We study the security aspects of remote state estimation within Cyber-Physical Systems (CPSs), where a sensor transmits its measurements to a remote state estimator over a multi-channel wireless link amidst a Denial-of-Service (DoS) attack. Existing literature primarily focuses on sensor defense schemes against non-adaptive DoS attackers, relying on prior knowledge of the attacker’s strategy alongside limited channel sensing capabilities. These studies assume either stationary or heuristic behavior from one party while exploring countermeasures from the other. To relax this constraint, we propose that both sensors and attackers employ online learning-based policies to select channels for packet transmission and for emitting jamming signals, respectively. We formulate the problem as an online learning-based repeated two-player constant-sum game, aiming to examine the stability of the remote state estimator. First, we show that both the sensor’s and attacker’s channel selection strategies adapt to each other, resulting in mutually optimal responses in the infinite-horizon scenario. Furthermore, we establish the asymptotic stability condition of the remote state estimator with respect to the number of wireless communication channels and the CPS critical value. Finally, we extend our analysis to scenarios where the DoS attacker targets more than one channel simultaneously, identifying the function by which the estimator’s stability region contracts as the number of attacked channels increases. Through extensive numerical evaluations under various CPS parameters, we analyze the mutual behavior of both entities and validate our analytical findings.

We study a family of adversarial (a.k.a. nonstochastic) multi-armed bandit (MAB) problems, wherein not only the player cannot observe the reward on the played arm (self-unaware player) but also it incurs switching costs when shifting to another arm. We study two cases: In Case 1, at each round, the player is able to either play or observe the chosen arm, but not both. In Case 2, the player can choose an arm to play and, at the same round, choose another arm to observe. In both cases, the player incurs a cost for consecutive arm switching due to playing or observing the arms. We propose two novel online learning-based algorithms each addressing one of the aforementioned MAB problems. We theoretically prove that the proposed algorithms for Case 1 and Case 2 achieve sublinear regret of O(√[4]KT3lnK) and O(√[3](K-1)T2lnK) , respectively, where the latter regret bound is order-optimal in time, K is the number of arms, and T is the total number of rounds. In Case 2, we extend the player's capability to multiple observations and show that more observations do not necessarily improve the regret bound due to incurring switching costs. However, we derive an upper bound for switching cost as c ≤ 1/√[3]m2 for which the regret bound is improved as the number of observations increases. Finally, through this study, we found that a generalized version of our approach gives an interesting sublinear regret upper bound result of [Formula: see text] for any self-unaware bandit player with s number of binary decision dilemma before taking the action. To further validate and complement the theoretical findings, we conduct extensive performance evaluations over synthetic data constructed by nonstochastic MAB environment simulations and wireless spectrum measurement data collected in a real-world experiment.

Physical-layer fingerprinting is a promising technique to identify Internet of Things (IoT) devices. In this article, we investigate a new radio-frequency (RF) fingerprinting based on the distinctive signal-to-noise-ratio (SNR) trace in the sector-level sweep (SLS) procedure of 5G IEEE 802.11ad devices. This SLS SNR trace-based fingerprinting can directly apply to off-the-shelf devices without any extra hardware requirements and be independent of the wireless channel and environment. To tackle the impact of orientation on the RF fingerprinting, we propose a novel fingerprinting framework, involving correlation analysis, surface fitting, curve pursuing, and binary classification, named the CSCB framework. Using this framework, the proposed SLS SNR trace-based fingerprinting can achieve device authentication at any orientation with one receiver under line-of-sight (LOS) or non-LOS (NLOS) scenarios. We conduct proof-of-concept experiments using off-the-shelf IEEE 802.11ad devices (Talon AD7200 and MG360 WiGig) to evaluate the performance of the proposed fingerprinting schemes. Experimental results show the effectiveness of the proposed fingerprinting schemes where the verification accuracy of the proposed scheme can reach 99% with only 200 training samples.

Recently, networks operate at frequencies over 28 GHz (mmWave) have emerged as a viable solution for 5G mobile networks to provide Gbps data rate. Due to the high directivity and attenuation of mmWave signals, mmWave communication links are highly vulnerable to the frequent mmWave channel blockages, which can trigger excessive handovers. Thanks to its ability to enrich the scattering environment and create reflective signal multipaths, Reconfigurable Intelligent Surface (RIS) has great potential to counter the blockage effect and thus greatly reduce the number of unnecessary handovers. However, this potential has not been well explored. In this paper, we propose a RIS-assisted handover scheme by leveraging deep reinforcement learning (DRL). Under various channel blockage conditions, the DRL agent manages to reduce the cumulative handover overhead by jointly adjusting beamformers and RIS phase shifts. Compared with the existing schemes without considering RIS, the RIS-assisted handover scheme significantly reduces the number of handovers and achieves higher spectrum efficiency. Besides, to alleviate the impact from the limited observations of the fast fading channels, we propose a lightweight algorithm to sense the blockage status and such sensing results can be utilized to improve the performance of model training. Numerical results show that DRL agent is able to further improve the performance when integrated with the blockage status sensing algorithm.

We study security of remote state estimation in wireless cyber-physical systems (CPS) where a sensor sends its measurements to the remote state estimator over a multichannel wireless link in presence of a jamming attacker. Most of the existing works study the sensor's defense scheme by adopting optimization-based methods and rely on the prior knowledge of the attacker's attack policy. To relax this constraint, we propose a novel online-learning-based policy called joint channel and power selection (J-CAP) for the sensor to dynamically choose transmission channel and power. The proposed method assumes no prior knowledge of the attacker's attack policy, nor of the channel state information. J-CAP jointly optimizes sensor's channel selection and power consumption, and guarantees the estimator's asymptotic stability. We theoretically prove that J-CAP achieves a sublinear learning regret bound. We also show J-CAP's optimality by deriving and matching its regret lower and upper bound orders. Compared with the solution that directly applies the baseline solution, J-CAP improves the regret upper bound by a factor of √{K+L}, where K and L denote the number of channels and number of power levels, respectively. Numerical evaluations validate the analytical results under various CPS parameters, and compare the J-CAP's performance with the state-of-the-art solutions.

Grant-free random access is an emerging technology for providing massive connectivity for 5G massive machine-type communications (mMTC), where non-orthogonal pilot sequences are used to simultaneously detect active users and estimate channels. However, grant-free 5G IoT networks are vulnerable to pilot contamination attacks (PCA), where the attacker can send the same pilots as legitimate IoT users to harm the active user detection and channel estimation. To defend against this attack, in this article, we propose a physical-layer countermeasure based on the channel virtual representation (CVR). CVR can emphasize the unique characteristics of mmWave channels that are sensitive to the location of the sender. This can be utilized to counter PCA no matter if the attacker's pilots are superimposed to that of the victim or not. Based on this observation, to achieve an efficient PCA detection, a single-hidden-layer multiple measurement (SHMM) Siamese network is employed. This solution tackles the challenges of channel randomness and massive connectivity in mMTC IoT networks, and supports small sample learning. Simulation results evaluate and confirm the effectiveness of the proposed detection scheme under various scenarios. The detection accuracy can approach 99% with 128 antennas at the receiver and reach above 95% even with only 50 training samples.

With the rapid growth of real-time machine learning applications, the process of feature selection and model optimization requires to integrate with the constraints on computational budgets. A specific computational resource in this regard is the time needed for evaluating predictions on test instances. The joint optimization problem of prediction accuracy and prediction-time efficiency draws more and more attention in the data mining and machine learning communities. The runtime cost is dominated by the feature generation process that contains significantly redundant computations across different features that sharing the same computational component in practice. Eliminating such redundancies would obviously reduce the time costs in the feature generation process. Our previous Cost-aware classification using Feature computational dependencies heterogeneous Hypergraph (CAFH) model has achieved excellent performance on the effectiveness. In the big data era, the high dimensionality caused by the heterogeneous data sources leads to the difficulty in fitting the entire hypergraph into the main memory and the high computational cost during the optimization process. Simply partitioning the features into batches cannot give the optimal solution since it will lose some feature dependencies across the batches. To improve the high memory and computational costs in the CAFH model, we propose an equivalent Accelerated CAFH (ACAFH) model based on the lossless heterogeneous hypergraph decomposition. An efficient and effective nonconvex optimization algorithm based on the alternating direction method of multipliers (ADMM) is developed to optimize the ACAFH model. The time and space complexities of the optimization algorithm for the ACAFH model are three and one polynomial degrees less than our previous algorithm for the CAFH model, respectively. Extensive experiments demonstrate the proposed ACAFH model achieves competitive performance on the effectiveness and much better performance on the efficiency.

Nonorthogonal multiple access (NOMA) technology can significantly promote Internet-of-Things (IoT) networks on spectral efficiency and massive connectivity. However, NOMA-IoT communications are vulnerable to pilot contamination attacks, where the attacker can send the same pilot signals as legitimate IoT users. Most existing countermeasures to this physical-layer threat struggle to adapt to NOMA-IoT networks, in which superimposed signals appear and low-cost IoT devices exist. In this article, we propose a compressed-sensing-based detection scheme to defend against pilot contamination attacks in NOMA-IoT networks. In particular, we present a multiple measurement vector (MMV) compressed sensing model and a security spreading code generation (SSCG) framework to prevent pilot contamination attacks from spoofing base station (BS) in NOMA-IoT networks. Furthermore, to efficiently reconstruct the superimposed signals based on the SSCG framework, a matching pursuit (MP) multiple response sparse Bayesian learning (MSBL) algorithm (MP-MSBL) is proposed. The security analysis and algorithm complexity of the proposed algorithms are provided. The simulation results evaluate and confirm the effectiveness of the proposed detection schemes. The reconstruction and detection accuracy of pilots can be higher than 99% under different scenarios.

The consumer unmanned aerial vehicle (UAV) market has grown significantly over the past few years. Despite its huge potential in spurring economic growth by supporting various applications, the increase of consumer UAVs poses potential risks to public security and personal privacy. To minimize the risks, efficiently detecting and identifying invading UAVs is in urgent need for both invasion detection and forensics purposes. Aiming to complement the existing physical detection mechanisms, we propose a machine learning-based framework for fast UAV identification over encrypted Wi-Fi traffic. It is motivated by the observation that many consumer UAVs use Wi-Fi links for control and video streaming. The proposed framework extracts features derived only from packet size and inter-arrival time of encrypted Wi-Fi traffic, and can efficiently detect UAVs and identify their operation modes. In order to reduce the online identification time, our framework adopts a re-weighted ℓ1-norm regularization, which considers the number of samples and computation cost of different features. This framework jointly optimizes feature selection and prediction performance in a unified objective function. To tackle the packet inter-arrival time uncertainty when optimizing the trade-off between the detection accuracy and delay, we utilize maximum likelihood estimation (MLE) method to estimate the packet inter-arrival time. We collect a large number of real-world Wi-Fi data traffic of eight types of consumer UAVs and conduct extensive evaluation on the performance of our proposed method. Evaluation results show that our proposed method can detect and identify tested UAVs within 0.15-0.35s with high accuracy of 85.7-95.2%. The UAV detection range is within the physical sensing range of 70m and 40m in the line-of-sight (LoS) and non-line-of-sight (NLoS) scenarios, respectively. The operation mode of UAVs can be identified with high accuracy of 88.5-98.2%.

Power non-orthogonal multiple access (NOMA) has been considered as a new enabling technology in 5G communication. In this paper, we introduce the problem of pilot contamination attack (PCA) on NOMA in millimeter wave (mmWave) and massive MIMO 5G communication. Due to the new characteristics of NOMA such as superposed signals with multi-users, PCA detection faces new challenges. By harnessing the sparseness and statistics of mmWave and massive MIMO virtual channel, we propose two effective PCA detection schemes for NOMA tackling static and dynamic environments, respectively. For the static environment, the problem of PCA detection is formulated as a binary hypothesis test of the virtual channel sparsity. For the dynamic environment, the statistic of the peaks in the virtual channel is leveraged to distinguish the contamination state from the normal state. A peak estimation algorithm and a machine learning based detection framework are proposed to achieve high detection performance. To further optimize the proposed scheme, a feature selection algorithm and an optimization model considering the detection accuracy and detection delay are presented. Simulation results evaluate and confirm the effectiveness of the proposed detection schemes. The detection rate can approach 100% with 10-3false alarm rate in the static environment and above 95% in the dynamic environment under various system parameters.

At present, object recognition studies are mostly conducted in a closed lab setting with classes in test phase typically in training phase. However, real-world problem are far more challenging because: i)~new classes unseen in the training phase can appear when predicting; ii)~discriminative features need to evolve when new classes emerge in real time; and iii)~instances in new classes may not follow the "independent and identically distributed" (iid) assumption. Most existing work only aims to detect the unknown classes and is incapable of continuing to learn newer classes. Although a few methods consider both detecting and including new classes, all are based on the predefined handcrafted features that cannot evolve and are out-of-date for characterizing emerging classes. Thus, to address the above challenges, we propose a novel generic end-to-end framework consisting of a dynamic cascade of classifiers that incrementally learn their dynamic and inherent features. The proposed method injects dynamic elements into the system by detecting instances from unknown classes, while at the same time incrementally updating the model to include the new classes. The resulting cascade tree grows by adding a new leaf node classifier once a new class is detected, and the discriminative features are updated via an end-to-end learning strategy. Experiments on two real-world datasets demonstrate that our proposed method outperforms existing state-of-the-art methods.

The fifth generation (5G) wireless technologies serve as a key propellent to meet the increasing demands of the future Internet of Things (IoT) networks. For wireless communication security in 5G IoT networks, physical-layer security (PLS) has recently received growing interest. This paper aims to provide a comprehensive survey of the PLS techniques in 5G IoT communication systems. The investigation consists of four hierarchical parts. In the first part, we review the characteristics of 5G IoT under typical application scenarios. We then introduce the security threats from the 5G IoT physical-layer and categorize them according to the different purposes of the attacker. In the third part, we examine the 5G communication technologies in 5G IoT systems and discuss their challenges and opportunities when coping with physical-layer threats, including massive multiple-input-multiple-output (MIMO), millimeter wave (mmWave) communications, nonorthogonal multiple access (NOMA), full-duplex technology, energy harvesting (EH), visible light communication (VLC), and unmanned aerial vehicle (UAV) communications. Finally, we discuss open research problems and future works about PLS in the IoT system with technologies of 5G and beyond.

As machine learning methods are utilized in more and more real-world applications involving constraints on computational budgets, the systematic integration of such constraints into the process of model selection and model optimization is required to an increasing extent. A specific computational resource in this regard is the time needed for evaluating predictions on test instances. There is meanwhile a substantial body of work concerned with the joint optimization of accuracy and test-time efficiency by considering the time costs of feature generation and model prediction. During the feature generation process, significant redundant computations across different features occur in many applications. Although the elimination of such redundancies would reduce the time cost substantially, there has been little research in this area due to substantial technical challenges involved, especially: 1) the lack of an effective formulation for feature computation dependency; and 2) the nonconvex and discrete nature of the optimization over feature computation dependency. In order to address these problems, this paper first proposes a heterogeneous hypergraph to represent the feature computation dependency, after which a framework is proposed that jointly optimizes the accuracy and the exact test-time cost based on a given feature computational dependency. A continuous tight approximation to this original problem is proposed based on a non-monotone nonconvex regularization term. Finally, an effective nonconvex optimization algorithm is proposed to solve the problem, along with a theoretical analysis of the convergence conditions. Extensive experiments on eight synthetic datasets and six real-world datasets demonstrate the proposed models' outstanding performance in terms of both accuracy and prediction-time cost.

Cognitive radio (CR) is considered as a key enabling technology for dynamic spectrum access to improve spectrum efficiency. Although the CR concept was invented with the core idea of realizing "cognition", the research on measuring CR cognition capabilities and intelligence is largely open. Deriving the intelligence capabilities of CR not only can lead to the development of new CR technologies, but also makes it possible to better configure the networks by integrating CRs with different intelligence capabilities in a more cost- efficient way. In this paper, for the first time, we propose a data-driven methodology to quantitatively analyze the intelligence factors of the CR with learning capabilities. The basic idea of our methodology is to run various tests on the CR in different spectrum environments under different settings and obtain various performance results on different metrics. Then we apply factor analysis on the performance results to identify and quantize the intelligence capabilities of the CR. More specifically, we present a case study consisting of sixty three different types of CRs. CRs are different in terms of learning-based dynamic spectrum access strategies, number of sensors, sensing accuracy, and processing speed. Based on our methodology, we analyze the intelligence capabilities of the CRs through extensive simulations. Four intelligence capabilities are identified for the CRs through our analysis, which comply with the nature of the tested algorithms.