Mobile Crowdsensing Systems (MCS) can be attacked by an adversary that registers numerous fictitious, typically emulated, devices to report bogus data in large volumes. It is crucial to safeguard MCS by preventing registration of fictitious devices, broadly termed Sybils. Most existing defenses try to detect Sybils essentially too late, after the adversary succeeds in having them join and after having influenced the system; more so, they require sensitive user information or demand burdensome manual tasks, ultimately discouraging participation. This is why we introduce ARGUS to enhance MCS security by thwarting attempts to register Sybils at a high rate and, thus, Sybil-based attacks at the first stage of the user registration phase. ARGUS reduces the fictitious device registration rate by filtering out their registrations early in their interaction with the system, before their adversarial data can influence the MCS. To sift fake/Sybil users, we utilize sparsely sampled smartphone battery logs to reflect actual user and smartphone usage characteristics without exposing privacy-sensitive information. ARGUS isolates and identifies even (colluding) Sybil users orchestrated by an attacker with a high volume of synthetically generated data. ARGUS leverages well-known machine learning components in a novel way and provides protection for systems without relying on historical user data or user interaction (as required, notably, by CAPTCHA); that is, without reducing privacy, inconveniencing users, or discouraging participation. We evaluate the effectiveness of ARGUS through extensive experiments, demonstrating it consistently achieves an F1-score greater than 90% in detecting a broad range of Sybil registrations; with adversarial strategies ranging from perturbing genuine traces to training generative adversarial networks (GANs). Unlike existing defenses that verify device integrity (e.g., device attestation) or human presence (e.g., CAPTCHA), both of which are susceptible to high bypass rates under certain attacks, ARGUS assesses behavioral authenticity through battery usage patterns, without user interaction and pre-emptively, offering a new, fundamentally orthogonal, and complementary countermeasure. Lightweight and easy to deploy, ARGUS is the first method to leverage mobile device battery traces to detect Sybil attacks in MCS systems without exposing privacy-sensitive user data. ARGUS can significantly increase the cost for any adversary that seeks to introduce Sibyls at a high rate, effectively and efficiently detecting and rejecting those that result from adversarial automation and generated data.

Federated Learning (FL) has drawn the attention of the Intelligent Transportation Systems (ITS) community. FL can train various models for ITS tasks, notably camera-based Road Condition Classification (RCC), in a privacy-preserving collaborative way. However, opening up to collaboration also opens FL-based RCC systems to adversaries, i.e., misbehaving participants that can launch Targeted Label-Flipping Attacks (TLFAs) and threaten transportation safety. Adversaries mounting TLFAs poison training data to misguide model predictions, from an actual source class (e.g., wet road) to a wrongly perceived target class (e.g., dry road). Existing countermeasures against poisoning attacks cannot maintain model performance under TLFAs close to the performance level in attack-free scenarios, because they lack specific model misbehavior detection for TLFAs and neglect client exclusion after the detection. To close this research gap, we propose DEFEND, which includes a poisoned model detection strategy that leverages neuron-wise magnitude analysis for attack goal identification and Gaussian Mixture Model (GMM)-based clustering. DEFEND discards poisoned model contributions in each round and adapts accordingly client ratings, eventually excluding malicious clients. Extensive evaluation involving various FL-RCC models and tasks shows that DEFEND can thwart TLFAs and outperform seven baseline countermeasures, with at least 15.78% improvement, with DEFEND remarkably achieving under attack the same performance as in attack-free scenarios.

Global Navigation Satellite Systems (GNSS) are vulnerable to spoofing attacks that can compromise critical infrastructure and safety-critical applications. While Federated Learning (FL) offers a promising paradigm for collaborative GNSS spoofing detection, with privacy preservation, existing proposals remain vulnerable to Data Poisoning Attacks (DPAs), by malicious clients manipulating local training labels to degrade global model performance. This paper presents G2FL, a robust FL framework that detects and mitigates label-flipping attacks in GNSS spoofing detection. Our approach integrates two complementary mechanisms: a Gaussian Mixture Model (GMM)-based cluster analysis that distinguishes poisoned model updates from benign contributions, through validation prediction statistics, and a score-based client management system that maintains reliability assessments to exclude persistently malicious participants. Experimental evaluation using a real-world GNSS spoofing dataset demonstrates that G2FL effectively mitigates DPAs, achieving 84.29% Area Under the Curve (AUC) compared to undefended FL (56.42%) and state-of-the-art defense, FoolsGold (65.80%), while maintaining performance close to attack-free scenarios (88.77%).

Non-orthogonal multiple access (NOMA) and massive multiple-input multiple-output (MIMO) systems are highly efficient. Massive MIMO systems are inherently resistant to passive attackers (eavesdroppers), thanks to transmissions directed to the users. However, active attackers can transmit a combination of legitimate user pilot signals during the channel estimation phase. This way, they can mislead the base station (BS) to rotate the transmission in their direction and allow them to eavesdrop during the downlink data transmission phase. In this paper, we analyze this vulnerability with two-user pairing strategies and investigate how physical layer security can mitigate such attacks and ensure secure (confidential) communication. We derive the secrecy outage probability (SOP) and a lower bound on the ergodic secrecy capacity using stochastic geometry tools when the number of antennas in the BSs tends to infinity (i.e., massive MIMO BS). The numerical and simulation results show that one of the strategies performs better and has a higher ergodic secrecy rate (ESR) and lower SOP. Moreover, we show that using NOMA instead of orthogonal multiple access (OMA) improves system performance significantly.

Integrated sensing and communication (ISAC) will be central to 6G-enabled transportation, providing both seamless connectivity and high-precision sensing. However, this tight integration exposes attack points not encountered in pure sensing and communication systems. In this article, we identify unique ISAC-induced security challenges and opportunities in three interrelated domains: cyber-physical (where manipulation of sensors and actuators can mislead perception and control), physical-layer (where over-the-air signals are vulnerable to spoofing and jamming) and protocol (where complex cryptographic protocols cannot detect lower-layer attacks). Building on these insights, we put forward a multi-domain security vision for 6G transportation and propose an integrated security framework that unifies protection across domains by leveraging existing ISAC measurements for lightweight cross-checks.

Modern localization relies on satellite and terrestrial infrastructures (e.g., global navigation satellite system (GNSS) and crowd-sourced Wi-Fi), supporting critical applications ranging from autonomous navigation to life services. However, they are susceptible to multimodal location spoofing attacks, where various types of wireless signals are crafted in a coordinated manner to deceive the receiver position. Such attacks can cause severe disruptions, such as misguiding vehicles and enabling fraud. Although recent deep learning methods help detect GNSS spoofing and jamming, they require extensive labeled datasets, they are not designed for multimodal location spoofing, training is computationally intensive and centralized, thus raising privacy concerns due to the sensitive nature of location data. We propose FedRAIM, a novel federated learning framework designed for robust, efficient, and privacy-preserving multimodal location spoofing detection. The key FedRAIM elements are: training labels are autonomously generated through an extended receiver autonomous integrity monitoring (RAIM) algorithm, incorporating diverse opportunistic information, i.e., terrestrial infrastructure signals, onboard sensor data, and naturally GNSS signals. During federated training, local long short-term memory (LSTM) models are trained independently on client devices. Server then aggregates, using the FedAvg algorithm, these local model parameters, not data, into a global model, which is subsequently distributed back to the clients for iterative training. Experimental results on real-world multimodal spoofing datasets demonstrate that FedRAIM achieves an area under the curve (AUC) of up to 98.3%.

Global navigation satellite system (GNSS) receivers are ubiquitous in our society, and because they are vulnerable to jamming attacks, it is important to quickly detect and localize any attackers. Instead of relying on dedicated sensing infrastructure for localization, one can utilize crowdsensing, or participatory sensing, where a large ensemble of users contributes measurements. In this work, the used measurements are carrier-to-noise-density ratio (C/N0) estimates and automatic gain control (AGC) values, which can both be retrieved from commercial connected GNSS receivers such as mobile phones. We extend our localization algorithm, with the option to use AGC values or C/N0 estimates alone or in combination, and improve the convergence rate. The flexibility of the proposed algorithm in using either AGC or C/N0 data, depending on the type of phone, increases the potential of the algorithm for participatory localization. The proposed algorithm was evaluated using data from different types of mobile phones in a simulated environment and in over-the-air field tests. These evaluations show that the proposed algorithm can operate in real-world situations and that it outperforms similar localization algorithms, achieving an estimated error of approximately 50-60 m for a free line-of-sight path loss. Moreover, for a varying path loss, the error remains well below 500 m most of the time. Given that the receivers are placed up to over 5000 m from the transmitter, these results show that the proposed localization algorithm is efficient in narrowing down the jammer position. Based on this localization, a report to relevant authorities can be facilitate further action, e.g., precise localization and removal of the jammer.

Mobile Crowd Sensing (MCS)-based data collection can facilitate a wide range of services. Navigation MCS-based applications (N-MCS) provide the Expected Time of Arrival (ETA), helping millions in their daily lives. N-MCS users share their locations and speeds to build a current state of traffic. However, malicious users, often termed Sybils, submit falsified data from remote locations using multiple accounts to mostly fake congestion on road segments and redirect benign N-MCS users. We investigate the impact of Sybil-based attacks on N-MCS, given the sensitive nature of location data, with and without privacy-enhancing technologies (PETs). Our simulation-based N-MCS system models both PETs and non-PETs variants, as well as Sybil-based attacks targeting critical links connecting communities in the road network, identified by the Infomap algorithm. With our extensive set of experiments, we have shown that comprising on average only 3.8% of N-MCS population, with PETs it is significantly easier to reroute the users. The impact on the travel time and trip length heavily rely on the traffic state, and in some cases PETs can significantly increase the targeted users travel time (trip length) median percentage change more than non-PETs by at least 12.81 pp (9.89 pp).

Standardized Vehicle-to-everything (V2X) security architectures, such as the Secure Credential Management System (SCMS) in the U.S. and the C-ITS Security Credential Management System (CCMS) in Europe, protect driver privacy through large-scale batch issuance of short-lived pseudonym certificates. At national deployment scale, minute-level rotation across hundreds of millions of vehicles results in trillion-scale annual certificate management, creating substantial backend complexity, storage burden, and persistent cellular connectivity requirements. This paper presents V-PASS, a hardware-rooted architecture that enables vehicles to derive unlinkable pseudonyms locally from a single enrollment credential, eliminating periodic batch provisioning from the Vehicular PKI (VPKI). A Secure Element (SE) enforces a window-level authorization policy and produces a hardware-bound attestation, ensuring that at most one valid pseudonym can be derived per window even under ECU software compromise, thereby providing ex-ante resistance against Sybil attacks. V-PASS adopts a split-trust design that confines lightweight authorization to the SE while delegating computationally expensive cryptographic proofs to the ECU. The resulting window object enables stateless verification for receivers while preserving cross-window unlinkability and conditional accountability. We implement V-PASS on a Raspberry Pi 5 emulating constrained automotive hardware. Evaluation shows a verification latency of 0.30 ms per message, supporting real-time V2X safety messaging, while achieving a 1750× reduction in pseudonym storage compared to traditional VPKIs, demonstrating practical feasibility for large-scale deployment.

Standardized Vehicular Communication (VC), mainly Cooperative Awareness Messages (CAMs) and Decentralized Environmental Notification Messages (DENMs), is paramount to vehicle safety, carrying vehicle status information and reports of traffic/road-related events respectively. Broadcasted CAMs and DENMs are pseudonymously authenticated for security and privacy protection, with each node needing to have all incoming messages validated within an expiration deadline. This creates an asymmetry that can be easily exploited by external adversaries to launch a clogging Denial of Service (DoS) attack: each forged VC message forces all neighboring nodes to cryptographically validate it; at increasing rates, easy to generate forged messages gradually exhaust processing resources and severely degrade or deny timely validation of benign CAMs/DENMs. The result can be catastrophic when awareness of neighbor vehicle positions or critical reports are missed. We address this problem making the standardized VC pseudonymous authentication DoS-resilient. We propose efficient cryptographic constructs, which we term message verification facilitators, to prioritize processing resources for verification of potentially valid messages among bogus messages and verify multiple messages based on one signature verification. Any message acceptance is strictly based on public-key based message authentication/verification for accountability, i.e., non-repudiation is not sacrificed, unlike symmetric key based approaches. This further enables drastic misbehavior detection, also exploiting the newly introduced facilitators, based on probabilistic signature verification and cross-checking over multiple facilitators verifying the same message; while maintaining verification latency low even when under attack, trading off modest communication overhead. Our facilitators can also be used for efficient discovery and verification of DENM or any event-driven message, including misbehavior evidence used for our scheme. Even when vehicles are saturated by adversaries mounting a clogging DoS attack, transmitting high-rate bogus CAMs/DENMs, our scheme achieves an average 50 ms verification delay with message expiration ratio less than 1%- a huge improvement over the current standard that verifies every message signature in a First-Come First-Served (FCFS) manner and suffers from having 50% to nearly 100% of the received benign messages expiring.