Topology Reconstruction and Characterisation of Wireless Ad Hoc Networks

Wireless ad hoc networks provide a useful commu- nications infrastructure for the mobile battlefield. In this paper we apply and develop passive radio frequency signal strength monitoring and packet transmission time profiling techniques, to characterise and reconstruct an encrypted wireless network's topology. We show that by using signal strength measurements from three or more wireless probes and by assuming the use of carrier sense multiple access with collision avoidance, for physical layer control, we can produce a representation of a wireless network's logical topology and in some cases reconstruct the physical topology. Smoothed Kalman filtering is used to track the reconstructed topology over time, and in conjunction with a weighted least squares template fitting technique, enables the profiling of the individual network nodes and the characterisation of their transmissions. Wireless Ad Hoc Networks (WAHNs) continue to be the focus of many research efforts, with a large number of protocols having been developed or under development. A possible application for WAHNs and the one focused on here, is the use of WAHN protocols to provide networked mobile battlefield communications. From an adversaries point of view, the communications provided by a battlefield WAHN could provide a valuable source of intelligence. The number of communicating nodes, their location and the nodes which provide the most communications, are all valuable sources of information which could be used to change the course of a battle. We wish to investigate just how much information can be gleaned from a WAHN, even when encryption techniques are used to secure both the protocol and data. The problem we consider here, is to determine how to reconstruct this secure network's topology, without decoding the transmissions and without knowing unique node identifiers such as IP addresses. The approach makes minimal assump- tions about the WAHN. In one component of the algorithm we exploit the specific behaviour of the IEEE 802.11 MAC protocol, but the algorithm is generic, and could be redesigned to exploit the behaviour of most wireless MAC protocols. The paper's main contributions are techniques that pro- duce logical graph representations of WAHNs over time, and a method that profiles and characterises their nodes using only passive, time synchronised Radio Frequency (RF) signal strength measurements. These measurements are gathered by wireless probes at different known locations, and are used to calculate the origin of each transmission (1), (2). A density based clustering technique (3), over fixed successive time intervals, in conjunction with inferences based on the MAC protocol provides the topology information. Kalman filtering is used to track each individual node's movement. We show that by using a simple linear dynamics model, smoothed Kalman filters are capable of tracking the node movement. We also show that by using the predicted location of each node, we can associate nodes recursively across the successive logical graphs and can therefore track a significant proportion of the topology over time. Finally we investigate if it is possible to classify transmitting nodes as sources, sinks or relays of data. An adversary may wish to deny communications on the battlefield and therefore attempt to disrupt communications going through a crucial net- work relay node. Similarly, for intelligence gathering purposes an adversary may wish to determine which node generates the majority of traffic, this could be a command or surveillance node in the WAHN. We show that by using the successive time measurements between each transmission, we can generate timing histograms that represent the transmission protocols used by particular nodes. These histograms characterise the nodes' transmission profiles for successive logical graphs. Using a least squares approach, we fit these node histograms to a known set of