CITADEL: CSI-Based Jamming Detection and Open-Set Classification for IIoT Networks
2026-06-22 • Cryptography and Security
Cryptography and SecurityMachine LearningNetworking and Internet Architecture
AI summaryⓘ
The authors developed CITADEL, a system that detects and identifies radio jamming attacks in industrial wireless networks by using Channel State Information (CSI) available on common devices. Unlike previous methods that need lots of hardware power or only recognize known attacks, CITADEL can also spot new, unseen attacks and resist attempts to fool it. Tested on various attack types, it showed high accuracy and low false alarms while running efficiently on edge devices. The authors compared CITADEL with other methods and found it outperforms them in detection, handling unknown attacks, and resisting evasion.
Radio frequency jammingIndustrial Internet of Things (IIoT)Channel State Information (CSI)Jamming detectionOpen-set detectionAdversarial robustnessWireless securityEdge computingSignal classificationZero-day attacks
Authors
Aymen Bouferroum, Ildi Alla, Valeria Loscri, Abderrahim Benslimane, Vincent Lenders
Abstract
Radio frequency jamming poses a critical threat to the availability of wireless Industrial Internet of Things (IIoT) networks. Existing detection and classification techniques are poorly suited to this setting: coarse signal-strength and cross-layer features lack information richness, while raw I/Q baseband approaches require hardware and throughput that is impractical at the scale of hundred-node IIoT deployments. This paper presents CITADEL, a lightweight two-stage hierarchical pipeline that uses only Channel State Information (CSI) measurements, which are natively available on commodity IIoT devices, to detect and classify jamming attacks including previously unseen ones. While prior work has shown that jamming leaves observable CSI signatures, CITADEL is the first system to translate this insight into an end-to-end pipeline that jointly achieves closed-set classification of known attacks, open-set detection of zero-day attacks, and resistance to adversarial evasion. Evaluated across 6 known attack types and 15 zero-day scenarios, CITADEL achieves 100% known-attack detection and 97.1% zero-day detection at a 0.4% end-to-end false positive rate. Under adversarial evaluation spanning white-box and black-box threat models, gradient-based evasion remains below 2% across all tested perturbation budgets and the strongest published CSI attack generator achieves less than 5% average evasion. A systematic comparison against eight baselines confirms that no existing method achieves comparable performance on CSI data across all three axes: detection, generalization, and robustness. The full pipeline completes inference in 14.2 ms at 95.9 mJ on an edge GPU, establishing CITADEL as a practical solution for large-scale IIoT network security.