PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Learning for Signal Authentication and Security in Massive Internet of Things Systems

Aidin Ferdowsi, Walid Saad

arXiv:1803.00916v2cs.CRcs.GTcs.LG

TL;DR

Resource-constrained IoT systems need reliable signal authentication, while gateways in massive deployments cannot authenticate every device. The paper combines dynamic LSTM-based watermarking with game-theoretic and learning approaches to device selection, reporting reliable transmission under one second and fewer compromised devices.

  • Problem

    Resource-constrained IoT devices make signal security challenging, and a gateway in a large-scale system cannot authenticate all transmitted signals.

    Source: §I · p. 1

  • Method

    The paper combines LSTM-based dynamic signal watermarking with game-theoretic device selection and learning methods for resource-constrained gateways.

    Source: §I · p. 2

  • Results

    The watermarking approach supports reliable IoT signal transmission under 1 second of latency, and the learning algorithms reduce compromised IoTDs by about 30%.

    Source: §I · p. 2

  • Takeaways & Limitations

    The authors conclude that LSTM watermarking is suitable for signal authentication because of its low complexity, small delay, and high attack-detection accuracy.

    Source: §V · p. 14

Abstract

from arXiv · show

Secure signal authentication is arguably one of the most challenging problems in the Internet of Things (IoT) environment, due to the large-scale nature of the system and its susceptibility to man-in-the-middle and eavesdropping attacks. In this paper, a novel deep learning method is proposed for dynamic authentication of IoT signals to detect cyber attacks. The proposed learning framework, based on a long short-term memory (LSTM) structure, enables the IoT devices (IoTDs) to extract a set of stochastic features from their generated signal and dynamically watermark these features into the signal. This method enables the cloud, which collects signals from the IoT devices, to effectively authenticate the reliability of the signals. Moreover, in massive IoT scenarios, since the cloud cannot authenticate all the IoTDs simultaneously due to computational limitations, a game-theoretic framework is proposed to improve the cloud's decision making process by predicting vulnerable IoTDs. The mixed-strategy Nash equilibrium (MSNE) for this game is derived and the uniqueness of the expected utility at the equilibrium is proven. In the massive IoT system, due to a large set of available actions for the cloud, it is shown that analytically deriving the MSNE is challenging and, thus, a learning algorithm proposed that converges to the MSNE. Moreover, in order to cope with the incomplete information case in which the cloud cannot access the state of the unauthenticated IoTDs, a deep reinforcement learning algorithm is proposed to dynamically predict the state of unauthenticated IoTDs and allow the cloud to decide on which IoTDs to authenticate. Simulation results show that, with an attack detection delay of under 1 second the messages can be transmitted from IoT devices with an almost 100% reliability.

I. INTRODUCTION

The paper addresses secure signal authentication and gateway resource limits in massive IoT through dynamic watermarking and game-theoretic device selection. It develops signal authentication from a system model and spread-spectrum watermarking to an LSTM-based approach.

I. INTRODUCTION

  • Resource-constrained IoT devices make signal security challenging, and gateway computational limits prevent authenticating every transmitted signal.Source: §I · pp. 1–2
  • The framework uses LSTM-extracted stochastic signal features for dynamic watermarking and a game-theoretic model to predict vulnerable devices under gateway resource constraints.The game’s mixed-strategy Nash equilibrium is derived, and a learning approach addresses the computational expense of analytical strategy selection.Source: §I · p. 2
  • Under 1 second of latency, the proposed watermarking approach supports reliable IoT signal transmission, while the learning algorithms reduce compromised IoTDs by about 30%.Source: §I · p. 2

II. IOT SIGNAL AUTHENTICATION: SYSTEM MODEL AND DEEP LEARNING SOLUTION

  • The system model considers IoTD signals used by a gateway for estimation and control, with an attacker that manipulates transmitted signals to cause estimation errors.Source: §II · p. 2

A. Spread Spectrum Watermarking

B. Static Watermarking for IoTD Attack Detection

Static spread-spectrum watermarking authenticates IoTD signals by embedding a bit stream and checking it at the gateway. Its security and detection delay depend on parameter choices, while a static stream can be exposed through long recordings.

B. Static Watermarking for IoTD Attack Detection

  • The gateway extracts the embedded bit stream and raises an attack alarm when it differs from the original stream.Embedding repeats over successive blocks of n_i n_si signal samples.Source: B. Static Watermarking for IoTD Attack… · p. 3
  • Small watermark power can raise bit errors, while longer pseudo-noise keys reduce errors at the cost of gateway computation and detection delay.Source: B. Static Watermarking for IoTD Attack… · p. 3
  • The watermark parameters are selected to limit key extraction and detection delay while meeting bit-extraction error and attack-detection requirements.The theorem expresses parameter conditions in terms of an acceptable delay, desired unsuccessful-attack probability, and desired bit-extraction error probability.Source: B. Static Watermarking for IoTD Attack… · pp. 3–4
  • A long-recording attacker can potentially recover the pseudo-noise key when the embedded bit stream remains static; dynamically changing the stream is proposed to deter this attack.Source: B. Static Watermarking for IoTD Attack… · p. 4

C. Deep Learning for Dynamic IoT Signal Watermarking

The dynamic watermarking method uses signal fingerprints to update the embedded bit stream. It applies LSTM sequence analysis to extract those fingerprints from time-dependent IoTD signals.

C. Deep Learning for Dynamic IoT Signal Watermarking

  • LSTM blocks extract fingerprints from time-dependent IoTD signals, using stochastic characteristics such as spectral flatness, central moments, skewness, and kurtosis to update the watermark bit stream dynamically.Source: C. Deep Learning for Dynamic IoT… · p. 4

1) Introduction to LSTM Cells:

LSTMs address conventional RNNs’ difficulty retaining information from past samples, making them suitable for time-dependent IoT signals. The paper uses them to extract signal features and watermark a dynamically generated bit stream.

1) Introduction to LSTM Cells:

  • LSTM forget, input, and output gates manage past information, current input, and the generated output, addressing conventional RNNs’ tendency to forget past samples.Conventional RNNs also face vanishing gradients during training.Source: 1) Introduction to LSTM Cells · p. 4

2) LSTM for Dynamic Signal Watermarking at the IoTDS:

  • The IoTD’s LSTM processes signal sequences over time, so its extracted fingerprints depend on activations at previous time steps.The bit stream is updated based on the sequence of generated data.Source: 2) LSTM for Dynamic Signal… · p. 4
  • The IoTD extracts spectral flatness, mean, variance, skewness, and kurtosis, maps them to a bit stream, and watermarks it into the original signal using a key.Training uses the original signal and a pseudo-noise key as inputs and the watermarked signal as the output.Source: 2) LSTM for Dynamic Signal… · pp. 4–5

3) LSTM for Dynamic Signal Authentication at the gateway:

The gateway uses a dynamic watermarking LSTM to extract bits and features from received signals and detect attacks by comparing them with the original signal’s content. Because authentication consumes limited gateway computation, it must choose which IoTD signals to authenticate.

3) LSTM for Dynamic Signal Authentication at the gateway:

  • The gateway triggers an attack alarm when the extracted bits and features differ from the expected sequences.The IoTD generates a different bit stream for each window, while the gateway’s DW-LSTM is trained on watermarked signals and keys to recover bits and original-signal features.Source: 3) LSTM for Dynamic Signal… · p. 5
  • Dynamic bit-stream generation is intended to prevent attackers from extracting the key and bit stream by recording and summing IoTD signals.Training is computationally expensive and can be done offline; testing uses summations, multiplications, and activation functions, and can run on any device.Source: 3) LSTM for Dynamic Signal… · p. 5
  • Limited gateway computation restricts how many IoTD signals can be authenticated, leaving unauthenticated signals as potential attack targets.The gateway must select a subset within its computation bound, while the attacker is assumed to have resources to target K devices.Source: 3) LSTM for Dynamic Signal… · p. 6

III. GAME THEORY FOR AUTHENTICATION UNDER COMPUTATIONAL CONSTRAINTS

The gateway and attacker must predict each other’s choices: more valuable IoTDs are also more likely attack targets, while gateway authentication consumes computation.

III. GAME THEORY FOR AUTHENTICATION UNDER COMPUTATIONAL CONSTRAINTS

  • Because higher-data IoTDs are more valuable to the system and more likely to be targeted, the gateway and attacker must predict which devices the other will select.The paper analyzes this interaction using game theory under gateway authentication resource constraints.Source: §III · p. 6

A. Game Formulation

The gateway–attacker game models resource-constrained signal authentication, with the gateway selecting feasible IoTDs to authenticate and the attacker selecting IoTDs to target. Dominated strategies reduce the search space, but massive systems still motivate mixed strategies because pure-strategy equilibria need not exist and the strategy sets can be large.

A. Game Formulation

  • The gateway and attacker maximize opposing utilities: the gateway seeks secured signals, while the attacker seeks compromised IoTDs that remain undetected.The gateway’s feasible pure strategies are IoTD subsets that stay within its computational resource limit.Source: A. Game Formulation · p. 7
  • The gateway should use all available computational resources, while the attacker’s non-dominated strategies use all K recording devices.Any gateway strategy that is a subset of another is weakly dominated; the attacker’s strategies reduce to selecting K IoTDs from N.Source: A. Game Formulation · p. 7
  • Restricting attacker strategies to K-device selections reduces the search from all subsets of N IoTDs to combinations of K IoTDs.The passage states the resulting complexity is O(N^K), compared with O(2^N) for considering all subsets.Source: A. Game Formulation · p. 8
  • The gateway’s non-dominated strategies can be found in O(NC/d) rather than O(2^N) using dynamic programming, although finding all such strategies is NP-hard.The algorithm uses the IoTD sampling frequencies and C/d as inputs.Source: A. Game Formulation · p. 8
  • For 1000 IoTDs, both players have very large strategy sets, and a pure-strategy Nash equilibrium is not guaranteed in the general case.The paper therefore investigates mixed-strategy equilibrium, where players assign probabilities to pure strategies.Source: A. Game Formulation · p. 8, Figure 8 · p. 8

B. Mixed-Strategy Nash Equilibrium

The paper maps mixed strategies to IoTD-level allocation probabilities to characterize equilibrium in the gateway–attacker game. It proves that infinitely many mixed-strategy Nash equilibria share a unique expected utility, while noting that direct computation becomes costly at massive scale.

B. Mixed-Strategy Nash Equilibrium

  • Mixed strategies assign probabilities to non-dominated strategies, and the expected utility is computed over the players’ strategy probabilities and payoffs.The paper maps these strategy probabilities to allocation vectors representing probabilities for individual IoTDs.Source: B. Mixed-Strategy Nash Equilibrium · pp. 8–9
  • The gateway’s allocation vector is built from probabilities over feasible strategies, with D defined as the maximum number of IoTDs in a gateway strategy.The mapping accounts for strategies of unequal size through repetitions of the non-dominated strategy set.Source: B. Mixed-Strategy Nash Equilibrium · p. 9
  • The game has infinitely many mixed-strategy Nash equilibria, but each player’s expected utility at equilibrium is unique.The proof uses the constant-sum game’s minimax solution and the mapping between allocation vectors and mixed-strategy vectors.Source: B. Mixed-Strategy Nash Equilibrium · p. 9
  • Analytically deriving the equilibrium is computationally expensive at massive scale because it requires finding and storing the gateway’s large strategy set.The gateway may also need to rerun the conventional computation as the system changes or IoTDs join.Source: B. Mixed-Strategy Nash Equilibrium · p. 9
  • The paper proposes fictitious play for complete information and an LSTM-based deep reinforcement learning algorithm when the gateway lacks information about unauthenticated IoTDs.The latter is intended to learn IoTD security states from past states.Source: B. Mixed-Strategy Nash Equilibrium · p. 10

C. Fictitious Play for Complete Information

For the complete-information case, fictitious play updates beliefs from past observations and selects strategies that maximize expected utility under each player’s constraints. The procedure continues until empirical frequencies converge; its information assumption limits its use to settings where players can observe prior choices.

C. Fictitious Play for Complete Information

  • Fictitious play updates beliefs about the opponent’s IoTD selections from observed history and chooses the next strategy to maximize expected utility subject to each player’s constraints.The attacker selects K IoTDs, while the gateway respects its computational resource limit.Source: C. Fictitious Play for Complete… · p. 10
  • The learning process stops when the empirical frequencies converge within error ϵ for every IoTD and player.Beliefs are updated after each player chooses a strategy.Source: C. Fictitious Play for Complete… · p. 10
  • In the incomplete-information architecture, gateway DW-LSTM blocks authenticate received signals when triggered by the DRL and return the associated IoTD state to it.The DRL trigger is a value of 1.Source: Figure 9 · p. 10
  • Fictitious play assumes complete information: the gateway and attacker know which IoTDs the other selected at the previous step.The paper notes this can apply when even unauthenticated IoTDs can report their security status; otherwise, the gateway only knows the states of previously authenticated IoTDs.Source: C. Fictitious Play for Complete… · p. 10

D. Deep Reinforcement Learning for Authentication under Incomplete Information

The gateway cannot observe unauthenticated IoTD states, so it approximates its payoff from attacker-action history and uses LSTM-based deep reinforcement learning to select devices to authenticate. The method addresses the large action space, but it may not converge to a mixed-strategy Nash equilibrium under incomplete information.

D. Deep Reinforcement Learning for Authentication under Incomplete Information

  • The gateway cannot compute its immediate payoff or choose its best action directly because unauthenticated IoTD states remain unknown.It therefore approximates its payoff from the attacker’s prior actions and uses an LSTM to select an action.Source: D. Deep Reinforcement Learning for… · pp. 10–11
  • The DRL combines a DNN summary of the attacker’s past actions with reinforcement learning to choose the gateway’s best action.The DNN’s LSTM output feeds fully connected and regression layers to approximate the Q function.Source: D. Deep Reinforcement Learning for… · p. 11
  • The gateway’s Q-learning state represents attacker actions across IoTDs and time, with values distinguishing no attack, attack, and non-authentication.The Q function estimates expected return for a state and gateway action; the available action space makes tabular storage and maximization challenging.Source: D. Deep Reinforcement Learning for… · p. 11
  • The learning algorithm uses replay memory, exploratory action selection, observed utilities, and Q-network updates to learn gateway actions.It estimates states of unauthenticated IoTDs from gateway beliefs and repeats until convergence.Source: D. Deep Reinforcement Learning for… · p. 11
  • Under incomplete information, the DRL may not converge to an MSNE, but its LSTM predictions can help select IoTDs to minimize compromised devices.The passage states that its expected utility is higher than equal-probability and value-proportional authentication baselines.Source: D. Deep Reinforcement Learning for… · p. 11

IV. SIMULATION RESULTS AND ANALYSIS

Simulations evaluate LSTM watermarking and gateway authentication strategies using accelerometer data and comparisons with static watermarking and baseline selection policies. The proposed methods detect dynamic injection attacks and improve gateway utility against baselines, with DRL below fictitious play in the reported resource setting.

Watermarking performance

  • The LSTM training converges after 269 epochs, with training error 0.0055 and testing error close to 0.015 on another accelerometer dataset.The reported setup trains each IoTD’s LSTM in parallel for approximately one day.Source: Figure 11 · p. 12, §IV · p. 12
  • At β/σ = 1, LSTM bit-extraction error is about one order of magnitude lower than static watermarking; at β/σ = 10, it is almost two orders lower.The dynamically changing bit stream also prevents summing recorded windows from increasing the key-to-signal power ratio to extract the bit stream and key.Source: §IV · p. 12, Figure 12 · p. 13

Attack detection

  • For dynamic data injection, static watermarking fails to detect the attack, whereas LSTM watermarking detects it with a 0.1-second delay.The detector compares extracted and hidden bit streams; the delay reflects waiting for one 0.1-second data window.Source: Figure 13 · p. 13, §IV · p. 13

Game-theoretic performance

  • At low gateway resources, DRL improves expected utility by up to 30% over both baselines, while FP exceeds DRL by up to 10% in expected utility.The Fig. 14 scenario has K = 100 recording devices; the DRL improvement corresponds to 13 fewer compromised IoTDs, while the FP gap corresponds to 7 more than FP.Source: Figure 14 · p. 14, §IV · p. 14
  • With R = 0.5 and K = 1000, FP’s expected utility is almost 5 times the baseline scenarios, while DRL improves expected utility by 20% over the baselines.The comparison varies attacker recording devices and reports a lower expected utility for DRL than FP.Source: §IV · p. 14

V. CONCLUSION

The paper concludes that LSTM-based watermarking supports IoTD signal authentication, while a game-theoretic framework addresses the gateway’s limited capacity to authenticate devices. Fictitious play handles complete information, and DRL predicts vulnerable devices when unauthenticated states are unavailable.

V. CONCLUSION

  • LSTM-based watermarking is presented as a low-complexity, low-delay, high-accuracy approach to detecting IoTD data-injection attacks.The schemes allow the gateway to authenticate the reliability of received signals.Source: §V · p. 14
  • The game-theoretic framework addresses the case where gateway computation prevents simultaneous authentication of all IoTDs.The paper derives the mixed-strategy Nash equilibrium and studies its properties.Source: §V · p. 14
  • Fictitious play converges to the MSNE with complete state information, while DRL predicts vulnerable IoTDs when unauthenticated states are unavailable.The conclusion reports simulation results as showing the effectiveness of the proposed authentication schemes.Source: §V · p. 14

APPENDIX

The proof chooses watermark parameters to balance attacker bit-extraction error against gateway extraction error, then derives a sampling constraint from the signal-reception delay.

A. Proof of Theorem 1

  • The proof chooses β_i to make attacker extraction of the hidden bit using the w sequence incur a high bit error rate.For two watermarked signals with the same embedded bit, it derives the error condition from their inner-product terms.Source: A. Proof of Theorem 1 · pp. 14–15
  • The derivation combines the attacker’s high-error requirement with the gateway’s small-extraction-error requirement to obtain β_i and n_i satisfying both.These parameters are chosen to meet the scheme’s security and performance requirements.Source: A. Proof of Theorem 1 · p. 15
  • The maximum n_s,i follows from the requirement that receiving the full watermarked signal takes n_i n_s,i / f_s,i seconds.Source: A. Proof of Theorem 1 · p. 15
Loading 1803.00916v2…