The Cellular Vehicle-to-Everything (C-V2X), introduced and developed by the 3GPP, is a promising technology for the Autonomous Driving System (ADS). C-V2X aims to fulfill the Service-Level Requirements (SLRs) of ADS to ensure road safety following the development of the latest version, i.e., the NR-V2X. However, vulnerabilities threatening road safety in NR-V2X persist that have yet to be investigated. Existing research primarily evaluates road safety based on successful packet receptions. In this work, we propose a novel resource starvation attack that exploits vulnerabilities in the resource allocation of NR-V2X to diminish the required SLRs, making the road condition unsafe for autonomous driving. Furthermore, we establish the Age of Information (AoI) as the predominant metric for estimating the impact of adversarial attacks on NR-V2X by constructing a Discrete-time Markov chain (DTMC) based analytical model and validating it through extensive simulations. Finally, our analysis underscores how the proposed attack on NR-V2X can lead to unsafe driving conditions by reducing the SLR of time-sensitive applications in ADS up to 15% from the target. Additionally, we observe that even benign vehicles act selfishly when resources are scarce, leading to further safety compromises.

Federated Learning (FL) enables collaborative model training across distributed devices while safeguarding data and user privacy. However, FL remains susceptible to privacy threats that can compromise data via direct means. That said, indirectly compromising the confidentiality of the FL model architecture (e.g., a convolutional neural network (CNN) or a recurrent neural network (RNN)) on a client device by an outsider remains unexplored. If leaked, this information can enable next-level attacks tailored to the architecture. This paper proposes a novel side-channel fingerprinting attack, leveraging flow-level and packet-level statistics of encrypted wireless traffic from an FL client to infer its deep learning model architecture. We name it FLARE, a fingerprinting framework based on FL Architecture REconnaissance. Evaluation across various CNN and RNN variants-including pre-trained and custom models trained over IEEE 802.11 Wi-Fi-shows that FLARE achieves over 98% F1-score in closed-world and up to 91% in open-world scenarios. These results reveal that CNN and RNN models leak distinguishable traffic patterns, enabling architecture fingerprinting even under realistic FL settings with hardware, software, and data heterogeneity. To our knowledge, this is the first work to fingerprint FL model architectures by sniffing encrypted wireless traffic, exposing a critical side-channel vulnerability in current FL systems.

While the disaggregated architecture of the industry-driven Open Radio Access Network (O-RAN) promises to foster vendor competition, accelerate innovation, and reduce cost for 5G/6G cellular network deployments, it also exposes the cellular network to various new cybersecurity and privacy vulnerabilities. This demo paper highlights one such new potential cybersecurity vulnerability in the Radio Unit (RU) of O-RAN networks, where an adversary can infer RU activity by analyzing electromagnetic side-channel emissions. We present a custom-built, open-source cellular O-RAN testbed equipped with EM measurement capabilities that enables direct observation of the FPGA-based RU during operation. By capturing EM emissions from the RU, we extract side-channel traces that reveal the underlying RU activity. These traces are then analyzed using a Random Forest-based machine learning classifier, which accurately distinguishes between different RU activity patterns. Our preliminary findings demonstrate the feasibility of inferring RU-level operations via passive EM observation, highlighting a previously unexplored security threat in O-RAN systems. All code and experimental artifacts are made publicly available at https://github.com/SPIRE-GMU/NextGRadio_Sidechanel.

The demand for radio resources, especially in the mid-band (i.e., 1-6 GHz) spectrum, is persistently increasing in wireless communications. Cognitive radio (CR) has emerged as a promising technology for addressing this increasing demand for the mid-band spectrum by enabling secondary users (SUs) to utilize the available spectrum opportunistically. This research, however, shows that more spectrum can be opportunistically accessed in the spatial domain by exploiting the frequency division duplexing (FDD) feature of cellular-based radio access technologies (RATs) in the mid-band spectrum, which remains undiscovered by existing opportunistic spectrum access techniques. This paper proposes a novel dynamic multi-channel spectrum access framework, employing actor-critic deep reinforcement learning (DRL), that leverages the FDD feature to explore these missed spectrum opportunities in CR networks. Extensive simulation results show that the proposed framework significantly outperforms FDD feature-unaware opportunistic spectrum access in terms of overall spectrum utilization.

Spectrum coexistence between 5G and Wi-Fi in the coveted 5GHz spectrum band unleashes new possibilities for more effective spectrum utilization. While the Listen-Before-Talk-based channel access mechanism with the self-deferral-based method enhances the relative fairness of this coexistence framework, it introduces new vulnerabilities yet to be addressed. This research presents a unique attack approach, Random Channel Access Deterrence (RanCAD), that exploits a novel vulnerability in the channel access mechanism. In the proposed attack, a malicious access point deceives a victim 5G base station into deferring its access to the shared channel, resulting in higher channel access delay and lower spectrum utilization. In addition, we propose a Discrete Time Markov Chain (DTMC) to study the proposed attack model, which helps illustrate the attack's impact on the victim's performance. To our knowledge, this is the first work to introduce this vulnerability in the channel access mechanism between coexisting 5G and Wi-Fi networks in the 5GHz band.

3GPP has introduced Private 5G to support the next-generation industrial automation system (IAS) due to the versatility and flexibility of 5G architecture. Besides the 3.5GHz CBRS band, unlicensed spectrum bands, like 5GHz, are considered as an additional medium because of their free and abundant nature. However, while utilizing the unlicensed band, industrial equipment must coexist with incumbents, e.g., Wi-Fi, which could introduce new security threats and resuscitate old ones. In this paper, we propose a novel attack strategy conducted by a mobility-enabled malicious Wi-Fi access point (mmAP), namely PACMAN attack, to exploit vulnerabilities introduced by heterogeneous coexistence. A mmAP is capable of moving around the physical surface to identify mission-critical devices, hopping through the frequency domain to detect the victim's operating channel, and launching traditional MAC layer-based attacks. The multi-dimensional mobility of the attacker makes it impervious to state-of-the-art detection techniques that assume static adversaries. In addition, we propose a novel Markov Decision Process (MDP) based framework to intelligently design an attacker's multi-dimensional mobility in space and frequency. Mathematical analysis and extensive simulation results exhibit the adverse effect of the proposed mobility-powered attack.

Safety concerns surrounding autonomous vehicles (AVs) present significant barriers to their widespread adoption. In AVs, it is necessary to make speedy decisions to safely roam through complex dynamic environments. Interestingly, predicting the future environment can aid in making these early decisions from the partially observed data. This proactive approach is becoming increasingly vital as the number of vehicles on the roads continues to rise, necessitating advanced development strategies for AVs. In this scenario, simulations based on Digital Twin (DT) are proving to be effective in necessary computation during the development and inference phase of the AVs. In fact, the DT system can play a crucial role in making early decisions. Thus, in this research, we propose a Generative Adversarial Network (GAN) enhanced frame prediction system for single and multi-time ahead image forecasting to aid in environment prediction and early decision. We demonstrate the relative motion of entities within the frames and evaluate our system's efficacy through qualitative and quantitative analyses. As This GAN-enhanced system---inside a DT---can predict a few frames into the future and check for anomalies, this can help the AVs make swift decisions. Moreover, by harnessing this capability to create diverse synthetic scenarios, we can enhance the development of the DT system, thus unlocking a multitude of opportunities for training various models for autonomous vehicles (AVs).

Data privacy, a critical human right, is gaining importance as new technologies are developed, and the old ones evolve. In mobile platforms such as Android, data privacy regulations require developers to communicate data access requests using privacy policy statements (PPS). This case study cross-examines the PPS in popular social media (SM) apps --- Facebook and Twitter --- for features of language ambiguity, sensitive data requests, and whether the statements tally with the data requests made in the Manifest file. Subsequently, we conduct a comparative analysis between the PPS of these two apps to examine trends that may constitute a threat to user data privacy.

The unprecedented growth in Internet of Things (IoT) deployment is making it difficult to safeguard IoT infrastructures against novel security threats. Recently, a new attack, hidden terminal emulation (HTE), has shed light on a vulnerability in the co-located and dense IoT networks, where the attacker emulates a hidden node from an external co-located network. HTE attack exploits the heterogeneity among different IoT networks, the shared nature of spectrum access, and the proximity to the victim IoT device in a dense IoT scenario to interrupt the victim’s communication. Prior work on HTE attack, however, considers an omniscient attack model, which has strong assumptions. In contrast, we propose a constrained attack model, which considers the sensing constraints of an attacker. Afterward, we propose a novel safeguard approach based on the Markov decision process to counteract the proposed attack model, namely Jump and Wobble. This work is among the very few to highlight the lower-layer vulnerabilities of spectrum coexistence in dense co-located IoT networks and, to the best of our knowledge, it is the first to propose a defense mechanism against HTE attacks.

The Internet of Things (IoT) has been rapidly taking steps towards commercialization. However, the dense deployment of IoT nodes - that may follow different wireless technologies - in the shared spectrum creates a new challenge to solve: secure coordination among co-located IoT nodes from different IoT networks. In this paper, we shed light on this unique challenge, and we illustrate how this challenge has the potential to create a novel vulnerability where an attacker can pose as a hidden terminal (by manipulating its radiation patterns) and interfere with transmissions from its hidden counterparts, namely hidden terminal emulation (HTE) attack. As the dense deployment of IoT nodes will aggravate such hidden terminal interference, it facilitates the HTE attacker plausible deniability to interfere with its hidden counterparts. This paper is the first to present a theoretical analysis of the feasibility of HTE attacks (i.e., successful impersonation of hidden terminals), to illustrate how it is affected by the density of IoT nodes, and to provide insights on secure IoT deployment.

Recently, the Internet of Things (IoT) technology has been drawing increasing attention in that it has a great potential to positively impact human life in a broad range of applications. However, the dense deployment of multiple co-located IoT networks that may follow different wireless protocols would engender new vulnerabilities. In this paper, we introduce a novel attack scenario in co-located IoT networks, where a reactive jammer can emulate the transmission characteristics of a hidden terminal from another network and can interfere with its hidden counterparts, namely the hidden terminal emulation (HTE) attack. As the dense deployment of IoT nodes will naturally create such hidden terminal scenarios, it provides the HTE attacker plausible deniability to reactively interfere with its hidden counterparts; hence, the HTE attacker remains immune to conventional reactive jamming detection techniques. In this paper, we capture the behavior of a benign hidden terminal via a parsimonious Markov model and propose a detection solution using the goodness-of-fit hypothesis testing. Though there has been extensive research on jamming detection, our novelty lies in considering hidden terminals as benign interference sources and leveraging the existing carrier sensing technique as a natural and effective way to detect HTE attacks.

In a cognitive radio-based network (CRN), secondary users opportunistically access underutilized spectrum resources and stop utilizing these resources when licensed or primary users reappear. Recently, a new attack, off-sensing (OS), has shed light on a vulnerability in the FCC policy of CRN. OS-attack utilizes the off-sensing interval of a victim to perpetrate the attack and to manipulate the victim's spectrum availability. However, prior work on OS-attack considers a deterministic approach that is unrealistic and is futile to fortify against conventional defense techniques. In this paper, we propose a new random approach, the random-OS attack, which adapts to realistic scenarios and is difficult to detect using conventional techniques. Then, we propose a novel safeguard approach based on the Markov decision process to defend the proposed attack, namely hide and seek. We also introduce an OS-attack detection strategy, which utilizes the sensing history to detect the presence of attackers without violating any policy or design constraints and without any networking overhead. Mathematical analysis and extensive simulation results exhibit the superior performance of our proposed works and advent a direction in designing safeguard strategies without amending the current FCC policies.

Spectrum handoff is an integral part of a cognitive radio-based network (CRN). It ensures the operational integrity of opportunistic spectrum access, the avoidance of harmful interference with licensed or primary users (PUs), and the delay requirement during a handoff. However, due to the random nature of PU activity, interference between primary and secondary users (SUs) are difficult to prevent. Proactive spectrum handoff aims to control this harmful interference between PUs and SUs by predicting the future activity of PUs and initiating spectrum handoff before a PU reappears. Though a few security aspects of CRNs attracted attention of researchers, vulnerabilities in the distributed proactive spectrum handoff process remain unstudied. In this paper, we introduce a vulnerability in the proactive spectrum handoff process and demonstrate how a selfish attacker can exploit this vulnerability to achieve personal gain. We name this covert spectrum handoff. To the best of our knowledge, this is the first work to consider security aspects of spectrum handoffs and to introduce an attack in the proactive spectrum handoff process.

Cognitive Radio (CR) has garnered much attention in the last decade, while the security issues are not fully studied yet. Existing research on attacks and defenses in CR - based networks focuses mostly on individual network layers, whereas cross-layer attacks remain fortified against single-layer defenses. In this paper, we shed light on a new vulnerability in cross-layer routing protocols and demonstrate how a perpetrator can exploit this vulnerability to manipulate traffic flow around it. We propose this cross-layer attack in CR-based wireless mesh networks (CR-WMNs), which we call off-sensing and route manipulation (OS-RM) attack. In this cross-layer assault, off-sensing attack is launched at the lower layers as the point of attack but the final intention is to manipulate traffic flow around the perpetrator. We also introduce a learning strategy for a perpetrator, so that it can gather information from the collaboration with other network entities and capitalize this information into knowledge to accelerate its malice intentions. Simulation results show that this attack is far more detrimental than what we have experienced in the past and need to be addressed before commercialization of CR-based networks.

Cognitive Radio (CR) is a promising solution to solve the spectrum scarcity problem. It enables opportunistic access to the available licensed spectrum for secondary users (SUs). However, CR networks (CRNs) possess security vulnerabilities and are susceptible to attacks. One of the most common attacks in CRNs, under which perpetrators exploit channel availability, is Primary User Emulation (PUE) attack. Here, a perpetrator mimics the signal characteristics of a benign primary user (PU) and transmits the signal to prevent SUs to access the spectrum. Researchers have proposed many solutions based on periodic sensing of the spectrum. However, all of the existed solutions have a strong assumption that the perpetrator's transmission coincides with the sensing intervals of SUs. In this paper, we introduce a new room of vulnerability in the conventional sensing approaches, where a perpetrator attacks only when no one is sensing the channel. This attack will decrease the channel utilization by SUs and create a Denial of Service (DoS) situation for victim SUs. We name this attack as off-sensing attack. We also propose an analytical model to analyze the impact of this attack in CRNs. Numerical analysis and simulation results show that this attack possesses a serious threat to CRNs.

This paper compares two approaches for predicting air temperature from historical pressure, humidity, and temperature data gathered from meteorological sensors in Northwestern Nevada. We describe our data and our representation and compare a standard neural network against a deep learning network. Our empirical results indicate that a deep neural network with Stacked Denoising Auto-Encoders (SDAE) outperforms a standard multilayer feed forward network on this noisy time series prediction task. In addition, predicting air temperature from historical air temperature data alone can be improved by employing related weather variables like barometric pressure, humidity and wind speed data in the training process.