Searcharxiv⌕ Search

arXiv subjects

Roberto Di Pietro

Publications and source records attributed to Roberto Di Pietro.

At least 37 records · Page 2Linked to original sources
arXiv2024

Inferring Power Grid Information with Power Line Communications: Review and Insights

High-frequency signals were widely studied in the last decade to identify grid and channel conditions in power lines. PLMs operating on the grid's physical layer are capable of transmitting such signals to infer information about the medium. When applied to the electrical grid, one of the key advantages of PLC is its capacity to use signals to provide information about the grid itself. This makes PLC an ideal communication technology for smart grid applications, particularly in the realms of grid monitoring and surveillance. In this paper, we focus on PLC grid information inference and provide several contributions: a classification of PLC-based applications, a review of the relevant literature, and insights to further advance the field. Our research identified contributions addressing PLMs for three main grid information inference applications: topology inference, anomaly detection, and grid cybersecurity. We utilize the outcome of our review to shed light on the current limitations of the research contributions and suggest future research directions in this field.

eess.SP↗
arXiv2024

A Survey and Comparison of Post-quantum and Quantum Blockchains

Blockchains have gained substantial attention from academia and industry for their ability to facilitate decentralized trust and communications. However, the rapid progress of quantum computing poses a significant threat to the security of existing blockchain technologies. Notably, the emergence of Shor's and Grover's algorithms raises concerns regarding the compromise of the cryptographic systems underlying blockchains. Consequently, it is essential to develop methods that reinforce blockchain technology against quantum attacks. In response to this challenge, two distinct approaches have been proposed. The first approach involves post-quantum blockchains, which aim to utilize classical cryptographic algorithms resilient to quantum attacks. The second approach explores quantum blockchains, which leverage the power of quantum computers and networks to rebuild the foundations of blockchains. This paper aims to provide a comprehensive overview and comparison of post-quantum and quantum blockchains while exploring open questions and remaining challenges in these domains. It offers an in-depth introduction, examines differences in blockchain structure, security, privacy, and other key factors, and concludes by discussing current research trends.

cs.CR↗
arXiv2024

Characterizing Polkadot's Transactions Ecosystem: methodology, tools, and insights

The growth potential of a crypto(currency) project can be measured by the use cases spurred by the underlying technology. However, these projects are usually distributed, with a weak feedback schemes. Hence, a metric that is widely used as a proxy for their healthiness is the number of transactions and related volumes. Nevertheless, such a metric can be subject to manipulation (the crypto market being an unregulated one magnifies such a risk). To address the cited gap we design a comprehensive methodology to process large cryptocurrency transaction graphs that, after clustering user addresses of interest, derives a compact representation of the network that highlights clusters interactions. To show the viability of our solution, we bring forward a use case centered on Polkadot, which has gained significant attention in the digital currency landscape due to its pioneering approach to interoperability and scalability. However, little is known about how many and to what extent its wide range of enabled use cases have been adopted by end-users so far. The answer to this type of question means mapping Polkadot (or any analyzed crypto project) on a palette that ranges from a thriving ecosystem to a speculative coin without compelling use cases. Our findings demonstrate that crypto exchanges exert considerable influence on the Polkadot network, owning nearly 40% of all addresses in the ledger and absorbing at least 80% of all transactions. In addition, the high volume of inter-exchange transactions (> 20%) underscores the strong interconnections among just a couple of prominent exchanges, prompting further investigations into the behavior of these actors to uncover potential unethical activities, such as wash trading. These results, while characterized by a high level of scalability and adaptability, are at the same time immune from the drawbacks of currently used metrics.

cs.CR↗
arXiv2023

Expanding Boundaries: Cross-Media Routing for Seamless Underwater and Aerial Communication

The colossal evolution of wireless communication technologies over the past few years has driven increased interest in its integration in a variety of less-explored environments, such as the underwater medium. In this magazine paper, we present a comprehensive discussion on a novel concept of routing protocol known as cross-media routing, incorporating the marine and aerial interfaces. In this regard, we discuss the limitation of single-media routing and advocate the need for cross-media routing along with the current status of research development in this direction. To this end, we also propose a novel cross-media routing protocol known as bubble routing for autonomous marine systems where different sets of AUVs, USVs, and airborne nodes are considered for the routing problem. We evaluate the performance of the proposed routing protocol by using the two key performance metrics, i.e., packet delivery ratio (PDR) and end-to-end delay. Moreover, we delve into the challenges encountered in cross-media routing, unveiling exciting opportunities for future research and innovation. As wireless communication expands its horizons to encompass the underwater and aerial domains, understanding and addressing these challenges will pave the way for enhanced cross-media communication and exploration.

cs.NI↗
arXiv2023

Adversarial Attacks Neutralization via Data Set Randomization

Adversarial attacks on deep-learning models pose a serious threat to their reliability and security. Existing defense mechanisms are narrow addressing a specific type of attack or being vulnerable to sophisticated attacks. We propose a new defense mechanism that, while being focused on image-based classifiers, is general with respect to the cited category. It is rooted on hyperspace projection. In particular, our solution provides a pseudo-random projection of the original dataset into a new dataset. The proposed defense mechanism creates a set of diverse projected datasets, where each projected dataset is used to train a specific classifier, resulting in different trained classifiers with different decision boundaries. During testing, it randomly selects a classifier to test the input. Our approach does not sacrifice accuracy over legitimate input. Other than detailing and providing a thorough characterization of our defense mechanism, we also provide a proof of concept of using four optimization-based adversarial attacks (PGD, FGSM, IGSM, and C\&W) and a generative adversarial attack testing them on the MNIST dataset. Our experimental results show that our solution increases the robustness of deep learning models against adversarial attacks and significantly reduces the attack success rate by at least 89% for optimization attacks and 78% for generative attacks. We also analyze the relationship between the number of used hyperspaces and the efficacy of the defense mechanism. As expected, the two are positively correlated, offering an easy-to-tune parameter to enforce the desired level of security. The generality and scalability of our solution and adaptability to different attack scenarios, combined with the excellent achieved results, other than providing a robust defense against adversarial attacks on deep learning networks, also lay the groundwork for future research in the field.

cs.LG↗
arXiv2023

The paradigm-shift of social spambots: Evidence, theories, and tools for the arms race

Recent studies in social media spam and automation provide anecdotal argumentation of the rise of a new generation of spambots, so-called social spambots. Here, for the first time, we extensively study this novel phenomenon on Twitter and we provide quantitative evidence that a paradigm-shift exists in spambot design. First, we measure current Twitter's capabilities of detecting the new social spambots. Later, we assess the human performance in discriminating between genuine accounts, social spambots, and traditional spambots. Then, we benchmark several state-of-the-art techniques proposed by the academic literature. Results show that neither Twitter, nor humans, nor cutting-edge applications are currently capable of accurately detecting the new social spambots. Our results call for new approaches capable of turning the tide in the fight against this raising phenomenon. We conclude by reviewing the latest literature on spambots detection and we highlight an emerging common research trend based on the analysis of collective behaviors. Insights derived from both our extensive experimental campaign and survey shed light on the most promising directions of research and lay the foundations for the arms race against the novel social spambots. Finally, to foster research on this novel phenomenon, we make publicly available to the scientific community all the datasets used in this study.

cs.SI↗
arXiv2023

$A^2RID$ -- Anonymous Direct Authentication and Remote Identification of Commercial Drones

The recent worldwide introduction of RemoteID (RID) regulations forces all Unmanned Aircrafts (UAs), a.k.a. drones, to broadcast in plaintext on the wireless channel their identity and real-time location, for accounting and monitoring purposes. Although improving drones' monitoring and situational awareness, the RID rule also generates significant privacy concerns for UAs' operators, threatened by the ease of tracking of UAs and related confidentiality and privacy concerns connected with the broadcasting of plaintext identity information. In this paper, we propose $A^2RID$, a protocol suite for anonymous direct authentication and remote identification of heterogeneous commercial UAs. $A^2RID$ integrates and adapts protocols for anonymous message signing to work in the UA domain, coping with the constraints of commercial drones and the tight real-time requirements imposed by the RID regulation. Overall, the protocols in the $A^2RID$ suite allow a UA manufacturer to pick the configuration that best suits the capabilities and constraints of the drone, i.e., either a processing-intensive but memory-lightweight solution (namely, $CS-A^2RID$) or a computationally-friendly but memory-hungry approach (namely, $DS-A^2RID$). Besides formally defining the protocols and formally proving their security in our setting, we also implement and test them on real heterogeneous hardware platforms, i.e., the Holybro X-500 and the ESPcopter, releasing open-source the produced code. For all the protocols, we demonstrated experimentally the capability of generating anonymous RemoteID messages well below the time bound of $1$ second required by RID, while at the same time having quite a limited impact on the energy budget of the drone.

cs.CR↗
arXiv2022

Characterizing the 2022 Russo-Ukrainian Conflict Through the Lenses of Aspect-Based Sentiment Analysis: Dataset, Methodology, and Preliminary Findings

Online social networks (OSNs) play a crucial role in today's world. On the one hand, they allow free speech, information sharing, and social-movements organization, to cite a few. On the other hand, they are the tool of choice to spread disinformation, hate speech, and to support propaganda. For these reasons, OSNs data mining and analysis aimed at detecting disinformation campaigns that may arm the society and, more in general, poison the democratic posture of states, are essential activities during key events such as elections, pandemics, and conflicts. In this paper, we studied the 2022 Russo-Ukrainian conflict on Twitter, one of the most used OSNs. We quantitatively and qualitatively analyze a dataset of more than 5.5+ million tweets related to the subject, generated by 1.8+ million unique users. By leveraging statistical analysis techniques and aspect-based sentiment analysis (ABSA), we discover hidden insights in the collected data and abnormal patterns in the users' sentiment that in some cases confirm while in other cases disprove common beliefs on the conflict. In particular, based on our findings and contrary to what suggested in some mainstream media, there is no evidence of massive disinformation campaigns. However, we have identified several anomalies in the behavior of particular accounts and in the sentiment trend for some subjects that represent a starting point for further analysis in the field. The adopted techniques, the availability of the data, the replicability of the experiments, and the preliminary findings, other than being interesting on their own, also pave the way to further research in the domain.

cs.SI↗
arXiv2022

Satellite-Based Communications Security: A Survey of Threats, Solutions, and Research Challenges

Satellite-based Communication systems are gaining renewed momentum in Industry and Academia, thanks to innovative services introduced by leading tech companies and the promising impact they can deliver towards the global connectivity objective tackled by early 6G initiatives. On the one hand, the emergence of new manufacturing processes and radio technologies promises to reduce service costs while guaranteeing outstanding communication latency, available bandwidth, flexibility, and coverage range. On the other hand, cybersecurity techniques and solutions applied in SATCOM links should be updated to reflect the substantial advancements in attacker capabilities characterizing the last two decades. However, business urgency and opportunities are leading operators towards challenging system trade-offs, resulting in an increased attack surface and a general relaxation of the available security services. In this paper, we tackle the cited problems and present a comprehensive survey on the link-layer security threats, solutions, and challenges faced when deploying and operating SATCOM systems.Specifically, we classify the literature on security for SATCOM systems into two main branches, i.e., physical-layer security and cryptography schemes.Then, we further identify specific research domains for each of the identified branches, focusing on dedicated security issues, including, e.g., physical-layer confidentiality, anti-jamming schemes, anti-spoofing strategies, and quantum-based key distribution schemes. For each of the above domains, we highlight the most essential techniques, peculiarities, advantages, disadvantages, lessons learned, and future directions.Finally, we also identify emerging research topics whose additional investigation by Academia and Industry could further attract researchers and investors, ultimately unleashing the full potential behind ubiquitous satellite communications.

cs.CR↗
arXiv2022

Analysis of Polkadot: Architecture, Internals, and Contradictions

Polkadot is a network protocol launched in 2020 with the ambition of unlocking the full potential of blockchain technologies. Its novel multi-chain protocol allows arbitrary data to be transferred across heterogeneous blockchains, enabling the implementation of a wide range of novel use cases. The Polkadot architecture is based on the principles of sharding, which promises to solve scalability and interoperability shortcomings that encumber many existing blockchain-based systems. Lured by these impressive features, investors immediately appreciated the Polkadot project, which is now firmly ranked among the top 10 cryptocurrencies by capitalization (around 20 Billions USD). However, Polkadot has not received the same level of attention from academia that other proposals in the crypto domain have received so far, like Bitcoin, Ethereum, and Algorand, to cite a few. Polkadot architecture is described and discussed only in the grey literature, and very little is known about its internals. In this paper, we provide the first systematic study on the Polkadot environment, detailing its protocols, governance, and economic model. Then, we identify several limitations -- supported by an empirical analysis of its ledger -- that could severely affect the scalability and overall security of the network. Finally, based on our analysis, we provide future directions to inspire researchers to investigate further the Polkadot ecosystem and its pitfalls in terms of performance, security, and network aspects.

cs.CR↗
arXiv2022

Content Privacy Enforcement Models in Decentralized Online Social Networks: State of Play, Solutions, Limitations, and Future Directions

In recent years, Decentralized Online Social Networks (DOSNs) have been attracting the attention of many users because they reduce the risk of censorship, surveillance, and information leakage from the service provider. In contrast to the most popular Online Social Networks, which are based on centralized architectures (e.g., Facebook, Twitter, or Instagram), DOSNs are not based on a single service provider acting as a central authority. Indeed, the contents that are published on DOSNs are stored on the devices made available by their users, which cooperate to execute the tasks needed to provide the service. To continuously guarantee their availability, the contents published by a user could be stored on the devices of other users, simply because they are online when required. Consequently, such contents must be properly protected by the DOSN infrastructure, in order to ensure that they can be really accessed only by users who have the permission of the publishers. As a consequence, DOSNs require efficient solutions for protecting the privacy of the contents published by each user with respect to the other users of the social network. In this paper, we investigate and compare the principal content privacy enforcement models adopted by current DOSNs evaluating their suitability to support different types of privacy policies based on user groups. Such evaluation is carried out by implementing several models and comparing their performance for the typical operations performed on groups, i.e., content publish, user join and leave. Further, we also highlight the limitations of current approaches and show future research directions. This contribution, other than being interesting on its own, provides a blueprint for researchers and practitioners interested in implementing DOSNs, and also highlights a few open research directions.

cs.SI↗
arXiv2022

Metaverse: Security and Privacy Issues

The metaverse promises a host of bright opportunities for business, economics, and society. Though, a number of critical aspects are still to be considered and the analysis of their impact is almost non-existent. In this paper, we provide several contributions. We start by analysing the foundations of the metaverse, later we focus on the novel privacy and security issues introduced by this new paradigm, and finally we broaden the scope of the contribution highlighting some of the far-reaching yet logical implications of the metaverse on a number of domains, not all of them in tech. Throughout the paper, we also discuss possible research directions. We believe that the provided holistic view on the foundations, technology, and issues related to the metaverse-with a focus on security and privacy-, other than being an interesting contribution on its own, could also pave the way for a few multidisciplinary research avenues.

cs.CR↗
arXiv2022

Serverless Computing: A Security Perspective

Serverless Computing is a virtualisation-related paradigm that promises to simplify application management and to solve the last challenges in the field: scale down and easy to use. The implied cost reduction, coupled with a simplified management of underlying applications, are expected to further push the adoption of virtualisation-based solutions, including cloud-computing or telco-cloud solutions. However, in this quest for efficiency, security is not ranked among the top priorities, also because of the (misleading) belief that current solutions developed for virtualised environments could be applied (as is) to this new paradigm. Unfortunately, this is not the case, due to the highlighted idiosyncratic features of serverless computing. In this paper, we review the current serverless architectures, abstract and categorise their founding principles, and provide an in depth analyse of them from the point of view of security, referring to principles and practices of the cybersecurity domain. In particular, we show the security shortcomings of the analysed serverless architectural paradigms, point to possible countermeasures, and highlight a few research directions.

cs.CR↗
arXiv2021

Road Traffic Poisoning of Navigation Apps: Threats and Countermeasures

Assisted-navigation applications have a relevant impact on our daily life. However, technological progress in virtualization technologies and Software-Defined Radios recently enabled new attack vectors, namely, road traffic poisoning. These attacks open up several dreadful scenarios, which are addressed in this contribution by identifying the associated challenges and proposing innovative countermeasures.

cs.CR↗
arXiv2021

A Novel Framework for the Analysis of Unknown Transactions in Bitcoin: Theory, Model, and Experimental Results

Bitcoin (BTC) is probably the most transparent payment network in the world, thanks to the full history of transactions available to the public. Though, Bitcoin is not a fully anonymous environment, rather a pseudonymous one, accounting for a number of attempts to beat its pseudonimity using clustering techniques. There is, however, a recurring assumption in all the cited deanonymization techniques: that each transaction output has an address attached to it. That assumption is false. An evidence is that, as of block height 591,872, there are several millions transactions with at least one output for which the Bitcoin Core client cannot infer an address. In this paper, we present a novel approach based on sound graph theory for identifying transaction inputs and outputs. Our solution implements two simple yet innovative features: it does not rely on BTC addresses and explores all the transactions stored in the blockchain. All the other existing solutions fail with respect to one or both of the cited features. In detail, we first introduce the concept of Unknown Transaction and provide a new framework to parse the Bitcoin blockchain by taking them into account. Then, we introduce a theoretical model to detect, study, and classify -- for the first time in the literature -- unknown transaction patterns in the user network. Further, in an extensive experimental campaign, we apply our model to the Bitcoin network to uncover hidden transaction patterns within the Bitcoin user network. Results are striking: we discovered more than 30,000 unknown transaction DAGs, with a few of them exhibiting a complex yet ordered topology and potentially connected to automated payment services. To the best of our knowledge, the proposed framework is the only one that enables a complete study of the unknown transaction patterns, hence enabling further research in the fields -- for which we provide some directions.

cs.CR↗
arXiv2021

SpreadMeNot: A Provably Secure and Privacy-Preserving Contact Tracing Protocol

A plethora of contact tracing apps have been developed and deployed in several countries around the world in the battle against Covid-19. However, people are rightfully concerned about the security and privacy risks of such applications. To this end, the contribution of this work is twofold. First, we present an in-depth analysis of the security and privacy characteristics of the most prominent contact tracing protocols, under both passive and active adversaries. The results of our study indicate that all protocols are vulnerable to a variety of attacks, mainly due to the deterministic nature of the underlying cryptographic protocols. Our second contribution is the design and implementation of SpreadMeNot, a novel contact tracing protocol that can defend against most passive and active attacks, thus providing strong (provable) security and privacy guarantees that are necessary for such a sensitive application. Our detailed analysis, both formal and experimental, shows that SpreadMeNot satisfies security, privacy, and performance requirements, hence being an ideal candidate for building a contact tracing solution that can be adopted by the majority of the general public, as well as to serve as an open-source reference for further developments in the field.

cs.CR↗
arXiv2021

IoTrace: A Flexible, Efficient, and Privacy-Preserving IoT-enabled Architecture for Contact Tracing

Contact tracing promises to help fight the spread of Covid-19 via an early detection of possible contagion events. To this end, most existing solutions share the following architecture: smartphones continuously broadcast random beacons that are intercepted by nearby devices and stored into their local contact logs. In this paper, we propose an IoT-enabled architecture for contact tracing that relaxes the smartphone-centric assumption, and provide a solution that enjoys the following features: (i) it reduces the overhead on the end-user to the bare minimum -- the mobile device only broadcasts its beacons; (ii) it provides the user with a degree of privacy not achieved by competing solutions -- even in the most privacy adverse scenario, the solution provides k-anonymity; and, (iii) it is flexible: the same architecture can be configured to support several models -- ranging from the fully decentralized to the fully centralized ones -- and the system parameters can be tuned to support the tracing of several social interaction models. We also highlight open issues and discuss a number of future research directions.

cs.NI↗