Spatial-temporal beam spoofing (STBS) poses a severe security threat to integrated sensing and communication (ISAC) systems by deliberately manipulating signal properties to fabricate deceptive target echoes, thereby undermining the sensing accuracy and evading the current security measures through the spatial masking and asynchronous injection. To combat this intelligent attack in ISAC, we proposes a beam consistency anomaly detection (BCAD) method, which establishes a physics-constrained verification procedure based on inherent propagation properties of legitimate signals. The proposed BCAD method systematically incorporates essential signal consistency requirements, such as array steering vector coherence, Doppler shift linearity, and phase progression consistency, into multivariate polynomial formulations. It then utilizes sum-of-squares relaxation to rigorously verify the global non-negativity of these polynomials across the entire parameter space encompassing angle-of-arrival, delay, and Doppler shift. This verification process confirms the physical legitimacy of the signal, and a negative result reveals violations of the transmission continuity constraint caused by STBS. Numeric results are presented to show the detection performance of the proposed BCAD method.

In this paper, we explore the vulnerability of the physical uplink shared channel (PUSCH) to a new smart jamming attack in fifth generation (5G) new radio (NR), where an intelligent adversary first executes its attack by sniffing the downlink control information (DCI)-indicated resource scheduling information and then disrupts the PUSCH data transmission effectively and covertly by the precise jamming. To combat such kind of DCI sniffing based smart jamming (DCIS-SJ), we propose a novel method for effective DCIS-SJ suppression leveraging the DCI-scheduled subset identification and the PUSCH resource reconstruction. Our method fundamentally relies on the differences in the spatial domain feature under available control channel elements and resource block group granularities between legitimate users and the DCIS-SJ attacker, to selectively exclude unwanted elements while safeguarding the authenticity of the targeted transmissions. Numerical results evaluate and confirm the effectiveness of our method.

For mission-critical massive machine-type communications (mMTC) applications, the messages are required to be delivered in real-time. However, due to the weak security protection capabilities of the low-cost and low-complexity machine-type devices, active jamming attack in the uplink access is a serious threat. Uplink access jamming (UAJ) can increase the number of dropped/retransmitted packets and restrict or prevent the normal device access. To tackle this vital and challenging problem, we propose a novel UAJ detection method based on the joint space-time sparsity (JSTS). Our key insight is that the JSTS-based feature will be significantly impacted if UAJ happens, since only a small fraction of the devices are active and the traffic pattern for each device is sporadic in the normal state. Unlike the existing detection methods under batch mode (i.e., all sample observations are collected before making a decision), the JSTS-based detection is performed in a sequential manner by processing the received signals one by one, which can detect UAJ as quickly as possible. Moreover, the proposed JSTS-based method does not rely on the prior knowledge of the attackers, since it only cares the abrupt change in the JSTS-based feature on each frame. Numerical results evaluate and confirm the effectiveness of our method.

In this paper, we investigate the design of a burst jamming detection method for delay-sensitive Internet-of-Things (IoT) applications. In order to obtain a timely detection of burst jamming, we propose an online principal direction anomaly detection (OPDAD) method. We consider the one-ring scatter channel model, where the base station equipped with a large number of antennas is elevated at a high altitude. In this case, since the angular spread of the legitimate IoT transmitter or the jammer is restricted within a narrow region, there is a distinct difference of the principal direction of the signal space between the jamming attack and the normal state. Most of existing binary hypothesis test based works cannot apply to detect burst jamming, because the attackers’ target time window does not match with the legitimate transmission. Unlike existing statistical features based batching methods, the proposed OPDAD method adopts an online iterative processing mode, which can quickly detect the exact attack time block instance by analyzing the newly coming signal. In addition, our detection method does not rely on the prior knowledge of the attacker, because it only cares the abrupt change in the principal direction of the signal space. Moreover, based on the high spatial resolution and the narrow angular spread, we provide the convergence rate estimate and derive a nearly optimal finite sample error bound for the proposed OPDAD method. Numerical results show the excellent real time capability and detection performance of our proposed method.

Due to the weak security protection capabilities of the low-cost and low-complexity massive access of machine-type devices, massive machine-type communications (mMTC) networks are extremely vulnerable to the access jamming, which can affect the correctness of activity and data detection of legitimate devices and even leads to the paralysis of the mission-critical mMTC applications. This paper studies detection problem of the access jamming in the uplink of mMTC (AJ-UM), and we propose to exploit the characteristics of the joint low-rank factor and sparsity (JLFS) to detect the AJ-UM. Our detection method is motivated by the fact that the JLFS-based feature will be significantly impacted if the AJ-UM happens. We first extract the JLFS-based feature by solving a low-rank maximum likelihood factor analysis problem with sparsity constraint, and then perform the AJ-UM detection in a sequential manner. Moreover, the proposed JLFS-based method does not need to know the accurate prior information of the JLFS-based feature in the presence or absence of the AJ-UM, which can determine the AJ-UM exists as long as there is an abrupt change in the JLFS-based feature. Numerical results are finally presented to confirm the effectiveness of the proposed JLFS-based method.