Publications

(2024). Transparent TSN for Agnostic End-hosts via P4-based Traffic Characterization at Switches. Proceedings of IEEE Conference on Local Computer Networks (LCN).

DOI

(2024). Enabling Uncooperative Physical Localization in Cellular Networks. Proceedings of ACM Conference on Mobile Computing and Networking (MobiCom).

DOI

(2023). FieldFuzz: In Situ Blackbox Fuzzing of Proprietary Industrial Automation Runtimes via the Network. Proceedings of International Symposium on Research in Attacks, Intrusions and Defenses (RAID).

PDF DOI

(2023). FetchBench: Systematic Identification and Characterization of Proprietary Prefetchers. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS).

PDF DOI

(2023). Blind Concealment from Reconstruction-based Attack Detectors for Industrial Control Systems via Backdoor Attacks. Proceedings of the Cyber-Physical System Security Workshop (CPSS), co-located with ASIACCS.

PDF

(2023). White-box Concealment Attacks Against Anomaly Detectors for Cyber-Physical Systems. Proceedings of Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA).

DOI

(2023). Time sensitive networking security: issues of precision time protocol and its implementation. Cybersecurity.

DOI URL

(2023). Get Your Cyber-Physical Tests Done! Data-Driven Vulnerability Assessment of Robotic Vehicle. Proceedings of the International Conference on Dependable Systems and Networks (DSN).

PDF

(2022). Hiding in Plain Sight? On the Efficacy of Power Side Channel-Based Control Flow Monitoring. Proceedings of the USENIX Security Symposium (USENIX Security).

PDF

(2022). Defense system and method against cyber-physical attacks.

(2022). Constrained Proximity Attacks on Mobile Targets. ACM Trans. Priv. Secur..

PDF DOI

(2022). Security Analysis of Vendor Implementations of the OPC UA Protocol for Industrial Control Systems. Proceedings of the Workshop on CPS & IoT Security and Privacy (CPSIoTSec), co-located with CCS'22.

PDF DOI URL

(2022). Microarchitectural Leakage Templates and Their Application to Cache-Based Side Channels. Proceedings of the ACM Conference on Computer and Communications Security (CCS).

PDF DOI

(2022). Identifying Near-Optimal Single-Shot Attacks on ICSs with Limited Process Knowledge. Proceedings of Conference on Applied Cryptography and Network Security (ACNS).

(2022). Blurtooth: Exploiting cross-transport key derivation in Bluetooth classic and Bluetooth low energy. Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS).

PDF Project

(2022). Assessing Model-free Anomaly Detection in Industrial Control Systems Against Generic Concealment Attacks. Proceedings of the Annual Computer Security Applications Conference (ACSAC).

PDF DOI

(2021). LIGHTBLUE: Automatic Profile-Aware Debloating of Bluetooth Stacks. Proceedings of the USENIX Security Symposium (USENIX Security).

PDF

(2021). Assessing the Use of Insecure ICS Protocols via IXP Network Traffic Analysis. Proceedings of International Conference on Computer Communications and Networks (ICCCN).

PDF

(2021). vBump: Securing Ethernet-based Industrial Control System Networks with VLAN-based Traffic Aggregation. Proceedings of the Workshop on CPS&IoT Security and Privacy (CPSIoTSec).

PDF DOI

(2021). COTS Drone Detection using Video Streaming Characteristics. Proceedings of International Conference on Distributed Computing and Networking (ICDCN).

PDF DOI

(2021). Attack Detection for CPS. Encyclopedia of Cryptography, Security and Privacy.

(2020). Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems. Proceedings of the Annual Computer Security Applications Conference (ACSAC).

PDF DOI

(2020). A Statistical Analysis Framework for ICS Process Datasets. Proceedings of the Joint Workshop on CPS&IoT Security and Privacy (CPSIOTSEC’20).

DOI

(2020). BIAS: Bluetooth Impersonation AttackS. IEEE Symposium on Security and Privacy (S&P).

PDF Code Project Video DOI

(2020). Apparatus and method for monitoring a wireless network.

(2020). Key Negotiation Downgrade Attacks on Bluetooth and Bluetooth Low Energy. Transactions on Privacy and Security (TOPS).

DOI

(2020). Decentralized Privacy-Preserving Proximity Tracing.

PDF

(2020). Co-Simulating Physical Processes and Network Data for High-Fidelity Cyber-Security Experiments. Sixth Annual Industrial Control System Security Workshop (ICSS).

PDF DOI

(2019). PAtt: Physics-based Attestation of Control Systems. Proceedings of International Symposium on Research in Attacks, Intrusions and Defenses (RAID).

PDF

(2019). The KNOB is Broken: Exploiting Low Entropy in the Encryption Key Negotiation Of Bluetooth BR/EDR. Proceedings of the USENIX Security Symposium (USENIX Security).

PDF Code Project

(2019). HADES-IoT: A Practical Host-Based Anomaly Detection System for IoT Devices. Proceedings of the Asia Conference on Information, Computer and Communications Security (ASIACCS).

PDF

(2019). Hide and Seek: An Architecture for Improving Attack Visibility in Industrial Control Systems. Proceedings of the International Conference on Applied Cryptography and Network Security (ACNS).

(2019). Detection of Threats to IoT Devices using Scalable VPN-forwarded Honeypots. ACM Conference on Data and Application Security and Privacy (CODASPY).

PDF DOI

(2019). Nearby Threats: Reversing, Analyzing, and Attacking Google’s 'Nearby Connections' on Android. Proceedings of the Network and Distributed System Security Symposium (NDSS).

PDF DOI

(2019). Zero Residual Attacks on Industrial Control Systems and Stateful Countermeasures. Proceedings of the Conference on Availability, Reliability and Security.

PDF DOI

(2019). Design and Realization of Testbeds for Security Research in the Industrial Internet of Things. Security and Privacy Trends in the Industrial Internet of Things.

DOI

(2019). A toolbox for assessing the impacts of cyber-physical attacks on water distribution systems. Environmental Modelling & Software.

DOI

(2018). Location Proximity Attacks against Mobile Targets: Analytical Bounds and Attacker Strategies. Proceedings of the European Symposium on Research in Computer Security (ESORICS).

DOI

(2018). The Battle Of The Attack Detection Algorithms: Disclosing Cyber Attacks On Water Distribution Networks. Journal of Water Resources Planning and Management.

DOI

(2018). A Survey of Physics-Based Attack Detection in Cyber-Physical Systems. ACM Computing Surveys (CSUR).

DOI

(2018). WADAC: Privacy-Preserving Anomaly Detection and Attack Classification on Wireless Traffic. Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec).

PDF DOI

(2018). On Practical Threat Scenario Testing in an Electric Power ICS Testbed. Proceedings of the Cyber-Physical System Security Workshop (CPSS), co-located with ASIACCS.

PDF DOI

(2018). Design and Large-Scale Evaluation of WiFi Proximity Metrics. Proceedings of European Wireless.

PDF

(2018). State-Aware Anomaly Detection for Industrial Control Systems. Proceedings of Security Track at the ACM Symposium on Applied Computing (SAC).

PDF DOI

(2017). Practical Evaluation of Passive COTS Eavesdropping in 802.11b/n/ac WLAN. Proceedings of Conference on Cryptology And Network Security (CANS).

PDF

(2017). Gamifying ICS Security Training and Research: Design, Implementation, and Results of S3. Proceedings of Workshop on Cyber-Physical Systems Security & Privacy (SPC-CPS), co-located with CCS.

PDF DOI

(2017). On Ladder Logic Bombs in Industrial Control Systems. Proceedings of the Workshop on the Security of Industrial Control Systems and of Cyber-Physical Systems (CyberICPS), co-located with ESORICS.

PDF DOI

(2017). Link-Layer Device Type Classification on Encrypted Wireless Traffic with COTS Radios. Proceedings of the European Symposium on Research in Computer Security (ESORICS).

PDF DOI

(2017). Messmanipulationen in Steuerungssystemen. Zeitschrift für Datenrecht und Informationssicherheit (DIGMA).

(2017). Legacy-Compliant Data Authentication for Industrial Control System Traffic. Proceedings of the Conference on Applied Cryptography and Network Security (ACNS).

PDF DOI

(2017). Towards Formal Security Analysis of Industrial Control Systems. Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS).

DOI

(2017). SIPHON: Towards Scalable High-Interaction Physical Honeypots. Proceedings of the Cyber-Physical System Security Workshop (CPSS), co-located with ASIACCS.

DOI

(2017). ProfilIoT: A Machine Learning Approach for IoT Device Identification Based on Network Traffic Analysis (Poster). Proceedings of the Security Track at ACM Symposium on Applied Computing (SAC).

DOI

(2017). IoTScanner: Detecting Privacy Threats in IoT Neighborhoods. Proceedings of the Workshop on IoT Privacy, Trust, and Security (IoTPTS), co-located with ASIACCS.

DOI

(2017). IoTScanner: Detecting and Classifying Privacy Threats in IoT Neighborhoods.

PDF

(2017). Evaluation of transport mode using wearable sensor data from 43,000 students. Proceedings of Transportation Research Board Annual Meeting (TRB).

(2016). Multi-Receiver GPS Spoofing Detection: Error Models and Realization. Proceedings of the Annual Computer Security Applications Conference (ACSAC).

PDF DOI

(2016). Advanced Security Testbed Framework for Wearable IoT Devices. Transactions on Internet Technology (TOIT).

DOI

(2016). Wearable Environmental Sensors and Infrastructure for Mobile Large-scale Urban Deployment. Sensors.

DOI

(2016). Physical-Layer Integrity for Wireless Messages. Computer Networks.

DOI

(2016). Towards High-Interaction Virtual ICS Honeypots-in-a-Box. Proceedings of Workshop on Cyber-Physical Systems Security & Privacy (SPC-CPS), co-located with CCS.

PDF DOI

(2016). Limiting The Impact of Stealthy Attacks on Industrial Control Systems. Proceedings of the ACM Conference on Computer and Communications Security (CCS).

DOI

(2016). HAMIDS: Hierarchical Monitoring Intrusion Detection System for Industrial Control Systems. Proceedings of Workshop on Cyber-Physical Systems Security & Privacy (SPC-CPS), co-located with CCS.

DOI

(2016). CPDY: Extending the Dolev-Yao Attacker with Physical-Layer Interactions. Proceedings of the International Conference on Formal Engineering Methods (ICFEM).

PDF DOI

(2016). On Attacker Models and Profiles for Cyber-Physical Systems. Proceedings of the European Symposium on Research in Computer Security (ESORICS).

PDF DOI

(2016). The Right Tool for the Job: a Case for Common Input Scenarios for Security Assessment. Proceedings of Workshop on Graphical Models for Security (GraMSec).

DOI

(2016). Assessing the effect of cyber-physical attacks on water distribution systems. Proceedings of World Congress on Environmental & Water Resources (EWRI).

DOI

(2016). Water Treatment, Distribution, and Electric Power Testbeds for Research in the Design of Secure Interdependent Critical Infrastructures. Proceedings of Workshop on Security and Resilience of Cyber-Physical Infrastructures (SERECIN).

PDF

(2016). SWaT: A Water Treatment Testbed for Research and Training on ICS Security. Proceedings of Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater).

PDF Slides DOI

(2016). Simulation of Cyber-Physical Attacks on Water Distribution Systems with EPANET. Proceedings of Singapore Cyber Security Conference (SG-CRC).

DOI

(2016). SENSg: Large-Scale Deployment of Wearable Sensors for Trip and Transport Mode Logging. Proceedings of Transportation Research Board Annual Meeting (TRB).

(2016). Characterizing Cyber-Physical Attacks on Water Distribution Systems. Journal of Water Resources Planning and Management.

DOI

(2016). Attacking Fieldbus Communications in ICS: Applications to the SWaT Testbed. Proceedings of Singapore Cyber Security Conference (SG-CRC).

DOI

(2015). MiniCPS: A toolkit for security research on CPS Networks. Proceedings of Workshop on Cyber-Physical Systems Security & Privacy (SPC-CPS), co-located with CCS.

DOI

(2015). UWB Rapid-Bit-Exchange System for Distance Bounding. Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec).

DOI

(2014). Automatic Generation of Security Argument Graphs. Proceedings of the IEEE Pacific Rim International Symposium on Dependable Computing (PRDC).

DOI

(2014). Visible light communication with flickering prevention.

(2014). CyberSAGE: A Tool for Automatic Security Assessment of Cyber-Physical Systems. Proceedings of the Conference on Quantitative Evaluation of SysTems (QEST).

PDF DOI

(2013). Delay Makes a Difference: Smart Grid Resilience Under Remote Meter Disconnect Attack. Proceedings of the IEEE Conference on Smart Grid Communications (SmartGridComm).

DOI

(2013). On Limitations of Friendly Jamming for Confidentiality. Proceedings of the IEEE Symposium on Security and Privacy (S&P).

DOI

(2013). Go with the Flow: Toward Workflow-Oriented Security Assessment. Proceedings of New Security Paradigm Workshop (NSPW).

DOI

(2012). Low-complexity Visible Light Networking with LED-to-LED communication. Proceedings of IFIP Wireless Days.

DOI

(2012). Toys communicating with LEDs: Enabling toy cars interaction. Proceedings of Consumer Communications and Networking Conference (CCNC).

DOI

(2012). Design and Implementation of a Terrorist Fraud Resilient Distance Bounding System. Proceedings of the European Symposium on Research in Computer Security (ESORICS).

DOI

(2011). On the Requirements for Successful GPS Spoofing Attacks. Proceedings of the ACM Conference on Computer and Communications Security (CCS).

PDF DOI

(2011). Investigation of Signal and Message Manipulations on the Wireless Channel. Proceedings of the European Symposium on Research in Computer Security (ESORICS).

PDF DOI

(2010). UWB Impulse Radio Based Distance Bounding. Proceedings of the Workshop on Positioning, Navigation and Communication (WPNC).

DOI

(2010). Integrity Regions: Authentication Through Presence in Wireless Networks. IEEE Transactions on Mobile Computing.

DOI

(2009). Secure Ranging With Message Temporal Integrity. Cryptology ePrint Archive: Report 2009/602.

PDF

(2009). iPhone and iPod location spoofing: Attacks on public WLAN-based positioning systems.

(2009). ID-based Secure Distance Bounding and Localization. Proceedings of the European Symposium on Research in Computer Security (ESORICS).

PDF DOI

(2009). Attacks on Public WLAN-based Positioning. Proceedings of the ACM Conference on Mobile Systems, Applications and Services (MobiSys).

PDF DOI

(2008). UWB-based Secure Ranging and Localization.