Spoofing Attack Detection in the Physical Layer with Commutative Neural Networks

Daniel Romero,Peter Gerstoft,Hadi Givehchian,Dinesh Bharadia
DOI: https://doi.org/10.48550/arXiv.2211.04269
2022-11-08
Abstract:In a spoofing attack, an attacker impersonates a legitimate user to access or tamper with data intended for or produced by the legitimate user. In wireless communication systems, these attacks may be detected by relying on features of the channel and transmitter radios. In this context, a popular approach is to exploit the dependence of the received signal strength (RSS) at multiple receivers or access points with respect to the spatial location of the transmitter. Existing schemes rely on long-term estimates, which makes it difficult to distinguish spoofing from movement of a legitimate user. This limitation is here addressed by means of a deep neural network that implicitly learns the distribution of pairs of short-term RSS vector estimates. The adopted network architecture imposes the invariance to permutations of the input (commutativity) that the decision problem exhibits. The merits of the proposed algorithm are corroborated on a data set that we collected.
Machine Learning,Cryptography and Security,Networking and Internet Architecture
What problem does this paper attempt to address?
The problem that this paper attempts to solve is to detect spoofing attacks at the physical layer, that is, the problem of attackers impersonating legitimate users to access or tamper with data. Specifically, the paper focuses on how to distinguish spoofing attacks from the movement of legitimate users in wireless communication systems. ### Problem Background In wireless communication systems, spoofing attacks are a serious problem because they allow attackers to impersonate legitimate users to access or modify data. Existing detection methods usually rely on features such as Received Signal Strength (RSS) and distinguish different transmission locations through long - term estimation. However, these methods are difficult to distinguish spoofing attacks from the movement of legitimate users because they require long - term averaging, thus reducing the time resolution. ### Core Problems of the Paper The paper aims to develop a method based on Deep Neural Network (DNN) to distinguish spoofing attacks from the movement of legitimate users by using short - term RSS estimation. Specifically, the paper solves the following problems: 1. **Improve Time Resolution**: Existing methods rely on long - term estimation, which makes them difficult to distinguish spoofing attacks from the movement of legitimate users. The paper proposes a new method that can perform accurate RSS estimation in a short time (that is, using a small number of samples). 2. **Deal with Input Symmetry**: Since the decision - making problem has symmetry (that is, regardless of the order of the two RSS vectors, the result should be the same), the paper designs a neural network architecture with exchange invariance. 3. **Reduce Sensitivity to Environmental Changes**: Existing methods may fail due to environmental changes (such as temperature changes). The method proposed in the paper does not depend on specific communication protocols, so it is more general and robust. ### Solutions The paper proposes a spoofing - attack - detection algorithm based on Commutative Neural Network. This algorithm is implemented through the following steps: 1. **Data Collection**: Record a small number of samples corresponding to RSS estimates at different transmitter locations. 2. **Network Architecture Design**: Design a DNN with exchange invariance to ensure input symmetry. 3. **Training Process**: Use a real - data set to train the DNN and minimize the probability of classification errors. 4. **Performance Evaluation**: Verify the performance of this method under different numbers of training samples and features through experiments. ### Experimental Results The experimental results show that the proposed DNN - based classifier (DNNC) can achieve high accuracy with only a small number of training locations, and its performance is better than other benchmark methods. In addition, DNNC can handle short - term RSS estimation well, providing high time resolution, thus effectively distinguishing spoofing attacks from the movement of legitimate users. ### Summary The paper proposes an innovative DNN - based spoofing - attack - detection method that can accurately distinguish spoofing attacks from the movement of legitimate users in a short time, providing a new solution for the security of wireless communication systems.