arXiv subjects

David Akopian

Publications and source records attributed to David Akopian.

16 recordsLinked to original sources

arXiv2023

Kernel-level Rootkit Detection, Prevention and Behavior Profiling: A Taxonomy and Survey

One of the most elusive types of malware in recent times that pose significant challenges in the computer security system is the kernel-level rootkits. The kernel-level rootkits can hide its presence and malicious activities by modifying the kernel control flow, by hooking in the kernel space, or by manipulating the kernel objects. As kernel-level rootkits change the kernel, it is difficult for user-level security tools to detect the kernel-level rootkits. In the past few years, many approaches have been proposed to detect kernel-level rootkits. It is not much difficult for an attacker to evade the signature-based kernel-level rootkit detection system by slightly modifying the existing signature. To detect the evolving kernel-level rootkits, researchers have proposed and experimented with many detection systems. In this paper, we survey traditional kernel-level rootkit detection mechanisms in literature and propose a structured kernel-level rootkit detection taxonomy. We have discussed the strength and weaknesses or challenges of each detection approach. The prevention techniques and profiling kernel-level rootkit behavior affiliated literature are also included in this survey. The paper ends with future research directions for kernel-level rootkit detection.

cs.CR↗

arXiv2021

Rejection of Smooth GPS Time Synchronization Attacks via Sparse Techniques

This paper presents a novel time synchronization attack (TSA) model for the Global Positioning System (GPS) based on clock data behavior changes in a higher-order derivative domain. Further, the time synchronization attack rejection and mitigation based on sparse domain (TSARM-S) is presented. TSAs affect stationary GPS receivers in applications where precise timing is required, such as cellular communications, financial transactions, and monitoring of the electric power grid. In the present work, the clock bias and clock drift are monitored at higher-order clock data derivatives where the TSA is seen as a sparse spike-like event. The smoothness of the attack relates to the derivative order where the sparsity is observed. The proposed method jointly estimates a dynamic solution for GPS timing and rejects behavior changes based on such sparse events. An evaluation procedure is presented for two testbeds, namely a commercial receiver and a software-defined radio. Further, the proposed method is evaluated against distinct real-dataset Texas Spoofing Test Battery (TEXBAT) scenarios. Combined synthetic and real-data results show an average RMS clock bias error of 12.08 m for the SDR platform, and 45.74 m for the commercial device. Further, the technique is evaluated against state-of-the-art mitigation techniques and in a spoofing-plus-multipath scenario for robustness. Finally, TSARM-S can be potentially optimized and implemented in commercial devices via a firmware upgrade.

eess.SP↗

arXiv2020

A GPS spoofing detection and classification correlator-based technique using the LASSO

This work proposes a global navigation satellite system (GNSS) spoofing detection and classification technique for single antenna receivers. We formulate an optimization problem at the baseband correlator domain by using the Least Absolute Shrinkage and Selection Operator (LASSO). We model correlator tap outputs of the received signal to form a dictionary of triangle-shaped functions and leverage sparse signal processing to choose a decomposition of shifted matching triangles from said dictionary. The optimal solution of this minimization problem discriminates the presence of a potential spoofing attack peak by observing a decomposition of two different code-phase values (authentic and spoofed) in a sparse vector output. We use a threshold to mitigate false alarms. Furthermore, we present a variation of the minimization problem by enhancing the dictionary to a higher-resolution of shifted triangles. The proposed technique can be implemented as an advanced fine-acquisition monitoring tool to aid in the tracking loops for spoofing mitigation. In our experiments, we are able to distinguish authentic and spoofer peaks from synthetic data simulations and from a real dataset, namely, the Texas Spoofing Test Battery (TEXBAT). The proposed method achieves 0.3% detection error rate (DER) for a spoofer attack in nominal signal-to-noise ratio (SNR) conditions for an authentic-over-spoofer power of 3 dB.

eess.SP↗

arXiv2019

A Reduced Complexity Cross-correlation Interference Mitigation Technique on a Real-time Software-defined Radio GPS L1 Receiver

The U.S. global position system (GPS) is one of the existing global navigation satellite systems (GNSS) that provides position and time information for users in civil, commercial and military backgrounds. Because of its reliance on many applications nowadays, it's crucial for GNSS receivers to have robustness to intentional or unintentional interference. Because most commercial GPS receivers are not flexible, software-defined radio emerged as a promising solution for fast prototyping and research on interference mitigation algorithms. This paper provides a proposed minimum mean-squared error (MMSE) interference mitigation technique which is enhanced for computational feasibility and implemented on a real-time capable GPS L1 SDR receiver. The GPS SDR receiver SW has been optimized for real-time operation on National Instruments' LabVIEW (LV) platform in conjunction with C/C++ dynamic link libraries (DLL) for improved efficiency. Performance results of said algorithm with real signals and injected interference are discussed. The proposed SDR receiver gains in terms of BER curves for several interferers are demonstrated.

eess.SP↗

arXiv2019

Indoor positioning system using WLAN channel estimates as fingerprints for mobile devices

With the growing integration of location based services (LBS) such as GPS in mobile devices, indoor position systems (IPS) have become an important role for research. There are several IPS methods such as AOA, TOA, TDOA, which use trilateration for indoor location estimation but are generally based on line-of-sight. Other methods rely on classification such as fingerprinting which uses WLAN indoor signals. This paper re-examines the classical WLAN fingerprinting accuracy which uses received signal strength (RSS) measurements by introducing channel estimates for improvements in the classification of indoor locations. The purpose of this paper is to improve existing classification algorithms used in fingerprinting by introducing channel estimates when there are a low number of APs available. The channel impulse response, or in this case the channel estimation from the receiver, should characterize a complex indoor area which usually has multipath, thus providing a unique signature for each location which proves useful for better pattern recognition. In this experiment, channel estimates are extracted from a Software-Defined Radio (SDR) environment, thus exploiting the benefits of SDR from a NI-USRP model and LabVIEW software. Measurements are taken from a known building, and several scenarios with one and two access points (APs) are used in this experiment. Also, three granularities in distance between locations are analyzed. A Support Vector Machine (SVM) is used as the algorithm for pattern recognition of different locations based on the samples taken from RSS and channel estimation coefficients.

cs.NI↗

arXiv2019

Exploiting Acceleration Features of LabVIEW platform for Real-Time GNSS Software Receiver Optimization

This paper presents the new generation of LabVIEW-based GPS receiver testbed that is based on National Instruments' (NI) LabVIEW (LV) platform in conjunction to C/C++ dynamic link libraries (DLL) used inside the platform for performance execution. This GPS receiver has been optimized for real-time operation and has been developed for fast prototyping and easiness on future additions and implementations to the system. The receiver DLLs are divided into three baseband modules: acquisition, tracking, and navigation. The openness of received baseband modules allows for extensive research topics such as signal quality improvement on GPS-denied areas, signal spoofing, and signal interferences. The hardware used in the system was chosen with an effort to achieve portability and mobility in the SDR receiver. Several acceleration factors that accomplish real-time operation and that are inherent to LabVIEW mechanisms, such as multithreading, parallelization and dedicated loop-structures, are discussed. The proposed SDR also exploits C/C++ optimization techniques for single-instruction multiple-data (SIMD) capable processors in software correlators for real-time operation of GNSS tracking loops. It is demonstrated that LabVIEW-based solutions provide competitive real-time solutions for fast prototyping of receiver algorithms.

eess.SP↗

arXiv2019

A Fast-rate WLAN Measurement Tool for Improved Miss-rate in Indoor Navigation

Recently, location-based services (LBS) have steered attention to indoor positioning systems (IPS). WLAN-based IPSs relying on received signal strength (RSS) measurements such as fingerprinting are gaining popularity due to proven high accuracy of their results. Typically, sets of RSS measurements at selected locations from several WLAN access points (APs) are used to calibrate the system. Retrieval of such measurements from WLAN cards are commonly at one-Hz rate. Such measurement collection is needed for offline radio-map surveying stage which aligns fingerprints to locations, and for online navigation stage, when collected measurements are associated with the radio-map for user navigation. As WLAN network is not originally designed for positioning, an RSS measurement miss could have a high impact on the fingerprinting system. Additionally, measurement fluctuations require laborious signal processing, and surveying process can be very time consuming. This paper proposes a fast-rate measurement collection method that addresses previously mentioned problems by achieving a higher probability of RSS measurement collection during a given one-second window. This translates to more data for statistical processing and faster surveying. The fast-rate collection approach is analyzed against the conventional measurement rate in a proposed testing methodology that mimics real-life scenarios related to IPS surveying and online navigation.

cs.NI↗

arXiv2019

Fast prototyping of an SDR WLAN 802.11b receiver for an indoor positioning system

Indoor positioning systems (IPS) are emerging technologies due to an increasing popularity and demand in location based service (LBS). Because traditional positioning systems such as GPS are limited to outdoor applications, many IPS have been proposed in literature. WLAN-based IPS are the most promising due to its proven accuracy and infrastructure deployment. Several WLAN-based IPS have been proposed in the past, from which the best results have been shown by so-called fingerprint-based systems. This paper proposes an indoor positioning system which extends traditional WLAN fingerprinting by using received signal strength (RSS) measurements along with channel estimates as an effort to improve classification accuracy for scenarios with a low number of Access Points (APs). The channel estimates aim to characterize complex indoor environments making it a unique signature for fingerprinting-based IPS and therefore improving pattern recognition in radio-maps. Since commercial WLAN cards offer limited measurement information, software-defined radio (SDR) as an emerging trend for fast prototyping and research integration is chosen as the best cost-effective option to extract channel estimates. Therefore, this paper first proposes an 802.11b WLAN SDR beacon receiver capable of measuring RSS and channel estimates. The SDR is designed using LabVIEW (LV) environment and leverages several inherent platform acceleration features that achieve real-time capturing. The receiver achieves a fast-rate measurement capture of 9 packets per second per AP. The classification of the propose IPS uses a support vector machine (SVM) for offline training and online navigation. Several tests are conducted in a cluttered indoor environment with a single AP in 802.11b legacy mode. Finally, navigation accuracy results are discussed.

eess.SP↗

arXiv2019

Tuning-Free, Low Memory Robust Estimator to Mitigate GPS Spoofing Attacks

The operation of critical infrastructures such as the electrical power grid, cellphone towers, and financial institutions relies on precise timing provided by stationary GPS receivers. These GPS devices are vulnerable to a type of spoofing called Time Synchronization Attack (TSA), whose objective is to maliciously alter the timing provided by the GPS receiver. The objective of this paper is to design a tuning-free, low memory robust estimator to mitigate such spoofing attacks. The contribution is that the proposed method dispenses with several limitations found in the existing state-of-the-art methods in the literature that require parameter tuning, availability of the statistical distributions of noise, real-time optimization, or heavy computations. Specifically, we (i) utilize an observer design for linear systems under unknown inputs, (ii) adjust it to include a state-correction algorithm, (iii) design a realistic experimental setup with real GPS data and sensible spoofing attacks, and (iv) showcase how the proposed tuning-free, low memory robust estimator can combat TSAs. Numerical tests with real GPS data demonstrate that accurate time can be provided to the user under various attack conditions.

eess.SY↗

arXiv2019

A Performance Study of a Fast-Rate WLAN Fingerprint Measurement Collection Method

Indoor positioning systems exploiting WLAN signal measurements such as Received Signal Strength (RSS) are gaining popularity due to high accuracy of the results. Sets of RSS and other measurements at designated locations from available WLAN access points (APs) are conventionally called fingerprints and retrieved from network cards at typically one Hz rate. Such measurement collection is needed for offline radio-map surveying stage which assigns fingerprints to locations, and for online navigation stage, when collected measurements are associated with the radio-map for positioning. As WLAN network is not originally designed for localization, the network cards occasionally miss the fingerprints, measurement fluctuations necessitate statistical signal processing, and surveying process is very time consuming. This paper describes a fast measurement collection approach that addresses the mentioned problems: higher probability of measurement acquisition, more data for statistical processing and faster surveying. The approach is further analyzed for practical setting applications.

eess.SP↗

arXiv2019

Development of a Real-Time Software-Defined Radio GPS Receiver Exploiting a LabVIEW-based Instrumentation Environment

The ubiquitousness of location based services (LBS) has proven effective for many applications such as commercial, military, and emergency responders. Software-defined radio (SDR) has emerged as an adequate framework for development and testing of global navigational satellite systems (GNSS) such as the Global Position System (GPS). SDR receivers are constantly developing in terms of acceleration factors and accurate algorithms for precise user navigation. However, many SDR options for GPS receivers currently lack real-time operation or could be costly. This paper presents a LabVIEW (LV) and C/C++ based GPS L1 receiver platform with real-time capabilities. The system relies on LV acceleration factors as well as other C/C++ techniques such as dynamic link library (DLL) integration into LV and parallelizable loop structures, and single input multiple data (SIMD) methods which leverage host PC multi-purpose processors. A hardware testbed is presented for compactness and mobility, as well as software functionality and data flow handling inherent in LV environment. Benchmarks and other real-time results are presented as well as compared against other state-of-the-art open-source GPS receivers.

eess.SP↗

arXiv2019

Software-Defined Radio GNSS Instrumentation for Spoofing Mitigation: A Review and a Case Study

Recently, several global navigation satellite systems (GNSS) emerged following the transformative technology impact of the first GNSS: US Global Positioning System (GPS). The power level of GNSS signals as measured at the earths surface is below the noise floor and is consequently vulnerable against interference. Spoofers are smart GNSS-like interferers, which mislead the receivers into generating false position and time information. While many spoofing mitigation techniques exist, spoofers are continually evolving, producing a cycle of new spoofing attacks and counter-measures against them. Thus, upgradability of receivers becomes an important advantage for maintaining their immunity against spoofing. Software-defined radio (SDR) implementations of a GPS receiver address such flexibility but are challenged by demanding computational requirements of both GNSS signal processing and spoofing mitigation. Therefore, this paper reviews reported SDRs in the context of instrumentation capabilities for both conventional and spoofing mitigation modes. This separation is necessitated by significantly increased computational loads when in spoofing domain. This is demonstrated by a case study budget analysis.

eess.SP↗

arXiv2018

Real-Time Rejection and Mitigation of Time Synchronization Attacks on the Global Positioning System

This paper introduces the Time Synchronization Attack Rejection and Mitigation (TSARM) technique for Time Synchronization Attacks (TSAs) over the Global Positioning System (GPS). The technique estimates the clock bias and drift of the GPS receiver along with the possible attack contrary to previous approaches. Having estimated the time instants of the attack, the clock bias and drift of the receiver are corrected. The proposed technique is computationally efficient and can be easily implemented in real time, in a fashion complementary to standard algorithms for position, velocity, and time estimation in off-the-shelf receivers. The performance of this technique is evaluated on a set of collected data from a real GPS receiver. Our method renders excellent time recovery consistent with the application requirements. The numerical results demonstrate that the TSARM technique outperforms competing approaches in the literature.

eess.SY↗

arXiv2016

Structured Group Sparsity: A Novel Indoor WLAN Localization, Outlier Detection, and Radio Map Interpolation Scheme

This paper introduces novel schemes for indoor localization, outlier detection, and radio map interpolation using Wireless Local Area Networks (WLANs). The localization method consists of a novel multicomponent optimization technique that minimizes the squared $\ell_{2}$-norm of the residuals between the radio map and the online Received Signal Strength (RSS) measurements, the $\ell_{1}$-norm of the user's location vector, and weighted $\ell_{2}$-norms of layered groups of Reference Points (RPs). RPs are grouped using a new criterion based on the similarity between the so-called Access Point (AP) coverage vectors. In addition, since AP readings are prone to containing inordinate readings, called outliers, an augmented optimization problem is proposed to detect the outliers and localize the user with cleaned online measurements. Moreover, a novel scheme to record fingerprints from a smaller number of RPs and estimate the radio map at RPs without recorded fingerprints is developed using sparse recovery techniques. All localization schemes are tested on RSS fingerprints collected from a real environment. The overall scheme has comparable complexity with competing approaches, while it performs with high accuracy under a small number of APs and finer granularity of RPs.

cs.NI↗

arXiv2016

Modern WLAN Fingerprinting Indoor Positioning Methods and Deployment Challenges

Wireless Local Area Network (WLAN) has become a promising choice for indoor positioning as the only existing and established infrastructure, to localize the mobile and stationary users indoors. However, since WLAN has been initially designed for wireless networking and not positioning, the localization task based on WLAN signals has several challenges. Amongst the WLAN positioning methods, WLAN fingerprinting localization has recently achieved great attention due to its promising results. WLAN fingerprinting faces several challenges and hence, in this paper, our goal is to overview these challenges and the state-of-the-art solutions. This paper consists of three main parts: 1) Conventional localization schemes; 2) State-of-the-art approaches; 3) Practical deployment challenges. Since all the proposed methods in WLAN literature have been conducted and tested in different settings, the reported results are not equally comparable. So, we compare some of the main localization schemes in a single real environment and assess their localization accuracy, positioning error statistics, and complexity. Our results depict illustrative evaluation of WLAN localization systems and guide to future improvement opportunities.

cs.NI↗

arXiv2016

A Joint Indoor WLAN Localization and Outlier Detection Scheme Using LASSO and Elastic-Net Optimization Techniques

In this paper, we introduce two indoor Wireless Local Area Network (WLAN) positioning methods using augmented sparse recovery algorithms. These schemes render a sparse user's position vector, and in parallel, minimize the distance between the online measurement and radio map. The overall localization scheme for both methods consists of three steps: 1) coarse localization, obtained from comparing the online measurements with clustered radio map. A novel graph-based method is proposed to cluster the offline fingerprints. In the online phase, a Region Of Interest (ROI) is selected within which we search for the user's location; 2) Access Point (AP) selection; and 3) fine localization through the novel sparse recovery algorithms. Since the online measurements are subject to inordinate measurement readings, called outliers, the sparse recovery methods are modified in order to jointly estimate the outliers and user's position vector. The outlier detection procedure identifies the APs whose readings are either not available or erroneous. The proposed localization methods have been tested with Received Signal Strength (RSS) measurements in a typical office environment and the results show that they can localize the user with significantly high accuracy and resolution which is superior to the results from competing WLAN fingerprinting localization methods.

cs.NI↗