The exponential growth of Wi-Fi-enabled devices and the changing nature of online activities highlight the urgent need to find innovative solutions to solve the ever-growing spectrum crunch. To address this challenge, the IEEE 802.11ax standard breaks away from traditional approaches leveraged in previous standards by jointly enabling orthogonal frequency-division multiple-access (OFDMA) and multi-user MIMO (MU-MIMO). While IEEE standardization groups are working to increase the network capacity (IEEE 802.11be) and its reliability (IEEE 802.11bn), there are still serious security issues in Wi-Fi. Some recent work has revealed that MU-MIMO transmissions can be thwarted by a malicious user that interferes with the procedure followed to set up simultaneous transmissions to multiple stations (STAs). In this work, we show that a similar attack is also effective in OFDMA MU-MIMO transmissions. Specifically, a malicious user in the network can alter the precoding procedure by transmitting adversarial feedback during the channel sounding phase, thus increasing the bit error rate (BER) experienced by legitimate STAs to up to 0.5 depending on the portion of feedback that is poisoned. We shared the code to implement our attack for reproducibility purposes and to ease its integration into digital twin frameworks of Wi-Fi networks to study and evaluate effective countermeasures.

There has been significant progress in Wi-Fi sensing applications pertaining to home surveillance, remote healthcare, and home entertainment among others. However, most of the work leverages manual extraction of Channel State Information (CSI) from Wi-Fi network interface card (NIC) and targets single-subject sensing. In this work, we devise a simultaneous multi-subject sensing strategy that can adapt to different environments and people being monitored. Si-FI leverages standard-compliant beamforming feedback information (BFI) as a proxy of CSI to characterize the propagation environment. Unlike CSI, BFI (i) can be captured without any firmware modifications and (ii) captures the multiple channels between the access point and the stations without any direct access to the sensing devices. Thus, conversely, from existing work, the edge server in Si-FI records the BFI of the channels between Access Point (AP) and all the stations (STAs) (sensing devices) with a single capture, reducing the channel occupation, transmission and system latency dramatically. To achieve generalization over unseen environments and people, we develop a few-shot learning algorithm named Si-FI FREL to operate with beamforming feedback angles (BFAs) (compressed BFI). We validate Si-FI through an extensive data collection campaign in 3 different environments and 3 subjects performing 20 different activities simultaneously. We demonstrate that Si-FI achieves classification accuracy of up to 99 %, while Si-FI FREL improves the accuracy up to 27 % when compared to the state-of-the-art domain adaptation algorithm. Si-FI reduces the system latency by 50 % and channel occupation by 110 KB per sample for each sensing device compared to the state-of-the-art simultaneous multi-subject sensing work.

While artificial intelligence (AI) is improving the performance of O-RAN, it will also expose the network to adversarial machine learning (AML) attacks. For this reason, in this paper, we are the first to investigate AML in the context of deep reinforcement learning (DRL)-based O-RAN xApps. What separates AML in O-RAN from traditional settings is the need to design and analyze adversarial attacks based on RAN-specific Key Performance Measures (KPMs) such as transmitted bit rate, downlink buffer occupancy, transmitted packets, etc. As such, we propose the AdvO-RAN framework, which includes (i) a new adversarial perturbation generator using preference-based reinforcement learning (PbRL) to learn the perturbation that most violate the user service level agreements (SLA) and (ii) a robust training module for enhancing DRL agent resilience to the attacks in (i). We experimentally evaluate AdvO-RAN on the Colosseum network emulator. Experimental results show that AdvO-RAN can enhance xApp performance by reducing SLA violations from 44% to 27% on average and reducing by 46% the latency under the most challenging attack scenario for Ultra-Reliable Low-Latency Communications (URLLC) traffic. AdvO-RAN can improve up to 75% of throughput in the victim Enhanced Mobile Broadband (eMBB) slice users during a constant bit-rate traffic scenario.

The performance of multiple-input, multiple-output (MIMO) systems highly depends on the precision of channel estimates provided by the mobile users. However, the current Wi-Fi standard requires an update interval of 10 ms, irrespective of the channel dynamics. This imposes a substantial overhead for the MIMO channel estimation. Recent work mainly targets different compression strategies, potentially compromising precoding accuracy and, in turn, the network performance. In stark opposition, we propose SHRINK, a framework to dynamically adapt the feedback transmission rate to the propagation environments and performance requirements. SHRINK determines whether the users should send back their channel estimates by predicting network performance through a data-driven analysis of prior and current channel estimates. We have experimentally evaluated SHRINK using off-the-shelf Wi-Fi devices in multiple environments, including an anechoic chamber, and benchmarked its performance against several state-of-the-art approaches. Experimental results show that SHRINK reduces airtime and data overhead by 81% on average compared to the IEEE 802.11 standard without impacting the precoding performance. Moreover, SHRINK outperforms state-of-the-art approaches by an average gain of 33.6% in airtime and data overhead reduction, corresponding to an increase in throughput of 24.5%.

Radio Frequency Fingerprinting (RFF) is a critical technology for enhancing physical-layer security by leveraging the unique RF characteristics of hardware, enabling authentication and anti-counterfeiting for wireless communication devices. In recent years, Deep Learning (DL) has been extensively applied in$R$FF, significantly improving identification accuracy and efficiency. However, DL- based RFF methods still encounter challenges regarding robustness, particularly in cross-channel scenarios. To address these challenges, we propose a channel-robust RFF method based on a Multi-Scale Convolutional Attention Network (MSCAN) with Random Overlay Augmentation (ROA). Specifically, MSCAN extracts and fuses features at different scales, allowing it to capture more comprehensive signal characteristics. Additionally, ROA is a combinatorial data augmentation (DA) strategy designed to simulate diverse characteristics of wireless propagation environments, thereby enhancing the adaptability and robustness of RFF in complex channel conditions. Experiments conducted on the ORACLE dataset demonstrate that our proposed method achieves over 92 % accuracy in cross-channel scenarios, outperforming the previously proposed DA strategy. The codes will be published in GitHub11https://github.com/BeechburgPieStar/SDG-for-Robust-SEI

The rapid increase in wireless devices has raised significant security and privacy concerns, positioning Specific Emitter Identification (SEI) as a crucial physical-layer security technology. While Deep Learning (DL) has been widely applied to SEI, it often requires large amounts of high-quality signal examples, which are laborious and expensive to obtain. Moreover, the DL-enabled SEI models have difficulties in extracting features from the signal examples in the testing process that are consistent with those from the signal examples in the training phase due to the wireless channel variations, further resulting in a significant reduction in identification performance. To address these challenges, we propose a channel-robust Few-Shot SEI (FS-SEI) method based on Meta-Feature Augmentation (MFA). Our approach utilizes datasets from base emitters to construct a meta-feature embedding function that can extract generalizable features from a few signal examples of target emitters. We then calculate and calibrate the statistics of these extracted features to describe the feature distribution of target emitters. A Multi-Layer Perceptron (MLP) is subsequently trained on both original and augmented features derived from this distribution, achieving a robust FS-SEI model. Experiments conducted on a Wi-Fi dataset comprising 16 emitter categories - 10 as base emitters and 6 as target emitters - demonstrate that our method achieves 93.75% identification accuracy with only 5 examples per target emitter, maintaining 92.56% accuracy even under varying wireless channel conditions. Code is available at https://github.com/lovelymimola/MFA-based-FS-SEI.

In this paper, we present MAGIC, a novel approach to gesture recognition utilizing mmWave multiple-input multiple-output (MIMO) Channel State Information (CSI). Unlike existing mmWave gesture recognition methods that often rely on radar signals, MAGIC leverages CSI extracted from mmWave MIMO integrated sensing and communication (ISAC) systems. While advanced radar systems, such as those operating in frequency-modulated continuous wave (FMCW) mode, can achieve high frequency and spatial resolution, they typically require dedicated sensing infrastructure, which increases system complexity. In contrast, MAGIC utilizes high-granular CSI from orthogonal frequency-division multiplexing (OFDM) systems, enabling fine spatial, temporal, and frequency-domain information for robust gesture recognition. This eliminates the need for dedicated radar transceivers, simplifying the system and reducing transmission overhead. MAGIC employs a learning-based architecture, integrating a temporal convolutional network (TCN) to classify gestures by capturing long-range temporal dependencies. To address the critical challenge of domain adaptation in gesture recognition, we propose adaptive temporal embedding network (ATEN), a meta-learning framework that combines the temporal modeling capabilities of TCN with task-specific adaptation mechanisms. We evaluateMAGIC through a comprehensive data collection campaign involving two subjects performing 10 micro gestures across three different environments, with synchronized video streams providing the ground truth. The proposed system achieves a baseline accuracy of 99.24% using TCN. The system continues to perform well – achieving up to 98.82% accuracy – when adapting to new domains using ATEN, outperforming other state-of-the-art domain adaptation methods by 14% on average.

Today, Wi-Fi is over 25 years old. Yet, despite sharing the same branding name, today’s Wi-Fi boasts entirely new capabilities that were not even on the roadmap 25 years ago. This article aims to provide a holistic and comprehensive technical and historical tutorial on Wi-Fi, beginning with Institute of Electrical and Electronics Engineers 802.11b (Wi-Fi 1) and looking forward to IEEE 802.11bn (Wi-Fi 8). This is the first tutorial article to span these eight generations. Rather than a generation-by-generation exposition, we describe the key mechanisms that have advanced Wi-Fi. We begin by discussing spectrum allocation and coexistence, and detailing the IEEE 802.11 standardization cycle. Second, we provide an overview of the physical layer (PHY) and describe key elements that have enabled data rates to increase by over 1000×. Third, we describe how Wi-Fi medium access control (MAC) has been enhanced from the original distributed coordination function (DCF) to now include capabilities spanning from frame aggregation to wideband spectrum access. Fourth, we describe how Wi-Fi 5 first broke the one-user-at-a-time paradigm and introduced multi-user (MU) access. Fifth, given the increasing use of mobile, battery-powered devices, we describe Wi-Fi’s energy-saving mechanisms over the generations. Sixth, we discuss how Wi-Fi was enhanced to seamlessly aggregate spectrum across 2.4-, 5-, and 6-GHz bands to improve throughput, reliability, and latency. Finally, we describe how Wi-Fi enables nearby access points (APs) to coordinate in order to improve performance and efficiency. In the Appendix, we further discuss Wi-Fi developments beyond 802.11bn, including integrated millimeter-wave (IMMW) operations, sensing, security and privacy extensions, and the adoption of artificial intelligence (AI)/machine learning (ML).

In this paper, we present m3MIMO a mmWave fully-digital multi-user multi-input multi-output (MU-MIMO) testbed for advanced wireless research. m3MIMO operates in the 57-64 GHz frequency range and supports up to 1 GHz of bandwidth enabling large data multiplexing in the frequency domain through orthogonal frequency-division multiplexing (OFDM). The testbed features three custom-designed Zynq UltraScale+ RFSoC-based Software Defined Radios (SDRs) empowered with the Pi-Radio fully digital transceivers. Two of these SDRs support eight transmit and receive streams each (8 × 8 MIMO), while the third SDR supports up to four channels. m3MIMO supports three different communication modes: (i) point-to-point (P2P) transmissions; (ii) single-user multi-input multi-output (SU-MIMO), where multiple streams are transmitted to a single end-device; and (iii) MU-MIMO, where two devices are simultaneously served by a single transmitter. To showcase the m3MIMO's versatility, we present two research use cases: tracking-based beamforming and mmWave-based sensing. We will open-source the m3MIMO code along with the relevant use-case datasets, facilitating further analysis1.

Emerging mobile virtual reality (VR) systems are required to continuously perform complex computer vision tasks needing computational power that is excessive for mobile devices. Thus, techniques based on wireless edge computing (WEC) have been recently proposed. However, existing WEC methods require the transmission and processing of a high amount of video data which may ultimately saturate the wireless link. In this paper, we propose a novel sensing-assisted edge computing (ISAC-EC) approach to address this issue. ISAC-EC leverages knowledge about the physical environment to reduce the end-to-end latency and overall computational burden by transmitting to the edge server only the relevant data for the delivery of the service. Our intuition is that the transmission of the portion of the video frames where there are no changes with respect to the previous frames can be avoided. Through wireless sensing, only the part of the frames where any environmental change is detected is transmitted and processed. We evaluated ISAC-EC by using a 10K 360°camera with a Wi-Fi 6 sensing system operating at 160 MHz and performing localization and tracking. Experimental results show that ISAC-EC reduces both the channel occupation and end-to-end latency by more than 90% while improving the instance segmentation and object detection performance with respect to state-of-the-art WEC approaches. For reproducibility purposes, we pledge to share our dataset and code repository.

In this work we present RAPID, the first joint communication and radar system based on next-generation IEEE 802.11ay WiFi networks operating in the 60 GHz band. Unlike existing approaches for human sensing at millimeter-wave frequencies, which rely on special-purpose radars, RAPID achieves radar-level sensing accuracy with IEEE 802.11ay access points, thus avoiding the burden of installing ad-hoc sensors. RAPID enables contactless human sensing applications, such as people tracking, Human Activity Recognition (HAR), and person identification without requiring modifications to the standard packet structure. Specifically, we leverage IEEE 802.11ay beam training to accurately localize and track multiple individuals within the same environment. Then, we propose a new way of using beam tracking to extract micro-Doppler signatures from the time-varying Channel Impulse Response (CIR) estimated fromreflectedpackets. Such signatures are fed to a deep learning classifier to perform HAR and person identification. RAPID is implemented on a cutting-edge IEEE 802.11ay-compatible FPGA platform with phased antenna arrays, and evaluated on a large dataset of CIR measurements. It is robust across different environments and subjects, and outperforms state-of-the-art sub-6 GHz WiFi sensing techniques. Using two access points, RAPID reliably tracks multiple subjects, reaching HAR and person identification accuracies of$94\%$and$90\%$, respectively.

Multi-user MIMO is a key component of modern wireless networks. As such, investigating the related security weaknesses is a compelling necessity. A major issue unveiled by existing work is that adversaries can “poison” the channel information feedback reported to the beamformer to decrease the performance experienced by a legitimate user. Prior work, however, assumes that the feedback is reported in an uncompressed fashion, which is not the case in current wireless standards such as Wi-Fi or 5G. In this work, we first show that assuming uncompressed feedback leads to overestimating the attack effectiveness by up to 60%. Next, we formulateACFP(Adversarial Compressed Feedback Problem), a novel non-convex constrained optimization problem to find the compressed feedback that maximizes a victim’s bit error rate (BER) while satisfying maximum power constraints. We proposeWHACK(Wireless Harmful Adversarial Compressed feedbacK), a new algorithm to solveACFPand find the malicious compressed feedback based on the convexity of the objective function and constraint using a nonlinear conjugate gradient method.WHACKhas been prototyped and extensively evaluated with off-the-shelf Wi-Fi devices. Experimental results show that it maximizes the victim’s BER, while modifying less than 60% of the feedback. Our dataset and code are available.

The effective deployment of smart service systems within homes, workspaces and cities, requires gaining context and situational awareness to take action when changes are detected. To this end, sound classification systems are widely adopted and integrated into several smart devices to continuously monitor the environment. However, sound classification algorithms are prone to adversarial attacks that pose a considerable security threat to smart service systems where they are integrated. In this paper, we devise HIJACK, a novel machine learning framework entailing five neural network strategies to enforce the robustness of sound classification systems to adversarial noise injection. The HIJACK methodologies can be applied to any neural network-based sound classifier and consist of tailored transformations of the input audio during training along with specific additional layers added to the neural network architecture. To assess the noise robustness provided by the HIJACK strategies, we design a measure based on a L2-adversarial attack to sound classification – identified as the normalized fast gradient method (NFGM) – that constructs the adversarial noise by maximizing the sound mis-classification probability. We assessed the robustness of HIJACK to the proposed NFGM attack on a publicly available dataset. The results show that the combination of the five HIJACK strategies allows reaching robustness to adversarial noise 58 times larger than state-of-the-art neural networks for sound classification, guaranteeing a classification accuracy above 83%.

Thanks to the definition of the new IEEE 802.11bf standard, the development of Wi-Fi sensing applications is gaining momentum in the research community. In this regard, several studies have shown that learning-based approaches that leverage the frequency response of the Wi-Fi channel in the sub-7 GHz bands can reach high accuracy in different classification tasks, such as activity recognition, or person identification. Instead, more fine-grained applications – e.g., human localization and tracking, or respiration and heartbeat monitoring – require implementing model-based approaches to estimate the Wi-Fi multi-path parameters and analyze the time evolution of the paths associated with specific targets (the human body or chest). In this paper, we investigate the performance of six super-resolution algorithms for sub-7 GHz multi-path parameter estimation. Our extensive evaluation indicates that the estimation accuracy that can be achieved through commercial devices allows implementing human localization and tracking strategies but is insufficient to effectively design human vital signs monitoring applications due to the limited frequency and spatial diversity. We pledge to release our implementations for further investigations.1

In this article we present SHARP, an original approach for obtaining human activity recognition (HAR) through the use of commercial IEEE 802.11 (Wi-Fi) devices. SHARP grants the possibility to discern the activities of different persons, across different time-spans and environments. To achieve this, we devise a new technique to clean and process the channel frequency response (CFR) phase of the Wi-Fi channel, obtaining an estimate of the Doppler shift at a radio monitor device. The Doppler shift reveals the presence of moving scatterers in the environment, while not being affected by (environment-specific) static objects. SHARP is trained on data collected as a person performs seven different activities in a single environment. It is then tested on different setups, to assess its performance as the person, the day and/or the environment change with respect to those considered at training time. In the worst-case scenario, it reaches an average accuracy higher than$95\%$, validating the effectiveness of the extracted Doppler information, used in conjunction with a learning algorithm based on a neural network, in recognizing human activities in a subject and environment independent way. The collected CFR dataset and the code are publicly available for replicability and benchmarking purposes [1].

We present DeepCSI, a novel approach to Wi-Fi radio fingerprinting (RFP) which leverages standard-compliant beamforming feedback matrices to authenticate MU-MIMO Wi-Fi devices on the move. By capturing unique imperfections in off-the-shelf radio circuitry, RFP techniques can identify wireless devices directly at the physical layer, allowing low-latency low-energy cryptography-free authentication. However, existing Wi-Fi RFP techniques are based on software-defined radio (SDRs), which may ultimately prevent their widespread adoption. Moreover, it is unclear whether existing strategies can work in the presence of MU-MIMO transmitters – a key technology in modern Wi-Fi standards. Conversely from prior work, DeepCSI does not require SDR technologies and can be run on any low-cost Wi-Fi device to authenticate MU-MIMO transmitters. Our key intuition is that imperfections in the transmitter’s radio circuitry percolate onto the beamforming feedback matrix, and thus RFP can be performed without explicit channel state information (CSI) computation. DeepCSI is robust to inter-stream and inter-user interference being the beamforming feedback not affected by those phenomena. We extensively evaluate the performance of DeepCSI through a massive data collection campaign performed in the wild with off-the-shelf equipment, where 10 MU-MIMO Wi-Fi radios emit signals in different positions. Experimental results indicate that DeepCSI correctly identifies the transmitter with an accuracy of up to 98%. The identification accuracy remains above 82% when the device moves within the environment. To allow replicability and provide a performance benchmark, we pledge to share the 800 GB datasets – collected in static and, for the first time, dynamic conditions – and the code database with the community.

In this work, we investigate the use of backscattered mm-wave radio signals for the joint tracking and recognition of identities of humans as they move within indoor environments. We build a system that effectively works with multiple persons concurrently sharing and freely moving within the same indoor space. This leads to a complicated setting, which requires one to deal with the randomness and complexity of the resulting (composite) backscattered signal. The proposed system combines several processing steps: at first, the signal is filtered to remove artifacts, reflections, and random noise that do not originate from humans. Hence, a density-based classification algorithm is executed to separate the Doppler signatures of different users. The final blocks are trajectory tracking and user identification, respectively, based on Kalman filters and deep neural networks. Our results demonstrate that the integration of the last-mentioned processing stages is critical toward achieving robustness and accuracy in multiuser settings. Our technique is tested both on a single-target public data set, for which it outperforms state-of-the-art methods, and on our own measurements, obtained with a 77 GHz radar on multiple subjects simultaneously moving in two different indoor environments. The system works in an online fashion, permitting the continuous identification of multiple subjects with accuracies up to 98%, e.g., with four subjects sharing the same physical space, and with a small accuracy reduction when tested with unseen data from a challenging real-life scenario that was not part of the model learning phase.

Vehicles are becoming connected entities, and with the advent of online gaming, on demand streaming and assisted driving services, are expected to turn into data hubs with abundant computing needs. In this article, we show the value of estimating vehicular mobility as 5G users move across radio cells, and of using such estimates in combination with an online algorithm that assesses when and where the computing services (virtual machines, VM) that are run on the mobile edge nodes are to be migrated to ensure service continuity at the vehicles. This problem is tackled via a Lyapunov-based approach, which is here solved in closed form, leading to a low-complexity and distributed algorithm, whose performance is numerically assessed in a real-life scenario, featuring thousands of vehicles and densely deployed 5G base stations. Our numerical results demonstrate a reduction of more than 50% in the energy expenditure with respect to previous strategies (full migration). Also, our scheme self-adapts to meet any given risk target, which is posed as an optimization constraint and represents the probability that the computing service is interrupted during a handover. Through it, we can effectively control the trade-off between seamless computation and energy consumption when migrating VMs.

Here, we present a mobility prediction framework for 5G mobile systems. Our work stems from the intuition that mobility in vehicular networks is highly correlated, and such correlation can be captured by advanced neural network designs to anticipate the users' point of attachment. To prove this, we combine Markov chains with recurrent and convolutional neural networks, training them on mobility trajectories estimated by the received radio signal from mobile millimeter-wave devices. The proposed framework is decentralized, i.e., user trajectories are independently learned by each base station. In this paper, various problems are pragmatically tackled and solved, such as dealing with imbalanced datasets, as some trajectories are under represented, and obtaining a mobility classifier whose accuracy increases as new mobility samples are collected.The proposed technique is assessed using emulated traces obtained through the SUMO mobility simulator for the city of Cologne. Numerical results show accuracies higher than 88% in the prediction of the next serving base station from 4 seconds before the handover is performed. Mobility (next base station) predictors like the ones presented here are key for network management purposes within 5G networks, e.g., to proactively allocate communication and edge computing resources.

The Internet of Things (IoT) is rapidly spreading, reaching a multitude of different domains, including personal health care, environmental monitoring, home automation, smart mobility, and Industry 4.0. As a consequence, more and more IoT devices are being deployed in a variety of public and private environments, progressively becoming common objects of everyday life. It is hence apparent that, in such a scenario, cybersecurity becomes critical to avoid threats like leakage of sensible information, denial of service (DoS) attacks, unauthorized network access, and so on. Unfortunately, many low-end IoT commercial products do not usually support strong security mechanisms, and can hence be target of-or even means for-a number of security attacks. The aim of this article is to provide a broad overview of the security risks in the IoT sector and to discuss some possible counteractions. To this end, after a general introduction to security in the IoT domain, we discuss the specific security mechanisms adopted by the most popular IoT communication protocols. Then, we report and analyze some of the attacks against real IoT devices reported in the literature, in order to point out the current security weaknesses of commercial IoT solutions and remark the importance of considering security as an integral part in the design of IoT systems. We conclude this article with a reasoned comparison of the considered IoT technologies with respect to a set of qualifying security attributes, namely integrity, anonymity, confidentiality, privacy, access control, authentication, authorization, resilience, self organization.