We study the security aspects of remote state estimation within Cyber-Physical Systems (CPSs), where a sensor transmits its measurements to a remote state estimator over a multi-channel wireless link amidst a Denial-of-Service (DoS) attack. Existing literature primarily focuses on sensor defense schemes against non-adaptive DoS attackers, relying on prior knowledge of the attacker’s strategy alongside limited channel sensing capabilities. These studies assume either stationary or heuristic behavior from one party while exploring countermeasures from the other. To relax this constraint, we propose that both sensors and attackers employ online learning-based policies to select channels for packet transmission and for emitting jamming signals, respectively. We formulate the problem as an online learning-based repeated two-player constant-sum game, aiming to examine the stability of the remote state estimator. First, we show that both the sensor’s and attacker’s channel selection strategies adapt to each other, resulting in mutually optimal responses in the infinite-horizon scenario. Furthermore, we establish the asymptotic stability condition of the remote state estimator with respect to the number of wireless communication channels and the CPS critical value. Finally, we extend our analysis to scenarios where the DoS attacker targets more than one channel simultaneously, identifying the function by which the estimator’s stability region contracts as the number of attacked channels increases. Through extensive numerical evaluations under various CPS parameters, we analyze the mutual behavior of both entities and validate our analytical findings.

We study a family of adversarial (a.k.a. nonstochastic) multi-armed bandit (MAB) problems, wherein not only the player cannot observe the reward on the played arm (self-unaware player) but also it incurs switching costs when shifting to another arm. We study two cases: In Case 1, at each round, the player is able to either play or observe the chosen arm, but not both. In Case 2, the player can choose an arm to play and, at the same round, choose another arm to observe. In both cases, the player incurs a cost for consecutive arm switching due to playing or observing the arms. We propose two novel online learning-based algorithms each addressing one of the aforementioned MAB problems. We theoretically prove that the proposed algorithms for Case 1 and Case 2 achieve sublinear regret of O(√[4]KT3lnK) and O(√[3](K-1)T2lnK) , respectively, where the latter regret bound is order-optimal in time, K is the number of arms, and T is the total number of rounds. In Case 2, we extend the player's capability to multiple observations and show that more observations do not necessarily improve the regret bound due to incurring switching costs. However, we derive an upper bound for switching cost as c ≤ 1/√[3]m2 for which the regret bound is improved as the number of observations increases. Finally, through this study, we found that a generalized version of our approach gives an interesting sublinear regret upper bound result of [Formula: see text] for any self-unaware bandit player with s number of binary decision dilemma before taking the action. To further validate and complement the theoretical findings, we conduct extensive performance evaluations over synthetic data constructed by nonstochastic MAB environment simulations and wireless spectrum measurement data collected in a real-world experiment.

We study security of remote state estimation in wireless cyber-physical systems (CPS) where a sensor sends its measurements to the remote state estimator over a multichannel wireless link in presence of a jamming attacker. Most of the existing works study the sensor's defense scheme by adopting optimization-based methods and rely on the prior knowledge of the attacker's attack policy. To relax this constraint, we propose a novel online-learning-based policy called joint channel and power selection (J-CAP) for the sensor to dynamically choose transmission channel and power. The proposed method assumes no prior knowledge of the attacker's attack policy, nor of the channel state information. J-CAP jointly optimizes sensor's channel selection and power consumption, and guarantees the estimator's asymptotic stability. We theoretically prove that J-CAP achieves a sublinear learning regret bound. We also show J-CAP's optimality by deriving and matching its regret lower and upper bound orders. Compared with the solution that directly applies the baseline solution, J-CAP improves the regret upper bound by a factor of √{K+L}, where K and L denote the number of channels and number of power levels, respectively. Numerical evaluations validate the analytical results under various CPS parameters, and compare the J-CAP's performance with the state-of-the-art solutions.

Grant-free random access is an emerging technology for providing massive connectivity for 5G massive machine-type communications (mMTC), where non-orthogonal pilot sequences are used to simultaneously detect active users and estimate channels. However, grant-free 5G IoT networks are vulnerable to pilot contamination attacks (PCA), where the attacker can send the same pilots as legitimate IoT users to harm the active user detection and channel estimation. To defend against this attack, in this article, we propose a physical-layer countermeasure based on the channel virtual representation (CVR). CVR can emphasize the unique characteristics of mmWave channels that are sensitive to the location of the sender. This can be utilized to counter PCA no matter if the attacker's pilots are superimposed to that of the victim or not. Based on this observation, to achieve an efficient PCA detection, a single-hidden-layer multiple measurement (SHMM) Siamese network is employed. This solution tackles the challenges of channel randomness and massive connectivity in mMTC IoT networks, and supports small sample learning. Simulation results evaluate and confirm the effectiveness of the proposed detection scheme under various scenarios. The detection accuracy can approach 99% with 128 antennas at the receiver and reach above 95% even with only 50 training samples.

Nonorthogonal multiple access (NOMA) technology can significantly promote Internet-of-Things (IoT) networks on spectral efficiency and massive connectivity. However, NOMA-IoT communications are vulnerable to pilot contamination attacks, where the attacker can send the same pilot signals as legitimate IoT users. Most existing countermeasures to this physical-layer threat struggle to adapt to NOMA-IoT networks, in which superimposed signals appear and low-cost IoT devices exist. In this article, we propose a compressed-sensing-based detection scheme to defend against pilot contamination attacks in NOMA-IoT networks. In particular, we present a multiple measurement vector (MMV) compressed sensing model and a security spreading code generation (SSCG) framework to prevent pilot contamination attacks from spoofing base station (BS) in NOMA-IoT networks. Furthermore, to efficiently reconstruct the superimposed signals based on the SSCG framework, a matching pursuit (MP) multiple response sparse Bayesian learning (MSBL) algorithm (MP-MSBL) is proposed. The security analysis and algorithm complexity of the proposed algorithms are provided. The simulation results evaluate and confirm the effectiveness of the proposed detection schemes. The reconstruction and detection accuracy of pilots can be higher than 99% under different scenarios.

The consumer unmanned aerial vehicle (UAV) market has grown significantly over the past few years. Despite its huge potential in spurring economic growth by supporting various applications, the increase of consumer UAVs poses potential risks to public security and personal privacy. To minimize the risks, efficiently detecting and identifying invading UAVs is in urgent need for both invasion detection and forensics purposes. Aiming to complement the existing physical detection mechanisms, we propose a machine learning-based framework for fast UAV identification over encrypted Wi-Fi traffic. It is motivated by the observation that many consumer UAVs use Wi-Fi links for control and video streaming. The proposed framework extracts features derived only from packet size and inter-arrival time of encrypted Wi-Fi traffic, and can efficiently detect UAVs and identify their operation modes. In order to reduce the online identification time, our framework adopts a re-weighted ℓ1-norm regularization, which considers the number of samples and computation cost of different features. This framework jointly optimizes feature selection and prediction performance in a unified objective function. To tackle the packet inter-arrival time uncertainty when optimizing the trade-off between the detection accuracy and delay, we utilize maximum likelihood estimation (MLE) method to estimate the packet inter-arrival time. We collect a large number of real-world Wi-Fi data traffic of eight types of consumer UAVs and conduct extensive evaluation on the performance of our proposed method. Evaluation results show that our proposed method can detect and identify tested UAVs within 0.15-0.35s with high accuracy of 85.7-95.2%. The UAV detection range is within the physical sensing range of 70m and 40m in the line-of-sight (LoS) and non-line-of-sight (NLoS) scenarios, respectively. The operation mode of UAVs can be identified with high accuracy of 88.5-98.2%.

Power non-orthogonal multiple access (NOMA) has been considered as a new enabling technology in 5G communication. In this paper, we introduce the problem of pilot contamination attack (PCA) on NOMA in millimeter wave (mmWave) and massive MIMO 5G communication. Due to the new characteristics of NOMA such as superposed signals with multi-users, PCA detection faces new challenges. By harnessing the sparseness and statistics of mmWave and massive MIMO virtual channel, we propose two effective PCA detection schemes for NOMA tackling static and dynamic environments, respectively. For the static environment, the problem of PCA detection is formulated as a binary hypothesis test of the virtual channel sparsity. For the dynamic environment, the statistic of the peaks in the virtual channel is leveraged to distinguish the contamination state from the normal state. A peak estimation algorithm and a machine learning based detection framework are proposed to achieve high detection performance. To further optimize the proposed scheme, a feature selection algorithm and an optimization model considering the detection accuracy and detection delay are presented. Simulation results evaluate and confirm the effectiveness of the proposed detection schemes. The detection rate can approach 100% with 10-3false alarm rate in the static environment and above 95% in the dynamic environment under various system parameters.

In this paper, we consider a wireless powered backscatter communication (WPBC) network in which a full-duplex access point (AP) simultaneously transmits information and energy signals by injecting artificial noise (AN) to secure the backscatter transmission from multiple backscatter devices (BDs). To maximize the minimum throughput and ensure fairness and security, we formulate an optimization problem by jointly considering the power splitting ratio between dedicated information signals and AN, backscatter time and signal power allocation among multiple BDs. For a single BD network, we obtain a closed-form solution and evaluate its validity through proof-of-concept experiments. For the general case with multiple BDs, we present an iterative algorithm by leveraging block coordinate descent (BCD) and successive convex approximation optimization to solve a non-convex problem incurred in WPBC. We further show the convergence of the proposed algorithm and analyze its complexity. Finally, extensive simulation results show that the proposed algorithm achieves an optimal and equitable throughput for all BDs, and our work provides a good perspective of resource allocation to improve the performance of WPBC networks.

In many IoT (Internet-of-Things) applications, a large number of low-cost IoT devices are connected to the Internet through an access point (AP) or gateway via wireless communication. Due to the resource constraints on IoT devices and broadcast nature of wireless medium, identity spoofing attacks are easy to launch but hard to defend in an IoT wireless access network. In this paper, under the context of 5G communication, we propose an efficient physical layer identity spoofing attack detection scheme for IoT. By harnessing the sparsity of the virtual channel in mmWave and Massive MIMO 5G communication, we propose a two- step detection scheme. In the first step, our scheme detects anomalies by examining the virtual angles of arrival (AoA) and path gains of all the IoT devices simultaneously in a virtual channel space (VCS). In the second step, we introduce a machine learning based detection scheme to detect the actual attack. Simulation results evaluate and confirm the effectiveness of the proposed detection scheme. The minimum Bayes risk of the proposed scheme can be less than 0.5\% even in the presence of 100 IoT devices.

Wireless physical layer security has attracted great attention in recent years. Although mobility is an intrinsic property of wireless networks, most of the existing works only consider static scenarios and the impact of mobility on wireless physical layer security is not well understood. To fill this gap, in this paper, we investigate physical layer security in the scenario with a random mobile receiver under Rayleigh fading channel. We consider a common scenario where a base station or access point communicates to a random mobile receiver with a passive eavesdropper in a circular region. The secrecy performances under three typical random mobility models are studied: random waypoint model (RWP); random direction model (RD); and border move model. We investigate the secrecy characteristics of the mobile user under steady-state running and provide a general analytical framework for computing the ergodic secrecy capacity. We derive tractable closed-form expressions of positive secrecy capacity probability and secrecy outage probability for RWP and RD mobility users, respectively. By comparing the secrecy performance of mobility with static case, we find that the RWP mobile user can achieve much better secrecy performance than the others. We then investigate the secrecy performance of RWP mobile user with pause time. Furthermore, the two types of secrecy improvement strategies for random mobile users are proposed. In the first strategy, a transmit subcell for RWP users is bounded. We allow the transmitter to communicate with the mobile user only when he is moving within the subcell. In the other strategy, the transmitter is turned on only when the evaluated secrecy performance reaches to a required level. We strike a good trade-off between the secrecy improvements and transmit outage probability. Extensive simulation results validate our theoretical analysis. Finally, we extend our framework to other realistic scenarios, including nodes moving in other shapes of areas, and multiple non-cooperative and cooperative eavesdroppers.

Cognitive radio (CR) is considered as a key enabling technology for dynamic spectrum access to improve spectrum efficiency. Although the CR concept was invented with the core idea of realizing "cognition", the research on measuring CR cognition capabilities and intelligence is largely open. Deriving the intelligence capabilities of CR not only can lead to the development of new CR technologies, but also makes it possible to better configure the networks by integrating CRs with different intelligence capabilities in a more cost- efficient way. In this paper, for the first time, we propose a data-driven methodology to quantitatively analyze the intelligence factors of the CR with learning capabilities. The basic idea of our methodology is to run various tests on the CR in different spectrum environments under different settings and obtain various performance results on different metrics. Then we apply factor analysis on the performance results to identify and quantize the intelligence capabilities of the CR. More specifically, we present a case study consisting of sixty three different types of CRs. CRs are different in terms of learning-based dynamic spectrum access strategies, number of sensors, sensing accuracy, and processing speed. Based on our methodology, we analyze the intelligence capabilities of the CRs through extensive simulations. Four intelligence capabilities are identified for the CRs through our analysis, which comply with the nature of the tested algorithms.