Estimating the Relative Speed of RF Jammers in VANETs

Vehicular Ad-Hoc Networks (VANETs) aim at enhancing road safety and providing a comfortable driving environment by delivering early warning and infotainment messages to the drivers. Jamming attacks, however, pose a significant threat to their performance. In this paper, we propose a novel Relative Speed Estimation Algorithm (RSEA) of a moving interfering vehicle that approaches a Transmitter ($Tx$) - Receiver ($Rx$) pair, that interferes with their Radio Frequency (RF) communication by conducting a Denial of Service (DoS) attack. Our scheme is completely sensorless and passive and uses a pilot-based received signal without hardware or computational cost in order to, firstly, estimate the combined channel between the transmitter - receiver and jammer - receiver and secondly, to estimate the jamming signal and the relative speed between the jammer - receiver using the RF Doppler shift. Moreover, the relative speed metric exploits the Angle of Projection (AOP) of the speed vector of the jammer in the axis of its motion in order to form a two-dimensional representation of the geographical area. This approach can effectively be applied both for a jamming signal completely unknown to the receiver and for a jamming signal partly known to the receiver. Our speed estimator method is proven to have quite accurate performance, with a Mean Absolute Error (MAE) value of approximately $10\%$ compared to the optimal zero MAE value under different jamming attack scenarios.


I. INTRODUCTION
Autonomous vehicles, capable of navigating in unpredictable real-world environments with little human feedback are a reality today [1]. Autonomous vehicle control imposes very strict security requirements on the wireless communication channels that are used by a fleet of vehicles [2], [3]. This is necessary in order to ensure reliable connectivity [4]. Moreover, the Intelligent Vehicle Grid technology, introduced in [5], allows the car to become a formidable sensor platform, absorbing information from the environment, other cars, or the driver, and feed it to other vehicles and infrastructure so as to assist in safe navigation, pollution control and traffic management. The vehicle grid essentially becomes an Internet of Things (IoT) for vehicles, namely the Internet of Vehicles (IoV), that is capable of making its own decisions when driving customers to their destinations [6].
Wi-Fi has become essential for the operation of a modern vehicle [7]. Wireless communications, however, being vulnerable to a wide range of attacks [8]. A RF jamming attack consists of radio signals maliciously emitted to disrupt legitimate communications. Such jamming is already known to be a big threat for any type of wireless network. With the rise in safety-critical vehicular wireless applications, this is likely to become a constraining issue for their deployment in the future. A subcategory of the jamming attacks is the Denial of Service (DoS) Attack, which is targeting to the availability of network services. Of special interest are the mobile jammers, which impose an added strain on vehicular networks (VANETs). Thus, the accurate prediction of the behavior of the jammer such as its speed, becomes critical for providing a swift reaction to an attack. In this work, we propose a novel metric that captures the relative speed between the jammer (Jx) and the receiver (Rx). We also propose the Relative Speed Estimation Algorithm (RSEA) that is a completely sensorless and passive estimation method that uses pilot-based received signals at the receiver in order to, firstly, estimate the channel between the transmitter-receiver and jammer-receiver, secondly the jamming signal and thirdly, to estimate the relative speed between the jammer-receiver using the RF Doppler shift property. This is the first work in the literature, according to our knowledge, that proposes an algorithm for speed estimation of malicious RF jammers.
Problem Statement: In addition to RF jamming, wireless communication between a transmitter (T x) and a receiver (Rx) can be impaired by unintentional interference and multiple access control (MAC) protocol collisions. Jammers can exhibit arbitrary behavior in order to disrupt and thwart communication with a form of Denial of Service (DoS) attack [9]. In the general case, RF jamming reduces the receiver signal to interference and noise ratio (SINR), a problem that can be addressed with classic communication algorithms. However, in several applications it is critical to detect accurately the presence of a jammer, i.e. the precise reason behind the reduction in SINR, the packet-delivery-ratio (PDR), and more importantly, the nature of the attack. Consequently, it is difficult to determine whether the reason for the SINR reduction is an intentional jamming attack or unintentional interference. The challenge in detecting an RF jamming attack is that the information that is available for a jammer is typically minimal and derives from the useful signal possibly mixed with other types of arbitrary interference in the area. Estimating the relative speed between a legitimate vehicle and a jammer, we can conclude if a high interference scenario has been provoked intentionally with the form of a DoS attack by an attacker that approaches the victim or has been provoked unintentionally by an area with significant RF interference. Specifically, if the estimated relative speed metric is about 0, we can conclude that the jammer is moving with about the same speed with the arXiv:1812.11811v1 [cs.CR] 31 Dec 2018 Figure 1: The Network Topology in which the orange vehicle is the jammer that approaches the T x − Rx pair from a AOP (θ) angle. This figure also includes the multipath fading effects by a static object receiver, having as result the jammer to approach the receiver at some time instant. On the other hand, if the estimated relative speed gets a bigger quantity, we can conclude that the jammer is moving at quite different speeds than this of receiver. Of particular interest is the higher level behavior of a jammer, like its motion/movement relative to the T x -Rx pair. This information can be effectively utilized in order a moving DoS attacker to be classified using Machine Learning algorithms.
Our solution: Using the jamming signal at the receiver we estimate the relative speed metric (∆u) that is based on the difference or sum between the velocities of the jammer and the receiver. This passively estimated metric also includes information regarding the Angle of Projection (AOP) of the jammed signal. Our scheme uses only the signal at the receiver under the presence of a jammer to characterize the behavior/motion of the jammer (if the Jx is approaching or moving away from the Rx) using the RF Doppler shift. We also adopt a pilot-based method for the channel estimation between T x -Rx since it is suitable for fast varying channels, such the VANETs, because the channel is directly estimated by training symbols or the pilot tone that are known a priori to the receiver.
The contributions of the paper are three-fold: • A completely sensorless and passive pilot-based scheme is proposed that is based on RF communication between T x − Rx being interfered by a jammer in the area. However, we do not apply the proposed RSEA for estimating only speed of T x [10]. We try from this point-to-point communication to gather as much information as possible regarding jammer's behavior, such as all the combined multipath channels among T x, Rx, Jx, jammer's relative speed value and the jamming signal; • In addition, the proposed relative speed metric defines physical location features, because is combined with the AOP of the jammer; • The effective usage of the estimated relative speed for a future jamming detection algorithm is outlined; It has to be highlighted that the proposed RSEA can also be applied with a completely unknown jamming signal, in the case where the T x sends more pilot symbols to the Rx than the sum of the number of different unknown to the receiver jamming symbols being sent by the jammer with the specific value of parameter 2N , which is the double number of multipath rays in the area for the estimation of both two channels between T x − Rx and Jx − Rx.
The rest of this paper is organized as follows: Section II presents the related work, whilst Section III analyzes the network topology, the system model analysis and the wireless channel model. Section IV presents the location aware relative speed metric and Section V analytically describes the proposed RSEA. Section VI presents the experimental evaluation of the proposed RSEA and provides comparison between different scenarios. Finally, Section VIII concludes the paper and gives some directions for future work.

II. RELATED WORK
A. RF Jamming RF jamming has been extensively studied in the context of classical 802.11 networks without accounting for the particularities of car-to-car communications. Besides the differences in PHY design of 802.11p compared to other 802.11 amendments, the propagation conditions of VANET are fundamentally different due to the highly dispersive and rapidly changing vehicular environment. A lot of kinds of jamming attacks has been studied in VANETs [11]. The two most important kinds of jamming attacks are the constant jamming and the reactive jamming. Constant jamming transmits random generated data on the channel without checking the state of the channel (Idle or not). However, the reactive jamming jams only when it senses activity on the channel otherwise it stays idle. In [12] observe that constant, periodic, but also reactive RF jammer can hinder communication over large propagation areas, which would threaten road safety. Reactive jamming attacks reach a high jamming efficiency and can even improve the energy-efficiency of the jammer in several application scenarios [13], [14]. Also, they can easily and efficiently be implemented on COTS hardware such as USRP radios [15], [16], [17]. But, more importantly, reactive jamming attacks are harder to detect due to the attack model, which allows jamming signal to be hidden behind transmission activities performed by legitimate users [16], [18], [19] . A different kind of attacks are the pilot-based attacks against OFDM and OFDMA signals [20]. These attacks seek to manipulate information used by the equalization algorithm to cause errors to a significant number of symbols. However, we do not evaluate this type of attack because the point of interest of this paper is the DoS attacks that are targeting to availability and no to integrity. In order to be robust against pilot tone jamming attacks, OFDM and OFDMA systems must randomize their subcarrier locations and values. For the mitigation of this type of RF jamming attack optimal power allocation with user scheduling are proposed under reactive jamming in the area [21], utilizing also the technique of uncoordinated frequency hopping (UFH) [22]. UFH implies the communication between transmitter and receiver through a randomly chosen frequency channel unknown for both agents. In [23] in order the secrecy level of wireless networks under UFH to be characterized, showing the harmful security effect of broadband eavesdropper adversaries capable of overhearing in multiple frequencies. To be countered such eavesdroppers, we consider the use of broadband friendly jammers that are available to cause interference on eavesdroppers. The goal is to cause as much interference as possible to eavesdroppers that are located in unknown positions, while limiting the interference observed by the legitimate receiver. However, the information about the location and speed of frienly jammers are crucial for the above UHF schemes.

B. Localization
A lot of work has covered matters of localization, which is a fundamental challenge for any wireless network of nodes, in particular, when nodes are mobile. In [24] the relative positions and velocities (PVs) are estimated up to a rotation and translation of an anchor-less network of mobile network, given twoway communication capability between all the nodes. A least squares based dynamic ranging algorithm is proposed, which employs a classical Taylor series based approximation to estimate pairwise distance derivatives efficiently without the usage of Doppler shifts. In [25], authors propose a dual-level travel speed calculation model, which is established under different levels of sample sizes. Wireless sensor networks (WSNs) are widely used to maintain the location information and rely on the tracking service only when their location changes. In the proposed approach in [26], the problem of tracking cooperative mobile nodes in wireless sensor networks is addressed with the Doppler shifts of the transmitting signal in combination with a Kalman filter, by performing a constrained least-squares optimization when a maneuver is detected. In [27], authors suggest a method for joint estimation of the speed of a vehicle and its distance to a road side unit (RSU) for narrow-band orthogonal frequency-division multiplexing (OFDM) communication systems. Spatial filtering and a Maximum Likelihood (ML) algorithm is developed for distance estimation. The vehicle speed is calculated using a kinematics model based on the estimated distance and Angle of Arrival (AOA) values.

C. Speed Estimation
Another class of papers proposes speed estimation systems that alerts drivers about driving conditions and helps them avoid joining traffic jams using multi-class classifiers. ReVISE in [28] proposes a multi-class SVM approach that uses features from the RF signal strength. Using a similar method, MUSIC [29] is a subspace based AOA estimation algorithm that exploits the eigen-structure of the covariance matrix of the received signals on a multi-signal classifier.
Covariance-based speed estimation schemes have also been used for the estimation of the maximum Doppler spread, or equivalently, the vehicle velocity that, is useful for improving handoff algorithms [30]. The authors in [31] proposed an algorithm that employs a modified normalized auto-covariance of received signal power to estimate the speed of mobile nodes.
However, the above covariance-based speed estimator utilizes correlation lags to improve performance which comes at the expense of computational complexity. In [32] an algorithm that estimates the speed of a mobile phone by matching time-series signal strength data to a known signal strength trace from the same road is introduced. The drawback of the correlation algorithm is the observation that the signal strength profiles along roads remain relatively stable over time. However, the results are more accurate than previous techniques that are based on handoffs or phone localization. In [33] a method for the estimation of speed for mobile phone users using WiFi Signal-to-Noise Ratio (SNR) and timedomain features like mean, maximum, and auto-correlation is proposed. Whilst in [34] two novel autocorrelation (ACF) based velocity estimators are used, without requiring knowledge of the SNR of the link.
In all the prior work, speed estimators that have been proposed include training procedures in order to estimate traffic congestion or other transportation performance metrics using sensor measurements. However, speed estimation problem from wireless RF communication due to security issues has been not widely investigated. Only, in [35] the authors try to estimate the AOA of the specular line of sight (LOS) component of signal received from a given single antenna transmitter using a predefined training sequence. The results show the optimality of the training based Maximum Likelihood (ML) AOA estimator in the case of a randomly generated jamming signal. However, the drawback of this ML-AOA estimator is that superior performance is subject to the availability of a perfect CSI. On the contrary, authors in [36] introduced a new algorithm to estimate the mobile terminal speed at base station in cellular networks. This helps BTS in estimating the channel Doppler shift, using measured received signals at the Base Station (BS). The Doppler shift estimation algorithm is improved by utilizing a speed estimation window that slides over bursts with overlaps and by introducing two different low and high thresholds for power level comparisons. The performance of the proposed algorithm is modeled in a Terrestrial Trunked Radio (TETRA) network and the simulation has shown acceptable results for a wide range of velocities and jammers. However, there has been no prior work that combines a feature of the physical location, such as the AOP of the Jx with its speed in order to estimate relative speeds of two moving vehicles (jammer -receiver) during a jamming attack, using the channel Doppler shift value.
The great majority of the works have used speed estimation in order to improve handover algorithms between transmitter and receiver under a typical micro-cellular system with nonisotropic scattering [10] and for calculating the optimal tuning of parameters for systems that adapt to changing channel conditions. Our proposed technique is the first in the literature, to the best of our knowledge, that uses the unicast communication between T x and Rx for the prediction of the jammer's speed and for future detection of a jamming attack.

A. Network Topology
We consider unicast V2V communication between transmitter and the receiver and a point-to-point V2V communication between a single jammer and the receiver. This simple scenario in a rural area is used for the initial verification of our system without high interference of other vehicles. In this area, a static obstacle already exists that impacts the communication between T x − Rx and Jx − Rx.
The jammer transmits wireless packets/signals that may form a reactive jamming signal. We assume that the T x − Rx pair of vehicles in our model moves with a constant speed for a period of time. This approach allows the modeling of platoons of vehicles that are formed by maintaining a constant distance with each other [1]. We assume that the jammer moves with a constantly increasing speed with the ultimate goal to approach the receiver and intervene in the effective communication zone of the T x−Rx pair. As it can be seen in the network topology of Fig.1, the distances between Jx−Rx in the y axis dy (Jx−Rx) and in the x axis dx (Jx−Rx) together with the actual distance between Jx − Rx d (Jx−Rx) , which is the hypotenuse of the rectangular triangle that is formed. The motion of the vehicles in Fig.1 is characterized by the speed vectors ( u Rx , u Jx , u Tx ). Only u Rx , u Tx have the same direction, which is the direction of the x axis. The jammer approaches the T x − Rx with an AOP (θ). So, the speed vector of the jammer is projected in the axis of the motion of vector u Rx with an AOP (θ) Fig.2a. In this figure we also notice that the AOP (θ) is not equal to zero. Moreover, the angle that is formed between the speed vector of the jammer u Jx , and the wireless signal that travels between the Jx and the Rx, is called the Angle of Departure (AOD) and is denoted as φ in Fig.2. In Fig.2a the Line of Sight (LOS) component between Jx -Rx has a AOD (φ) equal to zero, while the non Line of Sight (NLOS) component between Jx -Rx has a AOD (φ), which is different to zero in Fig.2b.

B. System Overview
In our system model, K known pilot symbols that compose the symbol vector x pilot = [x pilot (1)...x pilot (K)] T = [1...1] T are being sent over consecutive K time instants from the transmitter to the receiver. At the same time, the jammer simultaneously transmits over consecutive K time instants K jamming symbols to the receiver that compose the symbol vector s = [s 1 ...s K ] T . So we consider the received vector at the receiver y = [y(1)y(2)...y(K)] T , which consists of the combined symbols that the Rx receives from the transmitter and the jammer at K consecutive time instants. Therefore, for every time instant n ∈ (0, K] the receiver signal y(n) is the summation of the pilot symbol sent by the transmitter x pilot (n) and the symbol sent by the jammer s n . Using pilots, the LOS channel and the N − 1 NLOS channels between Jx − Rx are estimated by the receiver. The receiver can also define the specific value of parameter N , which is the total numner of multipath rays. The wireless channel is assumed to be constant for the duration of the transmission of the K pilot symbols from T x to Rx.

C. Attacker Model
We consider jammers that aim to block completely the communication over a link by emitting interference reactively when they detect packets over the air, thus causing a Denial of Service (DoS) attack. The jammers minimize their activity to only a few symbols per packet and use minimal, but sufficient power, to remain undetected. We assume that the jammer is able to sniff any symbol of the packet over the air in real-time and react with a jamming signal that flips selected symbols at the receiver with high probability (see [37]).
The jammer is designed to start transmitting upon sensing energy above a certain threshold in order a reactive jamming attack to be succeed. We set the latter to −86dBm as it is empirically determined to be a good tradeoff between jammer sensitivity and false transmission detection rate, when an ongoing 802.11p transmission is assumed. So, the symbol vector s that reaches at the Rx from the Jx after K time instants has the same length as the pilot symbol vector that reaches the Rx from the T x after K time instants, provided that the jammer transmits only when senses a transmission from the transmitter. Each one of the K scalar values depends on the used power by the jammer. The jammer continuously transmits with the same transmission power, with the purpose of overloading the wireless medium representing, thus a DoS attack [38]. This work assumes that when the jammer continuously transmits the same jamming symbol to the receiver forming a simplified jamming signal of the form s = [f...f ] T with length K and f a random unknown value to the receiver. Furthermore, the proposed RSEA can operate with completely unknown jamming signals. This is possible when the T x sends more pilot symbols to the Rx than the sum of the different unknown jamming symbols being sent by the jammer.
Recall that the main goal of this paper is to show how we can estimate the speed of an non-cooperative malicatious attacker that can eventually be used as extra useful information for the design of a RF jamming detection schemes [39].

D. Channel Model
Multipath is the propagation phenomenon that results in radio signals reaching the receiving antenna by two or more paths. The multipath scenario illustrated in Fig.1 includes a static obstacle in order for the multipath effects to be considered in the communication between T x -Rx and Jx -Rx. So, it exists the LOS component of the wireless signal being sent by the Jx, T x and also the NLOS component. In the NLOS component the AOP (θ) is not equal to zero and the AOD (φ) between the speed vector of the jammer and the NLOS ray is also not equal to zero (see Fig.2b). The phenomenons of reflection, diffraction and scattering due to the multipath give rise to additional radio propagation paths beyond the direct optical LOS path between the radio transmitter and receiver.
In our work, we adopt the Rician fading model, which is a channel model that includes path loss and also Rayleigh fading [40]. When a signal is transmitted the channel adds Rician fading. The Rician fading model is particularly appropriate when there is a direct propagating LOS component in addition to the faded component arising from multipath propagation.
The Rician channel at time instant t is defined with the help of multiple NLOS paths, which is similar to the Rayleigh fading channel but with the addition of a strong dominant LOS component. Parameter q defines the channel between T x−Rx with q = 1 and the channel between Jx − Rx with q = 2. We define a complex Gaussian random variable ζ G that is uniform over the range [0, 2π] and is fully specified by the variance σ 2 q . The Rician fading channel can be defined with the help of this random variable as: In the above equation, f c is the carrier frequency, f d,max is the maximum Doppler shift, φ q the incidence AOD between the vector of speed u Jx with the vector of the jamming signal, τ q = d/c is the excess delay time for the LOS ray that travels between the two communicating nodes in channel h q , d corresponds to the distance between the two communicating nodes and t is the current time instant. The first term corresponds to the specular LOS path arrival and the second, to the aggregate of the large number of reflected and the scattered paths. Parameter k is the ratio of the energy in the specular path to the energy in the scattered paths; the larger k is, the more deterministic the channel is [41]. Finally, (1) is the complex amplitude associated with the LOS path, which is known at the receiver. Rician channel model is often a better model of representing fading compared to the Rayleigh model.
The channel response y after K consecutive symbols sent by the jammer and the transmitter is: In above equation, the y is a K × 1 column vector. Moreover, x pilot is the symbol vector that the Rx receives from the T x after K consecutive time instants and s is the symbol vector that the Rx receives from the Jx after K consecutive time instants again. The symbol vectors ( have the same values, as defined above, for the l different paths of the respective channels, where ∀l ∈ (0, N − 1]. The w represents the additive white Gaussian noise (AWGN) with zero mean. We assume, also, that the jammer and the transmitter send at very close time instants their symbols at the receiver, so that h 1 , h 2 channels can remain stable for sending K symbols. Moreover, N is the overall multipath rays in the area. For the estimation of this parameter, we use the GEMV simulator [42]. For describing the modeled area GEMV uses the outlines of vehicles, buildings and foliage. Based on the outlines of the objects, it forms R-trees. R-tree is a tree data structure in which objects in the field are bound by rectangles and are hierarchically structured based on their location in space. Hence, GEMV employs a simple geometry-based small-scale signal variation model and calculates the additional stochastic signal variation and the number of diffracted and reflected rays based on the information about the surrounding objects. We must note that the wireless RF communication of the T x -Rx pair and the Jx -Rx pair is taking place in a

E. Transmission in the MAC/PHY Layer
We assume single carrier communication at the PHY. The 802.11p MAC also provides prioritized Enhanced Distributed Channel Access (EDCA), and can support applications by providing different levels of Quality of Service (QoS). In our model, only the 802.11p MAC EDCA AC[0] channel with higher priority is used for the pilots. The pilot beacons from the T x to the Rx are transmitted with high probability of successful delivery, increasing the accuracy of the proposed RSEA at the same time. Any type of collisions at the wireless channel resulting from competing traffic is addressed by the MAC EDCA backoff mechanism for distances smaller than the Carrier Sensing (CS) range of 1000m. So we assume that our speed estimation algorithm has a correct reaction and for high interference situations from other vehicles.

IV. LOCATION AWARE RELATIVE SPEED METRIC
One of the main novel ideas of this work, is that we take into account the physical location of the Jx, Rx nodes and the direction of their motion when calculating the relative speed metric. In the general case, the Rx does not move in the same direction as the Jx (see Fig.1). For this case, ∆u includes the AOP (angle θ) of the Jx between Jx and Rx. The geometryaware metric takes into account the distance dy (Jx−Rx) and the distance dx (Jx−Rx) . So a rectangular triangle is formed by the sides dx (Jx−Rx) , d (Rx−Jx) , dy (Jx−Rx) . As it can be seen from Fig.1, the distance d (Jx−Rx) is the hypotenuse of the rectangular triangle, which means that cos (θ) = dx (Jx−Rx) /d (Jx−Rx) . So, the speed of the Jx (Source) with respect to the Rx speed, while the Jx and the Rx are moving in the same direction, is the relative speed between the two vehicles moving towards each other and is equal to the sum of their individual speed vectors ∆ u line = u Jx + u Rx . Moreover, v = uTx ||uTx|| is the unit length vector pointing from the Jx to the T x. The relative speed of the Jx and the Rx can be defined as the following dot product: To represent all the speed vectors of Fig.1 in two dimensions (x, y), we project the vector u Jx on the unit length vector v. The direction of v is the x axis (see Fig.2). The projected vector is u Jx cos (θ). On the other hand, u Rx is already a vector in the direction of the x axis (see Fig.2), which has the same direction as the projection of u Jx . This allows the calculation of the relative speed between Jx − Rx using the two vectors ( u Jx cos (θ), u Rx ) that have the same direction with the vector v.
In (3), if we use the projection vector u Jx cos (θ) and the u Rx vector, we get the final version of our metric, which is: This is the ∆u metric in the direction of v. The addition is justified by the fact that the vectors u Jx cos (θ), u Rx have the same direction. In the above equation, u Jx , u Rx are the speed vectors of the Jx and the Rx, respectively. According to our model, if the Jx approaches the receiver, cos (θ) increases. As the u Rx remains constant and the u Jx is constantly increasing, (4) is an increasing function and its maximum value indicates a nearby jamming attack.
As ∆u increases, the jammer approaches the receiver and when ∆u decreases, the jammer is moving away from the T x and the Rx. If the Jx and the Rx are located on the same road, an actual straight line and the vectors u Jx , u Rx , have the same direction, then our metric is the sum between Jx − Rx speed vectors ( u Jx + u Rx ). Otherwise, if the vectors u Jx , u Rx have opposite directions, our metric is estimated by the difference ( u Jx − u Rx ).
Taking into account the direction of the Jx relative to the direction of the Rx the general form of the above metric is: It is crucial to point out that the above metric is the actual value of the relative speed that will be used in the subsequent sections to model the Doppler shift between the jammer and the receiver.

V. PROPOSED ESTIMATION SCHEME A. Estimation of the Combined Pilot/Jamming Signal
The channel between two nodes with jamming is captured in (2). For the proposed RSEA a pilot-based method for channel estimation is used. So, the signals that Rx receives from the T x and the jammer interfere additively. In (2), if we differentiate the one LOS component from the other N − 1 NLOS components, we have: In (7), the received vector y is the convolution between h 1 and the pilot symbol vector x pilot and the convolution between h 2 and the jamming symbol vector s. Moreover, the K × 1 column received vector y for the K received values for every time instant during which the receiver collects every pilot that is sent from the transmitter is: To estimate the channel between T x -Rx (h 1 ), the channel between Jx -Rx (h 2 ) and the jamming symbol vector s, the best we can do is to estimate the combined vector parameter: Vector z has the above form for the short time that is required by the receiver to collect all the K symbols of the pilot vector. Recall that for a short time duration, the wireless channel is assumed constant. So for all the K values of vector z in (9), the parameters h 1 [l], h 2 [l], x pilot [N −l] remain constant and only the jamming symbols may change depending on the form of the jamming symbol vector sent by the jammer. We use a MMSE estimator [43], which finds a better estimate from least squares (LS), in order the K values of z to be estimated: C w is the covariance matrix of the noise vector w. Vector z in (10) has K components each having N unknown multipath channel components. So, both the h 1 , h 2 channels can be estimated and also the K values of the jamming signal s can be estimated too.
If the simplified jamming signal is used 1 , in which the jammer continuously sends the same jamming symbol, which is unknown to the Rx, we have 2N unknown values for the two channels h 1 , h 2 with K equations in (9) and one unknown value for the jamming symbol f . So if the condition K > 2N + 1 is valid, we can see that each one of the channel values h 1 , h 2 out of N multipath values can be estimated with the elimination method for the solution of the linear system with K equations and 2N unknown values in (9). The values of the wireless channels h 1 , h 2 remain constant for each value of vector z. Moreover, the above linear system can also be solved with a completely unknown to the Rx jamming signal, provided that the length of the pilot symbol vector x pilot being sent from the T x to the Rx is larger than the sum of the number of the unknown jamming symbols with the value of parameter 2N , which is the double number of overall multipath rays in the area for the estimation of both h 1 , h 2 channels. We only utilize the LOS component of the vector z for the estimation of the relative speed metric using Doppler shift. So, the useful part from vector z that we need for the relative speed estimation through the Doppler shift is N % It is re-specified by the T x for the specific area using the GEMV propagation model. 4:ˆ z ← MMSE( y, C −1 w ) 5: 2N +1) )) % and s has the simplified jamming signal form then The proposed RSEA is presented in Algorithm 1. First, the T x specifies the number of multipath rays N in the area that the GEMV propagation model is used, as explained in subsection (III). Then, the RSEA is used for every time step with the transmission of a pilot that consists of K = 2N + 2 symbols. In line 4 of the algorithm the combined channel between the T x and the Rx, with the intervention of the Jx, is estimated from the vector y using a MMSE estimator. Depending on the jamming signal, the inequality that must be valid for the RSEA system to be resolvable for all the N multipath values is different. In the final 10th line of the RSEA, the relative speed value is estimated. A component r LOS [1] of the estimated vector of the combined LOS channelŝ r LOS 2 can be combined with the ray-optical baseband complexnumber (a 1 + b 1 j)s 1 , which is the jamming signal that the Rx finally receives from the Jx. Specifically, the subtraction of the channel h LOS 1 component from ther LOS [1] value can be set equal to the ray-optical baseband complex-number (a 1 + b 1 j)s 1 . The complex number (a 1 + b 1 j)s 1 characterizes the baseband form of the narrowband wireless channel. This narrowband wireless channel is a function of the relative speed ∆u between the jammer and receiver and the Doppler shift between the two moving objects.

C. Channel Model with Doppler Shift
In this subsection, we describe in more detail the wireless LOS combined channel model h LOS between T x -Rx and Jx -Rx. The tracked LOS components also show fading characteristics, likely due to the ground reflection which cannot be resolved from the true LOS. For this reason, we choose the same model for the LOS component as for the discrete components. So central to this paper, is the introduction of the proposed metric ∆u in the channel model of (1), taking into account the pathloss value at the receiver. This pathloss value only depends on the distance between the communicating nodes and usually gets small values for a narrowband wireless channel. Let us consider the channel model such as defined by the Rx for a ray transmitted between two nodes as [44]: In the above equation, q defines the channel between T x − Rx with q = 1 and the channel between Jx − Rx with q = 2, γ qi is the complex amplitude associated with the LOS path and po q represents the free space propagation loss [45], λ is the wavelength, f c the carrier frequency, f d,max is the maximum Doppler shift that depends on the ∆u metric such as in (3), φ q is the incidence AOD between the vector of speed u Jx and the vector of the jamming signal, (τ q = d/c) is the excess delay time that the ray travels between the two nodes, and t is the current time instant. We assume the LOS case for the communication between the jammer and the receiver, as can be seen in Fig.2a. The LOS ray between the Jx and the Rx has the same direction with the speed vector of the jammer.
As a consequence the AOD is equal to zero (cos φ q = 1, in (11)). The observed frequency at the receiver is f = f c (1 + ∆u c cos φ q ), which depends on the relative speed ∆u of the two vehicles (jammer, receiver) that we defined in the previous subsection. The baseband channel model for a ray transmitted between two nodes with the intervention of a jammer therefore becomes: We can see that the Doppler shift ∆f Hz that is observed in the Rx can be equal with [46]: And the maximum Doppler shift is: Now, let τ q be the time that is required for a signal to travel the distance d. Then, we can re-write h LOS 2 from (12) as: In the above equation, we use a f c = 5, 9Ghz, which is the band dedicated to V2V communication. The channel h LOS 2 (t, τ 2 ) is also the channel of a baseband signal in (15) and if ( ∆u c >> 1) has the form: To get our final signal model, we replace the path-loss parameter po with equation: Where, G 0,p is the received power at a reference distance d ref , which is a standard value at about 100m, n p is the path-loss exponent, which is equal to 2 for the pure LOS links and d i is the distance that the transmitted ray travels between the two communicating nodes. So, po only depends on the distance d that the ray travels. We denote ∆t = t RSEA i − t RSEA i−1 as the time interval between the current time instant and the preceding one, in which the RSEA is reapplied (t RSEA i−1 ). Furthermore, if h LOS 2 (t, τ 2 ) represents the channel between the Rx -Jx pair, the distance between the two nodes after the time interval ∆t is d = ∆u∆t, when the jammer approaches the receiver. Substituting (17) into (16), h LOS 2 can be rewritten as: In the above equation, the only unknown parameter is ∆u at time t. Reorganizing (18) we have: where, ω 2 = (2π/λ)(f c ∆u c )τ 2i . In the above equation, the only unknown parameter is ∆u.
For the LOS channel between T x − Rx, we know that the receiver moves with the same speed as the transmitter, such as a platoon of vehicles with two members. The above means that the Doppler phenomenon is non-existent. Following (16) for the formulation of the channel h LOS 1 without the existence of Doppler phenomenon, we can see that this channel only depends on the path-loss component and the complex amplitude associated with the LOS path. The path-loss component po 1 and the complex amplitude variable γ 1 can be estimated by the receiver. So the h LOS 1 can be represented by a complex number: Reformulating the combined value of the LOS channels (12) by combining equations (20), (19), we have:

D. Relative Speed Estimation
At this point we have an estimate of the baseband channel h LOS 2 between Jx − Rx, which can be represented with a complex number. The final baseband signal that reaches at the receiver after the intervention of the jammer can be represented as (a 1 +b 1 j)s. From Algorithm (1), we know that the jamming symbols of the symbol vector s is part of the vector r LOS . So, if from the estimated combined valuer LOS we subtract the channel h LOS 1 , which can be estimated by the receiver, the value (r LOS − h LOS 1 = h LOS 2 s) can be set equal to the baseband received signal at the receiver: From the above equation, as well: Reusing the (19) from the previous Section, the ray-optical baseband complex number (a 1 + b 1 j) can be set equal with: where, ω 2 = (2π/λ)(f c ∆u c )τ 2 ). The jamming signal s is estimated by the receiver from Algorithm (1). So the Re(s), Im(s) are known values to the receiver. From the above equation, we can calculate the desired parameters a 1 , b 1 :  (25), (26) and with the use of the Euler identity, we have: (27) there is only one unknown variable ∆u. So, we can calculate ∆u as: From the above equation, we can see that the estimated ∆u value depends on the excess delay time τ 2 = d c that is caused by the Doppler phenomenon.

A. Evaluation Setup
Our evaluation scenario is conducted on the outskirts of the city of Aachen, representing a real-word environment; while assuming that this is a rural area. Our experimental setup considers unicast data transmissions in a network consisting of three nodes: a transmitter, a receiver and a jammer, and V2X broadcast communication for 10 interfering vehicles outside of the CS range between the T x and the Rx (distance more than 1000m). Two different moving RF jamming attacks scenarios are evaluated. Analyzing RF Jammer Behavior 1 VI-B, the T x -Rx pair (see Fig.1) travels with a constant speed of approximately 50Km/h and with constant distance of approximately 20m, as a platoon of vehicles. The J x is also moving on a side road with zero initial speed and accelerates to a maximum speed of 60Km/h in order to approach the T x -Rx pair. In RF Jammer Behavior 2 VI-C the transmitter and the receiver travel with constant speed of approximately 48Km/h when the jammer approaches the crossroads, as illustrated in Fig.3, with accelerating speed and a maximum limit of 50km/h. Our experiments are conducted using the Veins-Sumo simulator [47] with the simulation parameters presented in Table I such as: The initial distance between the jammer and the pair of Rx -T x, d Jx−Rx , the distance that separates the receiver from the transmitter throughout the course of the simulation d Tx−Rx . The closest distance in which the jammer arrives relative to the T x -Rx pair as well as the power of all the transmitted signals P Tx,Jx . The time interval ∆t after RSEA is reapplied. The specific value of the parameter N , which is the number of the multipath rays. Last, the standard reference distance d ref is used for the estimation of the LOS path loss component.
As illustrated in Fig.3, there is a time interval ∆t ef f , in which the transmitter can effectively communicate with the receiver. It starts with the 'Start of Communication Zone' and ends with the 'Start of the Effective Zone' of the Jx. After the start of the effective zone of the Jx, the jammer is located at distances smaller than 30m away from the receiver and it can completely jam the communication between the T x and the Rx by constructing a 'Black hole'. All the evaluation parameters are summarized in Table II.
During the performance evaluation we test our proposed RSEA with different SINR values for two real-life scenarios. When the jamming vehicle is approaching the T x -Rx pair, the SINR is: The SINR level is measured by the receiver at the PHY layer. In the above equation, the noise power σ 2 n is the noise power. Moreover, the Mean Absolute Error (MAE) between the real ∆u value and the estimated is calculated for both scenarios. This is the difference between the actual relative speed metric ∆u with the estimated relative speed metric∆u.
where i is an integer number that identified with the current time instant in which the real and the estimated ∆u variable have a specific value and ns = 10 is the number of measurements for the specific speed value. The MAE value gets its optimal zero value when the real ∆u is identified with the estimated. We assume this optimal value as a reference point for the MAE(%) calculations for the rest of the paper.

B. Results of RF Jammer Behavior 1
In RF Jammer Behavior 1, we assume that the pair T x -Rx moves with a high constant speed (50 Km/h) when the jammer accelerates with a higher maximum speed (60 Km/h), while transmitting a jamming signal with a simplified form to the receiver. The first figure of Fig.4a shows a comparison between the real ∆u and the estimated value. Specifically, by observing the start time of the steep slope of SINR in Fig.5b, we can conclude that it coincides with the start of the jamming attack, the 15.5 sec. The main reason for the sharp decrease of the SINR in our experiment is the jamming attack and  not the interference from the entire environment. Moreover, in Fig.4a, after 15.5 sec, for which ∆u is above 20 rad*m/s, the SINR in Fig.4b has also a steep slope. So, the effective zone of communication between T x and Rx is approximately ∆t ef f = 15.5 secs, whilst after that it is corrupted for 13.5 secs. So, the 'black-hole' in the communication range between the T x and the Rx is during the time interval (15.5 secs-29 secs). After 29 secs, we have the end of the attack. For this time interval (15.5 secs-29 secs), the MAE of our proposed RSEA increases to 23% from the optimal MAE value (see Fig  6). In Fig.4a, we can see that ∆u reaches a maximum value, approximately 32.5 rad* m/s, at the time instant 23.4 sec. At this time, Jx is approaching the T x -Rx pair in the main road, which is illustrated in Fig.3. The average MAE for the duration of RF Jammer Behavior 1 is approximately 13% worse than the optimal value.

C. Results of RF Jammer Behavior 2
For the second evaluation scenario, we assume that the pair T x -Rx travels with constant speed (48 Km/h), which is almost the same as the maximum speed of the jammer (50 Km/h) (see Fig.5). The jammer continuously transmits a random jamming symbol to the receiver. The start time of the jamming attack is at 18 secs during which the SINR appears to be decreasing from 5dB to zero while ∆u starts to increase from 20 rad*m/s to the 'peak' value of ∆u. The time that is needed for the Jx to approach the pair T x -Rx is approximately ∆t ef f = 18 secs. After that time, the jamming attack clearly has perfect results for 18 secs; from the 18 secs of the simulation until 36 secs, after that SINR increases more than 5 dB.
If the ∆u slope is positive, the Jx approaches the Rx, whilst if it goes to zero, Jx is removed from the effective zone of communication between the T x and the Rx. The 'black-hole' in the communication between the T x and the Rx is around the time interval (18 secs -36 secs), during which the MAE value increases to approximately 18% from the optimal MAE value.
In Fig.5, we can see that the average MAE for the complete duration of RF Jammer Behavior 2 is approximately 10% worse than the optimal value, as it is shown also in Fig.6 D. MAE comparison between RF Jammer Behavior 1 and RF Jammer Behavior 2 The overall comparison of the MAE results between RF Jammer Behavior 1 (Jammer 1) and RF Jammer Behavior 2 (Jammer 2) is summarized in Table III. Fig.6 shows that there is a quite small MAE, only 15% greater than the MAE value at the start and end of simulation. However, when the jammer approaches the receiver the MAE shows an increase of about 23% from the optimal value for RF Jammer Behavior 1 and 18% for RF Jammer Behavior 2. The phenomenon of the larger MAE at the time of the jamming attack for RF Jammer Behavior 1 compared to that of RF Jammer Behavior 2 is attributed to the fast varying nature of the ∆u metric, because it changes with a higher rate and thus, the channel between the Jx and the Rx changes frequently too. So, the longer the duration of the jamming attack lasts the better the MAE results of the proposed RSEA are.
For the duration of the effective "Communication Zone" between T x -Rx (∆t ef f ) the average MAE was only 8% worse than the zero MAE value for RF Jammer Behavior 1 and 6% for RF Jammer Behavior 2. As the jammer approaches the receiver at a distance of approximately 30m, it could successfully affect the effective communication between T x − Rx. For the time interval of a "Black hole" in communication between T x -Rx, the average MAE increases to 23% from the optimal value for RF Jammer Behavior 1 and 18% for RF Jammer Behavior 2. When the overall average MAE, for the duration of the simulation is measured, an average MAE 13% worse than the zero MAE value for RF Jammer Behavior 1 is observed and 10% worse than the same reference point for RF Jammer Behavior 2. An average MAE for our scheme for all scenarios can be estimated and is about 13% worse than the optimal MAE value. Finally, it can be concluded from the simulation results that neither the jamming signal form nor the different Jx and T x − Rx pair speeds affect the speed estimation results significantly. Moreover, the insertion of 10 "hidden" nodes further away from the CS range of T x − Rx does not seem to affect the speed estimation values that are presented. A "hidden" node occupies the wireless medium through the MAC/EDCA backoff mechanism (see III-E), in very rare cases. In these cases, the T x−Rx communication is disrupted, forcing the RSEA to use the signal that Rx receives from this node for the combined channel estimation and finally, for the ∆u estimation.
In order to test our previous results under more generic scenarios, the average MAE is estimated for different jammer speed values and different number of "hidden" nodes that are located at the edge of the CS range of the T x − Rx pair.   .7b) and at approximately 19, 2% from the same reference value with the maximum number of "hidden" nodes, which is 50 nodes (see Fig.7a). For values greater than 67km/h regarding the speed metric and 30 "hidden" nodes, the MAE was increasing with a higher rate. For smaller values of these two "side-effect" values, the increase of MAE value is negligible. So these simulation results indicate that the backoff MAC/EDCA algorithm, using a safety-related high priority channel for the communication between T x − Rx, does not affect considerably the performance of the speed estimation algorithm. The jammer's speed increase, also, affects but not significantly the proposed RSEA.

VII. DISCUSSION
In Section VI we tested our proposed RSEA under different SINR values in order to represent realistic conditions. V2X communication generally uses broadcast messages, but in this paper we use unicast RF communication between two nodes in order to perform jammer's speed estimation. This type of communication is supported for advanced safety applications of autonomous vehicles by the Qualcomm's Cellular Vehicleto-Everything (C-V2X) technology [48]. The target of this paper is to evaluate the performance of the RSEA for a pair of moving nodes with limited conditions, having as a future objective to be used in a real-life VANET scenario for more than one pair of nodes. Peer to peer networks in vanets are studied lately in many other works [49]- [51], focusing mostly on social networks message exchange, cooperative caching or unicast video streaming. Relative speed estimation results from our proposed RSEA can be collected from a Trusted Central Authority (TCA) that exists in the area. Analyzing these collected data records, the TCA make deductions based on the SINR value, notify approaching vehicles and even propose jamming free routes [52].

VIII. CONCLUSION AND FUTURE WORK
In this paper, we presented an algorithm for estimating the combined value ∆u of the relative speed between Rx and Jx in combination with the AOP of the Jx, during a jamming attack. A simplified jamming signal is sent to the receiver by the jammer, that contains the same unknown symbol to the receiver K times. An entirely unknown jamming signal can also be estimated by the receiver at the proposed algorithm, too. The proposed relative speed metric can capture both the speed of the jammer and its direction relative to the T x -Rx movement. By predicting the above value, we can understand jammer's behavior, for which Rx does not have any information except for the combined signal that is received from T x and the interference caused by the attacker. Our proposed RSEA uses the physical metric of ∆u from RF communication T x − Rx in order to estimate the direction of the attacker. This metric is combined with the SINR value from the hardware (physical layer) in order for a real-life VANET scenario to be simulated. The MAE measured is being approximately only 10% worse compared to the optimal zero MAE value under different jamming attach scenarios.
As future work, we plan to combine RSEA with other metrics from the PHY layer or the network layer, such as SINR, for developing an accurate cross-layer jamming detection scheme. The detection scheme will be capable to deal with more than one pair of nodes that communicate in a broadcast form. This combined metric can be also used as an extra feature in a machine-learning approach (see [53]), in which the vehicles of the area can be classified as cooperative or malicious, thereby forming a trusted vehicular network. The usage of the relative speed metric can also reduce false alarms and can provide additional information about the future position of a Jx, such as the time that the attacker will approach the effective zone of communication. The above information extracted from our channel based Jx -Rx analysis, can decrease false alarms compared to jamming prediction schemes that are based only on the 802.11p PHY/MAC related metrics (see the DJAVAN in [54]), concluding the physical geographical topology of the attacker. Last but not least, this metric is appropriate for a variety of jamming attacks.