Weather Data Spoofing Attacks on Rain-Adaptive Millimeter-Wave Frequency Selection in V2X Communication Networks
Spoofed rainfall inputs let attackers dictate V2X millimeter-wave carrier selection without transmitting, halving platoon range or quadrupling latency in ns-3 simulations.
The paper shows spoofing only the rainfall sensor input lets an adversary control which mmWave carrier a connected vehicle selects, without transmitting on the channel. In MilliCar/ns-3 simulations with real 3GPP NR V2X propagation, forcing the 73 GHz band held an eight-vehicle platoon's reliable range at 38 m versus an 82 m honest baseline, while forcing 5 GHz kept 97% long-range reception but quadrupled long-range latency to 12.5 ms. A receiver-side SINR cross-check against rain-predicted attenuation detects force-up attacks with 98% probability within 1.5 s at 1% false alarms, but is structurally blind to force-down. The authors argue weather-aware band selection requires authenticated meteorological input.
- Spoofing the rainfall input alone dictates the victim's carrier frequency and communication range without channel transmission.
- Forced 73 GHz band cuts platoon reliable range to 38 m versus an 82 m baseline.
- Forced 5 GHz keeps 97% long-range reception but quadruples long-range latency to 12.5 ms.
- SINR cross-check detects force-up with 98% probability within 1.5 s at 1% false alarms; blind to force-down.
- Authors recommend authenticated meteorological input for weather-aware band selection.
Full article241 words · extracted from arxiv.org · click to collapse
Connected vehicles use millimeter-wave (mmWave) sidelinks for the data rates cooperative driving demands, and emerging designs select the carrier band from sensed rainfall. We show that this weather awareness is an attack surface: an adversary who spoofs only the rainfall input dictates the victim's carrier frequency, and through it its communication range, without transmitting on the channel. We evaluate the attack in MilliCar, an ns-3 module that runs the selected band as the real 3GPP NR V2X carrier with per-band propagation, beamforming, and blockage. Forcing the band up to 73 GHz holds an eight-vehicle platoon's reliable range at 38 m while the honest baseline doubles it to 82 m; forcing it down to 5 GHz sustains 97% long-range reception but collapses the transport block to a third and quadruples long-range latency to 12.5 ms. We then implement the defense the mechanism implies. Rain loss grows linearly with distance while path loss grows logarithmically, so a receiver that tests measured SINR against the attenuation its reported weather predicts flags force-up with 98% probability within 1.5 s at a 1% false-alarm rate, and re-selection then restores long-range reception from 60% to 75%. The same test is structurally blind to force-down, because the 5 GHz fallback is nearly rain-immune. An advecting rain cell that swings the local rate from 15 to 81 mm/h leaves every result unchanged. Weather-aware band selection therefore requires an authenticated meteorological input; physical cross-checking covers one half of the threat.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.20601