Wireless local area networks remain vulnerable to attacks initiated during the connection establishment (CE) phase. Even the latest Wi-Fi security protocols fail to fully mitigate threats such as man in the middle, preamble spoofing, and relaying. To fortify the CE phase, this paper presents a backwardcompatible scheme, reinforced with timing constraints, that interweaves a medium access control (MAC) layer digital signature into the preamble signals at the physical (PHY) layer to counter these attacks. The approach slices the signature and embeds the slices within CE frame preambles without extending frame size, allowing one or multiple stations to concurrently verify their respective APs' transmissions in enterprise and public Wi-Fi networks. The scheme supports concurrent CEs by enabling each station to analyze the consistent patterns of PHY-layer headers to determine whether the received frames are the anticipated ones from the expected APs, achieving 100% accuracy without needing to inspect MAC layer headers. Additionally, we design and implement a fast relay attack to challenge our defense's effectiveness. We extend existing open-source tools to support IEEE 802.11ax to evaluate the effectiveness and practicality of our scheme on a testbed consisting of universal software radio peripherals (USRPs), commercial APs, and Wi-Fi devices. Our results show that the proposed relay attack detection achieves 96-100% true positive rates. Finally, end-to-end formal analyses confirm the security and correctness of the proposed solution.

Malicious entities abuse advanced modulation classification (MC) techniques to launch traffic analysis, selective jamming, evasion, and poison attacks. Recent studies show that current defenses against such attacks are static in nature and vulnerable to persistent adversaries who invest time and resources into learning the defenses, thereby being able to design and execute more sophisticated attacks to circumvent them. In this paper, we present a moving-target defense framework to support a novel modulation-masking mechanism we develop against advanced and persistent MC attacks. The modulated symbols are first masked using small perturbations to make them appear to an adversary in a state of ambiguity about the model as if they are from another modulation scheme. By deploying a pool of deep learning models and perturbation-generating techniques, our defense strategy keeps changing (moving) them as needed, making it difficult (cubic time complexity) for adversaries to keep up with the evolving defense system over time. We show that the overall system performance remains unaffected under our technique. We further demonstrate that, over time, a persistent adversary can learn and eventually circumvent our masking technique, along with other existing defenses, unless a moving target defense approach is adopted.

To establish a secure Wi-Fi connection, a station first exchanges several unprotected management frames with an access point (AP) to eventually authenticate each other and install a pairwise key. It is, therefore, possible for an adversary to spoof elements of those unprotected frames at the physical (PHY) or MAC layers, facilitating additional attacks (e.g., man-in-the-middle and starvation attacks). Despite a few ad hoc efforts, there is still no practical way to counter these attacks jointly. In this paper, we propose practical schemes to employ cryptography at the PHY layer combined with a time-bound technique to detect and mitigate such attacks in enterprise and 802.1X-based public networks. Our backward-compatible schemes embed a digital signature of the AP (or a message authentication code) in frame preamble signals and add only a negligible delay to the connection establishment process and achieve a 98.9% true positive rate in detecting an attacker who tries to relay valid preambles. Furthermore, we conduct a formal security analysis of our scheme using a model checker and a cryptographic protocol verifier and evaluate its performance in a commercial AP-and-USRP~testbed.

Modulation classification (MC) has a wide range of applications in spectrum sharing, management, and enforcement and can also be used by an adversary to launch traffic analysis or selective jamming. While recent modulation obfuscation techniques show promising results in mitigating MC attacks, in this paper we develop a novel convolution neural network (CNN)-based model to attack those defenses and successfully identify the true modulation scheme. Our extensive simulation and over-the-air experiments using show that our classification technique achieves around 85-99% accuracy for SNR levels 0 dB and above. Furthermore, our results demonstrate that the proposed model can effectively differentiate between obfuscated and non-obfuscated symbols, even when a transmitter switches between them as a new defense mechanism, achieving an accuracy of 95%.

Despite being primarily developed for spectrum management, sharing, and enforcement in civilian and military applications, modulation classification can be exploited by an adversary to threaten user privacy (e.g., via traffic analysis), or launch jamming and spoofing attacks. Several existing works study how an adversary can still classify the user traffic despite obfuscation techniques at upper layers, but little work has been done on how an adversary can classify the "modulation scheme'' when it is obfuscated at the physical layer. In this respect, we aim to study how to break the state-of-the-art modulation obfuscation schemes by applying various machine learning (ML) methods. Our preliminary results show that common ML techniques perform poorly in correctly classifying an obfuscated modulation scheme except for the random forest method (with a score as much as twice the other techniques we consider), providing insights on why other techniques, e.g., deep learning, might be more promising for finding underlying correlations.