Estimating the Relative Speed of RF Jammers in VANETs

LA TEST VERSION 01/01/2019 A T 02:32:26 1 Estimating the Relati ve Speed of RF Jammers in V ANETs Dimitrios K osmanos, Antonios Argyriou and Leandros Maglaras Abstract —V ehicular Ad-Hoc Networks (V ANETs) aim at en- hancing road safety and providing a comfortable driving en viron- ment by delivering early war ning and infotainment messages to the drivers. J amming attacks, howev er , pose a significant thr eat to their performance. In this paper , we propose a nov el Relative Speed Estimation Algorithm (RSEA) of a moving interfering vehicle that approaches a T ransmitter ( T x ) - Receiver ( Rx ) pair , that interferes with their Radio Frequency (RF) communication by conducting a Denial of Service (DoS) attack. Our scheme is completely sensorless and passive and uses a pilot-based recei ved signal without hardwar e or computational cost in order to, firstly , estimate the combined channel between the transmitter - receiv er and jammer - receiv er and secondly , to estimate the jamming signal and the relati ve speed between the jammer - recei ver using the RF Doppler shift. Moreover , the relative speed metric exploits the Angle of Projection (AOP) of the speed vector of the jammer in the axis of its motion in order to form a two-dimensional repr esentation of the geographical ar ea. This approach can effectively be applied both f or a jamming signal completely unknown to the receiver and for a jamming signal partly known to the receiv er . Our speed estimator method is pro ven to have quite accurate performance, with a Mean Absolute Error (MAE) value of appr oximately 10% compar ed to the optimal zero MAE value under different jamming attack scenarios. I . I N T RO D U C T I O N Autonomous vehicles, capable of na vigating in unpre- dictable real-world en vironments with little human feedback are a reality today [1]. Autonomous vehicle control imposes very strict security requirements on the wireless communi- cation channels that are used by a fleet of vehicles [2],[3]. This is necessary in order to ensure reliable connectivity [4]. Moreov er , the Intelligent V ehicle Grid technology , introduced in [5], allows the car to become a formidable sensor platform, absorbing information from the environment, other cars, or the driv er , and feed it to other vehicles and infrastructure so as to assist in safe navigation, pollution control and traffic management. The vehicle grid essentially becomes an Internet of Things (IoT) for vehicles, namely the Internet of V ehicles (IoV), that is capable of making its own decisions when driving customers to their destinations [6]. W i-Fi has become essential for the operation of a mod- ern vehicle [7]. W ireless communications, howe ver , being vulnerable to a wide range of attacks [8]. A RF jamming attack consists of radio signals maliciously emitted to disrupt Corresponding author: D. Kosmanos (email: dikosman@uth.gr). D. Kosmanos and Antonios Argyriou are in the Department of Electrical & Computer Engineering, University of Thessaly , V olos, Greece L. Maglaras is in the Department of Computing T echnology , De Montfort Univ ersity , Leicester , UK. legitimate communications. Such jamming is already known to be a big threat for any type of wireless network. W ith the rise in safety-critical vehicular wireless applications, this is likely to become a constraining issue for their deployment in the future. A subcategory of the jamming attacks is the Denial of Service (DoS) Attack, which is targeting to the av ailability of network services. Of special interest are the mobile jammers, which impose an added strain on vehicular networks (V ANETs). Thus, the accurate prediction of the behavior of the jammer such as its speed, becomes critical for providing a swift reaction to an attack. In this work, we propose a novel metric that captures the relativ e speed between the jammer ( J x ) and the receiver ( Rx ). W e also propose the Relativ e Speed Estimation Algorithm (RSEA) that is a completely sensorless and passive estimation method that uses pilot-based recei ved signals at the receiv er in order to, firstly , estimate the channel between the transmitter -receiv er and jammer-recei ver , secondly the jamming signal and thirdly , to estimate the relativ e speed between the jammer-recei v er using the RF Doppler shift property . This is the first work in the literature, according to our kno wledge, that proposes an algorithm for speed estimation of malicious RF jammers. Problem Statement: In addition to RF jamming, wireless communication between a transmitter ( T x ) and a recei ver ( Rx ) can be impaired by unintentional interference and mul- tiple access control (MA C) protocol collisions. Jammers can exhibit arbitrary behavior in order to disrupt and thwart com- munication with a form of Denial of Service (DoS) attack [9]. In the general case, RF jamming reduces the receiver signal to interference and noise ratio (SINR), a problem that can be addressed with classic communication algorithms. Howe ver , in several applications it is critical to detect accurately the presence of a jammer, i.e. the precise reason behind the reduction in SINR, the packet-deliv ery-ratio (PDR), and more importantly , the nature of the attack. Consequently , it is diffi- cult to determine whether the reason for the SINR reduction is an intentional jamming attack or unintentional interference. The challenge in detecting an RF jamming attack is that the information that is av ailable for a jammer is typically minimal and derives from the useful signal possibly mix ed with other types of arbitrary interference in the area. Estimating the relativ e speed between a legitimate vehicle and a jammer, we can conclude if a high interference scenario has been provok ed intentionally with the form of a DoS attack by an attacker that approaches the victim or has been pro vok ed unintentionally by an area with significant RF interference. Specifically , if the estimated relativ e speed metric is about 0, we can conclude that the jammer is moving with about the same speed with the LA TEST VERSION 01/01/2019 A T 02:32:26 2 Figure 1: The Network T opology in which the orange vehicle is the jammer that approaches the T x − Rx pair from a A OP ( θ ) angle. This figure also includes the multipath f ading effects by a static object receiv er , having as result the jammer to approach the receiver at some time instant. On the other hand, if the estimated relativ e speed gets a bigger quantity , we can conclude that the jammer is moving at quite different speeds than this of receiv er . Of particular interest is the higher lev el behavior of a jammer , like its motion/mo vement relati ve to the T x - Rx pair . This information can be ef fectiv ely utilized in order a moving DoS attacker to be classified using Machine Learning algorithms. Our solution: Using the jamming signal at the recei ver we estimate the relative speed metric ( ∆ u ) that is based on the dif ference or sum between the velocities of the jammer and the receiv er . This passi vely estimated metric also includes information regarding the Angle of Projection (A OP) of the jammed signal. Our scheme uses only the signal at the receiv er under the presence of a jammer to characterize the behavior/motion of the jammer (if the J x is approaching or moving away from the R x ) using the RF Doppler shift. W e also adopt a pilot-based method for the channel estimation between T x - Rx since it is suitable for fast varying channels, such the V ANETs, because the channel is directly estimated by training symbols or the pilot tone that are kno wn a priori to the receiver . The contributions of the paper are three-fold: • A completely sensorless and passiv e pilot-based scheme is proposed that is based on RF communication between T x − Rx being interfered by a jammer in the area. How- ev er , we do not apply the proposed RSEA for estimating only speed of T x [10]. W e try from this point-to-point communication to gather as much information as possible regarding jammer’ s beha vior , such as all the combined multipath channels among T x, Rx, J x , jammer’ s relativ e speed value and the jamming signal; • In addition, the proposed relati ve speed metric defines physical location features, because is combined with the A OP of the jammer; • The effecti ve usage of the estimated relativ e speed for a future jamming detection algorithm is outlined; It has to be highlighted that the proposed RSEA can also be applied with a completely unknown jamming signal, in the case where the T x sends more pilot symbols to the Rx than the sum of the number of different unknown to the receiv er jamming symbols being sent by the jammer with the specific v alue of parameter 2 N , which is the double number of multipath rays in the area for the estimation of both two channels between T x − Rx and J x − Rx . The rest of this paper is organized as follows: Section II presents the related work, whilst Section III analyzes the network topology , the system model analysis and the wireless channel model. Section IV presents the location aw are relativ e speed metric and Section V analytically describes the proposed RSEA. Section VI presents the experimental ev aluation of the proposed RSEA and provides comparison between different scenarios. Finally , Section VIII concludes the paper and gi ves some directions for future work. I I . R E L A T E D W O R K A. RF Jamming RF jamming has been extensi vely studied in the con- text of classical 802.11 networks without accounting for the particularities of car-to-car communications. Besides the differences in PHY design of 802.11p compared to other 802.11 amendments, the propagation conditions of V ANET are fundamentally different due to the highly dispersiv e and rapidly changing vehicular en vironment. A lot of kinds of jamming attacks has been studied in V ANETs [11]. The two most important kinds of jamming attacks are the constant jamming and the reacti ve jamming. Constant jamming trans- mits random generated data on the channel without checking the state of the channel (Idle or not). Ho we ver , the reactive jamming jams only when it senses activity on the channel otherwise it stays idle. In [12] observe that constant, periodic, but also reactiv e RF jammer can hinder communication over large propagation areas, which would threaten road safety . Reactiv e jamming attacks reach a high jamming ef ficiency and can e ven improve the energy-ef ficiency of the jammer in sev eral application scenarios [13],[14]. Also, they can easily and ef ficiently be implemented on CO TS hardware such as USRP radios [15],[16],[17]. But, more importantly , reacti ve jamming attacks are harder to detect due to the attack model, which allows jamming signal to be hidden behind transmission activities performed by legitimate users [16],[18],[19] . A different kind of attacks are the pilot-based attacks against OFDM and OFDMA signals [20]. These attacks seek to manipulate information used by the equalization algorithm to cause errors to a significant number of symbols. Howe ver , we do not e v aluate this type of attack because the point of interest of this paper is the DoS attacks that are targeting to av ailability and no to integrity . In order to be robust against pilot tone jamming attacks, OFDM and OFDMA systems must randomize their subcarrier locations and v alues. For the mitigation of this type of RF jamming attack optimal power allocation with user scheduling are proposed under reactive jamming in the area [21], utilizing also the technique of uncoordinated frequenc y hopping (UFH) [22]. UFH implies the communication between transmitter and receiver through a randomly chosen frequency channel unknown for both agents. In [23] in order the secrecy lev el of wireless networks under LA TEST VERSION 01/01/2019 A T 02:32:26 3 UFH to be characterized, showing the harmful security effect of broadband ea vesdropper adversaries capable of ov erhearing in multiple frequencies. T o be countered such eavesdroppers, we consider the use of broadband friendly jammers that are av ailable to cause interference on ea vesdroppers. The goal is to cause as much interference as possible to eav esdroppers that are located in unknown positions, while limiting the interference observed by the legitimate recei ver . Howe ver , the information about the location and speed of frienly jammers are crucial for the abov e UHF schemes. B. Localization A lot of work has covered matters of localization, which is a fundamental challenge for any wireless network of nodes, in particular , when nodes are mobile. In [24] the relati ve positions and velocities (PVs) are estimated up to a rotation and transla- tion of an anchor-less network of mobile network, given two- way communication capability between all the nodes. A least squares based dynamic ranging algorithm is proposed, which employs a classical T aylor series based approximation to esti- mate pairwise distance deri v ativ es efficiently without the usage of Doppler shifts. In [25], authors propose a dual-level travel speed calculation model, which is established under dif ferent lev els of sample sizes. W ireless sensor networks (WSNs) are widely used to maintain the location information and rely on the tracking service only when their location changes. In the proposed approach in [26], the problem of tracking cooperati ve mobile nodes in wireless sensor networks is addressed with the Doppler shifts of the transmitting signal in combination with a Kalman filter , by performing a constrained least-squares optimization when a maneuver is detected. In [27], authors suggest a method for joint estimation of the speed of a vehicle and its distance to a road side unit (RSU) for narrow-band orthogonal frequency-di vision multiplexing (OFDM) commu- nication systems. Spatial filtering and a Maximum Likelihood (ML) algorithm is developed for distance estimation. The vehicle speed is calculated using a kinematics model based on the estimated distance and Angle of Arrival (A O A) v alues. C. Speed Estimation Another class of papers proposes speed estimation systems that alerts drivers about dri ving conditions and helps them av oid joining traffic jams using multi-class classifiers. ReVISE in [28] proposes a multi-class SVM approach that uses features from the RF signal strength. Using a similar method, MUSIC [29] is a subspace based A OA estimation algorithm that exploits the eigen-structure of the cov ariance matrix of the receiv ed signals on a multi-signal classifier . Cov ariance-based speed estimation schemes have also been used for the estimation of the maximum Doppler spread, or equiv alently , the vehicle velocity that, is useful for improving handoff algorithms [30]. The authors in [31] proposed an algorithm that employs a modified normalized auto-cov ariance of recei ved signal po wer to estimate the speed of mobile nodes. Howe v er , the abo ve covariance-based speed estimator uti- lizes correlation lags to improve performance which comes at the expense of computational complexity . In [32] an algorithm that estimates the speed of a mobile phone by matching time-series signal strength data to a kno wn signal strength trace from the same road is introduced. The drawback of the correlation algorithm is the observation that the signal strength profiles along roads remain relativ ely stable over time. Howe ver , the results are more accurate than previous techniques that are based on handoffs or phone localization. In [33] a method for the estimation of speed for mobile phone users using W iFi Signal-to-Noise Ratio (SNR) and time- domain features like mean, maximum, and auto-correlation is proposed. Whilst in [34] two nov el autocorrelation (A CF) based velocity estimators are used, without requiring knowl- edge of the SNR of the link. In all the prior work, speed estimators that hav e been proposed include training procedures in order to estimate traffic congestion or other transportation performance met- rics using sensor measurements. Howe ver , speed estimation problem from wireless RF communication due to security issues has been not widely in vestigated. Only , in [35] the authors try to estimate the A O A of the specular line of sight (LOS) component of signal received from a giv en single antenna transmitter using a predefined training sequence. The results sho w the optimality of the training based Maximum Likelihood (ML) A O A estimator in the case of a randomly generated jamming signal. Howe ver , the drawback of this ML- A OA estimator is that superior performance is subject to the av ailability of a perfect CSI. On the contrary , authors in [36] introduced a new algorithm to estimate the mobile terminal speed at base station in cellular networks. This helps BTS in estimating the channel Doppler shift, using measured received signals at the Base Station (BS). The Doppler shift estimation algorithm is improved by utilizing a speed estimation window that slides over bursts with overlaps and by introducing two different lo w and high thresholds for power le vel comparisons. The performance of the proposed algorithm is modeled in a T errestrial T runked Radio (TETRA) network and the simula- tion has sho wn acceptable results for a wide range of v elocities and jammers. Ho wev er , there has been no prior work that combines a feature of the physical location, such as the A OP of the J x with its speed in order to estimate relativ e speeds of two moving vehicles (jammer - receiver) during a jamming attack, using the channel Doppler shift value. The great majority of the works ha ve used speed estimation in order to improv e handov er algorithms between transmitter and receiv er under a typical micro-cellular system with non- isotropic scattering [10] and for calculating the optimal tuning of parameters for systems that adapt to changing channel con- ditions. Our proposed technique is the first in the literature, to the best of our kno wledge, that uses the unicast communication between T x and Rx for the prediction of the jammer’ s speed and for future detection of a jamming attack. I I I . S Y S T E M - M O D E L & P R E L I M I NA R I E S A. Network T opology W e consider unicast V2V communication between transmit- ter and the receiver and a point-to-point V2V communication between a single jammer and the receiv er . This simple scenario LA TEST VERSION 01/01/2019 A T 02:32:26 4 in a rural area is used for the initial verification of our system without high interference of other vehicles. In this area, a static obstacle already e xists that impacts the communication between T x − Rx and J x − Rx . The jammer transmits wireless packets/signals that may form a reactiv e jamming signal. W e assume that the T x − Rx pair of v ehicles in our model mo ves with a constant speed for a period of time. This approach allo ws the modeling of platoons of vehicles that are formed by maintaining a constant distance with each other [1]. W e assume that the jammer mov es with a constantly increasing speed with the ultimate goal to approach the receiv er and interv ene in the ef fecti ve communication zone of the T x − Rx pair . As it can be seen in the network topology of Fig.1, the distances between J x − Rx in the y axis dy ( J x − Rx ) and in the x axis dx ( J x − Rx ) together with the actual distance between J x − Rx d ( J x − Rx ) , which is the hypotenuse of the rectangular triangle that is formed. The motion of the vehicles in Fig.1 is characterized by the speed vectors ( ~ u Rx , ~ u Jx , ~ u Tx ) . Only ~ u Rx , ~ u Tx hav e the same direction, which is the direction of the x axis. The jammer approaches the T x − Rx with an A OP ( θ ) . So, the speed vector of the jammer is projected in the axis of the motion of vector ~ u Rx with an A OP ( θ ) Fig.2a. In this figure we also notice that the A OP ( θ ) is not equal to zero. Moreover , the angle that is formed between the speed v ector of the jammer ~ u Jx , and the wireless signal that travels between the J x and the R x , is called the Angle of Departure (A OD) and is denoted as φ in Fig.2. In Fig.2a the Line of Sight (LOS) component between J x - Rx has a A OD ( φ ) equal to zero, while the non Line of Sight (NLOS) component between J x - Rx has a A OD ( φ ) , which is different to zero in Fig.2b. B. System Overview In our system model, K kno wn pilot symbols that compose the symbol vector ~ x pilot = [ x pilot (1) ...x pilot ( K )] T = [1 ... 1] T are being sent o ver consecutiv e K time instants from the transmitter to the recei ver . At the same time, the jammer simultaneously transmits ov er consecutiv e K time instants K jamming symbols to the receiver that compose the symbol vector ~ s = [ s 1 ...s K ] T . So we consider the receiv ed vector at the receiv er ~ y = [ y (1) y (2) ...y ( K )] T , which consists of the combined symbols that the R x recei ves from the transmitter and the jammer at K consecuti ve time instants. Therefore, for ev ery time instant n ∈ (0 , K ] the receiver signal y ( n ) is the summation of the pilot symbol sent by the transmitter x pilot ( n ) and the symbol sent by the jammer s n . Using pilots, the LOS channel and the N − 1 NLOS channels between J x − Rx are estimated by the receiv er . The receiv er can also define the specific value of parameter N , which is the total numner of multipath rays. The wireless channel is assumed to be constant for the duration of the transmission of the K pilot symbols from T x to Rx . C. Attacker Model W e consider jammers that aim to block completely the communication over a link by emitting interference reactively when they detect packets over the air , thus causing a Denial of Service (DoS) attack. The jammers minimize their activity to only a few symbols per packet and use minimal, b ut suf ficient power , to remain undetected. W e assume that the jammer is able to snif f any symbol of the packet over the air in real-time and react with a jamming signal that flips selected symbols at the receiv er with high probability (see [37]). The jammer is designed to start transmitting upon sensing energy abov e a certain threshold in order a reactive jamming attack to be succeed. W e set the latter to − 86 dB m as it is empirically determined to be a good tradeoff between jammer sensitivity and false transmission detection rate, when an on- going 802.11p transmission is assumed. So, the symbol vector ~ s that reaches at the R x from the J x after K time instants has the same length as the pilot symbol vector that reaches the Rx from the T x after K time instants, provided that the jammer transmits only when senses a transmission from the transmitter . Each one of the K scalar values depends on the used po wer by the jammer . The jammer continuously transmits with the same transmission power , with the purpose of ov erloading the wireless medium representing, thus a DoS attack [38]. This work assumes that when the jammer continuously transmits the same jamming symbol to the recei ver forming a simplified jamming signal of the form ~ s = [ f ...f ] T with length K and f a random unknown v alue to the receiver . Furthermore, the proposed RSEA can operate with completely unknown jamming signals. This is possible when the T x sends more pilot symbols to the Rx than the sum of the different unknown jamming symbols being sent by the jammer . Recall that the main goal of this paper is to show how we can estimate the speed of an non-cooperati ve malicatious attacker that can e ventually be used as extra useful information for the design of a RF jamming detection schemes [39]. D. Channel Model Multipath is the propagation phenomenon that results in radio signals reaching the receiving antenna by two or more paths. The multipath scenario illustrated in Fig.1 includes a static obstacle in order for the multipath effects to be considered in the communication between T x - Rx and J x - Rx . So, it exists the LOS component of the wireless signal being sent by the J x , T x and also the NLOS component. In the NLOS component the A OP ( θ ) is not equal to zero and the A OD ( φ ) between the speed vector of the jammer and the NLOS ray is also not equal to zero (see Fig.2b). The phenomenons of reflection, diffraction and scattering due to the multipath giv e rise to additional radio propagation paths beyond the direct optical LOS path between the radio transmitter and receiver . In our work, we adopt the Rician fading model, which is a channel model that includes path loss and also Rayleigh fading [40]. When a signal is transmitted the channel adds Rician fading. The Rician fading model is particularly appropriate when there is a direct propagating LOS component in addition to the faded component arising from multipath propagation. The Rician channel at time instant t is defined with the help of multiple NLOS paths, which is similar to the Rayleigh fading channel but with the addition of a strong dominant LOS LA TEST VERSION 01/01/2019 A T 02:32:26 5 component. Parameter q defines the channel between T x − Rx with q = 1 and the channel between J x − R x with q = 2 . W e define a complex Gaussian random variable ζ G that is uniform ov er the range [0 , 2 π ] and is fully specified by the variance σ 2 q . The Rician fading channel can be defined with the help of this random variable as: h q [ t ] = r k k + 1 σ q e j (2 π/λ )( f c + f d,max cos φ q ) τ q δ ( t − τ q ) + r k k + 1 ζ G (1) In the abov e equation, f c is the carrier frequency , f d,max is the maximum Doppler shift, φ q the incidence A OD between the vector of speed ~ u J x with the vector of the jamming signal, τ q = d/c is the excess delay time for the LOS ray that travels between the two communicating nodes in channel h q , d corresponds to the distance between the two communicating nodes and t is the current time instant. The first term corresponds to the specular LOS path arriv al and the second, to the aggreg ate of the large number of reflected and the scattered paths. Parameter k is the ratio of the energy in the specular path to the energy in the scattered paths; the larger k is, the more deterministic the channel is [41]. Finally , ( γ q = q k k +1 σ q ) in (1) is the complex amplitude associated with the LOS path, which is known at the receiver . Rician channel model is often a better model of representing fading compared to the Rayleigh model. The channel response ~ y after K consecutiv e symbols sent by the jammer and the transmitter is: ~ y = N − 1 X l =0 ( h 1 [ l ] ~ x pilot [ N − l ] + h 2 [ l ] ~ s [ N − l ]) + ~ w (2) In abov e equation, the ~ y is a K × 1 column vector . Moreover , ~ x pilot is the symbol v ector that the Rx receiv es from the T x after K consecutive time instants and ~ s is the symbol vector that the Rx receives from the J x after K consecutiv e time instants again. The symbol vectors ( ~ x pilot [ N − l ] , ~ s [ N − l ]) hav e the same v alues, as defined above, for the l different paths of the respective channels, where ∀ l ∈ (0 , N − 1] . The ~ w represents the additive white Gaussian noise (A WGN) with zero mean. W e assume, also, that the jammer and the transmitter send at very close time instants their symbols at the receiv er , so that h 1 , h 2 channels can remain stable for sending K symbols. Moreover , N is the o verall multipath rays in the area. For the estimation of this parameter , we use the GEMV simulator [42]. For describing the modeled area GEMV uses the outlines of vehicles, buildings and foliage. Based on the outlines of the objects, it forms R-trees. R-tree is a tree data structure in which objects in the field are bound by rectan- gles and are hierarchically structured based on their location in space. Hence, GEMV employs a simple geometry-based small-scale signal v ariation model and calculates the additional stochastic signal v ariation and the number of dif fracted and reflected rays based on the information about the surrounding objects. W e must note that the wireless RF communication of the T x - Rx pair and the J x - Rx pair is taking place in a (a) LOS ray of J x - Rx communication with φ = 0 , θ 6 = 0 (b) NLOS ray of J x - Rx communication with φ 6 = 0 , θ 6 = 0 Figure 2: Illustration of projections of velocities u Jx on the vector ~ v . T wo-dimensional scheme specific frequency band, according to the existing standard for automotiv e systems[7]. E. T ransmission in the MAC/PHY Layer W e assume single carrier communication at the PHY . The 802.11p MA C also pro vides prioritized Enhanced Distrib uted Channel Access (EDCA), and can support applications by providing different levels of Quality of Service (QoS). In our model, only the 802.11p MAC EDCA AC[0] channel with higher priority is used for the pilots. The pilot beacons from the T x to the R x are transmitted with high probability of successful deli very , increasing the accurac y of the proposed RSEA at the same time. Any type of collisions at the wireless channel resulting from competing traffic is addressed by the MA C EDCA back off mechanism for distances smaller than the Carrier Sensing (CS) range of 1000 m . So we assume that our speed estimation algorithm has a correct reaction and for high interference situations from other vehicles. I V . L O C AT I O N A W A R E R E L A T I V E S P E E D M E T R I C One of the main novel ideas of this work, is that we take into account the physical location of the J x, R x nodes and the direction of their motion when calculating the relative speed metric. In the general case, the Rx does not move in the same direction as the J x (see Fig.1). For this case, ∆ u includes the LA TEST VERSION 01/01/2019 A T 02:32:26 6 A OP (angle θ ) of the J x between J x and Rx . The geometry- aware metric takes into account the distance dy ( J x − Rx ) and the distance dx ( J x − Rx ) . So a rectangular triangle is formed by the sides dx ( J x − Rx ) , d ( Rx − J x ) , dy ( J x − Rx ) . As it can be seen from Fig.1, the distance d ( J x − Rx ) is the hypotenuse of the rectangu- lar triangle, which means that cos ( θ ) = dx ( J x − Rx ) /d ( J x − Rx ) . So, the speed of the J x (Source) with respect to the Rx speed, while the J x and the Rx are moving in the same direction, is the relative speed between the two vehicles moving towards each other and is equal to the sum of their individual speed vectors ∆ ~ u line = ~ u Jx + ~ u Rx . Moreover , ~ v = ~ u Tx || u Tx || is the unit length v ector pointing from the J x to the T x . The relative speed of the J x and the Rx can be defined as the following dot product: ∆ u = ~ v ∆ ~ u line (3) T o represent all the speed v ectors of Fig.1 in two dimensions ( x, y ) , we project the v ector ~ u Jx on the unit length v ector ~ v . The direction of ~ v is the x axis (see Fig.2). The projected vector is ~ u Jx cos ( θ ) . On the other hand, ~ u Rx is already a vector in the direction of the x axis (see Fig.2), which has the same direction as the projection of ~ u Jx . This allo ws the calculation of the relativ e speed between J x − Rx using the two vectors ( ~ u Jx cos ( θ ) , ~ u Rx ) that have the same direction with the vector ~ v . In (3), if we use the projection v ector ~ u Jx cos ( θ ) and the ~ u Rx vector , we get the final v ersion of our metric, which is: ∆ u = | ~ u Jx ( dx ( J x − Rx ) /d ( J x − Rx ) ) + ~ u Rx | = | ~ u Jx cos ( θ ) + ~ u Rx | (4) This is the ∆ u metric in the direction of ~ v . The addition is justified by the fact that the vectors ~ u Jx cos ( θ ) , ~ u Rx hav e the same direction. In the above equation, ~ u Jx , ~ u Rx are the speed vectors of the J x and the Rx , respectiv ely . According to our model, if the J x approaches the receiver , cos ( θ ) increases. As the ~ u Rx remains constant and the ~ u Jx is constantly increasing, (4) is an increasing function and its maximum value indicates a nearby jamming attack. As ∆ u increases, the jammer approaches the receiv er and when ∆ u decreases, the jammer is moving aw ay from the T x and the Rx . If the J x and the Rx are located on the same road, an actual straight line and the vectors ~ u Jx , ~ u Rx , have the same direction, then our metric is the sum between J x − Rx speed vectors ( ~ u Jx + ~ u Rx ) . Otherwise, if the vectors ~ u Jx , ~ u Rx hav e opposite directions, our metric is estimated by the dif ference ( ~ u Jx − ~ u Rx ) . T aking into account the direction of the J x relati ve to the direction of the Rx the general form of the abov e metric is: ∆ u = | ~ u Jx cos ( θ ) ± ~ u Rx | (5) It is crucial to point out that the above metric is the actual value of the relativ e speed that will be used in the subsequent sections to model the Doppler shift between the jammer and the receiv er . V . P R O P O S E D E S T I M A T I O N S C H E M E A. Estimation of the Combined Pilot/J amming Signal The channel between two nodes with jamming is captured in (2). For the proposed RSEA a pilot-based method for channel estimation is used. So, the signals that Rx recei ves from the T x and the jammer interfere additiv ely . In (2), if we differentiate the one LOS component from the other N − 1 NLOS components, we ha ve: ~ r LOS = h LOS 1 ~ x pilot [ N ] + h LOS 2 ~ s [ N ] (6) Where, the channel v alues h LOS 1 = h 1 [0] , h LOS 2 [2] = h 2 [0] and the symbol vectors ~ x pilot [ N ] , ~ s [ N ] represent the unique LOS component of the total N multipath values. If the NLOS multipath component is added: ~ y = ~ r LOS + N − 1 X l =1 ( h 1 [ l ] ~ x pilot [ N − l ] + h 2 [ l ] ~ s [ N − l ]) + ~ w (7) In (7), the receiv ed vector ~ y is the con volution between h 1 and the pilot symbol vector ~ x pilot and the con volution between h 2 and the jamming symbol vector ~ s . Moreover , the K × 1 column received vector ~ y for the K received values for every time instant during which the recei ver collects ev ery pilot that is sent from the transmitter is: ~ y =    r LOS [1] + P N − 1 l =1 ( h 1 [ l ] + h 2 [ l ] s 1 [ N − l ]) ... r LOS [ K ] + P N − 1 l =1 ( h 1 [ l ] + h 2 [ l ] s K [ N − l ])    +   w 1 ... w K   (8) T o estimate the channel between T x - Rx ( h 1 ) , the channel between J x - R x ( h 2 ) and the jamming symbol vector ~ s , the best we can do is to estimate the combined vector parameter: ~ z =    P N − 1 l =0 ( h 1 [ l ] x pilot [ N − l ] + h 2 [ l ] s 1 [ N − l ]) ... P N − 1 l =0 ( h 1 [ l ] x pilot [ N − l ] + h 2 [ l ] s K [ N − l ])    (9) V ector ~ z has the abov e form for the short time that is required by the receiver to collect all the K symbols of the pilot vector . Recall that for a short time duration, the wireless channel is assumed constant. So for all the K v alues of vector ~ z in (9), the parameters h 1 [ l ] , h 2 [ l ] , x pilot [ N − l ] remain constant and only the jamming symbols may change depending on the form of the jamming symbol v ector sent by the jammer . W e use a MMSE estimator [43], which finds a better estimate from least squares (LS), in order the K v alues of ~ z to be estimated: ˆ ~ z = ( ~ x H pilot C − 1 w ~ x pilot ) − 1 ~ x H pilot C − 1 w ~ y (10) C w is the cov ariance matrix of the noise vector ~ w . V ector ~ z in (10) has K components each having N unkno wn multipath channel components. So, both the h 1 , h 2 channels can be estimated and also the K values of the jamming signal ~ s can be estimated too. If the simplified jamming signal is used 1 , in which the jammer continuously sends the same jamming symbol, which 1 ~ s = [ f ...f ] T LA TEST VERSION 01/01/2019 A T 02:32:26 7 is unknown to the Rx , we have 2 N unkno wn v alues for the two channels h 1 , h 2 with K equations in (9) and one unknown value for the jamming symbol f . So if the condition K > 2 N + 1 is valid, we can see that each one of the channel values h 1 , h 2 out of N multipath values can be estimated with the elimination method for the solution of the linear system with K equations and 2 N unknown values in (9). The values of the wireless channels h 1 , h 2 remain constant for each value of vector ~ z . Moreov er , the abov e linear system can also be solved with a completely unknown to the Rx jamming signal, provided that the length of the pilot symbol vector ~ x pilot being sent from the T x to the Rx is larger than the sum of the number of the unknown jamming symbols with the v alue of parameter 2 N , which is the double number of ov erall multipath rays in the area for the estimation of both h 1 , h 2 channels. W e only utilize the LOS component of the vector ~ z for the estimation of the relati ve speed metric using Doppler shift. So, the useful part from v ector ~ z that we need for the relative speed estimation through the Doppler shift is ~ r LOS = (    h LOS 1 + h LOS 2 s 1 ... h LOS 1 + h LOS 2 s K    ) . If we only want to estimate the h LOS 1 , h LOS 2 values of vector ~ r LOS without the multipath values, the above conditions for the solution of the linear system in (8) can be simplified to K > 4 for the simplified jamming signal form. B. Pr oposed Algorithm Algorithm 1 Relati ve Speed Estimation Algorithm (RSEA) 1: N % It is specified by the T x for the specific area using the GEMV propagation model. 2: for Every time step ( t RS E A ) A pilot signal with K = 2 N + 2 symbols being sent from T x to Rx do 3: N % It is re-specified by the T x for the specific area using the GEMV propagation model. 4: ˆ ~ z ← MMSE( ~ y , C − 1 w ) 5: ~ r LOS ← (    h LOS 1 + h LOS 2 s 1 ... h LOS 1 + h LOS 2 s K    ) %LOS components 6: if (( K > 2 N + 1 ) )) % and ~ s has the simplified jamming signal form then 7: ˆ ~ r LOS ← (    h LOS 1 + h LOS 2 s ... h LOS 1 + h LOS 2 s    ) % The ~ r LOS and ~ z values can be estimated. 8: ˆ r LOS [1] − h LOS 1 = ( a 1 + b 1 j ) s 9: end if 10: ˆ ∆ u Estimation % estimated relative speed v alue from (8) 11: end for The proposed RSEA is presented in Algorithm 1. First, the T x specifies the number of multipath rays N in the area that the GEMV propagation model is used, as explained in subsection (III). Then, the RSEA is used for ev ery time step with the transmission of a pilot that consists of K = 2 N + 2 symbols. In line 4 of the algorithm the combined channel between the T x and the Rx , with the intervention of the J x , is estimated from the vector ~ y using a MMSE estimator . Depending on the jamming signal, the inequality that must be v alid for the RSEA system to be resolvable for all the N multipath values is different. In the final 10th line of the RSEA, the relative speed value is estimated. A component ˆ r LOS [1] of the estimated vector of the combined LOS channels ˆ ~ r LOS 2 can be combined with the ray-optical baseband complex- number ( a 1 + b 1 j ) s 1 , which is the jamming signal that the Rx finally recei ves from the J x . Specifically , the subtraction of the channel h LOS 1 component from the ˆ r LOS [1] value can be set equal to the ray-optical baseband complex-number ( a 1 + b 1 j ) s 1 . The complex number ( a 1 + b 1 j ) s 1 characterizes the baseband form of the narrowband wireless channel. This narrowband wireless channel is a function of the relative speed ∆ u between the jammer and receiv er and the Doppler shift between the two moving objects. C. Channel Model with Doppler Shift In this subsection, we describe in more detail the wireless LOS combined channel model h LOS 1 + h LOS 2 between T x - Rx and J x - Rx . The tracked LOS components also show fading characteristics, likely due to the ground reflection which cannot be resolved from the true LOS. For this reason, we choose the same model for the LOS component as for the discrete components. So central to this paper , is the introduction of the proposed metric ∆ u in the channel model of (1), taking into account the pathloss value at the receiver . This pathloss value only depends on the distance between the communicating nodes and usually gets small v alues for a narrowband wireless channel. Let us consider the channel model such as defined by the Rx for a ray transmitted between two nodes as [44]: 2 X q =1 h LOS q ( t, τ q ) = 2 X q =1 γ q po q e j (2 π/λ )( f c + f d,max cos φ q ) τ q δ ( t − τ q ) (11) In the above equation, q defines the channel between T x − Rx with q = 1 and the channel between J x − Rx with q = 2 , γ q i is the complex amplitude associated with the LOS path and po q represents the free space propagation loss [45], λ is the wa velength, f c the carrier frequency , f d,max is the maximum Doppler shift that depends on the ∆ u metric such as in (3), φ q is the incidence A OD between the v ector of speed ~ u J x and the v ector of the jamming signal, ( τ q = d/c ) is the e xcess delay time that the ray tra vels between the two nodes, and t is the current time instant. W e assume the LOS case for the communication between the jammer and the receiv er , as can be seen in Fig.2a. The LOS ray between the J x and the Rx has the same direction with the speed vector of the jammer . 2 Each one of the K components of ~ r LOS has the same combined channel values LA TEST VERSION 01/01/2019 A T 02:32:26 8 As a consequence the A OD is equal to zero ( cos φ q = 1 , in (11)). The observed frequenc y at the receiv er is f 0 = f c (1 + ∆ u c cos φ q ) , which depends on the relativ e speed ∆ u of the two vehicles (jammer , recei ver) that we defined in the previous subsection. The baseband channel model for a ray transmitted between two nodes with the intervention of a jammer therefore becomes: 2 X q =1 h LOS q ( t, τ q ) = 2 X q =1 γ q po q e j (2 π/λ ) f c (1+ ∆ u c cos φ q ) τ q δ ( t i − τ q ) (12) W e can see that the Doppler shift ∆ f Hz that is observ ed in the R x can be equal with [46]: ∆ f = ∆ uf c cos φ q c (13) And the maximum Doppler shift is: f d,max = ∆ u c (14) Now , let τ q be the time that is required for a signal to trav el the distance d . Then, we can re-write h LOS 2 from (12) as: h LOS 2 ( t, τ 2 ) = γ 2 po 2 e j (2 π/λ ) f c (1+ ∆ u c ) d c δ ( t − ( d c )) (15) In the above equation, we use a f c = 5 , 9 Ghz , which is the band dedicated to V2V communication. The channel h LOS 2 ( t, τ 2 ) is also the channel of a baseband signal in (15) and if ( ∆ u c >> 1) has the form: h LOS 2 ( t, τ 2 ) = γ 2 po 2 e j (2 π/λ )( f c ∆ u c ) d c δ ( t − ( d c )) (16) T o get our final signal model, we replace the path-loss parameter po with equation: po = G 0 ,p ( d ref d ) n p (17) Where, G 0 ,p is the recei ved po wer at a reference distance d ref , which is a standard v alue at about 100m, n p is the path-loss exponent, which is equal to 2 for the pure LOS links and d i is the distance that the transmitted ray travels between the two communicating nodes. So, po only depends on the distance d that the ray travels. W e denote ∆ t = t RS E A i − t RS E A i − 1 as the time interval between the current time instant and the preceding one, in which the RSEA is reapplied ( t RS E A i − 1 ) . Furthermore, if h LOS 2 ( t, τ 2 ) represents the channel between the Rx - J x pair , the distance between the two nodes after the time interval ∆ t is d = ∆ u ∆ t , when the jammer approaches the receiv er . Substituting (17) into (16), h LOS 2 can be rewritten as: h LOS 2 ( t, τ 2 ) = γ 2 G 0 ,p ( d ref ∆ u ∆ t ) 2 e j (2 π/λ )( f c ∆ u c ) τ 2 δ ( t − ( d c )) (18) In the above equation, the only unknown parameter is ∆ u at time t . Reor ganizing (18) we have: h LOS 2 ( t, τ 2 ) = γ 2 G 0 ,p ( d 2 ref ∆ u 2 ∆ t 2 ) δ ( t − ( d c ))(cos ( ω 2 ) + j sin ( ω 2 )) (19) where, ω 2 = (2 π /λ )( f c ∆ u c ) τ 2 i . In the above equation, the only unknown parameter is ∆ u . For the LOS channel between T x − Rx , we know that the receiv er moves with the same speed as the transmitter, such as a platoon of vehicles with two members. The abov e means that the Doppler phenomenon is non-existent. Follo wing (16) for the formulation of the channel h LOS 1 without the existence of Doppler phenomenon, we can see that this channel only de- pends on the path-loss component and the complex amplitude associated with the LOS path. The path-loss component po 1 and the complex amplitude variable γ 1 can be estimated by the receiv er . So the h LOS 1 can be represented by a comple x number: h LOS 1 ( t, τ 1 ) = γ 1 po 1 e 0 = a T x − Rx + b T x − Rx j (20) Reformulating the combined value of the LOS channels ( h LOS 1 , h LOS 2 ) in (12) by combining equations (20), (19), we hav e: 2 X q =1 h LOS q ( t, τ qi ) = γ 1 po 1 + γ 2 G 0 ,p ( d 2 ref ∆ u 2 ∆ t 2 ) δ ( t − ( d c ))(cos ( ω 2 ) + j sin ( ω 2 )) (21) D. Relative Speed Estimation At this point we ha ve an estimate of the baseband channel h LOS 2 between J x − Rx , which can be represented with a complex number . The final baseband signal that reaches at the receiv er after the interv ention of the jammer can be represented as ( a 1 + b 1 j ) s . From Algorithm (1), we know that the jamming symbols of the symbol vector ~ s is part of the vector ~ r LOS . So, if from the estimated combined v alue ˆ r LOS we subtract the channel h LOS 1 , which can be estimated by the recei ver , the v alue ( ˆ r LOS − h LOS 1 = h LOS 2 s) can be set equal to the baseband receiv ed signal at the receiv er: ˆ r LOS − h LOS 1 = ( a 1 + b 1 j ) s (22) From the above equation, as well: h LOS 2 s = ( a 1 + b 1 j ) s (23) Reusing the (19) from the previous Section, the ray-optical baseband complex number ( a 1 + b 1 j ) can be set equal with: ( a 1 + b 1 j ) s = γ 2 G 0 ,p ( d 2 ref ∆ u ∆ t 2 ) δ ( t − ( d c ))(cos ( ω 2 ) Re ( s ) + j sin ( ω 2 ) I m ( s )) (24) where, ω 2 = (2 π /λ )( f c ∆ u c ) τ 2 ) . The jamming signal ~ s is estimated by the receiv er from Algorithm (1). So the Re ( s ) , I m ( s ) are known values to the receiv er . From the abov e equation, we can calculate the desired parameters a 1 , b 1 : a 1 / ( γ 2 G 0 ,p ( d 2 ref δ ( t − ( d c )) ∆ u 2 ∆ t 2 )) = cos ((2 π /λ )( f c ∆ u c ) τ 2 ) (25) LA TEST VERSION 01/01/2019 A T 02:32:26 9 Figure 3: Graphical Representation of the ∆ t ef f from the T x − Rx pair between the Communication Zone and Ef fectiv e Zone of the J x . b 1 / ( γ 2 G 0 ,p ( d 2 ref δ ( t − ( d c )) ∆ u 2 ∆ t 2 )) = sin ((2 π /λ )( f c ∆ u c )) τ 2 ) (26) From (25),(26) and with the use of the Euler identity , we have: cos((2 π /λ )( f c ∆ u c )) τ 2 ) 2 + sin((2 π /λ )( f c ∆ u c )) τ 2 ) 2 = 1 (27) In (27) there is only one unknown variable ∆ u . So, we can calculate ∆ u as: c ∆ u = 4 v u u t G 2 0 ,p γ 2 2 d 4 ref δ ( t − ( d c )) 2 ∆ t 4 ( a 2 1 + b 2 1 ) (28) From the above equation, we can see that the estimated c ∆ u value depends on the excess delay time τ 2 = d c that is caused by the Doppler phenomenon. V I . P E R F O R M A N C E E V A L UA T I O N A. Evaluation Setup Our e valuation scenario is conducted on the outskirts of the city of Aachen, representing a real-word en vironment; while assuming that this is a rural area. Our experimental setup considers unicast data transmissions in a network consisting of three nodes: a transmitter , a receiv er and a jammer , and V2X broadcast communication for 10 interfering vehicles outside of the CS range between the T x and the R x (distance more than 1000m). T wo different moving RF jamming attacks scenarios are e valuated. Analyzing RF Jammer Behavior 1 VI-B, the T x - Rx pair (see Fig.1) travels with a constant speed of approximately 50 K m/h and with constant distance of approximately 20m, as a platoon of vehicles. The J x is also moving on a side road with zero initial speed and accelerates to a maximum speed of 60Km/h in order to approach the T x - R x pair . In RF Jammer Behavior 2 VI-C the transmitter and the receiv er travel with constant speed of approximately 48 K m/h when the jammer approaches the crossroads, as illustrated in Fig.3, with accelerating speed and a maximum limit of 50 k m/h . Our experiments are conducted using the V eins-Sumo sim- ulator [47] with the simulation parameters presented in T able I such as: The initial distance between the jammer and the pair of R x - T x , d J x − Rx , the distance that separates the receiv er from the transmitter throughout the course of the simulation d T x − R x . The closest distance in which the jammer arri ves relativ e to the T x - R x pair as well as the power of all the transmitted signals P T x ,J x . The time interval ∆ t after RSEA is reapplied. The specific value of the parameter N , which is the number of the multipath rays. Last, the standard reference distance d ref is used for the estimation of the LOS path loss component. As illustrated in Fig.3, there is a time interv al ∆ t ef f , in which the transmitter can ef fectiv ely communicate with the receiv er . It starts with the ’Start of Communication Zone’ and ends with the ’Start of the Effective Zone’ of the J x . After the start of the effecti ve zone of the J x , the jammer is located at distances smaller than 30m away from the receiver and it can completely jam the communication between the T x and the Rx by constructing a ’Black hole’ . All the ev aluation parameters are summarized in T able II. During the performance e valuation we test our proposed RSEA with dif ferent SINR v alues for two real-life scenarios. When the jamming vehicle is approaching the T x - Rx pair , the SINR is: S I N R = || h 1 ~ x pilot || 2 || h 2 ~ s || 2 + σ 2 n (29) The SINR lev el is measured by the receiv er at the PHY layer . In the abov e equation, the noise power σ 2 n is the noise power . Moreover , the Mean Absolute Error (MAE) between the real ∆ u value and the estimated is calculated for both scenarios. This is the dif ference between the actual relative speed metric ∆ u with the estimated relati ve speed metric ˆ ∆ u . M AE = 1 ns | ∆ u i − ˆ ∆ u i | (30) where i is an integer number that identified with the current time instant in which the real and the estimated ∆ u variable hav e a specific value and ns = 10 is the number of measure- ments for the specific speed v alue. The MAE v alue gets its optimal zero v alue when the real ∆ u is identified with the estimated. W e assume this optimal value as a reference point for the MAE (%) calculations for the rest of the paper . B. Results of RF J ammer Behavior 1 In RF Jammer Behavior 1, we assume that the pair T x - Rx mo ves with a high constant speed (50 Km/h) when the jammer accelerates with a higher maximum speed (60 Km/h), while transmitting a jamming signal with a simplified form to the receiv er . The first figure of Fig.4a shows a comparison between the real ∆ u and the estimated value. Specifically , by observing the start time of the steep slope of SINR in Fig.5b, we can conclude that it coincides with the start of the jamming attack, the 15.5 sec. The main reason for the sharp decrease of the SINR in our experiment is the jamming attack and LA TEST VERSION 01/01/2019 A T 02:32:26 10 T able I: Simulation P arameters Evaluation Parameters in V eins Simulator V alues d T x ,R x 20m [ C W [ min ] , C W [ max ]] [3,7] V ehicle’s Transmission Range 130-300m Initial d J x − Rx 300m CS range of 802.11p protocol 1000m Interfering vehicles outside of CS range T x − R x 10 d J x − Rx at ”Black hole” 25m P T x,J x 100mW Minimum sensitivity ( P th ) -69dBm to -85dBm f c 5.9GHz Doppler shift for ∆ u = 120 k m/h ± 655 . 5 Hz d ref 100m ∆ t 2s N 4 T able II: Evaluation scenario parameters Independent parameters RF jammer 1 RF jammer 2 T x - Rx velocity 50 Km/h 48 Km/h J x velocity 60 Km/h 50 Km/h ∆ t ef f 15.5 sec 18 sec ”Black hole” of communication 13.5 sec 18 sec T ime of ∆ u peak 23.4 sec 25 sec not the interference from the entire en vironment. Moreover , in Fig.4a, after 15.5 sec, for which ∆ u is above 20 rad*m/s, the SINR in Fig.4b has also a steep slope. So, the effecti ve zone of communication between T x and Rx is approximately ∆ t ef f = 15 . 5 secs, whilst after that it is corrupted for 13.5 secs. So, the ’black-hole’ in the communication range between the T x and the Rx is during the time interval (15.5 secs- 29 secs). After 29 secs, we have the end of the attack. For this time interv al (15.5 secs- 29 secs), the MAE of our proposed RSEA increases to 23% from the optimal MAE value (see Fig 6). In Fig.4a, we can see that ∆ u reaches a maximum value, approximately 32 . 5 rad* m/s, at the time instant 23 . 4 sec. At this time, J x is approaching the T x - Rx pair in the main road, which is illustrated in Fig.3. The a verage MAE for the duration of RF Jammer Behavior 1 is approximately 13% worse than the optimal value. C. Results of RF J ammer Behavior 2 For the second ev aluation scenario, we assume that the pair T x - Rx trav els with constant speed (48 Km/h), which is almost the same as the maximum speed of the jammer (50 Km/h) (see Fig.5). The jammer continuously transmits a random jamming symbol to the recei ver . The start time of the jamming attack is at 18 secs during which the SINR appears to be decreasing from 5 dB to zero while ∆ u starts to increase from 20 rad*m/s to the ’peak’ value of ∆ u . The time that is needed for the J x to approach the pair T x - Rx is approximately ∆ t ef f = 18 secs. After that time, the jamming attack clearly has perfect results for 18 secs; from the 18 secs of the simulation until 36 secs, after that SINR increases more than 5 dB. If the ∆ u slope is positi v e, the J x approaches the Rx , whilst if it goes to zero, J x is removed from the effecti ve zone of communication between the T x and the Rx . The ’black-hole’ in the communication between the T x and the Rx is around the time interval (18 secs - 36 secs), during which the MAE value increases to approximately 18% from the optimal MAE value. In Fig.5, we can see that the av erage MAE for the complete duration of RF Jammer Behavior 2 is approximately 10% worse than the optimal v alue, as it is sho wn also in Fig.6 D. MAE comparison between RF J ammer Behavior 1 and RF J ammer Behavior 2 The overall comparison of the MAE results between RF Jammer Behavior 1 (Jammer 1) and RF Jammer Behavior 2 (Jammer 2) is summarized in T able III. Fig.6 sho ws that there is a quite small MAE, only 15% greater than the MAE value at the start and end of simulation. Howe ver , when the jammer approaches the receiv er the MAE shows an increase of about 23% from the optimal value for RF Jammer Behavior 1 and 18% for RF Jammer Behavior 2. The phenomenon of the larger MAE at the time of the jamming attack for RF Jammer Behavior 1 compared to that of RF Jammer Behavior 2 is attrib uted to the fast varying nature of the ∆ u metric, because it changes with a higher rate and thus, the channel between the J x and the Rx changes frequently too. So, the longer the duration of the jamming attack lasts the better the MAE results of the proposed RSEA are. For the duration of the effecti ve ”Communication Zone” between T x - Rx (∆ t ef f ) the av erage MAE was only 8% worse than the zero MAE v alue for RF Jammer Beha vior 1 and 6% for RF Jammer Behavior 2. As the jammer approaches the receiv er at a distance of approximately 30m, it could success- fully affect the effecti v e communication between T x − Rx . For the time interval of a ”Black hole” in communication between T x - Rx , the av erage MAE increases to 23% from the optimal v alue for RF Jammer Behavior 1 and 18% for RF Jammer Beha vior 2. When the ov erall a verage MAE, for the duration of the simulation is measured, an av erage MAE 13% worse than the zero MAE value for RF Jammer Behavior 1 is observed and 10% worse than the same reference point for RF Jammer Behavior 2. An average MAE for our scheme for all scenarios can be estimated and is about 13% worse than the optimal MAE value. Finally , it can be concluded from the simulation results that neither the jamming signal form nor the dif ferent J x and T x − Rx pair speeds af fect the speed estimation results significantly . Moreo ver , the insertion of 10 ”hidden” nodes further a way from the CS range of T x − Rx does not seem to affect the speed estimation values that are presented. A ”hidden” node occupies the wireless medium through the MA C/EDCA backof f mechanism (see III-E), in very rare cases. In these cases, the T x − Rx communication is disrupted, forcing the RSEA to use the signal that R x receiv es from this node for the combined channel estimation and finally , for the ∆ u estimation. In order to test our previous results under more generic scenarios, the average MAE is estimated for different jammer speed values and different number of ”hidden” nodes that are located at the edge of the CS range of the T x − Rx pair . LA TEST VERSION 01/01/2019 A T 02:32:26 11 (a) ∆ u vs Estimated ˆ ∆ u to Time (b) SINR(dB) vs Time(sec) Figure 4: RF Jammer Behavior 1 results: RSEA with speed of T x - Rx (50 Km/h) and J x maximum speed (60 Km/h) and a simplified form of jamming signal (a) Real ∆ u vs Estimated ˆ ∆ u to Time (b) SINR(dB) vs Time(sec) Figure 5: RF Jammer Behavior 2: RSEA with speed of T x - Rx (48 Km/h) and J x maximum speed (50 Km/h) and simplified jamming signal form Figure 6: Instantaneous MAE comparison between RF Jam- mer Behavior 1 and RF Jammer Behavior 2 with simplified jamming signal form Specifically we conducted several simulations, for a range of jammer speed values between [47 , 97] K m/h and number of ”hidden” nodes between [0 , 50] nodes. For these parameters, the MAE v alue increases at approximately 20% from the reference zero MAE value with the maximum jammer speed value (see Fig.7b) and at approximately 19 , 2% from the same reference value with the maximum number of ”hidden” nodes, which is 50 nodes (see Fig.7a). For values greater than 67 k m/h regarding the speed metric and 30 ”hidden” nodes, the MAE was increasing with a higher rate. For smaller values of these two ”side- effect” v alues, the increase of MAE value is negligible. So these simulation results indicate that the backoff MA C/EDCA algorithm, using a safety-related high priority T able III: RF Jammer Behavior comparison results of MAE (%) increase from the optimal zero MAE reference point. T ime Intervals MAE (Jammer 1) MAE (Jammer 2) ”Black hole” of communication T x - Rx 23% 18% T ime Interval of ∆ t ef f 8% 6% Overall Simulation T ime 13% 10% channel for the communication between T x − Rx , does not affect considerably the performance of the speed estimation algorithm. The jammer’ s speed increase, also, affects b ut not significantly the proposed RSEA. V I I . D I S C U S S I O N In Section VI we tested our proposed RSEA under different SINR v alues in order to represent realistic conditions. V2X communication generally uses broadcast messages, but in this paper we use unicast RF communication between two nodes in order to perform jammer’ s speed estimation. This type of communication is supported for adv anced safety applications of autonomous vehicles by the Qualcomm’ s Cellular V ehicle- to-Everything (C-V2X) technology [48]. The target of this paper is to e valuate the performance of the RSEA for a pair of moving nodes with limited conditions, having as a future objectiv e to be used in a real-life V ANET scenario for more LA TEST VERSION 01/01/2019 A T 02:32:26 12 (a) A verage MAE (%) vs Different number of ”hidden” nodes (b) A verage MAE (%) vs Range of jammer’ s speed values(Km/h) Figure 7: A v erage MAE (%) increase from the optimal zero MAE reference point with different ev aluation parameters: The MAE of the proposed RSEA with different number of nodes for the contention window of the MA C backof f procedure for the wireless channel bettween T x - R x and dif ferent jammer’ s speed values. than one pair of nodes. Peer to peer networks in vanets are studied lately in man y other works [49]–[51], focusing mostly on social networks message exchange, cooperati ve caching or unicast video streaming. Relativ e speed estimation results from our proposed RSEA can be collected from a T rusted Central Authority (TCA) that exists in the area. Analyzing these collected data records, the TCA make deductions based on the SINR v alue, notify approaching vehicles and e ven propose jamming free routes [52]. V I I I . C O N C L U S I O N A N D F U T U R E W O R K In this paper , we presented an algorithm for estimating the combined v alue ∆ u of the relative speed between R x and J x in combination with the A OP of the J x , during a jamming attack. A simplified jamming signal is sent to the receiv er by the jammer, that contains the same unkno wn symbol to the recei ver K times. An entirely unknown jamming signal can also be estimated by the receiv er at the proposed algorithm, too. The proposed relative speed metric can capture both the speed of the jammer and its direction relativ e to the T x - Rx mo vement. By predicting the abo ve value, we can understand jammer’ s behavior , for which Rx does not hav e any information except for the combined signal that is receiv ed from T x and the interference caused by the attacker . Our proposed RSEA uses the physical metric of ∆ u from RF communication T x − Rx in order to estimate the direction of the attacker . This metric is combined with the SINR value from the hardware (physical layer) in order for a real-life V ANET scenario to be simulated. The MAE measured is being approximately only 10% worse compared to the optimal zero MAE value under different jamming attach scenarios. As future work, we plan to combine RSEA with other metrics from the PHY layer or the network layer, such as SINR, for developing an accurate cross-layer jamming detec- tion scheme. The detection scheme will be capable to deal with more than one pair of nodes that communicate in a broadcast form. This combined metric can be also used as an extra feature in a machine-learning approach (see [53]), in which the vehicles of the area can be classified as cooperative or malicious, thereby forming a trusted vehicular network. The usage of the relati ve speed metric can also reduce false alarms and can provide additional information about the future position of a J x , such as the time that the attacker will approach the effecti ve zone of communication. The above in- formation extracted from our channel based J x - Rx analysis, can decrease false alarms compared to jamming prediction schemes that are based only on the 802.11p PHY/MAC related metrics (see the DJ A V AN in [54]), concluding the physical geographical topology of the attacker . Last but not least, this metric is appropriate for a variety of jamming attacks. R E F E R E N C E S [1] A. Mani, R. Arun, C. Chen-Nee, and G. Dipak, “Security vulnerabilities of connected vehicle streams and their impact on cooperative driving, ” IEEE Communications Magazine , vol. 53, pp. 126–132, 2015. [2] A. Herm, “ Assume self-driving cars are a hacker’ s dream? Think again , ” https://www .the guardian.com/technology/2017/aug/30/ self- driving- cars- hack ers- security, 2017, [Online; accessed 30-August- 2017]. [3] D. W AKABA Y ASHI, “W aymos Autonomous Cars Cut Out Hu- man Drivers in Road T ests, ” https://www .nytimes.com/2017/11/07/ technology/waymo- autonomous- cars.html, 2017, [Online; accessed 7- November -2017]. [4] C. Darren, “What is vehicle platooning? Dri ving T ests, ” https://www . drivingtests.co.nz/resources/what- is- v ehicle- platooning/, 2017. [5] J. A. Hartigan and M. A. W ong, “Internet of vehicles: From intelligent grid to autonomous cars and vehicular clouds, ” Internet of Things (WF- IoT), 2014 IEEE W orld F orum , 2014. [6] J. Jo and M. Gerla, “Internet of vehicles and autonomous connected car - privac y and security issues, ” Computer Communication and Networks (ICCCN), 2017 26th International Conference , 2017. [7] R. Barrett, “W i-Fi in the car: how to meet the concurrent needs of multiple systems and appli- cations, ” http://www .eene wseurope.com/design- center/ wi- fi- car- ho w- meet- concurrent- needs- multiple- systems- and- applications- 0, 2017. [8] A. Quyoom, R. Ali, D. N. Gouttam, and H. Sharma, “ A nov el mechanism of detection of denial of service attack (DoS) in V ANET using mali- cious and irrelev ant packet detection algorithm (MIPDA), ” Computing, Communication & Automation (ICCCA), 2015 International Conference on , pp. 414–419, 2015. [9] A. Y ousaf, A. Loan, R. F . Babiceanu, L. Maglaras, and O. Y ousaf, “ Architectural and information theoretic perspectives of physical layer intruders for direct sequence spread spectrum systems, ” Computers and Security , 2017. [10] Z. Ehsan and A. Ghasem, “IF-based velocity estimation of the mobile units in micro-cellular systems with non-isotropic scattering distrib u- tion, ” V ehicular T echnology Confer ence F all (VTC 2009-F all), 2009 IEEE 70th , 2009. [11] S. Malebary and W . Xu, “ A survey on jamming in vanet, ” International Journal of Scientific Research and Innovative T echnology , vol. 2, no. 1, 2015. [12] O. Punal, C. Pereira, A. Aguiar, and J. Gross, “Experimental charac- terization and modeling of RF jamming attacks on V ANETs, ” IEEE T ransactions on V ehicular T echnology , vol. 64, pp. 524 – 540, 2015. LA TEST VERSION 01/01/2019 A T 02:32:26 13 [13] M. Pajic and R. Mangharam, “Spatio-temporal techniques for antijam- ming in embedded wireless networks, ” EURASIP Journal on W ireless Communications and Networking , vol. 2010, 2010. [14] A. W ood, J. Stankovic, and G. Zhou, “DEEJ AM: Defeating energy- efficient jamming in IEEE 802.15.4-based wireless networks, ” Sensor , Mesh and Ad Hoc Communications and Networks, 2007. SECON 07. 4th Annual IEEE Communications Society Confer ence on , June 2007. [15] M. W ilhelm, I. Martinovic, J. B. Schmitt, and V . Lenders, “Short paper: reactiv e jamming in wireless networks: how realistic is the threat?” Pr oceedings of the fourth ACM conference on W ir eless network security , 2011. [16] D. Nguyen, C. Sahin, B. Shishkin, N. Kandasamy , and K. R. Dandekar , “ A real-time and protocol-aware reactiv e jamming framework built on software-defined radios, ” Proceedings of the 2014 ACM W orkshop on Softwar e Radio Implementation F orum, ser . SRIF 14. New Y ork, NY , USA: ACM , 2014. [17] E. Bayraktaroglu, C. King, X. Liu, G. Noubir , R. Rajaraman, and B. Thapa, “On the performance of ieee 802.11 under jamming, ” NFO- COM, 2008 Proceedings IEEE , April 2008. [18] A. Marttinen, A. W yglinski, and R. Jantti, “Statistics-based jamming detection algorithm for jamming attacks against tactical MANETs, ” Military Communications Conference (MILCOM), 2014 IEEE , Oct 2014. [19] M. Strasser, B. Danev , and S. Capkun, “Detection of reactiv e jamming in sensor networks, ” A CM T rans. Sen. Netw , vol. 7, no. 2, 2010. [20] T . C. Clancy , “Efficient ofdm denial: Pilot jamming and pilot nulling, ” 2011 IEEE International Conference on Communications (ICC) , 2011. [21] S. DOro, E. Ekici, and S. Palazzo, “Optimal power allocation and scheduling under jamming attacks, ” IEEE/ACM T ransactions on Net- working , vol. 25, pp. 1310 – 1323, 2017. [22] K. Xu, Q. W ang, and K. Ren, “Joint ufh and po wer control for ef- fectiv e wireless anti-jamming communication, ” 2012 Pr oceedings IEEE INFOCOM , 2012. [23] J. S. Sousa and J. P . V ilela, “Uncoordinated frequency hopping for secrecy with broadband jammers and eavesdroppers, ” 2015 IEEE In- ternational Conference on Communications (ICC) , 2015. [24] T . R. Raj, L. Geert, and v . d. V . Alle-Jan, “Relative velocity estimation using multidimensional scaling, ” Computational Advances in Multi- Sensor Adaptive Processing (CAMSAP), 2013 IEEE 5th International W orkshop , 2013. [25] W . Jiancheng, Y . Rongliang, W . Ru, and W . Chang, “Freeway travel speed calculation model based on ETC transaction data, ” Computational Intelligence and Neur oscience , vol. 2014, pp. 514 – 517, 2014. [26] K. Branislav , L. Akos, and K. Xenofon, “Tracking mobile nodes using RF Doppler shifts, ” SenSys ’07 Pr oceedings of the 5th international confer ence on Embedded networked sensor systems , pp. 29–42, 2007. [27] E. A. Ahmad, K. Markus, and F . Georg, “Distance and vehicle speed es- timation in OFDM multipath channels, ” Microwave, Radar and Wir eless Communications (MIK ON), 2016 21st International Confer ence , 2016. [28] K. Nehal, K. Ahmed E., and Y . Moustafa, “RF-based vehicle detection and speed estimation, ” V ehicular T echnolo gy Confer ence (VTC Spring), 2012 IEEE 75th , 2012. [29] B. W u, “Realization and simulation of DOA estimation using MUSIC algorithm with uniform circular arrays, ” The 2006 4th Asia-P acific Confer ence (2006) , pp. 908–912, 2016. [30] C. T epedelenlioglu and G. Giannakis, “ A spectral moment approach to velocity estimation in mobile communications, ” W ireless Communica- tions and Networking Confernce (WCNC), IEEE, 2000 , 2000. [31] R. Z. Y ahong and X. Chengshan, “Mobile speed estimation for broad- band wireless communications o ver rician f ading channels, ” IEEE T rans- actions on W ireless Communications , vol. 8, pp. 1–8, 2009. [32] C. Gayathri, V . A. V . T am, G. Marco, P . M. Richard, Y . Jie, and C. Y ingying, “V ehicular speed estimation using receiv ed signal strength from mobile phones, ” UbiComp ’10 Pr oceedings of the 12th A CM international conference on Ubiquitous computing , pp. 237–240, 2010. [33] P . K. Pedapolu, P . Kumar , V . Harish, S. V enturi, S. K. Bharti, V . Kumar , and S. Kumar , “Mobile phone user’ s speed estimation using WiFi Signal-to-Noise Ratio, ” in Proceedings of the 18th ACM International Symposium on Mobile Ad Hoc Networking and Computing . A CM, 2017, p. 32. [34] K. Branislav , L. Akos, and K. Xenofon, “SNR-independent velocity estimation for mobile cellular communications systems, ” Pr oceeding SenSys ’07 Pr oceedings of the 5th international conference on Embedded networked sensor systems , pp. 29–42, 2007. [35] A. Abdelaziz, C. E. K oksal, and H. El Gamal, “On the security of angle of arriv al estimation, ” in Communications and Network Security (CNS), 2016 IEEE Conference on , 2016, pp. 109–117. [36] A. J. Jav ad and A. G. Seyed, “Doppler shift estimation and jamming detection for cellular networks, ” Austr alian Journal of Basic and Applied Sciences , pp. 6590–6597, 2010. [37] S. Michael, L. V incent, and M. W ilhelm, “Detection of reactive jam- ming in DSSS-based wireless communications, ” IEEE T ransactions on W ir eless Communications , vol. 13, pp. 165 – 171, 2014. [38] M. Shabbir, M. A. Khan, U. S. Khan, and N. A. Saqib, “Detection and prevention of distributed denial of service attacks in V ANETs, ” in Computational Science and Computational Intelligence (CSCI), 2016 International Conference on . IEEE, 2016, pp. 970–974. [39] K. Dimitrios and A. Antonios, “Jamming attack detection in a pair of rf communicating vehicles using unsupervised machine learning, ” in V ehicular Communications , vol. 13. ELSEVIER, 2018, pp. 56–63. [40] D. Tse and P . V iswanath, Fundamentals of wireless communication . Cambridge univ ersity press, 2005. [41] E. Fatima, Abdeen Farah, G. E. Ashraf, and M. H. M. Nerma, “ A study of channel estimation in fast fading en vironments, ” in International Journal of Scientific and T echnolo gy Research , vol. 4. Directory of Open Access Journals, 2015, pp. 196–203. [42] B. Mate, B. Joo, and K. T . Ozan, “Geometry-based V ehicle-to-V ehicle channel modeling for lar ge-scale simulation, ” IEEE T ransactions on V ehicular T echnology , vol. 63, pp. 4146 – 4164, 2016. [43] S. A ymen, C. Faiza, K. Lotfi, E. Y assin, and R. Atika, “ A symbol-based estimation technique for inter-v ehicular communication performance optimization, ” IJCSI International Journal of Computer Science Issues , vol. 10, 2014. [44] A. Ghassan M.T ., A.-R. Mosa, and S. Sidi-Mohammed, “ An adaptive channel model for VBLAST in vehicular networks, ” EURASIP Journal on W ir eless Communications and Networking , vol. 2009, 2009. [45] N. Alam, A. T . Balaie, and A. G. Dempster , “Dynamic path loss exponent and distance estimation in a vehicular network using doppler effect and received signal strength, ” V ehicular T echnology Conference F all (VTC 2010-F all), 2010 IEEE 72nd , pp. 1–5, 2010. [46] J. Nuckelt, M. Schack, and T . Kurner , “Deterministic and stochastic channel models implemented in a physical layer simulator for Car-to-X communications, ” Advances in Radio Science , vol. 9”, pp. 165 – 171, 2011. [47] S. Christoph, G. Reinhard, and F . Dressler , “Bidirectionally coupled network and road traffic simulation for improved IVC analysis, ” IEEE T ransactions on Mobile Computing , vol. 10, pp. 3–15, 2011. [48] QU ALCOMM, “ Accelerating C-V2X commercialization, ” https://www . qualcomm.com/documents/path- 5g- cellular- v ehicle- everything- c- v2x, 2017. [49] M. A. Ferrag and A. Ahmim, “ESSPR: an efficient secure routing scheme based on searchable encryption with vehicle proxy re-encryption for vehicular peer-to-peer social network, ” T elecommunication Systems , vol. 66, no. 3, pp. 481–503, 2017. [50] N. Kumar and J.-H. Lee, “Peer-to-peer cooperative caching for data dis- semination in urban vehicular communications, ” IEEE Systems Journal , vol. 8, no. 4, pp. 1136–1144, 2014. [51] C. Rezende, A. Boukerche, H. S. Ramos, and A. A. Loureiro, “ A reacti ve and scalable unicast solution for video streaming over V ANETs, ” IEEE T ransactions on Computers , vol. 64, no. 3, pp. 614–626, 2015. [52] N. J. Patel and R. H. Jhaveri, “Trust based approaches for secure routing in V ANET: A survey , ” Procedia Computer Science , vol. 45, pp. 592– 601, 2015. [53] P . Oscar , A. Ismet, S. Caj-Julian, A. Gloria, . W . Klaus, and G. James, “Machine learning-based jamming detection for IEEE 802.11: Design and experimental ev aluation, ” W orld of W ireless, Mobile and Multimedia Networks (W oWMoM), 2014 IEEE 15th International Symposium , 2014. [54] M. L ynda, B.-O. Jalel, and T . N. Anh, “DJ A V AN: Detecting jamming attacks in vehicle ad hoc networks, ” Recent Advances in Modeling and P erformance Evaluation in W ireless and Systems , vol. 87, pp. 47–59, 2015.