Source author record

Francesco Gringoli

Francesco Gringoli appears in the imported research catalog. Authorship, coauthor and topic links are available while profile ownership is still unclaimed.

ResearcherUnclaimed source record

Catalog footprint

What is connected

8works
5topics
4close collaborators

Actions

Connect this record

Log in to claim

Research graph

See the researcher in context

Open full explorer

Inspect adjacent papers, topics, institutions and collaborators without losing the researcher page.

Building this map preview

BZPEER is loading the nearby papers, people, topics and institutions for this page.

Published work

8 published item(s)

preprint2026arXiv

Preliminary Insights in Chronos Frequency Data Understanding and Reconstruction

This paper presents a preliminary analysis of the ability of Chronos foundation model to process and internally represent frequency domain information. Foundation models that process time-series data offer practitioners a unified architecture capable of learning generic temporal representations across diverse tasks and domains, reducing the need for task-specific feature engineering and enabling transfer across signal modalities. Despite their growing adoption, the extent to which such models encode fundamental signal properties remains insufficiently characterised. We address this gap by analysing Chronos under controlled conditions, starting from the simplest class of signals: discrete sinusoids generated at fixed frequencies. Using lightweight online minimum description length probes applied to the decoder architecture, we test for the presence and separability of frequency information in the model's internal representations. The results provide insight into how frequential content is captured across the frequency spectrum and highlight regimes in which representation quality may degrade or require particular care. These findings offer practical guidance for users of Chronos in signal processing and information fusion contexts, and contribute to ongoing efforts to improve the interpretability and evaluation of foundation models for temporal data.

preprint2021arXiv

Low-Delay High-Rate Operation of 802.11ac WLAN Downlink: Nonlinear Controller Analysis & Design

In this paper we consider a next generation edge architecture where traffic is routed via a proxy located close to the network edge (e.g. within a cloudlet). This creates freedom to implement new transport layer behaviour over the wireless path between proxy and clients. We use this freedom to develop a novel traffic shaping controller for the downlink in 802.11ac WLANs that adjusts the send rate to each WLAN client so as to maintain a target number of packets aggregated in each transmitted frame. In this way robust low-delay operation at high data rates becomes genuinely feasible across a wide range of network conditions. Key to achieving robust operation is the design of an appropriate feedback controller, and it is this which is our focus. We develop a novel nonlinear control design inspired by the solution to an associated proportional fair optimisation problem. The controller compensates for system nonlinearities and so can be used for the full envelope of operation. The robust stability of the closed-loop system is analysed and the selection of control design parameters discussed. We develop an implementation of the nonlinear control design and use this to present a performance evaluation using both simulations and experimental measurements.

preprint2021arXiv

Modelling Downlink Packet Aggregation in Paced 802.11ac WLANs

We derive an analytic model of packet aggregation on the the downlink of an 802.11ac WLAN when packet arrivals are paced. The model is closed-form and so suitable for both analysis and design of next generation edge architectures that aim to achieve high rate and low delay. The model is validated against both simulations and experimental measurements and found to be remarkably accurate despite its simplicity.

preprint2020arXiv

Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets

Wireless communication standards and implementations have a troubled history regarding security. Since most implementations and firmwares are closed-source, fuzzing remains one of the main methods to uncover Remote Code Execution (RCE) vulnerabilities in deployed systems. Generic over-the-air fuzzing suffers from several shortcomings, such as constrained speed, limited repeatability, and restricted ability to debug. In this paper, we present Frankenstein, a fuzzing framework based on advanced firmware emulation, which addresses these shortcomings. Frankenstein brings firmware dumps "back to life", and provides fuzzed input to the chip's virtual modem. The speed-up of our new fuzzing method is sufficient to maintain interoperability with the attached operating system, hence triggering realistic full-stack behavior. We demonstrate the potential of Frankenstein by finding three zero-click vulnerabilities in the Broadcom and Cypress Bluetooth stack, which is used in most Apple devices, many Samsung smartphones, the Raspberry Pis, and many others. Given RCE on a Bluetooth chip, attackers may escalate their privileges beyond the chip's boundary. We uncover a Wi-Fi/Bluetooth coexistence issue that crashes multiple operating system kernels and a design flaw in the Bluetooth 5.2 specification that allows link key extraction from the host. Turning off Bluetooth will not fully disable the chip, making it hard to defend against RCE attacks. Moreover, when testing our chip-based vulnerabilities on those devices, we find BlueFrag, a chip-independent Android RCE.

preprint2016arXiv

Collision-free Operation in High Density WLAN Deployments

WiFi's popularity has led to crowded scenarios composed of many Access Points (AP) and clients, often operating on overlapping channels, producing interference that gravely degrades performance. This misallocation of resources is often the result of multiple WLANs ownership, that is, networks are frequently setup automatically without considering neighbouring APs. In this work we overview the effect of Overlapping BSS (OBSS) from the perspective of the MAC layer, taking special interest on describing the advantages of eliminating collisions with Carrier Sense Multiple Access with Enhanced Collision Avoidance (CSMA/ECA). We propose a single Access Point (AP) and several multi-AP scenarios, including the residential building example proposed for testing the upcoming IEEE 802.11ax amendment. Results using the first NS-3 implementation of CSMA/ECA reveal the advantage of CSMA/ECA's deterministic backoff contention technique, confirming its suitability for very crowded scenarios.

preprint2015arXiv

A High Efficiency MAC Protocol for WLANs: Providing Fairness in Dense Scenarios

Collisions are a main cause of throughput degradation in WLANs. The current contention mechanism used in IEEE 802.11 networks is called Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). It uses a Binary Exponential Backoff (BEB) technique to randomise each contender attempt of transmitting, effectively reducing the collision probability. Nevertheless, CSMA/CA relies on a random backoff that while effective and fully decentralised, in principle is unable to completely eliminate collisions, therefore degrading the network throughput as more contenders attempt to share the channel. To overcome these situations, Carrier Sense Multiple Access with Enhanced Collision Avoidance (CSMA/ECA) is able to create a collision-free schedule in a fully decentralised manner using a deterministic backoff after successful transmissions. Hysteresis and Fair Share are two extensions of CSMA/ECA to support a large number of contenders in a collision-free schedule. CSMA/ECA offers better throughput than CSMA/CA and short-term throughput fairness. This work describes CSMA/ECA and its extensions. Additionally, it provides the first evaluation results of CSMA/ECA with non-saturated traffic, channel errors, and its performance when coexisting with CSMA/CA nodes. Furthermore, it describes the effects of imperfect clocks over CSMA/ECA and present a mechanism to leverage the impact of channel errors and the addition/withdrawal of nodes over collision-free schedules. Finally, experimental results on throughput and lost frames from a CSMA/ECA implementation using commercial hardware and open-source firmware are presented.

preprint2015arXiv

Emitter Localisation from Reception Timestamps in Asynchronous Networks

We address the problem of localising a mobile terminal ("blind" node) in unknown position from a set of "anchor" nodes in known positions. The proposed method does not require any form of node synchronisation nor measurement (or control) of the transmission times, which is difficult or anyway costly to achieve in practice. It relies exclusively on reception timestamps collected by the anchor nodes, according to their local clocks, that overhear packets transmitted by the blind node and by (at least one) other transmitting node(s) in known position, e.g., other anchors. The clock differences between the nodes are not eliminated ex ante through clock synchronisation, as in traditional ToA and TDoA methods. Instead, they are counteracted ex post, during the data processing stage, leveraging the data redundancy that is intrinsic to the multiple reception of the same packet by different (anchor) nodes. We validate the proposed method in different experimental settings, indoor and outdoor, using exclusively low-cost Commercial-Off-The-Shelf WiFi devices, achieving sub-meter accuracy in full Line-of-Sight conditions and meter-level accuracy in mild Non-line-of-sight environment. The proposed method does not require that the blind node participate actively to the localisation procedure and can use "opportunistically" any legacy signal or packet available over-the-air for communication purposes. Considering the very minimal requirement on the system - basically, only that anchors in known positions are able to collect and share reception timestamps - the proposed approach can enable practical adoption of opportunistic and/or cooperative localisation on top of existing radio communication systems.

preprint2014arXiv

Implementation and Experimental Evaluation of a Collision-Free MAC Protocol for WLANs

Collisions are a main cause of throughput degradation in Wireless LANs. The current contention mechanism for these networks is based on a random backoff strategy to avoid collisions with other transmitters. Even though it can reduce the probability of collisions, the random backoff prevents users from achieving Collision-Free schedules, where the channel would be used more efficiently. Modifying the contention mechanism by waiting for a deterministic timer after successful transmissions, users would be able to construct a Collision-Free schedule among successful contenders. This work shows the experimental results of a Collision-Free MAC (CF-MAC) protocol for WLANs using commercial hardware and open firmware for wireless network cards which is able to support many users. Testbed results show that the proposed CF-MAC protocol leads to a better distribution of the available bandwidth among users, higher throughput and lower losses than the unmodified WLANs clients using a legacy firmware.