44 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO.

1, JANUARY 2013

Detection and Localization of Multiple Spoofing

Attackers in Wireless Networks
Jie Yang, Student Member, IEEE, Yingying (Jennifer) Chen, Senior Member, IEEE,
Wade Trappe, Member, IEEE, and Jerry Cheng

AbstractWireless spoofing attacks are easy to launch and can significantly impact the performance of networks. Although the
identity of a node can be verified through cryptographic authentication, conventional security approaches are not always desirable
because of their overhead requirements. In this paper, we propose to use spatial information, a physical property associated with each
node, hard to falsify, and not reliant on cryptography, as the basis for 1) detecting spoofing attacks; 2) determining the number of
attackers when multiple adversaries masquerading as the same node identity; and 3) localizing multiple adversaries. We propose to
use the spatial correlation of received signal strength (RSS) inherited from wireless nodes to detect the spoofing attacks. We then
formulate the problem of determining the number of attackers as a multiclass detection problem. Cluster-based mechanisms are
developed to determine the number of attackers. When the training data are available, we explore using the Support Vector Machines
(SVM) method to further improve the accuracy of determining the number of attackers. In addition, we developed an integrated
detection and localization system that can localize the positions of multiple attackers. We evaluated our techniques through two
testbeds using both an 802.11 (WiFi) network and an 802.15.4 (ZigBee) network in two real office buildings. Our experimental results
show that our proposed methods can achieve over 90 percent Hit Rate and Precision when determining the number of attackers. Our
localization results using a representative set of algorithms provide strong evidence of high accuracy of localizing multiple adversaries.

Index TermsWireless network security, spoofing attack, attack detection, localization

1 INTRODUCTION

D UE to the openness of the wireless transmission

medium, adversaries can monitor any transmission.
Further, adversaries can easily purchase low-cost wireless
Spoofing attacks can further facilitate a variety of traffic
injection attacks [1], [2], such as attacks on access control
lists, rogue access point (AP) attacks, and eventually Denial-
devices and use these commonly available platforms to of-Service (DoS) attacks. A broad survey of possible
launch a variety of attacks with little effort. Among various spoofing attacks can be found in [3], [4]. Moreover, in a
types of attacks, identity-based spoofing attacks are espe- large-scale network, multiple adversaries may masquerade
cially easy to launch and can cause significant damage to as the same identity and collaborate to launch malicious
network performance. For instance, in an 802.11 network, it attacks such as network resource utilization attack and
is easy for an attacker to gather useful MAC address denial-of-service attack quickly. Therefore, it is important to
information during passive monitoring and then modify its 1) detect the presence of spoofing attacks, 2) determine the
MAC address by simply issuing an ifconfig command to number of attackers, and 3) localize multiple adversaries
masquerade as another device. In spite of existing 802.11 and eliminate them.
security techniques including Wired Equivalent Privacy Most existing approaches to address potential spoofing
(WEP), WiFi Protected Access (WPA), or 802.11i (WPA2), attacks employ cryptographic schemes [5], [6]. However, the
such methodology can only protect data framesan attacker
application of cryptographic schemes requires reliable key
can still spoof management or control frames to cause
distribution, management, and maintenance mechanisms. It
significant impact on networks.
is not always desirable to apply these cryptographic
methods because of its infrastructural, computational, and
. J. Yang is with the Department of Computer Science and Engineering, management overhead. Further, cryptographic methods are
Oakland University, Rochester, Michigan 48309. susceptible to node compromise, which is a serious concern
E-mail: [email protected].
. Y. Chen is with the Department of Electrical and Computer Engineering, as most wireless nodes are easily accessible, allowing their
Stevens Institute of Technology, Castle Point on Hudson, Hoboken, NJ memory to be easily scanned. In this work, we propose to use
07030. E-mail: [email protected]. received signal strength (RSS)-based spatial correlation, a
. W. Trappe is with WINLAB, Rutgers, The State University of New Jersey,
Route 1 Tech Center, Room A-102, Technology Centre of New Jersey, 671 physical property associated with each wireless node that is
Route 1 South, North Brunswick, NJ 08902-3390. hard to falsify and not reliant on cryptography as the basis
E-mail: [email protected]. for detecting spoofing attacks. Since we are concerned with
. J. Cheng is with the Department of Medicine, Robert Wood Johnson
Medical School, University of Medicine & Dentistry of New Jersey, New
attackers who have different locations than legitimate
Brunswick, NJ 08901. E-mail: [email protected]. wireless nodes, utilizing spatial information to address
Manuscript received 7 Nov. 2010; revised 22 July 2011; accepted 7 Mar. 2012; spoofing attacks has the unique power to not only identify
published online 20 Mar. 2012. the presence of these attacks but also localize adversaries. An
Recommended for acceptance by D. Xuan. added advantage of employing spatial correlation to detect
For information on obtaining reprints of this article, please send e-mail to:
[email protected], and reference IEEECS Log Number TPDS-2010-11-0663. spoofing attacks is that it will not require any additional cost
Digital Object Identifier no. 10.1109/TPDS.2012.104. or modification to the wireless devices themselves.
1045-9219/13/$31.00 2013 IEEE Published by the IEEE Computer Society
YANG ET AL.: DETECTION AND LOCALIZATION OF MULTIPLE SPOOFING ATTACKERS IN WIRELESS NETWORKS 45

We focus on static nodes in this work, which are common integrated detection and localization system. Finally, we
for spoofing scenarios [7]. We addressed spoofing detection conclude our work in Section 6.
in mobile environments in our other work [8]. The works that
are closely related to us are [3], [7], [9]. Faria and Cheriton [3]
2 RELATED WORK
proposed the use of matching rules of signalprints for
spoofing detection, Sheng et al. [7] modeled the RSS readings The traditional approach to prevent spoofing attacks is to use
using a Gaussian mixture model and Chen et al. [9] used RSS cryptographic-based authentication [5], [6], [10]. Wu et al. [5]
and K-means cluster analysis to detect spoofing attacks. have introduced a secure and efficient key management
However, none of these approaches have the ability to (SEKM) framework. SEKM builds a Public Key Infrastruc-
ture (PKI) by applying a secret sharing scheme and an
determine the number of attackers when multiple adver-
underlying multicast server group. Wool [6] implemented a
saries use the same identity to launch attacks, which is the
key management mechanism with periodic key refresh and
basis to further localize multiple adversaries after attack
host revocation to prevent the compromise of authentication
detection. Although Chen et al. [9] studied how to localize
keys. An authentication framework for hierarchical, ad hoc
adversaries, it can only handle the case of a single spoofing
sensor networks is proposed in [10]. However, the crypto-
attacker and cannot localize the attacker if the adversary uses graphic authentication may not be always applicable
different transmission power levels. because of the limited resources on wireless devices, and
The main contributions of our work are: 1) GADE: a lacking of a fixed key management infrastructure in the
generalized attack detection model (GADE) that can both wireless network.
detect spoofing attacks as well as determine the number of Recently, new approaches utilizing physical properties
adversaries using cluster analysis methods grounded on associated with wireless transmission to combat attacks in
RSS-based spatial correlations among normal devices and wireless networks have been proposed. Based on the fact
adversaries; and 2) IDOL: an integrated detection and that wireless channel response decorrelates quite rapidly in
localization system that can both detect attacks as well as space, a channel-based authentication scheme was proposed
find the positions of multiple adversaries even when the to discriminate between transmitters at different locations,
adversaries vary their transmission power levels. and thus to detect spoofing attacks in wireless networks [11].
In GADE, the Partitioning Around Medoids (PAM) Brik et al. [12] focused on building fingerprints of 802.11b
cluster analysis method is used to perform attack detection. WLAN NICs by extracting radiometric signatures, such as
We formulate the problem of determining the number of frequency magnitude, phase errors, and I/Q origin offset, to
attackers as a multiclass detection problem. We then applied defend against identity attacks. However, there is additional
cluster-based methods to determine the number of attacker. overhead associated with wireless channel response and
We further developed a mechanism called SILENCE for radiometric signature extraction in wireless networks. Li
testing Silhouette Plot and System Evolution with minimum and Trappe [4] introduced a security layer that used forge-
distance of clusters, to improve the accuracy of determining resistant relationships based on the packet traffic, including
the number of attackers. Additionally, when the training MAC sequence number and traffic pattern, to detect
data are available, we propose to use the Support Vector spoofing attacks. The MAC sequence number has also been
Machines (SVM) method to further improve the accuracy of used in [13] to perform spoofing detection. Both the
determining the number of attackers. sequence number and the traffic pattern can be manipulated
Moreover, we developed an integrated system, IDOL, by an adversary as long as the adversary learns the traffic
which utilizes the results of the number of attackers returned pattern under normal conditions.
by GADE to further localize multiple adversaries. As we The works [3], [7], [14] using RSS to defend against
demonstrated through our experiments using both an 802.11 spoofing attacks are most closely related to us. Faria and
Cheriton [3] proposed the use of matching rules of
network as well as an 802.15.4 network in two real office
signalprints for spoofing detection. Sheng et al. [7] modeled
building environments, GADE is highly effective in spoofing
the RSS readings using a Gaussian mixture model. Sang and
detection with over 90 percent hit rate and precision.
Arora [14] proposed to use the nodes spatial signature,
Furthermore, using a set of representative localization
including Received Signal Strength Indicator (RSSI) and Link
algorithms, we show that IDOL can achieve similar localiza-
Quality Indicator (LQI) to authenticate messages in wireless
tion accuracy when localizing adversaries to that of under networks. However, none of these approaches are capable of
normal conditions. One key observation is that IDOL can determining the number of attackers when there are multiple
handle attackers using different transmission power levels, adversaries collaborating to use the same identity to launch
thereby providing strong evidence of the effectiveness of malicious attacks. Further, they do not have the ability to
localizing adversaries when there are multiple attackers in localize the positions of the adversaries after attack detection.
the network. Turning to studying localization techniques, in spite of its
The rest of the paper is organized as follows. We place several meter-level accuracy, using RSS [15], [16], [17], [18] is
our work in the context of related research in Section 2. We an attractive approach because it can reuse the existing
provide our theoretical analysis and describe the general- wireless infrastructure and is highly correlated with
ized attack detection model in Section 3. We formulate the physical locations. Dealing with ranging methodology,
problem of determining the number of attackers using range-based algorithms involve distance estimation to land-
multiclass detection and propose our cluster-analysis-based marks using the measurement of various physical properties
mechanisms in Section 4. In Section 5, we present IDOL, the such as RSS [15], [16], Time Of Arrival (TOA) [19], Time
46 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 1, JANUARY 2013

Difference Of Arrival (TDOA), and direction of arrival exponent, Xi is the shadow fading which follows zero mean
(DoA) [20]. Whereas range-free algorithms [21] use coarser Gaussian distribution with  standard deviation [23], [24].
metrics to place bounds on candidate positions. Another For simplicity, we assume the wireless nodes have the same
method of classification describes the strategy used to map a transmission power. We will discuss the issue of using
node to a location. Lateration approaches [19] use distances different transmission power levels in Section 3.4. Given
to landmarks, while angulation uses the angles from two wireless nodes in the physical space, the RSS distance
landmarks. Scene matching strategies [15] use a function between two nodes in signal space at the ith landmark is
that maps observed radio properties to locations on a given by
preconstructed signal map or database. Further, Chen et al.  
d2
[22] proposed to perform detection of attacks on wireless si 10 log X; 2
localization and Yang et al. [20] proposed to use the direction d1
of arrival and received signal strength of the signals to where X follows zero mean Gaussian distribution with
p
localize adversarys sensor nodes. In this work, we choose a 2 standard deviation.
group of algorithms employing RSS to perform the task of The square of RSS distance in n-dimensional signal space
localizing multiple attackers and evaluate their performance (i.e., at n landmarks) is then determined by
in terms of localization accuracy.
Our work differs from the previous study in that we use X
n
D2 s2i ; 3
the spatial information to assist in attack detection instead i1
of relying on cryptographic-based approaches. Further-
more, our work is novel because none of the exiting work where si with i 1; 2 . . . ; n is the RSS distance at ith
can determine the number of attackers when there are landmark and is given by (2).
multiple adversaries masquerading as the same identity. Based on (2) and (3), we know that, when these two
Additionally, our approach can accurately localize multiple wireless nodes are at the same location, the distance
adversaries even when the attackers varying their transmis- 1=22 D2 in n dimension signal space follows a central
sion power levels to trick the system of their true locations. Chi-square distribution 2 n with n degree of freedom [25].
The probability density functions (PDF) of the random
variable X D2 , which is the square distance in n-
3 GENERALIZED ATTACK DETECTION MODEL dimensional signal space, when two wireless nodes are at
In this section, we describe our Generalized Attack Detection the same location can be represented as
ModEl, which consists of two phases: attack detection, which 1 2
detects the presence of an attack, and number determination, fX xjsame location ex=4 xn=21 ; 4
2n n n=2
which determines the number of adversaries. The number
determination phase will be presented in Section 4. where x  0 and n=2 denotes the Gamma function,
which has closed-form values at the half-integers.
3.1 Theoretical Analysis of the Spatial Correlation However, when these two wireless nodes are at different
of RSS locations, 1=22 D2 becomes a noncentral chi-square dis-
The challenge in spoofing detection is to devise strategies tribution 2 n;  with n degree of freedom and a noncen-
that use the uniqueness of spatial information, but not using trality parameter , where
location directly as the attackers positions are unknown.
Xn   2
We propose to study RSS, a property closely correlated with di2
 10 log ; 5
location in physical space and is readily available in the i1
di1
existing wireless networks. Although affected by random
noise, environmental bias, and multipath effects, the RSS and dij , with i 1; 2; . . . n; j 1; 2, is the distance from jth
measured at a set of landmarks (i.e., reference points with wireless nodes to the ith landmark. The PDF of the random
known locations) is closely related to the transmitters variable X D2 when two wireless node are at the
physical location and is governed by the distance to the different locations can be represented as
landmarks [17]. The RSS readings at the same physical p!
location are similar, whereas the RSS readings at different 1 x2 xn24 x
fX xjdiff: locations 2 e 4 In2 ; 6
locations in physical space are distinctive. Thus, the RSS 4  2 22
readings present strong spatial correlation characteristics.
where I z is a modified Bessel function of the first kind [25].
We define the RSS value vector as s fs1 ; s2 ; . . . sn g
Given the threshold , the probability that we can
where n is the number of landmarks/access points that are
determine the two nodes are at different locations in a 2D
monitoring the RSS of the wireless nodes and know their
physical space with n landmarks (i.e., detection rate DR) is
locations. Generally, the RSS at the ith landmark from a
given by
wireless node is lognormally distributed [23]
  
  DR P x > jdiff: locations 1  F 2 n;=22 ; 7
dj 22
si dj dBm P d0 dBm  10 log Xi ; 1
d0
and the corresponding false positive rate is
where P d0 represents the transmitting power of the node   
at the reference distance d0 , dj is the distance between the F P R P x > jsame locations 1  F 2 n ; 8
wireless node j and the ith landmark, and  is the path loss 22
YANG ET AL.: DETECTION AND LOCALIZATION OF MULTIPLE SPOOFING ATTACKERS IN WIRELESS NETWORKS 47

Fig. 1. The ROC curves when the distance between two wireless Fig. 2. The ROC curves when the standard deviation of shadowing is 2,
devices is 16, 20, and 25 feet, respectively. The standard deviation of 3, and 4 dB, respectively. The distance between two devices is 25 feet.
shadowing is 2 dB. The path loss exponent is 2.5.
the smaller standard deviation of shadowing  results in a
where F X  is the Cumulative Distribution Function (CDF) better detection performance.
of the random variable X.
From (7) and (8), for a specified detection rate DR, the 3.2 Attack Detection Using Cluster Analysis
threshold of test can be obtained as The above analysis provides the theoretical support of using
the RSS-based spatial correlation inherited from wireless
 22 F 1
2 n;=22 1  DR; 9 nodes to perform spoofing attack detection. It also showed
that the RSS readings from a wireless node may fluctuate and
and the false positive rate can be represented in terms of the
should cluster together. In particular, the RSS readings over
detection rate
time from the same physical location will belong to the same
 
F P R 1  F 2 n F 1
2 n;=22 1  DR : 10 cluster points in the n-dimensional signal space, while the
RSS readings from different locations over time should form
From (7), we can see that the detection rate DR increases different clusters in signal space. We illustrated this
with , which can be represented by the distance between important observation in Fig. 3, which presents RSS reading
two wireless nodes together with the landmarks. Moreover, vectors of three landmarks (i.e., n 3) from two different
for a specified detection rate DR, (10) shows that the false physical locations. Under the spoofing attack, the victim and
positive rate F P R increases with the standard deviation of the attacker are using the same ID to transmit data packets,
shadowing . and the RSS readings of that ID is the mixture readings
We next study the detection power of our approach by measured from each individual node (i.e., spoofing node or
using the RSS-based spatial correlation. Fig. 1 presents the victim node). Since under a spoofing attack, the RSS readings
numerical results of receiver operating characteristic (ROC) from the victim node and the spoofing attackers are mixed
curves based on (7) and (8) when randomly placing two together, this observation suggests that we may conduct
wireless devices in a 100 by 100 feet square area. There are cluster analysis on top of RSS-based spatial correlation to
four landmarks deployed at the four corners of the square find out the distance in signal space and further detect the
area. The physical distance between two wireless devices is presence of spoofing attackers in physical space.
16, 20, and 25 feet, respectively. The path loss exponent  is In this work, we utilize the Partitioning Around Medoids
set to 2.5 and the standard deviation of shadowing is 2 dB. Method to perform clustering analysis in RSS. The PAM
From the figure, we observed that the ROC curves shift to Method [26] is a popular iterative descent clustering
the upper left when increasing the distance between two algorithm. Compared to the popular K-means method [9],
devices. This indicates that the farther away the two nodes the PAM method is more robust in the presence of noise and
are separated, the better detection performance that our outliers. Thus, the PAM method is more suitable in
method can achieve. This is because the detection perfor-
mance is proportional to the noncentrality parameter ,
which is represented by the distance between two wireless
nodes together with the landmarks.
We further investigate the detection performance of our
approach under RSS variations. In this study, we fixed the
distance between two wireless devices as 25 feet. The
obtained ROC curves when the standard deviation of
shadowing is set to 2, 3, and 4 dB, respectively, is shown in
Fig. 2. From the figure, it can be seen that we can obtain better
detection performance with lower standard deviation of
shadowing . A larger standard deviation of shadowing
causes the two distributions, i.e., noncentral chi-square and
central chi-square, to get closer to one another. Consequently, Fig. 3. Illustration of RSS readings from two physical locations.
48 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 1, JANUARY 2013

determining clusters from RSS streams, which can be

unreliable and fluctuating over time due to random noise
and environmental bias [27].
We thus formulate spoofing detection as a statistical
significance testing problem, where the null hypothesis is

H0 : normal no spoofing attack:

In significance testing, a test statistic T is used to evaluate
whether observed data belong to the null-hypothesis or not.
In particular, in our attack detection phase, we partition the
RSS vectors from the same node identity into two clusters
(i.e., K 2) no matter how many attackers are using this
identity, since our objective in this phase is to detect the
presence of attacks. We then choose the distance between
two medoids Dm as the test statistic T in our significance
testing for spoofing detection, Dm kMi  Mj k, where Mi
and Mj are the medoids of two clusters. Under normal
conditions, the test statistic Dm should be small since there
is basically only one cluster from a single physical location.
However, under a spoofing attack, there is more than one
node at different physical locations claiming the same node
identity. As a result, more than one clusters will be formed
in the signal space and Dm will be large as the medoids are
derived from the different RSS clusters associated with
different locations in physical space.

3.3 Evaluation Strategy

To test the performance of our attack detection approach, Fig. 4. Landmark setups and testing locations in two networks within two
we evaluate our approach in real office building environ- office buildings.
ments. We conducted experiments in two office buildings:
one is the Wireless Information Network Laboratory through all the possible combinations of testing points for
(WINLAB) using an 802.11 (WiFi) network and the other cases of two, three, and four attackers masquerading as a
is the Computer Science Department at Rutgers University single node identity. In addition, we built an integrated
using an 802.15.4 (ZigBee) network as presented in Fig. 4. system to both detect attacks as well as localize the positions
The wireless devices we consider here are a Dell laptop of adversaries. We use the leave-one-out method in
running Linux and equipped with an Orinoco silver card localization algorithms, which means we choose one
(for the 802.11 network) and a Tmote Sky mote (for the location as the testing node whereas the rest of the locations
802.15.4 network). The size of these two floors are 219 ft  as training data till all the locations have been tested. The
169 ft and 200 ft  80 ft, respectively. Fig. 4a shows five experimental results will be presented in the following
landmarks in red stars in the 802.11 networks to maximize sections, respectively.
the coverage, whereas there are four landmarks deployed as
3.4 Results of Attack Detection
red triangles in the 802.15.4 network to achieve optimal
landmark placement [17], shown in Fig. 4b. We note that the 3.4.1 Impact of Threshold and Sampling Number
deployment of landmarks has important impact on the The thresholds of test statistics define the critical region for
detection performance, which is similar to the wireless the significance testing. Appropriately setting a threshold 
localization [17]. Each landmark is a Linux machine enables the attack detector to be robust to false detections.
equipped with a Atheros miniPCI 802.11 wireless card Fig. 5 shows the Cumulative Distribution Function of Dm in
and a Tmote Sky mote so as to measure the RSS readings signal space under both normal conditions as well as with
from both WiFi and Zigbee networks. spoofing attacks. We observed that the curve of Dm shifted
The small dots in the floor maps are the locations used for greatly to the right under spoofing attacks. Thus, when
testing. There are 101 locations for the 802.11 network and 94 Dm > , we can declare the presence of a spoofing attack. The
locations for the 802.15.4 network. At each location, 300 short lines across the CDF lines are the averaged variances of
packet-level RSS samples are collected separately during the Dm under different sampling numbers. We observed that the
daytime when there were people walking around. Further, CDF curves of different sampling numbers are almost mixed
to evaluate the robustness of our approach in handling together, which indicate that for a given threshold  similar
attacks using different transmission power levels, we detection rate will be achieved under different sampling
collected packets at varying transmission power levels from numbers. However, the averaged variance decreases with
30 mW (15 dBm) to 1 mW (0 dBm) for the 802.11 network. the increasing number of samplesthe short-term RSS
We randomly chose point combinations on the floor and samples are not as stable as the long-term RSS samples.
treated one point as the position of the original node, and the The more stable the Dm is, the more robust the detection
rest as the positions of the spoofing nodes. Then, we ran tests mechanism can be. Therefore, there is a tradeoff between the
YANG ET AL.: DETECTION AND LOCALIZATION OF MULTIPLE SPOOFING ATTACKERS IN WIRELESS NETWORKS 49

Fig. 5. 802.11 network: cumulative distribution function of distance between medoids Dm in signal space.

Fig. 6. Receiver operating characteristic curves when using the PAM method to perform attack detection.

number of RSS samples needed to perform spoofing positive rates less than 10 percent, the detection rate are
detection and the time the system can declare the presence above 98 percent when the threshold  is around 8 dB. Even
of an attack. For this study, we use 200 RSS samples, which when the false positive rate goes to zero, the detection rate
has a variance of 0:84 dB2 . is still more than 95 percent for both networks.

3.4.2 Handling Different Transmission Power Levels 3.4.4 Impact of Distance between the Spoofing Node
If a spoofing attacker sends packets at a different transmis- and the Original Node
sion power level from the original node, based on our We further study how likely a spoofing device can be
cluster analysis there will be two distinct RSS clusters in detected by our attack detector when it is at various
signal space (i.e., Dm will be large). We varied transmission distances from the original node in physical space. Fig. 7
power for an attacker from 30 mW (15 dBm) to 1 mW presents the detection rate as a function of the distance
(0 dBm). We found that in all cases Dm is larger than normal between the spoofing node Pspoof and the original node Porg .
conditions. Fig. 5b presents an example of the Cumulative We found that the further away Pspoof is from Porg , the higher
Distribution Function of the Dm for the 802.11 network the detection rate becomes. This observation is consistent
when the spoofing attacker used transmission power of 10 with our theoretical analysis presented in Section 3.1. In
dB to send packets, whereas the original node used 15 dB particular, for the 802.11 network, the detection rate goes to
transmission power level. We observed that the curve of Dm over 90 percent when Pspoof is about 15 feet away from Porg
under the different transmission power level shifts to the when the false positive rate is 5 percent. While for the
right indicating larger Dm values. Thus, spoofing attacks
launched by using different transmission power levels will
be detected effectively in GADE. TABLE 1
Spoofing Attack Detection: Detection Rate and False Positive
3.4.3 Performance of Detection Rate in Two Networks
To evaluate the effectiveness of using cluster analysis for
attack detection, Fig. 6 presents the Receiver Operating
Characteristic curves of using Dm as a test statistic to
perform attack detection for both the 802.11 and the 802.15.4
networks. Table 1 presents the detection rate and false
positive rate for both networks under different threshold
settings. The results are encouraging, showing that for false
50 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 1, JANUARY 2013

Fig. 7. The detection rate as a function of the distance between the spoofing node and the original node.

Ntrue
802.15.4 network, the detection rate is above 90 percent P recisioni : 13
when the distance between Pspoof and Porg is about 20 feet by Ntrue Nfalse
setting the false positive to 5 percent. This is in line with the F-measure. F-measure is originated from information
average localization estimation errors using RSS [28] which retrieval and measures the accuracy of a test by considering
are about 15 feet. When the nodes are less than 15 feet apart, both the Hit Rate and the Precision [29]
they have a high likelihood of generating similar RSS
2
readings, and thus the spoofing detection rate falls below F -measurei 1 1
: 14
P recisioni HitRate
90 percent, but still greater than 70 percent. However, when i

Pspoof moves closer to Porg , the attacker also increases the Multiclass ROC graph. We further use the multiclass
probability to expose itself. The detection rate goes to ROC graph to measure the effectiveness of our mechanisms.
100 percent when the spoofing node is about 45-50 feet away Particularly, we use two methods [30]: class  reference
from the original node. based and benefit  error based. The class-reference-based
formulation produces C different ROC curves when hand-
ling C classes based on Pi and Ni . Further, in the C-class
4 DETERMINING THE NUMBER OF ATTACKERS detection problem, the traditional 2  2 confusion matrix,
4.1 Problem Formulation including True Positives, False Positives, False Negatives,
and True Negatives, becomes an C  C matrix, which
Inaccurate estimation of the number of attackers will cause
contains the C benefits (true positives) and C 2  C possible
failure in localizing the multiple adversaries. As we do not errors (false positives). The benefit-error-based method is
know how many adversaries will use the same node identity based on the C  C matrix. For example, when C 3 with
to launch attacks, determining the number of attackers possible number of attackers of f2; 3; 4g, the benefits are 3
becomes a multiclass detection problem and is similar to and the possible errors are 6.
determining how many clusters exist in the RSS readings. If
C is the set of all classes, i.e., all possible combination of 4.2 Silhouette Plot
number of attackers. For instance, C f1; 2; 3; 4g. For a class 4.2.1 Attacker Number Determination
of specific number of attackers ci , e.g., ci 3, we define Pi as A Silhouette Plot is a graphical representation of a cluster
the positive class of ci and all other classes (i.e., all other [31]. To determine the number of attackers, we construct
number of attackers) as negative class Ni Silhouettes in the following way: the RSS sample points S
fs1 ; . . . ; sN g (with N as the total number of samples) are the
Pi ci ; 11 data set and we let C c1 ; . . . ; cK be its clustering into K
clusters, as shown in Fig. 8. Let dsk ; sl be the distance
[
Ni cj 2 C: 12 between sk and sl . Let cj fsj1 ; . . . ; sjmj g be the jth cluster,
j6i j 1; . . . ; K, where mj jcj j.

Further, we are interested in the statistical characterization of

the percentage that the number of attackers can be accurately
determined over all possible testing attempts with mixed
number of attackers. Associated with a specific number of
attackers, i, we define the Hit Rate HRi as HRi NPtrue i
where
Ntrue is the true positive detection of class ci . Let Nfalse be the
false detection of the class ci out of the negative class Ni that
do not have i number of attackers. We then define the false
positive rate F Pi for a specific number of attackers of class ci
N
as F Pi Nfalse
i
. Then, the Precision is defined as Fig. 8. Illustration of the construction of Silhouettes, K 3; j 1.
YANG ET AL.: DETECTION AND LOCALIZATION OF MULTIPLE SPOOFING ATTACKERS IN WIRELESS NETWORKS 51

TABLE 2
same identity in the network, the Silhouette Plot achieves
Silhouette Plot: Hit Rate, Precision, and F-Measure both the highest Hit Rate, above 99 percent, and the highest
of Determining the Number of Attackers F-measure value, over 95 percent. Further, the case of four
attackers achieves the highest Precision above 99 percent,
which indicates that the detection of the number of attackers
is more accurate; however, the Hit Rate decreases to about
80 percent. Moreover, the Precision of the case of three
attackers is lower than the cases of two and four attackers.
This is because the cases of two attackers and four attackers
are likely to be mistakenly determined as the case of three
attackers. In general, our observation indicates that the Hit
Rate decreases as the number of attackers increases.
The average distance aji between the ith RSS vector in the However, when the number of attackers increases, the
cluster cj and the other RSS vectors in the same cluster is adversaries also increase the probability to expose them-
thus given by selves. In the rest of our study, we will only present the
mj results up to four attackers that masquerade the same node
1 X  
identity simultaneously.
aji d sji ; sjk ; i 1; . . . ; mj : 15
mj  1 k1
k6i 4.3 System Evolution
Further, the minimum average distance between the ith RSS 4.3.1 Attacker Number Determination
vector in the cluster cj and all the RSS vectors clustered in The System Evolution is a new method to analyze cluster
the clusters ck , k 1; . . . ; K; k 6 j is given by structures and estimate the number of clusters [32]. The
( ) System Evolution method uses the twin-cluster model, which
j 1 X mn
 j n are the two closest clusters (e.g., clusters a and b) among K
bi min d si ; sk ; i 1; :::; mj : 16
n1;:::K mn k1 potential clusters of a data set. The twin-cluster model is
n6j
used for energy calculation. The Partition Energy Ep K
Then, the silhouette width of the ith RSS vector in the cluster denotes the border distance between the twin clusters,
cj is defined as whereas the Merging Energy Em K is calculated as the
average distance between elements in the border region of
bji  aji the twin clusters. The border region includes a number of
wji
: 17 sample points chosen from clusters a and b that are closer to
max aji ; bji
its twin cluster than any other points within its own cluster.
From (17), it follows that 1  wji  1. We can now define For instance, if cluster a contains total Ma sample points, in
p
the silhouette of the cluster cj the twin-cluster model, a will be partitioned into Da M 2
a

parts. Then, the number of sample points in the border

m
1 X j
region is defined as na M Da . The same rule is carried out for
a

Wj wj : 18 its twin cluster b. Thus, we compute the Partition Energy

mj i1 i
Ep K as
Hence, the global Silhouette index for partition p that (
partitions the data set into K clusters is given by 1 X na
 
Ep K minj1;...nb D ai ; bj
na nb i1
1X K
) ; 21
W Kp wj : 19 Xnb
 
K j1 min D ai ; bj
i1;...na
j1
Finally, we define Silhouette Coefficient SC to determine
the number of attackers and the Merging Energy Em K as
na X
nb 1 nX
a nb
SC max W Kp : 20 1  
K Em K  na nb  D si ; sj ; 22
2 i1 ji1
SC is used for the selection of the best value of the cluster
number K (i.e., the optimal number of attackers) by choosing where Dai ; bj is the euclidean/Pearson distance between
the K to make W K as high as possible across all partitions. the elements aSi and bj in clusters a and b, respectively. And
Since the objective of constructing silhouettes is to obtain SC, Xsi ; sj 2 fai g fbj g, which are the elements in the border
we note that there are no adjustable parameters in this region of the twin clusters.
detection scheme. The basic idea behind using the System Evolution
method to determine the number of attackers is that all
4.2.2 Experimental Evaluation the rest of clusters are separated if the twin clusters are
Table 2 presents experimental values of Hit Rate, Precision, separable. Starting from the initial state with K 2, the
and F-measure when the attacker number i f2; 3; 4g for algorithm works with PAM by changing the number of
both the 802.11 and the 802.15.4 networks. We observed that clusters in a data set through the partitioning process
the performance of Silhouette Plot in both networks are Ep K > Em K and the merging process Em K  Ep K
qualitatively the same. We found that when the number of alternatively. The algorithm stops when it reaches a
attackers equals to 2, i.e., two attackers masquerading the equilibrium state Koptimal , at which the optimal number of
52 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 1, JANUARY 2013

ROC graphs using both the class-reference-based method

(i.e., the cases of two and four attackers) and the benefit-
error-based method (i.e., the case of three attackers) by
varying the threshold  0 . Because of the overall higher Hit
Rate under the 802.15.4 network, we only present the results
of the 802.11 network in Fig. 10. By using the class-reference-
based method, in Figs. 10a and 10b, we observed better
performance of Hit Rate under the case of two attackers than
the case of four attackers when the False Positive Rate
decreases. Turning to examine the ROC graphs of the case of
Fig. 9. System evolution: detection of four adversaries masquerading three attackers by using the benefit-error-based method as
the same node identity.
shown in Figs. 10c and 10d, we found that bounded by less
than 10 percent False Positive Rate, the Hit Rate is lower
clusters is found in the data set: Koptimal K; if Ep K > when treating four attackers as errors than treating two
Em K and Ep K 1  Em K 1. attackers as errors. This indicates that the probability of
Fig. 9 presents an example of using the System Evolution
misclassifying three attackers as four attackers is higher than
method to determine the number of attackers in the 802.11
that of misclassifying three attackers as two attackers.
network. It shows the energy calculation versus the number
of clusters. The Koptimal is obtained when K 4 with Ep 4 > 4.4 The SILENCE Mechanism
Em 4 and Ep 5 < Em 5 indicating that there are four The advantage of Silhouette Plot is that it is suitable for
adversaries in the network using the same identity to estimating the best partition. Whereas the System Evolution
perform spoofing attacks. method performs well under difficult cases such as when
there exists slightly overlapping between clusters and there
4.3.2 Experimental Evaluation are smaller clusters near larger clusters [32]. However, we
In this section, we show our study of System Evolution using observed that for both Silhouette Plot and System Evolution
multiclass ROC graphs. We perform threshold  0 testing on methods, the Hit Rate decreases as the number of attackers
Ep K  Em K. We can then obtain the number of attackers increases, although the Precision increases. This is because
Koptimal based on: Koptimal K, if Ep K  Em K >  0 and the clustering algorithms cannot tell the difference between
Ep K 1  Em K 1   0 . Fig. 10 presents the multiclass real RSS clusters formed by attackers at different positions

Fig. 10. System evolution in 802.11 network: multiclass receiver operating characteristic graphs of hit rate versus false positive.
YANG ET AL.: DETECTION AND LOCALIZATION OF MULTIPLE SPOOFING ATTACKERS IN WIRELESS NETWORKS 53

Fig. 11. Illustration of the minimum cluster distance using cluster analysis methods under the case of three attackers.

and fake RSS clusters caused by outliers and variations of Whereas for the 802.15.4 network, the Hit Rate has increased
the signal strength. Fig. 11 illustrates such a situation where from around 91-95 to 96 percent in SILENCE for the case of
there are three attackers masquerading the same identity. three attackers and from 84 to 88 percent for the four attackers
Silhouette Plot returns the number of attackers Ksp 4 as case. Further, we observed that SILENCE has better
shown in Fig. 11a. We found that the minimum distance performance over all the two, three, and four attackers in
between two clusters in Silhouette Plot is very small terms of F-measure. The overall improvement of F-measure is
because two clusters are actually from a single physical from 91 to 96 percent for 802.11 network, and from 92-93 to
location. Further, Fig. 11b shows that System Evolution 95 percent for 802.15.4 network. Further, comparing with
returns the number of attackers Kse 3, the correct number Silhouette Plot and System Evolution, the computational cost
of attackers, and the minimum distance between two of SILENCE does not increase much. We experienced that
clusters is large indicating that the clusters are from SILENCE can determine the number of attackers within
different physical locations. 1 second for each experimental run. These results demon-
Based on this observation, we developed SILENCE, strate that SILENCE, a mechanism that combines minimum
testing SILhouette Plot and System EvolutioN with mini- distance testing and cluster analysis together to perform
mum distanCE of cluster, which evaluates the minimum multiclass attacker detection, is more effective than using
distance between clusters on top of the pure cluster analysis techniques based on cluster analysis alone.
to improve the accuracy of determining the number of
attackers. The number of attackers K in SILENCE is thus 4.5 Support Vector Machines-Based Mechanism
determined by Provided the training data collected during the offline
8 training phase, we can further improve the performance of
< Ksp
> if Ksp  Kse;  obs  determining the number of spoofing attackers. In addition,
K Ksp if min Dobs
m Ksp > min Dm Kse ; 23 given several statistic methods available to detect the
>  obs   obs 
: Kse if min Dm Ksp < min Dm Kse ; number of attackers, such as System Evolution and SILENCE,
we can combine the characteristics of these methods to
achieve a higher detection rate. In this section, we explore
where Dobsm is the observed value of Dm between two
using Support Vector Machines to classify the number of
clusters. SILENCE takes the advantage of both Silhouette
Plot and System Evolution and further makes the judgment the spoofing attackers. The advantage of using SVM is that
by checking the minimum distance between the returned it can combine the intermediate results (i.e., features) from
clusters to make sure the clusters are produced by attackers different statistic methods to build a model based on
instead of RSS variations and outliers. Hence, when training data to accurately predict the number of attackers.
applying SILENCE to the case shown in Fig. 11, SILENCE Particularly, SVM is a set of kernel-based learning
returns K 3 as the number of attackers, which is the true methods for data classification, which involves a training
phase and a testing phase [33]. Each data instance in the
positive in this example.
training set consists of a target value (i.e., class label) and
4.4.1 Experimental Evaluation several attributes (i.e., features). For example, for spoofing
The effectiveness of using SILENCE to determine the number
of attackers is presented in Table 3. And Fig. 12 presents the TABLE 3
comparison of Hit Rate and F-measure of SILENCE to those SILENCE: Hit Rate, Precision, and F-Measure
of Silhouette Plot and System Evolution methods. The key
observation is that there is a significant increase of Hit Rate
for all the cases of the number of attackers under study. In
particular, for the 802.11 network, the Hit Rate has increased
from 89  92 percent in Silhouette Plot and System Evolution
to 98 percent using SILENCE for the case of three attackers
and from 80-82 to 90 percent for the four attackers case.
54 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 1, JANUARY 2013

Fig. 12. Hit Rate and F-measure comparison of SILENCE to methods using cluster analysis alone such as Silhouette and System Evolution.

detection, we can use a target value of 1 to label the result Since the classification of the number of attackers is a
if there are two attackers and a value of 1 to label the multiclass problem, the original binary SVM classifier needs
result if the number of attackers is not 2. Furthermore, the to be extended to a multiclass classifier. In the literature,
features can be the difference of the partition energy and there are many approaches which can be used to combine the
merge energy from System Evolution, or the minimum original binary SVM classifier to k-class classifiers [35], such
distance between two clusters from SILENCE, or the as one-against-all and one-against-one. In our testing, we use
combination of them. The goal of SVM is to produce a model the one-against-one method because it has shorter training
from the training set to predict the target value of data time and better performance than one-against-all [36].
instances (i.e., the testing data).
The training data set can be obtained through regular 4.5.1 Experimental Evaluation
network monitoring activities. Given a training set of To validate the effectiveness of the SVM-based mechanism
instance-label pairs xi ; yi ; i 1; . . . l, where xi 2 Rn is the for determining the number of attackers, we randomly
n dimension features and yi 2 1; 1 is the label, the choose half of the data as training data, whereas the rest of
support vector machines require the solution of the following data for testing. The features we used are the combination of
optimization problem [33]: the difference of partition energy and merge energy from
System Evolution and the minimum distance between two
1 T Xl
min w wC i clusters from SILENCE. Specifically, we used a feature set
w;b; 2 i1 with 10 dimensions, five dimensions from the difference of
24
Subject to yi wT xi b  1  i ; partition energy and merge energy obtained from System
Evolution, and the other five from the minimum distance
i  0:
between clusters. For example, the signal strength data have
Its dual is been partitioned multiple cluster sets (e.g., two, three, four,
five, and six clusters, respectively). For each partition, we
1 T obtain one difference of partition energy and merge energy
min  Q  eT 
 2 using System Evolution and one minimum distance between
Subject to yT  0; 25
clusters. To evaluate the computational cost of the SVM-
0  i  C; i 1; . . . ; l; based method, we implemented SVM on the laptop
equipped with 1 GHz CPU. We found that the online
where e is the vector of all ones, Q is an l by l positive detection time using the SVM-based method is less than 1 ms.
semidefinite matrix, Qij yi yj Kxi ; xj , and Kxi ; xj Table 4 shows experimental results of using SVM-based
xi T xj is called the kernel function. C > 0 is the penalty mechanism when the attacker number i f2; 3; 4g for both
parameter of the error term. The training vectors xi are the 802.11 and 802.15.4 networks. We observed that the
mapped into a higher dimensional space by the function . performance of SVM in both networks are similar. We found
SVM then finds a linear separating hyperplane with the that when the number of attackers equals to 2, the SVM-based
maximal margin in that higher dimensional space. Though
several kernels are being proposed by researchers, we use the
simple linear kernel for our testing [34] TABLE 4
SVM: Hit Rate, Precision, and F-Measure of Determining the
  Number of Attackers
K xi ; xj xTi xj : 26
Furthermore, given a new instance x0 , the decision
function on its label y0 is given by
!
X l  
0 0
y sgn yi i K xi ; x b : 27
i1
YANG ET AL.: DETECTION AND LOCALIZATION OF MULTIPLE SPOOFING ATTACKERS IN WIRELESS NETWORKS 55
   
method achieves the highest Hit Rate (above 99 percent) and di dj
P di  P dj 10i log10  10j log10 : 29
the highest F-measure value, over 98 percent. Moreover, the d0 d0
case of four attackers achieves the highest Precision, above Based on (29), we found that the difference of the
99 percent, which indicates that the detection of the number of corresponding received power between two different land-
attackers is highly accurate; however, the Hit Rate decreases marks is independent of the transmission power levels.
to about 90 percent. Thus, when an adversary residing at a physical location
By comparing the results of SVM to those of Silhouette varies its transmission power to perform a spoofing attack,
Plot, System Evolution and SILENCE methods, we found the difference of the RSS readings between two different
that there is a significant increase of Hit Rate, Precision and F- landmarks from the adversary is a constant since the RSS
measure for all the cases of the number of attackers under readings are obtained from a single physical location. We can
study. This is due to the facts that the SVM-based mechanism then utilize the difference of the medoids vectors in signal
uses the training data to build a prediction model and it also space obtained from SILENCE to localize adversaries.
takes the advantage of the combined features from two 5.2 Algorithms
statistic methods. These results demonstrate that SVM-based
In order to evaluate the generality of IDOL for localizing
mechanism, a classification approach that combines training
adversaries, we have chosen a set of representative localiza-
data and different statistic features is more effective in
tion algorithms ranging from nearest neighbor matching in
performing multiclass attacker detection when multiple
signal space (RADAR [15]), to probability-based (Area-
attackers are present in the system.
Based Probability (ABP) [16]), and to multilateration
(Bayesian Networks (BN) [37]).
5 IDOL: INTEGRATED DETECTION AND RADAR-gridded. The RADAR-Gridded algorithm is a
LOCALIZATION FRAMEWORK scene-matching localization algorithm extended from [15].
RADAR-Gridded uses an interpolated signal map, which is
In this section, we present our integrated system that can built from a set of averaged RSS readings with known x; y
both detect spoofing attacks, determine the number of locations. Given an observed RSS reading with an
attackers, and localize multiple adversaries. The experimen- unknown location, RADAR returns the x, y of the nearest
tal results are presented to evaluate the effectiveness of our neighbor in the signal map to the one to localize, where
approach, especially when attackers using different trans- nearest is defined as the euclidean distance of RSS points
mission power levels. in an N-dimensional signal space, where N is the number
5.1 Framework of landmarks.
Area-based probability. ABP also utilizes an interpo-
The traditional localization approaches are based on
lated signal map [16]. Further, the experimental area is
averaged RSS from each node identity inputs to estimate
divided into a regular grid of equal-sized tiles. ABP
the position of a node. However, in wireless spoofing
assumes the distribution of RSS for each landmark follows
attacks, the RSS stream of a node identity may be mixed
a Gaussian distribution with mean as the expected value of
with RSS readings of both the original node as well as
RSS reading vector s. ABP then computes the probability of
spoofing nodes from different physical locations. The
the wireless device being at each tile Li , with i 1 . . . L, on
traditional method of averaging RSS readings cannot the floor using Bayes rule:
differentiate RSS readings from different locations and thus
is not feasible for localizing adversaries. P sjLi  P Li
Different from traditional localization approaches, our P Li js : 30
P s
integrated detection and localization system utilizes the RSS
medoids returned from SILENCE as inputs to localization Given thatPthe wireless node must be at exactly one tile
algorithms to estimate the positions of adversaries. The satisfying Li1 P Li js 1, ABP normalizes the probability
return positions from our system includes the location and returns the most likely tiles/grids up to its confidence .
estimate of the original node and the attackers in the Bayesian networks. BN localization is a multilateration
physical space. algorithm that encodes the signal-to-distance propagation
Handling adversaries using different transmission model into the Bayesian Graphical Model for localization
power levels. An adversary may vary the transmission [37]. Fig. 13 shows the basic Bayesian Network used for our
study. The vertices X and Y represent location; the vertex si
power levels when performing spoofing attacks so that the
is the RSS reading from the ith landmark; and the vertex Di
localization system cannot estimate its location accurately.
represents the euclidean distance between the location
We examine the pass loss equation that models the received
specified by X and Y and the ith landmark. The value of si
power as a function of the distance to the landmark:
follows a signal propagation model si b0i b1i log Di ,
 
d where b0i ; b1i are the parameters specific to the ith landmark.
P ddBm P d0 dBm  10 log10 ; 28 The distance
d0
q
where P d0 represents the transmitting power of a node at Di X  xi 2 Y  yi 2
the reference distance d0 , d is the distance between the
transmitting node and the landmark, and  is the path loss in turn depends on the location X; Y of the measured
exponent. Further, we can express the difference of the signal and the coordinates (xi , yi ) of the ith landmark. The
received power between two landmarks, i and j, as network models noise and outliers by modeling the si as a
56 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 1, JANUARY 2013

presented in Fig. 15: 1) Adversaries used the same transmis-

sion power levels as the original node and the returned
medoids are used; 2) Adversaries changed their transmission
power level from 15 to 10 dB and the returned medoids are
used; and 3) Adversaries changed their transmission power
level from 15 to 10 dB and the difference of returned medoids
are used. The key observation from Fig. 15 is that the
performance of using the difference of returned medoids in
handling adversaries using different transmission power
levels is comparable to the results when adversaries used the
Fig. 13. Bayesian graphical model in our study. same transmission power levels as the original node. Further,
the localization performance is much worse than the
Gaussian distribution around the above propagation model, traditional approaches if the difference of returned medoids
with variance i : si  Nb0i b1i log Di ; i . Through Markov is not used when localizing adversaries using different
Chain Monte Carlo (MCMC) simulation, BN returns the transmission power levels, shown as the case 2 above. In
sampling distribution of the possible location of X and Y as particular, when using our approach, we can achieve the
the localization result. median error of 13 feet for both RADAR-Gridded and ABP in
case 3, a 40-50 percent performance improvement, compar-
5.3 Experimental Evaluation ing to the median errors of 20 and 19 feet for RADAR-
Fig. 14 presents the localization error CDF when using the Gridded and ABP, respectively, in case 2. Thus, IDOL is
returned RSS medoids from SILENCE and the averaged RSS, highly effective in localizing multiple adversaries with or
respectively, for RADAR-Gridded, ABP, and Bayesian Net- without changing their transmission power levels.
works in two networks. We observed similar localization
performance when using the returned RSS medoids to the
traditional approaches using averaged RSS. Further, Fig. 15
6 CONCLUSION
presents the CDF of localization error of RADAR-Gridded In this work, we proposed to use received signal strength-
and ABP when adversaries using different transmission based spatial correlation, a physical property associated with
power levels. To evaluate the performance of our approach each wireless device that is hard to falsify and not reliant on
by using the difference of returned medoids, three cases are cryptography as the basis for detecting spoofing attacks in

Fig. 14. Comparison of localization errors between using medoids from cluster analysis and using averaged RSS.

Fig. 15. Localization errors when adversaries using different transmission power levels.
YANG ET AL.: DETECTION AND LOCALIZATION OF MULTIPLE SPOOFING ATTACKERS IN WIRELESS NETWORKS 57

wireless networks. We provided theoretical analysis of using [8] J. Yang, Y. Chen, and W. Trappe, Detecting Spoofing Attacks in
Mobile Wireless Environments, Proc. Ann. IEEE Comm. Soc. Conf.
the spatial correlation of RSS inherited from wireless nodes Sensor, Mesh and Ad Hoc Comm. and Networks (SECON), 2009.
for attack detection. We derived the test statistic based on the [9] Y. Chen, W. Trappe, and R.P. Martin, Detecting and Localizing
cluster analysis of RSS readings. Our approach can both Wireless Spoofing Attacks, Proc. Ann. IEEE Comm. Soc. Conf.
detect the presence of attacks as well as determine the Sensor, Mesh and Ad Hoc Comm. and Networks (SECON), May 2007.
number of adversaries, spoofing the same node identity, so [10] M. Bohge and W. Trappe, An Authentication Framework for
Hierarchical Ad Hoc Sensor Networks, Proc. ACM Workshop
that we can localize any number of attackers and eliminate Wireless Security (WiSe), pp. 79-87, 2003.
them. Determining the number of adversaries is a particu- [11] L. Xiao, L.J. Greenstein, N.B. Mandayam, and W. Trappe,
larly challenging problem. We developed SILENCE, a Fingerprints in the Ether: Using the Physical Layer for Wireless
mechanism that employs the minimum distance testing in Authentication, Proc. IEEE Intl Conf. Comm. (ICC), pp. 4646-4651,
June 2007.
addition to cluster analysis to achieve better accuracy of [12] V. Brik, S. Banerjee, M. Gruteser, and S. Oh, Wireless Device
determining the number of attackers than other methods Identification with Radiometric Signatures, Proc. 14th ACM Intl
under study, such as Silhouette Plot and System Evolution, Conf. Mobile Computing and Networking, pp. 116-127, 2008.
that use cluster analysis alone. Additionally, when the [13] F. Guo and T. Chiueh, Sequence Number-Based MAC Address
Spoof Detection, Proc. Eighth Intl Conf. Recent Advances in
training data are available, we explored using Support Vector Intrusion Detection, pp. 309-329, 2006.
Machines-based mechanism to further improve the accuracy [14] L. Sang and A. Arora, Spatial Signatures for Lightweight Security
of determining the number of attackers present in the system. in Wireless Sensor Networks, Proc. IEEE INFOCOM, pp. 2137-
To validate our approach, we conducted experiments on 2145, 2008.
two testbeds through both an 802.11network (WiFi) and an [15] P. Bahl and V.N. Padmanabhan, RADAR: An in-Building RF-
Based User Location and Tracking System, Proc. IEEE
802.15.4 (ZigBee) network in two real office building INFOCOM, 2000.
environments. We found that our detection mechanisms [16] E. Elnahrawy, X. Li, and R.P. Martin, The Limits of Localization
are highly effective in both detecting the presence of attacks Using Signal Strength: A Comparative Study, Proc. IEEE Intl
with detection rates over 98 percent and determining the Conf. Sensor and Ad Hoc Comm. and Networks (SECON), Oct. 2004.
[17] Y. Chen, J. Francisco, W. Trappe, and R.P. Martin, A Practical
number of adversaries, achieving over 90 percent hit rates Approach to Landmark Deployment for Indoor Localization,
and precision simultaneously when using SILENCE and Proc. IEEE Intl Conf. Sensor and Ad Hoc Comm. and Networks
SVM-based mechanism. Further, based on the number of (SECON), Sept. 2006.
attackers determined by our mechanisms, our integrated [18] J. Yang and Y. Chen, A Theoretical Analysis of Wireless
Localization Using RF-Based Fingerprint Matching, Proc. Fourth
detection and localization system can localize any number of Intl Workshop System Management Techniques, Processes, and
adversaries even when attackers using different transmis- Services (SMTPS), Apr. 2008.
sion power levels. The performance of localizing adversaries [19] P. Enge and P. Misra, Global Positioning System: Signals, Measure-
achieves similar results as those under normal conditions, ments and Performance. Ganga-Jamuna Press, 2001.
[20] Z. Yang, E. Ekici, and D. Xuan, A Localization-Based Anti-Sensor
thereby, providing strong evidence of the effectiveness of
Network System, Proc. IEEE INFOCOM, pp. 2396-2400, 2007.
our approach in detecting wireless spoofing attacks, deter- [21] T. He, C. Huang, B. Blum, J.A. Stankovic, and T. Abdelzaher,
mining the number of attackers and localizing adversaries. Range-Free Localization Schemes in Large Scale Sensor Net-
works, Proc. MobiCom 03, 2003.
[22] Y. Chen, W. Trappe, and R. Martin, Attack Detection in Wireless
ACKNOWLEDGMENTS Localization, Proc. IEEE INFOCOM, Apr. 2007.
[23] A. Goldsmith, Wireless Communications: Principles and Practice.
This work is supported in part by the US National Science Cambridge Univ. Press, 2005.
Foundation (NSF) Grants CNS-0954020, CCF-1018270. This [24] T. Sarkar, Z. Ji, K. Kim, A. Medouri, and M. Salazar-Palma, A
work was done while J. Yang was at Stevens Institute of Survey of Various Propagation Models for Mobile Communica-
Technology. tion, IEEE Antennas and Propagation Magazine, vol. 45, no. 3,
pp. 51-82, June 2003.
[25] M. Abramowitz and I.A. Stegun, Handbook of Mathematical
REFERENCES Functions with Formulas, Graphs, and Mathematical Tables. Courier
Dover, 1965.
[1] J. Bellardo and S. Savage, 802.11 Denial-of-Service Attacks: Real [26] L. Kaufman and P.J. Rousseeuw, Finding Groups in Data: An
Vulnerabilities and Practical Solutions, Proc. USENIX Security Introduction to Cluster Analysis. Wiley Series in Probability and
Symp., pp. 15-28, 2003. Statistics, 1990.
[2] F. Ferreri, M. Bernaschi, and L. Valcamonici, Access Points [27] G. Zhou, T. He, S. Krishnamurthy, and J.A. Stankovic, Models
Vulnerabilities to Dos Attacks in 802.11 Networks, Proc. IEEE and Solutions for Radio Irregularity in Wireless Sensor Net-
Wireless Comm. and Networking Conf., 2004. works, ACM Trans. Sensor Networks, vol. 2, pp. 221-262, 2006.
[3] D. Faria and D. Cheriton, Detecting Identity-Based Attacks in
[28] Y. Chen, K. Kleisouris, X. Li, W. Trappe, and R.P. Martin, The
Wireless Networks Using Signalprints, Proc. ACM Workshop
Robustness of Localization Algorithms to Signal Strength Attacks:
Wireless Security (WiSe), Sept. 2006.
A Comparative Study, Proc. Intl Conf. Distributed Computing in
[4] Q. Li and W. Trappe, Relationship-Based Detection of Spoofing-
Sensor Systems (DCOSS), pp. 546-563, June 2006.
Related Anomalous Traffic in Ad Hoc Networks, Proc. Ann. IEEE
Comm. Soc. on IEEE and Sensor and Ad Hoc Comm. and Networks [29] C. van Rijsbergen, Information Retrieval, second ed. Butterworths,
(SECON), 2006. 1979.
[5] B. Wu, J. Wu, E. Fernandez, and S. Magliveras, Secure and [30] T. Fawcett, An Introduction to ROC Analysis, Pattern Recogni-
Efficient Key Management in Mobile Ad Hoc Networks, Proc. tion Letters, vol. 27, pp. 861-874, 2006.
IEEE Intl Parallel and Distributed Processing Symp. (IPDPS), 2005. [31] P. Rousseeuw, Silhouettes: A Graphical Aid to the Interpretation
[6] A. Wool, Lightweight Key Management for IEEE 802.11 Wireless and Validation of Cluster Analysis, J. Computational and Applied
Lans With Key Refresh and Host Revocation, ACM/Springer Math., vol. 20, no. 1, pp. 53-65, Nov. 1987.
Wireless Networks, vol. 11, no. 6, pp. 677-686, 2005. [32] K. Wang, Estimating the Number of Clusters via System
[7] Y. Sheng, K. Tan, G. Chen, D. Kotz, and A. Campbell, Detecting Evolution for Cluster Analysis of Gene Expression Data,
802.11 MAC Layer Spoofing Using Received Signal Strength, Technical Report NO. 2007-258, Computer Science Dept., Xidian
Proc. IEEE INFOCOM, Apr. 2008. Univ., P.R. China, 2007.
58 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 24, NO. 1, JANUARY 2013

[33] N. Cristianini and J. Shawe-Taylor, An Introduction to Support Wade Trappe received the BA degree in
Vector Machines and Other Kernel-Based Learning Methods. Cam- mathematics from the University of Texas at
bridge Univ. Press, 2000. Austin in 1994 and the PhD degree in applied
[34] C.-C. Chang and C.-J. Lin, LIBSVM: A Library for Support Vector mathematics and scientific computing from the
Machines, Software, http://www.csie.ntu.edu.tw/cjlin/libsvm, University of Maryland, College Park, in 2002.
2001. He is currently an associate director with the
[35] V. Franc and V. Hlavac, Multi-Class Support Vector Machine, Wireless Information Network Laboratory and an
Proc. Intl Conf. Pattern Recognition (ICPR), vol. 16, pp. 236-239, associate professor with the Department of
2002. Electrical and Computer Engineering, Rutgers,
[36] C. Hsu and C. Lin, A Comparison of Methods for Multiclass The State University of New Jersey, Piscataway.
Support Vector Machines, IEEE Trans. Neural Networks, vol. 13, His research interests include wireless security, wireless networking,
no. 2, pp. 415-425, Mar. 2002. multimedia security, and network security. He has led projects that
[37] D. Madigan, E. Elnahrawy, R. Martin, W. Ju, P. Krishnan, and A.S. involve security and privacy for sensor networks, physical-layer security
Krishnakumar, Bayesian Indoor Positioning Systems, Proc. IEEE for wireless systems, a security framework for cognitive radios, the
INFOCOM, pp. 324-331, Mar. 2005. development of wireless testbed resources, and new radio frequency
identification technologies. Recently, his research group has developed
Jie Yang received the PhD degree in computer several cross-layer security mechanisms for wireless networks and
engineering from Stevens Institute of Technol- mechanisms for jamming detection and defense for wireless networks
ogy in 2011. He is currently an assistant and has investigated privacy-enhancing routing methods for wireless
professor in the Department of Computer networks. He has published more than 100 papers, including two papers
Science and Engineering at Oakland University. in media security and one paper on the localization of cognitive radios
He was a postdoctoral fellow in the Data (for which he received the Best Paper Awards) and several wireless
Analysis and Information Security (DAISY) security papers in premier conference proceedings. His experience in
Laboratory at Stevens Institute of Technology. network security and wireless systems spans 12 years, and he is a
His research interests include cyber security and coauthor of the popular textbook Introduction to Cryptography With
privacy, mobile and pervasive computing, wire- Coding Theory and four other books on wireless systems and
less localization systems, and mobile social networks. He is the recipient multimedia security. He is a member of the IEEE, the IEEE Signal
of the Best Paper Award from ACM International Conference on Mobile Processing Society, the IEEE Communications Society, and the
Computing and Networking (MobiCom) 2011 and the Outstanding Association for Computing Machinery.
Research Award in 2009 from Stevens Institute of Technology. His
research has received wide press coverage including MIT Technology Jerry Cheng received the PhD degree in
Review, The Wall Street Journal, CNET News, and Yahoo News. He is a statistics from Rutgers University. He is currently
student member of the IEEE. an assistant professor in Robert Wood Johnson
Medical School at the University of Medicine and
Yingying (Jennifer) Chen received the PhD Dentistry of New Jersey (UMDNJ). His research
degree in computer science from Rutgers Uni- interests include data mining and learning,
versity. She is currently an associate professor statistical modeling and data analysis, clustering
in the Department of Electrical and Computer analysis and algorithms, statistical applications
Engineering at Stevens Institute of Technology. in engineering, and biostatistics. Prior to the
Her research interests include cyber security current position, he was a postdoctoral research
and privacy, wireless and sensor networks, scholar with the Department of Statistics at Columbia University.
mobile social networks and pervasive comput-
ing. She has coauthored the book Securing
Emerging Wireless Systems and published . For more information on this or any other computing topic,
extensively in journal and conference papers. Prior to joining Stevens please visit our Digital Library at www.computer.org/publications/dlib.
Institute of Technology, she was with Alcatel-Lucent. She received the
IEEE Outstanding Contribution Award from IEEE New Jersey Coast
Section each year 2005-2009. She is the recipient of the US National
Science Foundation (NSF) CAREER award. She is the recipient of
Google Research Award 2010 and the Best Paper Award from ACM
International Conference on Mobile Computing and Networking (Mobi-
Com) 2011. She is also the recipient of the Best Paper Award from the
International Conference on Wireless On-demand Network Systems
and Services (WONS) 2009, as well as the Best Technological
Innovation Award from the International TinyOS Technology Exchange
2006. She is a senior member of the IEEE.