Researchers have demonstrated the feasibility of detecting human motion behind the wall with radio frequency (RF) sensing techniques. With these techniques, an eavesdropper can monitor people's behavior from outside of the room without the need to access the room. This introduces a severe privacy-leakage issue. To address this issue, we propose Aegis, an interference-negligible RF sensing shield that i) incapacitates the RF sensing of eavesdroppers that work on any WiFi frequency bands and at any unknown locations outside of the protected area; ii) has minimum interference to the on-going WiFi communication; and iii) preserves authorized RF sensing inside the private region. Our extensive evaluation shows that when Aegis is activated, the accuracy of legitimate sensing system only decreases by 0.08, while the accuracy of the illegitimate sensing system is as low as 0.04. Moreover, the on-going data communication throughput is even increased by$\text{10}\;\text{MB/s}$on$\text{2.4}\;\;\text{GHz}$WiFi band and$\text{5}\;\text{MB/s}$on$\text{5}\;\;\text{GHz}$WiFi band.

Orthogonal frequency-division multiplexing (OFDM) has been widely used in WiFi, LTE, and adopted in 5G. Recently, researchers have proposed multiple OFDM-based WiFi backscatter systems that use the same underlying design principle (i.e., codeword translation) at the OFDM symbol-level to transmit the tag data. However, since the phase error correction in WiFi receivers can eliminate the phase offset created by a tag, the codeword translation requires specific WiFi receivers that can disable the phase error correction. As a result, phase error is introduced into the decoding procedure of the codeword translation, which significantly increases the tag data decoding error. To address this issue, we designed a novel OFDM backscatter called TScatter, which uses high-granularity sample-level modulation to avoid the phase offset created by a tag being eliminated by phase error correction. Moreover, by taking advantage of the phase error correction, our system is able to work in more dynamic environments. Our design also has two advantages: much lower bit error rate (BER) and higher throughput. We conducted extensive evaluations under different scenarios. The experimental results show that TScatter has i) three to four orders of magnitude lower BER when its throughput is similar to the latest OFDM backscatter system MOXcatter; or ii) more than 212 times higher throughput when its BER is similar to MOXcatter. Our design is generic and has the potential to be applied to backscatter other OFDM signals (e.g., LTE and 5G).

Recent advances in Cross-Technology Communication (CTC) have opened a new door for cooperation among heterogeneous IoT devices to support ubiquitous applications, such as smart homes and smart offices. However, existing work mainly focuses on physical layer performance improvements. In this paper, we explore how to leverage the latest CTC techniques for network layer performance improvements. Specifically, we introduce Waves, which leverages WiFi to ZigBee CTC and WiFi access point’s adaptive transmit power control techniques for reliable and fast data dissemination in low-duty-cycle ZigBee networks. We extensively evaluate our design under various settings. Evaluation results show that Waves can provide reliable data dissemination and is 33.5 times faster than the state-of-the-art protocol in terms of dissemination time.

The camera is one of the most important sensors for an autonomous vehicle (AV) to perform Environment Perception and Simultaneous Localization and Mapping (SLAM). To secure the camera, current autonomous vehicles not only utilize the data gathered from multiple sensors (e.g., Camera, Ultrasonic Sensor, Radar, or LiDAR) for environment perception and SLAM but also require the human driver to always realize the driving situation, which can effectively defend against previous attack approaches (i.e., creating visible fake objects or introducing perturbations to the camera by using advanced deep learning techniques). Different from their work, in this paper, we in-depth investigate the features of Infrared light and introduce a new security challenge called I-Can-See-the-Light- Attack (ICSL Attack) that can alter environment perception results and introduce SLAM errors to the AV. Specifically, we found that the invisible infrared lights (IR light) can successfully trigger the image sensor while human eyes cannot perceive IR lights. Moreover, the IR light appears magenta color in the camera, which triggers different pixels from the ambient visible light and can be selected as key points during the AV's SLAM process. By leveraging these features, we explore to i) generate invisible traffic lights, ii) create fake invisible objects, iii) ruin the in-car user experience, and iv) introduce SLAM errors to the AV. We implement the ICSL Attack by using off-the-shelf IR light sources and conduct an extensive evaluation on Tesla Model 3 and an enterprise-level autonomous driving platform under various environments and settings. We demonstrate the effectiveness of the ICSL Attack and prove that current autonomous vehicle companies have not yet considered the ICSL Attack, which introduces severe security issues. To secure the AV, by exploring unique features of the IR light, we propose a software-based detection module to defend against the ICSL Attack.

Recent advances in Cross-Technology Communication (CTC) have opened a new door for cooperation among heterogeneous IoT devices to support ubiquitous applications, such as smart homes and smart offices. However, existing work mainly focuses on physical layer performance improvements. In this paper, we explore how to leverage the latest CTC techniques for network layer performance improvements. Specifically, we introduce Waves, which leverages WiFi to ZigBee CTC and WiFi access point’s adaptive transmit power control techniques for reliable and fast data dissemination in low-duty-cycle ZigBee networks. We extensively evaluate our design under various settings. Evaluation results show that Waves can provide reliable data dissemination and is 33.5 times faster than the state-of-the-art protocol in terms of dissemination time.

Routing and flooding are important functions in wireless networks. However, until now routing and flooding protocols are investigated separately within the same network (i.e., a WiFi network or a ZigBee network). Moreover, further performance improvement has been hampered by the assumption of the harmful cross technology interference. In this paper, we present coexistent routing and flooding (CRF), which leverages the unique feature of physical layer cross-technology communication technique for concurrently conducting routing within the WiFi network and flooding among ZigBee nodes using a single stream of WiFi packets. We extensively evaluate our design under different network settings and scenarios. The evaluation results show that CRF i) improves the throughput of WiFi network by 1.12 times than the state-of-the-art routing protocols; and ii) significantly reduces the flooding delay in ZigBee network (i.e., 31 times faster than the state-of-the-art flooding protocol).

To support ubiquitous computing for various applications (such as smart health, smart homes, and smart cities), the communication system requires to be ubiquitously available, ultra-low-power, high throughput, and low-latency. A passive communication system such as backscatter is desirable. However, existing backscatter systems cannot achieve all of the above requirements. In this paper, we present the first LTE backscatter (LScatter) system that leverages the continuous LTE ambient traffic for ubiquitous, high throughput and low latency backscatter communication. Our design is motivated by our observation that LTE ambient traffic is continuous (v.s. bursty and intermittent WiFi/LoRa traffic), which makes LTE ambient traffic a perfect signal source of a backscatter system. Our design addresses practical issues such as time synchronization, phase modulation, as well as phase offset elimination. We extensively evaluated our design using a testbed of backscatter hardware and USRPs in multiple real-world scenarios. Results show that our LScatter's performance is consistently orders of magnitude better than WiFi backscatter in all the above scenarios. For example, LScatter's throughput is 13.63Mbps, which is 368 times higher than the latest ambient WiFi backscatter system [54]. We also demonstrate the effectiveness of our system using two real-world applications.

Internet-of-things (IoT) devices are sharing the radio frequency band (e.g., 2.4 GHz ISM band). The exponentially increasing number of IoT devices introduces potential security issues at the gateway in IoT networks. In this paper, we introduce a set of new attacks through concealed jamming - an adversary pretends to be (or compromises) a legitimate WiFi device, then sends out WiFi packets to prevent ZigBee devices' communication or collide with ZigBee's packets. By doing this, concealed jamming has the potential to severely delay the reception of ZigBee packets that may contain important information (e.g., critical health data from wearables, fire alarms, and intrusion alarms). To defend against these attacks, we designed a novel ZigBee data extraction technique that can recover ZigBee data from the ZigBee packets that were collided with WiFi packets. We extensively evaluated our design in different real-world settings. The results show that ZigBee devices (protected by our proposed methods) achieve similar performance as those that are not under the concealed jamming attack. Moreover, compared with unprotected devices, their throughput is more than 15 times higher than the unprotected one that is under concealed jamming attacks.

Deep neural networks are vulnerable to adversarial examples which are inputs modified with unnoticeable but malicious perturbations.Most defending methods only focus on tuning the DNN itself, but we propose a novel defending method which modifies the input data to detect the adversarial examples.We establish a detection framework based on normalizing filters that can partially erase those perturbations by smoothing the input image or depth reduction work.The framework gives the decision by comparing the classification results of original input and multiple normalized inputs.Using several combinations of gaussian blur filter, median blur filter and depth reduction filter, the evaluation results reaches a high detection rate and achieves partial restoration work of adversarial examples in MNIST dataset.The whole detection framework is a low-cost highly extensible strategy in DNN defending works.

Routing and flooding are important functions in wireless networks. However, until now routing and flooding protocols are investigated separately within the same network (i.e., a WiFi network or a ZigBee network). Moreover, further performance improvement has been hampered by the assumption of the harmful cross technology interference. In this paper, we present coexistent routing and flooding (CRF), which leverages the unique feature of physical layer cross-technology communication technique for concurrently conducting routing within the WiFi network and flooding among ZigBee nodes using a single stream of WiFi packets. We extensively evaluate our design under different network settings and scenarios. The evaluation results show that CRF i) improves the throughput of WiFi networks by 1.2 times than the state-of-the-art routing protocols; and ii) significantly reduces the flooding delay in ZigBee networks (i.e., 31 times faster than the state-of-the-art flooding protocol).

WiFi and Bluetooth Low Energy (BLE) are widely used in Internet of Things (IoT) devices. Since WiFi and BLE work within the overlapped ISM 2.4 GHz band, they will interfere with each other. Existing approaches have demonstrated their effectiveness in mitigating the interference. However, further performance improvement has been hampered by the design goal of exclusive communication of WiFi or BLE, which only allows one WiFi or BLE device to transmit packets at any specific time slot on the overlapped channel within the communication range. In this paper, we explore a new communication method, called Parallel Inclusive Communication (PIC), which leverages the unique modulation schemes of WiFi and BLE for parallel inclusive bi-directional transmission of both WiFi and BLE data at the same time within the overlapped channel. In this communication system, the PIC gateway is designed upon the IEEE 802.11g and 802.15.1 frameworks while the WiFi and BLE clients are commercial off-the-shelf devices. PIC achieves similar data rates for these parallel WiFi and BLE communications as if WiFi and BLE are communicating separately. PIC's system architecture naturally fits at the edge of the Internet, which is an optimal site for concurrently collecting (or disseminating) data from (or to) an exponentially increasing number of IoT devices that are using WiFi or BLE. We conducted extensive evaluations under four real-world scenarios. Results show that compared with existing approaches, PIC can significantly i) increase the packet reception ratios by 183%; ii) reduce the round-trip delay time by 590 times and energy consumption by 50.5 times; and iii) improve the throughput under WiFi and BLE coexistence scenarios.

The exponentially increasing number of Internet of Things (IoT) devices and the data generated by these devices introduces the spectrum crisis at the already crowded ISM 2.4-GHz band. To address this issue and enable more flexible and concurrent communications among IoT devices, we propose B2W2, a novel communication framework that enables N-way concurrent communication among Wi-Fi and Bluetooth low energy (BLE) devices. Specifically, we demonstrate that it is possible to enable the BLE to Wi-Fi cross-technology communication while supporting the concurrent BLE to BLE and Wi-Fi to Wi-Fi communications. We conducted extensive experiments under different real-world settings, and results show that its throughput is more than 85X times higher than that of the most recently reported cross-technology communication system, which only supports one-way communication (i.e., broadcasting) at any specific time.

Recent advances in cross-technology communication have significantly improved the spectrum efficiency in the same Industrial, Scientific, and Medical band among heterogeneous wireless devices (e.g., WiFi and ZigBee). However, further performance improvement in the whole network is hampered because the cross-technology network layer is missing. As the first cross-technology network layer design, our work, named ECT , opens a promising direction for significantly reducing the packet delivery delay via collaborative and concurrent cross-technology communication between WiFi and ZigBee devices. Specifically, ECT can dynamically change the nodes’ priorities and reduce the delivery delay from high-priority nodes under unreliable links. The key idea of ECT is to leverage the concurrent transmission of important data and raw data from ZigBee nodes to the WiFi access point. We extensively evaluate ECT under different network settings, and results show that our ECT’s packet delivery delay is more than 29 times lower than the current state-of-the-art solution.

Tracking moving objects is always a critical challenge in cyber-physical systems. Researchers have proposed many tracking algorithms. However, most of the proposed algorithms cannot be used for on-demand deployment because of the unavailable preset fingerprints (prior landmark or context information) in their assumption. Another issue is that those algorithms with models built in an interference-free environment cannot work in interference-rich environments. To address those issues, we propose a localizing and tracking algorithm called Enhanced Field Division (EFD), which dynamically divides the field into areas with unique signatures and tracks the target without any fingerprints. We also implemented a proof-of-concept localization platform to demonstrate the tracking accuracy and the algorithm performance in practical, interference-rich environments.

This study presents a new method for detecting Shrew DDoS (Distributed Denial of Service) attacks and analyzes the characteristics of the Shrew DDoS attack. Shrew DDoS is periodic to be suitable for the server’s TCP (Transmission Control Protocol) timer. It has lower maximum to bypass peak detection. This periodicity makes it distinguishable from normal data packets. By proposing the CCID (Cross-Correlation Identity Distinction) method to distinguish the flow properties, it quantifies the difference between a normal flow and an attack flow. Simultaneously, we calculated the cross-correlation between the attack flow and the normal flow in three different situations. The server can use its own TCP flow timer to construct a periodic attack flow. The cross-correlation between Gaussian white noise and simulated attack flow is less than 0.3. The cross-correlation between single-door function and simulated attack flow is 0.28. The cross-correlation between actual attack flow and simulated attack flow is more than 0.8. This shows that we can quantitatively distinguish the attack effects of different signals. By testing 4 million data, we can prove that it has a certain effect in practice.

Password has become today's dominant method of authentication in social network. While the brute-force attack methods, such as HashCat and John the Ripper, are unpractical, the research then switches to the password guess. The state-of-the-art approaches, such as Markov Model and probabilistic context-free grammars(PCFG), are all based on statistical probability. These approaches have a low matching rate. The methods on neural network have been proved more accurate and practical for password guessing than traditional methods. However, a raw neural network model is not qualified for cross-sites attack since each data set has its own features. This paper proposes a general deep learning model for password guessing, called GENPass. GENPass can learn features from several data sets and ensure the output wordlist high accuracy in different data sets by using adversarial generation. The password generator of GENPass is PCFG+LSTM(PL), where LSTM is a kind of Recurrent Neural Network. We combine neural network with PCFG because we found people were used to set their passwords with meaningful strings. Compared with LSTM, PL increased the matching rate by 16%-30% in the cross-sites tests when learning from a single dataset. GENPass uses several PL models to learn datasets and generate passwords. The result shows that the matching rate of GENPass is 20% higher than that of simply mixing those datasets in the cross-sites test.

Researchers have demonstrated the feasibility of detecting human motion behind the wall with radio frequency (RF) sensing techniques. With these techniques, an eavesdropper can monitor people's behavior from outside of the room without the need to access the room. This introduces a severe privacy-leakage issue. To address this issue, we propose Aegis, an interference-negligible RF sensing shield that i) incapacitates the RF sensing of eavesdroppers that work at any unknown locations outside of the protected area; ii) has minimum interference to the ongoing WiFi communication; and iii) preserves authorized RF sensing inside the private region. Our extensive evaluation shows that when Aegis is activated, it i) has a negligible impact on the legitimate sensing system; ii) effectively prevents the illegitimate sensing system from sensing human motions. Moreover, the ongoing data communication throughput is even increased.

The exponentially increasing number of Internet-of-Thing (IoT) devices introduces a spectrum crisis in the shared ISM band. However, it also introduces opportunities for conducting radio frequency (RF) sensing using pervasively available signals generated by heterogeneous IoT devices. In this paper, we explore how to leverage the ambient wireless traffic that i) generated by uncontrollable IoT devices and ii sensed by ambient noise floor measurements (a widely available metric in IoT devices) for human gesture recognition. Specifically, we introduce our system EAR, which can conduct fine-grained human gesture recognition using coarse-grained measurements (i.e., noise floor) of ambient RF signals generated from uncontrollable signal sources. We conducted extensive evaluations in both residential and academic buildings. Experimental results show that although EAR uses coarse-grained noise floor measurements to sense the uncontrollable signal sources, the signal sources can be distinguished with an accuracy up to 99.76%. Moreover, EAR can recognize fine-grained human gestures with high accuracy even under extremely low traffic rate (i.e., 4%) from uncontrollable ambient signal sources.

Web service is one of the key communications software services for the Internet. Web phishing is one of many security threats to web services on the Internet. Web phishing aims to steal private information, such as usernames, passwords, and credit card details, by way of impersonating a legitimate entity. It will lead to information disclosure and property damage. This paper mainly focuses on applying a deep learning framework to detect phishing websites. This paper first designs two types of features for web phishing: original features and interaction features. A detection model based on Deep Belief Networks (DBN) is then presented. The test using real IP flows from ISP (Internet Service Provider) shows that the detecting model based on DBN can achieve an approximately 90% true positive rate and 0.6% false positive rate.

The exponentially increasing number of Internet of things (IoT) devices introduces spectrum crisis to the widely used industrial, scientific, and medical (ISM) frequency band. Since IoT devices use heterogeneous radios with different bandwidths (e.g., 20 MHz for WiFi and 2 MHz for ZigBee), traditional interference avoidance methods, such as time-division multiple access (TDMA) and carrier-sense multiple access (CSMA), have very low spectrum utilization. This is because TDMA and CSMA allocate the packets at time domain, without considering the bandwidth difference of different IoT radios. To address this issue, we propose PMC, a novel communication system that enables parallel multi-protocol communication to heterogeneous IoT radios (i.e., WiFi and ZigBee) within a single WiFi channel. Our extensive evaluations show that PMC achieves the throughput of up to 121.02 kbit/s and 319.76 Mbit/s for parallel communication to ZigBee and WiFi, respectively. Compared with TDMA and CSMA, the spectrum utilization of PMC is increased by 2.3 and 1.8 times, respectively.

The exponentially increasing number of IoT devices makes the unlicensed industrial, scientific, and medical (ISM) radio bands (e.g., 2.4 GHz) extremely crowded. Currently, there is no efficient solution to coordinate the large amount heterogeneous IoT devices that have different communication technologies (e.g., WiFi and ZigBee). To fill this gap, in this paper, we introduce embedded multiple flows (EMF) communication method, which (i) embeds different pieces of information in existing traffic and (ii)concurrently sends out these information from one IoT sender to multiple IoT receivers that have a different communication technology from the sender. By doing this, our EMF method (i) enables cross-technology communication among heterogeneous IoT devices, (ii) does not introduce any extra control traffic, and (iii) is transparent to the higher layer applications. Our approach is implemented on USRPs and commercial off-the-shelf (COTS) ZigBee devices. We also conducted extensive experiments to evaluate our approach in real-world settings. The evaluation results show that EMF's throughput is more than 14 times higher than the latest cross-technology communication technique (i.e. FreeBee[1]).

The emerging smart health and smart home applications require pervasive and non-intrusive human activity recognition and monitoring. Traditional technologies (e.g., using cameras or accelerometers and gyroscopes) may introduce privacy issues or require people to wear sensors. To address these issues, recent approaches exploit fine-grained wireless signals for activity recognition. However, these approaches require devices that are costly or need to provide unique wireless features (e.g., Doppler shifts or phase information). With the increasingly available Internet of Things (IoT) devices, in this paper, we propose Harmony, a human activity recognition and monitoring middleware which can utilize the coarse-grained (but pervasively available) received signal strength (RSS) measurements from the radios of IoT devices. We implement a complete evaluation platform (from data collection to data analysis) of the middleware on top of low cost ZigBee compliant MICAz nodes and a laptop. We also conducted extensive experiments. Our results show that our design can achieve similar accuracy as fine-grained WiFi channel state information (CSI) measurement-based approaches. Specifically, our overall human activities recognition accuracy is up to 74% and 90% for RSS readings from a single pair and 3 pairs of IoT devices, respectively.

The exponentially increasing number of internet of things (IoT) devices and the data generated by these devices introduces the spectrum crisis at the already crowded ISM 2.4 GHz band. To address this issue and enable more flexible and concurrent communications among IoT devices, we propose B2W2, a novel communication framework that enables N-way concurrent communication among WiFi and Bluetooth Low Energy (BLE) devices. Specifically, we demonstrate that it is possible to enable the BLE to WiFi cross-technology communication while supporting the concurrent BLE to BLE and WiFi to WiFi communications. We conducted extensive experiments under different real-world settings and results show that its throughput is more than 85X times higher than the most recently reported cross-technology communication system [22], which only supports one-way communication (i.e., broadcasting) at any specific time.