[Paper Review] CyberSpec: Intelligent Behavioral Fingerprinting to Detect Attacks on Crowdsensing Spectrum Sensors

Alberto Huertas Celdrán, Pedro Miguel Sánchez Sánchez+3 more|arXiv (Cornell University)|Jan 14, 2022

Digital Media Forensic Detection4 citations

TL;DR

This paper proposes CyberSpec, a machine learning/digital fingerprinting framework that detects spectrum sensing data falsification (SSDF) attacks in resource-constrained crowdsensing spectrum sensors by monitoring internal system events. Evaluated on the real ElectroSense platform, CyberSpec achieves near-perfect detection (100% TPR) for five of seven SSDF attacks using unsupervised models with detection times under 60 seconds.

ABSTRACT

Integrated sensing and communication (ISAC) is a novel paradigm using crowdsensing spectrum sensors to help with the management of spectrum scarcity. However, well-known vulnerabilities of resource-constrained spectrum sensors and the possibility of being manipulated by users with physical access complicate their protection against spectrum sensing data falsification (SSDF) attacks. Most recent literature suggests using behavioral fingerprinting and Machine/Deep Learning (ML/DL) for improving similar cybersecurity issues. Nevertheless, the applicability of these techniques in resource-constrained devices, the impact of attacks affecting spectrum data integrity, and the performance and scalability of models suitable for heterogeneous sensors types are still open challenges. To improve limitations, this work presents seven SSDF attacks affecting spectrum sensors and introduces CyberSpec, an ML/DL-oriented framework using device behavioral fingerprinting to detect anomalies produced by SSDF attacks affecting resource-constrained spectrum sensors. CyberSpec has been implemented and validated in ElectroSense, a real crowdsensing RF monitoring platform where several configurations of the proposed SSDF attacks have been executed in different sensors. A pool of experiments with different unsupervised ML/DL-based models has demonstrated the suitability of CyberSpec detecting the previous attacks within an acceptable timeframe.

Motivation & Objective

• Address the lack of formalized SSDF attack models targeting resource-constrained spectrum sensors in crowdsensing environments.
• Overcome challenges in detecting SSDF attacks due to limited device resources, heterogeneous sensor types, and data integrity threats.
• Develop a scalable, lightweight anomaly detection framework that leverages behavioral fingerprinting and unsupervised ML/DL for real-time detection.
• Evaluate the performance and scalability of ML/DL models across individual, device-type, and global model configurations in real-world settings.
• Identify missing behavioral features that hinder detection of certain attacks (e.g., Repeat, Freeze), guiding future improvements.

Proposed method

• Define and implement seven novel SSDF attacks—Repeat, Mimic, Confusion, Noise, Spoof, Freeze, and Delay—classified into three families: simulating false signals, hiding real attacks, and combining both.
• Design CyberSpec to monitor 8 internal system events: virtual memory, file system, CPU, network, scheduler, device drivers, system calls, and random number generation.
• Extract behavioral features from periodic event logs to create device-specific behavioral fingerprints for anomaly detection.
• Apply unsupervised ML/DL models—Autoencoder, Isolation Forest (IF), Local Outlier Factor (LOF), COPOD, and One-Class SVM (OC-SVM)—to detect deviations from normal behavior.
• Train models offline and deploy them on a central server to evaluate features in real time, minimizing computational load on edge devices.
• Conduct experiments across three configurations: individual device models, device-type models (excluding 15%, 33%, or 50% of devices), and global models combining all sensors.

Experimental results

Research questions

• RQ1 What are the behavioral signatures of seven novel SSDF attacks on resource-constrained spectrum sensors, and how do they affect data integrity?
• RQ2 How effective are unsupervised ML/DL models in detecting anomalies caused by these SSDF attacks using internal system event monitoring?
• RQ3 What is the detection performance and scalability of individual, device-type, and global ML/DL models across heterogeneous spectrum sensors?
• RQ4 Which system events are critical for detecting specific SSDF attacks, and which are currently missing (e.g., file read operations) that limit detection?
• RQ5 Can the framework achieve low-latency detection (<60s) while maintaining low computational overhead on edge devices?

Key findings

• Five of the seven SSDF attacks—Noise, Spoof, Confusion, Mimic, and Delay—achieved 100% True Positive Rate (TPR) across all three experimental configurations (individual, device-type, global models).
• The Autoencoder, LOF, and OC-SVM models demonstrated the highest detection performance, with detection times under 60 seconds, including monitoring, preprocessing, and evaluation phases.
• Device-type models maintained strong performance when 15%, 33%, or 50% of devices were excluded from training, achieving 80–70% TPR and 100% True Negative Rate (TNR) for five attacks.
• Repeat and Freeze attacks were poorly detected (7–32% TPR) because CyberSpec does not monitor file read operations, which are central to their behavior.
• The global model training took 770.39 seconds, but testing time was minimal (0.01–0.04 seconds), confirming low-latency detection feasibility in real-time deployment.
• The framework’s total detection latency, including monitoring (50 s), preprocessing (6.8 s), and evaluation (2.75 s), was under 60 seconds, making it suitable for real-time threat detection.