PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Learning for Launching and Mitigating Wireless Jamming Attacks

Tugba Erpek, Yalin E. Sagduyu, Yi Shi

arXiv:1807.02567v2cs.NIcs.LGstat.ML

TL;DR

The paper studies how a jammer can learn to target successful cognitive-radio transmissions and how the transmitter can defend itself. It combines adversarial deep learning, power control, GAN-based data augmentation, and controlled transmitter errors. Exploratory jamming reduces throughput substantially, while the proposed defense improves it from 0.050 to 0.216 packet/slot in the studied scenario.

  • Problem

    Machine-learning-based cognitive radios may be vulnerable to adversaries, but their jamming and mitigation implications are not well understood.

  • Method

    The paper trains a jammer to predict ACK-producing transmissions, controls its power using classification scores, augments scarce data with a GAN, and defends through selected transmitter decision errors.

  • Results

    0.050 to 0.216 packet/slot: carefully selected transmitter errors significantly improve performance against the learned jammer; exploratory jamming reduces throughput from 0.766 to 0.050 packet/slot.

  • Takeaways & Limitations

    A transmitter can use a small, adaptive causative defense to mislead a learned jammer and improve throughput, whereas random and sensing-based jamming are not mitigated by this defense.

Abstract

from arXiv · show

An adversarial machine learning approach is introduced to launch jamming attacks on wireless communications and a defense strategy is presented. A cognitive transmitter uses a pre-trained classifier to predict the current channel status based on recent sensing results and decides whether to transmit or not, whereas a jammer collects channel status and ACKs to build a deep learning classifier that reliably predicts the next successful transmissions and effectively jams them. This jamming approach is shown to reduce the transmitter's performance much more severely compared with random or sensing-based jamming. The deep learning classification scores are used by the jammer for power control subject to an average power constraint. Next, a generative adversarial network (GAN) is developed for the jammer to reduce the time to collect the training dataset by augmenting it with synthetic samples. As a defense scheme, the transmitter deliberately takes a small number of wrong actions in spectrum access (in form of a causative attack against the jammer) and therefore prevents the jammer from building a reliable classifier. The transmitter systematically selects when to take wrong actions and adapts the level of defense to mislead the jammer into making prediction errors and consequently increase its throughput.

I. INTRODUCTION

The paper applies adversarial machine learning to cognitive-radio jamming, exploiting learned transmission behavior and addressing vulnerabilities that remain insufficiently understood. It develops power control, GAN-based data augmentation, and a transmitter-side defense using controlled decision errors.

  • Adversarial machine learning is used to design wireless jamming attacks and mitigation solutions for cognitive radios.
  • The jammer learns from spectrum observations and ACK feedback to predict successful transmissions rather than merely detecting idle channels.Its prediction target differs from the transmitter’s channel-status classifier because jamming should target transmissions that would otherwise succeed.
  • 0.050 packet/slot versus 0.766 packet/slot: exploratory jamming sharply reduces transmitter throughput in the studied scenario.Random and sensing-based jamming leave throughput at 0.383 and 0.140 packet/slot, respectively.
  • Relaxing the jammer’s power budget improves jamming success while reducing transmitter throughput and success ratio.The jammer selects transmit power from its deep-learning classification score under an average power constraint.
  • Within 0.19% for misdetection and 3.14% for false alarm, GAN-augmented training approaches the jammer’s performance with more real data.The GAN generates labeled synthetic samples from a small real dataset to shorten the learning period.
  • 0.216 packet/slot versus 0.050 packet/slot: carefully selected wrong transmitter actions significantly improve performance against the learned jammer.The defense uses classifier scores to choose actions and adapts its defense level based on achieved throughput; it does not mitigate random or sensing-based jamming.

II. RELATED WORK

The paper builds on machine-learning and game-theoretic wireless-security research while specifying a single-channel cognitive-radio model with transmitter, receiver, jammer, and background traffic.

  • Related work: Prior work includes deep learning for spectrum sensing, GAN-based training-data augmentation, neural-network channel estimation, and modulation classification.
  • Related work: Related anti-jamming research uses physical-layer countermeasures, adaptive access protocols, jamming games, stochastic games, reinforcement learning, and statistical intrusion detection.
  • Related work: This work differs from many prior studies by applying machine learning directly to the jammer’s attack strategy.
  • System model: The system model contains one transmitter, one receiver, one jammer, and an unknown background traffic source on a single channel.
  • System model: The transmitter senses each slot and transmits when the channel is detected idle, while the jammer predicts successful transmissions and jams only those slots.
  • System model: A transmission succeeds when receiver SINR exceeds threshold β, with ACK feedback sent during the slot’s ending period.

B. Classifiers of Transmitter and Jammer

The transmitter and jammer use separate classifiers because their sensing inputs differ, and the jammer learns to predict ACK-producing transmissions from its own observations.

  • Transmitter sensing results s_T(t) and jammer sensing results s_J(t) can differ because the devices occupy different locations and experience different channels.
  • The transmitter’s pre-trained classifier maps K_T recent sensing results to an idle-or-busy channel decision.Its feature vector is x_T(t)=(s_T(t−K_T+1),…,s_T(t)).
  • The two classifiers are not required to share inputs or outputs: the transmitter predicts channel status, whereas the jammer predicts successful transmission.
  • The jammer trains classifier C_J on K_J recent sensing results and ACK outcomes to predict whether a transmission will succeed.It then maps those features to a jamming decision.

C. Performance Measures

Classifier quality is evaluated with misdetection and false-alarm probabilities, while transmitter performance is measured by throughput and success ratio.

  • Both classifiers optimize their hyperparameters to minimize max{e_MD, e_FA}, controlling the larger class-specific error.
  • Transmitter misdetection means an idle slot is predicted busy, while transmitter false alarm means a busy slot is predicted idle.
  • Jammer misdetection means a successful transmission is predicted without an ACK, whereas jammer false alarm predicts an ACK when transmission is absent or would fail unjammed.
  • Throughput is received packets divided by time slots, and success ratio is successful transmitter transmissions divided by all transmitter transmissions.

IV. TRANSMITTER’S OPERATION

The transmitter trains a deep-learning classifier on recent RSSI sensing results to predict channel status and guide spectrum access. Its classifier is trained and evaluated using collected samples, with hyperparameters optimized for sensing errors.

  • Transmitter sensing and classification: The transmitter records the most recent K_T RSSI results and uses them to construct the classifier’s feature set for each time slot.For numerical results, K_T = 10.
  • Training procedure: The transmitter collects 1000 samples, splits them evenly into training and test sets, and trains an FNN classifier returning “idle” or “busy” labels.The hyperparameters minimize max{e_MD, e_FA}.
  • Classifier design: The FNN uses one hidden layer with 100 neurons, cross-entropy loss, backpropagation, softmax output activation, and sigmoid hidden-layer activations.Weights and biases are initialized randomly in [−1.0, 1.0].
  • Training configuration: Training uses unit normalization on the first pass, minibatches of 25, momentum coefficient 0.9, and 10 epochs per time slot.The classifier is evaluated over 500 time slots after training.

V. JAMMER’S OPERATION

The jammer infers successful future transmissions rather than merely classifying channel occupancy, using its own sensing results and detected ACKs to train a deep-learning classifier. After training, it jams slots predicted to contain successful transmissions, producing a large throughput reduction in the evaluated scenario.

  • Adversarial classifier construction: Because jammer and transmitter observations differ across locations and channel realizations, the jammer cannot simply clone the transmitter’s classifier from identical inputs.The jammer instead learns from its own observations and transmission outcomes.
  • Adversarial classifier construction: The jammer’s features are its sensing results, while its labels are “ACK” and “no ACK,” representing whether a successful transmission is predicted.A successful transmission requires transmitter access and receiver SINR above threshold.
  • Attack operation: The jammer detects ACK transmissions, collects training samples, trains a classifier, and then predicts future successful transmissions without continuing to collect ACKs during attack.ACKs are assumed reliably detectable because they are short, delayed, and coded for lower required SNR than data packets.
  • Classifier implementation: The jammer trains an FNN using 1000 samples split evenly into training and test data, with two hidden layers of 50 neurons and softmax output activation.Training, including hyperparameter optimization, takes 67 seconds; testing takes 0.024 milliseconds per sample.
  • Attack performance: The attack reduces transmitter throughput from 0.766 packet/slot to 0.05 packet/slot and success ratio from 95.75% to 6.25%.Under attack, 25 successful transmissions remain among 400 transmissions.

B. Sensing-based and Random Jamming as Benchmark Schemes

Sensing-based and random jamming provide benchmark attacks against which deep-learning jamming is compared. The sensing-based jammer depends strongly on its threshold, while deep-learning jamming uses recent sensing history and classification scores.

  • Sensing-based jamming: The sensing-based jammer transmits when received sensing power exceeds a threshold τ.Its performance depends on the selected threshold.
  • Sensing-based jamming: A low τ increases false alarms and power use, whereas a high τ increases misdetections.The evaluated threshold τ = 3.4 minimizes max{e_MD, e_FA}.
  • Benchmark comparison: Random jamming makes decisions without using sensing results, while sensing-based jamming uses only the current slot’s sensing result.Deep-learning jamming instead uses recent sensing results and a likelihood score.

C. Jamming Power Control with an Average Power Constraint

The jammer controls transmit power using deep-learning classification scores while satisfying an average power constraint. As the available average power increases, it can jam more predicted opportunities and reduce transmitter performance more strongly.

  • Score-based power control: The jammer adjusts slot power p_t between P_min and P_max according to the classifier score s, with lower scores receiving greater jamming power.Scores s ≤ S identify slots classified as containing ACKs, and p(s) is designed as a decreasing function.
  • Score-based power control: The power-control design allocates zero power or a value in [P_min, P_max], depending on classification confidence and the average budget P_avg.The piecewise-linear function is constructed to satisfy the budget using training-data score distributions.
  • Power-control assumption: The analysis assumes the training and test distributions of classification scores are the same, although they may differ in practice.The paper notes that the distributions are similar but not necessarily identical.
  • Power-budget effect: With P_min = 500N_0 and P_max = 1000N_0, increasing P_avg lets the jammer successfully jam more transmissions and worsens transmitter throughput and success ratio.P_avg = 0 corresponds to no attack, while P_avg = P_max corresponds to no power budget.

VI. JAMMING ATTACK WITH LIMITED TRAINING DATA COLLECTED

The jammer uses a conditional GAN to augment limited real training data with labeled synthetic spectrum samples, shortening the learning period while approaching the performance of training with many real samples.

  • GAN-based data augmentation: The conditional GAN trains a generator and discriminator in a minimax process, with the generator producing realistic labeled spectrum data.The implementation uses FNNs for both networks and trains them with backpropagation.
  • GAN training: After approximately 3000 epochs, the initial fluctuations in generator and discriminator losses drop significantly, so training stops at 3500 epochs.The stopping point is selected based on observed loss stabilization.
  • Learning-period reduction: 33 seconds with the GAN versus 500 seconds without it reduces the time needed to prepare jammer training data before success-transmission prediction.The GAN workflow uses 10 seconds to collect real samples and 23 seconds to train and generate synthetic samples.
  • GAN-based data augmentation: The jammer applies a conditional GAN to generate 500 labeled synthetic samples from 10 real samples for classifier training.The generator creates labeled data while the discriminator distinguishes real from synthetic samples.
  • Performance evaluation: 7.62% false alarm and 10.71% misdetection result when 500 synthetic samples augment the limited real training data.These errors are much smaller than using only 10 real samples and close to training with 500 real samples.

VII. DEFENSE SCHEME

The transmitter defends against adversarial deep-learning jamming by selectively flipping transmission decisions to poison the jammer’s training data, using classifier scores to limit defense overhead.

  • Defense mechanism: The transmitter flips selected labels by transmitting on predicted-busy channels or withholding transmission on predicted-idle channels.These deliberately wrong actions poison the jammer’s exploratory-attack training process.
  • Defense mechanism: The transmitter selects defense slots using its classifier’s likelihood scores, concentrating wrong actions where classification confidence is lower.The classifier uses a 0.25 threshold for idle-versus-busy decisions, and scores farther from the threshold indicate higher confidence.
  • Defense against adversarial deep learning-based jamming: 10% defense operations increase jammer misdetection from 4.18% to 17.53% and false alarm from 14.53% to 23.68%.Increasing defense operations can improve throughput until excessive wrong decisions reduce the transmitter’s performance.

C. Defense against Unknown Jammer Types

Because the transmitter may not know the jammer type, it searches for the defense level that maximizes throughput and adapts it as attacks or network conditions change.

  • Adaptive defense: The adaptive defense begins at a fixed level and adjusts it using throughput measured from received ACK messages.This allows mitigation without assuming prior knowledge of the jammer type.
  • Adaptive defense: For adversarial deep-learning jamming, defense requires pd > 0, whereas random or sensing-based jamming has optimal defense level pd = 0.The transmitter searches defense levels based on achieved throughput.
  • Adaptive defense: A linear search evaluates defense levels and refines the neighborhood of the current best value until no improvement or the target granularity is reached.The paper also notes that more advanced searches, such as golden section search, can reduce search iterations.
  • Adaptive defense: The best defense level in the reported adversarial-deep-learning case is pd = 20%, while pd = 0% is optimal for sensing-based and random jammers.The defense level can adapt when the jammer type changes, assuming convergence is faster than those changes.
  • Extension to mobile setting: With increasing jammer-to-background-source distance, channel-condition learning becomes more difficult and the transmitter achieves better throughput and success ratio.With increasing jammer-to-receiver distance, jamming interference decreases, improving transmitter performance even when prediction errors do not change.

B. Extension of Communication Setting

The setting extends to multiple transmitters and receivers while retaining one independently operating jammer that predicts successful transmissions rather than identifying their sources.

  • Extension to multiple transmitters and receivers: Multiple transmitters and receivers can be supported by incorporating interference from non-intended transmitters into receiver sensing data.The transmitter still predicts whether received signal strengths will be good based on past signal strengths.
  • Jammer deployment: A single jammer can serve a neighboring area and operate independently because jammers may be deployed sparsely.The extension retains one jammer rather than assigning a separate classifier to each transmitter.
  • Jammer prediction target: The jammer predicts whether any successful transmissions will occur, eliminating the need to identify corresponding transmitters or build per-transmitter classifiers.This keeps the jammer’s prediction target at the level of successful transmissions.
  • Overall system design: The proposed attack combines deep-learning prediction, classification-score-based power control, GAN data augmentation, and an intentional-action defense.The attack reduces transmitter throughput and success ratio relative to random and sensing-based jamming, while GAN augmentation shortens the learning period.
Loading 1807.02567v2…