Location Spoofing Attacks Research Articles

Deep Learning-Based Location Spoofing Attack Detection and Time-of-Arrival Estimation through Power Received in IoT Networks

In the context of the Internet of Things (IoT), location-based applications have introduced new challenges in terms of location spoofing. With an open and shared wireless medium, a malicious spoofer can impersonate active devices, gain access to the wireless channel, as well as emit or inject signals to mislead IoT nodes and compromise the detection of their location. To address the threat posed by malicious location spoofing attacks, we develop a neural network-based model with single access point (AP) detection capability. In this study, we propose a method for spoofing signal detection and localization by leveraging a feature extraction technique based on a single AP. A neural network model is used to detect the presence of a spoofed unmanned aerial vehicle (UAV) and estimate its time of arrival (ToA). We also introduce a centralized approach to data collection and localization. To evaluate the effectiveness of detection and ToA prediction, multi-layer perceptron (MLP) and long short-term memory (LSTM) neural network models are compared.

Reliable Detection of Location Spoofing and Variation Attacks

Location spoofing is a critical attack in mobile communications. While several previous studies investigated the detection of location spoofing attacks, they are limited in their performance and lack the consideration of emerging attack variations. In this paper, we present a data-driven methodology for the reliable detection of location spoofing and its variations. To enhance the performance, we introduce and utilize a new set of features, which is differential in nature and enables the checking of the mobility constraints and inconsistency. Our comparison study with the previous research shows that the presented scheme using the new features significantly improves the accuracy and reliability of the detection against location spoofing attacks. To take the possibility of attack variations into account, we establish a set of scenarios manipulating coordinate data to create attack variants. Our experimental results confirm the feasibility and effectiveness of the new features for identifying diverse types of spoofing attacks and their variations, greatly improving the detection performance by up to 99.1% accuracy. Additionally, we present a profiling-based detection approach (building the detector referring only to legitimate coordinate data), to further extend resilience to previously unseen attacks as a means to zero-day detection. The evaluation result shows the potential of the profiling-based detector with comparable or even better performance than the supervised learning methods (requiring both legitimate and falsified data to construct the detector).

Exploiting Correlation Among GPS Signals to Detect GPS Spoofing in Power Grids

Global positioning systems (GPS) are the major source to provide time synchronization information for phasor measurement units (PMUs) used in modern wide-area measurement systems (WAMS). GPS signals are typically sent from satellites thousands of kilometers away in space without any encryption. A cybercriminal may capture these signals to carry out GPS spoofing attacks on WAMS by maliciously desynchronizing the PMUs. Although modern power grids rely on accurate time synchronization, most of the existing works on GPS spoofing focus on location spoofing attacks. To solve this issue, we propose a light-weight GPS time spoofing detection technique based on the autocorrelation among consecutive GPS signals. The statistical runs test is used to generate training data for the classifier. The power spectral density values of multiple received GPS signals are combined to form a window. Then the runs test is used to obtain a p-value to quantify the correlation between the present and previous window. These p-values are used with supervised learning techniques to classify GPS signals as spoofed or safe. Using an experimental setup with actual GPS equipment, data are generated to train and test the proposed technique. The results show that the proposed technique can effectively detect GPS time spoofing attacks with a probability of detection above 95% while maintaining negligible probability of false alarm and probability of missed detection.

ReliableBox: Secure and Verifiable Cloud Storage With Location-Aware Backup

While the prevalent cloud storage platforms are offering convenient services in support of diverse data-driven applications for clients, various security concerns raise in terms of data confidentiality, availability, and retrievability. Among them, servers' dishonesty on the location-specific data backup becomes a serious concern when the data stands out clients' control, considering the strict regulations imposed by many governments and organizations on data storage location. This article studies location-aware data backup verification for the data stored in clouds and aims to design a secure framework, named as ReliableBox, enabling the clients to verify if their data have been backed up on the remote servers with specific geolocation. In the design of ReliableBox, we leverage the prominent proof-of-storage techniques for data possession proof, and take advantage of multilateration geolocation and Intel SGX for the precise communication delay measurement and trust computing delay measurement, respectively. In ReliableBox, a client first computes integrity tags for the files and then outsources both the files and tags to the cloud storage server. In the later attestation, with the precise network delay and distance measurement from location-known verifiers, the client verifies that the outsourced files are intact and backed-up to hosts at the specific geolocation. With the customized design, ReliableBox can support the security needs in terms of both data integrity and backup location verification for clients, even when there exists potential dishonest cloud service providers who may manipulate the network delays or forge verification proofs. We provide security analysis to show the security property of ReliableBox in terms of data access, confidentiality, and verifications. In the end, we implement the system prototype and deploy it into several prevalent and commercial cloud platforms for performance evaluation. The experimental results demonstrate that ReliableBox is secure in support of data integrity checking and location-aware backup auditing, while it is robust to the data possession and location spoofing attacks.

Wasserstein Metric-Based Location Spoofing Attack Detection in WiFi Positioning Systems

WiFi positioning systems (WPS) have been introduced as parts of 5G location services (LCS) to provide fast positioning results of user devices in urban areas. However, they are prominently threatened by location spoofing attacks. To end this, we present a Wasserstein metric-based attack detection scheme to counter the location spoofing attacks in the WPS. The Wasserstein metric is used to measure the similarity of each two hotspots by their signal’s frequency offset distribution features. Then, we apply the clustering method to find the fake hotspots which are generated by the same device. When applied with WPS, the proposed method can prevent location spoofing by filtering out the fake hotspots set by attackers. We set up experimental tests by commercial WiFi devices, which show that our method can detect fake devices with 99% accuracy. Finally, the real-world test shows our method can effectively secure the positioning results against location spoofing attacks.

Quantum-Resistant Cryptography for the Internet of Things Based on Location-Based Lattices

An important enabler of the Internet of Things (IoT) is the Narrow-Band Internet of Things (NB-IoT) technology, which is a 3GPP standards compliant connectivity solution. Quantum computing, another emerging technological paradigm, promises novel compute opportunities but is also able to compromise cybersecurity ciphers. Therefore, improved methods to mitigate such security threats are needed. In this research, we propose a location-aware cryptographic system that guarantees post-quantum IoT security. The ultimate value of a location-driven cryptosystem is to use the geographic location as a player’s identity and credential. Position-driven cryptography using lattices is efficient and lightweight, and it can be used to protect sensitive and confidential data in many critical situations that rely heavily on exchanging confidential data. At the best of our knowledge, this research starts the study of unconditional-quantum-resistant-location-driven cryptography by using the Lattice problem for the IoT in a pre-and post-quantum world. Unlike existing schemes, the proposed cryptosystem is the first secure and unrestricted position-based protocol that guards against any number of collusion attackers and against quantum attacks. It has a guaranteed authentication process, solves the problems of distributing public keys by removing a public key infrastructure (PKI), offers secure NB-IoT without SIM cards, and resists location spoofing attacks. Furthermore, it can be generalized to any network – not just NB-IoT.

Realization and countermeasures for current location spoofing attacks

Recently, many retailers have rapidly increased cashless services. Customer guidance technology by providing advertisements and premiums linked with location information is drawing attention in cashless services using smartphones. While such technology is highly convenient, incidents such as the exploitation of premium points by disguising location information have occurred. It has become a major issue that shakes the reliability of cashless services and, in turn, affects the trust of the advanced information society that involves future financial services. In particular, the point acquisition service by visiting retail stores using smartphones has emerged as a real problem, with reports of cases of exploiting points by falsifying the location information of users who hold smartphones. This research will confirm the current location information spoofing attack method using smartphones for specific services and propose countermeasures.

Detection of Spoofing Attacks in WLAN-Based Positioning Systems Using WiFi Hotspot Tags

WLAN-based localization is widely adopted for mobile positioning, which is the prerequisite for location based services and more. However, the existing positioning systems are vulnerable to location spoofing attacks, which may bring major privacy concerns to mobile social network service (MSNS). In this paper, we first show a privacy attack model base on spoofing attack in MSNS, and then propose a novel defense mechanism based on WiFi-hotspot tags (i.e. base-station tags, BS tags). Specially, we utilize the unpredictability and reproducibility of BS tags to authenticate the spatial-temporal property of a geolocation. Furthermore, we introduce the bloom filter to compress parts of real-time hotspots frames, while guaranteeing its high entropy. Also, we design a tag verification algorithm based on the fuzzy extractors, which can well adapt to the high-bit error rates of wireless transmission. Finally, the safety and feasibility of the mechanism are proved by theoretical and experimental analysis.

Physical layer authentication under intelligent spoofing in wireless sensor networks

Location based access in wireless sensor networks (WSN) are vulnerable to location spoofing attacks. In this paper, we investigate the physical layer (PHY-layer) authentication in the threat of an intelligent location spoofing attack. The intelligent attack can emulate the legitimate channel information and maximize its long-term cumulative reward. First, we analyze the feasibility of this intelligent attack and investigate how it threats to the networks. Specifically, we derive the optimal transmit power allocation and find the worst case for the defenders, namely optimal intelligent attack, in which the attacker can learn the intelligent attack action based on the beamforming with optimal transmit power allocation. To defend against such an intelligent attack with high accuracy and low overhead, we develop a cooperative PHY-layer authentication scheme. Then, we provide an in-depth analysis on the belief and derive the belief bounds and the closed-form expression for the belief threshold. Furthermore, considering the whole computation complexity and the double counting problem in a loopy graph, we propose the cooperative neighbour selection algorithm to accelerate belief convergence and reduce the overhead. Finally, the simulation results reveal that the proposed method can significantly improve the defense performance compared with the state-of-art methods.

Enhanced Authentication Based on Angle of Signal Arrivals

In the scope of vehicular communication networks, the nature of exchanged safety/warning messages renders itself highly location dependent, as it is usually for incident reporting. Vehicles are required to periodically exchange beacon messages that include speed, time, and GPS location information. Reported position information must be accurate and authentic. To mitigate the potential risk of location spoofing/falsifying attack, this paper presents Angle-of-Arrival (AoA) estimation as a physical layer authentication scheme for cross verification of the reported location information. We consider a multi-antenna road side unit under location spoofing attack. Within the considered vehicular communication settings, fundamental limits of AoA estimation are developed in terms of its Cramer–Rao Bound and existence of efficient estimator. The problem of deciding whether the received signal originated from the claimed GPS location is formulated as a two-sided hypotheses testing problem whose solution is given by Wald test statics . We give correct decision $P_D$ and false alarm $P_F$ probabilities in a closed form. To offset the gap between information theoretical studies and practical implementations of physical layer security architectures, theoretical results presented in this paper are further supported by detailed hardware implantation using software-defined radios and field experimental results. We show that the keystone for obtaining reliable AoA measurements is the accurate characterization of the array response vector. Our hardware measurements showed that, unlike idealized models, hardware imperfections leave the actual array response vector of non-structured form. To address this problem, we introduce the method for obtaining the actual array response vector empirically, which led to accurate and stable AoA measurements. Field experimental results shows the feasibility of the proposed AoA authentication scheme.

A Secure Authentication Protocol for Internet of Vehicles

An Internet of Vehicles (IoV) allows forming a self-organized network and broadcasting messages for the vehicles on roads. However, as the data are transmitted in an insecure network, it is essential to use an authentication mechanism to protect the privacy of vehicle users. Recently, Ying et al. proposed an authentication protocol for IoV and claimed that the protocol could resist various attacks. Unfortunately, we discovered that their protocol suffered from an offline identity guessing attack, location spoofing attack, and replay attack, and consumed a considerable amount of time for authentication. To resolve these shortcomings, we propose an improved protocol. In addition, we provide a formal proof to the proposed protocol to demonstrate that our protocol is indeed secure. Compared with previous methods, the proposed protocol performs better in terms of security and performance.

ADS-B is Vulnerable to location Spoofing Attacks and Countermeasures

ADS-B is Vulnerable to location Spoofing Attacks and Countermeasures

Exploiting Proximity-Based Mobile Apps for Large-Scale Location Privacy Probing

Proximity-based apps have been changing the way people interact with each other in the physical world. To help people extend their social networks, proximity-based nearby-stranger (NS) apps that encourage people to make friends with nearby strangers have gained popularity recently. As another typical type of proximity-based apps, some ridesharing (RS) apps allowing drivers to search nearby passengers and get their ridesharing requests also become popular due to their contribution to economy and emission reduction. In this paper, we concentrate on the location privacy of proximity-based mobile apps. By analyzing the communication mechanism, we find that many apps of this type are vulnerable to large-scale location spoofing attack (LLSA). We accordingly propose three approaches to performing LLSA. To evaluate the threat of LLSA posed to proximity-based mobile apps, we perform real-world case studies against an NS app named Weibo and an RS app called Didi. The results show that our approaches can effectively and automatically collect a huge volume of users’ locations or travel records, thereby demonstrating the severity of LLSA. We apply the LLSA approaches against nine popular proximity-based apps with millions of installations to evaluate the defense strength. We finally suggest possible countermeasures for the proposed attacks.

Wrong Siren! A Location Spoofing Attack on Indoor Positioning Systems: The Starbucks Case Study

The Internet of Things interconnects a mass of billions devices, from smartphones to cars, to provide convenient services to people. This gives immediate access to various data about the objects and the environmental context -- leading to smart services and increased efficiency. A number of retail stores have started to adopt IoT enabled services to attract customers. In particular, thanks to indoor proximity technologies, it is possible to introduce location-based smart services to customers, for example, transmitting identifiable signals that represent the locations of stores. In this article, we investigate a potential security risk involved in such technologies: physical signals used as identifiers can be captured and forged easily with today's widely available IoT software for implementing location spoofing attacks. We highlight this security risk by providing a case study: an in-depth security analysis of the recently launched Starbucks service called Siren Order.

Geo-Spatial Location Spoofing Detection for Internet of Things

We develop a new location spoofing detection algorithm for geo-spatial tagging and location-based services in the Internet of Things (IoT), called Enhanced Location Spoofing Detection using Audibility (ELSA) which can be implemented at the backend server without modifying existing legacy IoT systems. ELSA is based on a statistical decision theory framework and uses two-way time-of-arrival (TW-TOA) information between the user's device and the anchors. In addition to the TW-TOA information, ELSA exploits the implicit available audibility information to improve detection rates of location spoofing attacks. Given TW-TOA and audibility information, we derive the decision rule for the verification of the device's location, based on the generalized likelihood ratio test. We develop a practical threat model for delay measurements spoofing scenarios, and investigate in detail the performance of ELSA in terms of detection and false alarm rates. Our extensive simulation results on both synthetic and real-world datasets demonstrate the superior performance of ELSA compared to conventional non-audibility-aware approaches.

Privacy-Preserving Location Proof for Securing Large-Scale Database-Driven Cognitive Radio Networks

The latest Federal Communications Commission (FCC) ruling has enforced database-driven cognitive radio networks (CRNs), in which all secondary users (SUs) can query a database to obtain spectrum availability information (SAI). Database-driven CRNs are regarded as a promising approach for dynamic and highly efficient spectrum management paradigm for large-scale Internet of Things (IoT). However, as a typical location-based service (LBS), before providing services to the user, there is no verification of the queried location, which is very vulnerable to location spoofing attack. A malicious user can report a fake location to the database and access the channels that may not be available for its location. This will introduce serious interference to the primary users (PUs). In this study, we identify a new kind of attack coined as location cheating attack, which allows an attacker to spoof other users to another location and make them query the database with wrong location, or allows a malicious user to forge location arbitrarily and query the database for services. To thwart this attack, we propose a novel infrastructure-based approach that relies on the existing WiFi or cellular network access points (or AP) to provide privacy-preserving location proof. With the proposed solution, the database can verify the locations without knowing the user’s accurate location. We perform comprehensive experiments to evaluate the performance of the proposed approach. Experimental results show that our approach, besides providing location proofs effectively, can significantly improve the user’s location privacy.

SGOR: Secure and scalable geographic opportunistic routing with received signal strength in WSNs

Wireless sensor networks (WSNs) are inherently susceptible to attacks as malicious nodes can disrupt the communication from any other node to the sink. To address a wide range of attacks, we propose a novel and comprehensive approach called Secure and Scalable Geographic Opportunistic Routing with received signal strength (SGOR), satisfying the requirements of both security and scalability in WSNs. Unlike most of previous secure protocols relying on infrastructure like anchor nodes, a distributed location verification algorithm is presented to utilize the received signal strength to address the location spoofing attack. As one of opportunistic geographic routings, SGOR provides the property of robustness by taking full advantage of the broadcast nature of wireless channels, and scalability for being inherited from geographic routing. Moreover, an ambient-sensitive trust model is proposed to defend against more kinds of attackers in SGOR. The theoretical results are given to demonstrate the effectiveness and robustness of SGOR to survive more severe attacks. In extensive simulations, we compare SGOR with four other representative protocols. The results show that SGOR achieves about two times higher packet delivery rate with acceptable overhead, particularly in large and highly hostile networks.

Characterization and detection of location spoofing attacks

With the proliferation of diverse wireless devices, there is an increasing concern about the security of location information which can be spoofed or disrupted by adversaries. This paper investigates the characterization and detection of location spoofing attacks, specifically those which are attempting to falsify (degrade) the position estimate through signal strength based attacks. Since the physical-layer approach identifies and assesses the security risk of position information based solely on using received signal strength (RSS), it is applicable to nearly any practical wireless network. In this paper, we characterize the impact of signal strength and beamforming attacks on range estimates and the resulting position estimate. It is shown that such attacks can be characterized by a scaling factor that biases the individual range estimators either uniformly or selectively. We then identify the more severe types of attacks, and develop an attack detection approach which does not rely on a priori knowledge (either statistical or environmental). The resulting approach, which exploits the dissimilar behavior of two RSS-based estimators when under attack, is shown to be effective at detecting both types of attacks with the detection rate increasing with the severity of the induced location error.

A Two-Step Secure Localization for Wireless Sensor Networks

Accuratelylocatingunknownnodesisacriticalissueinthestudyofwirelesssensornetworks(WSNs). Many localization approaches have been proposed based on anchor nodes, which are assumed to know their locations by manual placement or additional equipments such as global positioning system. However, none of these approaches can work properly under the adversarial scenario. In this paper, we propose a novel scheme called two-step secure localization (TSSL) stand against many typical malicious attacks, e.g. wormhole attack and location spoofing attack. TSSL detects malicious nodes step by step. First, anchor nodes collaborate with each other to identify suspicious nodes by checkingtheircoordinates,identitiesandtimeofsendinginformation.Then,byusingamodifiedmesh generationscheme,maliciousnodesareisolatedandtheWSNisdividedintoareaswithdifferenttrust grades. Finally, a novel localization algorithm based on the arrival time difference of localization information is adopted to calculate locations of unknown nodes. Simulation results show that the TSSL detects malicious nodes effectively and the localization algorithm accomplishes localization with high localization accuracy.