Anomaly Detection for Sensing Security

TL;DR

This paper explores anomaly detection techniques for sensing security using filters and hypothesis tests, demonstrating their effectiveness in WiFi-based motion detection and highlighting limitations of simple countermeasures.

Contribution

It adapts and evaluates moving average, autoregression, and Kalman filters for anomaly detection in sensing security, providing insights into their robustness and limitations.

Findings

Filters effectively detect motion attacks in WiFi signals.

Power randomization alone is insufficient against attackers with CSI access.

Frequency-variant randomization may be necessary for mitigation.

Abstract

Various approaches in the field of physical layer security involve anomaly detection, such as physical layer authentication, sensing attacks, and anti-tampering solutions. Depending on the context in which these approaches are applied, anomaly detection needs to be computationally lightweight, resilient to changes in temperature and environment, and robust against phase noise. We adapt moving average filters, autoregression filters and Kalman filters to provide predictions of feature vectors that fulfill the above criteria. Different hypothesis test designs are employed that allow omnidirectional and unidirectional outlier detection. In a case study, a sensing attack is investigated that employs the described algorithms with various channel features based on commodity WiFi devices. Thereby, various combinations of algorithms and channel features show effectiveness for motion detection by an attacker. Countermeasures only utilizing transmit power randomization are shown insufficient to mitigate such attacks if the attacker has access to channel state information (CSI) measurements, suggesting that mitigation solutions might require frequency-variant randomization.