© The Author(s) 2023. Published by EDP Sciences and China Science Publishing & Media Ltd.

1. Introduction

The broadcast-based communication has made wireless networks vulnerable to jamming attacks and to radio interference. The increasingly flexible programming interfaces of commodity devices (e.g., software-defined radios) have enabled adversaries to build jammers with little effort to disturb network communication. Even without malicious jammers, the tension between the proliferation of wireless technologies and the limited number of unlicensed bands has made and will continue to make the radio environment crowded, causing unintentional radio interference across devices that leverage different wireless technologies but share the same spectrum, e.g., WiFi and Bluetooth. Multiple instances of jamming attacks and unintentional radio interference may co-exist in the network, and they will continue to be one of the most urgent threats harming the dependability of wireless communication and endangering the successful deployment of pervasive applications built on top of wireless networks. Since both jamming attacks and radio interference can prevent networks from delivering information, we use the term jamming to refer to both threats in this paper.

To ensure the dependability of wireless communication, much work has been done to detect and defend against jamming attacks. In terms of detection, single-statistics-based and consistent-check-based algorithms [1] have been proposed. The existing countermeasures for coping with jamming include two types: the proactive conventional physical-layer techniques that provide resilience to interference by employing advanced transceivers [2], e.g., frequency hopping, and the reactive non-physical-layer strategies that defend against jamming leveraging MAC or network layer mechanisms [3, 4], e.g., adaptive error correcting codes, channel adaption. Those defense technologies provide useful methods to alleviate jamming. However, they primarily rely on the network to passively adjust themselves without leveraging the information of the jammer. We take a different viewpoint, that is, networks should identify the physical location of a jammer and use such information to actively exploit a wide range of defense strategies in various layers. For instance, a routing protocol can choose a route that does not traverse the jammed region to avoid wasting resources caused by failed packet deliveries. Furthermore, once a jammer’s location is identified, one can eliminate the jammer from the network by neutralizing it. This approach is especially useful for coping with unintentional radio interference that is turned on accidentally. In this paper, we aim to address the problem of localizing multiple jamming attackers coexist in a wireless network.

Although there has been active research in the area of localizing a wireless device [5–7], most of those localization schemes are inapplicable to jamming scenarios. For instance, many localization schemes require the wireless device to be equipped with specialized hardware [5, 8], e.g., ultrasound or infrared, or utilize signals transmitted from wireless devices to perform localization. Unfortunately, the jammer will not cooperate and the jamming signal is usually embedded in the legal signal and thus, is hard to extract, making the signal-based and special-hardware-based approaches inapplicable. Regarding jammer localization, only a few algorithms [9, 10] have been proposed to localize one jammer. Without presenting a performance evaluation, Pelechrinis et al. [10] proposed to localize the jammer by performing a gradient descent search based on packet delivery rate (PDR). Liu et al. [9, 11] have designed two algorithms that utilize the network topology changes caused by jamming attacks to estimate the jammer’s position: one is a virtual-force-based jammer localization algorithm [9] and the other is a least-squares-based localization scheme [11]. Prior work can localize one jammer, but will not perform well in the presence of multiple jammers, which can cause severe network communication disturbance on a large scale. Furthermore, multiple jammers may have overlapping jamming regions and form only one connected jammed area. Therefore, the problem of multiple-jammer localization still persists and needs appropriate solutions.

In this paper, we systematically studied the effects of multiple jammers and developed a framework utilizing network topology changes under jamming to locate multiple jamming attackers. The two main components in our framework, namely the automatic network topology partitioner and intelligent multi-jammer localizer, work together to derive different categories of node clusters and achieve high localization accuracy even under overlapping jammed areas. We conducted real experiments using MicaZ sensor nodes in a multi-hop network setup with two jammers. Our experimental results confirmed that we are able to collect the network topology changes in spite of the disturbed network communication under jamming. We further performed simulations under various large-scale network setups. Our extensive simulation results demonstrated that our framework can effectively partition the network topology under the presence of multiple jamming attackers and further localize these jammers with high accuracy with or without prior knowledge of the order in the jammers are turned on. The main contribution of this paper is summarized as follows:

• We propose a new multi-jammer localization framework consisting of an automatic network topology partitioner and intelligent multi-jammer localizer, which could deal with both cases of sequentially and simultaneously turning on jammers.

• To localize multiple jammers with appropriate localization methods, we develop a new localization strategy in our intelligent multi-jammer localizer based on the jammed and boundary cluster classification results.

• We conducted real experiments using MicaZ sensor nodes in a multi-hop network setup, and the experimental results confirmed the capability of our proposed automatic network topology partitioner to collect the network topology changes under jamming.

• To evaluate the localization performance of the proposed framework, we conduct large-scale simulations by taking the example with 3 jammers both sequentially and simultaneously turning on for illustration. The localization results confirm the feasibility of our proposed multiple jammer localization strategy.

The remainder of the paper is organized as follows: We first discuss our work in the context of existing studies in Section 2. We then specify our jamming attack model and analyze the jamming effects in Section 3. The feasibility of our approach utilizing the network topology changes is validated through real experiments in Section 4. We present our framework and algorithms that are developed to partition the network topology and localize multiple jamming attackers in Section 5. We next conduct extensive simulations to validate our approach in Section 8. Finally, we conclude our work in Section 9.

2. Related work

Jamming and radio interference are known threats and have attracted much attention [12]. Traditionally, jamming is addressed through conventional PHY-layer communication techniques, e.g., spreading techniques. While these techniques provide resilience to interference [2], they require advanced transceivers. Jamming detection has been studied by Xu et al. [1] in the context of commodity wireless devices and in the context of sensor networks [13]. Our work focuses on localizing jammers after identifying jamming attacks using these detection strategies.

Numerous countermeasures have been proposed for coping with jamming in commodity wireless networks. Defense strategies include the use of error correcting codes [3] to increase the likelihood of decoding corrupted packets, channel hopping [4, 14, 15] to adapt the working channel to escape from jamming, spatial retreats [16] to move out of jammed region geographically, anti-jamming timing channel [17], and wormhole-based anti-jamming techniques [18].

Wireless localization, which has been an active area of research, employs infrared [5] and ultrasound [8, 19] based on localization infrastructure, both of which require specialized infrastructure for localization. Furthermore, received signal strength (RSS) [6, 7, 20, 21] is an attractive approach because it can reuse the existing wireless infrastructure.

Localization algorithms can be categorized into range-based and range-free based on the localization methodology. Range-based algorithms involve estimating the distance to anchor points with known locations by utilizing the measurement of various physical properties, such as RSS [7], Time of Arrival [22], and Time Difference of Arrival [8]. Range-free algorithms [23–26] use coarser metrics to place bounds on candidate positions. However, these approaches are mostly inapplicable to localize jammers, as the jammer will not cooperate, and the regular radio signal is disturbed under jamming.

Recently, several methods have been proposed for localizing individual jammers. Pelechrinis et al. [10] suggested measuring PDR and performing a gradient descent search to locate the jammer. Liu et al. [9] proposed a method that estimates the jammer’s position by using virtual forces derived from network topology changes caused by jamming attacks. Both methods [9, 10] require an iterative search for the jammer’s location. Liu et al. [11] developed a lease-squares-based algorithm that leverages the change of hearing range caused by jamming to localize the jammer in one round. Kim et al. [27] used power adaptation techniques to localize a jammer, assuming an ideal Friis transmission model and not considering radio irregularity. However, these algorithms only localize one jammer and may not be effective in locating multiple jammers, which is the problem addressed in this paper.

3. Model

In this section, we introduce our adversary and network models, followed by an analysis of jamming effects in the presence of multiple jammers.

3.1. Adversary model

We consider the presence of multiple jammers in the network and aim to localize each of them. Regardless of their attack strategies, jammers have similar effects: nodes close to jammers experience severe communication disruption, while nodes farther away may not be affected at all. Therefore, we assume that jammers transmit at the same fixed power level, without investigating diverse jamming attack philosophies. To simplify the problem, we consider the scenario where two jammers transmit at the same power level and become active either sequentially or simultaneously. The simultaneous activation of two jammers presents greater challenges than the sequential case since it does not reveal any information about individual jammers but all of them as a whole. It is worth noting that our strategies can be easily extended to localize more than two jammers.

3.2. Network model

We design our solutions for a category of wireless networks with the following characteristics.

• Stationary. The nodes in our considered network remain stationary after their deployment. In future works, we will investigate mobile nodes.

• Neighbor-aware. Each node is equipped with an omnidirectional antenna and transmits at the same transmission power level. Therefore, each node shares the same communication range and can only receive messages from other nodes within its communication range. We refer to these nodes as “neighbors” of a particular node. To keep track of their neighbors, each node maintains a neighbor table containing the IDs of neighboring nodes and updates this table as needed. This is supported by most routing protocols and can be easily implemented by periodically broadcasting beacons.

• Location-aware. Each node is aware of its own location. This is reasonable as most wireless devices are equipped with GPS or some other approximate but less burdensome localization algorithms [6, 7, 12].

• Able to detect jamming. In this work, we focus on locating jammers after they are detected. Thus, we assume the network is able to identify a jamming attack and the number of jammers, leveraging the existing jamming detection approaches [1, 12, 28].

3.3. Analysis of jamming effects

3.3.1. General jamming effects

In order to present a comprehensive understanding of the complex relationship between the transmission power of a wireless node and a jammer, we adopt the signal-to-interference-plus-noise-ratio (SINR) model. This model takes into account the ambient noise P_N and jamming signals P_J as part of the “noise” in a jamming scenario. The SINR can be expressed for a sender-receiver pair (S, R):

$$\begin{array}{c}\hfill \mathrm{SINR}=\frac{P_{\mathit{SR}}}{P_N+P_{\mathit{JR}}}\end{array}$$(1)

where P_SR is the received power of the desired signal, P_N represents the noise, and P_JR is the received power level of the jamming signal. In our work, we define the link state l_ijfrom node n_i to n_j using a threshold model. Specifically, we define the link state from node n_i to n_j as:

$$\begin{array}{c}\hfill l_{\mathit{ij}}=\{\begin{array}{cc}0\hfill & {\mathrm{SINR}}_{\mathit{ij}}\le {\gamma }_0\hfill \\ 1\hfill & {\mathrm{SINR}}_{\mathit{ij}}>{\gamma }_0\hfill \end{array}\end{array}$$(2)

where SINR_ij represents the SINR measured at node n_j when node n_i is transmitting, and all other network nodes remain silent. γ_o is the threshold SINR, above which packets can be received successfully. We refer to this threshold as the Decodable SINR threshold [11].

In order to describe the impact of jammers on wireless networks, we introduce a classification of network nodes into three categories: unaffected nodeN_U, jammed nodeN_J, and boundary nodeN_B. Let Nbrn_i denote the set of neighbors of node n_i before any jammer becomes active, other notations are explained in Table 1. We then derive the SINR-based jamming model as follows:

• Unaffected node. N_U = {n_u|∀n_i ∈ Nbr{n_u},SINR_iu >  γ_o}. A node is unaffected, if it can receive packets from all of its neighbors.

• Jammed node. N_J = {n_j|∀n_i ∈ N_U, L_ij = 0}. Essentially, a node n_j is jammed if it cannot receive messages from any of the unaffected nodes. We note that two nodes in the jammed region may still be able to communicate with each other, but we still call them jammed nodes. However, they cannot communicate with any of the unaffected nodes.

• Boundary node. N_B = {n_b|(∃n_i ∈ N_U, L_ib = 1) and (∀n_i ∈Nbr{n_b}∩N_J, SINR_ib ≤ γ_o)}. A boundary node can receive packets from part of its neighbors but not from all its neighbors.

Figure 1. An illustration of a multi-jammer scenario in a wireless network

3.3.2. Effects of multiple jammers

In scenarios where multiple jammers are present, the jammers can be turned on either sequentially or simultaneously. We analyze the jamming effects by considering these two typical ways of conducting jamming attacks. Figure 1 depicts a network set up with one sender-receiver pair (S, R) and two jammers (J₁, J₂), where the distance between S and R is d_SR, and J₁ and J₂ with the transmission power P_J are d_J1R and d_J2R away from R. The interfering signal from both jammers, J₁ and J₂, arriving at the legitimate receiver S will mix together and create even stronger interference to the reception of the legitimate signal, resulting in more complexity in the jamming scenarios. We next use this setup to illustrate the different jamming effects when two jammers are turned on either sequentially or simultaneously.

Sequentially turning on jammers. When the two jammers J₁ and J₂ are turned on sequentially, the network communication will experience changes and disruptions twice. When the first jammer J₁ is turned on, according to equation (1), the SINR at receiver R in the presence of Jammer J₁ becomes:

$$\begin{array}{c}\hfill {\mathrm{SINR}}^1=\frac{P_{\mathit{SR}}}{P_N+P_{J_{1}R}},\end{array}$$(3)

and the link state from node n_i to n_j is still defined by equation (2).

After the second jammer J₂ is turned on, the SINR-based jamming model at R is changed to:

$$\begin{array}{c}\hfill {\mathrm{SINR}}^{1,2}=\frac{P_{\mathit{SR}}}{P_N+P_{J_{1}R}+P_{J_{2}R}}·\end{array}$$(4)

The link state from node n_i to n_j may change or remain the same depending on SINR. In total, there are three cases:

$$\begin{array}{c}\hfill l_{\mathit{ij}}=\{\begin{array}{cc}0\to 0\hfill & {\mathrm{SINR}}_{\mathit{ij}}^1\le {\gamma }_0\to {\mathrm{SINR}}_{\mathit{ij}}^{1,2}\le {\gamma }_0\hfill \\ 1\to 0\hfill & {\mathrm{SINR}}_{\mathit{ij}}^1>{\gamma }_0\to {\mathrm{SINR}}_{\mathit{ij}}^{1,2}\le {\gamma }_0\hfill \\ 1\to 1\hfill & {\mathrm{SINR}}_{\mathit{ij}}^1>{\gamma }_0\to {\mathrm{SINR}}_{\mathit{ij}}^{1,2}>{\gamma }_0.\hfill \end{array}\end{array}$$(5)

For instance, a link state l_ij changes from 1 to 0, if the SINR from n_i to n_j was larger than γ₀ but drops below γ₀ after J₂ is turned on.

Simultaneously turning on jammers. When two jammers are turned on simultaneously, the SINR at receiver R is similar to the SINR after both jammers are turned on sequentially, and the link state from node n_i to n_j is

$$\begin{array}{c}\hfill l_{\mathit{ij}}=\{\begin{array}{cc}0\hfill & {\mathrm{SINR}}_{\mathit{ij}}^{1,2}\le {\gamma }_0\hfill \\ 1\hfill & {\mathrm{SINR}}_{\mathit{ij}}^{1,2}>{\gamma }_0.\hfill \end{array}\end{array}$$(6)

3.3.3. Propagation models

We have utilized two propagation models to model the received power of signals: free-space model and the shadowing model. Due to the simplicity of the free space model, we use it to illustrate the theoretical basis of our algorithm. However, our experimental validation leverages the shadowing model, a realistic model that captures the absorption, reflection, scattering, and diffraction in complex propagation environments.

Free Space Model considers a signal propagated through free space without obstructions. The received signal power is,

$$\begin{array}{c}\hfill P_{\mathit{SR}}=\frac{P_{S}G}{4\pi d^2},\end{array}$$(7)

where P_S is the transmission power of the sender; G is the antenna field patterns in the line-of-sight (LOS) direction between the sender and receiver; and d is the distance between the sender and the receiver. We note that the sender can either be a jammer J or a network node n_i. The analysis of the free-space model provides insights into understanding the jamming effects and the underlying theoretical basis. However, real wireless communication operates in complex propagation environments full of absorption, reflection, scattering, and diffraction, and it cannot be accurately modeled by the free-space model. In this work, we adopt the shadowing-based signal propagation model which is more realistic in practice.

Shadowing Model captures both path loss versus distance and the random attenuation due to blockage from objects in the signal path [29]. Let path loss at the receiver that is at the distance d from the sender be

$$\begin{array}{c}\hfill \mathrm{PL}(d)=10{log}_{10}\frac{P_S}{P_{\mathit{SR}}},\end{array}$$(8)

then the shadowing model has the following form:

$$\begin{array}{c}\hfill \mathrm{PL}(d)=\mathrm{PL}(d_0)-10·\eta ·log\left(\frac{d}{d_0}\right)+X_{\sigma },\end{array}$$(9)

where PL(d₀) is the known path loss at a reference distance d₀, η is the Path Loss Exponent (PLE), and X_σ is a Gaussian zero-mean random variable with standard deviation σ.

The log-normal shadowing model captures both path loss versus distance and the random attenuation due to blockage from objects in the signal path [29]. It has the following form:

$$\begin{array}{c}\hfill \mathrm{PL}(d)=\mathrm{PL}(d_0)-10·\eta ·log\left(\frac{d}{d_0}\right)+X_{\sigma },\end{array}$$(10)

where PL(d) is the path loss at distance d, PL(d₀) is the known path loss at a reference distance d₀, η is the Path Loss Exponent (PLE), and X_σ is a Gaussian zero-mean random variables with standard deviation σ.

When there is only one jammer J, the received power from the sender S can be expressed as $P_{\mathit{SR}}=\frac{P_S}{{10}^{\frac{\mathrm{PL}(d_{\mathit{SR}})}{10}}}$, and from the jammer is $P_{\mathit{JR}}=\frac{P_J}{{10}^{\frac{\mathrm{PL}(d_{\mathit{JR}})}{10}}}$. Thus, the signal-to-interference-plus-noise ratio under a single jammer scenario is:

$$\begin{array}{c}\hfill {\mathrm{SINR}}^1=\frac{P_{\mathit{SR}}}{P_{\mathit{JR}}+P_N}=\frac{\frac{P_S}{{10}^{\frac{\mathrm{PL}(d_{\mathit{SR}})}{10}}}}{\frac{P_J}{{10}^{\frac{\mathrm{PL}\left(d_{\mathit{JR}}\right)}{10}}}+P_N}·\end{array}$$(11)

When multiple jammers are present, we illustrate the SINR jamming model under the shadowing signal propagation model by using two jammers. The SINR at R is calculated by considering the superimposed transmission power from both jammers:

$$\begin{array}{c}\hfill {\mathrm{SINR}}^{1,2}=\frac{\frac{P_S}{{10}^{\frac{\mathrm{PL}\left(d_{\mathit{SR}}\right)}{10}}}}{\frac{P_J}{{10}^{\frac{\mathrm{PL}\left(d_{J_{1}R}\right)}{10}}}+\frac{P_J}{{10}^{\frac{\mathrm{PL}\left(d_{J_{2}R}\right)}{10}}}+P_N}·\end{array}$$(12)

Further, the link state from node n_i to n_j is decided by equations (5) and (6).

4. Collecting network topology information

To localize multiple jamming attackers, our approach is to estimate the positions of jammers by observing network topology changes caused by their presence. To achieve this, it is crucial to capture topology differences before and after the emergence of jammers. In Section 3, we provide important theoretical insights to understand the impact of jammers on the network. Specifically, the likelihood that node n_i receives messages from node n_j depends on the SINR at n_i when n_j is transmitting. However, measuring SINR is often not feasible in practice. In this section, we describe our experimental study on collecting network topology information in real-time and classifying nodes into three categories: unaffected nodes, jammed nodes, and boundary nodes. To conduct our study, we used MicaZ sensor nodes [30], which provide access to the entire network stack. The MicaZ sensor nodes use TinyOS 2.x as the operating system and have a 2.4–2.48 GHz Chipcon CC2420 Radio.

4.1. Link state estimation and information collection

Our approach involves each node updating its neighbor table by locally measuring the link quality to each neighbor and periodically reporting the neighbor table to a designated entity, such as the network sink, which can then localize jammers.

We estimated the link quality by measuring the percentage of packets delivered. Specifically, the instantaneous PDR from node n_j to node n_i at the kth interval can be expressed as $p_{\mathit{ij}}^k=\frac{m_r}{m_t}$, where m_t is the total number of packets transmitted from n_j to n_i and m_r is the total number of packets received at n_i at the kth interval. We defined the link quality as the exponential moving average of instantaneous PDRs.

$$\begin{array}{c}\hfill q_{\mathit{ij}}^k=\{\begin{array}{cc}(1-\alpha )q_{\mathit{ij}}^{k-1}+\alpha p_{\mathit{ij}}^k\hfill & {\mathrm{\Delta }}_l^k<{\beta }_1\hfill \\ \alpha q_{\mathit{ij}}^{k-1}+(1-\alpha )p_{\mathit{ij}}^k\hfill & \mathtt{o}therwise,\hfill \end{array}\end{array}$$(13)

where α controls the weight of decreasing older link estimations, ${\mathrm{\Delta }}_l^k=\underset{r\in [1,l]}{max}|p_{\mathit{ij}}^k-p_{\mathit{ij}}^{k-r}|$, and β₁ defines the threshold that bounds short-term fluctuations. The condition Δ_l^k <  β₁ is for expediting link estimations when the link state has indeed been changed.

To improve the accuracy of link estimations, we introduced a small α that discounts older estimations slowly and smooths out short-term fluctuations. However, when a jammer is activated, it introduces delays before the estimations reflect the current network condition, such as being jammed. To address this issue, we examined the instantaneous Packet Delivery Ratios (PDRs) in the past l intervals and assigned a high weight to p_ij^k if its changes exceeded the short-term fluctuation range, denoted as β₁. Additionally, we defined the link state from node n_i to n_j as follows:

$$\begin{array}{c}\hfill l_{\mathit{ij}}^k=\{\begin{array}{cc}1\hfill & q_{\mathit{ij}}^k>{\beta }_2\hfill \\ 0\hfill & \mathtt{o}therwise.\hfill \end{array}\end{array}$$(14)

As an example, Figure 2 shows q^k and p^k between a pair of nodes in our experimental network. In our experiment, we set α = 0.2, β₁ = 0.7, l = 2, and β₂ = 0.65. We observed that q^k smoothed out the fluctuations when the network status did not change, but it quickly captured the event that J₁ was turned on at the 30th second and J₂ was turned off at the 90th second. We noted that J₂ has a small impact on the link quality, in this case.

Figure 2. Instantaneous PDR and exponential moving average of PDR from node 11 to node 8, when two jammers were turned on and off in sequence

To collect information about the network topology, a customized protocol was used based on the Collection Tree Protocol (CTP) implemented in TinyOS 2.x. Each node was able to monitor the link quality with its neighbors and send this information to the designated node for jamming localization. A routing tree was built after the network was deployed, with the designated node as the root. Each node periodically sends a data packet containing its latest neighbor list to the designated node via unicast.

Figure 3. A snapshot of experiment setup

Figure 4. Topology changes as turning on and off J1 placed at the upper-left corner and J2 at the upper-right corner in sequence: (a) No jammers were on. (b) J1 was turned on at the 30th second. (c) J2 was turned on at the 60th second. (d) J1 was turned off at the 90th second

4.2. An example walk-through using MicaZ

To investigate the effects of jamming in an indoor environment, we deployed a network of 12 Micaz nodes with a communication range of approximately 0.8 m, achieved by installing a 10 dB attenuator on each node. The jamming devices, J₁ and J₂, were positioned at the upper-left and upper-right corners, respectively, as illustrated in Figure 3. Node 0 was designated as the root of a routing tree, and all nodes periodically reported their neighbor lists to node 0, which learned the network topology. Figure 4a shows the network topology before the jammers were activated, with all links being bidirectional. Single-headed arrows indicate a unidirectional link from node n_i to n_j (l_ij = 1), while double-headed arrows represent bidirectional links (l_ij = l_ji = 1). It should be noted that in the absence of jammers, all links in the network were bidirectional.

We activated the first jammer J₁ at the 30th second and the second jammer J₂ at the 60th second. We then turned off J₁ at the 90th second. Figure 4 illustrates the network topologies at each stage. From these observations, we noted that:

• The presence of jammers has caused certain links to become unidirectional. For instance, when J₁ is active, the link from node 8 to node 11, l_8, 11, is connected as shown in Figure 4a, but l_11, 8 is not. However, node 11 can still occasionally deliver a few packets to node 8 to report its neighbor list, so node 0 is aware that l_8, 11 = 1.

• The experiments confirmed our analysis of how multiple jammers affect network topology changes. Furthermore, the experiments suggested that the network can identify the order in which the jammers become active. Specifically, when J₁ was turned on in the upper-left corner, as shown in Figure 4b, nodes {5, 7} became boundary nodes since they lost some of their neighbors but could still receive messages. After J₂ was turned on, as shown in Figure 4c, nodes {5, 7} changed into jammed nodes since they could no longer receive messages from any of their neighbors. Once we turned off J₁, node 5 regained its ability to deliver messages to others and became a boundary node again, but node 7 remained jammed, as shown in Figure 4d.

• Interestingly, we discovered that node 5 was not jammed when only one jammer was active, but became jammed when both jammers were turned on. Therefore, N_J¹ ∩ N_J² ≠ N_J^1, 2, making the task of localizing multiple jammers challenging.

After activating J₁ on the upper-left corner, as depicted in Figure 4b, nodes 3, 4, 10, and 11 became jammed nodes and could no longer receive or send messages to other nodes. Meanwhile, nodes 1, 2, 5, 6, 7, 8, and 9 became boundary nodes, as they were still able to receive messages but lost some of their neighbors. Node 0 remained unaffected. Upon turning on J₂, shown in Figure 4c, nodes {5, 7} changed from boundary nodes to jammed nodes as they were no longer able to receive messages from any of their neighbors. Finally, after turning off J₁ as illustrated in Figure 4d, node 11 regained its ability to deliver messages and became a boundary node.

5. Framework for localizing multiple jammers

Our experimental results suggest that we are able to collect the network topology changes in spite of the disturbed network communication under jamming. In this section, we propose a framework that can localize multiple jammers by exploiting the collected network topology changes. We note that this framework can be implemented at the network sink where all the network neighborhood information is reported, but is not limited to it. Furthermore, each node monitors the network topology changes by measuring the beacons required by most routing protocols, and our localization algorithm involves each affected node reporting its neighbor changes in one message. Thus, the additional communication overhead is proportional to the affected nodes.

Our framework consists of two components, the automatic network topology partitioner and intelligent multi-jammer localizer, as shown in Figures 5 and 6 respectively. The automatic network topology partitioner systematically divides the nodes into three categories by examining the PDR on each node: unaffected nodes, jammed nodes, and boundary nodes. Then it forms two types of clusters via the Minimum Spanning Tree technique: jammed clusters (JCs) and boundary clusters (BCs). The detailed approach will be discussed in Section 6.

Figure 5. Framework for automatic network topology partitioner.

Figure 6. Framework for intelligent multi-jammer localizer

The intelligent multi-jammer localizer estimates the positions of multiple jammers based on the results from the partitioner component, by utilizing different localization algorithms. Particularly, the localizer should deal with two cases: sequentially and simultaneously turning on jammers. For each case, there are three localization algorithms, dealing with different jamming scenarios, are developed for localizing jammers. In particular, for sequentially turning on the case, we have the mirroring method, centroid method, and adaptive LSQ method for estimating the positions of jammers. The algorithm starts localization when there is a new jammer turning on. The adaptive LSQ method is exploited if a new boundary cluster (BC) appears; Centroid method deals with the scenario where new jammed cluster (JC) appears but no new BC; Mirroring method addresses the jamming scenario where neither new BC or new JC appears.

For simultaneously turning on the case, the adaptive LSQ method, centroid method, and Gauss-Newton searching method are exploited. The jammers are localized by examining each BC in the jamming scenario. If only one jammer is included in one particular BC, the Adaptive LSQ method is deployed; if the number of jammers in the BC under examination is larger than the number of JC formed in this BC, Gauss-Newton searching method is utilized, otherwise, we choose centroid method. We will discuss the detailed algorithms in Section 7.

6. Automatic network topology partitioner

Upon detection of jamming using existing detection approaches, our automatic network topology partitioner categorizes network nodes into distinct clusters, namely jammed clusters (JC) and boundary clusters (BC). Typically, there is one JC and one BC formed around a jammer. To identify these clusters, we developed a topology partitioning method based on Minimum Spanning Trees (MST).

MST-based topology partitioning. We formulate the network into a connected, undirected graph, which is represented by a neighborhood adjacency matrixG [31]. The graph is undirected because each communication link between nodes is bi-directional under normal situations without jamming. In the matrix G, an element is set to 1 if two nodes are neighbors, otherwise, it is set to 0. Given a connected, undirected graph, a spanning tree of that graph is a subgraph which is a tree connecting all the vertices together. Further, an MST [31] is a spanning tree with a total weight less than or equal to the weight of every other spanning tree. Any undirected graph (not necessarily connected) has a minimum spanning forest, which is a union of minimum-spanning trees for its connected components. The minimum-spanning trees can be obtained using Prim’s algorithm.

To identify BCs and JCs, we define subgraphs G_NJ and G_NB containing all jammed and boundary nodes, respectively. In the presence of multiple jammers in the network, some nodes will be identified as either jammed nodes or boundary nodes. These nodes can form connected and undirected graphs, which we denote as G_NJ and G_NB for jammed and boundary nodes respectively. To better understand the relationship among these graphs, we use a network with 6 nodes as shown in Figure 7. Node 2 has three neighbors, 1, 3 and 5; Node 3’s neighbors are 2, 4, and 5; Node 3 and 6 are Node 4’s neighbors; Node 5 has 2 and 3 as its neighbors; Node 6 connects with 1 and 4. The 6 × 6 neighborhood matrix G of this network with respect to the unaffected node vector [1, 2, 3, 4, 5, 6] is:

$$\begin{array}{c}\hfill G=\left[\begin{array}{cccccc}1& 1& 0& 0& 0& 1\\ 1& 1& 1& 0& 1& 0\\ 0& 1& 1& 1& 1& 0\\ 0& 0& 1& 1& 0& 1\\ 0& 1& 1& 0& 1& 0\\ 1& 0& 0& 1& 0& 1\end{array}\right].\end{array}$$(15)

Figure 7. A network example to show the neighborhood adjacency matrix. (a) Without jamming. (b) With jamming

The rows and columns in G correspond to the node IDs. For example, G(1, 2)=1 represents a link existing between Node 1 and 2, whereas G(1, 3)=0 indicates Node 1 and 3 are disconnected. Under jamming, there are 3 jammed nodes i.e., 1, 4, and 6, and 2 boundary nodes, 2 and 3. Thus, the jammed node ID vector I_NJ = [1, 4, 6], and boundary node ID vector I_NB = [2, 3]. G_NJ and G_NB are sub-matrices of G formed by selecting rows and columns indexed by I_NJ and I_NB, respectively.

$$\begin{array}{cc}\hfill G_{N_J}& =G[I_{N_J};I_{N_J}]=\left[\begin{array}{ccc}1& 0& 1\\ 0& 1& 1\\ 1& 1& 1\end{array}\right]\hfill \\ \hfill G_{N_B}& =G[I_{N_B};I_{N_B}]=\left[\begin{array}{cc}1& 1\\ 1& 1\end{array}\right].\hfill \end{array}$$(16)

Since boundary nodes are mostly surrounding jammed nodes, they may not form an appropriate cluster by themselves. To derive the proper number of BCs, instead of using G_NB, we use G_{NJ& NB}, which is a submatrix of G formed by selecting rows and columns indexed by I_NJ ∪ I_NB:

$$\begin{array}{c}\hfill G_{N_J\&N_B}=G[I_{N_J}\cup I_{N_B};I_{N_J}\cup I_{N_B}]=\left[\begin{array}{ccccc}1& 0& 1& 0& 1\\ 0& 1& 1& 0& 1\\ 1& 1& 1& 1& 0\\ 0& 0& 1& 1& 1\\ 1& 1& 0& 1& 1\end{array}\right].\end{array}$$(17)

Figure 8. Clusters for jammed nodes and boundary nodes: the nodes connected by black solid lines form a jammed cluster through an MST, whereas those nodes connected by red dashed lines belong to the boundary cluster

Algorithm 1 outlines the MST-based topology partitioning approach. The JC is obtained through Prim’s algorithm applied to G_NJ. To establish the BC, we create a combined MST comprising the jammed and boundary nodes in G_{NJ& NB}, beginning with either a jammed or boundary node. We then remove the jammed nodes from the combined MST to obtain the BC. Figure 8 illustrates the JC and BC obtained via the MST-based topology partitioning method. The JC consists of nodes connected by black solid lines, while the red dashed lines connect the nodes belonging to the BC. It is worth noting that the BC may not be a suitable cluster on its own, and may require the involvement of jammed nodes to form an appropriate cluster. Overall, two clusters, JC and BC, are formed based on the proposed MST-based approach to facilitate the later localization process. According to [31], the computational complexity of Prim’s algorithm is O((V + E)logV), where V and E represent the number of vertices and edges in a graph. Since the number of edges is uncertain in the G under jamming, the complexity of the proposed approach in the worst case is $O(N_J^2+{(N_J+N_B)}^2)=O(2N_J^2+2N_J{N}_B+N_B^2)$.

Node clustering analysis based on jammers’ distance. After applying our MST-based topology partitioning method when multiple jammers are present in the network, there will be one jammed cluster and one boundary cluster formed around each jammer as depicted in Figure 9a. These clusters aid in localizing the position of each jammer. For instance, the jammed cluster can be used with the traditional centroid method [9] to obtain an initial position estimate of the jammer. The boundary cluster is also utilized to examine changes in node hearing range caused by jamming, which assists in improving the localization accuracy using the AdaptiveLSQ method, developed in our prior work [11].

Figure 9. Illustration of the clustering results obtained from the MST-based topology partitioning method when two jammers are placed at various distances. (a) 2 jammed clusters, 2 boundary clusters. (b) 2 jammed clusters, 1 boundary cluster. (c) 1 jammed cluster, 1 boundary cluster

We examine a two-jammer example to illustrate our methodology, noting that cases with more jammers can produce a wider range of clustering outcomes but share the same fundamental concept as the two-jammer scenario. When the two jammers are far apart, each one forms a distinct jammed cluster and boundary cluster resulting in 2 jammed clusters and 2 boundary clusters (2JC-2BC), as shown in Figure 9a. However, when two jammers reside close to each other, they may have overlapping jamming regions and form only one connected jammed area. Depending on how close the two jammers are, two scenarios are possible. The first one is two jammed clusters and one boundary cluster (2JC-1BC), as shown in Figure 9b. When two jammers are located close by, the two boundary clusters are merged into one, but the two jammed clusters are still distinguishable. The second one is one jammed cluster and one boundary cluster (1JC-1BC), as depicted in Figure 9c. When two jammers are placed even closer, the two jammed clusters merge into one jammed cluster.

The MST-based topology partitioning method can identify all three cases: 2JC-2BC, 2JC-1BC, and 1JC-1BC. However, the diversity of clustering results makes it challenging to localize multiple jammers. While in the case of 2JC-2BC, algorithms for localizing one jammer can be applied to determine both jammers’ location, this is not applicable when two jammers are close to each other and form 2JC-1BC or 1JC-1BC. To overcome this challenge, we developed an intelligent multi-jammer localizer that uses the topology partitioning results to localize jammers regardless of whether they have overlapping jammed areas.

7. Intelligent multi-jammer localizer

Continuing with the two-jammer example, to localize multiple jammers, our framework is designed to perform intelligent localization based on three possible classification outcomes returned from the automatic network topology partitioner: 2JC-2BC, 2JC-1BC, and 1JC-1BC. For the cases with more jammers, the localization strategy can also refer to the two-jammer example. We will discuss it in a later section. Moreover, we develop two sets of solutions, one possesses the prior knowledge of the order in which the jammers are turned on, referred to as sequentially turning on; and the other does not have any prior knowledge about the order in which the jammers are turned on, which makes the system consider that the jammers are turned on simultaneously. The jamming effects of sequentially turning on jammers and simultaneously turning on jammers are presented in Section 3 and are used as prior knowledge for the intelligent multi-jammer localizer.

7.1. Basic algorithms to localize single jammer

We start by introducing several localization algorithms used to estimate the position of a single jammer:

Centroid-based [9], Adaptive LSQ [11], mirroring method and Gauss-Newton searching method. All these algorithms work even when the network communication is disturbed by jamming, and they utilize the affected network topology to perform localization.

Centroid-based. The Centroid-based localization method estimates a single jammer’s position $({\widehat{x}}_J,{\widehat{y}}_J)$ by averaging over the coordinates of all jammed nodes belonging to the corresponding jammed cluster formed around the single jammer. Consider that there are M jammed nodes {(x_m, y_m)}_{m = 1, …, M}, the position of the jammer can be estimated by Centroid-based localization as:

$$\begin{array}{c}\hfill \widehat{J}=({\widehat{x}}_J,{\widehat{y}}_J)=(\frac{{\sum }_{m=1}^M{x}_m}{M},\frac{{\sum }_{m=1}^M{y}_m}{M})·\end{array}$$(18)

Adaptive LSQ. The Adaptive LSQ exploits the formation of the boundary cluster and uses a node (e.g., boundary node)’s neighbor list changes under jamming to estimate the jammer’s location. We describe the main component of Adaptive LSQ in this paper and refer readers to our prior work [11] for a complete algorithm description.

In summary, we formed a least squares problem to estimate the position and transmission power of the jammer:

$$\begin{array}{c}\hfill \widehat{\mathbf{v}}={[{\widehat{x}}_J,{\widehat{y}}_J,{\widehat{P}}_J]}^T={\left({\mathbf{A}}^T\mathbf{A}\right)}^{-1}{\mathbf{A}}^T\mathbf{b}\end{array}$$(19)

where A and b are matrices depending on the position of M boundary nodes {(x_m, y_m)}_{m = 1, …, M} and their hearing range {r_hm}_{m = 1, …, M}, i.e., the range within which they can receive packets from other nodes, respectively.

$$\begin{array}{cc}\hfill \mathbf{A}& =\left(\begin{array}{ccc}{x}_1-\frac{1}{M}\sum _{m=1}^M{x}_m& y_1-\frac{1}{M}\sum _{m=1}^M{y}_m& \frac{1}{2}(C(r_{h_1})-C_{\mathrm{\Sigma }})\\ ⋮& ⋮& ⋮\\ x_M-\frac{1}{M}\sum _{m=1}^M{x}_m& y_M-\frac{1}{M}\sum _{m=1}^M{y}_m& \frac{1}{2}(C(r_{h_M})-C_{\mathrm{\Sigma }})\end{array}\right)\hfill \\ \hfill \mathbf{b}& =\left(\begin{array}{c}(x_1^2-\frac{1}{M}\sum _{m=1}^M{x}_m^2)+(y_1^2-\frac{1}{M}\sum _{m=1}^M{y}_m^2)\\ ⋮\\ (x_M^2-\frac{1}{M}\sum _{m=1}^M{x}_m^2)+(y_M^2-\frac{1}{M}\sum _{m=1}^M{y}_m^2)\end{array}\right)\hfill \end{array}$$(20)

and

$$\begin{array}{c}\hfill C\left(r_{h_m}\right)=\frac{{\gamma }_0{r}_{h_m}^2}{P_S-\frac{4\pi {\gamma }_0{P}_N}{G}{r}_{h_m}^2},C_{\mathrm{\Sigma }}=\frac{1}{M}\sum _{m=1}^{M}C\left(r_{h_m}\right).\end{array}$$(21)

Based on equation (7), we can get:

$$\begin{array}{cc}\hfill \frac{\frac{P_S{G}_{\mathit{SR}}}{4\pi d_{\mathit{SR}}^2}}{P_N+\frac{P_J{G}_{\mathit{SR}}}{4\pi d_{\mathit{JR}}^2}}& ={\gamma }_0\hfill \\ \hfill {(x-x_J)}^2-{(y-y_J)}^2& =P_{J}C(d_{\mathit{SR}}),\hfill \end{array}$$(22)

with d_J² = (x − x_J)² − (y − y_J)² where (x,y) and (x_J,y_J) are the coordinates of a boundary node and the jammer J respectively, and $C(d_{\mathit{SR}})=\frac{{\gamma }_0{d}_{\mathit{SR}}^2}{P_S-\frac{4\pi {\gamma }_0{P}_N}{G_{\mathit{SR}}}{d}_{\mathit{SR}}^2}$. d_SR is the range within which the boundary node R can receive packets from other nodes, e.g., any transmitter S within d_SR of R has SNR_S → R ≥ γ₀ where γ₀ is the decodable SNR threshold.

Under jamming, suppose that the range of a boundary node m that can hear packets is changed to d_SRm with m = {1, …, M}. Then, we can construct M equations for M boundary nodes:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill {(x_1-x_J)}^2+{(y_1-y_J)}^2& =P_{J}C\left(d_{S{R}_1}\right)\hfill \\ \hfill {(x_2-x_J)}^2+{(y_2-y_J)}^2& =P_{J}C\left(d_{S{R}_2}\right)\hfill \\ \hfill & ⋮\hfill \\ \hfill {(x_M-x_J)}^2+{(y_M-y_J)}^2& =P_{J}C\left(d_{S{R}_M}\right).\hfill \end{array}\end{array}$$(23)

In Adaptive LSQ, d_SRm can be estimated for each boundary node m and the jammer’s position can be estimated by solving the above equations. Moreover, the non-linear equation groups can be linearized into the form of A z = b with

$$\begin{array}{c}\hfill \mathbf{A}=\left(\begin{array}{ccc}{x}_1-\frac{1}{M}\sum _{m=1}^M{x}_i& y_1-\frac{1}{M}\sum _{m=1}^M{y}_i& \frac{1}{2}(C(d_{S_1})-C_{\mathrm{\Sigma }})\\ ⋮& ⋮& ⋮\\ x_M-\frac{1}{M}\sum _{m=1}^M{x}_M& y_M-\frac{1}{M}\sum _{m=1}^M{y}_M& \frac{1}{2}(C(d_{S_M})-C_{\mathrm{\Sigma }})\end{array}\right)\end{array}$$(24)

and

$$\begin{array}{c}\hfill \mathbf{b}=\left(\begin{array}{c}(x_1^2-\frac{1}{M}\sum _{i=1}^M{x}_i^2)+(y_1^2-\frac{1}{M}\sum _{i=1}^M{y}_i^2)\\ ⋮\\ (x_M^2-\frac{1}{M}\sum _{m=1}^M{x}_M^2)+(y_M^2-\frac{1}{M}\sum _{m=1}^M{y}_i^2)\end{array}\right)\end{array}$$(25)

where $C_{\mathrm{\Sigma }}=\frac{1}{M}\sum _{m=1}^{M}C(d_{S{R}_m})$. Thus, we can calculate the estimation of the jammer’s position and the jammer’s transmission power by solving the least squares:

$$\begin{array}{c}\hfill \mathbf{z}={[x_J,y_J,P_J]}^T={\left({\mathbf{A}}^T\mathbf{A}\right)}^{-1}{\mathbf{A}}^T\mathbf{b}.\end{array}$$(26)

Moreover, the radio propagation in real-world scenarios is complex with random attenuation and multi-path effects, Adaptive LSQ further combines the Centroid-based method with the basic LSQ algorithm to handle the radio irregularity. After introducing the basic algorithms that we adopt to use in our intelligent multi-jammer localizer, we next present how to localize multiple jammers based on the classification from network topology partitioning by continuously using the two-jammer example.

Centroid-based versus Adaptive LSQ. According to our prior work, the Adaptive LSQ is more likely to provide a better estimation of the jammer’s location than the Centroid-based method, because Centroid-based is sensitive to the distribution of jammed nodes. However, such a conclusion is only valid under the assumption of a single jammer. When multiple jammers are present, it is sometimes difficult, even impossible, to identify which jammer or jammers disturb the communication of the boundary nodes. Thus, it is non-trivial to construct A and b for jammer localization using Adaptive LSQ. In those cases, the Centroid-based method will perform better. Regarding the computational complexity, Centroid-based method is proportional to the number of jammed nodes as O(M_J), while Adaptive LSQ is approximately $O(M_B^3)$ due to 3 times of matrix (or its transpose, inverse matrix) multiplication, where M_J and M_B are the jammed and boundary nodes involved in the localization process.

7.2. Algorithms for localizing multiple jammers

When jammers have overlapped jamming regions, a single JC contains more than 1 jammer. Simply applying Adaptive LSQ or centroid method is not working. We develop Mirroring and Gauss-Newton searching methods to address this case sequentially and simultaneously turning on the case respectively.

Mirroring algorithm. When two jammers are sequentially turned on, the first jammer’s location can be estimated by applying Adaptive LSQ to the portion of BC when only the first jammer is on. To localize the second jammer’s position after it is on, since only one connected jammed area is formed, our assumption about the omni-direction characteristic of the propagation model and the uniform distribution of the nodes in the network implies that the two jammers will be at symmetric positions with respect to the center of the jammed region. Thus, the Mirroring algorithm uses the location estimation of the first jammer ${\widehat{J}}_1$, and applies the Adaptive LSQ to the whole jammed area to obtain a position estimation $\widehat{J}$ based on the single boundary cluster. Based on our assumption, the second jammer’s position ${\widehat{J}}_2$ can be estimated as a symmetric position of ${\widehat{J}}_1$ with respect to the position estimation $\widehat{J}$:

$$\begin{array}{c}\hfill \widehat{J_2}=\widehat{J}-(\widehat{J_1}-\widehat{J}).\end{array}$$(27)

It can be found from the above equation that the computation complexity of the Mirroring algorithm is about $O(M_B^3+M_J)$, where M_J and M_B are the jammed and boundary nodes involved in the localization process.

Gauss-Newton Searching algorithm. When the jammers’ turning-on sequence is not available, our framework treats two jammers being turned on simultaneously. 1JC-1BC makes estimating each jammer’s position especially hard. We propose a method grounded on Gauss-Newton Searching to localize each jammer’s position.

To localize more than one jammer within one single jammed cluster, we derive a general form of Gauss-Newton searching method for localizing these jammers. According to the SNR model, we can formulate the SNR at one particular boundary node m from multiple jammer’s transmission power as follows:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \frac{\frac{P_{s}G}{4\pi r_{\mathit{SR}}^2}}{P_N+{\sum }_{m=1}^M\frac{P_{J}G}{4\pi r_{J_{m}R}^2}}& \le {\gamma }_0\hfill \\ \hfill \sum _{m=1}^M\frac{{\gamma }_0{P}_J}{r_{J_{m}R}}+\frac{4\pi {\gamma }_0{P}_N}{G}+\frac{P_S}{r_{\mathit{SR}}^2}& \ge 0\hfill \\ \hfill {\gamma }_0{P}_J\sum _{m=1}^M\prod _{n=1,n\ne m}^M{r}_{J_{n}R}^2+C\prod _{m=1}^M{r}_{J_{m}R}^2& \ge 0\hfill \\ \hfill \end{array}\end{array}$$(28)

where $C=\frac{4\pi {\gamma }_0{P}_N}{G}-\frac{P_S}{r_{\mathit{SR}}^2}$.

The objective function minimizes the left term of the above equation and if there exists M such boundary nodes.

$$\begin{array}{c}\hfill \begin{array}{c}\hfill \underset{\mathbf{v}}{\arg min}S(\mathbf{v})=\underset{\mathbf{v}}{\arg min}({\gamma }_0{P}_J\sum _{m=1}^M\prod _{n=1,n\ne m}^M{r}_{J_{n}R}^2+C\prod _{m=1}^M{r}_{J_{m}R}^2).\end{array}\end{array}$$(29)

To obtain the searching gradient, we can obtain the Jacobi matrix by calculating the derivative of the objective function as follows:

$$\begin{array}{c}\hfill J_{\mathbf{f}}=\left[\begin{array}{cccccc}\frac{\partial f_{r_1}(\mathbf{v})}{\partial x_{J_1}}& \frac{\partial f_{r_1}(\mathbf{v})}{\partial y_{J_1}}& \frac{\partial f_{r_1}(\mathbf{v})}{\partial x_{J_2}}& \frac{\partial f_{r_1}(\mathbf{v})}{\partial y_{J_2}}& \cdots & \frac{\partial f_{r_1}(\mathbf{v})}{\partial P_J}\\ [6pt]\frac{\partial f_{r_2}(\mathbf{v})}{\partial x_{J_1}}& \frac{\partial f_{r_2}(\mathbf{v})}{\partial y_{J_1}}& \frac{\partial f_{r_2}(\mathbf{v})}{\partial x_{J_2}}& \frac{\partial f_{r_2}(\mathbf{v})}{\partial y_{J_2}}& \cdots & \frac{\partial f_{r_2}(\mathbf{v})}{\partial P_J}\\ [4pt]⋮& ⋮& ⋮& ⋮& \ddots & ⋮\\ [4pt]\frac{\partial f_{r_M}(\mathbf{v})}{\partial x_{J_1}}& \frac{\partial f_{r_M}(\mathbf{v})}{\partial y_{J_1}}& \frac{\partial f_{r_M}(\mathbf{v})}{\partial x_{J_2}}& \frac{\partial f_{r_M}(\mathbf{v})}{\partial y_{J_2}}& \cdots & \frac{\partial f_{r_M}(\mathbf{v})}{\partial P_J}\end{array}\right].\end{array}$$(30)

Each element in the Jacobi Matrix is represented as below:

$$\begin{array}{cc}\hfill \frac{\partial f_1(\mathbf{v})}{\partial x_{J_u}}& =(2{\gamma }_0{P}_J\sum _{m=1}^M(x_{J_u}-x)\prod _{n=1,n\ne m}^M{r}_{J_{n}R}^2+2C(x_{J_u}-x)\prod _{m=1}^M{r}_{J_{m}R}^2)\hfill \\ \hfill \frac{\partial f_1(\mathbf{v})}{\partial y_{J_u}}& =(2{\gamma }_0{P}_J\sum _{m=1}^M(y_{J_u}-y)\prod _{n=1,n\ne m}^M{r}_{J_{n}R}^2+2C(y_{J_u}-y)\prod _{m=1}^M{r}_{J_{m}R}^2)\hfill \\ \hfill \frac{\partial f_1(\mathbf{v})}{\partial P_J}& ={\gamma }_0\sum _{m=1}^M\prod _{n\ne m}{r}_{J_{n}R}^2.\hfill \end{array}$$(31)

Therefore, by using the Gauss-Newton searching method, we can locate more than one jammer, x_Jm, y_Jm, m = 1, ⋯, M, in a single jammed cluster. Since the Gauss-Newton searching method is an iterative method in the search for regression parameters in a nonlinear regression model, its computational complexity is unknown, but it usually converges in less than 10 iterations according to our empirical study.

7.3. Localization strategy

After introducing the localization algorithms, we present our intelligent multi-jammer localizer, which can localize multiple jammers based on the clustering results from the automatic network topology partitioner. The algorithmic flow of our intelligent multi-jammer localizer is displayed in Algorithm 2.

Based on the topology partitioning results, we will choose the appropriate localization methods introduced above to localize jammers. To illustrate the application of jamming algorithms chosen for dealing with different jamming scenarios, we categorize the jamming scenarios based on the jammedd and boundary cluster classification.

7.3.1. Sequentially turning on

For sequentially turning on the case, the localization algorithm starts working only when a new jammer turns on.

• New BC appears: new jammer resulting in new BC indicates that the new BC includes a single jammer. The new jammer inside the particular boundary cluster is shown as the blue ellipse in Figure 10. The jammer in a distinguishable BC has less impact from other jammers, therefore, we can directly apply the Adaptive-LSQ method for localizing this jammer.

• New JC appears, no new BC appears: new jammer resulting in new JC indicates that the new jammed cluster JC₁ only includes a single jammer shown as the black ellipse in Figure 10. The jammer in a distinguishable JC also has less impact from other jammers, therefore centroid method based on the jammed cluster can be used for localizing the jammer.

• Neither new JC nor new BC appears: new jammer results in no new BC and JC indicates that the new jammer is close to previous jammers. Both new jammers and previous jammers are included in single JC. Multiple jammers in a single JC are shown in the red ellipse in Figure 10. The estimated jammer gets impact from other jammers, hence the new jammer is localized leveraging the previously localized jammers’ positions via Mirroring method.

Figure 10. Illustration for different jamming scenarios

7.3.2. Simultaneously turning on

For simultaneously turning on the case, we localize each jammer from each individual BC:

• One BC with one JC which includes only one jammer: each jammer has only one jammed cluster, and this jammed cluster includes one single jammer shown as the blue circle in Figure 10. A jammer inside one particular boundary cluster has less impact from other jammers, which is distinguished by the corresponding BC as the blue ellipse in Figure 10. The jammer corresponds to only BC, the Adaptive-LSQ method is appropriate for localizing the involved jammer.

• One BC with multiple JCs:

  • (i)

    Each JC with one jammer: each jammed cluster includes only one single jammer shown as the black circle in Figure 10. A particular jammed cluster within a boundary cluster has only one jammer inside, which is shown as the black ellipse in Figure 10. The jammer can be distinguished by the corresponding JC, which indicates that the centroid method based on the jammed cluster can be applied.

  • (ii)

    Each JC with multiple jammers: each jammed cluster includes multiple jammers shown as the red circle in Figure 10. Multiple jammers are included in the single jammed cluster of a particular boundary cluster shown as the red ellipse in Figure 10, no single jammer can be distinguished based on either JC or BC. Therefore, all the jammers within one particular JC should be localized via Gauss-Newton searching method.

8. Simulation evaluation

8.1. Simulation setup and performance metrics

In an area of 1000-by-1000 square meters, we generated 1000 different network topologies with 2000 and 3000 nodes, respectively, to validate the effectiveness of our framework. The nodes were uniformly placed to cover the entire deployment region with a minimum distance bounded by a threshold. To study the effects of multiple jammers, we presented the results of two jammers with a transmission range of 60 m and a decodable SNR threshold γ₀ of 1.1. To emulate real-world scenarios, we developed our simulation under the shadowing model and tuned the parameters using those obtained from our empirical experimental study [11]. Specifically, we set the path loss exponent η to 2.11 and the standard deviation σ to 1.0.

We evaluated the accuracy of localizing the jammers by defining the localization error as the Euclidean distance between the estimated jammer’s location and the true location. To capture the statistical characteristics, we studied the average errors under multiple experimental rounds and used the median error and the Cumulative Distribution Function (CDF) of the localization error as our validation metrics.

Figure 11. Node topology partitioning study: average number of clusters as a function of the distance between two jammers (2000-node and 3000-node deployment with node transmission range set to 30 m). (a) 2000-node. (b) 3000-node

8.2. Node topology partitioning study

We first studied the results of the automatic network topology partitioner when varying the distance between two jammers. Figure 11 depicts the average number of clusters obtained from our network topology partitioner as a function of the distance between jammers in a 2000-node network and a 3000-node network when setting each node’s transmission range to 30 m. We observed that both the number of JC and BC starts from 1 when two jammers are placed closely, and then jumps to 2 when two jammers are moving away from each other. Particularly, 2JC-2BC is returned when the distance L_J >  200 m in both networks, and 1JC-1BC is returned when L_J <  100 m in the 2000-node network and L_J <  75 m in the 3000-node network, respectively. Finally, all three clustering results are possible when L_J falls in between. Particularly, under the 2000-node deployment, only 1JC and 1BC are obtained when L_J is less than 100 m. Then the number of JC and BC goes up to 2 when the distance L_J is over 150 m and 200 m respectively. Whereas for the 3000-node deployment, when the distance L_J between two jammers is less than 75 m, there is always only 1JC and 1BC returned. When the two jammers’ distance L_J is over 125 m, the number of the jammed cluster first jumps to 2, and later the number of the boundary cluster becomes 2 when the two jammers are about 200 m away. When L_J is beyond 200 m, the topology partitioning always returns 2JC and 2BC. This observation confirms that our network topology partitioner works flexibly when the distance between jammers varies.

8.3. Localization algorithm selection study

We investigated how our multi-jammer localizer behaves when the distance between two jammers changes. Figure 12 shows the percentage of the basic localization algorithm usage within our multi-jammer localizer for three different distances: 500 m, 100 m, and 50 m. For the case when the partitioner returns 2JC-2BC, which occurs when the jammers are 500 m away, our multi-jammer localizer always uses Adaptive LSQ to perform localization.

Figure 12. Usage of localization algorithms in our multi-jammer localizer with node transmission range setting to 30 m. (a) 2000-node. (b) 3000-node

However, when the jammers are closer to each other, such as around L_J = 100 m, the usage of basic localization algorithms changes. For example, in the 2000-node deployment, the mirroring algorithm or Gauss-Newton Searching method dominates and conducts localization 98% of the time because 1JC-1BC is classified by topology partitioner for 98% of the jamming scenarios. Similarly, in the 3000-node deployment, the usage of the Centroid-based method is about 60%, and the mirroring algorithm and Gauss-Newton Searching method is about 40%, as shown in Figure 12b, where over half of the jamming scenarios are classified as 2JC-1BC and less than half is classified as 1JC-1BC. Finally, when the jammers are very close to each other (i.e., L_J = 50 m), the usage of the mirroring algorithm and Gauss-Newton Searching method is over 99%, matching with the 1JC-1BC topology partitioning case.

8.4. Localization performance study

For localizing multiple jammers, we study the localization performance by taking the example with 3 jammers both sequentially and simultaneously turning on for illustration. The different locations of multiple jammers would result in different jamming topology partitions, the algorithms selected are also different. For different jamming topology partitions, our proposed jammer localization scheme produces good performance. Note that for the jammers sequentially turning on, the first jammer is always localized with the Adaptive LSQ method.

Figure 13. Jamming topology partition results under 3 Jammers. (a) 3J-3B. (b) 3J-1B. (c) 2J-1B

8.4.1. Sequentially turning on

For sequentially turning on jammers, if one new jammer only results in one new jammed cluster and one new boundary cluster due to the large distance between each other, we always apply the Adaptive-LSQ method to localize it. As a result, for 3 jammers, we have 3 jammed clusters and 3 boundary cluster (3JC-3BC), and the localization results is shown in Figure 13a. For sequential cases, the localization accuracy of a particular jammer has little impact from its previous jammer due to the large distance between jammers, i.e., the median errors for all three jammers are around 4.1 m as shown in Figure 14a.

Figure 14. Localization error for different cluster combinations for 3 sequentially turning on jammers. (a) 3J-3B. (b) 3J-1B. (c) 2J-1B

If one new jammer results in one new jammed cluster and no new boundary cluster when it turns on, the centroid method is suitable for this case. For 3JC-1BC, the boundary clusters for all the jammers merge into one boundary cluster, since all three jammers are closer to each other than 3JC-3BC scenario. However, each jammer still maintains its own jammed cluster as shown in Figure 13b. Under such a jamming scenario, except for the first jammer, Adaptive LSQ will not be applicable here for the two following jammers, therefore we turn to the centroid method. The previous jammer will have more impact on the localization accuracy of the following jammers than the 3JC-3BC scenario, so the localization performance would degrade. Further, since the centroid method is also sensitive to node distribution, that is also one reason leading to worse performance.

From Figure 14c, we observe that the jammer localized with the centroid method has a median error of 5.2 m, which is almost 1 m worse than the first jammer localized with the Adaptive LSQ method. If one new jammer does not incur a new jammed cluster and boundary cluster, which means the new jammer shares the same jammed cluster and boundary cluster with its previous jammers as shown in Figure 13c, the Mirroring method will be exploited. For the Mirroring method, since the new jammer is estimated based on the estimated positions of its previous jammers, the impact from the previous jammer on localization accuracy would be even larger than in 3JC-1BC scenarios. We find in Figure 14c, that the median localization error for the jammer localized with the Mirroring method is about 9.9 m, and the other two jammers also have a median error of around 4.1 m.

8.4.2. Simultaneously turning on

Different from the sequential case, the jamming topology is the only information we obtained for simultaneously turning on jammers. If both the number of jammed clusters and boundary clusters equal to the number of jammers, that means each jammer forms an independent jammed and boundary cluster. Adaptive-LSQ would be the most accurate localization method for this case. As shown in Figure 15a, due to little impact with each other, the median errors for 3 jammers have a similar median error of around 4.1 m, which is almost the same as the sequential case with 3JC-3BC.

Figure 15. Localization error for different cluster combinations for 3 simultaneously turning on jammers. (a) 3J-3B. (b) 3J-1B. (c) 2J-1B

If the number of jammed clusters is equal to the number of jammers, but the number of boundary clusters is less, the Centroid method will be applied to the boundary cluster including multiple jammers. A typical case is 3JC-1BC as shown in Figure 15b, only centroid method is employed for localizing all three jammers. We observe that the median errors for the jammers localized with the centroid method are around 4.9 m.

If both the number of jammed cluster and boundary clusters are less than the number of jammers, some jammers must share the same jammed and boundary cluster. For 2JC-1BC scenarios, two of the jammers are within the same jammed and boundary cluster, so the Gauss-Newton searching method will be applied to these two jammers. In addition, the other jammer is localized with centroid method due to no distinct boundary cluster. Figure 15c shows the median localization error of about 14.5 and 16.6 m with the Gauss-Newton method, and the third jammer with a median error of around 4.7 m.

The observations above confirm the feasibility of our proposed multiple jammer localization strategies. For different network topology partitioning results, an appropriate jammer localization algorithm can be applied to achieve good localization accuracy. Particularly, for sequentially turning on jammers, previous jammers would affect the localization accuracy of the following jammers, but our proposed method would mitigate such impact to get better localization results for the following jammers. Whereas for simultaneously turning on jammers, the topology partitioning becomes much more complex due to mutual impact among multiple jammers, however, our strategy still works on providing good location estimation for each jammer. Further, our algorithm is generic to the localization problem for any number of jammers with or without the knowledge of the turning-on order.

8.4.3. Distance study between two jammers

We studied the effect of node transmission range on the localization accuracy by setting the distance between jammers to {500 m, 100 m, 50 m}, respectively, with the node transmission range {35 m, 45 m, 55 m}. Table 2 summarizes the distribution of clustering results, i.e., 2JC-2BC, 2JC-1BC, and 1JC-1BC, for all settings. The corresponding median error of localization is presented in Table 2.

In general, changing the node transmission range does not significantly affect the localization error 2 when jammers are turned on sequentially, with localization error always between 3 m and 4 m. However, when jammers are simultaneously turned on, the localization accuracy under L_J = 500 m degrades with increasing node transmission range, while the performance under L_J ≤ 100 m improves with increasing node transmission range.

This is because, under larger distances L_J, the intelligent multi-jammer localizer uses the Adaptive LSQ method to localize jammers. When the node transmission range increases, the number of boundary nodes reduces, and the number of constraints for the Adaptive LSQ method also decreases, leading to a degradation in localization accuracy. On the other hand, under smaller distances L_J, the dominant algorithms selected by the intelligent multi-jammer localizer are Centroid-based, Mirroring, and Gauss-Newton Searching methods. As the node transmission range increases, the interference between each jammer’s JC (or BC) decreases, leading to an improvement in localization performance.

When L_J = 500 m, where two jammers are far away from each other, it is more likely that they are located in two different boundary clusters, which indicates that there is less mutual impact on location estimation for these two jammers. The Adaptive LSQ method will dominate, and high localization accuracy will be achieved for both jammers. Particularly, the localization accuracy is around 3.5 m when the node transmission range varies for both cases of sequentially and simultaneously turning on jammers as shown in Figure 16a.

Figure 16. Median localization error as a function of the node transmission range under the 3000-node deployment. (a) LJ = 500 m. (b) LJ = 100 m. (c) LJ = 50 m

When L_J = 100 m, where two jammers approach each other, their boundary clusters will be integrated into one, but jammers clusters remain separate. Without a third jammer, it is appropriate to choose the centroid method for localizing these two jammers. However, the position estimation accuracy will decrease a little. Particularly, the centroid-based method dominates and performs localization for over 75% of scenarios as displayed in Table 2. When two jammers are sequentially turned on, the localization error is between 3.2 m and 4 m as shown in Figure 16b, and the localization accuracy of the second jammer underperforms that of the first jammer. This is because the jammed cluster formed by the second jammer is interfered with by the first jammer when two jammers are placed close by. As the node transmission range increases, the interference is weakened. When two jammers are simultaneously turned on, the localization error presents a decreasing trend, from 5 m to 4 m, when the node transmission range increases. This indicates that the increasing node transmission range improves the localization performance.

Finally, when L_J = 50 m, where two jammers get even closer, the jammed clusters also merge into one. Only the Mirroring or Gauss-Newton method can be chosen, and the localization performance will be degraded. Such performance difference is caused by the fact that both the jammed cluster and the boundary cluster of two jammers are largely overlapping due to the close proximity of the two jammers, making it extremely hard to locate each individual jammer without prior knowledge. This is the case of 1JC-1BC, whereby Mirroring algorithms are selected for sequentially turning-on cases and the Gauss-Newton Searching method is selected for simultaneously turning-on cases. As shown in Figure 16c, when jammers are sequentially turned on, the localization conducted by the dominating Mirroring algorithm achieves a similar performance (around 3.5 m) to that of when L_J = 500 m. When jammers are simultaneously turned on, the median localization error via the Gauss-Newton Searching method reduces from 5.5 m to 3.1 m when the node transmission range increases from 35 m to 55 m, suggesting that the Gauss-Newton Searching method also benefits from larger node transmission ranges. We note that in practice the attackers may not desire to place two jammers in the vicinity as it reduces the overall jamming effects in the network. Instead, the attackers would prefer to place two jammers farther away from each other to cause network communication disturbance in a large area.

9. Conclusion

In this paper, we addressed the problem of localizing jamming attackers when multiple jammers are present in a wireless network. Our jammers can be intentional jamming attackers and unintentional radio interfers coexisting in the network. We proposed to identify the physical position of jammers by leveraging the network topology changes caused by jamming. In particular, we studied the jamming effects under multiple jammers and developed a framework that can perform critical tasks of automatic network topology partitioning and intelligent multi-jammer localization. Our approach does not depend on measuring signal strength inside the jammed area, nor does it require delivering information out of the jammed area. Instead, our framework uses disturbed network communication and derives node clusters for jammer localization grounded on network topology changes. Our experimental results on a multi-hop network using MicaZ sensor nodes showed that we can successfully collect real-time network topology changes under jamming, and thus confirmed the feasibility of applying our approach in practice. In addition to utilizing the existing jammer localization algorithms, e.g., Adaptive LSQ and Centroid-based methods, we developed two new algorithms, namely Mirroring and Gauss-Newton Searching algorithms, that are particularly effective when multiple jammers create one connected jamming area. We evaluated the performance of our multi-jammer localizer through simulation using large-scale network setups with various distances between jammers. Our simulation results indicated that the multi-jammer localizer can intelligently use appropriate localization strategies to estimate the position of jammers and achieve comparable accuracy to localize a single jammer.

Range-free based localization heavily relies on the distribution of network nodes. Our future work will focus on the impact of network nodes distribution on the accuracy of jamming localization leveraging the tool of stochastic geometry. Furthermore, the jamming behaviors (i.e., the variation of jamming power, the duration and interval of jamming signal, and the mobility of jammer, etc.) also cause great trouble to the localization strategies. Therefore, a more intelligent framework integrating jamming detection, identification, and localization is in demand. In addition, we will also take more powerful jammers equipped with directional antennae into consideration.

Conflict of Interest

The author declares no conflict of interest.

Data Availability

No data are associated with this article.

Authors’ Contributions

Hongbo Liu proposed the overall multi-jammer localization framework and wrote this paper. Yingying Chen, Wenyuan Xu, and Zhenhua Liu contributed to the experimental design and embellished the whole paper. Yuchen Su participated in manuscript preparation and improved the readability of the paper by grammatical modification and polishing. All authors read and approved the final manuscript.

Acknowledgments

Thanks to the anonymous reviewers for their helpful comments and suggestions.

Funding

This work is partially supported by the National Natural Science Foundation of China under Grant No. 62172080, the Natural Science Foundation of Sichuan Province under Grants 2023NSFSC0478, and the National Key R& D Program of China No. 2022YFB3103404.

References

Hongbo Liu is a Professor with the University of Electronic Science and Technology of China, Chengdu, China. His research interests include wireless sensing and mobile computing, and cyber security and privacy.

Yingying (Jennifer) Chen is a Professor of Electrical and Computer Engineering with Rutgers University, where she is a member of the Wireless Information Network Laboratory, and also leads the Data Analysis and Information Security Laboratory. Her research interests include smart healthcare, cybersecurity and privacy, Internet of Things, and mobile computing and sensing.

Wenyuan Xu is currently a Professor with the College of Electrical Engineering, Zhejiang University. Her research interests include wireless networking, network security, and the IoT security.

Zhenhua Liu is currently working in the Arena for Research on Emerging Networks and Applications (ARENA) lab. His research interests include wireless PHY/MAC layer security, jamming/radio interference, wireless localization/tracking and mobile computing.

Yuchen Su received his bachelor’s degree from University of Electronic Science and Technology of China (UESTC), Chengdu, China, in 2022. He is pursuing the master’s degree in cyberspace security with the UESTC. His research interests include mobile computing and IoT security.

All Tables

All Figures

	Figure 1. An illustration of a multi-jammer scenario in a wireless network
In the text

	Figure 2. Instantaneous PDR and exponential moving average of PDR from node 11 to node 8, when two jammers were turned on and off in sequence
In the text

	Figure 3. A snapshot of experiment setup
In the text

	Figure 4. Topology changes as turning on and off J1 placed at the upper-left corner and J2 at the upper-right corner in sequence: (a) No jammers were on. (b) J1 was turned on at the 30th second. (c) J2 was turned on at the 60th second. (d) J1 was turned off at the 90th second
In the text

	Figure 5. Framework for automatic network topology partitioner.
In the text

	Figure 6. Framework for intelligent multi-jammer localizer
In the text

	Figure 7. A network example to show the neighborhood adjacency matrix. (a) Without jamming. (b) With jamming
In the text

	Figure 8. Clusters for jammed nodes and boundary nodes: the nodes connected by black solid lines form a jammed cluster through an MST, whereas those nodes connected by red dashed lines belong to the boundary cluster
In the text

	Figure 9. Illustration of the clustering results obtained from the MST-based topology partitioning method when two jammers are placed at various distances. (a) 2 jammed clusters, 2 boundary clusters. (b) 2 jammed clusters, 1 boundary cluster. (c) 1 jammed cluster, 1 boundary cluster
In the text

	Figure 10. Illustration for different jamming scenarios
In the text

	Figure 11. Node topology partitioning study: average number of clusters as a function of the distance between two jammers (2000-node and 3000-node deployment with node transmission range set to 30 m). (a) 2000-node. (b) 3000-node
In the text

	Figure 12. Usage of localization algorithms in our multi-jammer localizer with node transmission range setting to 30 m. (a) 2000-node. (b) 3000-node
In the text

	Figure 13. Jamming topology partition results under 3 Jammers. (a) 3J-3B. (b) 3J-1B. (c) 2J-1B
In the text

	Figure 14. Localization error for different cluster combinations for 3 sequentially turning on jammers. (a) 3J-3B. (b) 3J-1B. (c) 2J-1B
In the text

	Figure 15. Localization error for different cluster combinations for 3 simultaneously turning on jammers. (a) 3J-3B. (b) 3J-1B. (c) 2J-1B
In the text

	Figure 16. Median localization error as a function of the node transmission range under the 3000-node deployment. (a) LJ = 500 m. (b) LJ = 100 m. (c) LJ = 50 m
In the text