On the Security Threat of Abandoned and Zombie Cellular IoT Devices The number of networkconnected devices increased exponentially at least during the last two decades. Although the robustness and longterm stability of these devices are relatively high, many of them outlast the purpose of their installation, sometimes even the lifecycle of its serving connection technology.The number of longliving, radiotransmitting, abandoned devices keeps increasing, especially with new deployments of Internet of Things (IoT) endpoints. Such equipment occupy radio resources in both licensed and public radio bands; moreover, they seize processing resources in networking equipment. This worrying situation should be taken care of. In the short term we can identify and ban such devices, but in the long term, proper, standardized lifecycle management should be put in place.This paper demonstrates the manifestation of this problem on 3GPPbased cellular networks (3G, 4G, and 5G), although similar issues are threatening for WiFi, Bluetooth, ZigBee and LoRaWAN technologies, as well. Furthermore, the paper presents methods to identify abandoned, nonoperated or zombie devices, and proposes methods on refusing their access to the network, or xe2x80x93 in the cellular case xe2x80x93 forcing them into radio silence.

Design of a Framework to Detect Device Spoofing Attacks Using Network Characteristics This article proposes a generic framework to detect device spoofing attacks using physical network characteristics that are hard for an attacker to mimic, including received signal strength indicator and round trip time. A technological challenge with this approach is that those values can change over time and affect the detection accuracy. To overcome this challenge, we obtained the similarity of subsequent network behaviors by using a time series similarity measure. Our method continuously monitors physical network characteristics of a device, and looks for significant changes made in those monitored characteristics. Detected changes would indicate that a suspicious activity (e.g., device spoofing) has occurred. To demonstrate our implementation, we thoroughly tested the proposed framework on ZigBee (IEEE 802.15.4) wireless networks. We achieved a high Fmeasure accuracy of 0.96 when spoofing devices were located more than 5 m away from original devices.