Statistics for Spatial Data.

Simulation and the monte carlo method

https://www.jstage.jst.go.jp/article/jsprs1975/37/6/37_6_39/_pdf

1998 IEEE International Conference on SMCに参加して

Understanding Contemporary Society: Theories of the Present

In order to provide meaningful data about spectrum use, occupancy measurements describing the utilization rate of a specific frequency band should be conducted over a specific area instead of a single location. This paper presents a comprehensive methodology for the measurement and analysis of spectrum occupancy. This paper surveys spectrum measurement campaigns and associated interference maps, introducing the latter as a tool for spectrum analysis and management based on measurement data. An interference map characterizes the spectrum use by defining the level of interference over an area of interest in a certain frequency band. Building on findings from practical measurement studies, guidelines for spectrum occupancy measurements are given. While many scientific spectrum occupancy measurement papers tend to be too optimistic about the significance and generality of the results, we propose a cautionary perspective on drawing strong conclusions based on the often limited amount of data gathered. The different phases of the spectrum occupancy measurement and analysis process are described and a thorough discussion of interpolation methods is provided. Means to improve the measurement accuracy are discussed, especially regarding spatial domain considerations and the impact of the sampling interval on the results. A practical example of an improved measurement system design covering all the phases of the measurement process and used at the Turku, Finland; Blacksburg, VA, USA; and Chicago, IL, USA, spectrum observatories is given. Using the improved design, more realistic spectrum occupancy data can be obtained to lay the foundation for spectrum management decisions.

Spectrum Occupancy Measurements: A Survey and Use of Interference Maps

It is a promising vision to utilize white spaces, i.e., vacant VHF and UHF TV channels, to satisfy skyrocketing wireless data demand in both outdoor and indoor scenarios. While most prior works have focused on exploring outdoor white spaces, the indoor story is largely open for investigation. Motivated by this observation and that 70% of the spectrum demand comes from indoor environments, we carry out a comprehensive study of exploring indoor white spaces. We first present a large-scale measurement of outdoor and indoor TV spectrum occupancy in 30+ diverse locations in a typical metropolis Hong Kong. Our measurement results confirm abundant white spaces available for exploration in a wide range of areas in metropolises. In particular, more than 50% and 70% of the TV spectrum are white spaces in outdoor and indoor scenarios, respectively. While there are substantially more white spaces in indoor scenarios than in outdoor scenarios, there is no effective solution for identifying indoor white spaces. To fill in this gap, we propose the first system WISER (for White-space Indoor Spectrum EnhanceR), to identify and track indoor white spaces in a building, without requiring user devices to sense the spectrum. We discuss the design space of such system and justify our design choices using intensive real-world measurements. We design the architecture and algorithms to address the inherent challenges. We build a WISER prototype and carry out real-world experiments to evaluate its performance. Our results show that WISER can identify 30%-50% more indoor white spaces with negligible false alarms, as compared to alternative baseline approaches.

/pdf/exploring-indoor-white-spaces-in-metropolises-1hqqjhidfp.pdf

Exploring indoor white spaces in metropolises

Automobiles are equipped with Electronic Control Units (ECUs) that communicate via in-vehicle network protocol standards such as the Controller Area Network (CAN). These protocols were designed under the assumption that separating in-vehicle communications from external networks is sufficient for protection against cyber attacks. This assumption, however, has been shown to be invalid by recent attacks in which adversaries were able to infiltrate the in-vehicle network. Motivated by these attacks, intrusion detection systems (IDSs) have been proposed for in-vehicle networks that attempt to detect attacks by exploiting physical properties such as clock skew of an ECU. In this paper, we propose the cloaking attack, an intelligent masquerade attack in which an adversary modifies the timing of transmitted messages to match the clock skew of a targeted ECU. The attack leverages the fact that, while the clock skew is a physical property of each ECU that cannot be changed by the adversary, the estimation of the clock skew by other ECUs is based on the timing of network traffic, which, being a cyber component only, can be modified by an adversary. We implement the proposed cloaking attack and test it on two IDSs, namely, the current state-of-the-art IDS and its adaptation to the widely-used Network Time Protocol (NTP). We implement the cloaking attack on two hardware testbeds, a prototype and a real vehicle, and show that it is able to deceive both IDSs. We also introduce a new metric called the Maximum Slackness Index to quantify the effectiveness of a clock skew-based IDS in detecting masquerade attacks when the adversary is unable to precisely match the clock skew of the targeted ECU.

Cloaking the clock: emulating clock skew in controller area networks

This paper presents a new masquerade attack called the cloaking attack and provides formal analyses for clock skew-based intrusion detection systems (IDSs) that detect masquerade attacks in the controller area network (CAN) in automobiles. In the cloaking attack, the adversary manipulates the message inter-transmission times of spoofed messages by adding delays so as to emulate a desired clock skew and avoid detection. In order to predict and characterize the impact of the cloaking attack in terms of the attack success probability on a given CAN bus and IDS, we develop formal models for two clock skew-based IDSs, i.e., the state-of-the-art (SOTA) IDS and its adaptation to the widely used network time protocol (NTP), using parameters of the attacker, the detector, and the hardware platform. To the best of our knowledge, this is the first paper that provides formal analyses of clock skew-based IDSs in automotive CAN. We implement the cloaking attack on two hardware testbeds, a prototype and a real vehicle (the University of Washington EcoCAR), and demonstrate its effectiveness against both the SOTA and NTP-based IDSs. By comparing each predicted attack success probability curve against its experimental curve, we find that the average prediction error is within 3.0% for the SOTA IDS and 5.7% for the NTP-based IDS.

Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

Nowadays, the interconnection of automotive systems with modern digital devices offers advanced user experiences to drivers. Electronic Control Units (ECUs) carry out a multitude of operations using the insecure Controller Area Network (CAN) bus in automotive Cyber-Physical Systems (CPSs). Therefore, dangerous attacks, such as disabling brakes, are possible and the safety of passengers is at risk. In this paper, we present TACAN (Transmitter Authentication in CAN), which provides secure authentication of ECUs by exploiting the covert channels without introducing CAN protocol modifications or traffic overheads (i.e., no extra bits or messages are used). TACAN turns upside-down the originally malicious concept of covert channels and exploits it to build an effective defensive technique that facilitates transmitter authentication via a trusted Monitor Node. TACAN consists of three different covert channels for ECU authentication: 1) Inter-Arrival Time (IAT)-based, leveraging the IATs of CAN messages; 2) offset-based, exploiting the clock offsets of CAN messages; 3) Least Significant Bit (LSB)-based, concealing authentication messages into the LSBs of normal CAN data. We implement the covert channels on the University of Washington (UW) EcoCAR testbed and evaluate their performance through extensive experiments. We demonstrate the feasibility of TACAN, highlighting no traffic overheads and attesting the regular functionality of ECUs. In particular, the bit error ratios are within 0.1% and 0.42% for the IAT-based and offset-based covert channels, respectively. Furthermore, the bit error ratio of the LSB-based covert channel is equal to that of a normal CAN bus, which is 3.1 x 10-7%.

TACAN: transmitter authentication through covert channels in controller area networks

White Space Networking crucially relies on the active monitoring of spectrum usage (to identify white space opportunities) in both space and time. One way to achieve this is wide-area deployment of spectrum sensors to gather spatio-temporal spectrum data, and use them to construct better Radio Environment Maps (REMs) via suitable statistical interpolation techniques (i.e., Kriging). Cost of such large-scale sensor deployment can be reduced via crowdsourcing, i.e., outsourcing the sensing task to mobile users equipped with sensorized high-end client devices (e.g., tablets or smartphones), and success of such crowdsourced sensing presumes some incentive mechanisms to attract user participation. In this work, we present an incentivized crowdsourcing system architecture that (periodically) acquires spectrum data from users, so as to optimize the resulting radio environment map (i.e., minimizing the average prediction-error variance) for a given data acquisition budget. First, we introduce an auction-based incentive mechanism that is computationally efficient, individually rational and truthful, and prove that the total payment of the proposed mechanism is a monotonically increasing function of the cardinality of the winner set. Then we propose a budget-feasible version and through extensive simulations, we evaluate the performance of proposed mechanisms for comparison to a baseline to demonstrate its significantly superior performance in crowdsourced radio mapping.

Xuhang Ying

Papers

Exploring indoor white spaces in metropolises

Cloaking the clock: emulating clock skew in controller area networks

Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

TACAN: transmitter authentication through covert channels in controller area networks

Incentivizing crowdsourcing for radio environment mapping with statistical interpolation