Spoofing Attacks Research Articles

Manipulating the Posterior Support of a Discrete Bayesian Estimator Under Full Sensor Control

The asymptotic implausibility problem is introduced from the perspective of an adversary that seeks to drive the belief of a recursive Bayesian estimator away from a particular set of parameter values. It is assumed that the adversary controls all sensors informing the estimator, and can transmit false measurements stochastically according to a fixed distribution of its choice. First, we outline a method for verifying whether a given distribution solves the problem. We then consider the class of spoofing attacks, and show that the asymptotic implausibility problem has a solution if and only if it can be solved by a spoofing attack. Attention is restricted to finite parameter and observation spaces.

Enforcing a Source-end Cooperative Multilevel Defense Mechanism to Counter Flooding Attack

The exponential advancement in telecommunication embeds the Internet in every aspect of communication. Interconnections of networks all over the world impose monumental risks on the Internet. A Flooding Attack (FA) is one of the major intimidating risks on the Internet where legitimate users are prevented from accessing network services. Irrespective of the protective measures incorporated in the communication infrastructure, FA still persists due to the lack of global cooperation. Most of the existing mitigation is set up either at the traffic starting point or at the traffic ending point. Providing mitigation at one or the other end may not be a complete solution. To insist on better protection against flooding attacks, this work proposes a cooperative multilevel defense mechanism. The proposed cooperative multilevel defense mechanism consists of two-level of mitigation. In the first level, it is proposed to design a Threshold-based rate-limiting with a Spoofing Resistant Tag (TSRT), as a source end countermeasure for High-Rate Flooding Attacks (HRFA) and spoofing attacks. In the second level, the accent is to discriminate normal traffic after Distributed Denial of Service (DDoS) traffic and drop the DDoS traffic at the destination end. Flow Congruence-based Selective Pushback (FCSP), as a destination-initiated countermeasure for the Low Rate Flooding Attack (LRFA). The source and the destination cooperate to identify and block the attack. A key advantage of this cooperative mechanism is that it can distinguish and channel down the attack traffic nearer to the starting point of the attack. The presentation of the agreeable cooperative multilevel safeguard mechanism is approved through broad recreation in NS-2. The investigation and the exploratory outcomes show that the proposed plan can effectively identify and shield from the attack.

Reliable Detection of Location Spoofing and Variation Attacks

Location spoofing is a critical attack in mobile communications. While several previous studies investigated the detection of location spoofing attacks, they are limited in their performance and lack the consideration of emerging attack variations. In this paper, we present a data-driven methodology for the reliable detection of location spoofing and its variations. To enhance the performance, we introduce and utilize a new set of features, which is differential in nature and enables the checking of the mobility constraints and inconsistency. Our comparison study with the previous research shows that the presented scheme using the new features significantly improves the accuracy and reliability of the detection against location spoofing attacks. To take the possibility of attack variations into account, we establish a set of scenarios manipulating coordinate data to create attack variants. Our experimental results confirm the feasibility and effectiveness of the new features for identifying diverse types of spoofing attacks and their variations, greatly improving the detection performance by up to 99.1% accuracy. Additionally, we present a profiling-based detection approach (building the detector referring only to legitimate coordinate data), to further extend resilience to previously unseen attacks as a means to zero-day detection. The evaluation result shows the potential of the profiling-based detector with comparable or even better performance than the supervised learning methods (requiring both legitimate and falsified data to construct the detector).

VocalPrint: A mmWave-Based Unmediated Vocal Sensing System for Secure Authentication

With the continuing growth of voice-controlled devices, voice metrics have been widely used for user identification. However, voice biometrics is vulnerable to replay attacks and ambient noise. We identify that the fundamental vulnerability in voice biometrics is rooted in its indirect sensing modality (e.g., microphone). In this paper, we present <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">VocalPrint</i> , a resilient mmWave interrogation system which directly captures and analyzes the vocal vibrations for user authentication. Specifically, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">VocalPrint</i> exploits the unique disturbance of the skin-reflect radio frequency (RF) signals around the near-throat region of the user, caused by the vocal vibrations. The complex ambient noise is isolated from the RF signal using a novel resilience-aware clutter suppression approach for preserving fine-grained vocal biometric properties. Afterward, we extract the vocal tract and vocal source features and input them into an ensemble classifier for authentication. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">VocalPrint</i> is practical as it allows the effortless transition to a smartphone while having sufficient usability due to its non-contact nature. Our experimental results from 41 participants with different interrogation distances, orientations, and body motions show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">VocalPrint</i> achieves over 96 percent authentication accuracy even under unfavorable conditions. We demonstrate the resilience of our system against complex noise interference and spoof attacks of various threat levels.

Experimental Case Study of Self-Supervised Learning for Voice Spoofing Detection

This study aims to improve the performance of voice spoofing attack detection through self-supervised pre-training. Supervised learning needs appropriate input variables and corresponding labels for constructing the machine learning models that are to be applied. It is necessary to secure a large number of labeled datasets to improve the performance of supervised learning processes. However, labeling requires substantial inputs of time and effort. One of the methods for managing this requirement is self-supervised learning, which uses pseudo-labeling without the necessity for substantial human input. This study experimented with contrastive learning, a well-performing self-supervised learning approach, to construct a voice spoofing detection model. We applied MoCo’s dynamic dictionary, SimCLR’s symmetric loss, and COLA’s bilinear similarity in our contrastive learning framework. Our model was trained using VoxCeleb data and voice data extracted from YouTube videos. Our self-supervised model improved the performance of the baseline model from 6.93% to 5.26% for a logical access (LA) scenario and improved the performance of the baseline model from 0.60% to 0.40% for a physical access (PA) scenario.

New LLRT-Based Methods for Active Eavesdropper Detection in Cell-Free Massive MIMO

In this paper, the problem of active eavesdropper detection is considered for a cell-free massive multiple-input multiple-output (m-MIMO) system which is attacked by an active eavesdropper within the uplink training phase, also called pilot spoofing attack. Two methods based on log-likelihoodratio tests (LLRT), one in a centralized and the other in a decentralized fashion, are proposed to detect the signal abnormality. The methods take advantage of a special protocol in which the legitimate users switch to an off-mode irregularly, without significantly affecting the spectral efficiency of the data transmission. The protocol is directly applicable to environments with low to moderate mobility, and can be extended to high mobility through a simple rearrangement of available pilot sequences among users if needed. More importantly, the proposed methods impose low fronthaul overhead which is imperative for a cellfree m-MIMO system with a large number of access points (APs). A closed-form expression for the joint probability density function (PDF) of the processed received signals conditioned on the alternative hypothesis, which is essential for the implementation of LLRT-based detection methods, is also derived. Through an asymptotic analysis, it is shown for the proposed methods that the detection and false-alarm probabilities approach to one and zero, respectively as the number of APs goes to infinity. Numerical results reveal that both methods significantly outperform a recent approach in terms of false-alarm rate with negligible degradation in the per user uplink spectral efficiency.

FGDNet: Fine-Grained Detection Network Towards Face Anti-Spoofing

With the development of facial recognition technology, face anti-spoofing as the most important security module of face recognition system becomes more and more important. As a matter of fact, face anti-spoofing is still a challenging task, especially facing various attacks simultaneously. Moreover, most of current detectors mainly focus on binary classification while usually fail to complete the task of fine-grained multiple classification, referring to as replay, print, partial mask, and full mask attacks. To fill the gap, in this context, it is proposed to design the fine-grained detection network for classifying various face spoofing attack modes. First, we propose to establish a Transformer style network structure for feature extraction, where the convolution mapping operation is adopted instead of traditional linear mapping. Specifically, we adopt the self-attention module for extracting long distance feature, and convolution mapping is used to maintain the model's ability to extract local features. Finally, the simple yet effective linear classifier is introduced for fine-grained classification. Moreover, with the help of the VGG based style-transfer network, the well-designed scheme of data augmentation module is proposed for solving the problem of insufficient training samples. In the large-scale experiments, compared with the baseline detectors, our proposed fine-grained classifier with low computation cost performs its superiority for multiple classification.

Mitigation of ADS-B Spoofing Attack Impact on Departure Sequencing Through Modulated Synchronous Taxiing Approach

Mitigation of ADS-B Spoofing Attack Impact on Departure Sequencing Through Modulated Synchronous Taxiing Approach

Challenge-Response Emotion Authentication Algorithm Using Modified Horizontal Deep Learning

Face authentication is an important biometric authentication method commonly used in security applications. It is vulnerable to different types of attacks that use authorized users’ facial images and videos captured from social media to perform spoofing attacks and dynamic movements for penetrating security applications. This paper presents an innovative challenge-response emotions authentication model based on the horizontal ensemble technique. The proposed model provides high accurate face authentication process by challenging the authorized user using a random sequence of emotions to provide a specific response for every authentication trial with a different sequence of emotions. The proposed model is applied to the KDEF dataset using 10-fold cross-validations. Several improvements are made to the proposed model. First, the VGG16 model is applied to the seven common emotions. Second, the system usability is enhanced by analyzing and selecting only the four common and easy-to-use emotions. Third, the horizontal ensemble technique is applied to enhance the emotion recognition accuracy and minimize the error during authentication processes. Finally, the Horizontal Ensemble Best N-Losses (HEBNL) is applied using challenge-response emotion to improve the authentication efficiency and minimize the computational power. The successive improvements implemented on the proposed model led to an improvement in the accuracy from 92.1% to 99.27%.

Iris Liveness Detection Using Fragmental Energy of Haar Transformed Iris Images Using Ensemble of Machine Learning Classifiers

Contactless verification is possible with iris biometric identification, which helps prevent infections like COVID-19 from spreading. Biometric systems have grown unsteady and dangerous as a result of spoofing assaults employing contact lenses, replayed the video, and print attacks. The work demonstrates an iris liveness detection approach by utilizing fragmental coefficients of Haar transformed Iris images as signatures to prevent spoofing attacks for the very first time in the identification of iris liveness. Seven assorted feature creation ways are studied in the presented solutions, and these created features are explored for the training of eight distinct machine learning classifiers and ensembles. The predicted iris liveness identification variants are evaluated using recall, F-measure, precision, accuracy, APCER, BPCER, and ACER. Three standard datasets were used in the investigation. The main contribution of our study is achieving a good accuracy of 99.18% with a smaller feature vector. The fragmental coefficients of Haar transformed iris image of size 8 * 8 utilizing random forest algorithm showed superior iris liveness detection with reduced featured vector size (64 features). Random forest gave 99.18% accuracy. Additionally, conduct an extensive experiment on cross datasets for detailed analysis. The results of our experiments show that the iris biometric template is decreased in size to make the proposed framework suitable for algorithmic verification in real-time environments and settings.

GPS Spoofing Attacks in FANETs: A Systematic Literature Review

Flying Ad-Hoc Networks (FANETs) are groups of UAVs connected in an Ad-Hoc manner to accomplish a common mission. The widespread acceptance of UAVs due to their low cost and high efficiency has attracted malicious security attacks against them. These attacks cannot be easily prevented due to UAVs’ limited computational power, short battery life, and inability to execute complex algorithms. FANETs rely on the Global Positioning System (GPS) for localization. GPS Spoofing, an easy-to-launch attack, is one of the main challenges in FANETs. In which, the legitimate and not-encrypted civilian GPS signals are overridden by counterfeit signals to deceive the UAVs to collide or to be hijacked. Researchers proposed various countermeasures to address GPS Spoofing attacks in FANETs. To further assist future research, this paper provides a systematic literature review on GPS Spoofing attacks in FANETs and their defense mechanisms. After formulating eight research questions and applying well-defined inclusion/exclusion criteria and quality assessment tools, 70 research articles were extracted. The existing defense mechanisms were classified based on their objectives (i.e., detection, mitigation, and/or prevention) and according to their basis (i.e., relying on readings from various drones’ devices/sensors, processing the signals received by various sensors, employing machine learning algorithms, relying on game theory, or leveraging cryptographic techniques to authenticate and protect the confidentiality of GPS signals). The defense mechanisms were also analyzed to identify the attacker models, impacts of the attack, and detection performance. This study found that most of the proposed methods are detection approaches, rather than mitigation or prevention. Also, almost all papers used simulation experiments rather than a proof-of-concept implementation, which does not demonstrate a convincing performance under realistic mobility and propagation models. Moreover, most solutions addressed GPS Spoofing for a single UAV. Only eight articles addressed multiple UAV scenarios and none of them provided a proof-of-concept evaluation.

Implementing Power System Protection Algorithms in a Digital Hardware-in-the-Loop Substation

Real-time power system algorithms are necessary for grid advancement, but few practical applications have been demonstrated in a research usability context. The work in this paper consists of implementing a data correction algorithm, its deployment within realistic substation equipment, and the design of a testbed to demonstrate the overall framework and its usability. A digital simulator is used to generate Phasor Measurement Unit (PMU) data for the algorithm. The algorithm corrects data that has been perturbed by GPS spoofing attacks. Finally, the entire system is visualized on power-utility software, SEL Synchrowave Operations. Considerations and potential issues are discussed and are applicable to digital Hardware-in-the-Loop (HIL) systems as well as to field-deployed systems. The system is demonstrated with 11 simultaneously GPS-spoofing attacked PMUs in a 21 PMU system. The HIL testbed developed in this paper provides a valuable tool for easily testing a variety of real-time power system algorithms and the communications and control necessary for them operate successfully.

Securing Autonomous Vehicles Against GPS Spoofing Attacks: A Deep Learning Approach

Securing Autonomous Vehicles Against GPS Spoofing Attacks: A Deep Learning Approach

A Neutrosophic Model for Ranking Technical Sol utions for Three Types of ARP Attacks in SDN Architecture

Software-defined networks (SDN) have developed an understanding of the technological world in recent decades, which has led scholars to become interested in its problems. One of the primary issues facing SDN networks is security. We discovered that ARP assaults constitute a significant threat to SDN, so we provided in this survey the most recent solutions put forth to counteract these attacks, and rank the technical solutions based on the neutrosophic set. The neutrosophic set is used to deal with uncertain data in the evaluation process. The neutrosophic set is integrated with the TOPSIS method to obtain the rank of the proposed solutions. The TOPSIS method is used to give a rank of alternatives with specified criteria. This will make it easier for future researchers to identify and combat the three different forms of ARP attacks—ARP flooding assault, ARP spoofing attack, and ARP broadcasting attack. Prior to that, we went into more detail on SDN networks, including their design and, in particular, the shortcomings of the ARP protocol. Since SDN focuses on separating the controller plane from the data plane and centralizing the controller, it differs significantly from traditional networks and has stirred considerable controversy in the networking industry. Due to the fact that SDN is software-based, it offers greater flexibility, scalability, programmatic management, and control. The decoupling of the control and forwarding planes also enables SDN to connect to applications via application programming interfaces (APIs), supporting application security and performance and resulting in a scalable and dynamic network architecture. Contrarily, because traditional networks are hardware-based, they must use fixed functions and specialized hardware and devices to control the network. As a result, scaling traditional networks requires purchasing new hardware, which is a common issue. The SDN network architecture and its properties, as well as the most significant issues—particularly the three different types of ARP attacks that affect SDN—are covered in some sections of this research. These sections also discuss the best current remedies for these issues and outline the ongoing work that will eventually result in an ideal SDN network architecture free of significant security issues.

Spoofing Face Detection Using Novel Edge-Net Autoencoder for Security

Recent security applications in mobile technologies and computer systems use face recognition for high-end security. Despite numerous security techniques, face recognition is considered a high-security control. Developers fuse and carry out face identification as an access authority into these applications. Still, face identification authentication is sensitive to attacks with a 2-D photo image or captured video to access the system as an authorized user. In the existing spoofing detection algorithm, there was some loss in the recreation of images. This research proposes an unobtrusive technique to detect face spoofing attacks that apply a single frame of the sequenced set of frames to overcome the above-said problems. This research offers a novel Edge-Net autoencoder to select convoluted and dominant features of the input diffused structure. First, this proposed method is tested with the Cross-ethnicity Face Anti-spoofing (CASIA), Fetal alcohol spectrum disorders (FASD) dataset. This database has three models of attacks: distorted photographs in printed form, photographs with removed eyes portion, and video attacks. The images are taken with three different quality cameras: low, average, and high-quality real and spoofed images. An extensive experimental study was performed with CASIA-FASD, 3 Diagnostic Machine Aid-Digital (DMAD) dataset that proved higher results when compared to existing algorithms.

PAST-AI: Physical-Layer Authentication of Satellite Transmitters via Deep Learning

Physical-layer security is regaining traction in the research community, due to the performance boost introduced by deep learning classification algorithms. This is particularly true for sender authentication in wireless communications via radio fingerprinting. However, previous research mainly focused on terrestrial wireless devices while, to the best of our knowledge, none of the previous work considered satellite transmitters. The satellite scenario is generally challenging because, among others, satellite radio transducers feature non-standard electronics (usually aged and specifically designed for harsh conditions). Moreover, the fingerprinting task is specifically difficult for Low-Earth Orbit (LEO) satellites (like the ones we focus in this paper) since they feature a low bit-rate and orbit at about 800 Km from the Earth, at a speed of around 25,000 Km/h, thus making the receiver experiencing a down-link with unique attenuation and fading characteristics. In this paper, we investigate the effectiveness and main limitations of AI-based solutions to the physical-layer authentication of LEO satellites. Our study is performed on massive real data—more than <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$100M$ </tex-math></inline-formula> I-Q samples—collected from an extensive measurements campaign on the IRIDIUM LEO satellites constellation, lasting 589 hours. Our results show that Convolutional Neural Networks (CNN) and autoencoders (if properly calibrated) can be successfully adopted to authenticate the satellite transducers, with an accuracy spanning between 0.8 and 1, depending on prior assumptions. However, the relatively high number of I-Q samples required by the proposed methodology, coupled with the low bandwidth of satellite link, might prevent the detection of the spoofing attack under certain configuration parameters.

Improving GNSS Spoofing Awareness in Smartphones via Statistical Processing of Raw Measurements

Due to the low received power of Global Navigation Satellite Signals (GNSS), the performance of GNSS receivers can be disrupted by anthropogenic radio frequency interferences, with intentional jamming and spoofing activities being among the most critical threats. It is reported in the literature that modern, GNSS-equipped Android smartphones are generally resistant to simplistic spoofing, and many recent contributions support such a biased belief. In this paper, we present the results of a test campaign designed to further stress the resilience of such devices to simplistic spoofing attacks and highlight their actual vulnerability. We then propose an effective spoofing detection technique, that exploits the spatial and temporal correlation of the counterfeit signals by leveraging the statistical analysis of raw GNSS measurements. By not requiring access to the low signal processing level of the GNSS id=Greceiverprocessor, the proposed solution applies to id=Gany id=Gdevicedevices embedding a GNSS id=Greceiver that providesunit and providing output raw GNSS measurements, such as current Android smartphones. Vulnerability analysis and validation of the proposed technique were conducted in a controlled environment by transmitting realistic, id=Gcounterfeitfake Global Positioning System id=R1(GPS) L1/CA navigation signals to a variety of Android smartphones id=Gembedding also differentand embedded GNSS chipsets. id=GIn the process, id=GWWe show that, under proper conditions, the devices were vulnerable to the attacks and that the effects were visible through their raw measurements, i.e., Carrier-to-noise ratio (C/N0), pseudo-range measurements, and position estimates. In particular, the study demonstrates that cross-correlation between id=Gthe C/N0 time series provided by each device id=Gforabout different GNSS satellites id=Gincreasesincrease under spoofing conditions, thus constituting id=Gan effectivea proper metric to detect the attack within a few seconds.

MAUTH: Continuous User Authentication Based on Subtle Intrinsic Muscular Tremors

Continuous authentication is viewed to be increasingly important for mobile devices, which store a wide range of private data and sensitive information of users. Traditional continuous authentication methods need user inputs (e.g. typing, sliding). In this work, we present MAUTH, a zero-effect continuous authentication scheme for mobile devices. With the built-in motion sensors on commercial off-the-shelf (COTS) devices, MAUTH can continuously extract, classify and verify the unique tremor features of users on how their body intrinsically shakes during the normal use of such devices. As a result, it is extremely difficult if not impossible to reproduce the same set of tremors as individuals differ in their muscle development. We implement MAUTH as a software on Android-based smartphones, which demonstrates that MAUTH is light-weight and unobtrusive to its users. We conduct extensive real-world experiments and trace-driven simulations in controlled and uncontrolled environments on 21 volunteers. The results show that MAUTH is difficult to counterfeit and achieves a low average false positive rate (FPR) of 6.73% under real-world spoofing attacks. Moreover, MAUTH is comfortable to use and can achieve a low average false negative rate (FNR) of 2.2% during uncontrolled and continuous usage of devices, leveraging isolation-forest-based classifiers trained with only 40 training samples.

A Review of Recent Developments on Secure Authentication Using RF Fingerprints Techniques

The Internet of Things (IoT) concept is widely used today. As IoT becomes more widely adopted, the number of devices communicating wirelessly (using various communication standards) grows. Due to resource constraints, customized security measures are not possible on IoT devices. As a result, security is becoming increasingly important in IoT. It is proposed in this study to use the physical layer properties of wireless signals as an effective method of increasing IoT security. According to the literature, radio frequency (RF) fingerprinting (RFF) techniques are used as an additional layer of security for wireless devices. To prevent spoofing or spoofing attacks, unique fingerprints appear to be used to identify wireless devices for security purposes (due to manufacturing defects in the devices' analog components). To overcome the difficulties in RFF, different parts of the transmitted signals (transient/preamble/steady-state) are used.&#x0D; This review provides an overview of the most recent RFF technique developments. It discusses various solution methods as well as the challenges that researchers face when developing effective RFFs. It takes a step towards the discovery of the wireless world in this context by drawing attention to the existence of software-defined radios (SDR) for signal capture. It also demonstrates how and what features can be extracted from captured RF signals from various wireless communication devices. All of these approaches' methodologies, classification algorithms, and feature classification are explained. &#x0D; In addition, this study discusses how deep learning, neural networks, and machine learning algorithms, in addition to traditional classifiers, can be used. Furthermore, the review gives researchers easy access to sample datasets in this field.

Defending a wireless LAN against ARP spoofing attacks using a Raspberry Pi

The Address Resolution Protocol (ARP) is a protocol that converts Internet Protocol (IP) addresses to Media Access Control (MAC) addresses. Due to a security issue known as "Man in the Middle," identity theft is feasible using the ARP protocol. ARP spoofing is one of the weaknesses in wireless networks when an attacker effectively masquerades as a legitimate one. Spoofing attacks will reduce network performance and break several security measures. In networks that use MAC address-based filtering to verify clients, all a spoofer needs is an actual MAC address from an authorised client to gain an unfair advantage. The research recommends developing a security system recognising and preventing ARP spoofing attacks. This system detects ARP spoofing attempts by comparing the static MAC address of the original router to the router's MAC address in the ARP cache table. After detecting the attack using information collected from the router's MAC address in the ARP cache table, the system will conduct a de-authentication attack against the attacker's MAC address. If the attacker is disconnected from the WLAN, they cannot perform ARP spoofing attacks. This system is operated using a Raspberry Pi Model B. Most ARP spoofing attacks can be detected in 0.93 seconds, and responding takes 3.05 seconds.