Design of a Framework to Detect Device Spoofing Attacks Using Network Characteristics This article proposes a generic framework to detect device spoofing attacks using physical network characteristics that are hard for an attacker to mimic, including received signal strength indicator and round trip time. A technological challenge with this approach is that those values can change over time and affect the detection accuracy. To overcome this challenge, we obtained the similarity of subsequent network behaviors by using a time series similarity measure. Our method continuously monitors physical network characteristics of a device, and looks for significant changes made in those monitored characteristics. Detected changes would indicate that a suspicious activity (e.g., device spoofing) has occurred. To demonstrate our implementation, we thoroughly tested the proposed framework on ZigBee (IEEE 802.15.4) wireless networks. We achieved a high Fmeasure accuracy of 0.96 when spoofing devices were located more than 5 m away from original devices.

Episodic Detection of Spoofed Data In Synchrophasor Measurement Streams Phasor Measurement Units (PMUs) provide highquality state information about the electrical grid in nearreal time. However, as utilities become more reliant on these measurements, the devices themselves as well as the communication network that supports them will likely become a more prominent attack surface for cyber threats. In this paper, we demonstrate a system designed to find anomalous PMU dataxe2x80x93specifically data that is intended to provide false signal readings (spoofed data) over a period of time. Our system uses support vector machines to distinguish between xe2x80x9cnormalxe2x80x9d system operation and xe2x80x9cspoofedxe2x80x9d operation. The work presented here makes three main contributions. Specifically, we demonstrate: (1) a SVMbased classifier that has reasonable longevity (i.e., once trained, the classifier remains valid for a reasonable length of time); (2) a distributed version of our classifier that improves the efficiency and scalability; and (3) the classifiers above can be used to detect spoofs at different levels of fidelity which can have a dramatic effect on their suitability in a realworld operating environment.