Identity Spoofing Research Articles

Cortical-striatal brain network distinguishes deepfake from real speaker identity

Deepfakes are viral ingredients of digital environments, and they can trick human cognition into misperceiving the fake as real. Here, we test the neurocognitive sensitivity of 25 participants to accept or reject person identities as recreated in audio deepfakes. We generate high-quality voice identity clones from natural speakers by using advanced deepfake technologies. During an identity matching task, participants show intermediate performance with deepfake voices, indicating levels of deception and resistance to deepfake identity spoofing. On the brain level, univariate and multivariate analyses consistently reveal a central cortico-striatal network that decoded the vocal acoustic pattern and deepfake-level (auditory cortex), as well as natural speaker identities (nucleus accumbens), which are valued for their social relevance. This network is embedded in a broader neural identity and object recognition network. Humans can thus be partly tricked by deepfakes, but the neurocognitive mechanisms identified during deepfake processing open windows for strengthening human resilience to fake information.

An approach to detect identity spoofing in AIS messages

Automatic identification system (AIS) is a maritime communication system that uses a transceiver to automatically exchange navigational data. These data help navigation and allow to monitor the maritime traffic. However, this system can be hacked and malicious users can easily transmit false data to mislead the coastguards or vessels navigating around. While previous research has proposed methods to detect these falsifications, none of them suggest strategies that detect AIS identity spoofing combining the tracking of the ship position and AIS transceiver’s carrier frequency offset (CFO). The CFO, caused by the carrier frequencies mismatch between emitter and receiver and Doppler effect, is used as a radiometric signature to identify materially every transceiver independently of its transmitted identity. It can drift over time and this is why it is tracked thanks to a Kalman filter (KF). In addition, position is also considered to reduce the miss probability of spoofing detection. The KF is noise adaptive to be robust against various CFO drifts and noise levels of the environment. The strategy is tested on real AIS data and the results demonstrate its efficacy: false alarm and miss probabilities were respectively 1% and 1.7%. These results show the ability of the test to correctly detect identity spoofing and the interest of CFO as a radiometric signature. This signature, used for the first time in an AIS application, could be used with other signatures in a future work to improve identity spoofing detection. This is why we made open source in GitHub our algorithm and the real AIS data used.

Spoofing Against Spoofing: Toward Caller ID Verification in Heterogeneous Telecommunication Systems

Caller ID spoofing is a global industry problem and often acts as a critical enabler for telephone fraud. To address this problem, the Federal Communications Commission has mandated telecom providers in the U.S. to implement STIR/SHAKEN, an industry-driven solution based on digital signatures. STIR/SHAKEN relies on a public key infrastructure (PKI) to manage digital certificates, but scaling up this PKI for the global telecom industry is extremely difficult, if not impossible. Furthermore, it only works with IP-based systems (e.g., SIP), leaving the traditional non-IP systems (e.g., SS7) unprotected. So far the alternatives to the STIR/SHAKEN have not been sufficiently studied. In this article, we propose a PKI-free solution, called Caller ID Verification (CIV). CIV authenticates the caller ID based on a challenge-response process instead of digital signatures, hence requiring no PKI. It supports both IP and non-IP systems. Perhaps counter-intuitively, we show that number spoofing can be leveraged, in conjunction with Dual-tone Multi-frequency, to efficiently implement the challenge-response process, i.e., using spoofing to fight against spoofing. We implement CIV for Voice over Internet Protocol, cellular, and landline phones across heterogeneous networks (SS7/SIP) by only updating the software on the user’s phone. This is the first caller ID authentication solution with working prototypes for all three types of telephone systems in the current telecom architecture. Finally, we show how the implementation of CIV can be optimized by integrating it into telecom clouds as a service, which users may subscribe to.

A Multi-Round Zero Knowledge Proof Algorithm for Secure IoT and Blockchain Environments

Presented herein is a novel algorithm for multi-round, zero-knowledge proof (ZKP), devised specifically for authenticating factorisation proofs within a variety of cryptographic applications. This advanced algorithm, while maintaining computational complexity within acceptable bounds, offers a secure and proficient solution. The functionality of the algorithm is marked by multiple rounds of interaction between the Prover and Verifier. Initially, the Prover generates a random value and calculates a commitment. Subsequently, the Verifier issues a random challenge, eliciting a computed response from the Prover. To validate the proof, the Verifier verifies the equality of the commitment and the computed response. Efficaciousness of the proposed multi-round ZKP algorithm is demonstrated across diverse input sizes and parameters. Results indicate a success rate exceeding 90% on average, showcasing the robustness of the method. The recurring interaction between the Verifier and Prover enhances the Prover's authentication, thereby improving the algorithm’s reliability. Implementation of the algorithm, achievable through standard cryptographic tools and protocols, can fortify the security of multiple cryptographic applications. A significant application can be found in Digital Identity Management Systems (DIMS). Currently, these systems are vulnerable to a myriad of threats, including identity spoofing, data breaches, and internal security risks. The application of the ZKP algorithm can simultaneously augment security and withhold sensitive information, potentially transforming the DIMS security landscape. Future research may focus on improving the efficiency and scalability of the multi-round ZKP algorithm. There also remains a vast potential for exploring additional applications of this technique within various cryptographic domains.

Continuous Entity Authentication in the Internet of Things Scenario

In the context of the Internet of Things (IoT), the proliferation of identity spoofing threats has led to the need for the constant entity verification of devices. Recently, a formal framework has been proposed to study resistance to impersonation attacks for One-Message Unilateral Entity Authentication (OM-UEA) schemes, in which the prover continuously authenticates itself through the use of a sequence of authentication messages. Given the limited computing power of the parties (particularly the prover) and the often limited bandwidth channel, in the IoT scenario it is desirable to design unilateral entity authentication schemes that require the use of a single message per session and light computations. In this paper, we first show that OM-UEA schemes can be implemented through digital signatures and that a weak form of unforgeability is sufficient to achieve security against active adversaries. We then apply the signature scheme proposed by Yang et al. in ASIACCS 2020 to our framework, resulting in an OM-UEA scheme that requires minimal computational effort and low storage requirements for the prover. Inspired by this last construction, we propose an OM-UEA scheme based on the hardness of the discrete logarithm problem, which further improves the computational performance for the prover. Our findings offer feasible options for implementing secure continuous entity authentication in IoT applications.

BBAP-WSN: A New Blockchain-Based Authentication Protocol for Wireless Sensor Networks

Wireless Sensor Networks—WSNs, an important part of IoT—consist of sensor nodes with limited processing, memory capacities, and energy. Wireless Sensor Networks face many dangers as they are often distributed into untrusted regions. The accuracy of the data obtained in a WSN, where security threats cannot be prevented, is also questioned. In WSNs, the authentication of the resources and the data can be verified with the authentication mechanism. Authentication in WSNs allows the node to verify whether data have been sent from authorized sources and protects the original data from changes. However, there are some deficiencies in terms of security in existing authentication protocols such as ID spoofing attacks. In addition, blockchain, one of the emerging technologies, gives significant successful results in security applications. Cryptographically secured, immutable, non-repudiable, irrevocable, auditable, and verifiable can be given as security-related characteristics of the blockchain. This study aims to use these features of the blockchain in WSNs. In this study, a new blockchain-based authentication protocol was developed for WSNs. Based on the study’s system model, sensor nodes, cluster nodes, base station, and blockchain networks were created using a private blockchain, and users. A detailed security analysis was carried out for the study. At the same time, efficiency analysis was performed by implementing the proposed model on the WiSeN sensor node.

Randomized Moving Target Approach for MAC-Layer Spoofing Detection and Prevention in IoT Systems

MAC-layer spoofing, also known as identity spoofing, is recognized as a serious problem in many practical wireless systems. IoT systems are particularly vulnerable to this type of attack as IoT devices (due to their various limitations) are often incapable of deploying advanced MAC-layer spoofing prevention and detection techniques, such as cryptographic authentication. Signal-level device fingerprinting is an approach to identity spoofing detection that is highly suitable for sensor-based IoT networks but can be also utilized in many other types of wireless systems. Previous research works on signal-level device fingerprinting have been based on rather simplistic assumptions about both the adversary’s behavior and the operation of the defense system. The goal of our work was to examine the effectiveness of a novel system that combines signal-level device fingerprinting with the principles of Randomized Moving Target Defense (RMTD) when dealing with a very advanced adversary. The obtained results show that our RMTD-enhanced signal-level device fingerprinting technique exhibits far superior defense performance over the non-RMTD techniques previously discussed in the literature and, as such, could be of great value for practical wireless systems subjected to identity spoofing attacks. We have also introduced a novel proof-of-concept adaptive parameter tuning approach for system practitioners with the ability to encode their risk profile and compute the most efficient hyper-parameters of our proposed defense system.

Toward Verifying the User of Motion-Controlled Robotic Arm Systems via the Robot Behavior

Motion-controlled robotic arms allow a user to interact with a remote real world without physically reaching it. By connecting cyberspace to the physical world, such interactive teleoperations are promising to improve remote education, virtual social interactions, and online participatory activities. In this work, we build up a motion-controlled robotic arm framework comprising a robotic arm end and a user end, which are connected via a network and responsible for manipulator control and motion capture, respectively. To protect the system access, we propose to verify who is controlling the robotic arm by examining the robotic arm’s behavior, which adds a second security layer in addition to the system login credentials. We show that a robotic arm’s motion inherits its human controller’s behavioral biometric in interactive control scenarios. By extracting the angle readings of the robotic arm’s all joints, the proposed user authentication approach reconstructs the robotic arm’s end-effector movement trajectory that follows the user’s hand. Furthermore, we derive the unique robotic motion features to capture the user’s behavioral biometric embedded in the robot motions and develop learning-based algorithms to verify the robotic arm user to be one of the enrolled users or a nonuser. Extensive experiments show that our system achieves 94% accuracy to distinguish users while preventing user identity spoofing attacks with 95% accuracy.

Estimation of the success probability of a malicious attacker on blockchain-based edge network

Modeling highly accurate cyber-attacks on blockchain-based edge networks may be almost impossible in real-world circumstances due to unanticipated adversary (malicious) behavior. In this study, we propose a novel, distributed blockchain-based security architecture that today’s industrial edge-enabled IoT systems may use to strengthen their defences against cyberattacks. We develop a probabilistic model to estimate the success probability of a malicious attacker on blockchain-based edge network by considering (i) hardware-level attack, (ii) network-level attack (IoT, Edge), (iii) software-level attack, wallet, smart contract, and (iv) blockchain network-level attack. We analyze the proposed attack model for sixteen different cyberattacks: False Data Injection, Sybil, DDoS, Identity Spoofing, Side-Channel, Botnet, Backdoor Trojan, Targeted Code Injection, Social Engineering, Phishing, Sinkhole, Man-in-the-middle, SQL Injection, Consensus, Eclipse, and Block Mining. Our model considers scenarios where private keys are stolen, lost, or forgotten by certain nodes. To determine the probability that a malicious attacker will be successful, we develop a simulation environment (a blockchain-based edge network with 200 total nodes, which generates 47,540 samples). We then estimate the success probability of a malicious attacker based on the blockchain resiliency (fault-tolerance) provided by the consensus algorithm, attack types, attack location, and the network size for various scenarios. Our results demonstrate that blockchain-based edge networks are more vulnerable to malicious attacks based on: (i) cyber-attack types (90.96% for Botnet and Backdoor Trojan attacks higher than for other attacks, such as DDoS, SQL Injection and Sybil); (ii) attack location (90.18% for software-level attacks higher than hardware, network, and blockchain network-level attacks); and (iii) consensus algorithm (68.85% for Byzantine fault tolerance, BFT, higher than the Proof-of-Work, PoW). The IoT network vulnerability factor, or exposure factor, of cyberattacks, depends on the strategic importance of the application to the attacker. Our results should be validated in real-world experiments with a large number of nodes.

Experimental Study of Location Spoofing and Identity Spoofing Attack in Internet of Things Network

IoT devices are placed at open places, generally at where monitoring and controlling of devices from remote location is difficult. Location spoofing is a threat in which an intruder intentionally modifies the contextual information such as geolocation of a device. Location spoofed device will pass faulty data to the base station, and because of that, serious problems such as traffic jam in smart city application, machine malfunctioning in industry application can take place. So decision making in IoT applications to determine correctness of contextual information is a prime concern for smooth functioning of networks. Identity spoofing is a threat in which an attacker captures the identity information of a legal device and can misuse this stolen information for performing various cyber threats such as MITM, key stolen, and replay. The authors have simulated these attacks in Cooja simulator and investigated the performance of the network in the presence of these attacks. The conclusion is that these attacks affect network performance in an adverse way.

PREVENTION OF TELEPHONE FRAUD (CRIMINOLOGICAL ASPECT)

The problems of committing fraud using telephone communication are updated. The relevance of issues related to the prevention of telephone fraud, first and foremost caller ID spoofing and phishing, is substantiated. The article analyzes the methods of preventing telephone fraud, such as the possibility of establishing the number of fraudsters through electronic search services, special free services, Viber and WhatsApp messengers, Sberbank Online, caller ID for incoming calls on "Avito" and "Yula", through applications for iPhone and Android, caller ID from "Kaspersky Lab" – Kaspersky Who Calls, through the Internet search engine "Yandex" and other applications. It is recommended to use the methods of victimologic counter-strategy in relation to telephone fakers, such as psychological self-defense, criticality (prudence) in their own actions (mainly those of a financial nature), safe behavior in a non-standard situation, a critical level of trust, awareness of possible risks. It is necessary to take precautions not to become a victim of telephone fraud, not to lose self-control and vigilance, to use all opportunities to check the source of telephone fraud, to report such cases to law enforcement agencies. Personal interest in maintaining personal security, the desire for self-defense and timely informing law enforcement agencies will become an obstacle to the spread of telephone fraud.

Electromagnetic Fingerprinting of Memory Heartbeats

This paper presents MemScope, a system that fingerprints devices via electromagnetic sensing of their memory heartbeats, i.e., the clock signal that synchronizes memory and memory controller. MemScope leverages the enhanced resolution and security of memory heartbeat fingerprint, which has enriched spectral features thanks to the spread spectrum generation of memory clock, and cannot be concealed as long as the device accesses its memory during computing. MemScope employs signal processing algorithms that allow it to hear the memory heartbeats of devices from a distance, in the presence of noise, and in crowded environments where multiple devices coexist. It then fingerprints memory heartbeats using machine learning tools. Measurements on a set of 65 devices over a month validate the robustness of fingerprint against time variation, and show a high precision and recall. We then use the neural network to build a detector to defend against possible replay attacks. Finally, we further demonstrate the effectiveness of MemScope in two application scenarios, (i) detecting wireless identity spoofing and (ii) identifying and localizing unauthorized hidden cameras.

Lattice‐based batch authentication scheme with dynamic identity revocation in VANET

Aggregate signatures allow someone to aggregate multiple signatures into one signature, which is suitable for resource-constrained and computationally inefficient environments. Identify-based aggregate signature can solve the storage problem of public key certificates while achieving efficient signature verification. However, in most of the identity-based aggregate signature schemes, the user identity revocation process is time-consuming and cannot resist quantum attacks. To solve above problems, this paper proposes a lattice-based aggregate signature scheme with dynamic identity revocation by combining lattice-based cryptography and an aggregate signature scheme. The security of the proposed lattice-based aggregate signature scheme with dynamic identity revocation has been proved in the random oracle model. In addition, the verification efficiency of the aggregate signature has been improved compared with multiple different signatures. Much of the data transfer in Vehicular Ad Hoc Network (VANET) is carried out wirelessly, which makes VANET vulnerable to identity spoofing attacks. Identity authentication technology can prevent attackers from impersonating legitimate users, thus ensuring the security of VANET. Based on the proposed lattice-based aggregate signature scheme with dynamic identity revocation, this paper proposes a lattice-based batch authentication scheme with dynamic identity revocation in VANET. Through the proposed batch authentication scheme, we can effectively resist the impersonation attack of VANET in the quantum computer environment, and the efficiency of authentication is improved.

Radio Frequency Fingerprint-Based DSRC Intelligent Vehicle Networking Identification Mechanism in High Mobility Environment

In recent years, Dedicated Short-Range Communication (DSRC) vehicle interconnection technology has achieved mature development and broad applications, which is the key Vehicle to Everything (V2X) technology to realize transport intelligence. However, the openness of wireless transmission and the mobility of wireless terminals cause the identification mechanism of the DSRC system to face serious security threats. A radio frequency fingerprint (RFF)-based identification method can better resist the identity attack and spoofing by extracting the hardware characteristics formed by the differences of electronic components to authenticate different devices. Therefore, in this paper a novel RFF identification mechanism is proposed for IEEE 802.11p protocol-based DSRC intelligent vehicle networking devices suitable for a high mobility environment, in which the preamble field features of physical layer frames are extracted as device fingerprints, and the random forest algorithm and sequential detection method are used to distinguish and authenticate different devices. The experiment and simulation results demonstrate that the identification accuracy rates of the eight DSRC modules in the low-speed LOS and NLOS experimental states and up to 70 km/h high-speed simulations all exceed 99%, illustrating that this method has important application value in the field of identity authentication of V2X devices in high-speed scenarios.

Reduction of secondary lobes in joint angle and delay estimation in angle of arrival localization to detect MAC address spoofing in wireless networks

in this paper, we solve the problem of secondary lobes that are due to noise that comes from constructive and destructive multipath interference that are resulted in received signal strength (RSS) variation over time. This is to develop a very efficient localization algorithm that uses a unique fingerprint angle of arrivals (AOAs), in a specified range, with associated time delays (TDs), in the surrounded sparsity design promoting multipath parameter (i.e:RSS). We solve this problem to detect physical identity spoofing of nodes in radio wireless networks, and localize adversaries and jammers of wireless networks. All radio waves are vulnerable to many types of attacks due to the ability to capture them and sniff or eavesdropping on them in the open space. Physical identity spoofing is used to launch many types of attacks against wireless networks like Denial of Service (DOS), Man-In-The-Middle and Session Hijacking and eavesdropping. Eavesdropping is a human-based social engineering attack. Active adversaries are able to jam and eavesdrop simultaneously, while passive adversaries can only eavesdrop on passed signals. In TCP/IP protocol for example, Media Access Card (MAC) Address is transferred in 802.11 frames. Detection process was carried out by analyzing electromagnetic radio waves that are used to transfer data, in the form of radio wave signals that are formed by the modulation process which mixes the electromagnetic wave, with another one of different frequency or amplitude to produce the signal with a specified pattern of frequency and amplitude. We depended on the angle of arrival of vectors and time delay across scattered areas in the surrounded space to solve the problem of co-location in detection and localization of jammers. We used Maximum Likelihood (ML) angle of arrival determination because ML approaches, known to their higher accuracy and enhanced resolution capabilities. And we assessed their computational complexity that was considered as the major drawback for designers to their implementation in practice. Our solution was tested on a jammer that changed the signal strength of received signal at the receiver at an angle of arrival 30 degree. And we used scatterers density to determine the angle of arrival of the sender. The simulation has observed that the power of the received signal has changed from the range of angles 20 to 40 degrees. We used scatterers because they describe the density of the signal power, and also enhance the signal to noise ratio, that resulted from the multipath fading of the signal strength. And also overcoming the problem of secondary lobes that are due to signal propagation, while determining the angle of arrival of a signal sender. So, we developed a new passive technique to detect MAC address spoofing based on angle of arrival localization. And assessed the computation complexity of the localization technique through depending on a range angle to estimate the angle of arrival of the adversary within it. And we reduced number of secondary lobes, and their peaks, in the importance function, while determining the angle of arrival, and so increasing the accuracy of angle of arrival measurement. We compared our work to other techniques and find that our technique is better than these techniques.

A Novel Framework for Open-Set Authentication of Internet of Things Using Limited Devices.

The Internet of Things (IoT) is promising to transform a wide range of fields. However, the open nature of IoT makes it exposed to cybersecurity threats, among which identity spoofing is a typical example. Physical layer authentication, which identifies IoT devices based on the physical layer characteristics of signals, serves as an effective way to counteract identity spoofing. In this paper, we propose a deep learning-based framework for the open-set authentication of IoT devices. Specifically, additive angular margin softmax (AAMSoftmax) was utilized to enhance the discriminability of learned features and a modified OpenMAX classifier was employed to adaptively identify authorized devices and distinguish unauthorized ones. The experimental results for both simulated data and real ADS–B (Automatic Dependent Surveillance–Broadcast) data indicate that our framework achieved superior performance compared to current approaches, especially when the number of devices used for training is limited.

IoT Nodes Authentication and ID Spoofing Detection Based on Joint Use of Physical Layer Security and Machine Learning

The wide variety of services and applications that shall be supported by future wireless systems will lead to a high amount of sensitive data exchanged via radio, thus introducing a significant challenge for security. Moreover, in new networking paradigms, such as the Internet of Things, traditional methods of security may be difficult to implement due to the radical change of requirements and constraints. In such contexts, physical layer security is a promising additional means to realize communication security with low complexity. In particular, this paper focuses on node authentication and spoofing detection in an actual wireless sensor network (WSN), where multiple nodes communicate with a sink node. Nodes are in fixed positions, but the communication channels varies due to the scatterers’ movement. In the proposed security framework, the sink node is able to perform a continuous authentication of nodes during communication based on wireless fingerprinting. In particular, a machine learning approach is used for authorized nodes classification by means of the identification of specific attributes of their wireless channel. Then classification results are compared with the node ID in order to detect if the message has been generated by a node other than its claimed source. Finally, in order to increase the spoofing detection performance in small networks, the use of low-complexity sentinel nodes is proposed here. Results show the good performance of the proposed method that is suitable for actual implementation in a WSN.

Amenințări la adresa libertății presei: intimidarea, hărțuirea și agresarea jurnaliștilor

All over the world investigative journalism involves tremendous risks. Attacks and aggressions aimed to intimidate, humiliate, or discrediting journalists and even to undermine the credibility of the media are a growing phenomenon in the digital world. Threats to the freedom of press include various types of intimidation, harassment, or attacks, while women journalists often face gender-specific forms of violence. In this study we investigate the most common forms of intimidation and pressure that journalists face in Romania: attacks from the politicians, intimidation through lawsuits, aggressive reactions from the public, various types of digital harassment including hacking, doxing and identity spoofing, online sexual attacks against women, physical violence. Any form of aggression, besides the direct effects on victims, represents threat to the freedom of the press, and must be publicly denounce.

Towards Standardized Prevention of Unsolicited Communications and Phishing Attacks

The world of communication technology is changing fast and the means of communication are moving towards a packet switched transmission systems such as Voice over IP (VoIP). Formerly call identity spoofing of the displayed number in circuit switched (CS) networks was too difficult to perform so that people could be sure that when receiving a call on their mobile phone or at home, the displayed number is the one as it is supposed to be. Nowadays this is not the case anymore, voice communication from the internet with VoIP is cheap and spam calls can be easily realized without any costs, also it is getting easier to perform spoofed calls with wrong display name or number.
 The mobile network operators have no mechanisms to tackle those threats, but standardization activities are already in place within the security group SA3 of 3GPP. This paper provides an overview of the current status of the standards activities and shows the most promising solutions that are proposed up to now. The proposed solutions detect unsolicited communications and spoofed calls by tracing back to the displayed number used in the attack.

Zero-Bias Deep Learning for Accurate Identification of Internet-of-Things (IoT) Devices

The Internet of Things (IoT) provides applications and services that would otherwise not be possible. However, the open nature of IoT make it vulnerable to cybersecurity threats. Especially, identity spoofing attacks, where an adversary passively listens to existing radio communications and then mimic the identity of legitimate devices to conduct malicious activities. Existing solutions employ cryptographic signatures to verify the trustworthiness of received information. In prevalent IoT, secret keys for cryptography can potentially be disclosed and disable the verification mechanism. Non-cryptographic device verification is needed to ensure trustworthy IoT. In this paper, we propose an enhanced deep learning framework for IoT device identification using physical layer signals. Specifically, we enable our framework to report unseen IoT devices and introduce the zero-bias layer to deep neural networks to increase robustness and interpretability. We have evaluated the effectiveness of the proposed framework using real data from ADS-B (Automatic Dependent Surveillance-Broadcast), an application of IoT in aviation. The proposed framework has the potential to be applied to accurate identification of IoT devices in a variety of IoT applications and services. Codes and data are available in IEEE Dataport.