2015 IEEE Global Conference on Signal and Information Processing (GlobalSIP)

A Novel Physical Layer Spoofing Detection Based

on Sparse Signal Processing
Ning Wang * , Shichao Lv † , Ting Jiang * Ge Zhou *
*
Key Laboratory of Universal Wireless Communication Ministry of Education
Beijing University of Posts and Telecommunications Beijing, China
†
Beijing Key Laboratory of IOT information security technology
Institute of Information Engineering, CAS Beijing, China
E-mail: * [email protected] , † [email protected]

Abstract— In wireless communication systems, spoofing security in wireless communication by numerous

attack significantly impact the information security, for this researchers [3]-[8] recently. In previous works, the channel
attack is not hard to launch with little effort. Although response was used to detect the spoofing attack, either
traditional cryptographic authentication can be utilized for received signal strength (RSS) [6], or channel state
node identification, it is not desirable in some low power
requirements application scenarios such as Wireless Sensor
information (CSI) [7] [8]. However, little work has been
Networks (WSNs). In this paper, we formulate this problem as attempted to utilize spares signal processing to implement
one of sparse signal processing. In order to identify the physical layer spoofing detecting.
existence of the spoofing attacker, we explore using the feature In this paper, we present a new process model to detect
extraction and fusion to establish an automatic representative the spoofing attitude based on sparse representation. After
selection algorithm. By examining the correlation between the sparse decomposition and principal component analysis
two selected targets, we can determine the attacking situation. (PCA), the original channel impulse response becomes a
We evaluate our scheme through an experimental system, and little of sparse coefficients. Then, we utilize the feature
the experimental results on real measured data show that our extraction and combination to establish a novel automatic
sparse signal processing can reach desired identification
performance.
representative selection algorithm to choose the optimal
targets. Finally, examining the correlation between the
Keywords—physical layer security; spoofing attack; signal targets, we can determine whether there is existing spoofing
processing; sparse representation attack in this communication.
A. Related work
Many physical layer authentication scheme related
I. INTRODUCTION spoofing detection such as [6]-[9]. But, the works that are
In wireless communication, security is threatened by the closely related to us are [6] [9] [10]. [6] proposed the use of
development of computer and wireless technology. Received Signal Strength (RSS) traces for spoofing
Although most existing wireless networks have some detection. They develop a DEMOTE system to utilize the
security mechanisms such as Wi-Fi Protected Access (WPA) temporal constraints to predict the RSS traces for partition
and 802.11i, these wireless systems still have security and use the spatial correlation for the attack detection.
vulnerabilities [1]. Through disguising the identity such as Instead of RSS traces reconstruction of [6], we focus on the
MAC address, an attacker can spoofs some management features extraction from sparse representation to make a
control messages to claim to be a legitimate node. In distinction between the signals. [9] utilized the K-means
addition, spoofing attack is the foundation of other senior cluster to identify the channel response of the nodes. They
attacks such as denial-of-service (Dos) and man-in-the- propose detecting the attacker as well as locating the
middle attacks [2]. positions. And [6] proposed using matches rules to detect
About this problem, traditional methods are actually key identity-based spoofing. Different from them also, we first
distribution schemes. However, even if the security investigate channel sparse representation for spoofing
mechanism is based on the most recent advanced encryption detection.
standard (AES), spoofing attack is easy to launch because B. Our Contributions
these security mechanisms are established at the higher There have two contributions in this paper as follow:
layers of the protocol stack [3]. Furthermore, in some low (1) We propose that utilizing the sparse signal
power requirements application scenarios such as Wireless processing to implement spoofing detection.
Sensor Networks (WSNs) and Wireless Body Area Network (2) For examining the correlation, we establish an
(WBAN), traditional cryptographic security mechanisms are Automatic Representative Selection Algorithm
not desirable [4]. (ARSA) to search for the optimal target.
To overcome this hurdle, the inimitable feature of the
physical layer is exploited to enhance or supplement

978-1-4799-7591-4/15/$31.00 ©2015 IEEE 582

 2015 IEEE Global Conference on Signal and Information Processing (GlobalSIP)

II. SYSTEM SETUP

A. Sparse Representation
(1)
X
First feature as concentration ratio:
2n−1+i
,X2n−1
F = d(i) d(i) (5)
In this subsection, sparse representation contains two phase:
k=2n−1−i k=0

!
sparse decomposition and principal component analysis (P-

X X
CA). Second feature as the middle section variance:
1) Sparse decomposition: Suppose that a received signal 2n−1+i 2n−1+i 2
1
set isY = [y1 , ..., yN ] ∈ Rm×N , N is the number of data F (2)
= d(i) − d(i) (6)
samples and eachyi ∈ Rm×1 , i = 1, 2, ..., N . We want to 2i − 1
k=2n−1−i k=2n−1−i
find a dictionaryD = [d1 , ..., dn ] ∈ Rm×n and sparse vector

X X
The shape imbalance as the third feature:
matrixX = [x1 , ..., xn ] ∈ Rm×n that satisfy

y = Dx =
X
N
dk xk (1)
F (3) =
2n−1

k=2n−1+i
d(i) −
2n−1−i

k=1
d(i) (7)
k=1

where the atoms dk is the column vector of redundant com- In this way, one feature space [F (1) , F (2) , F (3) ] is established.
plete dictionary. Sparse representation model is given by Then, we directly resort to the equal combination (EC) rule
for combination the features,
min x0 s.t. y = Dx (2)
F = μ1 F (1) + μ2 F (2) + μ3 F (3) (8)
where 0 denotes 0 norm, its role is to count the number of 1
nonzero entries. where, μi = mean(F (i) )
This problem is equivalent to a convex optimization problem Up to now, we have already established an integrated feature
under 1 norm. The model is F to measure the difference levels of obtained signal sparse
representation. Thus, each received signal sparse representa-
min x1 s.t. y = Dx (3)
tion xi = [xi1 , ..., xiv ] can be mapped to a single point in the
where 1 denotes 1 norm. feature vector F = [F1 , ..., Fk ] and k ∈ [1, ..., L]. Suppose
Many algorithms can solve this optimization problem, such that the number of signals at level Fk is denoted by nk and
as gradient projection, greedy pursuit algorithms, etc. In this the total number of signals by N = n1 + n2 + ... + nL . Then

P
study, we use the popular orthogonal match pursuit algorithm the probability distribution of each value Fk is
(OMP) to solve the problem and the used redundant over L
complete dictionary is wavelet dictionary. p(Fk ) = nk /N, p(Fk ) ≥ 0, p(Fk ) = 1 (9)
2) Principal component analysis (PCA): After sparse rep- k=1

resentation, we use principal component analysis (PCA) to In this study, we utilize an unsupervised approach to search the
decrease the dimension of the sparse coefficient vector. optimal threshold (denoted by ε). According to [11], choosing
Suppose that the input sparse vector x = [x1 , ..., xn ] is then the optimal threshold is an optimization problem,

¨
transformed into xV = [x1 , ..., xv ] by the following way:
k ∗ = arg max σB
2
(k), k ∈ [1, ..., L]
k
XV = V(x − μx ) (4) ω(k)(1 − ω(k)) > 0 (10)
Subject to
or 0 < ω(k) < 1
P
where μx denotes the mean of the samples, V is the projection
vector. k
The objective of PCA is to choose a set of projection vectors 2
where, ω(k) = p(Fi ) and σB (k) is between-class variance
xV that can represent the original sparse coefficient vector x i=1
with the minimum mean square error. [11]:
2
2 [μT ω(k) − μ(k)]
Thus, the received signals sets is Y = [y1 , ..., yN ], its cor- σB (k) = (11)

P
responding sparse representation is X = [x1 , ..., xN ] and each ω(k)[1 − ω(k)]
element of sparse coefficient is xi = [xi1 , ..., xiv ],i ∈ {1, ..., N } L

P
after PCA processing. N denotes the number of signals and v where, μT is the total mean level ,i.e., μT = Fi p(Fi ), and
i=1
is the vector dimension of sparse coefficient. k
μ(k) is the class mean levels ,i.e., μ(k) = Fi p(Fi ).
B. Automatic representative selection algorithm i=1
In this subsection, we present a new automatic represen- Thus, the optimal threshold k ∗ is selected, and the feature
tative selection algorithm (ARSA) to dichotomize the sparse vector F = [F1 , ..., Fk ] is dichotomized into two classes
representation in two classes, and get the target sparse coeffi- [F1 , ..., Fk∗ ] and [Fk∗ , ..., FL ] by this optimal threshold at level
cients x(a) and x(b) . k ∗ . Then, we choose the middle level as the representative,
Firstly, in order to reflect the distinction of the obtained and the corresponding sparse coefficients is selected, .i.e., the
sparse representation, we extract three quantifiable features sparse coefficients x(0) and x(1) that corresponding to the
according to the following processing. feature F(k∗ +1)/2 and F(k∗ +1)/2 are obtained.

583
 2015 IEEE Global Conference on Signal and Information Processing (GlobalSIP)

0.8
Spoofing situations
DŽďŝůĞŶŽĚĞƐ Normal situations
0.7

0.6

0.5

Correlation
ŶƚĞŶŶĂ
0.4

Fig. 1: Mobile node and Software defined radio platform 0.3

(Sora) in experiment.
0.2

4 original signal (a) 4 original signal (b) 0.1

x 10 x 10
1 1
0
0 0 0 10 20 30 40 50
Sample index

−1 −1
0 50 100 150 0 50 100 150 Fig. 4: The correlation analysis of the experiment .
4sparse representation 4
x 10 x 10 sparse representation
2 2
TABLE I: The composition of the training phase
0 0

−2 −2 Testing phase Spoofing scenario Normal scenario

0 100 200 300 0 100 200 300
PCA PCA Transmitting Two mobile node One mobile node
0.05 0.05
Received One MAC address One MAC address
0 0

−0.05 −0.05
0 10 20 30 0 10 20 30

P €X − X Š€Y − Y Š
Pearson correlation coefficient:
n

r= Ê
P €X − X Š Ê P € Y − Y Š
Fig. 2: Signal processing under normal situations. i i
i=1
(12)
n 2 n 2
4 original signal (a) 4 original signal (b)
i i
1
x 10
1
x 10 i=1 i=1

where Xi and Yi are the values of the packet of each party,

0 0
X and Y are the mean values of a sequence of packets
−1
0 50 100 150
−1
0 50 100 150
respectively.
x 10
4sparse representation 4
x 10 sparse representation Under normal situations, the correlation rate should be high
2 2
since they have the same channel and within the coherent
0 0 time. However, under the spoofing situations, the two selected
signals are uncorrelated to each other as they have different
−2 −2
0 100 200 300 0 100 200 300 transmitters and different channels even in the coherent time.
PCA PCA
0.2 0.05
III. EVALUATION
0 0
The detection performance of the proposed scheme is eval-
−0.2
0 10 20 30
−0.05
0 10 20 30
uated by an experimental system.

A. Data acquisition
Fig. 3: Signal processing under spoofing attack situation.
We configure two mobile nodes (homemade hardware based
on IEEE 802.15.4) worn on the chest and the arms as signal
transmitters. And Software defined radio platform (SDR) is
C. Correlation detection
used to emulate the controller. The utilized SDR is Microsoft
When the target sparse coefficients x(0) and x(1) are select- Research Software Radio, also known as Sora. Sora is a
ed, we examine the correlation between the two selected sparse high-performance fully programmable software radio based
coefficients to determine the attacking situation. In this study, on general purpose processors (i.e., CPU) in commodity PC
Pearson correlation coefficient is used to depict the degree of architecture. Fig. 1 shows the mobile nodes and the SDR
correlation. platform respectively in our experiments.

584
 2015 IEEE Global Conference on Signal and Information Processing (GlobalSIP)

In the testing phase, the experiment is repeated 300 times V. CONCLUSION

to obtain the normal signals and spoofing attack signals, In this paper, we have formulated spoofing detection as a
respectively. Table 1 indicates the composition of testing data. sparse signal processing. Based on the feature extraction and
The two mobile node have the same MAC address and as fusion, we presented a novel automatic representative selection
the role of the spoofing attack sources. While, in the normal algorithm (ARSA) to choose the optimal inspection target.
scenario, there is only one mobile node to play legitimate In order to verify this process model, we performed indoor
signals. experiments, and the result showed the better performance. In
our future work, extending the channel sparse representation
B. Signal processing to other wireless security application will be an interesting
topic.
After the experimental data are collected, we classify these
signals into two groups: one is a normal situation and the ACKNOWLEDGMENT
other is spoofing attack situation. In order to simplify the This work was supported by National Nature Science Foun-
discussion, we randomly selected two signals (denote (a) and dation of China (61171176) and the Innovation Program of
(b)) to display. Institute of Information Engineering Chinese Academy of
Fig. 2 shows the signal processing under normal situations. Sciences (Y4Z0033102).
We can notice that the original signals are similar, but these
signals exhibit the difference after sparse representation. Al- R EFERENCES
though there is only one transmitter, the sparse representation [1] H. Yang, F. Ricciato, S. Lu, and L. Zhang, “Securing a wireless world,”
of the received signals are differences in performance. The Proceedings of the IEEE, vol. 94, no. 2, pp. 442–454, 2006.
[2] J. Bellardo and S. Savage, “802.11 denial-of-service attacks: Real
reasons may be that dynamic environment and the movement vulnerabilities and practical solutions.” in USENIX security, 2003, pp.
of the transmitter leads to differences in channel. Fig. 3 15–28.
shows spoofing attack normal situations, and this difference [3] X. Wu and Z. Yang, “Physical-layer authentication for multi-carrier
transmission,” IEEE Communications Letters, vol. 19, no. 1, pp. 74 –
between the two received signals is more profound after sparse 77, 2015.
representation. Because these signals come from different [4] L. Shi, M. Li, S. Yu, and J. Yuan, “Bana: Body area network authenti-
transmitters, their channel is hard to similar. cation exploiting channel characteristics,” Selected Areas in Communi-
cations, IEEE Journal on, no. 9, pp. 1803–1816, 2013.
Fig. 4 shows that the correlation rate ranges from 0.5 to 0.8 [5] F. Zheng, Z. Xiao, S. Zhou, J. Wang, and L. Huang, “Message authenti-
under the normal situation, while this rate range is from 0 to cation over noisy channels,” Entropy, vol. 17, no. 1, pp. 368–383, 2015.
0.25 under the spoofing attack situation. We can see a clear [6] J. Yang, Y. Chen, W. Trappe, and J. Cheng, “Determining the number
of attackers and localizing multiple adversaries in wireless spoofing
difference between the two situations. After the processing attacks,” in INFOCOM 2009, IEEE. IEEE, 2009, pp. 666–674.
of ARSA, two signals representing the most difference are [7] X. Liang, L. J. Greenstein, L. Fellow, and B. M. Narayan, “Channel-
elected. As the above analysis, the same transmitter has the based spoofing detection in frequency-selective rayleigh channels,” IEEE
Transactions on Wireless Communications, vol. 8, no. 12, pp. 5948 –
similar channel, so their sparse representation is more relevant. 5956, 2009.
On the contrary, in spoofing attack situation, their channels are [8] L. Xiao, A. Reznik, W. Trappe, C. Ye, Y. Shah, L. Greenstein, and
hard to parallel, so the correlation rate is very low. N. Mandayam, “Phy-authentication protocol for spoofing detection in
wireless networks,” in Global Telecommunications Conference (GLOBE-
COM 2010), 2010 IEEE. IEEE, 2010, pp. 1–6.
IV. REMARK [9] Y. Chen, W. Trappe, and R. P. Martin, “Detecting and localizing wireless
spoofing attacks,” in Sensor, Mesh and Ad Hoc Communications and
Networks, 2007. SECON’07. 4th Annual IEEE Communications Society
Accommodation. In practical, moving action and complex Conference on. IEEE, 2007, pp. 193–202.
environment will reduce the correlation of the received signal. [10] D. B. Faria and D. R. Cheriton, “Detecting identity-based attacks in
If the observation time interval is within the coherence time, wireless networks using signalprints,” in Proceedings of the 5th ACM
workshop on Wireless security. ACM, 2006, pp. 43–52.
spoofing detection will adopt the mobile object for the channel [11] N. Otsu, “A threshold selection method from gray-level histograms,”
reciprocity. Automatica, vol. 11, no. 285-296, pp. 23–27, 1975.
Consumption. In the process of authentication, the algorith-
m is low-power design. Instead of traditional cryptographic
authentication, our scheme is more suitable for low-power
requirements of the application, and without communication
costs and additional operation.
Scalability. The proposed authentication can be used in
combination with other security programs (for example key-
based authentication). Reasonable combination scheme can
improve the safety performance.
Security. In various attacks, spoofing attack is prerequisites.
This attack model is the foundation of other senior attacks.
Therefore, preventing spoofing attacks can greatly enhance the
security of wireless communication.

585