arXiv subjects
Publications and source records attributed to Francesco Restuccia.
We expose a new security leak for smartphone users, which allows to stole user personal data by accessing the mobile operator user page when auto-login is employed. We show how any "apparently" genuine app can steal these data from some mobile operators, affecting more than 80% of Italian mobile smartphones.
The Internet of Things (IoT) is expected to require more effective and efficient wireless communications than ever before. For this reason, techniques such as spectrum sharing, dynamic spectrum access, extraction of signal intelligence and optimized routing will soon become essential components of the IoT wireless communication paradigm. Given that the majority of the IoT will be composed of tiny, mobile, and energy-constrained devices, traditional techniques based on a priori network optimization may not be suitable, since (i) an accurate model of the environment may not be readily available in practical scenarios; (ii) the computational requirements of traditional optimization techniques may prove unbearable for IoT devices. To address the above challenges, much research has been devoted to exploring the use of machine learning to address problems in the IoT wireless communications domain. This work provides a comprehensive survey of the state of the art in the application of machine learning techniques to address key problems in IoT wireless communications with an emphasis on its ad hoc networking aspect. First, we present extensive background notions of machine learning techniques. Then, by adopting a bottom-up approach, we examine existing work on machine learning for the IoT at the physical, data-link and network layer of the protocol stack. Thereafter, we discuss directions taken by the community towards hardware implementation to ensure the feasibility of these techniques. Additionally, before concluding, we also provide a brief discussion of the application of machine learning in IoT beyond wireless communication. Finally, each of these discussions is accompanied by a detailed analysis of the related open problems and challenges.
Radio access network (RAN) slicing realizes a vision where physical network resources that belong to a specific infrastructure provider can be shared among multiple mobile network operators (MNOs). Existing work in this area has addressed RAN slicing at different levels of network abstractions, but has often neglected the multitude of tightly intertwined inter-level operations involved in real-world slicing systems. For this reason, this article discusses a novel framework for operator-to-waveform 5G RAN slicing. In the proposed framework, slicing operations are treated holistically, including MNO's selection of base stations (BSs) and maximum number of users, down to the waveform-level scheduling of resource blocks. Experimental results show that the proposed framework provides up to 150% improvement in terms of number of resource blocks that can be used to enable 5G transmission technologies that require coordination and synchronization among BSs.
Undetectable wireless transmissions are fundamental to avoid eavesdroppers. To address this issue, wireless steganography hides covert information inside primary information by slightly modifying the transmitted waveform such that primary information will still be decodable, while covert information will be seen as noise by agnostic receivers. Since the addition of covert information inevitably decreases the SNR of the primary transmission, key challenges in wireless steganography are: i) to assess the impact of the covert channel on the primary channel as a function of different channel conditions; and ii) to make sure that the covert channel is undetectable. Existing approaches are protocol-specific, also we notice that existing wireless technologies rely on phase-keying modulations that in most cases do not use the channel up to its Shannon capacity. Therefore, the residual capacity can be leveraged to implement a wireless system based on a pseudo-noise asymmetric shift keying (PN-ASK) modulation, where covert symbols are mapped by shifting the amplitude of primary symbols. This way, covert information will be undetectable, since a receiver expecting phase-modulated symbols will see their shift in amplitude as an effect of channel/path loss degradation. We first investigate the SER of PN-ASK as a function of the channel; then, we find the optimal PN-ASK parameters that optimize primary and covert throughput under different channel condition. We evaluate the throughput performance and undetectability of PN-ASK through extensive simulations and on an experimental testbed based on USRP N210 software-defined radios. We show that PN-ASK improves the throughput by more than 8x with respect to prior art. Finally, we demonstrate through experiments that PN-ASK is able to transmit covert data on top of IEEE 802.11g frames, which are correctly decoded by an off-the-shelf laptop WiFi.
In advanced jamming, the adversary intentionally concentrates the available energy budget on specific critical components (e.g., pilot symbols, acknowledgement packets, etc.) to (i) increase the jamming effectiveness, as more targets can be jammed with the same energy budget; and (ii) decrease the likelihood of being detected, as the channel is jammed for a shorter period of time. One of the fundamental challenges in designing defense mechanisms against an advanced jammer is understanding which jamming strategies yields the lowest throughput, for a given channel condition and a given amount of energy. To the best of our knowledge, this problem still remains unsolved. To fill this gap, in this paper we conduct a comparative analysis of several most viable advanced jamming schemes in the widely-used MIMO networks. We first mathematically model a number of advanced jamming schemes at the signal processing level, so that a quantitative relationship between the jamming energy and the jamming effect is established. Based on the model, theorems are derived on the optimal advanced jamming scheme for an arbitrary channel condition. The theoretical findings are validated through extensive simulations and experiments on a 5-radio 2x2 MIMO testbed. Our results show that the theorems are able to predict jamming efficiency with high accuracy. Moreover, we show that the theorems can be incorporated to state-of-art reinforcement learning based jamming algorithms and boost the action exploration phase so that a faster convergence is achieved.
Radio fingerprinting provides a reliable and energy-efficient IoT authentication strategy. By mapping inputs onto a very large feature space, deep learning algorithms can be trained to fingerprint large populations of devices operating under any wireless standard. One of the most crucial challenges in radio fingerprinting is to counteract the action of the wireless channel, which decreases fingerprinting accuracy significantly by disrupting hardware impairments. On the other hand, due to their sheer size, deep learning algorithms are hardly re-trainable in real-time. Another aspect that is yet to be investigated is whether an adversary can successfully impersonate another device fingerprint. To address these key issues, this paper proposes DeepRadioID, a system to optimize the accuracy of deep-learning-based radio fingerprinting algorithms without retraining the underlying deep learning model. We extensively evaluate DeepRadioID on a experimental testbed of 20 nominally-identical software-defined radios, as well as on two datasets made up by 500 ADS-B devices and by 500 WiFi devices provided by the DARPA RFMLS program. Experimental results show that DeepRadioID (i) increases fingerprinting accuracy by about 35%, 50% and 58% on the three scenarios considered; (ii) decreases an adversary's accuracy by about 54% when trying to imitate other device fingerprints by using their filters; (iii) achieves 27% improvement over the state of the art on a 100-device dataset.
One of the key challenges to the IoT's success is how to secure and anonymize billions of IoT transactions and devices per day, an issue that still lingers despite significant research efforts over the last few years. On the other hand, technologies based on blockchain algorithms are disrupting today's cryptocurrency markets and showing tremendous potential, since they provide a distributed transaction ledger that cannot be tampered with or controlled by a single entity. Although the blockchain may present itself as a cure-all for the IoT's security and privacy challenges, significant research efforts still need to be put forth to adapt the computation-intensive blockchain algorithms to the stringent energy and processing constraints of today's IoT devices. In this paper, we provide an overview of existing literature on the topic of blockchain for IoT, and present a roadmap of research challenges that will need to be addressed to enable the usage of blockchain technologies in the IoT.
The explosion of 5G networks and the Internet of Things will result in an exceptionally crowded RF environment, where techniques such as spectrum sharing and dynamic spectrum access will become essential components of the wireless communication process. In this vision, wireless devices must be able to (i) learn to autonomously extract knowledge from the spectrum on-the-fly; and (ii) react in real time to the inferred spectrum knowledge by appropriately changing communication parameters, including frequency band, symbol modulation, coding rate, among others. Traditional CPU-based machine learning suffers from high latency, and requires application-specific and computationally-intensive feature extraction/selection algorithms. In this paper, we present RFLearn, the first system enabling spectrum knowledge extraction from unprocessed I/Q samples by deep learning directly in the RF loop. RFLearn provides (i) a complete hardware/software architecture where the CPU, radio transceiver and learning/actuation circuits are tightly connected for maximum performance; and (ii) a learning circuit design framework where the latency vs. hardware resource consumption trade-off can explored. We implement and evaluate the performance of RFLearn on custom software-defined radio built on a system-on-chip (SoC) ZYNQ-7000 device mounting AD9361 radio transceivers and VERT2450 antennas. We showcase the capabilities of RFLearn by applying it to solving the fundamental problems of modulation and OFDM parameter recognition. Experimental results reveal that RFLearn decreases latency and power by about 17x and 15x with respect to a software-based solution, with a comparatively low hardware resource consumption.
The notions of softwarization and virtualization of the radio access network (RAN) of next-generation (5G) wireless systems are ushering in a vision where applications and services are physically decoupled from devices and network infrastructure. This crucial aspect will ultimately enable the dynamic deployment of heterogeneous services by different network operators over the same physical infrastructure. RAN slicing is a form of 5G virtualization that allows network infrastructure owners to dynamically "slice" and "serve" their network resources (i.e., spectrum, power, antennas, among others) to different mobile virtual network operators (MVNOs), according to their current needs. Once the slicing policy (i.e., the percentage of resources assigned to each MVNO) has been computed, a major challenge is how to allocate spectrum resources to MVNOs in such a way that (i) the slicing policy defined by the network owner is enforced; and (ii) the interference among different MVNOs is minimized. In this article, we mathematically formalize the RAN slicing enforcement problem (RSEP) and demonstrate its NP-hardness. For this reason, we design three approximation algorithms that render the solution scalable as the RSEP increases in size. We extensively evaluate their performance through simulations and experiments on a testbed made up of 8 software-defined radio peripherals. Experimental results reveal that not only do our algorithms enforce the slicing policies, but can also double the total network throughput when intra-MVNO power control policies are used in conjunction.
The Internet of Things (IoT) realizes a vision where billions of interconnected devices are deployed just about everywhere, from inside our bodies to the most remote areas of the globe. As the IoT will soon pervade every aspect of our lives and will be accessible from anywhere, addressing critical IoT security threats is now more important than ever. Traditional approaches where security is applied as an afterthought and as a "patch" against known attacks are insufficient. Indeed, next-generation IoT challenges will require a new secure-by-design vision, where threats are addressed proactively and IoT devices learn to dynamically adapt to different threats. To this end, machine learning and software-defined networking will be key to provide both reconfigurability and intelligence to the IoT devices. In this paper, we first provide a taxonomy and survey the state of the art in IoT security research, and offer a roadmap of concrete research challenges related to the application of machine learning and software-defined networking to address existing and next-generation IoT security threats.
The reliability of information in participatory sensing (PS) systems largely depends on the accuracy of the location of the participating users. However, existing PS applications are not able to efficiently validate the position of users in large-scale outdoor environments. In this paper, we present an efficient and scalable Location Validation System (LVS) to secure PS systems from location-spoofing attacks. In particular, the user location is verified with the help of mobile WiFi hot spots (MHSs), which are users activating the WiFi hotspot capability of their smartphones and accepting connections from nearby users, thereby validating their position inside the sensing area. The system also comprises a novel verification technique called Chains of Sight, which tackles collusion-based attacks effectively. LVS also includes a reputation-based algorithm that rules out sensing reports of location-spoofing users. The feasibility and efficiency of the WiFi-based approach of LVS is demonstrated by a set of indoor and outdoor experiments conducted using off-the-shelf smartphones, while the energy-efficiency of LVS is demonstrated by experiments using the Power Monitor energy tool. Finally, the security properties of LVS are analyzed by simulation experiments. Results indicate that the proposed LVS system is energy-efficient, applicable to most of the practical PS scenarios, and efficiently secures existing PS systems from location-spoofing attacks.
Mobile crowdsensing allows data collection at a scale and pace that was once impossible. One of the biggest challenges in mobile crowdsensing is that participants may exhibit malicious or unreliable behavior. Therefore, it becomes imperative to design algorithms to accurately classify between reliable and unreliable sensing reports. To this end, we propose a novel Framework for optimizing Information Reliability in Smartphone-based participaTory sensing (FIRST), that leverages mobile trusted participants (MTPs) to securely assess the reliability of sensing reports. FIRST models and solves the challenging problem of determining before deployment the minimum number of MTPs to be used in order to achieve desired classification accuracy. We extensively evaluate FIRST through an implementation in iOS and Android of a room occupancy monitoring system, and through simulations with real-world mobility traces. Experimental results demonstrate that FIRST reduces significantly the impact of three security attacks (i.e., corruption, on/off, and collusion), by achieving a classification accuracy of almost 80% in the considered scenarios. Finally, we discuss our ongoing research efforts to test the performance of FIRST as part of the National Map Corps project.
Mobile crowdsensing harnesses the sensing power of modern smartphones to collect and analyze data beyond the scale of what was previously possible. In a mobile crowdsensing system, it is paramount to incentivize smartphone users to provide sensing services in a timely and reliable manner. Given sensed information is often valid for a limited period of time, the capability of smartphone users to execute sensing tasks largely depends on their mobility, which is often uncertain. For this reason, in this paper we propose IncentMe, a framework that solves this fundamental problem by leveraging game-theoretical reverse auction mechanism design. After demonstrating that the proposed problem is NP-hard, we derive two mechanisms that are parallelizable and achieve higher approximation ratio than existing work. IncentMe has been extensively evaluated on a road traffic monitoring application implemented using mobility traces of taxi cabs in San Francisco, Rome, and Beijing. Results demonstrate that the mechanisms in IncentMe outperform prior work by improving the efficiency in recruiting participants by 30%.
Radio access network (RAN) slicing is an effective methodology to dynamically allocate networking resources in 5G networks. One of the main challenges of RAN slicing is that it is provably an NP-Hard problem. For this reason, we design near-optimal low-complexity distributed RAN slicing algorithms. First, we model the slicing problem as a congestion game, and demonstrate that such game admits a unique Nash equilibrium (NE). Then, we evaluate the Price of Anarchy (PoA) of the NE, i.e., the efficiency of the NE as compared to the social optimum, and demonstrate that the PoA is upper-bounded by 3/2. Next, we propose two fully-distributed algorithms that provably converge to the unique NE without revealing privacy-sensitive parameters from the slice tenants. Moreover, we introduce an adaptive pricing mechanism of the wireless resources to improve the network owner's profit. We evaluate the performance of our algorithms through simulations and an experimental testbed deployed on the Amazon EC2 cloud, both based on a real-world dataset of base stations from the OpenCellID project. Results conclude that our algorithms converge to the NE rapidly and achieve near-optimal performance, while our pricing mechanism effectively improves the profit of the network owner.
Smartphones have become the most pervasive devices in people's lives, and are clearly transforming the way we live and perceive technology. Today's smartphones benefit from almost ubiquitous Internet connectivity and come equipped with a plethora of inexpensive yet powerful embedded sensors, such as accelerometer, gyroscope, microphone, and camera. This unique combination has enabled revolutionary applications based on the mobile crowdsensing paradigm, such as real-time road traffic monitoring, air and noise pollution, crime control, and wildlife monitoring, just to name a few. Differently from prior sensing paradigms, humans are now the primary actors of the sensing process, since they become fundamental in retrieving reliable and up-to-date information about the event being monitored. As humans may behave unreliably or maliciously, assessing and guaranteeing Quality of Information (QoI) becomes more important than ever. In this paper, we provide a new framework for defining and enforcing the QoI in mobile crowdsensing, and analyze in depth the current state-of-the-art on the topic. We also outline novel research challenges, along with possible directions of future work.
Security threats such as jamming and route manipulation can have significant consequences on the performance of modern wireless networks. To increase the efficacy and stealthiness of such threats, a number of extremely challenging, cross-layer attacks have been recently unveiled. Although existing research has thoroughly addressed many single-layer attacks, the problem of detecting and mitigating cross-layer attacks still remains unsolved. For this reason, in this paper we propose a novel framework to analyze and address cross-layer attacks in wireless networks. Specifically, our framework consists of a detection and a mitigation component. The attack detection component is based on a Bayesian learning detection scheme that constructs a model of observed evidence to identify stealthy attack activities. The mitigation component comprises a scheme that achieves the desired trade-off between security and performance. We specialize and evaluate the proposed framework by considering a specific cross-layer attack that uses jamming as an auxiliary tool to achieve route manipulation. Simulations and experimental results obtained with a test-bed made up by USRP software-defined radios demonstrate the effectiveness of the proposed methodology.
Participatory sensing is a powerful paradigm which takes advantage of smartphones to collect and analyze data beyond the scale of what was previously possible. Given that participatory sensing systems rely completely on the users' willingness to submit up-to-date and accurate information, it is paramount to effectively incentivize users' active and reliable participation. In this paper, we survey existing literature on incentive mechanisms for participatory sensing systems. In particular, we present a taxonomy of existing incentive mechanisms for participatory sensing systems, which are subsequently discussed in depth by comparing and contrasting different approaches. Finally, we discuss an agenda of open research challenges in incentivizing users in participatory sensing.