N unknown values in (9). The values of the wireless channels h1,h2 remain constant for each value of vector z⟶. Moreover, the above linear system can also be solved with a completely irregular form of the jamming signal provided that the length of the pilot symbol vector x⟶pilot being sent from the Tx to the Rx is larger than the sum of the number of the unknown jamming symbols with the value of parameter (which is the double number of overall multipath rays in the area for the estimation of both h1,h2 channels) 2N. We only utilize the LOS component of the vector z⟶ for the estimation of the relative speed metric using Doppler shift. So, the useful part from vector z⟶ that we need for the relative speed estimation through the Doppler shift is r⟶LOS=h1LOS+h2LOSs1…h1LOS+h2LOSsK. If we only want to estimate the h1LOS,h2LOS values of vector r⟶LOS without the multipath values, the above conditions for the solution of the linear system in (8) can be simplified to K>3 for the simplified jamming signal form.


## 5.2. Proposed Algorithm

The proposed RSEA is presented in Algorithm1. First, the Tx specifies the number of multipath rays N in the area that the GEMV propagation model is used, as explained in subsection 3.4. Then, the RSEA is used for every time step with the transmission of a pilot that consists of K=2N+2 symbols. In line 4 of the algorithm, the combined channel between the Tx and the Rx, with the intervention of the Jx, is estimated from the vector y⟶ using a MMSE estimator. Depending on the jamming signal, the inequality that must be valid for the RSEA system to be resolvable for all the N multipath values is different. In the final 10th line of the RSEA, the relative speed value is estimated. A component r^LOS1 of the estimated vector of the combined LOS channels r⟶^LOS (each one of the K components of r⟶LOS has the same combined channel values) can be combined with the ray-optical baseband complex number a1+b1js1, which is the jamming signal that the Rx finally receives from the Jx. Specifically, the subtraction of the channel h1LOS component from the r^LOS1 value can be set equal to the ray-optical baseband complex number a1+b1js1. The complex number a1+b1js1 characterizes the baseband form of the narrowband wireless channel. This narrowband wireless channel is a function of the relative speed Δu between the jammer and receiver and the Doppler shift between the two moving objects.Algorithm 1:Relative Speed Estimation Algorithm (RSEA).
(1)
N% It is specified by the Tx for the specific area using the GEMV propagation model.
(2)
for Every time step
t
RSEA A pilot signal with K=2N+2 symbols being sent from Tx to Rxdo
(3)
N% It is respecified by the Tx for the specific area using the GEMV propagation model.
(4)
z⟶^ ← MMSE (y⟶,Cw−1)
(5)
r⟶LOS ← h1LOS+h2LOSs1…h1LOS+h2LOSsK %LOS components
(6)
if ((K>2N+1)) % and s⟶ has the simplified jamming signal form then
(7)
r⟶^LOS ← h1LOS+h2LOSs…h1LOS+h2LOSs % The r⟶LOS and z⟶ values can be estimated.
(8)
r^LOS1−h1LOS=a1+b1j s
(9)
end if
(10)
Δu^ Estimation % estimated relative speed value from (8)
(11)
end for


## 5.3. Channel Model with Doppler Shift

In this subsection, we describe in more detail the wireless LOS combined channel modelh1LOS+h2LOS between Tx-Rx and Jx-Rx. The proposed relative speed value Δu can be estimated using only the LOS combined channel models. The tracked LOS components also show fading characteristics, likely due to the ground reflection which cannot be resolved from the true LOS. For this reason, we choose the same model for the LOS component as for the discrete components. Small-scale fading characteristics do not affect significantly the communication between Tx and Rx, as compared to NLOS conditions and, therefore, the Δu estimation procedure. So central to this paper is the introduction of the proposed metric Δu in the channel model of (1), taking into account the path loss value at the receiver. This path loss value only depends on the distance between the communicating nodes and usually gets small values for a narrowband wireless channel. Let us consider the channel model such as defined by the Rx for a ray transmitted between two nodes as [53](11)∑q=12hqLOSt,τq=∑q=12γqpoqej2π/λfc+fd,maxcosϕqτqδt−τq.In the above equation,q defines the channel between Tx−Rx with q=1 and the channel between Jx−Rx with q=2, γq is the amplitude associated with the LOS path, poq represents the free space propagation loss [54], λ is the wavelength, fc the carrier frequency, fd,max is the maximum Doppler shift that depends on the Δu metric such as in (3), ϕq is the incidence AOD between the vector of speed u⟶Jx and the vector of the jamming signal, τq=d/c is the excess delay time that the ray travels between the two nodes, and t is the current time instant. We assume the LOS case for the communication between the jammer and the receiver, as can be seen in Figure 2(a). The LOS ray between the Jx and the Rx has the same direction with the speed vector of the jammer. As a consequence, the AOD is equal to zero (cosϕq=1, in (11)). The observed frequency at the receiver is f′=fc1+Δu/ccosϕq, which depends on the relative speed Δu of the two vehicles (jammer and receiver) that we defined in the previous subsection. The baseband channel model for a ray transmitted between two nodes with the intervention of a jammer therefore becomes(12)∑q=12hqLOSt,τq=∑q=12γqpoqej2π/λfc1+Δu/ccosϕqτqδt−τq.We can see that the Doppler shiftΔf Hz that is observed in the Rx can be equal to [55](13)Δf=Δufccosϕqc.And the maximum Doppler shift is as follows:(14)fd,max=Δuc.Now, letτq be the time that is required for a signal to travel the distance d. Then, we can rewrite h2LOS from (12) as(15)h2LOSt,τ2=γ2po2ej2π/λfc1+Δu/cd/cδt−dc.In the above equation, we use afc = 5.9 GHz, which is the band dedicated to V2V communication. The channel h2LOSt,τ2 is also the channel of a baseband signal in (15) and if Δu/c≫1 has the following form:(16)h2LOSt,τ2=γ2po2ej2π/λfcΔu/cd/cδt−dc.To get our final signal model, we replace the path loss parameterpo2 with the following equation:(17)po2=G0,pdrefdnp,where G0,p is the received power at a reference distance dref, which is a standard value at about 100 m, np is the path loss exponent, which is equal to 2 for the pure LOS links, and d is the distance that the transmitted ray travels between the two communicating nodes. So, po2 only depends on the distance d that the ray travels. We denote Δt=tiRSEA−ti−1RSEA as the time interval between the current time instant and the preceding one, in which the RSEA is reapplied ti−1RSEA. Furthermore, if h2LOSt,τ2 represents the channel between the Rx-Jx pair, the distance between the two nodes after the time interval Δt is d=ΔuΔt, when the jammer approaches the receiver. Substituting (17) into (16), h2LOS can be rewritten as(18)h2LOSt,τ2=γ2G0,pdrefΔuΔt2ej2π/λfcΔu/cτ2δt−dc.In the above equation, the only unknown parameter isΔu at time t. Reorganizing (18), we have the following equation:(19)h2LOSt,τ2=γ2G0,pdref2Δu2Δt2δt−dccosω2+jsinω2,where ω2=2π/λfcΔu/cτ2. In the above equation, the only unknown parameter is Δu.For the LOS channel betweenTx−Rx, we know that the receiver moves with the same speed as the transmitter, such as a platoon of vehicles with two members. The above means that the Doppler phenomenon is nonexistent. Following (16) for the formulation of the channel h1LOS without the existence of Doppler phenomenon, we can see that this channel only depends on the path loss component and the complex amplitude associated with the LOS path. The path loss component po1 and the complex amplitude variable γ1 can be estimated by the receiver. So the h1LOS can be represented by a complex number:(20)h1LOSt,τ1=γ1po1e0=aTx−Rx+bTx−Rxj.Reformulating the combined value of the LOS channels (h1LOS, h2LOS) in (12) by combining equations (20), (19), we have the following equation:(21)∑q=12hqLOSt,τqi=γ1po1+γ2G0,pdref2Δu2Δt2δt−dccosω2+jsinω2.


## 5.4. Relative Speed Estimation

At this point, we have an estimate of the baseband channelh2LOS between Jx−Rx, which can be represented with a complex number. The final baseband signal that reaches at the receiver after the intervention of the jammer can be represented as a1+b1js. From Algorithm 1, we know that the jamming symbols of the symbol vector s⟶ is part of the vector r⟶LOS. So, if from the estimated combined value r^LOS we subtract the channel h1LOS, which can be estimated by the receiver, the value r^LOS−h1LOS=h2LOSs can be set equal to the baseband received signal at the receiver:(22)r^LOS−h1LOS=a1+b1js.From the above equation, also(23)h2LOSs=a1+b1js.Reusing the (19) from the previous section, the ray-optical baseband complex number a1+b1j can be set equal to(24)a1+b1js=γ2G0,pdref2Δu2Δt2δt−dccosω2Res+jsinω2Ims,where ω2=2π/λfcΔu/cτ2. The jamming signal s⟶ is estimated by the receiver from Algorithm 1. So the Res,Ims are known values to the receiver. From the above equation, we can calculate the desired parameters a1,b1:(25)a1γ2G0,pdref2δt−d/c/Δu2Δt2=cos2πλfcΔucτ2,(26)b1γ2G0,pdref2δt−d/c/Δu2Δt2=sin2πλfcΔucτ2.From (25) and (26) and with the use of the Euler identity, we have the following equation:(27)cos2πλfcΔucτ22+sin2πλfcΔucτ22=1.In (27), there is only one unknown variable Δu. So, we can calculate Δu as(28)Δu^=G0,p2γ22dref4δt−d/c2Δt4a12+b124.From the above equation, we can see that the estimatedΔu^ value depends only on the excess delay time τ2=d/c that is caused by the Doppler phenomenon and not on the actual value of Doppler shift.


## 6. Performance Evaluation

### 6.1. Evaluation Setup

Our evaluation scenario is conducted on the outskirts of the city of Aachen, representing a real-world environment while assuming that this is a rural area. Our experimental setup considers unicast data transmissions in a network consisting of three nodes: a transmitter, a receiver, and a jammer, and V2X broadcast communication for 10 interfering vehicles outside of the CS range between theTx and the Rx (distance more than 1000 m). Two different moving RF jamming attack scenarios are evaluated. Analyzing RF Jammer Behavior 1 VI-C, the Tx-Rx pair (see Figure 1) travels with a constant speed of approximately 50Km/h and with constant distance of approximately 20 m, as a platoon of vehicles. The Jx is also moving on a side road with zero initial speed and accelerates to a maximum speed of 60 Km/h in order to approach the Tx-Rx pair. In RF Jammer Behavior 2 VI-D, the transmitter and the receiver travel with constant speed of approximately 48Km/h when the jammer approaches the crossroads, as illustrated in Figure 3, with accelerating speed and a maximum limit of 50km/h.Figure 3
Graphical representation of theΔteff from the Tx−Rx pair between the communication zone and effective zone of the Jx.Our experiments are conducted using the Veins-Sumo simulator [56] with the simulation parameters presented in Table 1 such as the initial distance between the jammer and the pair of Rx-Tx, dJx−Rx; the distance that separates the receiver from the transmitter throughout the course of the simulation dTx−Rx; the closest distance in which the jammer arrives relative to the Tx-Rx pair as well as the power of all the transmitted signals PTx,Jx; the time interval Δt after RSEA is reapplied; and the specific value of the parameter N, which is the number of the multipath rays. Last, the standard reference distance dref is used for the estimation of the LOS path loss component.Table 1
Simulation parameters.
Evaluation parameters in veins simulator
Values
d
Tx
,
Rx
20 m
C
W
min
,
C
W
max
[3, 7]
Vehicle’s transmission range
130–300 m
InitialdJx−Rx
300 m
CS range of 802.11p protocol
1000 m
Interfering vehicles outside of CS rangeTx−Rx
10
d
Jx
−
Rx at “black hole”
25 m
P
Tx
,
Jx
100 mW
Minimum sensitivityPth
−69 dBm to −85 dBm
f
c
5.9 GHz
Doppler shift forΔu=120km/h
±
655.5 Hz
d
ref
100 m
Δ
t
2 s
N
4As illustrated in Figure3, there is a time interval Δteff, in which the transmitter can effectively communicate with the receiver. It starts with the “Start of Communication Zone” and ends with the “Start of the Effective Zone” of the Jx. After the start of the effective zone of the Jx, the jammer is located at distances smaller than 30 m away from the receiver and it can completely jam the communication between the Tx and the Rx by constructing a “black hole.” All the evaluation parameters are summarized in Table 2.Table 2
Evaluation scenario parameters.
Independent parameters
RF Jammer 1
RF Jammer 2
Tx-Rx velocity
50 Km/h
48 Km/h
Jx velocity
60 Km/h
50 Km/h
Δ
t
eff
15.5 sec
18 sec
“Black hole” of communication
13.5 sec
18 sec
Time ofΔu peak
23.4 sec
25 secDuring the performance evaluation, we test our proposed RSEA with different SINR values for two real-life scenarios. When the jamming vehicle is approaching theTx-Rx pair, the SINR is given by(29)SINR=h1x⟶pilot2h2s⟶2+σn2.The SINR level is measured by the receiver at the PHY layer. In the above equation, the noise powerσn2 is the noise power. Moreover, the mean absolute error (MAE) between the real Δu value and the estimated is calculated for both scenarios. This is the difference between the actual relative speed metric Δu with the estimated relative speed metric Δu^:(30)MAE=1nsΔui−Δu^i,where i is an integer number that identified with the current time instant in which the real and the estimated Δu variable have a specific value and ns=10 is the number of measurements for the specific speed value. The MAE value gets its optimal zero value when the real Δu is identified with the estimated. We assume this optimal value as a reference point for the MAE % calculations for the rest of the paper.


### 6.2. Speed Estimator Comparison

All state-of-the-art recent papers from 2014 onwards for speed estimation, along with the proposed one, are summarized and compared under specific conditions in Table3. These articles fall into some specific categories. Some of the papers use RSUs installed on the side of the road that can detect a vehicle and estimate its speed by analyzing the influence of the vehicle on surrounding wireless signals from roadside wireless infrastructures (see [27, 29, 44]). In the same category belong the articles that require static nodes with specific magnetic sensors to collect the earth magnetic field and estimate the speed of a vehicle by calculating the similarity of vehicle signatures between these static nodes (see [42]). Last, recent papers such as [43] use ViLDAR systems to estimate a vehicle’s speed using received light power (intensity) variations of a vehicle’s headlamps as transmitter and static photodetectors as receiver through visible light communication (VLC). Moreover, some papers need static cameras located at the roads for the speed estimation procedure ([40, 41]). However, these methods require the deployment of many RSUs or additional hardware to estimate vehicle speed over a large section of the road, and therefore, the cost of the methods is high. The methods that use RSUs for estimating the speed of an RF jammer are not applicable additionally because a smart jammer may change its travel behavior (i.e., speed and direction) in order to look like a legitimate vehicle and thus remain undetected. Another category of papers uses specific hardware embedded in the vehicle such as UCA antennas, RADAR, and LIDAR for the speed estimation [29]. These techniques are also very expensive. Some papers need also big or medium training data for the speed estimation using either complicated kinematic models [27] or the autocorrelation between two time series of WiFi signals using different samples of SNR data [36]. Similarly, some papers must use a proper (relatively large) window size for collecting training data for performing speed estimation [44]. A last category of articles deals with some of the limitations that impose on the speed estimation process. Specifically, some of the papers assume moving vehicles with speed limits of up to 60km/h which corresponds to relatively low sampling rates required for the WiFi hardware used [29, 44]. However, a great challenge of V2V communication is the high Doppler shifts due to the fast-moving communicating vehicles. Such corresponding limiting factors for a VANET may be the high computational time or the applicability of the method only to relevant static nodes such as applications for estimating speed directly from signal strength profiles of mobile phones.Table 3
Method limitations.
Categories
[26]
[28]
[35]
([39])
[40]
[42]
[41]
[43]
[RSEA]
RSU, static sensors, static cameras
✕
✕
✕
✕
✕
✕
✕
Extra sensors on vehicles (UCA)
✕
Limitations (speed limit)
✕
✕
✕
Training data
✕
✕
✕Concluding, it is obvious that the proposed RSEA method is the only method in the state-of-the-art literature that estimates the relative speed of a jammer with a completely passive scheme that is based on RF communication betweenTx-Rx with the interference of a jammer in the area, without extra cost for adding sensors or hardware. Moreover, we can conclude that the proposed method is the only method in the literature that combines the physical orientation of the vehicles in the considering jamming scenario with the relative speed Δu between Jx-Rx without extra sensors. Last, the proposed method is the only method that does not susceptible to high Doppler shift or relative speed values that are observed in V2V communication. It may be noted that, later in this section, the proposed RSEA will be evaluated on a wide range of jammer speed values.


### 6.3. Results of RF Jammer Behavior 1

In RF Jammer Behavior 1, we assume that the pairTx-Rx moves with a high constant speed (50 Km/h) when the jammer accelerates with a higher maximum speed (60 Km/h), while transmitting a jamming signal with a simplified form to the receiver. The first figure of Figure 4(a) shows a comparison between the real Δu and the estimated value. Specifically, by observing the start time of the steep slope of SINR in Figure 5(b), we can conclude that it coincides with the start of the jamming attack, 15.5 sec. The main reason for the sharp decrease of the SINR in our experiment is the jamming attack and not the interference from the entire environment. In that case, the total received power at the Rx is also increased indicating the jamming attack. Moreover, in Figure 4(a), after 15.5 sec, for which Δu is above 20rad∗m/s, the SINR in Figure 5(b) has also a steep slope. So, the effective zone of communication between Tx and Rx is approximately Δteff=15.5 sec, whilst after that it is corrupted for 13.5 sec. So, the “black hole” in the communication range between the Tx and the Rx is during the time interval (15.5 sec–29 sec). After 29 sec, we have the end of the attack. For this time interval (15.5 sec–29 sec), the MAE of our proposed RSEA increases to 23% from the optimal MAE value (see Figure 6).Figure 4
RF Jammer Behavior 1 results: RSEA with speed ofTx-Rx (50 Km/h) and Jx maximum speed (60 Km/h) and a simplified form of the jamming signal. (a) Δu vs. estimated Δu^ to time. (b) SINR (dB) vs. time (sec).
(a)
(b)Figure 5
RF Jammer Behavior 2: RSEA with speed ofTx-Rx (48 Km/h) and Jx maximum speed (50 Km/h) and simplified jamming signal form. (a) Real Δu vs. estimated Δu^ to time. (b) SINR (dB) vs. time (sec).
(a)
(b)Figure 6
Instantaneous MAE comparison between RF Jammer Behavior 1 and RF Jammer Behavior 2 withsimplified jamming signal form.In Figure4(a), we can see that Δu reaches a maximum value, approximately 32.5rad∗m/s, at the time instant 23.4 sec. At this time, Jx is approaching the Tx-Rx pair in the main road, which is illustrated in Figure 3. The average MAE for the duration of RF Jammer Behavior 1 is approximately 13% worse than the optimal value.


### 6.4. Results of RF Jammer Behavior 2

For the second evaluation scenario, we assume that the pairTx-Rx travels with constant speed (48 Km/h), which is almost the same as the maximum speed of the jammer (50 Km/h) (see Figure 5). The jammer continuously transmits a random jamming symbol to the receiver. The start time of the jamming attack is at 18 sec during which the SINR appears to be decreasing from 5 dB to zero while Δu starts to increase from 20rad∗m/s to the “peak” value of Δu. The time that is needed for the Jx to approach the pair Tx-Rx is approximately Δteff=18 sec. After that time, the jamming attack clearly has perfect results for 18 sec; from the 18 sec of the simulation until 36 sec, after that SINR increases more than 5 dB.If theΔu slope is positive, the Jx approaches the Rx, whilst if it goes to zero, Jx is removed from the effective zone of communication between the Tx and the Rx. The “black hole” in the communication between the Tx and the Rx is around the time interval (18 sec–36 sec), during which the MAE value increases to approximately 18% from the optimal MAE value.In Figure5, we can see that the average MAE for the complete duration of RF Jammer Behavior 2 is approximately 10% worse than the optimal value, as it is shown also in Figure 6.


### 6.5. MAE Comparison between RF Jammer Behavior 1 and RF Jammer Behavior 2

The overall comparison of the MAE results between RF Jammer Behavior 1 (Jammer 1) and RF Jammer Behavior 2 (Jammer 2) is summarized in Table4. Figure 6 shows that there is a quite small MAE, only 15% greater than the MAE value at the start and end of simulation. However, when the jammer approaches the receiver, the MAE shows an increase of about 23% from the optimal value for RF Jammer Behavior 1 and 18% for RF Jammer Behavior 2. The phenomenon of the larger MAE at the time of the jamming attack for RF Jammer Behavior 1 compared to that of RF Jammer Behavior 2 is attributed to the fast varying nature of the Δu metric because it changes with a higher rate, and thus, the channel between the Jx and the Rx changes frequently too. So, the longer the duration of the jamming attack lasts, the better the MAE results of the proposed RSEA are.Table 4
RF Jammer Behavior comparison results of MAE% increase from the optimal zero MAE reference point.
Time intervals
MAE (Jammer 1)
MAE (Jammer 2)
“Black hole” of communication
23
%
18
%
Δ
t
eff
8
%
6
%
Overall simulation time
13
%
10
%In order to test our previous results under more generic scenarios, the average MAE is estimated for different jammer speed values and different number of “hidden” nodes that are located at the edge of the CS range of theTx−Rx pair. Specifically, we conducted several simulations, for a range of jammer speed values between 47,97Km/h and number of “hidden” nodes between 0,50 nodes. For these parameters, the MAE value increases at approximately 20% from the reference zero MAE value with the maximum jammer speed value (see Figure 7(b)) and at approximately19.2% from the same reference value with the maximum number of “hidden” nodes, which is 50 nodes (see Figure 7(a)). For values greater than 67km/h regarding the speed metric and 30 “hidden” nodes, the MAE was increasing with a higher rate. For smaller values of these two “side effect” values, the increase of MAE value is negligible. So these simulation results indicate that the back-off MAC/EDCA algorithm, using a safety-related high priority channel for the communication between Tx−Rx, does not affect considerably the performance of the speed estimation algorithm. The jammer’s speed increase also affects but not significantly the proposed RSEA.Figure 7
Average MAE% increase from the optimal zero MAE reference point with different evaluation parameters: the MAE of the proposed RSEA with different number of nodes for the contention window of the MAC back-off procedure for the wireless channel between Tx-Rx and different jammer’s speed values. (a) Average MAE (%) vs. different number of “hidden” nodes. (b) Average MAE (%) vs. range of jammer’s speed values (Km/h).
(a)
(b)


## 6.1. Evaluation Setup

Our evaluation scenario is conducted on the outskirts of the city of Aachen, representing a real-world environment while assuming that this is a rural area. Our experimental setup considers unicast data transmissions in a network consisting of three nodes: a transmitter, a receiver, and a jammer, and V2X broadcast communication for 10 interfering vehicles outside of the CS range between theTx and the Rx (distance more than 1000 m). Two different moving RF jamming attack scenarios are evaluated. Analyzing RF Jammer Behavior 1 VI-C, the Tx-Rx pair (see Figure 1) travels with a constant speed of approximately 50Km/h and with constant distance of approximately 20 m, as a platoon of vehicles. The Jx is also moving on a side road with zero initial speed and accelerates to a maximum speed of 60 Km/h in order to approach the Tx-Rx pair. In RF Jammer Behavior 2 VI-D, the transmitter and the receiver travel with constant speed of approximately 48Km/h when the jammer approaches the crossroads, as illustrated in Figure 3, with accelerating speed and a maximum limit of 50km/h.Figure 3
Graphical representation of theΔteff from the Tx−Rx pair between the communication zone and effective zone of the Jx.Our experiments are conducted using the Veins-Sumo simulator [56] with the simulation parameters presented in Table 1 such as the initial distance between the jammer and the pair of Rx-Tx, dJx−Rx; the distance that separates the receiver from the transmitter throughout the course of the simulation dTx−Rx; the closest distance in which the jammer arrives relative to the Tx-Rx pair as well as the power of all the transmitted signals PTx,Jx; the time interval Δt after RSEA is reapplied; and the specific value of the parameter N, which is the number of the multipath rays. Last, the standard reference distance dref is used for the estimation of the LOS path loss component.Table 1
Simulation parameters.
Evaluation parameters in veins simulator
Values
d
Tx
,
Rx
20 m
C
W
min
,
C
W
max
[3, 7]
Vehicle’s transmission range
130–300 m
InitialdJx−Rx
300 m
CS range of 802.11p protocol
1000 m
Interfering vehicles outside of CS rangeTx−Rx
10
d
Jx
−
Rx at “black hole”
25 m
P
Tx
,
Jx
100 mW
Minimum sensitivityPth
−69 dBm to −85 dBm
f
c
5.9 GHz
Doppler shift forΔu=120km/h
±
655.5 Hz
d
ref
100 m
Δ
t
2 s
N
4As illustrated in Figure3, there is a time interval Δteff, in which the transmitter can effectively communicate with the receiver. It starts with the “Start of Communication Zone” and ends with the “Start of the Effective Zone” of the Jx. After the start of the effective zone of the Jx, the jammer is located at distances smaller than 30 m away from the receiver and it can completely jam the communication between the Tx and the Rx by constructing a “black hole.” All the evaluation parameters are summarized in Table 2.Table 2
Evaluation scenario parameters.
Independent parameters
RF Jammer 1
RF Jammer 2
Tx-Rx velocity
50 Km/h
48 Km/h
Jx velocity
60 Km/h
50 Km/h
Δ
t
eff
15.5 sec
18 sec
“Black hole” of communication
13.5 sec
18 sec
Time ofΔu peak
23.4 sec
25 secDuring the performance evaluation, we test our proposed RSEA with different SINR values for two real-life scenarios. When the jamming vehicle is approaching theTx-Rx pair, the SINR is given by(29)SINR=h1x⟶pilot2h2s⟶2+σn2.The SINR level is measured by the receiver at the PHY layer. In the above equation, the noise powerσn2 is the noise power. Moreover, the mean absolute error (MAE) between the real Δu value and the estimated is calculated for both scenarios. This is the difference between the actual relative speed metric Δu with the estimated relative speed metric Δu^:(30)MAE=1nsΔui−Δu^i,where i is an integer number that identified with the current time instant in which the real and the estimated Δu variable have a specific value and ns=10 is the number of measurements for the specific speed value. The MAE value gets its optimal zero value when the real Δu is identified with the estimated. We assume this optimal value as a reference point for the MAE % calculations for the rest of the paper.


## 6.2. Speed Estimator Comparison

All state-of-the-art recent papers from 2014 onwards for speed estimation, along with the proposed one, are summarized and compared under specific conditions in Table3. These articles fall into some specific categories. Some of the papers use RSUs installed on the side of the road that can detect a vehicle and estimate its speed by analyzing the influence of the vehicle on surrounding wireless signals from roadside wireless infrastructures (see [27, 29, 44]). In the same category belong the articles that require static nodes with specific magnetic sensors to collect the earth magnetic field and estimate the speed of a vehicle by calculating the similarity of vehicle signatures between these static nodes (see [42]). Last, recent papers such as [43] use ViLDAR systems to estimate a vehicle’s speed using received light power (intensity) variations of a vehicle’s headlamps as transmitter and static photodetectors as receiver through visible light communication (VLC). Moreover, some papers need static cameras located at the roads for the speed estimation procedure ([40, 41]). However, these methods require the deployment of many RSUs or additional hardware to estimate vehicle speed over a large section of the road, and therefore, the cost of the methods is high. The methods that use RSUs for estimating the speed of an RF jammer are not applicable additionally because a smart jammer may change its travel behavior (i.e., speed and direction) in order to look like a legitimate vehicle and thus remain undetected. Another category of papers uses specific hardware embedded in the vehicle such as UCA antennas, RADAR, and LIDAR for the speed estimation [29]. These techniques are also very expensive. Some papers need also big or medium training data for the speed estimation using either complicated kinematic models [27] or the autocorrelation between two time series of WiFi signals using different samples of SNR data [36]. Similarly, some papers must use a proper (relatively large) window size for collecting training data for performing speed estimation [44]. A last category of articles deals with some of the limitations that impose on the speed estimation process. Specifically, some of the papers assume moving vehicles with speed limits of up to 60km/h which corresponds to relatively low sampling rates required for the WiFi hardware used [29, 44]. However, a great challenge of V2V communication is the high Doppler shifts due to the fast-moving communicating vehicles. Such corresponding limiting factors for a VANET may be the high computational time or the applicability of the method only to relevant static nodes such as applications for estimating speed directly from signal strength profiles of mobile phones.Table 3
Method limitations.
Categories
[26]
[28]
[35]
([39])
[40]
[42]
[41]
[43]
[RSEA]
RSU, static sensors, static cameras
✕
✕
✕
✕
✕
✕
✕
Extra sensors on vehicles (UCA)
✕
Limitations (speed limit)
✕
✕
✕
Training data
✕
✕
✕Concluding, it is obvious that the proposed RSEA method is the only method in the state-of-the-art literature that estimates the relative speed of a jammer with a completely passive scheme that is based on RF communication betweenTx-Rx with the interference of a jammer in the area, without extra cost for adding sensors or hardware. Moreover, we can conclude that the proposed method is the only method in the literature that combines the physical orientation of the vehicles in the considering jamming scenario with the relative speed Δu between Jx-Rx without extra sensors. Last, the proposed method is the only method that does not susceptible to high Doppler shift or relative speed values that are observed in V2V communication. It may be noted that, later in this section, the proposed RSEA will be evaluated on a wide range of jammer speed values.


## 6.3. Results of RF Jammer Behavior 1

In RF Jammer Behavior 1, we assume that the pairTx-Rx moves with a high constant speed (50 Km/h) when the jammer accelerates with a higher maximum speed (60 Km/h), while transmitting a jamming signal with a simplified form to the receiver. The first figure of Figure 4(a) shows a comparison between the real Δu and the estimated value. Specifically, by observing the start time of the steep slope of SINR in Figure 5(b), we can conclude that it coincides with the start of the jamming attack, 15.5 sec. The main reason for the sharp decrease of the SINR in our experiment is the jamming attack and not the interference from the entire environment. In that case, the total received power at the Rx is also increased indicating the jamming attack. Moreover, in Figure 4(a), after 15.5 sec, for which Δu is above 20rad∗m/s, the SINR in Figure 5(b) has also a steep slope. So, the effective zone of communication between Tx and Rx is approximately Δteff=15.5 sec, whilst after that it is corrupted for 13.5 sec. So, the “black hole” in the communication range between the Tx and the Rx is during the time interval (15.5 sec–29 sec). After 29 sec, we have the end of the attack. For this time interval (15.5 sec–29 sec), the MAE of our proposed RSEA increases to 23% from the optimal MAE value (see Figure 6).Figure 4
RF Jammer Behavior 1 results: RSEA with speed ofTx-Rx (50 Km/h) and Jx maximum speed (60 Km/h) and a simplified form of the jamming signal. (a) Δu vs. estimated Δu^ to time. (b) SINR (dB) vs. time (sec).
(a)
(b)Figure 5
RF Jammer Behavior 2: RSEA with speed ofTx-Rx (48 Km/h) and Jx maximum speed (50 Km/h) and simplified jamming signal form. (a) Real Δu vs. estimated Δu^ to time. (b) SINR (dB) vs. time (sec).
(a)
(b)Figure 6
Instantaneous MAE comparison between RF Jammer Behavior 1 and RF Jammer Behavior 2 withsimplified jamming signal form.In Figure4(a), we can see that Δu reaches a maximum value, approximately 32.5rad∗m/s, at the time instant 23.4 sec. At this time, Jx is approaching the Tx-Rx pair in the main road, which is illustrated in Figure 3. The average MAE for the duration of RF Jammer Behavior 1 is approximately 13% worse than the optimal value.


## 6.4. Results of RF Jammer Behavior 2

For the second evaluation scenario, we assume that the pairTx-Rx travels with constant speed (48 Km/h), which is almost the same as the maximum speed of the jammer (50 Km/h) (see Figure 5). The jammer continuously transmits a random jamming symbol to the receiver. The start time of the jamming attack is at 18 sec during which the SINR appears to be decreasing from 5 dB to zero while Δu starts to increase from 20rad∗m/s to the “peak” value of Δu. The time that is needed for the Jx to approach the pair Tx-Rx is approximately Δteff=18 sec. After that time, the jamming attack clearly has perfect results for 18 sec; from the 18 sec of the simulation until 36 sec, after that SINR increases more than 5 dB.If theΔu slope is positive, the Jx approaches the Rx, whilst if it goes to zero, Jx is removed from the effective zone of communication between the Tx and the Rx. The “black hole” in the communication between the Tx and the Rx is around the time interval (18 sec–36 sec), during which the MAE value increases to approximately 18% from the optimal MAE value.In Figure5, we can see that the average MAE for the complete duration of RF Jammer Behavior 2 is approximately 10% worse than the optimal value, as it is shown also in Figure 6.


## 6.5. MAE Comparison between RF Jammer Behavior 1 and RF Jammer Behavior 2

The overall comparison of the MAE results between RF Jammer Behavior 1 (Jammer 1) and RF Jammer Behavior 2 (Jammer 2) is summarized in Table4. Figure 6 shows that there is a quite small MAE, only 15% greater than the MAE value at the start and end of simulation. However, when the jammer approaches the receiver, the MAE shows an increase of about 23% from the optimal value for RF Jammer Behavior 1 and 18% for RF Jammer Behavior 2. The phenomenon of the larger MAE at the time of the jamming attack for RF Jammer Behavior 1 compared to that of RF Jammer Behavior 2 is attributed to the fast varying nature of the Δu metric because it changes with a higher rate, and thus, the channel between the Jx and the Rx changes frequently too. So, the longer the duration of the jamming attack lasts, the better the MAE results of the proposed RSEA are.Table 4
RF Jammer Behavior comparison results of MAE% increase from the optimal zero MAE reference point.
Time intervals
MAE (Jammer 1)
MAE (Jammer 2)
“Black hole” of communication
23
%
18
%
Δ
t
eff
8
%
6
%
Overall simulation time
13
%
10
%In order to test our previous results under more generic scenarios, the average MAE is estimated for different jammer speed values and different number of “hidden” nodes that are located at the edge of the CS range of theTx−Rx pair. Specifically, we conducted several simulations, for a range of jammer speed values between 47,97Km/h and number of “hidden” nodes between 0,50 nodes. For these parameters, the MAE value increases at approximately 20% from the reference zero MAE value with the maximum jammer speed value (see Figure 7(b)) and at approximately19.2% from the same reference value with the maximum number of “hidden” nodes, which is 50 nodes (see Figure 7(a)). For values greater than 67km/h regarding the speed metric and 30 “hidden” nodes, the MAE was increasing with a higher rate. For smaller values of these two “side effect” values, the increase of MAE value is negligible. So these simulation results indicate that the back-off MAC/EDCA algorithm, using a safety-related high priority channel for the communication between Tx−Rx, does not affect considerably the performance of the speed estimation algorithm. The jammer’s speed increase also affects but not significantly the proposed RSEA.Figure 7
Average MAE% increase from the optimal zero MAE reference point with different evaluation parameters: the MAE of the proposed RSEA with different number of nodes for the contention window of the MAC back-off procedure for the wireless channel between Tx-Rx and different jammer’s speed values. (a) Average MAE (%) vs. different number of “hidden” nodes. (b) Average MAE (%) vs. range of jammer’s speed values (Km/h).
(a)
(b)


## 7. Discussion

In Section 6, we tested our proposed RSEA under different SINR values in order to represent realistic conditions. When there is a decreased steep slope of the SINR values, a jamming attack is conducted in the area. At the same time, the relative speed valueΔu, as defined in (4), presents an increased steep slope, indicating a jamming attack. Furthermore, when the jammer approaches the receiver, the MAE of the RSEA presents a significant increase due to the packet loss of the pilots sent by the Tx to Rx due to the presence of jammer. This results in the incorrect estimation of the stochastic V2V channel between Jx and Rx, increasing also the corresponding MAE of the Δu value.V2X communication generally uses broadcast messages, but in this paper, we use unicast RF communication between two nodes in order to perform jammer’s speed estimation. This type of communication is supported for advanced safety applications of autonomous vehicles by the Qualcomm’s Cellular Vehicle-to-Everything (C-V2X) technology [57]. The target of this paper is to evaluate the performance of the RSEA for a pair of moving nodes with limited conditions, having as a future objective to be used in a real-life VANET scenario for more than one pair of nodes. Peer-to-peer networks in VANETs are studied lately in many other works [58–61], focusing mostly on social networks message exchange, cooperative caching, or unicast video streaming.Relative speed estimation results from our proposed RSEA can be collected from a Trusted Central Authority (TCA) that exists in the area. Analyzing these collected data records, the TCA makes deductions based on the SINR value, notifies approaching vehicles, and even proposes jamming-free routes [62].


## 8. Conclusion and Future Work

In this paper, we presented an algorithm for estimating the combined valueΔu of the relative speed between Rx and Jx in combination with the AOP of the Jx, during a jamming attack. A simplified jamming signal is sent to the receiver by the jammer that contains an unknown symbol to the receiver K times. The proposed relative speed metric can capture both the speed of the jammer and its direction relative to the Tx-Rx movement. By predicting the above value, we can understand jammer’s behavior, for which Rx does not have any information except for the combined signal that is received from Tx and the interference caused by the attacker. Our proposed RSEA uses the physical metric of Δu from RF communication Tx−Rx in order to estimate the direction of the attacker. This metric is combined with the SINR value from the hardware (physical layer) in order for a real-life VANET scenario to be simulated. The MAE measured is being approximately only 10% worse compared to the optimal zero MAE value under different jamming attach scenarios.As future work, we plan to combine RSEA with other metrics from the PHY layer or the network layer, such as SINR, for developing an accurate cross-layer jamming detection scheme. The detection scheme will be capable of dealing with more than one pair of nodes that communicate in a broadcast form. This combined metric can be also used as an extra feature in a machine learning approach (see [63]), in which the vehicles of the area can be classified as cooperative or malicious, thereby forming a trusted vehicular network. The usage of the relative speed metric can also reduce false alarms and can provide additional information about the future position of a Jx, such as the time that the attacker will approach the effective zone of communication. The above information extracted from our channel-based Jx-Rx analysis can decrease false alarms compared to jamming prediction schemes that are based only on the 802.11p PHY/MAC-related metrics (see the DJAVAN in [64]), concluding the physical geographical topology of the attacker. Last but not least, this metric is appropriate for a variety of jamming attacks.



---

*Source: 2064348-2019-11-23.xml*