Robust and Precise Application Fingerprinting on 5G Physical Uplink Channel

• URL: http://arxiv.org/abs/2606.15221v1
• Date: Sat, 13 Jun 2026 09:36:34 GMT
• Title: Robust and Precise Application Fingerprinting on 5G Physical Uplink Channel
• Abstract summary: Air fingerprinting infers application activity by sniffing metadata from cellular control channels.<n>5G encrypts these channels, breaking the attack chain that prior attacks depend on.<n>This paper reveals a physical-layer side channel that bypasses encryption.
• Score: 14.703722937793641
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Air fingerprinting infers application activity by sniffing metadata from cellular control channels. 5G encrypts these channels, breaking the attack chain that prior attacks depend on. This paper reveals a physical-layer side channel that bypasses encryption: under the link adaptation mandated by the cellular communication standard, the uplink Modulation and Coding Scheme (MCS) remains stable, so the number of Physical Resource Blocks (PRBs) occupied by a transmission accurately reflects the IP packet length. Combined with the uplink control channel that carries downlink information, an attacker can reconstruct a bidirectional traffic profile. This bidirectional information recovery can be achieved simply by observing the uplink spectrum, without decoding any channel. Building on this side channel, we design Crosshair, a passive three-step attack. First, a blind extraction stage recovers the uplink physical channel occupancy from raw IQ samples via energy detection, reconstructing bidirectional traffic from uplink spectrum. Second, we design a data augmentation method that synthesizes spectral profiles across diverse channel conditions, eliminating the need for prior knowledge of the communication environment. Third, cross-modal alignment embeds the spectral and IP domains into a shared space, enabling new applications to be enrolled from a collected IP trace alone. Extensive experiments on a 5G NR testbed demonstrate the robustness and precision of Crosshair: it outperforms the State-of-the-Art (SOTA) physical layer fingerprinting method in application recognition accuracy, and maintains high accuracy in cross-MCS scenarios.

Related papers

• S$^3$AM: A Single-Stream SAM with Reliability-Calibrated Frequency Adapter for Multi-modal Salient Object Detection [74.15663758681849]
  Single-stream framework integrates reliability-calibrated frequency adaptation into the adopted SAM backbone for MSOD.<n>Experiments on RGB-D, RGB-T, and RGB-NIR salient object detection benchmarks validate that the proposed framework achieves competitive performance.
  arXiv  Detail & Related papers  (2026-08-18T08:05:00Z)
• Fast Cross-Scenario Adaptation of CSI Models via Channel Conditional Parameter Generation [71.49439535846827]
  Conditional Channel Generation (CCPG) is an end-to-end pipeline for rapid deployment of CSI models in dynamic wireless environments.<n> CCPG identifies scene-sensitive adaptation bottlenecks through component-freezing experiments and generates only lightweight LoRA weights.<n>Experiments on DeepMIMO and WAIR-D for CSI feedback and channel estimation show that CCPG adapts to new scenarios in about 3 seconds with a single forward pass.
  arXiv  Detail & Related papers  (2026-06-22T13:20:01Z)
• Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection [7.981257687111937]
  Stepping-stone intrusions (SSIs) are a prevalent network evasion technique.<n>Effective SSI detection requires correlating the incoming and outgoing flows at each relay host at extremely low false positive rates.<n> ESPRESSO is a flow correlation model combining a transformer-based feature extraction network, time-aligned multi-channel interval features, and online triplet metric learning.
  arXiv  Detail & Related papers  (2026-04-09T22:26:52Z)
• Benchmarking Dataset for Presence-Only Passive Reconnaissance in Wireless Smart-Grid Communications [2.721477719641864]
  This paper introduces an IEEE-inspired, literature-anchored benchmark dataset generator for passive reconnaissance over a tiered Home Area Network (HAN), Neighborhood Area Network (NAN), and Wide Area Network (WAN) communication graph with heterogeneous wireless and wireline links.
  arXiv  Detail & Related papers  (2026-03-10T12:39:03Z)
• Cross-Layer Detection of Wireless Misbehavior Using 5G RAN Telemetry and Operational Metadata [0.0]
  We study how manipulation affects the coherence among physical layer measurements, MAC scheduling decisions, and configuration metadata.<n>Every manipulation produces a distinct and reproducible signature that is not visible from any single telemetry source.<n>Findings indicate that cross layer coherence provides a practical signal for detecting uplink misbehavior using only standard gNB telemetry.
  arXiv  Detail & Related papers  (2025-11-26T18:53:26Z)
• BiLCNet : BiLSTM-Conformer Network for Encrypted Traffic Classification with 5G SA Physical Channel Records [3.4949103362575573]
  We develop a preprocessing pipeline to transform raw channel records into structured representations.<n>We propose a novel hybrid architecture: BiLSTM-Conformer Network (BiLCNet), which integrates the sequential modeling capability of BiLSTM with the spatial feature extraction strength of Conformer blocks.<n>Our model achieves a classification accuracy of 93.9%, outperforming a series of conventional machine learning and deep learning algorithms.
  arXiv  Detail & Related papers  (2025-09-22T08:27:11Z)
• DT-DDNN: A Physical Layer Security Attack Detector in 5G RF Domain for CAVs [10.215216950059874]
  jamming attacks pose substantial risks to the 5G network.<n>This work presents a novel deep learning-based technique for detecting jammers in CAV networks.<n>Results show that the proposed method achieves 96.4% detection rate in extra low jamming power.
  arXiv  Detail & Related papers  (2024-03-05T04:29:31Z)
• SCTransNet: Spatial-channel Cross Transformer Network for Infrared Small Target Detection [46.049401912285134]
  Infrared small target detection (IRSTD) has recently benefitted greatly from U-shaped neural models. Existing techniques struggle when the target has high similarities with the background. We present a Spatial-channel Cross Transformer Network (SCTransNet) that leverages spatial-channel cross transformer blocks.
  arXiv  Detail & Related papers  (2024-01-28T06:41:15Z)
• Practical quantum secure direct communication with squeezed states [37.69303106863453]
  We report the first table-top experimental demonstration of a CV-QSDC system and assess its security.<n>This realization paves the way into future threat-less quantum metropolitan networks, compatible with coexisting advanced wavelength division multiplexing (WDM) systems.
  arXiv  Detail & Related papers  (2023-06-25T19:23:42Z)
• Joint Channel Estimation and Feedback with Masked Token Transformers in Massive MIMO Systems [74.52117784544758]
  This paper proposes an encoder-decoder based network that unveils the intrinsic frequency-domain correlation within the CSI matrix. The entire encoder-decoder network is utilized for channel compression. Our method outperforms state-of-the-art channel estimation and feedback techniques in joint tasks.
  arXiv  Detail & Related papers  (2023-06-08T06:15:17Z)
• Deep Learning-Based Synchronization for Uplink NB-IoT [72.86843435313048]
  We propose a neural network (NN)-based algorithm for device detection and time of arrival (ToA) estimation for the narrowband physical random-access channel (NPRACH) of narrowband internet of things (NB-IoT) The introduced NN architecture leverages residual convolutional networks as well as knowledge of the preamble structure of the 5G New Radio (5G NR) specifications.
  arXiv  Detail & Related papers  (2022-05-22T12:16:43Z)
• Convergence of Federated Learning over a Noisy Downlink [84.55126371346452]
  We study federated learning, where power-limited wireless devices utilize their local datasets to collaboratively train a global model with the help of a remote parameter server. This framework requires downlink transmission from the PS to the devices and uplink transmission from the devices to the PS. The goal of this study is to investigate the impact of the bandwidth-limited shared wireless medium in both the downlink and uplink on the performance of FL.
  arXiv  Detail & Related papers  (2020-08-25T16:15:05Z)
• DeepSIC: Deep Soft Interference Cancellation for Multiuser MIMO Detection [98.43451011898212]
  In multiuser multiple-input multiple-output (MIMO) setups, where multiple symbols are simultaneously transmitted, accurate symbol detection is challenging. We propose a data-driven implementation of the iterative soft interference cancellation (SIC) algorithm which we refer to as DeepSIC. DeepSIC learns to carry out joint detection from a limited set of training samples without requiring the channel to be linear.
  arXiv  Detail & Related papers  (2020-02-08T18:31:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.