Search

Abstract In the recent years, cyberattacks to smart grids are becoming more frequent. Among the many malicious activities that can be launched against smart grids, the False Data Injection (FDI) attacks have raised significant concerns from both academia and industry. FDI attacks can affect the (internal) state estimation process—critical for smart grid monitoring and control—thus being able to bypass conventional Bad Data Detection (BDD) methods. Hence, prompt detection and precise localisation of FDI attacks are becoming of paramount importance to ensure smart grids security and safety. Several papers recently started to study and analyse this topic from different perspectives and address existing challenges. Data‐driven techniques and mathematical modelling are the major ingredients of the proposed approaches. The primary objective is to provide a systematic review and insights into FDI attacks joint detection and localisation approaches considering that other surveys mainly concentrated on the detection aspects without detailed coverage of localisation aspects. For this purpose, more than 40 major research contributions were selected and inspected, while conducting a detailed analysis of the methodology and objectives in relation to the FDI attacks detection and localisation. Key findings of the identified papers were provided according to different criteria, such as employed FDI attacks localisation techniques, utilised evaluation scenarios, investigated FDI attack types, application scenarios, adopted methodologies and the use of additional data. Finally, open issues and future research directions were discussed.

MITRE ATT&CK is a comprehensive knowledge-base of adversary tactics, techniques, and procedures (TTP) based on real-world attack scenarios. It has been used in different sectors, such as government, academia, and industry, as a foundation for threat modeling, risk assessment, and defensive strategies. There are valuable insights within MITRE ATT&CK knowledge-base that can be applied to various fields and applications, such as risk assessment, threat characterization, and attack modeling. No previous work has been devoted to the comprehensive collection and investigation of statistical insights of the MITRE ATT&CK dataset. Hence, this work aims to extract, analyze, and represent MITRE ATT&CK statistical insights providing valuable recommendations to improve the security aspects of Enterprise, Industrial Control Systems (ICS), and mobile digital infrastructures. For this purpose, we conduct a hierarchical analysis starting from MITRE ATT&CK threat profiles toward the list of techniques in the MITRE ATT&CK database. Finally, we summarize our key findings while providing recommendations that will pave the way for future research in the area.

The security and privacy of wireless channels is typically enforced by leveraging cryptographic tools. However, there are scenarios where these methods are unfit, such as in resource-constrained environments, i.e., Internet of Things (IoT), or when an extra layer of security is needed. A promising solution involves correlating air pressure (barometric) readings to securely pair IoT devices while requiring zero-interaction. This paper presents an experimental dataset of real-world barometric measurements collected in open areas under different weather conditions. Specifically, our dataset includes readings recorded using the reference hardware platform BMP280. The experiments involve a reference scenario constituted by three Adafruit BMP280 barometric sensors connected to a Raspberry Pi 3 Model B board to collect barometric measurements. The three sensors represent two communicating parties (Alice and Bob) and an adversary (Eve), respectively. The dataset is constituted by three experiments characterized by different relative distances among Alice, Bob, and Eve. We considered 5cm and 2m between Alice and Bob while placing Eve at 2m and 8 meters, respectively. The second configuration, i.e., (Alice-Bob at 2m and Eve at 8m) has been replicated in a different scenario characterized by less air pressure fluctuations. The sampling frequency has been set to 70Hz while the measurements last for 50, 24 and 41 hours, respectively.Researchers can use this dataset in several ways, including: (i) Study the air pressure variation and correlation between devices separated by different distances, (ii) Develop a co-location verification extension for the Diffie-Hellman (DH) key agreement method that utilizes air pressure data streams, (iii) Study possible attacks against proximity-based authentication techniques that depend on pressure correlated variations.

The broadcast nature of wireless communications makes them vulnerable to denial-of-service attacks. Indeed, an adversary can prevent the reception of wireless messages by transmitting signals with high power over the same frequency of the considered channel. This paper presents an experimental dataset of real-world indoor communication scenarios affected by different jamming techniques. Specifically, our dataset includes data acquired from 7 different Software Defined Radios (SDRs), i.e., the USRP Ettus Research X310, operating in an office environment. Each experiment is characterized by a transmitter, a receiver, and a jammer. While the hardware of the transmitter and the receiver are kept the same for all the experiments, the hardware of the jammer is changed adopting 5 different radios of the same brand. The dataset includes different jamming behaviors, based on the type of signal injected by the jammer: no jamming (silent), tone (sinusoidal), and Gaussian noise. Moreover, besides having multiple jamming devices and modes, the dataset also includes different transmission distances and jamming powers. In each experiment, a pre-determined sequence of bits has been modulated using the BPSK scheme, transmitted wirelessly under different jamming conditions, and then stored, at the receiver, as a 2-columns matrix of I/Q samples. Researchers can use this dataset in several ways, including: (i) developing active and reactive techniques for jamming detection, (ii) jamming identification at the physical layer, and finally, (iii) developing mitigation techniques supported by real data.

Physical-layer information associated with wireless communications is a trove of data, that can be leveraged by several research communities, e.g., networking and security. Indeed, such information (IQ samples) represents the signal at the very beginning of the receiver chain, just after the demodulation, and they embed valuable information about both the channel and the transmitter, which can be used for several purposes, e.g., protocol design, network performance analysis, and transmitter fingerprinting.In this paper, we present the data of a measurement campaign targeting the messages of the IRIDIUM satellite constellation. The resulting dataset has been collected throughout a measurement period of about 2 months and it comprises +3.8 M IRIDIUM Ring Alert (IRA) packets—the cleartext packets broadcasted by the IRIDIUM satellites. Our dataset includes several pieces of information included in the IRA packets, i.e., the reception timestamp, position of the transmitting satellite on the ground, satellite ID, beam ID, etc. Moreover, for each packet, we also collected the corresponding raw IQ samples, for a total of +7.6B data.We believe that the amount of collected data, the duration of the measurement campaign, and the information included herein, will be valuable assets for the research community.

This paper presents a low-complexity noise reduction scheme for orthogonal frequency-division multiplexing (OFDM)-based power line communication (PLC) systems. The solution exploits the positive time-correlation between the subcarrier noise magnitudes and phases. More specifically, we performed field measurements of PLC noise conducted in seven diverse locations, with continuous measurements for two days, covering the 42 kHz to 471 kHz frequency band. After analyzing the data, we have identified a key PLC noise characteristic; the subcarrier noise magnitudes are highly time-correlated in narrow frequency bands. The same behavior has also been noticed for the subcarrier noise phases. This correlation characteristic has been used to propose a simple and efficient noise reduction scheme for NB-PLC systems. We have applied the proposed method in a real case scenario, where PLC noise field measurements have been used to confirm the advantages in terms of noise reduction gain and bit error rate (BER). Indeed, depending on the channel and used modulation, the proposed scheme is able to reduce the BER by around 35 %, in the considered PLC scenarios.

We propose JAM-ME, an autonomous jamming-assisted navigation system that allows a drone to accomplish its mission even in the presence of an anti-drone jamming protection system. In this contribution, we review the current state-of-the-art highlighting how current solutions to respond to drones are completely ineffective against JAM-ME. In particular, we introduce our solution and its theoretical framework, and later we relax a few constraints of the baseline model (adding wind drift, and allowing the target to be randomly placed within the jammed area). Moreover, we run extensive simulations that do support our findings: even under the combined action of jamming and wind drift, the drone can reach a target randomly deployed in the jamming area-any other drone, under the same conditions, would have simply failed. As per the overhead, under very conservative assumptions, JAM-ME experiences an average overhead of 70%; however, note that such overhead can be reduced by at least a tenfold factor in practical settings-discussed in the paper. Finally, we highlight the intrinsic limitations of our solution, potential countermeasures, and new jamming strategies that can pave the way to further research.

Jamming is a malicious radio activity that represents a dreadful threat when employed in critical scenarios. Several techniques have been proposed to detect, locate, and mitigate jamming. Similarly, counter-counter-jamming techniques have been devised. This paper belongs to the latter thread. In particular, we propose a new jammer model: a power-modulated jammer that defies standard localization techniques. We provide several contributions: we first define a new mathematical model for the power-modulated jammer and then propose a throughout analysis of the localization error associated with the proposed power-modulated jammer, and we compare it with a standard power-constant jammer. Our results show that a power-modulated jammer can make the localization process completely ineffective—even under conservative assumptions of the shadowing process associated with the radio channel. Indeed, we prove that a constant-power jammer can be localized with high precision, even when coupled with a strong shadowing effect (σ ≈ 6 dBm). On the contrary, our power-modulated jammer, even in the presence of a very weak shadowing effect (σ < 2 dBm), presents a much wider localization error with respect to the constant-power jammer. In addition to being interesting on its own, we believe that our contribution also paves the way for further research in this area.

We propose Strength of Crowd (SoC), a distributed Internet of Things (IoT) protocol that guarantees message broadcast from an initiator to all network nodes in the presence of either a reactive or a proactive jammer, that targets a variable portion of the radio spectrum. SoC exploits a simple, yet innovative and effective idea: nodes not (currently) involved in the broadcast process transmit decoy messages that cannot be distinguished (by the jammer) from the real ones. Therefore, the jammer has to implement a best-effort strategy to jam all the concurrent communications up to its frequency/energy budget. SoC exploits the inherent parallelism that stems from the massive deployments of IoT nodes to guarantee a high number of concurrent communications, exhausting the jammer capabilities and hence leaving a subset of the communications not jammed. It is worth noting that SoC could be adopted in several wireless scenarios; however, we focus on its application to the Wireless Sensor Networks (WSN) domain, including IoT, Machine-to-Machine (M2M), Device-to-Device (D2D), to name a few. In this framework, we provide several contributions: firstly, we show the details of the SoC protocol, as well as its integration with the IEEE 802.15.4-2015 MAC protocol; secondly, we study the broadcast delay to deliver the message to all the nodes in the network; and finally, we run an extensive simulation and experimental campaign to test our solution. We consider the state-of-the-art OpenMote-B experimental platform, adopting the OpenWSN open-source protocol stack. Experimental results confirm the quality and viability of our solution.