Pith. sign in

REVIEW 4 major objections 3 minor 50 references

OFDM-based JCAS under Attack: The Dual Threat of Spoofing and Jamming in WLAN Sensing

T0 review · 4 major / 3 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that an SDR attacker can hijack a WLAN sensing receiver's synchronization, then inject fake targets and erase real ones via standardized OFDM training symbols.

desk verdict A genuinely useful framework for spoofing and deceptive jamming in WLAN sensing, but the load-bearing claim that a standard 802.11 receiver can be forced to synchronize to the jammer is only shown for a simplified preamble-less model. read the letter →

arxiv 2501.06798 v1 pith:AUAJVZXI submitted 2025-01-12 cs.CR eess.SP

Hasan Can Yildirim , Musa Furkan Keskin , Henk Wymeersch , Francois Horlin This is my paper · ORCID
classification cs.CReess.SP
keywords WLANsensingjointcommunicationandtargetspoofingdeceptivejammingOFDMcarrierfrequencyoffsetrange-Dopplermapsoftware-definedradio
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

WLAN sensing treats Wi-Fi's OFDM signals as radar pulses, so a receiver's range-Doppler map is only as trustworthy as the training symbols it synchronizes to. This paper tries to establish that an attacker with a software-defined radio can break that trust without specialized digital radio-frequency memory hardware: by transmitting standardized OFDM symbols loaded with a fake channel response and making that signal arrive stronger than the legitimate one, Eve can force Bob to synchronize to her and then populate his range-Doppler map with arbitrary fake targets while smearing real targets into noise-like ridges. If the claim holds, a commodity attacker can spoof and jam WLAN sensing in the same transmission. The authors support it with a mathematical model of the jammed channel estimate, a qualitative comparison of jamming strategies, simulations of target detection probability, and indoor experiments with USRP radios.

What carries the argument

The load-bearing mechanism is Bob's lag-1 autocorrelation synchronization: Bob computes $\Xi[k] = \sum_{n=-Q_{\mathrm{cp}}}^{Q} r[n+k,m] r^*[n+k,m+1]$ and locks to the largest peak. Eve exploits this by ensuring $20\log_{10}(|\alpha_0^{(b)}|) - 20\log_{10}(|\alpha_0|) > 3$ dB, so Bob estimates Eve's CFO and arrival time instead of Alice's. The second piece is the standardized training symbol $\mathbf{S}$: because it is a known BPSK sequence, Eve can generate an artificial channel transfer function $\bar{\mathbf{H}} = \mathbf{F}_Q^H \bar{\mathbf{Y}}_j \mathbf{F}_M = \mathbf{1} + \bar{a}\mathbf{d}(\bar{\tau})\mathbf{b}^H(\bar{f})$ by reversing the radar processing chain, transmit $\bar{\mathbf{H}} \odot \mathbf{S}$, and thereby place a fake target at any delay-Doppler cell. Equation (12) is the resulting decomposition of Bob's estimated channel transfer function into Eve's contribution $\mathbf{B}_0 \odot \bar{\mathbf{H}}$, the desynchronized surveillance channel multiplied by the ICI matrix $\mathbf{C}$, and noise.

What would settle it

Run the same attack against a standards-compliant IEEE 802.11ac null-data-packet receiver that first processes L-STF and L-LTF for joint time-frequency synchronization: if the receiver still synchronizes to Alice's LOS peak (or rejects Eve's preamble) when Eve is 10 dB stronger, the forced-synchronization premise fails; conversely, observing Bob's range-Doppler map show the fake target and ICI ridges would confirm it.

Watch

Extended reading notes

Core claim

The paper's central claim is that a WLAN sensing receiver that synchronizes by picking the strongest peak of a lag-1 autocorrelation can be hijacked: if the attacker's signal arrives at Bob at least 3 dB stronger than Alice's line-of-sight signal, Bob locks to Eve's timing and carrier frequency offset. From that point the standardized OFDM training structure lets Eve fabricate the entire channel estimate. Bob's estimated channel transfer function becomes Eq. (12), $\hat{\mathbf{H}}_j = \mathbf{B}_0 \odot \bar{\mathbf{H}} + \mathbf{H}' \odot \mathbf{C} + \mathbf{Z}$, where the first Hadamard product carries Eve's artificial range-Doppler map (including a fake target at an arbitrary delay-Doppler cell) and the second product turns Alice's desynchronized surveillance channel into CFO-induced inter-carrier interference ridges that replace real target peaks. The paper argues, and demonstrates by simulation and USRP experiments, that an SDR without DRFM can therefore both inject arbitrary artificial targets and invalidate real surveillance targets whenever the jamming-to-signal ratio is above 8-12 dB and the CFO difference is at least about 3 ppm (6 ppm for 802.11ac-class subcarrier spacing).

Load-bearing premise

The attack assumes Bob's receiver actually locks to the strongest autocorrelation peak and that Eve can learn the sensing parameters from the unprotected negotiation; the experiments also omit the real 802.11 preamble fields (L-STF and L-LTF), so the paper has not demonstrated that a standards-compliant NDP receiver locks to Eve when the full preamble must be mimicked.

Editorial extensions

If this is right

  • Above 8-12 dB JSR and with a CFO difference of roughly 3 ppm (6 ppm for 312.5 kHz subcarrier spacing), Bob's probability of detecting the real target collapses while the artificial target is detected, so spoofing and deceptive jamming succeed together.
  • Narrower subcarrier spacing, as in 802.11ax (78.125 kHz), makes the surveillance channel more fragile: the real target's detection probability drops once CFO exceeds about 1 ppm.
  • Combining selective target injection (beamforming toward Bob with a null toward other paths) with a preceding jamming signal produces the cleanest deception: Bob sees only the artificial target, no true targets and no ridges.
  • The presence of CFO-induced ridges is a detectable fingerprint: a receiver that sees ridges can infer it is being jammed, and Eve can unintentionally hide her own fake target when ridges align with it.
  • Because Eve can update the artificial target parameters across snapshots following Newtonian kinematics, she can make the fake target trackable, forcing Bob's tracking filter to follow it.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: a receiver that uses a fixed, narrow timing window based on round-trip-time distance estimates would shut down the 'preceding jamming signal' variant (Case 1), but would still face the forced-synchronization variant (Case 2) whenever Eve's signal is stronger.
  • Beyond the paper: the cleanest countermeasure suggested by the model is to randomize or authenticate the training symbols per null data packet so that Eve cannot precompute $\bar{\mathbf{H}} \odot \mathbf{S}$, and to make synchronization robust to the strongest-peak rule, e.g., by verifying the candidate peak against the expected LOS delay.
  • Beyond the paper: the same Hadamard-product structure likely applies to other OFDM-based JCAS systems that reuse training fields for sensing, so the attack is not limited to 802.11ac-class WLAN; testing it on 802.11ax/be NDP frames would show how broadly the vulnerability extends.
  • Beyond the paper: the experiments do not include L-STF and L-LTF, so a fair next test is to check whether a real receiver locks to Eve when the full NDP preamble is mimicked; until then, the practical efficacy in standards-compliant deployments remains an open question.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. This paper considers an OFDM-based WLAN sensing system in which Alice transmits periodic NDPs, Bob performs lag-1 autocorrelation synchronization and RDM-based radar processing, and Eve, after eavesdropping the unprotected sensing negotiation, transmits OFDM symbols modulated by an artificial channel transfer function. The core modeling result is Eq. (12): once Bob is forced to synchronize to Eve, the estimated CTF separates into G1 = B0 ⊙ H̄, which injects artificial targets and their combinations with real Eve-Bob targets, and G2 = H′ ⊙ C, which spreads real surveillance peaks into ICI ridges. The paper proposes strategies A1-A3 for target spoofing and B1-B2 for surveillance invalidation, analyzes them qualitatively in Table IV, evaluates them in Monte Carlo simulations with CFAR detection, and demonstrates the RDMs on USRP X310 hardware. It concludes that above about 10 dB JSR and 3 ppm CFO difference, target spoofing and deceptive jamming are highly effective.

Significance. If the forced-synchronization precondition holds, the paper is a useful contribution: it shows that arbitrary target injection and surveillance invalidation are possible without DRFM hardware, quantifies operational regimes via Monte Carlo, and validates the RDM phenomenology on SDRs. The high-level framework in Eqs. (8)-(17) is coherent, the thresholds such as 3 ppm and 10 dB JSR emerge from the simulations rather than being forced, and the four combined strategies are demonstrated on hardware. However, the paper's central precondition, that Bob locks onto Eve, is neither modeled nor experimentally tested with a standards-compliant 802.11ac preamble, and the analytic ICI term in Eq. (12) is presented in a form that needs clarification. The significance is therefore conditional on closing these gaps.

major comments (4)
  1. [§II-B2, §III-B3, §VI-A, Appendix A] The forced-synchronization step is the load-bearing precondition for Eq. (12), but it is modeled and tested with a frame reduced to a single VHT-LTF-like OFDM symbol used for both synchronization and channel estimation. A standards-compliant 802.11ac NDP receiver performs packet detection and CFO estimation on L-STF/L-LTF, validates L-SIG/VHT-SIG-A, and only then uses VHT-LTF for channel estimation. The lag-1 autocorrelation in Eq. (4) over symbols separated by Ts (or To per Footnote 2) is not the L-STF short-symbol correlator. Section VI-A explicitly omits L-STF/L-LTF as straightforward to implement, so the paper has not shown that a real receiver locks to Eve when Eve must mimic the full preamble. This unproven link is central to the spoofing/jamming claim in Section VII; please add a preamble-aware synchronization model and a full-NDP simulation or experiment.
  2. [§III-B4, Eq. (15)] Equation (12) is presented as an exact decomposition, but the ICI treatment appears inconsistent with the standard CFO model. The matrix P in Eq. (15) is a full Q×Q coupling matrix, and the LS channel estimate under CFO takes the form of a matrix-vector product over subcarriers, not an elementwise Hadamard product with a single matrix C. For BPSK training, the correct expression is Ĥ_q[m] = Σ_i P_{q,i} S_i[m] S_q[m] H′_i[m] Λ_{m,m}, which cannot be written as H′ ⊙ C for a C that is independent of H′. Please clarify whether Eq. (12) is an approximation, state the conditions under which it holds, or correct the model; as written, the statement in Section III-C2 that the ICI term spreads energy across range is not a direct consequence of Eq. (16).
  3. [§VI-A, §VI-B2] For strategy A2 (selective target injection), the experiments bypass the AoA estimation stage and compute the angles manually before designing the precoder. This validates beamforming with known angles but does not validate the claimed capability to obtain those angles stealthily from the negotiation phase via MUSIC or ESPRIT. The text should either validate the full A2 chain or state this limitation explicitly.
  4. [§VI-B3] The experimental validation is qualitative: the comparison with simulations is based on visual inspection of RDMs, and no detection probability or CFAR-based KPI is reported for the hardware results, although the paper identifies target PD as the main KPI. Please add quantitative experimental metrics or explicitly limit the experimental claims to RDM phenomenology.
minor comments (3)
  1. [§II-B2] The text says 'following a short inter-frame space (SISF)'; this should be SIFS (short interframe space).
  2. [§V-B6] The sentence says the expected number of detected targets is calculated using the analytical expression in (13), but Eq. (13) defines G1; the reference should be corrected or the missing derivation should be added.
  3. [Table V] The coordinates of Eve and the target are both given as (5m,10m); if this is intentional, please explain, since it affects the bistatic geometry and the A2 nulling scenario, and if it is a typo, correct it.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity found: the attack synthesis and thresholds are self-contained simulation outputs, with only minor non-load-bearing self-citations and explicit external-validity limitations.

full rationale

The paper's derivation chain is not circular in the sense defined by the review criteria. In Section III-B1, Eve constructs the jamming signal from a desired artificial RDM via Eq. (8), and Section III-B4 shows via Eq. (12) that Bob's estimated CTF decomposes into the intended spoofing term, the desynchronized surveillance term, and noise. This is attack synthesis rather than a prediction forced from fitted inputs: the artificial target appears because Eve deliberately encodes it into the standardized OFDM structure, not because a fitted parameter was renamed as a result. The thresholds cited in Section VII, such as roughly 8-12 dB JSR and 3-6 ppm CFO difference, emerge from Monte Carlo simulations in Section V (5k and 10k realizations), not from parameters tuned to force the conclusion. The forced-synchronization condition of 3 dB or more power is attributed to an external textbook [42] and is tested in simulation. Self-citations to [33] and [44] are background, baseline, and terminology references; they are not load-bearing uniqueness claims or ansatzes, so they do not constitute circularity. The manuscript itself flags validity limitations: Section II-B2 simplifies the NDP to 'only the VHT-LTF', footnote 2 notes that the CFO phase in Eq. (4) uses Ts and 'should be replaced by To to be fully standard compliant', and Section VI-A states that L-STF and L-LTF fields are omitted in experiments because they are 'straightforward to implement' and 'unnecessary for our purposes'. These are real external-validity concerns about whether a standards-compliant receiver would lock to Eve, but they are not reductions of the paper's equations to their own inputs. No circular step can be exhibited; the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The central attack reuses known OFDM signal structures and radar processing; the only genuinely new machinery is the jammer's artificial CTF and forced-synchronization CFO model. No free parameters are fitted to data in the model; thresholds are emergent from Monte Carlo simulation. Main assumptions are the Bob synchronization behavior, attacker knowledge, and the simplified frame model.

assumptions (5)
  • domain assumption OFDM point-scatterer channel model with diffuse scattering and complex amplitudes per path (Eq. 3).
    Used throughout Section II-B4; standard for radar signal processing, but restricts analysis to first-order point reflections and a dominant LOS path.
  • domain assumption Bob's receiver uses lag-1 auto-correlation and synchronizes to the largest correlation peak; a 3 dB stronger Eve LOS captures synchronization.
    Invoked in Section III-B3 and based on [42]; if a real 802.11 receiver uses a different synchronization rule, the attack may not transfer.
  • domain assumption Eve knows sensing parameters (Q, Qcp, M, T, fc, Ts) via unprotected negotiation eavesdropping.
    Stated in Section III; this is a strong attacker capability but follows from the standard's unprotected over-the-air negotiation.
  • ad hoc to paper The sensing frame can be simplified to a single VHT-LTF-like OFDM symbol used for both synchronization and channel estimation.
    Footnote 2 and Section VI-A; the real NDP contains L-STF, L-LTF, and other fields that Eve would need to mimic, which the experiments omit.
  • domain assumption CFO estimation is assumed error-free.
    Sections II-B5 and III-B3 assume the estimated CFO equals the actual CFO; residual CFO estimation errors would alter the ICI predictions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of OFDM-based JCAS under Attack: The Dual Threat of Spoofing and Jamming in WLAN Sensing." pith.science (2026). https://pith.science/paper/AUAJVZXI

@misc{pith2026250106798,
  author       = {Pith},
  title        = {Pith review of: OFDM-based JCAS under Attack: The Dual Threat of Spoofing and Jamming in WLAN Sensing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AUAJVZXI}},
  note         = {Machine review of arXiv:2501.06798}
}
read the original abstract

This study reveals the vulnerabilities of Wireless Local Area Networks (WLAN) sensing, under the scope of joint communication and sensing (JCAS), focusing on target spoofing and deceptive jamming techniques. We use orthogonal frequency-division multiplexing (OFDM) to explore how adversaries can exploit WLAN's sensing capabilities to inject false targets and disrupt normal operations. Unlike traditional methods that require sophisticated digital radio-frequency memory hardware, we demonstrate that much simpler software-defined radios can effectively serve as deceptive jammers in WLAN settings. Through comprehensive modeling and practical experiments, we show how deceptive jammers can manipulate the range-Doppler map (RDM) by altering signal integrity, thereby posing significant security threats to OFDM-based JCAS systems. Our findings comprehensively evaluate jammer impact on RDMs and propose several jamming strategies that vary in complexity and detectability.

Figures

Figures reproduced from arXiv: 2501.06798 by the authors.

Figure 1
Figure 1. Jammer scenario topology with relevant line-of-sight (LOS) distances () [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. During a sensing measurement instance, Alice transmits an NDPA and [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Different signal alignment cases during jamming. Green and red boxes [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Different jamming strategies to achieve Eve’s goals. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Six RDMs are provided. The first column shows the surveillance and artificial RDMs in isolation. The second column corresponds to jammed RDMs with A1 and A2 strategies. The third column corresponds to the methods in [4], adapted and implemented for sensing. As a compar…
Figure 7
Figure 7. Figure 7: Probability of detecting real and artificial targets as a function of [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 10
Figure 10. Figure 10: The impact of the number of real scatterers in the environment is studied as a function of Bob’s PFa. The JSR is fixed to 10 dB, and the SNR is 30 dB. Eve transmits an RDM with two peaks: one representing the artificial target and the other as a reference, accounting …
Figure 9
Figure 9. Figure 9: The MDRrt and DRat are plotted for three different CFO regions. Based on [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 11
Figure 11. Figure 11: The picture of the experimental setup, consisting of a metallic fan as [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Signal structure for jamming. Alice transmits the same OFDM symbol [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]
Figure 13
Figure 13. Figure 13: The RDMs obtained for Alice-Bob and Eve-Bob channels while the [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]
Figure 14
Figure 14. Figure 14: The jammed RDMs with combined strategies, with [PITH_FULL_IMAGE:figures/full_fig_p013_14.png]
Figure 15
Figure 15. Figure 15: RTT-based distance estimation procedure. The green and red arrows [PITH_FULL_IMAGE:figures/full_fig_p014_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 46 canonical work pages

  1. [1]

    An Overview on IEEE 802.11bf: WLAN Sensing

    R. Du, H. Hua, H. Xie, X. Song, Z. Lyu, M. Hu, Y . Xin, S. McCann, M. Montemurro, T. X. Han et al. , “An overview on IEEE 802.11 bf: WLAN sensing,” arXiv preprint arXiv:2207.04859 , 2021. 14 Fig. 15: RTT-based distance estimation procedure. The green and red arrows correspond to the propagation delays over the related distances. Blue lines correspond to t...

    work page Pith review arXiv 2021

  2. [2]

    Enabling joint communication and radar sensing in mo- bile networks—a survey,

    J. A. Zhang, M. L. Rahman, K. Wu, X. Huang, Y . J. Guo, S. Chen, and J. Yuan, “Enabling joint communication and radar sensing in mo- bile networks—a survey,” IEEE Communications Surveys & Tutorials , vol. 24, no. 1, pp. 306–345, 2021

    2021

  3. [3]

    IEEE WLAN sensing use cases, official document,

    IEEE 802.11bf TG, “IEEE WLAN sensing use cases, official document,” https://mentor.ieee.org/802.11/dcn/20/ 11-20-1712-02-00bf-wifi-sensing-use-cases.xlsx, last accessed: 17/10/2023

    work page 2023

  4. [4]

    Preamble injection and spoofing attacks in Wi-Fi networks,

    Z. Zhang and M. Krunz, “Preamble injection and spoofing attacks in Wi-Fi networks,” in 2021 IEEE Global Communications Conference (GLOBECOM). IEEE, 2021, pp. 1–6

    work page 2021

  5. [5]

    Phase warping and differential scrambling attacks against ofdm frequency synchronization,

    M. J. La Pan, T. C. Clancy, and R. W. McGwier, “Phase warping and differential scrambling attacks against ofdm frequency synchronization,” in 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, 2013, pp. 2886–2890

    work page 2013

  6. [6]

    Jamming attacks against ofdm timing synchronization and signal acquisition,

    M. J. L. Pan, T. C. Clancy, and R. W. McGwier, “Jamming attacks against ofdm timing synchronization and signal acquisition,” in MIL- COM 2012 - 2012 IEEE Military Communications Conference , 2012, pp. 1–7

    work page 2012

  7. [7]

    Efficient ofdm denial: Pilot jamming and pilot nulling,

    T. C. Clancy, “Efficient ofdm denial: Pilot jamming and pilot nulling,” in 2011 IEEE International Conference on Communications (ICC) , 2011, pp. 1–5

    work page 2011

  8. [8]

    Jamming beamforming: A new attack vector in jamming IEEE 802.11 ac networks,

    G. Patwardhan and D. Thuente, “Jamming beamforming: A new attack vector in jamming IEEE 802.11 ac networks,” 2014 IEEE Military Communications Conference, pp. 1534–1541, 2014

    work page 2014

Show all 50 references
  1. [9]

    Orthogonality-sabotaging attacks against ofdma-based wireless networks,

    S. Zhao, Z. Lu, Z. Luo, and Y . Liu, “Orthogonality-sabotaging attacks against ofdma-based wireless networks,” in IEEE INFOCOM 2019 - IEEE Conference on Computer Communications , 2019, pp. 1603–1611

    2019

  2. [10]

    Classification of spoofing attack types,

    J. R. v. d. Merwe, X. Zubizarreta, I. Luk ˇcin, A. R¨ugamer, and W. Felber, “Classification of spoofing attack types,” in 2018 European Navigation Conference (ENC). IEEE, 2018, pp. 91–99

    2018

  3. [11]

    Device-to-identity linking attack using targeted Wi-Fi geolocation spoofing,

    C. Matte, J. P. Achara, and M. Cunche, “Device-to-identity linking attack using targeted Wi-Fi geolocation spoofing,” Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks, pp. 1–6, 2015

    2015

  4. [12]

    Attacks on public WLAN-based positioning systems,

    N. O. Tippenhauer, K. B. Rasmussen, C. P ¨opper, and S. ˇCapkun, “Attacks on public WLAN-based positioning systems,” Proceedings of the 7th international conference on Mobile systems, applications, and services, pp. 29–40, 2009

    2009

  5. [13]

    Identification of location spoofing in wireless sensor networks in non-line-of-sight conditions,

    D. Liu, Y . Xu, and X. Huang, “Identification of location spoofing in wireless sensor networks in non-line-of-sight conditions,” IEEE Trans- actions on Industrial Informatics , vol. 14, no. 6, pp. 2375–2384, 2017

    2017

  6. [14]

    Jamming attacks and anti-jamming strategies in wireless networks: A comprehensive survey,

    H. Pirayesh and H. Zeng, “Jamming attacks and anti-jamming strategies in wireless networks: A comprehensive survey,” IEEE communications surveys & tutorials , vol. 24, no. 2, pp. 767–809, 2022

    2022

  7. [15]

    A survey of spoofing and counter-measures,

    C. G ¨unther, “A survey of spoofing and counter-measures,” NAVIGA- TION: Journal of the Institute of Navigation, vol. 61, no. 3, pp. 159–177, 2014

    2014

  8. [16]

    A survey on OFDM physical layer security,

    R. Melki, H. N. Noura, M. M. Mansour, and A. Chehab, “A survey on OFDM physical layer security,” Physical Communication , vol. 32, pp. 1–30, 2019

    2019

  9. [17]

    Deception jamming modeling in radar sensor networks,

    J. Schuerger and D. Garmatyuk, “Deception jamming modeling in radar sensor networks,” IEEE Military Communications Conference , pp. 1–7, 2008

    2008

  10. [18]

    Performance of random OFDM radar signals in deception jam- ming scenarios,

    ——, “Performance of random OFDM radar signals in deception jam- ming scenarios,” IEEE Radar Conference , pp. 1–6, 2009

    2009

  11. [19]

    A novel deceptive jamming approach against frequency diverse array radar,

    M. Tan, C. Wang, B. Xue, and J. Xu, “A novel deceptive jamming approach against frequency diverse array radar,” IEEE Sensors Journal, vol. 21, no. 6, pp. 8323–8332, 2021

    2021

  12. [20]

    Efficient deceptive jamming method of static and moving targets against sar,

    Q. Sun, T. Shu, K.-B. Yu, and W. Yu, “Efficient deceptive jamming method of static and moving targets against sar,” IEEE Sensors Journal, vol. 18, no. 9, pp. 3610–3618, 2018

    2018

  13. [21]

    A smart multitransmitter cooperative false images generation method against multichannel sar- gmti,

    P. Ji, S. Xing, D. Dai, B. Pang, and D. Feng, “A smart multitransmitter cooperative false images generation method against multichannel sar- gmti,” IEEE Transactions on Geoscience and Remote Sensing , vol. 62, pp. 1–17, 2024

    2024

  14. [22]

    Fast generation of deceptive jamming signal against spaceborne sar based on spatial frequency domain interpolation,

    K. Yang, F. Ma, D. Ran, W. Ye, and G. Li, “Fast generation of deceptive jamming signal against spaceborne sar based on spatial frequency domain interpolation,” IEEE Transactions on Geoscience and Remote Sensing, vol. 60, pp. 1–15, 2022

    2022

  15. [23]

    Digital radio frequency memory,

    S. Roome, “Digital radio frequency memory,” Electronics & communi- cation engineering journal , 1990

    1990

  16. [24]

    Secure OFDM system design and capacity analysis under disguised jamming,

    Y . Liang, J. Ren, and T. Li, “Secure OFDM system design and capacity analysis under disguised jamming,” IEEE Transactions on Information Forensics and Security, vol. 15, pp. 738–752, 2020

    2020

  17. [25]

    Diverse frequency time modulation for passive false target spoofing: Design and experiment,

    X. Fang, M. Li, S. Li, D. Ramaccia, A. Toscano, F. Bilotti, and D. Ding, “Diverse frequency time modulation for passive false target spoofing: Design and experiment,” IEEE Transactions on Microwave Theory and Techniques, vol. 72, no. 3, pp. 1932–1942, 2024

    1932

  18. [26]

    AoA-based physical layer authentication in analog arrays under impersonation attacks,

    M. Srinivasan, L. Senigagliesi, H. Chen, A. Chorti, M. Baldi, and H. Wymeersch, “AoA-based physical layer authentication in analog arrays under impersonation attacks,” arXiv preprint arXiv:2407.08282 , 2024

    2024 arXiv

  19. [27]

    Detecting 5G signal jammers using spectrograms with supervised and unsupervised learning,

    M. Varotto, S. Valentin, and S. Tomasin, “Detecting 5G signal jammers using spectrograms with supervised and unsupervised learning,” arXiv preprint arXiv:2405.10331, 2024

    2024 arXiv

  20. [28]

    Detecting 5G signal jammers with autoencoders based on loose observations,

    ——, “Detecting 5G signal jammers with autoencoders based on loose observations,” in 2023 IEEE Globecom Workshops (GC Wkshps). IEEE, 2023, pp. 160–165

    2023

  21. [29]

    Detecting 5G narrowband jammers with CNN, k-nearest neighbors, and support vector machines,

    M. Varotto, F. Heinrichs, T. Schuerg, S. Tomasin, and S. Valentin, “Detecting 5G narrowband jammers with CNN, k-nearest neighbors, and support vector machines,” arXiv preprint arXiv:2405.09564 , 2024

    2024 arXiv

  22. [30]

    Channel state information-free location-privacy enhancement: Delay-angle information spoofing,

    J. Li and U. Mitra, “Channel state information-free location-privacy enhancement: Delay-angle information spoofing,” in ICC 2024 - IEEE International Conference on Communications , 2024, pp. 3767–3772

    2024

  23. [31]

    Channel state information-free location-privacy enhancement: Fake path injection,

    ——, “Channel state information-free location-privacy enhancement: Fake path injection,” IEEE Transactions on Signal Processing , vol. 72, pp. 3745–3760, 2024

    2024

  24. [32]

    Range-doppler spoofing in OFDM signals for preventing wireless passive emitter tracking,

    A. Argyriou, “Range-doppler spoofing in OFDM signals for preventing wireless passive emitter tracking,” in 2023 IEEE Radar Conference (RadarConf23). IEEE, 2023, pp. 1–6

    2023

  25. [33]

    Deceptive jamming in WLAN sensing,

    H. C. Yildirim, M. F. Keskin, H. Wymeersch, and F. Horlin, “Deceptive jamming in WLAN sensing,” 2024 IEEE Radar Conference (Radar- Conf24), 2024

    2024

  26. [34]

    IEEE 802.11 bf WLAN sensing procedure: Enabling the widespread adoption of Wi-Fi sensing,

    T. Ropitault, C. da Silva, S. Blandino, A. Sahoo, N. Golmie, K. Yoon, C. Aldana, and C. Hu, “IEEE 802.11 bf WLAN sensing procedure: Enabling the widespread adoption of Wi-Fi sensing,” IEEE Communi- cations Standards Magazine , 2023

    2023

  27. [35]

    IEEE 802.11 ac: from channelization to multi-user MIMO,

    O. Bejarano, E. W. Knightly, and M. Park, “IEEE 802.11 ac: from channelization to multi-user MIMO,” IEEE Communications Magazine, 2013

    2013

  28. [36]

    A time and frequency synchronization scheme for multiuser OFDM,

    J.-J. van de Beek, P. Borjesson, M.-L. Boucheret, D. Landstrom, J. Arenas, P. Odling, C. Ostberg, M. Wahlqvist, and S. Wilson, “A time and frequency synchronization scheme for multiuser OFDM,” IEEE Journal on Selected Areas in Communications, vol. 17, no. 11, pp. 1900– 1914, 1999

    1900

  29. [37]

    Robust frequency and timing synchronization for ofdm,

    T. Schmidl and D. Cox, “Robust frequency and timing synchronization for ofdm,” IEEE Transactions on Communications , vol. 45, no. 12, pp. 1613–1621, 1997

    1997

  30. [38]

    Horlin and A

    F. Horlin and A. Bourdoux, Digital compensation for analog front-ends: a new approach to wireless transceiver design . John Wiley & Sons, 2008

    2008

  31. [39]

    G. D. Durgin, Space-time wireless channels. Prentice Hall Professional, 2003

    2003

  32. [40]

    Integrated sensing and communication channel modeling: A survey,

    Z. Wei, J. Jia, Y . Niu, L. Wang, H. Wu, H. Yang, and Z. Feng, “Integrated sensing and communication channel modeling: A survey,” IEEE Internet of Things Journal , pp. 1–1, 2024

    2024

  33. [41]

    M. A. Richards, J. A. Scheer, and W. A. Holm, Principles of Modern Radar: Basic principles . The Institution of Engineering and Technol- ogy, 2010. 15

    2010

  34. [42]

    Chiueh, P.-Y

    T.-D. Chiueh, P.-Y . Tsai, and I.-W. Lai, Baseband receiver design for wireless MIMO-OFDM communications . John Wiley & Sons, 2012

    2012

  35. [43]

    Clock synchronization over IEEE 802.11—a survey of methodologies and protocols,

    A. Mahmood, R. Exel, H. Trsek, and T. Sauter, “Clock synchronization over IEEE 802.11—a survey of methodologies and protocols,” IEEE Transactions on Industrial Informatics , vol. 13, no. 2, pp. 907–922, 2016

    2016

  36. [44]

    Impact of interference on OFDM based radars,

    H. C. Yildirim, J. Louveaux, P. De Doncker, and F. Horlin, “Impact of interference on OFDM based radars,” IEEE Vehicular Technology Conference, 2020

    2020

  37. [45]

    Multiple emitter location and signal parameter estimation,

    R. Schmidt, “Multiple emitter location and signal parameter estimation,” IEEE Transactions on Antennas and Propagation , vol. 34, no. 3, pp. 276–280, 1986

    1986

  38. [46]

    ESPRIT-estimation of signal parameters via ro- tational invariance techniques,

    R. Roy and T. Kailath, “ESPRIT-estimation of signal parameters via ro- tational invariance techniques,”IEEE Transactions on Acoustics, Speech, and Signal Processing , vol. 37, no. 7, pp. 984–995, 1989

    1989

  39. [47]

    A global human walking model with real-time kinematic personification,

    R. Boulic, N. M. Thalmann, and D. Thalmann, “A global human walking model with real-time kinematic personification,” The visual computer , 1990

    1990

  40. [48]

    OS-CFAR theory for multiple targets and nonuniform clutter,

    S. Blake, “OS-CFAR theory for multiple targets and nonuniform clutter,” IEEE Transactions on Aerospace and Electronic Systems, vol. 24, no. 6, pp. 785–790, 1988

    1988

  41. [49]

    A survey of round trip time prediction systems,

    D. Mirkovic, G. Armitage, and P. Branch, “A survey of round trip time prediction systems,” IEEE Communications Surveys & Tutorials, vol. 20, no. 3, pp. 1758–1776, 2018

    2018

  42. [50]

    Passive estimation of TCP round-trip times,

    H. Jiang and C. Dovrolis, “Passive estimation of TCP round-trip times,” ACM SIGCOMM Computer Communication Review , vol. 32, no. 3, pp. 75–88, 2002

    2002

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.