EP3543976A1

EP3543976A1 - A method for increasing specificity of jamming detection in a home alarm system

Info

Publication number: EP3543976A1
Application number: EP18163170.6A
Authority: EP
Inventors: Filip Skarp
Original assignee: Verisure SARL
Current assignee: Verisure SARL
Priority date: 2018-03-21
Filing date: 2018-03-21
Publication date: 2019-09-25
Anticipated expiration: 2038-03-21
Also published as: IL277301B1; PT3543976T; WO2019179648A1; CL2020002409A1; IL277301A; ES2871560T3; IL277301B2; BR112020019201B1; EP3543976B1; BR112020019201A2

Abstract

A method and a system for detecting an interference signal and classifying the interference signal into two or more classes by
- repeatedly measuring (201) a received signal strength indicator (RSSI) of a received signal;
- repeatedly calculating an average value (205) of the received signal strength indicator over a first time-period;
- repeatedly calculating a variance value (210) of the received signal strength indicator over a second time-period, said second time period at least partly overlapping said first time period;
- comparing the calculated average value (215) to a predetermined threshold average value;
- comparing the calculated variance value (220) to a predetermined threshold variance value; and
- classifying the signal into one of two or more classes (235) based on the comparisons (215, 220), one class being indicative of a jamming condition.

The system comprises an antenna, a transceiver and a processor.

Description

TECHNICAL FIELD

The invention relates to a method and a system for detecting jamming of systems using wireless communication. In particular it relates to a method and a system for differentiating between interference originating from a jamming device and interference originating from a nearby wireless system.

BACKGROUND

Alarm systems comprising detectors and gateways are commonly used in private houses and office premises. Detectors are more and more frequently connected through wireless communication means to a central unit, also known as a gateway, which in turn is connected to a central monitoring station (CMS) such as a remote alarm receiving centre. In case of an alarm situation one or more detector(s) transmits an alarm signal to the gateway and the gateway transmits an alarm signal to the central monitoring station, should the alarm system be in an armed state.
A burglar or other intruder may use electronic jamming devices to jam wireless signals between the detector(s) and the gateway or between the gateway and the central monitoring station. The present invention relates to a method and means for detection of jamming interference from such jamming devices, and for detecting nearby wireless communication interference and differentiating the two from each other.
If nothing else is explicitly stated in the present document, it is the communication between the gateway and its associated detectors and sensors that is subject to jamming.

PRIOR ART

Prior art jamming detection exist in different forms. Detectors, sensors and gateways normally communicate via radio links or by other wireless means. Radio signals also can be used for communication with the remote alarm receiving centre. As in all applications radio signals are vulnerable to disturbances and of course to deliberate jamming attempts.
GB2457102 discloses an alarm comprising a repeater which is arranged to detect a jamming signal and to transmit a jamming alert signal at a frequency other than a jammed frequency in the event that a jamming signal is detected.
Another way of handling jamming problems is disclosed in RU2399095 . The system in RU2399095 comprises a plurality of microcells in a multilevel hierarchical structure. A plurality of relay nodes is used to ensure that alarm messages are transmitted even if one microcell is jammed.

SUMMARY OF THE INVENTION

According to a first aspect of the present invention, there is provided a method of detecting an interference signal and classifying the origin of the interference signal into one of two or more classes. The method comprises the following steps:

measuring (201) a received signal strength indicator (RSSI) of a received signal;
calculating an average value (205) of the received signal strength indicator during a first time period;
calculating a variance value (210) of the received signal strength during a second time period, said second time period at least partly overlapping said first time period;
comparing the calculated average value (215) to a predetermined threshold average value;
comparing the calculated variance value (220) to a predetermined threshold variance value;
classifying the signal into one of two or more classes (235) based on the comparisons (215, 220) during overlapping time periods, one class being indicative of a jamming condition.

An advantage of an alarm system with a method of the present invention is that jamming can be detected earlier and more accurately. The method facilitates differentiation between radio frequency interference originating from a jammer and radio frequency interference originating from an adjacent wireless system.
A feature of the present invention is that unintentional interference from other benign wireless systems can be differentiated from malicious RF jamming. This differentiation will ultimately result in a decrease of the number of false alarms. The present invention provides a method of detecting jamming of intruder alarm systems or jamming of other wireless systems. The method is particularly advantageous for such systems because the number of false alarms due to detection of interference from other wireless systems can be reduced without reducing the number of true alarms, i.e. alarms due to the detection of interference from a jamming device.
The present invention provides a way to detect and differentiate radio interference originating from a jamming device, a so-called jammer, from interference originating from a nearby wireless system. When a jamming condition is detected an alarm can be generated. An alarm or alert signal can also be forwarded to a central monitoring station where further actions can be taken in a response to the jamming condition.
The jammers used today are based on noise generators. These jammers generate a broadband noise. More advanced models may use filtering to only jam parts of the spectrum - but it is still using noise to jam the system. Since noise per definition will be random it will exhibit a high degree of variance around a constant mean.
By continuously measuring the received signal strength, a so called Received Signal Strength Indicator (RSSI) and repeatedly calculating the mean and variance of the signal over a predetermined number of the latest received signal strength measurements one would have all the data needed to differentiate between noise and signal. If the average and variance is "high", there is a jammer present, if the average is high but the variance low, a carrier is present. The fact that a carrier is present is considered equivalent to the fact that a nearby wireless system is present and is transmitting.
According to a further aspect, there is provided an alarm system for detecting a possible jamming signal, the system comprising:

an antenna;
a transceiver;
a processor;

An advantage of such a system is that the number of false alarms would decrease making it easier for an alarm operator to decide when to send out a watchman, and when not to, decreasing the time and money spent on false alarms.
The system preferably comprises

an RSSI source of the transceiver;
an RSSI average calculator unit (410) for calculating an RSSI average;
an RSSI variance calculator unit (415) for calculating an RSSI variance
an average comparator unit (420) for comparing RSSI average with a predetermined average threshold;
a variance comparator unit (425) for comparing RSSI variance with a predetermined variance threshold;
a decision module unit (430) for deciding a class based on the comparisons.

By studying RSSI average and variance a good estimate on whether the received signal is originating from a nearby installation or from a jamming device, since jamming device signals and carrier waves from a nearby installation normally have different characteristics.

BRIEF DESCRIPTION OF THE DRAWINGS

Non-limiting embodiments of the invention will now be described with reference to the figures in which:

Fig. 1: shows a schematic diagram of a radio receiving module according to prior art.
Fig. 2: shows a flowchart of a method for differentiating whether a high received signal strength indicator is caused by a jammer or caused by a transmission originating from a nearby wireless system.
Fig. 3: shows a schematic block diagram of a wireless system
Fig. 4: shows a schematic block diagram of a jammer/carrier detector

DETAILED DESCRIPTION

In jamming detection, it is usually beneficial to detect jamming early and accurately. The present invention provides a method and a system for differentiating between a jammer and an adjacent wireless system or a similar radio condition environment thus resulting in a more accurate jamming detection.
The accuracy of a jamming detector could be estimated by studying the two measures called "sensitivity" and "specificity". Sensitivity or "true positive rate" is a measure of the proportion of positives that are correctly identified as such, i.e., the percentage of true jamming signals that are correctly identified as such. Specificity or "true negative rate" is a measure of the proportion of negatives that are correctly identified as such, i.e., the percentage of noise and interference signals not coming from a jammer, that are correctly identified as being not jamming signals.
For alarm system operators, there is a trade-off between these values because it is desirable to detect jamming (high sensitivity), but it is also desirable to limit the number of false positives, since these will increase costs, without adding value. A high number of false positives may also lower the confidence in the system among customers.
One way to lower false positive rate is to target interference that originates from adjacent home alarm systems or similar installations. The jammers used today normally are based on noise generators. These jammers generate a broadband noise. More advanced models may use filtering to only jam parts of the spectrum - but most are still using noise to jam the system. Since noise per definition will be random it will exhibit a high degree of variance around a constant mean. A regular transmission from an alarm system will not exhibit those noise characteristics, instead there will be a low variance. The average may still be high though, depending on distance to the nearby system and transmitted power.
In accordance with the disclosed embodiment, signal strength average and variance data are used to distinguish between carriers and noise. Furthermore, it may be used to either continuously or intermittently monitor possible jamming and non-malicious neighbouring signals. The method comprises steps to determine the values of the average and variance of received radio frequency energy, or RSSI, in those particular bandwidth(s) used for communication. If the average and variance values are both "high", there is a high probability that a jammer and a jamming condition is present. If the average is high but the variance is low, there is a high probability that a carrier is present. The four use cases are summarized in the table below: Table 1. How received signal average and variance predict signal origin

Low variance High variance

Low average Weak carrier Noise

High average Carrier Jammer
Thus, embodiments of the present invention provide methods of detecting an interference signal and classifying the origin of the interference signal into one of two or more classes. In the present embodiment, the method comprises the following steps:

repeatedly measuring (201) a received signal strength indicator (RSSI) of a received signal;
repeatedly calculating an average value (205) of the received signal strength indicator over a first time period;
repeatedly calculating a variance value (210) of the received signal strength indicator over a second time period, said second time period at least partly overlapping said first time period;
comparing the calculated average value (215) to a predetermined threshold average value;
comparing the calculated variance value (220) to a predetermined threshold variance value;
classifying the signal into one of two or more classes (235) based on the comparisons (215, 220) during overlapping time periods, one class being indicative of a jamming condition.

The classes are preferably the classes defined in table 1, i.e., "Weak carrier", "Noise", "Carrier", and "Jammer". The classes may as an alternative be "Jammer" and "Non-jammer". The class "Jammer" corresponds to a jamming condition.
Fig. 1 shows a schematic diagram of a radio receiving portion of a wireless system according to prior art. The system is configured to provide a so-called received strength signal indicator. An antenna 101 is connected to a low noise amplifier 105. The output from the low noise amplifier 105 is connected to a mixer 110. The mixer also receives input from a local oscillator 115. The mixer output is filtered by a filter 120 and fed to an amplifier 125. Output from the amplifier 125 is fed to a channel filter 130. Output from the channel filter 130 is fed to a detector 135. Output from detector 135 is fed to a demodulator 140. Output 145 from the demodulator may include received signal strength indicator.
Fig. 2 shows a flowchart of a method for differentiating whether a high received signal strength indicator is caused by a jammer or caused by a transmission originating from a nearby and harmless, wireless system. The method comprises the following steps:

Providing 201 an RSSI signal representative of received signal strength of the studied frequency band;
Providing 207 a first window size representative of the time window of RSSI signal to use for producing values of the RSSI average signal
Producing 205 an RSSI average signal, based on the RSSI signal, and representative of a moving average created with the aid of the first window size;
Providing 212 a second window size representative of the time window of RSSI signal to use for producing values of the RSSI variance signal
Producing 210 an RSSI variance signal, based on the RSSI signal, and representative of a moving variance created with the aid of the second window size;
Providing 217 a threshold for the RSSI average, above which threshold it is highly likely that a nearby system or jammer is emitting radio frequency energy in the studied frequency band
Comparing 215 the RSSI average signal with the provided threshold for average;
Providing 218 a variance threshold for the RSSI variance, above which threshold it is highly likely that it is a nearby jammer that is emitting radio frequency energy in the studied frequency band, but below which threshold it is highly likely that any emitted radio frequency energy in the frequency band studied, originates from a nearby wireless system.
Comparing 220 the RSSI variance signal with the provided threshold for variance;
Deciding 235 based on the comparisons 215, 220 whether a jammer is active.

Variance and average threshold values are predetermined and set in dependence of radio signal conditions in the environment of the wireless system. The predetermined average value normally is set to a level where the RSSI of a standard wireless system will be. The predetermined variance value normally is set to a level somewhat higher than where a standard carrier is present.
Fig. 3 shows a schematic block diagram of a wireless system according to an embodiment of the present invention. An antenna 302 is connected to a radio transceiver unit TXU 305, such as e.g. Ti 1121 from Texas Instruments. The radio transceiver unit 305 is connected to a processor, preferably a microcontroller unit MCU 310. The microcontroller unit MCU is configured to instruct the transceiver unit TXU to provide a first stream of instantaneous values of received signal strength indicator (RSSI) to the microcontroller unit 310.
Further, the microcontroller 310 is configured to provide a second stream of values, each value calculated as an average of a predetermined number of the last values of the first stream. The microcontroller 310 is further configured to provide a third stream of values, each value calculated as a value corresponding to or being the variance of the first stream.
The microcontroller 310 is further configured to decide, based on the second and third stream of values, if a jamming device is active. Preferably, the decision is based on whether the average is high at the same time as variance is high, as can be seen in Table 1 above.
Fig. 4 shows a schematic block diagram of a jammer-carrier detector. An RSSI source unit 405 is connected to an RSSI average calculator unit 410 to provide an RSSI stream of values. The RSSI source unit 405 also provides RSSI values to an RSSI variance calculator unit 415. The RSSI average calculator unit 410 is configured to produce an RSSI average stream of values, in each moment representative of the average RSSI taken during a first time period incorporating a first predetermined number of the last samples of the RSSI signal.
The RSSI variance calculator unit 415 is configured to produce an RSSI variance stream of values, in each moment representative of the variance of the RSSI stream of values taken during a second time period incorporating a second predetermined number of the last samples of the RSSI signal. In various embodiments, first and second sliding time windows start at the same time and have equal length.
Each value of the stream of averaged values are compared to a predetermined average threshold value in an average comparator unit 420.
Each value of the stream of variance values are compared to a predetermined variance threshold value in a variance comparator unit 425.
The result of the comparisons in the average comparator unit 420 and in the variance comparator unit 425 are fed to a decision module unit 430. The decision module unit 430 is configured to provide, based on the result of the comparisons, a classification indicating whether the received signal belongs to one of the following classes:

Class 1: There is a jamming signal present, or
Class 2: There is radio frequency energy present originating from a nearby benign wireless system;
Class 3: There is neither any jammer nor any actively sending nearby benign wireless system present.

There may also be provided a further alternative, such as an indication that, based on the received radio frequency energy, it is not possible to give a definite classification.
The classification result is preferably used to take decision on generating an alarm signal and/or sending an alarm signal to a remote alarm receiving centre or wait and see how the received energy develops.

Claims

A method of detecting an interference signal and classifying the origin of the interference signal into one of two or more classes, the method comprising the following steps:
- measuring (201) a received signal strength indicator (RSSI) of a received signal;

- calculating an average value (205) of the received signal strength indicator during a first time-period;

- calculating a variance value (210) of the received signal strength indicator during a second time period, said second time period at least partly overlapping said first time period;

- comparing the calculated average value (215) to a predetermined threshold average value;

- comparing the calculated variance value (220) to a predetermined threshold variance value; and

- classifying the signal into one of two or more classes (235) based on the comparisons (215, 220), one class being indicative of a jamming condition.
The method according to claim 1, further comprising calculating the average value and the variance value over the same time period.
The method according to claim 1, further comprising classifying the received signal as a jamming signal when the average value exceeds the predetermined threshold average value and the variance value exceeds the predetermined threshold variance value.
An alarm system for detecting a possible jamming condition, the system comprising:
- an antenna;

- a transceiver;

- a processor;
characterised in that the system is configured to:
- measuring (201) a received signal strength indicator (RSSI) of a received signal;

- calculating an average value (205) of the received signal strength indicator over a first time-period;

- calculating a variance value (210) of the received signal strength indicator over a second time-period, said second time period at least partly overlapping said first time period;

- comparing the calculated average value (215) to a predetermined threshold average value;

- comparing the calculated variance value (220) to a predetermined threshold variance value; and

- classifying the signal into one of two or more classes (235) based on the comparisons (215, 220), one class being indicative of a jamming condition.
The system of claim 4 further comprising:
- an RSSI source;

- an RSSI average calculator unit (410) for calculating an RSSI average;

- an RSSI variance calculator unit (415) for calculating an RSSI variance

- an average comparator unit (420) for comparing RSSI average with a first threshold;

- a variance comparator unit (425) for comparing RSSI average with a second threshold;

- a decision module unit (430) for deciding a class based on the comparisons.