Deep-learning radio fingerprinting is not robust against spatial variations, where a neural network trained on location A does not perform well over RF signals from location B. We promote the robustness of deep-learning radio fingerprinting against spatial variations by synergizing Complex-Valued Neural Networks (CVNNs) and pseudo-labeling. Compared to existing solutions, we leverage pseudo-labeling to fine-tune a CVNN without needing labeled RF signals from a new location. We collect large-scale real-world datasets across different locations. We conduct comprehensive evaluations of these datasets with multiple complex-valued activation functions. Our experimental results significantly improve the accuracy of radio fingerprinting when training data and test data are from two different locations (e.g., increasing accuracy from 40.0% to 62.8%).

The use of Internet of Things (IoT) devices is higher than ever and is growing rapidly. Many IoT devices are manufactured by home appliance manufacturers where security and privacy is not the foremost concern. There does not exist a strict authentication method that verifies the identity of the device. This allows any rogue IoT device to authenticate and spoof various IoT device activities using compromised credentials. This paper addresses the issue by introducing a novel method for re- and continuous authentication utilizing a device-type classification as a new identity paradigm. We present RADTEC: a protocol for authenticating a device in a network by leveraging machine learning to classify the type of an IoT device attempting to connect to the network with an accuracy of over 95% in less than 0.65 milliseconds. We investigate multiple machine learning classifiers to infer the types of IoT devices and use them to develop a stricter and more efficient method for authentication.

Creativity focuses on the generation of novel and useful ideas. In this paper, we propose an approach to automatically generating creative requirements candidates via the adversarial examples resulted from applying small changes (perturbations) to the original requirements descriptions. We present an architecture where the perturbator and the classifier positively influence each other. Meanwhile, we ensure that each adversarial example is uniquely traceable to an existing feature of the software, instrumenting explainability. Our experimental evaluation of six datasets shows that around 20% adversarial shift rate is achievable. In addition, a human subject study demonstrates our results are more clear, novel, and useful than the requirements candidates outputted from a state-of-the-art machine learning method. To connect the creative requirements closer with software development, we collaborate with a software development team and show how our results can support behavior-driven development for a web app built by the team.

Fault injection attacks can completely bypass typical code defenses on embedded systems and lead to severe consequences, such as leaking encryption keys and bypassing secure boot. However, programmers lack awareness of fault injection attacks and there are limited tools to automatically detect these vulnerabilities. In this paper, we conduct an empirical evaluation over 15 C files (5,005 lines of code) selected from GitHub projects designed for embedded systems. We find that 3.72% of lines (i.e., 186 lines) are vulnerable under fault injection attacks. Moreover, we develop a new tool, named FaultHunter, which can automatically detect fault injection vulnerabilities in C code. Our detection method consists of two key building blocks, including parse tree generation and token search. Our experimental results show that FaultHunter can achieve a detection performance with 90.3% recall and 56.4% precision.

Cache-based website fingerprinting attacks can infer which website a user visits by measuring CPU cache activities. Studies have shown that an attacker can achieve high accuracy with a low sampling rate by monitoring cache occupancy of the entire Last Level Cache. Although a defense has been proposed, it was not effective when an attacker adapts and retrains a classifier with defended data. In this paper, we propose a new defense, referred to as cache shaping, to preserve user privacy against cache-based website fingerprinting attacks. Our proposed defense produces dummy cache activities by introducing dummy I/O operations and implementing with multiple processes, which hides fingerprints when a user visits websites. Our experimental results over large-scale datasets collected from multiple web browsers and operating systems show that our defense remains effective even if an attacker retrains a classifier with defended cache traces. We demonstrate the efficacy of our defense in the closed-world setting and the open-world setting by leveraging deep neural networks as classifiers.

Website fingerprinting attacks can infer which website a user visits over encrypted network traffic. Recent studies can achieve high accuracy (e.g., 98%) by leveraging deep neural networks. However, current attacks rely on enormous encrypted traffic data, which are time-consuming to collect. Moreover, large-scale encrypted traffic data also need to be recollected frequently to adjust the changes in the website content. In other words, the bootstrap time for carrying out website fingerprinting is not practical. In this paper, we propose a new method, named Adaptive Fingerprinting, which can derive high attack accuracy over few encrypted traffic by leveraging adversarial domain adaption. With our method, an attacker only needs to collect few traffic rather than large-scale datasets, which makes website fingerprinting more practical in the real world. Our extensive experimental results over multiple datasets show that our method can achieve 89% accuracy over few encrypted traffic in the closed-world setting and 99% precision and 99% recall in the open-world setting. Compared to a recent study (named Triplet Fingerprinting), our method is much more efficient in pre-training time and is more scalable. Moreover, the attack performance of our method can outperform Triplet Fingerprinting in both the closed-world evaluation and open-world evaluation.

Minute hardware imperfections in the radio-frequency circuitry of a wireless device can be leveraged as a unique fingerprint. Radio fingerprinting is a way of distinguishing a device from others of the same type at the physical layer by utilizing these hardware imperfections. Recent studies proposed to utilize deep learning over raw I/Q data for the purpose of radio fingerprinting and achieve high accuracy. Unfortunately, deep-learning-based radio finger-printing is not robust over I/Q data across different days due to significant changes in wireless channels. This study proposes to leverage fine-tuning to improve the robustness of radio fingerprinting in a cross-day scenario, where training and test I/Q data are from different days. Our experimental results suggest that transfer learning is a promising approach for robust deep-learning-based radio fingerprinting in practice.