Radio-frequency coverage maps (RF maps) are essential in wireless communication, but obtaining them through site surveys can be labor-intensive and sometimes impractical. To address this challenge, we propose RecuGAN, a generative adversarial network (GAN)-based approach for generating RF maps. RecuGAN leverages the principles of information maximizing GAN (InfoGAN) to capture latent properties of RF maps, enabling unsupervised categorization and generation of new and diverse RF maps. Unlike traditional methods, RecuGAN does not require labeled data or conditional input, reducing complexity, time, and cost. We enhance the RecuGAN objective function with a customized gradient penalty-based Wasserstein GAN (WGAN) function and a gradient-based loss function for stable training and accurate map generation. We also provide the option to incorporate multiple generators in RecuGAN, enabling high-resolution RF map generation. As demonstrated through extensive training with both experimental and simulation data, RecuGAN can synthesize diverse high-quality RF maps and categorize them based on the RSS distribution. Compared to a UNet-based conditional GAN (cGAN), RecuGAN achieves a mean average percentage error (MAPE) of 1.18%, outperforming the cGAN model, which achieves a MAPE of 2.5%.

In this paper, we propose MAMBA, a restless multi-armed bandit framework for beam tracking in directional millimeter-wave (mmW) cellular systems. Instead of relying on explicit control messages, MAMBA utilizes the ACK/NACK packets transmitted by user equipments (UEs) to the base station (BS) as a part of the hybrid automatic repeat request (HARQ) procedure. These packets are used to measure the quality of the currently operating downlink beam, and select a new downlink beam along with an appropriate modulation and coding scheme (MCS) for future transmissions. At its core, MAMBA implements an online reinforcement learning technique called adaptive Thompson sampling (ATS), which determines a good beam and associated MCS to be used for the upcoming transmissions. To evaluate MAMBA's performance, we conduct extensive simulations and over-the-air (OTA) experiments over the 28 GHz band using phased-array antennas. We study fixed- as well as adaptive-rate variants of MAMBA, and contrast it with four other beam tracking strategies: a beam selection scheme similar to the one used in 5G NR (called ‘static oracle’), a theoretically optimal but practically infeasible beam tracking scheme (called ‘dynamic oracle’), an$\epsilon$-greedy algorithm [1], and the Unimodal Beam Alignment (UBA) algorithm [2]. Our results show that MAMBA achieves 182% throughput gain over the ‘static oracle’ and is reasonably close to the throughput of the ‘dynamic oracle’. Compared to UBA, MAMBA achieves 25-35% gain in throughput, depending on UE mobility. Finally, when operated at a fixed MCS, MAMBA/ATS achieves 21% gain over the$\epsilon$-greedy algorithm at the lowest applied MCS index, and 255% gain at the highest MCS index.

Radio-frequency coverage maps (RF maps) are extensively utilized in wireless networks for capacity planning, placement of access points and base stations, localization, and coverage estimation. Conducting site surveys to obtain RF maps is labor-intensive and sometimes not feasible. In this paper, we propose radio-frequency adversarial deep-learning inference for automated network coverage estimation (RADIANCE), a generative adversarial network (GAN) based approach for synthesizing RF maps in indoor scenarios. RADIANCE utilizes a semantic map, a high-level representation of the indoor environment to encode spatial relationships and attributes of objects within the environment and guide the RF map generation process. We introduce a new gradient-based loss function that computes the magnitude and direction of change in received signal strength (RSS) values from a point within the environment. RADIANCE incorporates this loss function along with the antenna pattern to capture signal propagation within a given indoor configuration and generate new patterns under new configuration, antenna (beam) pattern, and center frequency. Extensive simulations are conducted to compare RADIANCE with ray-tracing simulations of RF maps. Our results show that RADIANCE achieves a mean average error (MAE) of 0.09, root-mean-squared error (RMSE) of 0.29, peak signal-to-noise ratio (PSNR) of 10.78, and multi-scale structural similarity index (MS-SSIM) of 0.80.

Narrow beams in millimeter-wave (mmWave) communication introduce significant beam misalignment challenges. In this paper, we introduce MAMBA-X, an enhanced version of the MAMBA beam tracking scheme. Basically, MAMBA uses a restless multi-armed bandit framework to capture the dynamics of mmWave links by discounting the relevance of past observations using a “forgetting factor” ($\gamma_{1}$) and increases the weight of recent observations via a “boost factor” ($\gamma_{2}$). Because the original MAMBA uses fixed values for$\gamma_{1}$and$\gamma_{2}$, it cannot quickly adapt to variations in user mobility. Moreover, if the time between consecutive beam selection instances is large compared to channel dynamics, past observations become obsolete. To tackle these issues, we first use the concept of beam coherence time to establish a bound on the beam selection intervals. Secondly, we show that the performance of MAMBA depends primarily on the value of$\gamma_{1}$which, in turn, depends on UE mobility. We develop a Long Short-Term Memory (LSTM) model to dynamically predict and update the optimal value of$\gamma_{1}$. Through extensive simulations at 28 GHz and using publicly available 5G NR experimental dataset, we evaluate MAMBA-X. Our results indicate that the total delivered traffic is improved by up to 46.8% relative to the original MAMBA and 142% compared to the default beam management scheme in 5G NR.

Bluetooth Low Energy (BLE) has become an intrinsic wireless technology for the Internet of Things (IoT). With the proliferation of BLE-embedded IoT devices, it is important to study the security and privacy implications of BLE. The forefront attack to BLE devices is the wireless sniffing attack, which would lead to more detrimental threats like jamming, encryption cracking or system penetration. Existing sniffing attacks are based on the correct detection of BLE connection initiation state, but they become ineffective for BLE long-lived connections. In this paper, we focus on the adversary setting with a low-cost single radio and develop a suite of real-time algorithms to determine the key parameters necessary to follow and sniff a BLE connection in the connected state. We implement our algorithms in the open source platform - Ubertooth One and evaluate its performance in terms of sniffing overhead and accuracy. By comparing with state-of- the-art schemes, experimental results show that our sniffer achieves much higher sniffing accuracy (over 80%) and better stability to BLE operational dynamics.