IEEE 802.11 DoS attack detection and mitigation utilizing Cross Layer Design

Abstract

Denial of Service (DoS) attack is a powerful attack that disrupts the network and deprives the legitimate users from utilizing the network resources. DoS attacks could be implemented to target any layer of the Open Systems Interconnection (OSI) layers, in this paper we are focusing on DoS attacks that target the Medium Access Control (MAC) layer in wireless networks. We present a complete solution using Cross Layer Design techniques to detect and identify the attackers and to mitigate the attack by minimizing the negative impact on the network. DoS attacks could range from plain attacks which do not require any protocol modifications or intelligence during the attack like the signal jamming attack to sophisticated attacks where the attacker is intelligent and aware of its surroundings and constantly modifying its behavior during the attack to appear as a legitimate node to avoid detection. In this paper we are focusing on the sophisticated DoS attack in wireless networks using IEEE 802.11 Distributed Coordination Function (DCF) protocols [1–3], where the attacker is striving to appear as a legitimate member of the network and fully joined the network group and possesses for instance the spread sequence or the channel coding scheme. The algorithm is examined in fixed and mobile environments with multiple Physical (PHY) layer technologies (DSSS, FHSS, and OFDM) using different MAC layer protocols (IEEE 802.11, IEEE 802.11b, and IEEE 802.11g). DoS attackers illegally alter the IEEE 802.11 DCF standards and modify the MAC firmware code in the Network Interface Card (NIC) on their communication equipment to capture the channel by maximizing the packet transmission success rate to a degree where all other legitimate node will have near zero percent success rate for their packet transmissions. This type of DoS attack generally results in bandwidth starvation and extreme power and CPU processing consumption to the legitimate nodes in the network. Two-dimensional Markov Chain is modeled to obtain the maximum throughput to identify the DoS attackers and the rest of the presented algorithm mitigates the impact of the attackers while deceiving the attackers and make them falsely believe that the attacks are still disrupting the network so they do not resort to modifying the attacking techniques. The algorithm is validated using network simulations under different condition using different technologies.