Emilie Bout
email: emilie.bout@inria.fr

Alessandro Brighente
email: alessandro.brighente@unipd.it

Mauro Conti
email: mauro.conti@unipd.it

Loscri Valeria
email: valeria.loscri@inria.fr

FOLPETTI: A Novel Multi-Armed Bandit Smart Attack for Wireless Networks

Keywords: wireless security;, Net- Internet of Things, Jamming, Channel hopping

Channel hopping provides a defense mechanism against jamming attacks in large scale Internet of Things (IoT) networks. However, a sufficiently powerful attacker may be able to learn the channel hopping pattern and efficiently predict the channel to jam.

In this paper, we present FOLPETTI, a Multi-Armed Bandit (MAB)-based attack to dynamically follow the victim's channel selection in real-time. Compared to previous attacks implemented via Deep Reinforcement Learning (DRL), FOLPETTI does not require recurrent training phases to capture the victim's behavior, allowing hence a continuous attack. We assess the validity of FOLPETTI by implementing it to launch a jamming attack. We evaluate its performance against a victim performing random channel selection and a victim implementing a MAB defence strategy. We assume that the victim detects an attack when more than 20% of the transmitted packets are not received, therefore this represents the limit for the attack to be stealthy. In this scenario, FOLPETTI achieves a 15% success rate for the victim's random channel selection strategy, close to the 17.5% obtained with a genie-aided approach.Conversely, the DRL-based approach reaches a success rate of 12.5%, which is 5.5% less than FOLPETTI. We also confirm the results by confronting FOLPETTI with a MAB based channel hopping method. Finally, we show that FOLPETTI creates an additional energy demand independently from its success rate, therefore decreasing the lifetime of IoT devices.

CCS CONCEPTS

• Security and privacy → Mobile and

INTRODUCTION

Guaranteeing security in IoT represents a challenging task due to the large number of connected devices and their largely distributed nature [START_REF] Haslina | Current research on Internet of Things (IoT) security: A survey[END_REF]. The attack surface of this technology is expected to further expand, due to the introduction of massive IoT networks [START_REF] Guo | Enabling massive IoT toward 6G: A comprehensive survey[END_REF]. Furthermore, these devices are mostly connected via wireless communications, whose openness represents an additional security challenge. A common strategy to mitigate attacks is to move the communication from the attacked channel to a free one. Each user is hence given a set of different channels to use for communication.

Channel hopping is the process by means of which a user selects, upon detecting an attack or a communication failure, a new channel for transmission. This is particularly useful in attacks such as jamming, where a malicious user intentionally degrades the quality of the victim's channel preventing the successful delivery of packets [START_REF] Grover | Jamming and anti-jamming techniques in wireless networks: a survey[END_REF]. In this case, the victim selects an alternative free channel according to a predefined strategy.

Most of the research on channel hopping focused on the design of strategies to optimally select the new channel. In particular, given different attacker capabilities, researchers focused on the design of the best channel hopping strategy to guarantee continuous service availability. Relevant examples include sequential channel hopping (i.e., move to the next available channel), random channel hopping (i.e., select a random channel from those available) [START_REF] Lee | Randomized channel hopping scheme for anti-jamming communication[END_REF], game theory approaches [START_REF] Namvar | Jamming in the internet of things: A game-theoretic perspective[END_REF][START_REF] Tang | Jamming mitigation via hierarchical security game for IoT communications[END_REF], and machine learning approaches [START_REF] Han | Two-dimensional antijamming communication based on deep reinforcement learning[END_REF][START_REF] Upadhyaya | Machine learning-based jamming detection in wireless iot networks[END_REF][START_REF] Xiao | Anti-jamming underwater transmission with mobility and learning[END_REF]. However, given the increasing availability of cheap smart and powerful devices, an attacker can design an optimal strategy too. In particular, given a certain defence strategy, the attacker can learn the victim's channel hopping pattern to predict the channel to jam. To this aim, an attacker might use DRL, where she first observes the victim's behavior, and then attacks according to the inferred channel hopping pattern [START_REF] Zhong | Adversarial jamming attacks on deep reinforcement learning based dynamic multichannel access[END_REF]. In response, the victim selects a new channel hopping strategy to reduce the effectiveness of the attacker. In this case, the attacker needs to periodically interrupt the attack to learn the new victim's channel hopping pattern. The DRL strategy also relies on the assumption that, during the learning phase, the victim's channel hopping strategy remains static. Therefore, learning-based methods do not represent an efficient solution against channel hopping. Based on these observations, an effective attack strategy does not need to rely on a particular victim's behavior, and should provide attack continuity.

In this paper, we propose FOLPETTI, a novel attack strategy against channel hopping that guarantees the continuity of the attack. We exploit a MAB approach to resolve the exploit-explore dilemma at the attackers' side. Thanks to our online approach, we guarantee both the attack continuity and the independence from the assumption of a victim's static channel hopping strategy. As a relevant example, we test FOLPETTI in a jamming scenario considering two defence strategies: i) random channel hopping, and ii) the smart channel hopping strategy implemented in [START_REF] Toldov | A Thompson Sampling approach to channel exploration-exploitation problem in multihop cognitive radio networks[END_REF]. We compare FOLPETTI against three other attacking strategies: i) Random strategy, where the attacker randomly selects a channel to attack; ii) DRL strategy, where the attacker uses DRL to predict the channel to attack; and iii) Optimal strategy, i.e., a genie aided method. We assume that the victim detects an attacker when the percentage of correctly delivered packets falls below 80%. This hence represents the limit that the attacker needs to achieve to be stealthy. Our results show that, in case of random channel hopping, FOLPETTI reduces the Packet Delivery Ratio (PDR) to 82%, close to the 80% PDR attained with a genie aided method (optimal solution). The FOLPETTI attack is continuous, therefore causing a higher impact on the network compared to that of the DRL-based attack, which needs to periodically stop and learn the best strategy. Indeed, we show that the DRL based attack reduces the PDR to 85%, i.e 5% less than FOLPETTI. Also when the transmitter adopts the smart channel hopping strategy, we demonstrate that FOLPETTI is able to reduce the PDR more significantly compared to other methods. Moreover, we prove that FOLPETTI significantly increases the number of retransmissions and consequently the energy demand of the victims.

The main contributions of the paper can be summarized as follows.

• We design FOLPETTI, a new smart attack strategy against channel hopping. FOLPETTI is based on a MAB approach able to perform an optimal channel selection. • We integrate the FOLPETTI strategy with a jamming attack and demonstrate that the attacker is able to learn the victim's channel hopping strategy and attack online. This guarantees a continuous attack. • We show that FOLPETTI increases the number of retransmissions and hence increases the nodes' energy demand, shortening device's lifetime. • We develop a jamming module with the latest version of discrete event simulator NS-3 (Network Simulator-3). We add some essential needs for simulating modern jamming attacks, such as the machine learning-based approach.

The rest of the paper is organized as follows. In Section 2 we present the representative works on attacks against channel hopping. In Section 3 we detail the FOLPETTI strategy and how this approach can be combined with a jamming attack. Section 4 describes the approach used for detecting jamming attacks and the channel hopping strategy implemented after an attack detection. Section 5 provides an analysis of the behavior of the FOLPETTI strategy. Then, in Section 6 we compare the performance of FOLPETTI with those of other relevant attacks in two different scenarios. In Section 7 we provide some insights into the implementation of such a kind of attack in a wireless communication network. We discuss in Section 8 possible countermeasures to prevent FOLPETTI. Finally, we conclude the paper and provide some future research direction in Section 9.

RELATED LITERATURE

In this section we review the literature discussing channel hopping schemes. We first discuss the defence perspective, to gain insights into how victims select their hopping strategies. Then we discuss the attack perspective to clearly show the novelty of our attack strategy.

Defence Perspective. Channel hopping solutions range from the most naive (i.e., sequential channel hopping) to the most elaborated and smart (e.g., via Reinforcement Learning (RL)). We focus on the second class, and in particular on RL where devices can decide on the next channel based on the positive and negative feedback received from the network. The authors in [START_REF] Han | Two-dimensional antijamming communication based on deep reinforcement learning[END_REF] propose a framework where, in case of heavy jamming, a user might leave the network and connect to another access point. The RL framework exploits the past observations to decide whether to leave the network or select a new channel. A similar RL-based mobility concept has been exploited by the authors of [START_REF] Xiao | Anti-jamming underwater transmission with mobility and learning[END_REF] to decide whether a user should combat the jammer or leave. Both [START_REF] Han | Two-dimensional antijamming communication based on deep reinforcement learning[END_REF] and [START_REF] Xiao | Anti-jamming underwater transmission with mobility and learning[END_REF] used quantized Signal to Interference plus Noise Ratio (SINR) values as RL states, therefore being limited in real world scenarios. To deal with the problem of infinite SINR states, the authors in [START_REF] Liu | Antijamming communications using spectrum waterfall: A deep reinforcement learning approach[END_REF] proposed to use the spectrum waterfall as RL states. Furthermore, their solution does not require the knowledge of the jamming pattern, and extends to the case where the attacker implements an intelligent and dynamic jamming strategy. The authors in [START_REF] Wang | Mean field reinforcement learning based anti-jamming communications for ultra-dense internet of things in 6G[END_REF] proposed a multi-agent RL framework to account for both the jamming attacker and the mutual interference caused by multiple legitimate nodes. A similar concept has been proposed by the authors in [START_REF] Zhou | Intelligent Anti-Jamming Communication for Wireless Sensor Networks: A Multi-Agent Reinforcement Learning Approach[END_REF] to cope with the increasing number of devices in ultra-dense networks. All these works however did not account for the power-limited capabilities of IoT devices. The authors in [START_REF] Xu | An intelligent anti-jamming scheme for cognitive radio based on deep reinforcement learning[END_REF] proposed a Markov decision process-based RL framework, showing the power consumption of their framework against three types of jammers: sweep, random, and sensing-based. However, they did not consider the effects of an intelligent jamming strategy.

Attack Perspective: As demonstrated by the fervent literature described above, most of the literature focuses on channel hopping solutions for the mitigation. In this paper, we focus on the attacker side and we hence review available proposals for smart jamming strategies. The authors in [START_REF] Noori | Jamming and anti-jamming in interference channels: a stochastic game approach[END_REF] proposed a game-theoretic approach, where both the attacker and the victim choose the channel to hop solving for the optimal strategy. However, authors resolved to Qlearning to compute the solution of the game, hence requiring periodical learning phase. The authors in [START_REF] Zhong | Adversarial jamming attacks on deep reinforcement learning based dynamic multichannel access[END_REF] proposed a deep RL framework, where the attacker observes the victim activity to learn the activity pattern. The attacker employs an actor-critic neural network model, where the actor tests the channel and reports result to the critic which decides on the next action. Authors assume that the victim pattern is static during the learning phase. An extension to simultaneously attack multiple channels has been proposed in [START_REF] Wang | Adversarial Reinforcement Learning in Dynamic Channel Access and Power Control[END_REF], where the authors consider multiple dynamic channels. Their approach is based on a Deep Q-Network (DQN) approach with the main objective to reduce the sum-rate of the victim node. In order to implement an effective attack, the authors foresee a listening phase where the attack is in stand-by.

Unlike the previous attacks, our solutions is able to attack in a continuous fashion, without requiring a listening phases. We hence provide a novel and efficient attack strategy.

METHODOLOGY

In this section, we describe our attack methodology. We first describe FOLPETTI, our novel attack strategy in Section 3.1. Then, as a relevant example, we show its implementation for a jamming attack in Section 3.2.

FOLPETTI: a Novel Attack Framework

An efficient attacks against channel hopping has two fundamental requirements: i) it should not depend on specific assumptions on the victim's hopping pattern, and ii) it needs to be continuous in time. We here explain how FOLPETTI satisfies both these requirements.

In FOLPETTI, the attacker follows the victim's channel selection using a MAB framework. Several MAB algorithms have been implemented at the defence side, where the goal is to find the optimal non-attacked communication channel [START_REF] Dakdouk | Reinforcement learning techniques for optimized channel hopping in IEEE 802.15. 4-TSCH networks[END_REF][START_REF] Toldov | A Thompson Sampling approach to channel exploration-exploitation problem in multihop cognitive radio networks[END_REF]. We adapted the framework of these solutions to implement an attack strategy. To select the optimal channel, i.e., that where the attack will have the most effect, the attacker needs to solve the Exploit-Explore dilemma. This problem can be modeled with via MAB as a Markov Decision Process (MDP). The MDP can be described via five tuples ⟨𝑆, 𝐴, 𝑃, 𝑅, 𝛾⟩, where:

• 𝑆 is a finite set of states 𝑠;

• 𝐴 is a finite set of actions 𝑎;

• 𝑃 𝑎 (𝑠 𝑛 , 𝑠 𝑛+1 ) is the probability that an action 𝑎 in state 𝑠 𝑛 in time 𝑛 + 1; • 𝑅 𝑎 (𝑠 𝑛 , 𝑠 𝑛+1 ) is the expected immediate reward received after transitioning state 𝑠 𝑛 to state 𝑠 𝑛+1 due to action 𝑎;

• 𝛾 ∈ [0, 1] is a discount factor.
The main objective of a MDP is to find a policy 𝜋 that associates an action to each state 𝜋 : 𝑆 → 𝐴 to maximize the reward. Therefore, the agent tries to maximize his reward by selecting the optimal channel. At each time instant 𝑛, the attacker may stay in the previously selected state 𝑠 𝑖 , or move to another state 𝑠 𝑗 . Therefore, we define the possible actions as the set 𝑆 = 𝑠 1 , 𝑠 2 , ..., 𝑠 𝑆 of the available channels. We assume that the reward is one 𝑅 𝑎 (𝑠 𝑛 , 𝑠 𝑛+1 ) = 1 whenever the newly selected channel is used by a victim. Otherwise, the reward is zero 𝑅 𝑎 (𝑠 𝑛 , 𝑠 𝑛+1 ) = 0.

To solve this online decision problem, inspired by the work in [START_REF] Toldov | A Thompson Sampling approach to channel exploration-exploitation problem in multihop cognitive radio networks[END_REF], we apply the Thompson sampling algorithm as a policy. The prior distribution beta(𝛼 𝑗 , 𝛽 𝑗 ) for each access trial is a Beta distribution with parameters 𝛼 𝑗 and 𝛽 𝑗 . We denote as 𝜇 𝑗 the event where the attack is successful (𝑅 𝑎 = 1). For action 𝑠, the probability of success is given by

𝑝 𝑗 (𝜇 𝑗 |𝑆 𝑗 ) = Γ(𝛼 𝑗 + 𝛽 𝑗 ) Γ(𝛼 𝑗 )Γ(𝛽 𝑗 ) (𝜇 𝑗 ) 𝜇 𝑗 -1 (1 -𝜇 𝑗 ) 𝛽 𝑗 -1 ; (1)
where Γ(•) is the gamma function. If the state 𝑠 is selected in round t and returns a reward 𝑅 𝑎 , the prior distribution for the mean reward of arm 𝑠 can be updated via the Bayes rule. By utilizing the conjugacy properties, the posterior distribution for the mean reward of each arm is also a beta distribution with parameters updated based on the following rules [START_REF] Russo | A tutorial on thompson sampling[END_REF]:

(𝛼 𝑠 , 𝛽 𝑠 ) ← (𝛼 𝑠 , 𝛽 𝑠 ) if 𝑎 𝑡 ≠ 𝑠; (𝛼 𝑠 + 𝑅 𝑎 , 𝛽 𝑠 + 1 -𝑅 𝑎 ) if 𝑎 𝑡 = 𝑠. (2)

FOLPETTI Combined with Jamming Attack

To validate the effectiveness of FOLPETTI, we show its application to a jamming attack. Jamming attacks have the purpose of causing a denial of service by degrading the channel's quality and preventing the exchange of packets between legitimate nodes in the network. The jammer has hence the option of voluntarily occupying the channel or causing collisions to corrupt the packet and force the node to retransmit. Furthermore, the attacker needs to act in a stealthy fashion, to avoid being detected.

In this work, we implement a constant jamming attack to continuously jam the victim's channels. Based on FOLPETTI model, the attacker follows the victim's channel selection and jams them as described in Algorithm 1. Notice that in this work we assume that the attacker can jam a single channel per time instant. We will consider an attack jamming over multiple channels in future works.

Algorithm 1 FOLPETTI Algorithm

Require: 𝑗 : channel index, 𝑐 : total number of channel accesses, 𝑡 𝑗 : number of successful transmissions so far

𝛼 𝑗 = 𝛽 𝑗 = 1 𝑡 𝑗 = 𝑐 = 0 while True do for all j do sample 𝑟 𝑗 ∼ beta (𝛼 𝑗 + 𝑡 𝑗 , 𝛽 𝑗 + 𝑡 𝑗 ) end for m = argmax {r 𝑗 }; c ++ ; JAM(); if channel is occupied then 𝑡 𝑚 + = 1 end if end while
We determine the success of the jamming attack based on the Received Signal Strength Indicator (RSSI). This metric, unlike other metrics such as the Packet Error Rate (PER) or PDR, does not require the attacker to spend a lot of time in listening mode. Therefore, the attacker can remain active for the whole duration of the attack. Indeed, we have observed a drop in the RSSI when an attack takes place whether on the side of the transmitter or the attacker.

CHANNEL HOPPING MODEL

In this section, we focus on the victim's side. We first describe in Section 4.1 the detection method implemented by the victim to detect an attack. Then, we describe in Section 4.2 the different channel hopping strategies.

Detection Method

To estimate the impact of FOLPETTI, we use the PDR. This type of metric is often used to identify jamming attacks in the literature [START_REF] Xu | The Feasibility of Launching and Detecting Jamming Attacks in Wireless Networks[END_REF], and can be computed as

Packet Delivery Ratio = Number of PSD Number of PT , ( 3
)
where 𝑃𝑆𝐷 is the number of packets successfully received at the destination and 𝑃𝑇 represents the number of packets transmitted by the source. Based on this metric, we implement a statistical detection framework based on the behavior of the network without attack [START_REF] Spuhler | Detection of Reactive Jamming in DSSS-based Wireless Communications[END_REF]. Indeed, on the basis of a network without attack, it is possible to calculate the average PDR and thus to define a detection threshold 𝛿. If the PDR is smaller than 𝛿, then the channel is under attack and the mitigation method can start. The choice of PDR as detection approach is mostly based on the consideration that it allows to detect different types of jamming attacks without increasing the computational overhead.

Channel Hopping

Channel hopping is both an interference mitigation method and a reaction strategy against jamming attacks. It consists of in dynamically changing the communication channel to mitigate interference or counteract to jamming attacks. Assuming that the jammer does not attack on all the channels simultaneously, channel hopping is an effective method to keep the communication active. However, there are some potential issues related to its implementation. For instance, the selection of the successive channel should be realized without prior negotiation to avoid leakage of information that could be exploited by the attackers. Indeed, if the attacker eavesdrops the hopping pattern, it can continuously jam the network in all channels. In this work, we implement the following two strategies. a MAB approach, and follows the model proposed by authors in [START_REF] Toldov | A Thompson Sampling approach to channel exploration-exploitation problem in multihop cognitive radio networks[END_REF]. This method tries to converge to the best channel available in as few steps as possible by employing a Thompson sampling formulation.

PERFORMANCE EVALUATION

In this section, we first describe in Section 5.1 the system we consider for implementing the attack based on the FOLPETTI strategy. Before showing in Section 5.3 the performance obtained by running the FOLPETTI attack, we describe in Section 5.2 the other channel hopping strategies employed by the attacker.

Network Model

We consider a network based on wireless nodes with limited energy, i.e. battery equipped. All devices have similar features in terms of computational capacity and memory. In particular, we consider a wireless communication network composed of three legitimate nodes connected via an access point with the IEEE 802.11 protocol and capable of transmitting on 12 different channels [START_REF] Kawade | Interference Analysis of 802.11b and 802.11g Wireless Systems[END_REF]. We assume that the attacker has the same configuration as the legitimate nodes to reduce the probability of being detected. The attacker jams the communication between the access point and node 1 as depicted in Fig. 1. We assume that legitimate nodes in the network may be able to detect an attack if their performance falls below a certain value. Therefore, a stealthy attack is possible only if the attacker is able to keep its success rate below the identifiability threshold.

To follow the effects of the jamming attacks and compute the PDR, the three considered devices communicate via the Transmission Control Protocol (TCP). Indeed, TCP provides an acknowledgement (ACK packet) for each correctly received packet. Therefore, based on these ACK packets, the transmitter can judge whether the We assume that the access point constantly transmits packets every 0.1 s and begins its transmission at the start of the simulation (𝑡 = 0). After 10 s, the attacker starts its attack. The legitimate nodes and the attacker start their communication on the same channel. We implement the aforementioned attacker's and transmitter's channel hopping methods in the discrete event simulator NS-3 (Network Simulator-3). We modify and update the jamming module [START_REF]Wireless jamming model[END_REF] with the latest version of NS-3 and integrated into it the "ns3-gym" module [START_REF] Gawlowicz | ns-3 meets OpenAI Gym: The Playground for Machine Learning in Networking Research[END_REF] allowing to implement MAB algorithms. The code is available 1 . Based on Fig. 2, we describe the process of the FOLPETTI attack combined with the constant Jamming attack. The first step is to initialize the jammer attributes and the MAB parameters, i.e., the number of arms (in this case this corresponds to the number of channels). Once this step is done, the jammer is ready and has to make the decision on which channel to jam. To this aim, we exploit the OpenAi class to return the arm chosen by the algorithm. Then, the Jammer Device class sends all the necessary data to the Wireless Module Utility class that transmits this information to the Physical Layer Driver element. The Physical Layer Driver schedules the next Jammer Signal. Once the signal has been sent, the Physical Layer Driver notifies the Wireless Module Utility which will then perform a network analysis. Then it returns an update of the different metrics of interest for FOLPETTI, i.e., the RSSI and the PDR. These metrics are communicated to the Jammer Device class. Then, the Jammer Device class receives the RSSI value and determines the reward. This value is delivered to the OpenAi class to complete the procedure of the MAB algorithm.

We developed this module to be as extensible as possible. Indeed, it is possible to extend all these classes to develop new jamming strategies, metrics, and new MAB algorithms.

Comparison with Other Attack Strategies

In order to assess the validity of FOLPETTI, we compare it with four other attack strategies:

• Random Channel Hopping (𝐴 𝑅𝑎𝑛𝑑𝑜𝑚 ): As for the mitigation method, the attacker randomly selects the channel on which to perform its attack. The channel change takes place after each transmission of the jamming signal. Hence in this case, the attacker has a probability of 1/𝑀 of jamming the correct channel, where 𝑀 represents the total number of channels. • Reactive Channel Hopping (𝐴 𝑅𝑒𝑎𝑐𝑡𝑖𝑣𝑒 ): One of the most developed strategies in the literature is the jamming reactive attack, which limits the attacker's energy consumption. The attacker jams the signal only when a communication takes place. This implies that the attacker must be able to react. The reaction time must be shorter than the packet transmission time for the latter to be an effect. Moreover, when the attacker senses no communication on a certain channel, he scans all the other channels in order to know the correct transmission channel.

• DRL based Channel Hopping(𝐴 𝐷𝑅𝐿 ): The attacker employs the strategy developed in [START_REF] Zhong | Adversarial jamming attacks on deep reinforcement learning based dynamic multichannel access[END_REF] and uses a DRL algorithm consisting of an actor and a critic to make decisions on the channel to attack. In this method, the actor observes its environment to choose the action to optimize its policy. During this time, the critic evaluates the actions performed by the actor by calculating the difference between the expected outcome and the actual one and informs it of the quality of its choice. The temporal difference value is then used to update the actor and critic model. Moreover, to optimize this model and reduce the probability of being detected, the attacker alternates between two modes: attacking phase, and listening mode. Indeed, the two agents (actor and critic) are based on neural networks that must be trained beforehand. This is why, during the training phase, the attacker is in listening mode. Once the model is trained, the attacker switches to attack mode. In this phase, the attacker scrambles the channel and can decide to switch to listening mode to re-train its neural network when performance decrease. • Optimal Channel Hopping (𝐴 𝑂𝑝𝑡𝑖𝑚𝑎𝑙 ): We assume the attacker is omniscient and knows the victim's channel hopping pattern. After each diffusion of the jamming signal, the attacker verifies if it has to change channel. This approach represents the optimal solution, and we considered it as baseline in our simulations.

Performance of FOLPETTI-Based Jamming

To better understand the advantage of FOLPETTI, we initially describe its behavior and compare it with that of a DRL-based attack.

In this part, we assume that the victim's channel hopping strategy follows a random choice. Fig. 3 shows the impact of FOLPETTI and DRL-based strategy on the PDR. The closer the PDR is to zero, the more effect the attack has on the network. We fix the attack detection threshold to 80% PDR. Indeed, based on [START_REF] Xu | The Feasibility of Launching and Detecting Jamming Attacks in Wireless Networks[END_REF], and the distance between the access point and the victim that we defined above, the percentage of the PDR observed in real-life in a network without attack varies between 82%-100% in a normal behavior. Consequently, when the PDR drops at 80% a jamming attack occurs and the transmitter randomly hops into another channel. Fig. 4 shows the transition channel pattern for the transmitter and the attacker for the case of FOLPETTI attack and DRL-based attack. For reasons of readability, By combining Fig. 3 and Fig. 4a, we see that our attack tracks the channel hopping mitigation method. Indeed, at 𝑡 = 10 the PDR drops from 100% to 89%. This is explained by the fact that the attacker and the transmitter are positioned in the same channel. Then the attacker is in the exploration step and examines the availability of the other channels, hence increasing the PDR again to 95%. At the end of this phase, the attacker decides to turn to the exploitation period and jams channel 1 causing the PDR to drop to 80%. At this point, the transmitter detects a potential attack and changes the communication medium. The victim randomly chooses a channel and verifies in a second time if this is occupied. Therefore at time 𝑡 = 49, the transmitter switches to channel 11. However, as this has a low RSSI value, the access point will re-select a new channel (in this case, 8). Simultaneously, the attacker receives negative rewards and decides to change the jamming channel. Consequently, at 𝑡 = 54 the attacker chooses to jam channel 8 which will again cause the PDR to drop to 80%. We observe that this behavior pattern remains until the end of the simulation. Therefore, our proposed approach allows to quickly deduce the new communication parameters used by the transmitter. Indeed, after the transmitter changes channel, the attacker can find the optimal channel so that the PDR does not exceed 84%.

On the contrary, for the DRL-based attack, we notice in Fig. 3 that at the beginning of the simulation, the PDR rapidly drops to 80%. Consequently, the legitimate nodes of the networks react and change their transmission channel from 8 to 11, as we see in Fig. 4b. However, the attacker continues to jam channel 8 for a short time until it finds that it has no effect on it. As a result, it switches to listening mode to re-train its neural network with new observations. This period appears on the figure starting from second 150 and lasts about 100 s. During this time, the attacker does not impact the network, and the values of the PDR increase. At second 300, the attacker finds its new policy and jams the channel where the transmission is taking place. Hence, the PDR values drop to the detection threshold and the transmitter will react accordingly by changing channel again. We note that this behavior is repeated until the end of the simulation.

By analyzing the behavior of the two attacks, we see that the attack based on the MAB algorithm, i.e., FOLPETTI, reacts faster to policy updates than the one based on the DRL. This is confirmed by an overall lower PDR for FOLPETTI. Indeed, this mechanism does not require any learning time, so the attacker can remain active throughout the attack, hence steadily keeping a close-to-optimal PDR.

ASSESSMENT OF THE FOLPETTI ATTACK IN TWO SCENARIOS

In this section, we evaluate our new strategy in two scenarios. In the first Section 6.1, we consider a victim using random channel hopping. Then, we consider a victim exploiting a smart channelhopping strategy in Section 6.2. For these two cases, we compare the different strategies in terms of a) PDR, b) success rate of the attack, c) number of retransmissions and d) number of detections.

The PDR is computed via equation ( 3). The success rate of the attack corresponds to the number of successfully jammed packets by the attacker over the total number of transmitted packets by the victim.

The results obtained below correspond to an average over 1000 simulations.

Scenario 1: FOLPETTI Against Random Channel Hopping

Figure 5: PDR for different strategies of attack against Random Channel Hopping Method Fig. 5 shows the impact of the different attacks on the network considering the PDR evolution over time. As can be seen in this figure, for the FOLPETTI attack the PDR values are the closest to those of the optimal solution. Indeed, the average PDR of the optimal solution is 80% against 82% for our new approach and 85% for the DRL-based attack. It is important to note that the channel change by the transmitter takes place when the PDR is below a threshold 𝛿, set here at 80%. In the case of the optimal solution, the attacker is omniscient and knows in advance the future channel to jam. Therefore, once the PDR reaches the detection threshold, it will remain constant throughout the simulation. Conversely, for the attack following the strategy based on random channel hopping, the value of the PDR remains high at 90%. This can be explained by the fact that the attacker has a 1/12 probability of jamming the busy channel, therefore having limited effect on the transmission. The reactive attack has an efficiency close to the attack using a random channel strategy. Indeed, after 1 second of inactivity, the attacker re-scans all of the different channels in order to deduce the new transmission channel. Consequently, the attacker is inactive during this time and loses performance. Finally, the DRL-based approach has an average PDR value of 85% which is higher than of the FOLPETTI attack. In addition, the first learning time is considerable and the attack only manages to deduce a strategy after 600 s. In this approach, when the attacker considers itself ineffective, it has the possibility of re-training its two agents in order to re-adapt their strategies. As seen previously, during this phase, it cannot impact the network therefore having no effect on the PDR. On the other hand, the FOLPETTI attack has the ability to learn online and to remain active throughout the attack. Therefore the PDR obtained via FOLPETTI quickly decreases and closely approaches that of the optimal solution. The performances of the different attack strategies evaluated according to the success rate are presented in Fig. 6. When the attack is optimal at the end of the simulation, the success rate is around 17.5% against 15.5% for the FOLPETTI solution and 12.5% for the DRL-based solution. The FOLPETTI attack is more efficient than the other attack strategies and, in particular, twice as effective as that based on a random strategy. The difference between the FOLPETTI attack and the DRL-based attack can be explained by the fact that, in the first case, the attack needs fewer observations and therefore less time to converge towards the optimal solution.

By comparing the number of retransmitted packets in Table 2, we can discern that the strategy based on MAB with Thompson policy has an impact on the behavior of the network. On contrary, the random channel hopping strategy has no effect on the number of retransmissions. Indeed, the number of retransmissions is equal to 74 against 738 with the strategy based on the MAB and 1070 for the optimal solution. Moreover, the number of retransmissions for the DRL-based solution is 641, 13% less than for the FOLPETTI attack.

The number of detections and consequently the number of channel hops at the transmitter side confirm these results. For the random solution, the PDR never drops below 80%, therefore no attack is detected and no channel hopping is performed. For FOLPETTI, the transmitter detects an attack 1483 times against 1729 times for the optimal solution. Therefore, this new type of approach produces a significant effect in terms of retransmissions and disturbance on the channel, hence decreasing the energy efficiency of the victim network. As confirmed by the results obtained previously, the attack based on DRL is less efficient than the optimal and FOLPETTI attacks and therefore leads to a lower number of detections. Indeed, this approach has a detection number of 1189, 294 detections less than with our approach. Consequently, when the mitigation method is based on a random strategy, the proposed solution is effective and the results obtained are almost similar to those provided by an optimal solution.

Scenario 2: FOLPETTI against Smart Channel Hopping

In order to estimate the robustness of the FOLPETTI model, we evaluated it against a smart channel hopping method. We exploit the channel hopping method proposed in 4, that tries to predict the best communication channel available without interference. The results obtained in Fig. 7 reveal different points. First, the smart method obtains better performance in terms of defense compared to a random defense strategy. In this case, the PDR is equal to 100% unlike 90% when the channel hopping strategy is based on random selection. The same behavior is also visible for the reactive attack. Indeed, the PDR remains high around 97.5%. For the two smart attackers, we notice that in the beginning of the simulation the PDR is around 94%. Therefore, this new types of attack decrease the PDR by 6% compared to a more basic method. As our attack does not need training time and converges faster towards the choice of the optimal channel, the PDR tends to drop little by little to arrive at the end of the simulation at 92.5%. Thus, we notice that our approach has an impact on the network even if the mitigation method is more efficient. This is different from the attack based on the DRL algorithm, which at convergence reaches an average PDR value rise around 94.5% due to the time needed to re-train the model. These results are also confirmed by the success rate, shown in Fig. 8. Indeed, our new attack has a success rate 7.5% higher than the one based on random channel hopping strategy, whose success rate is 0%. Moreover, if we compare the success rate between the two smart attacks, our approach has a higher success rate that converges around 7.5% after 900 s of simulation. During the same simulation time, the DRL-based attack has a success rate of 2%, i.e., 3.75 times lower than that of the FOLPETTI attack.

By looking at the number of retransmissions reported in Table 3, the attack based on MAB algorithm has an important effect on the network as it allows to generate 280 retransmission. The attack based on agent-critic method causes 212 retransmissions, i.e., 68 less than FOLPETTI attack. In addition, the legitimate nodes must change channel 513 times against 485 times when the attack is based on DRL method and 0 times with a random strategy.

Simulations demonstrated the efficiency of this new type of attack to select the optimal channel to jam even if the channel hopping method is more robust.

DISCUSSION

Based on the results obtained in the two scenarios considered, we observe that the proposed method has better performance than a basic strategy like a random method. In addition, FOLPETTI is also effective when the channel hopping strategy is based on a more advanced approach such as the MAB algorithm. The main advantage of the FOLPETTI based attack is that it operates without having prior knowledge of its victim. Indeed, the apprenticeship is completely online, the attacker does not alternate between long transmission and listening phases in order to discern its impact on the victim. This is possible thanks to the RSSI metric which does not require any listening time, allowing the attacker to remain active throughout its attack. Another main benefit of the Multi Armed Bandit algorithm with Thompson policy is that it requires less computing resources and can be executed in small devices as evidenced in [START_REF] Toldov | A Thompson Sampling approach to channel exploration-exploitation problem in multihop cognitive radio networks[END_REF]. Therefore, the attacker can use common devices whilst being mobile like a Raspberry Pi, and execute attacks in any environment.

By analyzing the number of retransmissions that FOLPETTI generates, we can deduce that this type of attack strongly impacts on the network performance. An increase in the number of retransmissions not only causes a delay in the delivery of information but also a considerable loss of energy for the transmitter. Indeed, the energy consumption 𝐸 total of the transmitter in 802.11 protocol can be computed with this formula:

𝐸 total = 𝑃𝑊 𝑇 𝑥 × 𝑇 𝑇 𝑥 + 𝑃𝑊 𝑅𝑥 × 𝑇 𝑅𝑥 + 𝑃𝑊 𝐼 𝐷𝐿𝐸 × 𝑇 𝐼 𝐷𝐿𝐸 + 𝑃𝑊 𝑆𝐿𝐸𝐸𝑃 × 𝑇 𝑆𝐿𝐸𝐸𝑃 , (4)
where 𝑃𝑊 𝑇 𝑋 , 𝑃𝑊 𝑅𝑋 , 𝑃𝑊 𝐼 𝐷𝐿𝐸 and 𝑃𝑊 𝑆𝐿𝐸𝐸𝑃 represent the power consumption of the transmitter node when it is in the transmitting, listening, idle, and sleep states respectively. 𝑇 𝑇 𝑋 , 𝑇 𝑅𝑋 , 𝑇 𝐼 𝐷𝐿𝐸 and 𝑇 𝑆𝐿𝐸𝐸𝑃 correspond to the total time spent by the transmitter in each respective state. In addition, the total amount of energy for one retransmission 𝐸 𝑅𝑒𝑡𝑥 can be described as:

𝐸 𝑅𝑒𝑡𝑥 = 𝑅(𝑇 𝑇 𝑥 × 𝑃𝑊 𝑇 𝑥 ) + 𝑅(𝑇 𝑅𝑥 × 𝑃𝑊 𝑅𝑥 ), (5)
where 𝑅 corresponds to the total number of packets transmitted during one retransmission such as data or acknowledgements packets. Diverse measures of power consumption for several type of network interface controller are provided in [START_REF] Chiaravalloti | Power consumption of WLAN network elements[END_REF]. The authors show that transmitting and listening are the two most energy demanding modes. Combining this consideration with equations ( 4) and (5), we notice that FOLPETTI drastically reduces the lifetime of a device. Indeed, if the attacker is equipped with an Alfa AWUS036h network interface controller compatible with a Raspberry Pi, the energy consumption for each step can be determined as shown in table 4. These information are provided by [START_REF]Single-Chip 2x2 MIMO MAC/BB/Radio with PCI Express Interface for 802[END_REF].

Based on the previous simulations and by considering the values given in Table 5 corresponding to the transmission 𝑇 𝑇 𝑥 time and reception time 𝑇 𝑅𝑥 of the various packets involved for one retransmission, we can compute the additional network energy consumption under a jamming attack.

Combining formula (5) and the information from Table 4, we deduce that the energy consumption for one retransmission 𝐸 𝑅𝑒𝑡𝑥 is 0.0050431 J. For the scenario 1, the number of retransmission Operating Mode Sleep Idle Tx Rx P(W) 0.001 0.30 0,67 0,34 Therefore the additional energy expended by the transmitter is 3.72 J for an attack of 30 minutes. For the same situation, the DRLbased attack generates an increase of energy consumption of 3.23 J, which is 0.49 J less than the FOLPETTI attack. With the random jamming approach, the supplementary energy consumed by the access point is 0.373 J, i.e 10 times less than for FOLPETTI method.

The same results are also observed for the second scenario. Indeed, for 30 minutes of simulations, the number of retransmissions is 280 when the jammer is based on the new approach and 38 when the attacker applies a random logic. Consequently, the emitter consumes 1.41 J with the FOLPETTI model against 0.19 J with a basic method. Our new approach has a greater effect on the victim's energy consumption than other attack strategies. This is confirmed comparing our attack to the DRL-based. Indeed, the DRL-based method causes an energy expenditure for the victim of 1.06 J, i.e. 0.35 J less than the FOLPETTI attack.

The main advantage of FOLPETTI attack is that it does not require training. Indeed, the update of its policy is done in real time. Unlike other works, we do not rely on ACK packets to define the success of our attack. Consequently, the attacker must not wait to receive this packet to recover a reward. The update of the policy is done in a smaller time and the attacker will converge faster to the optimal solution. As a result, FOLPETTI attack is more effective as we proved in the previous section.

To finish, our new type of attack can be considered a framework to perform several known attacks. Indeed, being able to predict the communication channel can be useful in replay attack or flooding attack in order to limit their probability of detection. Moreover, more and more attacks are based on machine learning algorithms and consequently data sets in order to deduce information [START_REF] Acar | Peek-a-boo[END_REF][START_REF] Msadek | IoT Device Fingerprinting: Machine Learning based Encrypted Traffic Analysis[END_REF]. In particular, they require passive listening to the network in order to collect the maximum of data. This step is crucial because the effectiveness of the machine learning algorithm relies on the data set. In this case, FOLPETTI makes it possible to follow the channel hop and thus not to lose any information necessary for the creation of the data set. In addition, the mitigation method by channel hopping is not only present in Wi-Fi protocol. Indeed, this strategy is also employed by other communication protocols. Thereby, this new framework does not depend on the Wi-Fi protocol and can be effective in other use cases.

POSSIBLE COUNTERMEASURES

We have just shown that the different strategies employed in the channel hopping literature lose effectiveness when the attacker operates with a more elaborate algorithm. Indeed, even if the FOLPETTI attack has a smaller effect when a smart channel hopping is used, this new type of attack leads to a decrease in network performance. Several works aimed at creating more robust MAB algorithms exist in the literature and could be applied in MAB channel hopping strategies [START_REF] Vial | Robust Multi-Agent Multi-Armed Bandits[END_REF]. Moreover, it is also possible to evade the FOLPETTI attack by directly attacking the MAB model of the attacker. Indeed, this type of algorithm can be subjected to adversarial attacks, and two strategies could be designed to disturb the FOLPETTI model.

• Poisoning attacks: One of the countermeasures can be the poisoning attack [START_REF] Liu | Data Poisoning Attacks on Stochastic Bandits[END_REF]. The purpose of the transmitter is to deceive the attacker about its choice. The victim influences the attacker to jam an unused channel, having hence no effect. To this aim, legitimates nodes must falsify certain rewards in order to control the attacker's decision. In this situation, nodes can possibly voluntary transmit in an jammed channel to influence the number of rewards and therefore the attacker's policy. • Delayed feedback attack: Another possible countermeasure could be to implement delayed feedback in order to deceive the attacker's choice. The goal of the victim is to delay the transmission of feedback information that serves as a reward to the attacker. In this case, the complexity of the MAB algorithm for the attacker will increase significantly as demonstrated in [START_REF] Grover | Best arm identification in multi-armed bandits with delayed feedback[END_REF]. As a result, the attacker will need a significant time to converge to the optimal solution.

One of the main difficulties of these solutions is that the transmitter must completely know the parameters of the MAB algorithm employed by the attacker, such as the type of the rewards or the policy. In addition, the legitimates nodes of the network must be able to implement these methods without impacting the network performance. Finally, an important point to take into account when designing these countermeasures in the IoT context is the power consumption they require. Consequently, designing solutions against FOLPETTI attacks requiring few resources, knowledge, and not impacting the network remains an open challenge.

CONCLUSION AND FUTURE WORK

In this article, we presented FOLPETTI, a novel smart attack that operates in an unknown network in the absence of a-priori information about the network itself. FOLPETTI has the ability to understand and predict the behaviour of victims and more particularly their channel hopping strategy. We evaluated FOLPETTI against two defence strategies, one more classic based on random channel hopping and one more advanced based upon MAB algorithm. In the first situation, FOLPETTI approaches an optimal attack solution in terms of PDR, success rate, and number of retransmissions. In the second case, our new attack is still able to enhance the success rate to 5% against 2.5% for the other smart attack. The simulations results demonstrate that the proposed strategy can improve the overall jamming performance. Moreover, our approach can be considered a framework to be used for any multi-channel communication protocol. Although we used FOLPETTI to perform a jamming attack, it can also be used for other attacks that may benefit from channel following strategies such as replay attack. Our future works will evaluate this new solution in a testbed composed of several nodes and jammers in order to evaluate its performance in real life situation. Moreover, since the final goal of creating an attack is to improve the security system, we will add countermeasures in the smart channel hopping method against a FOLPETTI attack. This study will focus on the trade-off between the security, efficiency, and the network performance.

Figure 1 :

 1 Figure 1: Network model

Figure 2 :

 2 Figure 2: NS-3 Jammer work-flow

Figure 3 :

 3 Figure 3: PDR attacker.

  (a) Channel Behavior with FOLPETTI attack (b) Channel Behavior with DRL-based attack

Figure 4 :

 4 Figure 4: Transition channel pattern for transmitter and attacker

Figure 6 :

 6 Figure 6: Success rate for different strategies of attack against Random Channel Hopping Method

Figure 7 :

 7 Figure 7: PDR for different strategies of attack against Smart Channel Hopping Method

Figure 8 :

 8 Figure 8: Success rate for different strategies of attack against Smart Channel Hopping Method

Table 1 summarizes

 1 the simulation parameters.

	Parameter Name	Setting Used
	Simulation Time	1790 seconds
	Size of Legitimate Packet(octets)	1000
	Start of jamming(seconds)	10
	Start of channel hopping(seconds)	1
	Energy Model	EnergyBasicModel
	Distance Node -Access Point(m)	5
	Threshold Detection (%)	80

Table 1 :

 1 Simulation parameters

Table 2 :

 2 Number of retransmissions and detection for different attack strategies against random channel hopping method

	Attack	Number	of	Number of de-
		Retransmis-	tection
		sions
	Random	74		0
	Reactive	419		514
	DRL-based Attack	641		1189
	FOLPETTI	738		1483
	Optimal	1070		1729

Table 3 :

 3 Number of retransmission and detection for different attack strategies against smart Channel Hopping method

	Attack	Number	of	Number of de-
		Retransmis-	tection
		sion
	Random	38		0
	Reactive	87		124
	DRL-based Attack	212		485
	FOLPETTI	280		513
	Optimal	470		751

Table 4 :

 4 Power Consumption for 2.4 GHz Operation

	Type of packet Transmission time (s) Reception time (s)
	Data	0,00397	0,00695
	Ack	0,00002	0,00003

Table 5 :

 5 Average time spent by each state during a retransmission according to the type of packet is 738 when the strategy attack is based on Multi Armed Bandit.

If the reviewer wants to look at the code prior to publication, we can provide it through the program chairs. Due to the double-blind review process we cannot provide the link to the code at this stage.

ACKNOWLEDGMENTS

This work was partially supported by a grant from CPER DATA and by the General Armament Direction, France and the Defense Innovation Agency, France


Yannick Saouter

Decoding M -binary turbo codes by the dual method

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

ETSI (European Te lecommunications Standards Institute

) is in the process of adopting new channel coding for interactivity in Digital Video Broadcasting (DVB) for satellite (RCS: Return Channel over Satellite) and terrestrial (RCT: Return Channel over Terrestrial) transmission. The error-correcting code is a duo-binary 8-state convolutional turbo code, specified for var ious block sizes (from 12 to 216 bytes) and coding rates (from 1/3 to 617).

II. DUO-BINARY CODES

Duo-binary codes were introduced in the domain of turbo codes by Berrou et al. [1]. These codes are in fact binary codes with an unpunctured rate of 2/3: each pair of data bits produces one redundancy bit. Those codes exhibit better correcting per formances and do not suffer from severe flattening at low er ror rates, unlike classical binary turbo codes. In this article, we consider the 8-state duo-binary recommended by the DVB datasheet standard [START_REF]Digital Video Broadcasting (DVB); Interaction channel for satellite distribution systems[END_REF], as an illustrative example. Figure 1 de scribes the layout of the encoder as well as its transition graph. Following the works of Hartmann [START_REF] Hartmann | An optimum symbol-by-symbol decoding rule for linear codes[END_REF], Hagenauer introduced MAP dual decoding for binary turbo codes [START_REF] Hagenauer | Iterative decoding of binruy block and convolutionnal codes[END_REF]. This work was extended to the general case of turbo codes defined over Galois fields by Berkmann [START_REF] Berkmann | Iterative Decoding of Nonbinary Codes[END_REF]. In this article, we extend it to M-binary turbo codes which do not come within the scope of Berkmann's work and seem to have more practical appli cations. Indeed, although duo-binary turbo codes can be de coded by Hagenauer's method, our improvement is to extract duo-binary extrinsic values (instead of binary extrinsic values for Hagenauer). This leads to better performance in tenns of bit error rate. For the sake of simplicity, we present here the equations for the case of duo-binary codes and then explain how they generalize to the general M -binary case.

Let C be a systematic duo-binary convolutional code. Let x = (xo,x1, ... ,XN-1) be a frame of N duo-binary infor mation data symbols to be encoded by the encoder of C. The encoder of C will be denoted C. We suppose that

x is a teffilinated sequence (i.e. if the encoding of x be gins in the zero state of C, it also finishes in the zero state of C). The output sequence produced by C is then c = (xo, Yo, xi, Yi, ... , XN-1, YN-1) where Yi denotes the i-th bi nary redundancy produced by the encoder. The codeword c is then modulated by a BPSK and transmitted over a memory less channel with white Gaussian noise with zero mean. We suppose that the modulation is the conventional one in which a data bit 0 is emitted over the channel as -1 and a data bit 1 as +1.

From the decoder point of view, a frame r = ( r0, r1, r1 0, r2, r3, r' 1, ... , r2N-2, r2N-1, r' N-1) with real numbers values is received, where r2i (resp. r2i+1) corresponds to the received sample for the first (resp. second) bit of the duo-binary symbol Xi and r' i corresponds to the received sample for Yi• For any 0:::; t < N, any si,s2 E {0, 1} and any s E {0, 1}, we define J(t, si, s2) = Prob(r2t, r2t+l I si, s2) and I(t, s) = Prob(r't Is).

More precisely, if 7 is the standard deviation of the noise of the transmission channel (computed from the Eb /NO value and the rate of the code by conventional fonnulas ), we have:

1 -((r' t -m.)2) I(t, s) = --exp ( ) .../2-iT 272
J(t ) __ 1_ ( -((r 2 t -m .1 )2 + (r 2t+1 -m.2)2) ) , s1, s2 -2 71"7 exp 272
if ms is the noiseless modulation level of the bit s (i.e. mo = -1 andm1=1).

Let 6 be the reciprocal dual code of C (in the sense of con volutional codes), whose encoder is C. We denote� the set of the states of C. For any state u E �we denote Succ(u) (resp. Pred(u)) the set of states of C which can be reached 1 from state a (resp. which can reach state a) after a single step of convolutional encoding. Let a be any state in 'E and let a ' be any state in Succ(a). Then during a transition from a to a ' , encoder C will produce three bits as outputs that we will denote z1 (a, a ' ), z2 (a, a ' ) and zs (a, a ' ). These three bits are not to be considered in any order: if you consider a code word of C beginning and ending in the zero state of C, then any codeword of 6 with the same length beginning and end ing in the zero state of C should have a null dot product over GF (2) with the codeword of C if z1 (a, a ' ) (resp. z2(a, a ' )) is multiplied with the fi rst (resp. second) bit of the data symbol of the codeword of C, and z3(a,a ' ) is multiplied with the bi nary redundancy of the codeword of C. This defines z1 (a, a ' ), z2 (a, a ' ) and z3 (a, a ' ) uniquely and without ambiguity.

For any a E 'E, any a ' E Succ( a) and 0 :5 t < N we define the branch metric at time t for a transition from a to a ' , that we will denote as B M ( t, a, a ' ) by the following equation:

BM(t,(1 , u' ) = E <-1y1<"" •"" ' ).•1 +z2( u , u ') .•2 .J(t, 81, 82)).
( L (-1ys ( u ,o-') .s .I(t,s)) s E{0,1}

Now, we defi ne the forward metrics Au(t) for any (1 E 'E and 0 :5 t < N and the backward metrics Bu(t) for any u E 'E and 0 < t :5 N by the following recurrence equations:

Ao(O) = 1, Au(O) = 0 ifo :;i: 0 Bo(N) = 1, B,,. (N) = 0 if (1 :;i: 0 A u(t) = L Au ' (t -l).BM(t -1, U1, (1) u1EPred ( u) Bu(t) = E B u 1(t+ l).BM(t,(1,U1) a1ESucc(a)
Then if m = (si, s2) is a duo-binary symbol, the extrinsic value at time t for symbol m, required by the turbo decoding process and that we will denote as EXT Rm(t), is equal to:

EXTRm(t) =-log[ L E ((-l Y' ( u , u ').s1 +z2(u ,o-' ).s2 . Au(t).B u r(t + 1). uEEu ' ESucc ( o-) (I(t,0) + ( -1ya ( u , u ' ) I(t, 1)))]
The proofs of these formulas are outside the scope of this paper but they will be published in a more detailed article.

IV. GENERALIZATION TO M -BINARY CODES

In the previous section, we have described computation in the case of duo-binary turbo codes only, in order to lighten the notation. However, these formulas generalize to any M -binary codes.

For instance, if we now consider a tri-binary code, the J terms now have four function indices and are defi ned by the following equation:

J(t, s1, s2, s3) = ( -1 -) 3; 2 ex p C CE�=1 ( r3t+•-1 -m.;)2) ) 2�T 2T2
The branch metrics BM(t, a, a ' ) have the same expression, with the difference that the summation of the first factor term is now over { si, s2, s3 E {O , 1}} and the exponent now has an additional term z3 (a, a ' ).s3. The exponent of the second factor still concerns the redundancy of the code and thus is z4 (a, a ' ).s where z4 is the fourth bit produced by the encoder of the dual reciprocal code.

The expression of the state metrics does not change and fi nally the expression of the extrinsic value is modified with an additional term in the first exponent, namely zs (a,a 1 ).s3 while the second exponent becomes z4 (a, a ' ).

V. CIRCULAR CODES

In what follows, we will compare the performance of the dual duo-binary MAP decoding with that of the dual binary MAP decoding [START_REF] Riedel | MAP Decoding of Convolutional Codes Using Reciprocal Dual Codes[END_REF] for the case of the DVB-RCS code [START_REF]Digital Video Broadcasting (DVB); Interaction channel for satellite distribution systems[END_REF]. However, in what precedes, we have considered codes whose encoding begins and ends in the zero state. Practically, in applications, those codes require a set of termination symbols, in order to ensure that the end state is effectively the zero state.

In the DVB-RCS encoding scheme, the beginning and end ing state are computed, given the information data, in order that they be equal. This kind of code is called circular. This allows space to be saved for information data, since there are no longer any terminating symbols. Moreover, since the frame is circular, there are no side effects due to the initialization of forward state metrics and backward state metrics at the begin ning and the end of th� frame, and any extrinsic value benefi ts from the decoding of the entire frame.

However, the orthogonality property is not preserved with such codes and this property is critical for the computation of extrinsic values by the dual method. In order to circumvent the problem, we use the forgetfulness property of convolutional decoding. Indeed, it is a well known fact in turbo decoding that the extrinsic values for a given symbol of the frame essen tially depend on the channel values of its nearest neighbors and the dependence decreases exponentially. This property allows sliding window decoding and has also been validated for dual binary MAP decoding [START_REF] Weiss | Error Correction with Tail-Biting Convolutional Codes[END_REF], which is in any case algebraically equivalent to classical binary MAP decoding [START_REF] Bahl | Optimal Decoding of Linear Codes for Minimizing Symbol Error• Rate[END_REF]. Similarly, dual M -binary MAP decoding is equivalent to classical M - binary MAP decoding .and thus the forgetfulness property also holds in our approach.

Thus, in order to deal with circular codes, we begin the de coding by a prologue which is in charge of estimating the ini

n-1 + n-3, 1 + n-1 + n-2 + n-3, 1 + n-2 + n-3)
. This code has a rate of 1/3 since the initial code has a rate of 2/3.

Thus, for one input bit, we have three output redundancy bits.

Let Xi be the samples of input bits and r}, rt and r� be the samples of output redundancies. According to the expression of il(D) we then have the recurrence equations:

r} == Xi + Xi-1 + Xi-3 rl == x; + Xi-1 + Xi-2 + Xi-3 r: == Xi + Xi-2 + Xi-3
The corresponding encoder C is depicted in figure 2 and the reader may verify that any sequence of the initial DVB RCS code beginning and ending in the zero state has a null dot product over GF [START_REF]Digital Video Broadcasting (DVB); Interaction channel for satellite distribution systems[END_REF] with any sequence produced by the encoder C of the same length also beginning and ending in the zero state if ai (resp. bi, ri) meets r} (resp. r�, r�). This order is not arbitrary: it is imposed by the initial matrix conventions we chose. In this section we compare our dual duo-binary MAP decod ing with the dual binary MAP decoding described in [START_REF] Riedel | MAP Decoding of Convolutional Codes Using Reciprocal Dual Codes[END_REF] for a special case of the DVB-RCS encoding standard. We choose two different frame lengths (a long one with 188 information bytes and a short one with 12 information bytes) and the spec ifications of the permutations used are to be found in [START_REF]Digital Video Broadcasting (DVB); Interaction channel for satellite distribution systems[END_REF]. For both programs, the computations were done in floating point numbers and we use prologues at each iteration of the turbo decoding process. The number of iterations is the same in both programs and is equal to 8. The bit error ratio curves of each decoding are depicted in figure 3 for a frame length of 188 bytes and in figure 4 for a frame length of 12 bytes. IX.ACKNOWLEDGMENTS

Figure 1 :

 1 Figure 1: Architecture and state lattice of the duo-binary con volutional encoder

  tial state metrics of the backward and the forward phase. If N is the length of the frame and L is the length of the prologue, then the initial forward state metrics are computed by making a forward prologue over the channel samples of the interval [N -L , N -l]. At time N -Lall the states are considered a priori possible and thus all the state metrics are initialized to 1.0. Since the frame is circular, the state metrics computed at the end of the prologue after the samples of time N -l, are acceptable initializations for the regular forward phase begin ning with the sample of time 0. Similarly, the initial backward metrics are computed by a backward prologue over the interval [O , L] . VI. IMPLEMENTATION FOR THE DVB-RCS CODE Let us denote A(D} = :E:'.:: aiD i , B(D) = :E:'.:: biD i and R(D) = :E�: riD i , where ai (resp. bi) are the input bits of the DVB-RCS encoder depicted in figure 1 and ri is the output redundancy. Then the transfer function of this code can be computed by the conventional method [9] and we find: (A(D) B(D) R(D)} == (A(D) B(D)}. G 0 The transfer matrix of the dual code is then defined as the matrix H(D) such that G(D).HT(D) = 0 where G(D) is the transfer matrix of the code explicitly given in the previous equation. The matrix H(D} is not uniquely defined and thus we can choose the one with the simplest expression. In fact, we have: Thus we may choose H(D) = (D3 + D + 1, D3 + D2 + D + 1, D3 + D2 + 1). Now the transfer matrix of the reciprocal dual code is H(D) = H(D-1 ). We then have H(D) = (1 +

  x

Figure 2 :

 2 Figure 2: Architecture of the dual reciprocal duo-binary con volutional encoder

8 Figure 3 :

 83 Figure 3: Performance of binary and duo-binary MAP decod ing for DVB-RCS standard (frame length= 188 bytes)

Figure 4 :

 4 Figure 4: Performance of binary and duo-binary MAP decod ing for DVB-RCS standard (frame length=12 bytes) In the case of 188 byte frame, we see a great degradation of performance if we use binary MAP dual decoding instead of duo-binary MAP decoding. The gap attains 0.6 dB at a bit error ratio of 10-5. In the case of 12 byte frames, the differ ence is only 0.2 dB at the same bit error ratio. The explanation is that, in longer frames, the duo-binary decoder takes advan tage of a greater number of correctly evaluated extrinsic values while the binary decoder suffers from correlation between the extrinsic values of each bit of a duo-binary symbol. This cor relation is eliminated in the duo-binary case since each symbol is treated as a pair, while the binary decoder treats each bit of a pair independently. VI II. CONCLUSION In this article, we have presented a new soft decision algorithm that makes use of duality to compute M -binary extrinsic val ues. We have shown that, in the case of the DVB-RCS code, our approach outperforms the dual binary MAP algorithm by more than 0.2 dB on an AWGN channel. The following step will be to derive simplified versions of this algorithm with a silicon integration.

The author wishes to thank Prof. Claude Berrou at the Ecole Nationale Superieure de Telecommunications de Bretagne (Brest, France) for his support and his helpful comments about the work presented in this article.


Patricia Armando
email: patricia.armando@enst-bretagne.fr

Karine Amis
email: karine.amis@enst-bretagne.fr

Dominique Le Roux
email: dominique.leroux@enst-bretagne.fr

FREQUENCY DOMAIN TURBO EQUALIZATION FOR SINGLE CARRIER SPACE-TIME BLOCK CODE PER BLOCK

This paper deals with multiple-input multiple-output communication system with single-carrier modulation and frequency domain equalization. Space-time coding schemes adapted to frequency-selective channels namely space-time block codes per block are used. An efficient generalized receiver based on space-time frequency domain detector is investigated. We propose the frequency domain derivation of a generalized minimum mean square error turbo equalizer for orthogonal spacetime block code per block. The main advantage of our proposed scheme is that it can be applied to any orthogonal space-time block code per block. Simulation results show that the scheme performs efficiently over frequency-selective block fading channels.

I. INTRODUCTION

In the last few years we have seen an impressive development of wireless communication systems. The volume of information sent through a band-limited transmission medium is growing up. At the same time, other requirements are to be considered in indoor environments with non-line of sight (NLOS) propagation to improve as far as possible the performance of the receiver.

The standard IEEE 802.16 introduces the use of techniques to avoid the inter-symbol interference (ISI) due to multipath propagation like orthogonal frequency division multiplexing modulation (OFDM) or single-carrier modulation with frequency domain equalization [START_REF] Falconer | Frequency domain equalization for single-carrier broadband wireless systems[END_REF] (SC-FDE). In addition, the standard IEEE 802.16 suggests orthogonal space-time block codes (OSTBC) like the Alamouti code [START_REF] Alamouti | A simple transmit diversity technique for wireless communications[END_REF] and its generalization proposed by Tarokh et al [START_REF] Tarokh | Space-time block codes from orthogonal designs[END_REF]. The main advantage of OS-TBC is their linear maximum likelihood (ML) detection and thus low receiver complexity.

These codes have become a subject of interest in the research field. An important contribution made by Tirkkonen et al, generalizes the construction of complex OSTBC [START_REF] Tirkkonen | Square-matrix embeddable space-time block codes for complex signal constellations[END_REF] based on the Clifford algebra. Moreover, Tirkkonen et al propose the optimization of one or more code features such as power allocation based on unitary transformations on elementary OSTBC.

To adapt the Alamouti scheme to frequency-selective fading channels, the standard IEEE 802.16 proposes to use reversal techniques and symbol packet encoding instead of unique symbol encoding. In [START_REF] Amis | Predictive decision feedback equalization for space-time block codes with orthogonality in frequency domain[END_REF], Amis et al generalizes the construction of OSTBC per block (OSTBCB) and derive an efficient generalized decision feedback equalizer adapted to them. On the other hand, turbo equalization [START_REF] Douillard | Iterative correction of intersymbol interference : turboequalization[END_REF][START_REF] Laot | Low complexity linear turbo equalization: A possible solution for EDGE[END_REF] has been proved to achieve near optimal performance on ISI channels.

In this paper, we use the generalization of OSTBCB proposed in [START_REF] Amis | Predictive decision feedback equalization for space-time block codes with orthogonality in frequency domain[END_REF], and we derive the frequency domain turbo equalizer for these codes. Several papers have studied the turbo equalization principle for MIMO systems [START_REF] Abe | Space-time turbo equalization in frequencyselective MIMO channels[END_REF][START_REF] Frohlich | Frequency domain MIMO interference cancellation technique for space-time block-coded single-carrier system[END_REF][START_REF] Yee | Comparison study of single-carrier an multi-carrier modulation using iterative based receiver mimo system[END_REF][START_REF] Amis | Efficient frequency domain MMSE turbo equalization derivation and performance comparison with the time-domain counterpart[END_REF], where the great majority deals with spatial multiplexing schemes (BLAST) first proposed by Bell Labs [START_REF] Foschini | Layered space-time block architecture for wireless communications in a fading environment when using multi-element antennas[END_REF], and few others consider the Alamouti scheme like [START_REF] Frohlich | Frequency domain MIMO interference cancellation technique for space-time block-coded single-carrier system[END_REF]. However, the turbo equalization proposed in [START_REF] Frohlich | Frequency domain MIMO interference cancellation technique for space-time block-coded single-carrier system[END_REF] can only be applied to the Alamouti code. The advantage of our generalized turbo equalizer is that it can be used for any OSTBCB and any number of receiver antenna. Our generalized receiver achieves near-optimal performance while reducing complexity at the same time.

This paper is organized as follows: in Section II. presents the notations and the system model, then the ML detector structure is introduced. In Section III. the frequency domain generalized turbo equalizer based on the MMSE criterion for OSTBCB is derived. Finally, in Section IV., simulations show the receiver efficiency over selective-frequency block fading channels.

II. SYSTEM MODEL

A. Orthogonal frequency STBC per block

c ST = K k=1 [s k (n)] T ⊗ β - k + [s k ⋆ (p n )] T ⊗ β + k (1)
where

[a] ⋆ denotes the conjugate of [a], [a]
T its transpose matrix, (p n ) = (P -n)mod(P ), ⊗ denotes the Kronecker (tensor) product, and β - k and β + k are T × n T complex matrices characteristic of the considered OSTBCB which properties are given in [START_REF] Tirkkonen | Square-matrix embeddable space-time block codes for complex signal constellations[END_REF].

Let us consider the frequency properties of the OSTBCB given in [START_REF] Amis | Predictive decision feedback equalization for space-time block codes with orthogonality in frequency domain[END_REF], and let S k (p) be the p-th coefficient of the P -FFT of {s k (n)}. The P -FFT applied to c ST along the time dimension (vertical) leads to

P complex matrices C ST (p) of size T × n T [5] C ST (p) = K k=1 S k (p)β - k + S ⋆ k (p)β + k , 0 ≤ p ≤ P -1 (2)
Subsequently, each transmitted block is preceded by a cyclic prefix CP which is the repetition of the last G samples of each block. These CPs guarantee circular convolution in the timedomain, i.e. a scalar product in the frequency domain. The length of the CP is at least equal to the channel ISI order to avoid the inter-block interference (IBI).

Assuming perfect carrier and time synchronizations, the received samples {y j (n)} on the receive antenna j can be expressed as

y j (n) = n T i=1 L-1 l=0 h j,i (n -l)c i ST (n) + φ j (n) (3)
where {h j,i (n)} are the coefficients of the channel impulse response between transmit antenna i and receive antenna j, c i ST (n) corresponds to the m-th OSTBCB element sent from the i-th transmit antenna, φ j (n) are complex circular AWGN noise coefficients on received antenna j with zero mean and variance σ 2 φ . After eliminating the CP, {y j (n)} is split into T packets of length P . Then, a P -FFT is applied on each block to obtain the P matrices Y (p) of size T × n R .

Y(p) = H(p)C ST (p) + Φ(p) (4)
where {Φ(p)} denotes the P -FFT of the noise {φ(n)},

H(p) = {H j,i (p)} with 1 ≤ i ≤ n T , 1 ≤ j ≤ n R and {H j,i (
p)} is the P -FFT of the time channel impulse response coefficients {h j,i (n)}.

H j,i (p) = P -1 n=0 h j,i (n)exp(-j2π np P ) (5)

B. The ML-detector

From now on, soft decisions variables for each S k (p) resulting from the application of the maximum likelihood criterion to matrices Y(p) are denoted X k (p) [START_REF] Amis | Predictive decision feedback equalization for space-time block codes with orthogonality in frequency domain[END_REF]. In [START_REF] Amis | Predictive decision feedback equalization for space-time block codes with orthogonality in frequency domain[END_REF], it is shown that the soft decisions variables can be described by

X k (p) = G ⋆ k (p)[G k (p)S k (p) + Λ k (p)] (6)
where

G ⋆ k (p)G k (p) = Tr[H(p) † H(p)], H † denotes the Hermi- tian of H and Λ k (p) is the equivalent complex AWGN of vari- ance σ 2 Λ = σ 2 Φ = P σ 2 φ . Let us denote B k (p) = G ⋆ k (p)Λ k (p). Its variance is defined by σ 2 B = P |G k (p)| 2 σ 2 φ k .
From now on, we define and consider σ 2 b = σ 2 B /P .

III. FREQUENCY DOMAIN MMSE TURBO EQUALIZATION IC-LE

Let us consider the finite-length MMSE interference cancellation (IC) structure given in Figure 3. After the P -FFT, the ML-detector detailed in [START_REF] Amis | Predictive decision feedback equalization for space-time block codes with orthogonality in frequency domain[END_REF] provides X k (p). Using equivalent model [START_REF] Laot | Low complexity linear turbo equalization: A possible solution for EDGE[END_REF] and the FD-MMSE-IC-LE described in [START_REF] Laot | Low complexity linear turbo equalization: A possible solution for EDGE[END_REF] and [START_REF] Bidan | Turbo-equalization for bandwidth-efficient digital communications over frequency-selective channels[END_REF] for single-input single-output systems, an interference cancellation structure consisting of a feedfoward filter F k (p) and a feedback filter Q k (p) delivers estimated symbols Z k (p) cf. Figure 2. The SISO BSC module generates soft symbol estimates. They are computed as the expected value of the transmitted symbols, with respect to the a priori probabilities derived from the soft value delivered by the decoder at the previous iteration.

Z k (p) = F k (p)X k (p) -Q k (p) Xk (p) (7
xk (n) = E[s k (n)|L a (n)] (8)
Under the assumption of i.i.

d 1 transmitted symbols {s k (n)}, σ 2 x = E[|s k (n) -xk (n)| 2 |L a (n)].
Those soft symbol estimates are exploited as a priori information to cancel the ISI in MMSE-IC-LE.

Let us now detail the equations defining the turbo equalizer. The MMSE IC-LE aims at minimizing the mean square error

ε LE = E[|z k (n)-s k (n)| 2 ]. {z k (n)} is the IFFT Z k (p). Due to the FFT properties combined and assuming i.i.d. of {s k (n)}, minimizing ε LE is equivalent to minimizing each E[|Z k (p) - S k (p)| 2 ] under the constraint P -1 p=0 Q k (p) = 0 i.e. q k (n = 0) = 0.
The Lagrangian resolution of this optimization leads to

Q k (p) = F k (p)|G k (p)| 2 -µ (9)
where µ =1

P P -1 q=0 F k (q)|G k (q)| 2 .
Finally, the frequency domain equalizer coefficients F k (p) are given by Figure 3: Frequency domain turbo equalizer structure

F k (p) = (σ 2 s -µσ 2 x) |G k (p)| 2 (σ 2 s -σ 2 x) + σ 2 b ( 10
)
The output of the SBC denoted L(n) is equal to

L(n) = ln (s∈S|c(n)=1) P r(z k (n)|s k (n) = s)P a,n (s) (s∈S|c(n)=0) P r(z k (n)|s k (n) = s)P a,n (s) (11) where
P r(z k (n)|s k (n) = s) = 1 πσ 2 b exp - |z k (n) -µs k (n)| 2 σ 2 b ( 12
)
and

P a,n (s) = m i=1 P a,n (c i n ) (13)
with {c i n } {1≤i≤m} are the interleaved encoded bit values mapped to s ∈ S.

P a,n (c i n ) = exp (2c i n -1)L a I N (n) 2 exp L a I N (n) 2 + exp - L a I N (n) 2 (14)
L(n) values are used to conjugate the extrinsic information L e out (n) defined by

L e OU T (n) = L(n) -L a IN (n) (15)
IV. SIMULATION RESULTS

The MIMO system consists of 2 transmit antennas and 1 receive antenna. The OSTBCB considered is derived from the Alamouti scheme and is defined by

c = s k (n) -s ⋆ k+1 (p n ) s k+1 (n) s ⋆ k (p n ) (16)
The FEC code is a 1/2 rate convolutional code with generator polynomials [START_REF] Bidan | Turbo-equalization for bandwidth-efficient digital communications over frequency-selective channels[END_REF][START_REF] Proakis | Performance Capabilities of the Viterbi Algorithm for Combatting Intersymbol Interference on Fading Multipath Channels[END_REF] 8 . The pseudo random interleaver length is 1024. Interleaved data is QPSK modulated. The total average transmitted power is normalized to unity. The frequency selective channel consists of 5 i.i.d paths of equal average power such that the total average received power is equal to one (EQ-5). h 1,i (l) is a complex Gaussian random variable of zero mean and variance 1 5 . We further assume that the channel coefficients are spatially uncorrelated and remain constant during the transmission of one OSTBCB. At the receiver, we assume perfect channel state information and perfect synchronization. In our simulations, 5 iterations of the turbo equalizer are considered. The outer decoder is a BCJR decoder [START_REF] Bahl | Optimal decoding of linear codes for minimizing symbol error rate[END_REF]. In comparison with the first iteration, the fifth iteration exhibits a gain of 1.5 dB for a BER of 2.10 -2 (resp. 1 dB for a BER of 2.10 -4 ) at the SBC output (resp. decoder output). Moreover the equalizer achieves the genie equalizer bound after 5 iterations and the decoder performs at 0.2 dB of the genie decoder bound. One can check that the genie bound coincides with the theoretical bit error probability of a QPSK modulated SISO system over the Rayleigh frequency-selective fast fading channel with n T × L taps [START_REF] Proakis | Performance Capabilities of the Viterbi Algorithm for Combatting Intersymbol Interference on Fading Multipath Channels[END_REF].

V. CONCLUSIONS

In this paper we have generalized the turbo equalizer structure of [START_REF] Bidan | Turbo-equalization for bandwidth-efficient digital communications over frequency-selective channels[END_REF] for the generalized OSTBCB proposed in [START_REF] Amis | Predictive decision feedback equalization for space-time block codes with orthogonality in frequency domain[END_REF]. This structure can be applied to any OSTBCB and any receive antenna number. Simulations carried out over a multipath block fading channel have shown the efficiency of the proposed receiver. Future work will consider the turbo equalizer structure optimization, including synchronization and channel estimation.

Figure 1 :

 1 Figure 1: Discrete-time equivalent transmitter model

  ) where { Xk (p)} is the estimated ISI. The P -IFFT of {Z k (p)} denoted {z k (n)} is used in the soft SBC to deliver lineary reliability values used as input of the decoder. The decoder feed the soft-input soft-output (SISO) bit to symbol converter (BSC) with log-likelihood ratios (LLR) denoted L D OU T (n) or L a (n) after interleaving.

Figure 2 :

 2 Figure 2: Structure of the equalizer

Figure 4 :

 4 Figure 4: MMSE-IC-LE performance of OSTBCB (n T = 2, n R = 1) with QPSK over the EQ-5 block fading channel

independent and identically distributed