Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf ·...
Transcript of Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf ·...
![Page 1: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/1.jpg)
Location Spoofing Attack and Its
Countermeasures in Database-Driven
Cognitive Radio Networks
Kexiong (Curtis) Zeng,
Sreeraksha Kondaji Ramesh,
Yaling Yang.
![Page 2: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/2.jpg)
Outline
Background and Motivation
Our Works
Overview of GPS Spoofing Attack and Existing
Countermeasures
Attack Model
Countermeasures and Evaluations
Future Work
1
![Page 3: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/3.jpg)
Background
Background of database-driven cognitive radio networks
Enforced by FCC.
Primary users (PUs) and secondary users (SUs).
Submit location information to query the database.
Database allocates available spectrum to SUs.
2
![Page 4: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/4.jpg)
Motivation
3
Location Security Loophole
![Page 5: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/5.jpg)
Outline
Background and Motivation
Our Works
Overview of GPS Spoofing Attack and Existing
Countermeasures
Attack Model
Countermeasures and Evaluations
Future Work
4
![Page 6: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/6.jpg)
Our Works
First to study the impact of GPS spoofing
attacks in cognitive radio networks (CRNs).
Formulate attack models & examine the
impact.
Analyze various countermeasures.
5
![Page 7: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/7.jpg)
Outline
Background and Motivation
Our Works
Overview of GPS Spoofing Attack and Existing
Countermeasures
Attack Model
Countermeasures and Evaluations
Future Work
6
![Page 8: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/8.jpg)
Overview of GPS Spoofing Attack
and Existing Countermeasures
Civilian GPS can be easily spoofed:
Transmit counterfeit GPS signals.
Rebroadcast GPS signals.
Existing Countermeasures:
Self-check algorithms.
Smart antennas.
7
![Page 9: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/9.jpg)
Outline
Background and Motivation
Our Works
Overview of GPS Spoofing Attack and Existing
Countermeasures
Attack Model
Countermeasures and Evaluations
Future Work
8
![Page 10: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/10.jpg)
Single GPS Spoofing Attacker
9
![Page 11: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/11.jpg)
Attack Model
Random attack model
No knowledge about the database and currently registered SUs information.
Spoof SUs to a random location in the cell.
Optimal attack model
Access to the database and currently registered SUs information.
Spoof SUs to an optimal location in the cell.
10
![Page 12: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/12.jpg)
Our Settings
Round-robin scheduling and List-coloring spectrum allocation.
WhiteSpaceFinder developed by Microsoft.
A 16km-radius single cell in Blacksburg, Virginia with 100m *100m resolution.
SUs are uniformly distributed.
11
![Page 13: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/13.jpg)
Evaluate the Impact
Random and optimal attacks
1 km transmission range
30 simulation runs
15
![Page 14: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/14.jpg)
Random vs. Optimal
16
The performance of random and optimal attack in a 1260-SU network.
![Page 15: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/15.jpg)
Outline
Background and Motivation
Our Works
Overview of GPS Spoofing Attack and Existing
Countermeasures
Attack Model
Countermeasures and Evaluations
Future Work
17
![Page 16: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/16.jpg)
Countermeasures
Centralized Detection Scheme (CDS)
Environmental-radio-based Location
Verification (ELV)
Peer Location Verification (PLV)
18
![Page 17: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/17.jpg)
Centralized Detection Scheme
Maintain location traces for all SUs.
Detect abnormal mobility patterns.
Limitations:
Misclassification.
Cannot restore network operations.
Privacy violations to SUs.
19
![Page 18: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/18.jpg)
Environmental-radio-based
Location Verification
SUs are software defined radios.
WiFi signal
Television signal
FM signal
Location crosscheck.
20
![Page 19: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/19.jpg)
Implementation of ELV
21
26 red balloons indicate the locations of test points.
![Page 20: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/20.jpg)
Localization Performance
22
Localization performance using FM radio signals.
ELV has some error ranges.
![Page 21: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/21.jpg)
Effectiveness of ELV
Undetected GPS spoofing attacks.
Spoofed locations inside the error ranges.
Model as attacks with distance constraints.
23
![Page 22: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/22.jpg)
Effectiveness of ELV
24
The probability is calculated by 30 individual simulations in a 84-SU network.
![Page 23: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/23.jpg)
Limitations of ELV
Blind spots of the environmental radio
signal database.
Performance depends on the number of
local channels.
25
![Page 24: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/24.jpg)
Peer Location Verification
26
Spoofed
![Page 25: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/25.jpg)
Parameters
Initial anchor ratio .
Anchors transmit 𝑟-radius beacon signals with
probability 𝛽.
27
![Page 26: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/26.jpg)
Convergence Speed
Divide time into discrete slots.
𝑝𝑖,𝑡: the probability of an SU 𝑖 is verified at
time 𝑡.
𝐏𝐭 = 𝑝1,𝑡, 𝑝2,𝑡, . . . , 𝑝𝑛,𝑡𝑇.
28
![Page 27: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/27.jpg)
Convergence Speed
Time evolution of the probability :
𝐏𝐭 = (𝐈 + 𝛽𝐀)𝐏𝐭−1 = 𝐁𝐏𝐭−1 = 𝐁𝑡𝐏0,
where 𝐁 = (𝐈 + 𝛽𝐀), 𝐈 is the identity matrix
and 𝐀 is the adjacency matrix.
29
![Page 28: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/28.jpg)
Convergence Speed
Derive a lower bound for the increasing of
verified SU number:
where N𝑡 is the time evolution of verified SU
number, 𝜆1,𝐵 is the largest eigenvalue of 𝐁,
𝐶 is a constant.
30
![Page 29: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/29.jpg)
Evaluation of PLV
Missed detection (false negative)
Isolated SUs
31
![Page 30: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/30.jpg)
Missed Detection
32
False negative SU ratio = number of non−detected victim SUsTotal number of non−anchor SUs
.
![Page 31: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/31.jpg)
Evaluation of PLV
Missed detection (false negative)
Isolated SUs
False alarm (false positive)
Malicious anchor nodes
Majority Voting
33
![Page 32: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/32.jpg)
False Alarm
34
False positive SU ratio=Number of SUs reporting false alarms
Total number of non−anchor SUs.
![Page 33: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/33.jpg)
Discussion of PLV
Require some small initial anchor ratio and
SU density.
Good news:
Attackers are less likely to spoof extremely
sparse SU networks.
• Can hardly spoof enough SUs to cause serious PU
interference.
35
![Page 34: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/34.jpg)
Outline
Background and Motivation
Our Works
Overview of GPS Spoofing Attack and Existing
Countermeasures
Attack Model
Countermeasures and Evaluations
Future Work
36
![Page 35: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/35.jpg)
Future Work
Hybrid Countermeasure.
Independent of wireless signals.
A framework of sensing-based secure
location verification system for mobile
devices.
37
![Page 36: Location Spoofing Attack and Its Countermeasures in ...kexiong6/talks/Curtis_CNS.pdf · Countermeasures in Database-Driven Cognitive Radio Networks Kexiong ... Round-robin scheduling](https://reader031.fdocuments.in/reader031/viewer/2022022505/5abb3ed47f8b9a8f058c44dc/html5/thumbnails/36.jpg)