Search

Device fingerprinting combined with Machine and Deep Learning (ML/DL) report promising performance when detecting cyberattacks targeting data managed by resource-constrained spectrum sensors. However, the amount of data needed to train models and the privacy concerns of such scenarios limit the applicability of centralized ML/DL-based approaches. Federated learning (FL) addresses these limitations by creating federated and privacy-preserving models. However, FL is vulnerable to malicious participants, and the impact of adversarial attacks on federated models detecting spectrum sensing data falsification (SSDF) attacks on spectrum sensors has not been studied. To address this challenge, the first contribution of this work is the creation of a novel dataset suitable for FL and modeling the behavior (usage of CPU, memory, or file system, among others) of resource-constrained spectrum sensors affected by different SSDF attacks. The second contribution is a pool of experiments analyzing and comparing the robustness of federated models according to i) three families of spectrum sensors, ii) eight SSDF attacks, iii) four scenarios dealing with unsupervised (anomaly detection) and supervised (binary classification) federated models, iv) up to 33% of malicious participants implementing data and model poisoning attacks, and v) four aggregation functions acting as anti-adversarial mechanisms to increase the models robustness.

Integrated sensing and communication (ISAC) is a novel paradigm using crowdsensing spectrum sensors to help with the management of spectrum scarcity. However, well-known vulnerabilities of resource-constrained spectrum sensors and the possibility of being manipulated by users with physical access complicate their protection against spectrum sensing data falsification (SSDF) attacks. Most recent literature suggests using behavioral fingerprinting and Machine/Deep Learning (ML/DL) for improving similar cybersecurity issues. Nevertheless, the applicability of these techniques in resource-constrained devices, the impact of attacks affecting spectrum data integrity, and the performance and scalability of models suitable for heterogeneous sensors types are still open challenges. To improve limitations, this work presents seven SSDF attacks affecting spectrum sensors and introduces CyberSpec, an ML/DL-oriented framework using device behavioral fingerprinting to detect anomalies produced by SSDF attacks affecting resource-constrained spectrum sensors. CyberSpec has been implemented and validated in ElectroSense, a real crowdsensing RF monitoring platform where several configurations of the proposed SSDF attacks have been executed in different sensors. A pool of experiments with different unsupervised ML/DL-based models has demonstrated the suitability of CyberSpec detecting the previous attacks within an acceptable timeframe.

The computing device deployment explosion experienced in recent years, motivated by the advances of technologies such as Internet-of-Things (IoT) and 5G, has led to a global scenario with increasing cybersecurity risks and threats. Among them, device spoofing and impersonation cyberattacks stand out due to their impact and, usually, low complexity required to be launched. To solve this issue, several solutions have emerged to identify device models and types based on the combination of behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques. However, these solutions are not appropriated for scenarios where data privacy and protection is a must, as they require data centralization for processing. In this context, newer approaches such as Federated Learning (FL) have not been fully explored yet, especially when malicious clients are present in the scenario setup. The present work analyzes and compares the device model identification performance of a centralized DL model with an FL one while using execution time-based events. For experimental purposes, a dataset containing execution-time features of 55 Raspberry Pis belonging to four different models has been collected and published. Using this dataset, the proposed solution achieved 0.9999 accuracy in both setups, centralized and federated, showing no performance decrease while preserving data privacy. Later, the impact of a label-flipping attack during the federated model training is evaluated, using several aggregation mechanisms as countermeasure. Zeno and coordinate-wise median aggregation show the best performance, although their performance greatly degrades when the percentage of fully malicious clients (all training samples poisoned) grows over 50%.

Social media are decentralized, interactive, and transformative, empowering users to produce and spread information to influence others. This has changed the dynamics of political communication that were previously dominated by traditional corporate news media. Having hundreds of millions of tweets collected over the 2016 and 2020 U.S. presidential elections gave us a unique opportunity to measure the change in polarization and the diffusion of political information. We analyze the diffusion of political information among Twitter users and investigate the change of polarization between these elections and how this change affected the composition and polarization of influencers and their retweeters. We identify "influencers" by their ability to spread information and classify them into those affiliated with a media organization, a political organization, or unaffiliated. Most of the top influencers were affiliated with media organizations during both elections. We found a clear increase from 2016 to 2020 in polarization among influencers and among those whom they influence. Moreover, 75% of the top influencers in 2020 were not present in 2016, demonstrating that such status is difficult to retain. Between 2016 and 2020, 10% of influencers affiliated with media were replaced by center- or right-orientated influencers affiliated with political organizations and unaffiliated influencers., Comment: 41 pages, 13 figures, 9 tables

Fifth generation mobile networks (5G) are currently being deployed by mobile operators around the globe. 5G acts as an enabler for various use cases and also improves the security and privacy over 4G and previous network generations. However, as recent security research has revealed, the standard still has security weaknesses that may be exploitable by attackers. In addition, the migration from 4G to 5G systems is taking place by first deploying 5G solutions in a non-standalone (NSA) manner where the first step of the 5G deployment is restricted to the new radio aspects of 5G, while the control of the user equipment is still based on 4G protocols, i.e. the core network is still the legacy 4G evolved packet core (EPC) network. As a result, many security vulnerabilities of 4G networks are still present in current 5G deployments. This paper presents a systematic risk analysis of standalone and non-standalone 5G networks. We first describe an overview of the 5G system specification and the new security features of 5G compared to 4G. Then, we define possible threats according to the STRIDE threat classification model and derive a risk matrix based on the likelihood and impact of 12 threat scenarios that affect the radio access and the network core. Finally, we discuss possible mitigations and security controls. Our analysis is generic and does not account for the specifics of particular 5G network vendors or operators. Further work is required to understand the security vulnerabilities and risks of specific 5G implementations and deployments., Comment: 47 pages, 10 figures, 8 tables, technology review, systematic risk analysis

The connectivity and resource-constrained nature of single-board devices open the door to cybersecurity concerns affecting Internet of Things (IoT) scenarios. One of the most important issues is the presence of unauthorized IoT devices that want to impersonate legitimate ones by using identical hardware and software specifications. This situation can provoke sensitive information leakages, data poisoning, or privilege escalation in IoT scenarios. Combining behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques is a promising approach to identify these malicious spoofing devices by detecting minor performance differences generated by imperfections in manufacturing. However, existing solutions are not suitable for single-board devices since they do not consider their hardware and software limitations, underestimate critical aspects such as fingerprint stability or context changes, and do not explore the potential of ML/DL techniques. To improve it, this work first identifies the essential properties for single-board device identification: uniqueness, stability, diversity, scalability, efficiency, robustness, and security. Then, a novel methodology relies on behavioral fingerprinting to identify identical single-board devices and meet the previous properties. The methodology leverages the different built-in components of the system and ML/DL techniques, comparing the device internal behavior with each other to detect manufacturing variations. The methodology validation has been performed in a real environment composed of 15 identical Raspberry Pi 4 B and 10 Raspberry Pi 3 B+ devices, obtaining a 91.9% average TPR and identifying all devices by setting a 50% threshold in the evaluation process. Finally, a discussion compares the proposed solution with related work, highlighting the fingerprint properties not met, and provides important lessons learned and limitations.

In communication systems, there are many tasks, like modulation recognition, which rely on Deep Neural Networks (DNNs) models. However, these models have been shown to be susceptible to adversarial perturbations, namely imperceptible additive noise crafted to induce misclassification. This raises questions about the security but also the general trust in model predictions. We propose to use adversarial training, which consists of fine-tuning the model with adversarial perturbations, to increase the robustness of automatic modulation recognition (AMC) models. We show that current state-of-the-art models benefit from adversarial training, which mitigates the robustness issues for some families of modulations. We use adversarial perturbations to visualize the features learned, and we found that in robust models the signal symbols are shifted towards the nearest classes in constellation space, like maximum likelihood methods. This confirms that robust models not only are more secure, but also more interpretable, building their decisions on signal statistics that are relevant to modulation recognition., Comment: arXiv admin note: text overlap with arXiv:2103.14977

In network science complex systems are represented as a mathematical graphs consisting of a set of nodes representing the components and a set of edges representing their interactions. The framework of networks has led to significant advances in the understanding of the structure, formation and function of complex systems. Social and biological processes such as the dynamics of epidemics, the diffusion of information in social media, the interactions between species in ecosystems or the communication between neurons in our brains are all actively studied using dynamical models on complex networks. In all of these systems, the patterns of connections at the individual level play a fundamental role on the global dynamics and finding the most important nodes allows one to better understand and predict their behaviors. An important research effort in network science has therefore been dedicated to the development of methods allowing to find the most important nodes in networks. In this short entry, we describe network centrality measures based on the notions of network traversal they rely on. This entry aims at being an introduction to this extremely vast topic, with many contributions from several fields, and is by no means an exhaustive review of all the literature about network centralities., Comment: 10 pages, 3 figures. Entry for the volume "Statistical and Nonlinear Physics" of the Encyclopedia of Complexity and Systems Science, Chakraborty, Bulbul (Ed.), Springer, 2021 Updated version

This work investigates the possibilities enabled by federated learning concerning IoT malware detection and studies security issues inherent to this new learning paradigm. In this context, a framework that uses federated learning to detect malware affecting IoT devices is presented. N-BaIoT, a dataset modeling network traffic of several real IoT devices while affected by malware, has been used to evaluate the proposed framework. Both supervised and unsupervised federated models (multi-layer perceptron and autoencoder) able to detect malware affecting seen and unseen IoT devices of N-BaIoT have been trained and evaluated. Furthermore, their performance has been compared to two traditional approaches. The first one lets each participant locally train a model using only its own data, while the second consists of making the participants share their data with a central entity in charge of training a global model. This comparison has shown that the use of more diverse and large data, as done in the federated and centralized methods, has a considerable positive impact on the model performance. Besides, the federated models, while preserving the participant's privacy, show similar results as the centralized ones. As an additional contribution and to measure the robustness of the federated approach, an adversarial setup with several malicious participants poisoning the federated model has been considered. The baseline model aggregation averaging step used in most federated learning algorithms appears highly vulnerable to different attacks, even with a single adversary. The performance of other model aggregation functions acting as countermeasures is thus evaluated under the same attack scenarios. These functions provide a significant improvement against malicious participants, but more efforts are still needed to make federated approaches robust.

Given the rapid changes in telecommunication systems and their higher dependence on artificial intelligence, it is increasingly important to have models that can perform well under different, possibly adverse, conditions. Deep Neural Networks (DNNs) using convolutional layers are state-of-the-art in many tasks in communications. However, in other domains, like image classification, DNNs have been shown to be vulnerable to adversarial perturbations, which consist of imperceptible crafted noise that when added to the data fools the model into misclassification. This puts into question the security of DNNs in communication tasks, and in particular in modulation recognition. We propose a novel framework to test the robustness of current state-of-the-art models where the adversarial perturbation strength is dependent on the signal strength and measured with the "signal to perturbation ratio" (SPR). We show that current state-of-the-art models are susceptible to these perturbations. In contrast to current research on the topic of image classification, modulation recognition allows us to have easily accessible insights on the usefulness of the features learned by DNNs by looking at the constellation space. When analyzing these vulnerable models we found that adversarial perturbations do not shift the symbols towards the nearest classes in constellation space. This shows that DNNs do not base their decisions on signal statistics that are important for the Bayes-optimal modulation recognition model, but spurious correlations in the training data. Our feature analysis and proposed framework can help in the task of finding better models for communication systems.

Many systems exhibit complex temporal dynamics due to the presence of different processes taking place simultaneously. An important task in such systems is to extract a simplified view of their time-dependent network of interactions. Community detection in temporal networks usually relies on aggregation over time windows or consider sequences of different stationary epochs. For dynamics-based methods, attempts to generalize static-network methodologies also face the fundamental difficulty that a stationary state of the dynamics does not always exist. Here, we derive a method based on a dynamical process evolving on the temporal network. Our method allows dynamics that do not reach a steady state and uncovers two sets of communities for a given time interval that accounts for the ordering of edges in forward and backward time. We show that our method provides a natural way to disentangle the different dynamical scales present in a system with synthetic and real-world examples., Comment: 54 pages, 14 figures. Accepted version by Science Advances

In the current network-based computing world, where the number of interconnected devices grows exponentially, their diversity, malfunctions, and cybersecurity threats are increasing at the same rate. To guarantee the correct functioning and performance of novel environments such as Smart Cities, Industry 4.0, or crowdsensing, it is crucial to identify the capabilities of their devices (e.g., sensors, actuators) and detect potential misbehavior that may arise due to cyberattacks, system faults, or misconfigurations. With this goal in mind, a promising research field emerged focusing on creating and managing fingerprints that model the behavior of both the device actions and its components. The article at hand studies the recent growth of the device behavior fingerprinting field in terms of application scenarios, behavioral sources, and processing and evaluation techniques. First, it performs a comprehensive review of the device types, behavioral data, and processing and evaluation techniques used by the most recent and representative research works dealing with two major scenarios: device identification and device misbehavior detection. After that, each work is deeply analyzed and compared, emphasizing its characteristics, advantages, and limitations. This article also provides researchers with a review of the most relevant characteristics of existing datasets as most of the novel processing techniques are based on machine learning and deep learning. Finally, it studies the evolution of these two scenarios in recent years, providing lessons learned, current trends, and future research challenges to guide new solutions in the area.

Many social and economic systems can be represented as attributed networks encoding the relations between entities who are themselves described by different node attributes. Finding anomalies in these systems is crucial for detecting abuses such as credit card frauds, web spams or network intrusions. Intuitively, anomalous nodes are defined as nodes whose attributes differ starkly from the attributes of a certain set of nodes of reference, called the context of the anomaly. While some methods have proposed to spot anomalies locally, globally or within a community context, the problem remain challenging due to the multi-scale composition of real networks and the heterogeneity of node metadata. Here, we propose a principled way to uncover outlier nodes simultaneously with the context with respect to which they are anomalous, at all relevant scales of the network. We characterize anomalous nodes in terms of the concentration retained for each node after smoothing specific signals localized on the vertices of the graph. Besides, we introduce a graph signal processing formulation of the Markov stability framework used in community detection, in order to find the context of anomalies. The performance of our method is assessed on synthetic and real-world attributed networks and shows superior results concerning state of the art algorithms. Finally, we show the scalability of our approach in large networks employing Chebychev polynomial approximations., Comment: Accepted paper at the 34th AAAI Conference on Artificial Intelligence (AAAI-20), New York, US. 8 pages, 5 figures

Cryptocurrencies are distributed systems that allow exchanges of native tokens among participants, or the exchange of such tokens for fiat currencies in markets external to these public ledgers. The availability of their complete historical bookkeeping opens up the possibility of understanding the relationship between aggregated users' behaviour and the cryptocurrency pricing in exchange markets. This paper analyses the properties of the transaction network of Bitcoin. We consider four different representations of it, over a period of nine years since the Bitcoin creation and involving 16 million users and 283 million transactions. By analysing these networks, we show the existence of causal relationships between Bitcoin price movements and changes of its transaction network topology. Our results reveal the interplay between structural quantities, indicative of the collective behaviour of Bitcoin users, and price movements, showing that, during price drops, the system is characterised by a larger heterogeneity of nodes activity., Comment: 18 pages, 6 figures

The functioning of the cryptocurrency Bitcoin relies on the open availability of the entire history of its transactions. This makes it a particularly interesting socio-economic system to analyse from the point of view of network science. Here we analyse the evolution of the network of Bitcoin transactions between users. We achieve this by using the complete transaction history from December 5th 2011 to December 23rd 2013. This period includes three bubbles experienced by the Bitcoin price. In particular, we focus on the global and local structural properties of the user network and their variation in relation to the different period of price surge and decline. By analysing the temporal variation of the heterogeneity of the connectivity patterns we gain insights on the different mechanisms that take place during bubbles, and find that hubs (i.e., the most connected nodes) had a fundamental role in triggering the burst of the second bubble. Finally, we examine the local topological structures of interactions between users, we discover that the relative frequency of triadic interactions experiences a strong change before, during and after a bubble, and suggest that the importance of the hubs grows during the bubble. These results provide further evidence that the behaviour of the hubs during bubbles significantly increases the systemic risk of the Bitcoin network, and discuss the implications on public policy interventions.

The dynamics and influence of fake news on Twitter during the 2016 US presidential election remains to be clarified. Here, we use a dataset of 171 million tweets in the five months preceding the election day to identify 30 million tweets, from 2.2 million users, which contain a link to news outlets. Based on a classification of news outlets curated by www.opensources.co, we find that 25% of these tweets spread either fake or extremely biased news. We characterize the networks of information flow to find the most influential spreaders of fake and traditional news and use causal modeling to uncover how fake news influenced the presidential election. We find that, while top influencers spreading traditional center and left leaning news largely influence the activity of Clinton supporters, this causality is reversed for the fake news: the activity of Trump supporters influences the dynamics of the top fake news spreaders., Comment: Updated to latest revised version

Measuring and forecasting opinion trends from real-time social media is a long-standing goal of big-data analytics. Despite its importance, there has been no conclusive scientific evidence so far that social media activity can capture the opinion of the general population. Here we develop a method to infer the opinion of Twitter users regarding the candidates of the 2016 US Presidential Election by using a combination of statistical physics of complex networks and machine learning based on hashtags co-occurrence to develop an in-domain training set approaching 1 million tweets. We investigate the social networks formed by the interactions among millions of Twitter users and infer the support of each user to the presidential candidates. The resulting Twitter trends follow the New York Times National Polling Average, which represents an aggregate of hundreds of independent traditional polls, with remarkable accuracy. Moreover, the Twitter opinion trend precedes the aggregated NYT polls by 10 days, showing that Twitter can be an early signal of global opinion trends. Our analytics unleash the power of Twitter to uncover social trends from elections, brands to political movements, and at a fraction of the cost of national polls.

The process of diffusion is the most elementary stochastic transport process. Brownian motion, the representative model of diffusion, played a important role in the advancement of scientific fields such as physics, chemistry, biology and finance. However, in recent decades, non-diffusive transport processes with non-Brownian statistics were observed experimentally in a multitude of scientific fields. Examples include human travel, in-cell dynamics, the motion of bright points on the solar surface, the transport of charge carriers in amorphous semiconductors, the propagation of contaminants in groundwater, the search patterns of foraging animals and the transport of energetic particles in turbulent plasmas. These examples showed that the assumptions of the classical diffusion paradigm, assuming an underlying uncorrelated (Markovian), Gaussian stochastic process, need to be relaxed to describe transport processes exhibiting a non-local character and exhibiting long-range correlations. This article does not aim at presenting a complete review of non-diffusive transport, but rather an introduction for readers not familiar with the topic. For more in depth reviews, we recommend some references in the following. First, we recall the basics of the classical diffusion model and then we present two approaches of possible generalizations of this model: the Continuous-Time-Random-Walk (CTRW) and the fractional L\'evy motion (fLm).

The discovery of two-dimensional electron gases (2DEGs) at the interface between two insulating complex oxides, such as LaAlO3 (LAO) or gamma-Al2O3 (GAO) epitaxially grown on SrTiO3 (STO) 1,2, provides an opportunity for developing all-oxide electronic devices3,4. These 2DEGs at complex oxide interfaces involve many-body interactions and give rise to a rich set of phenomena5, for example, superconductivity6, magnetism7,8, tunable metal-insulator transitions9, and phase separation10. However, large enhancement of the interfacial electron mobility remains a major and long-standing challenge for fundamental as well as applied research of complex oxides11-15. Here, we inserted a single unit cell insulating layer of polar La1-xSrxMnO3 (x=0, 1/8, and 1/3) at the interface between disordered LaAlO3 and crystalline SrTiO3 created at room temperature. We find that the electron mobility of the interfacial 2DEG is enhanced by more than two orders of magnitude. Our in-situ and resonant x-ray spectroscopic in addition to transmission electron microscopy results indicate that the manganite layer undergoes unambiguous electronic reconstruction and leads to modulation doping of such atomically engineered complex oxide heterointerfaces. At low temperatures, the modulation-doped 2DEG exhibits clear Shubnikov-de Haas oscillations and the initial manifestation of the quantum Hall effect, demonstrating an unprecedented high-mobility and low electron density oxide 2DEG system. These findings open new avenues for oxide electronics., Comment: 29 pages, 5 figures, Accepted for publication in Nature Materials

The discovery of two-dimensional electron gases (2DEGs) in SrTiO3-based heterostructures provides new opportunities for nanoelectronics. Herein, we create a new type of oxide 2DEG by the epitaxial-strain-induced polarization at an otherwise nonpolar perovskite-type interface of CaZrO3/SrTiO3. Remarkably, this heterointerface is atomically sharp, and exhibits a high electron mobility exceeding 60,000 cm2V-1s-1 at low temperatures. The 2DEG carrier density exhibits a critical dependence on the film thickness, in good agreement with the polarization induced 2DEG scheme., Comment: 19 pages, 4 figs; Nano Letters,2015, published online