Scalable and Robust Mobile Activity Fingerprinting via Over-the-Air Control Channel in 5G Networks

• URL: http://arxiv.org/abs/2409.12572v1
• Date: Thu, 19 Sep 2024 08:49:40 GMT
• Title: Scalable and Robust Mobile Activity Fingerprinting via Over-the-Air Control Channel in 5G Networks
• Abstract summary: We show that less than 10% of Physical Downlink Control Channel (PDCCH) messages could be decoded using sniffers. This privacy attack exposes the number of active communication channels and reveals the mobile applications and their usage time. We propose an efficient deep learning-based mobile traffic classification method that eliminates the need for manual feature extraction.
• Score: 0.15346678870160887
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: 5G has undergone significant changes in its over-the-air control channel architecture compared to legacy networks, aimed at enhancing performance. These changes have unintentionally strengthened the security of control channels, reducing vulnerabilities in radio channels for attackers. However, based on our experimental results, less than 10% of Physical Downlink Control Channel (PDCCH) messages could be decoded using sniffers. We demonstrate that even with this limited data, cell scanning and targeted user mobile activity tracking are feasible. This privacy attack exposes the number of active communication channels and reveals the mobile applications and their usage time. We propose an efficient deep learning-based mobile traffic classification method that eliminates the need for manual feature extraction, enabling scalability across various applications while maintaining high performance even in scenarios with data loss. We evaluated the effectiveness of our approach using both an open-source testbed and a commercial 5G testbed, demonstrating the feasibility of mobile activity fingerprinting and targeted attacks. To the best of our knowledge, this is the first study to track mobile activity over-the-air using PDCCH messages.

Related papers

• 5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information (long version) [4.294205370255953]
  We present a novel technique to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline.<n>We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors.
  arXiv  Detail & Related papers  (2026-09-07T11:39:52Z)
• Robust and Precise Application Fingerprinting on 5G Physical Uplink Channel [14.703722937793641]
  Air fingerprinting infers application activity by sniffing metadata from cellular control channels.<n>5G encrypts these channels, breaking the attack chain that prior attacks depend on.<n>This paper reveals a physical-layer side channel that bypasses encryption.
  arXiv  Detail & Related papers  (2026-06-13T09:36:34Z)
• ActiveFlowMark: Assessing Tor Anonymity under Active Bandwidth Watermarking [34.15634406550005]
  Low-latency anonymity networks such as Tor remain vulnerable to infrastructure-level traffic analysis.<n>We introduce NATA, a non-invasive active traffic-correlation analysis algorithm.<n>It injects distinguishable throughput patterns into traffic flows through controlled bandwidth perturbations.
  arXiv  Detail & Related papers  (2026-05-07T08:57:57Z)
• Breaking 5G on The Lower Layer [9.311361097270153]
  We explore lower-layer exploitation in modern 5G.<n>Recent releases have increased the number of lower-layer control messages and procedures.<n>We present two practical attacks and evaluate them in a controlled lab testbed.
  arXiv  Detail & Related papers  (2026-02-10T19:54:32Z)
• Slice-Aware Spoofing Detection in 5G Networks Using Lightweight Machine Learning [0.0]
  This study presents a slice-aware lightweight machine-learning framework for detecting spoofing attacks within 5G network slices.<n>The framework was implemented on a reproducible Open5GS and srsRAN testbed.<n>Results show that aligning security intelligence with slice boundaries enhances detection reliability and preserves operational isolation.
  arXiv  Detail & Related papers  (2025-11-12T18:44:02Z)
• Screen Hijack: Visual Poisoning of VLM Agents in Mobile Environments [61.808686396077036]
  We present GHOST, the first clean-label backdoor attack specifically designed for mobile agents built upon vision-language models (VLMs)<n>Our method manipulates only the visual inputs of a portion of the training samples without altering their corresponding labels or instructions.<n>We evaluate our method across six real-world Android apps and three VLM architectures adapted for mobile use.
  arXiv  Detail & Related papers  (2025-06-16T08:09:32Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• What If We Had Used a Different App? Reliable Counterfactual KPI Analysis in Wireless Systems [52.499838151272016]
  This paper addresses the "what-if" problem of estimating the values of key performance indicators (KPIs) that would have been obtained if a different app had been implemented by the radio access network (RAN) We propose a conformal-prediction-based counterfactual analysis method for wireless systems that provides reliable "error bars" for the estimated, containing the true with a user-defined probability.
  arXiv  Detail & Related papers  (2024-09-30T18:47:26Z)
• Distilling Channels for Efficient Deep Tracking [68.13422829310835]
  This paper presents a novel framework termed channel distillation to facilitate deep trackers. We show that an integrated formulation can turn feature compression, response map generation, and model update into a unified energy minimization problem. The resulting deep tracker is accurate, fast, and has low memory requirements.
  arXiv  Detail & Related papers  (2024-09-18T08:09:20Z)
• Transfer-based Adversarial Poisoning Attacks for Online (MIMO-)Deep Receviers [44.051757540209756]
  We propose a transfer-based adversarial poisoning attack method for online receivers. Without knowledge of the attack target, perturbations are injected to the pilots, poisoning the online deep receiver. Simulation results indicate that the proposed poisoning attack significantly reduces the performance of online receivers.
  arXiv  Detail & Related papers  (2024-09-04T04:17:57Z)
• Federated Learning for Zero-Day Attack Detection in 5G and Beyond V2X Networks [9.86830550255822]
  Connected and Automated Vehicles (CAVs) on top of 5G and Beyond networks (5GB) make them vulnerable to increasing vectors of security and privacy attacks. We propose in this paper a novel detection mechanism that leverages the ability of the deep auto-encoder method to detect attacks relying only on the benign network traffic pattern. Using federated learning, the proposed intrusion detection system can be trained with large and diverse benign network traffic, while preserving the CAVs privacy, and minimizing the communication overhead.
  arXiv  Detail & Related papers  (2024-07-03T12:42:31Z)
• CONNECTION: COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioN [1.7034813545878589]
  Covert channel networks are a well-known method for circumventing the security measures organizations put in place to protect their networks from adversarial attacks. This paper introduces a novel method based on bit-rate modulation for implementing covert channels between devices connected over a wide area network.
  arXiv  Detail & Related papers  (2024-04-24T13:14:09Z)
• Unprotected 4G/5G Control Procedures at Low Layers Considered Dangerous [4.235733335401408]
  We study the complexity of the cellular standards and the high degree of cross-layer operations. We find that current cellular systems are susceptible to several new passive attacks due to information leakage. We identify active attacks that reduce the users' throughput by disabling RF front ends at the UE.
  arXiv  Detail & Related papers  (2024-03-11T13:42:05Z)
• Real-time Traffic Classification for 5G NSA Encrypted Data Flows With Physical Channel Records [3.8998980344852856]
  classification of fifth-generation New-Radio (5G-NR) mobile network traffic is an emerging topic in the field of telecommunications. Traditional approaches such as Deep Packet Inspection (DPI) can not be directly applied to encrypted data flows. In this study, we examine the real-time encrypted 5G Non-Standalone (NSA) application-level traffic classification using physical channel records.
  arXiv  Detail & Related papers  (2023-07-15T09:32:34Z)
• Propagate And Calibrate: Real-time Passive Non-line-of-sight Tracking [84.38335117043907]
  We propose a purely passive method to track a person walking in an invisible room by only observing a relay wall. To excavate imperceptible changes in videos of the relay wall, we introduce difference frames as an essential carrier of temporal-local motion messages. To evaluate the proposed method, we build and publish the first dynamic passive NLOS tracking dataset, NLOS-Track.
  arXiv  Detail & Related papers  (2023-03-21T12:18:57Z)
• Channel-wise Gated Res2Net: Towards Robust Detection of Synthetic Speech Attacks [67.7648985513978]
  Existing approaches for anti-spoofing in automatic speaker verification (ASV) still lack generalizability to unseen attacks. We present a novel, channel-wise gated Res2Net (CG-Res2Net), which modifies Res2Net to enable a channel-wise gating mechanism.
  arXiv  Detail & Related papers  (2021-07-19T12:27:40Z)
• Deep Reinforcement Learning with Spatio-temporal Traffic Forecasting for Data-Driven Base Station Sleep Control [39.31623488192675]
  To meet the ever increasing mobile traffic demand in 5G era, base stations (BSs) have been densely deployed in radio access networks (RANs) to increase the network coverage and capacity. As the high density of BSs is designed to accommodate peak traffic, it would consume an unnecessarily large amount of energy if BSs are on during off-peak time. To save the energy consumption of cellular networks, an effective way is to deactivate some idle base stations that do not serve any traffic demand. In this paper, we develop a traffic-aware dynamic BS sleep control framework, named DeepBSC
  arXiv  Detail & Related papers  (2021-01-21T01:39:42Z)
• Temporally-Transferable Perturbations: Efficient, One-Shot Adversarial Attacks for Online Visual Object Trackers [81.90113217334424]
  We propose a framework to generate a single temporally transferable adversarial perturbation from the object template image only. This perturbation can then be added to every search image, which comes at virtually no cost, and still, successfully fool the tracker.
  arXiv  Detail & Related papers  (2020-12-30T15:05:53Z)
• Exploitation of Channel-Learning for Enhancing 5G Blind Beam Index Detection [1.9981375888949475]
  This work investigates how machine learning technology can improve the performance of 5G cell and beam index search in practice. We propose and implement new channel-learning schemes to enhance the performance of 5G beam index detection.
  arXiv  Detail & Related papers  (2020-12-07T12:24:32Z)
• Self-supervised Video Object Segmentation [76.83567326586162]
  The objective of this paper is self-supervised representation learning, with the goal of solving semi-supervised video object segmentation (a.k.a. dense tracking) We make the following contributions: (i) we propose to improve the existing self-supervised approach, with a simple, yet more effective memory mechanism for long-term correspondence matching; (ii) by augmenting the self-supervised approach with an online adaptation module, our method successfully alleviates tracker drifts caused by spatial-temporal discontinuity; (iv) we demonstrate state-of-the-art results among the self-supervised approaches on DAVIS-2017 and YouTube
  arXiv  Detail & Related papers  (2020-06-22T17:55:59Z)
• Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises [87.53808756910452]
  A cooling-shrinking attack method is proposed to deceive state-of-the-art SiameseRPN-based trackers. Our method has good transferability and is able to deceive other top-performance trackers such as DaSiamRPN, DaSiamRPN-UpdateNet, and DiMP.
  arXiv  Detail & Related papers  (2020-03-21T07:13:40Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.