IEEE 802.11a Wireless-Fidelity is a wireless communications standard used by Internet of Things (IoT) deployments. The IoT's ubiquity and rapid integration often outpace or neglect security mechanisms essential to protecting the people and critical infrastructure it supports. This work presents a deep learning-driven low probability of intercept solution aimed at increasing wireless communications security by employing a frequency hopping scheme learned in the presence of a peer, on-path adversary. The results show the presented LPI approach ensures high synchronization between legitimate users,$> 99\%$, while keeping the adversary's probability of intercept low,$< 17\%$.

Internet of Things (IoT) deployments are projected to reach 30.9 billion by 2025, most of which will employ little or no encryption. Specific Emitter Identification (SEI) is being put forward as a lightweight security approach intended to solve the risks of unencrypted or weakly encrypted IoT deployments. SEI exploits waveform distortions that are intrinsic, distinct, and imparted during normal device operations, which permits the employment of SEI without needing to modify the IoT device. However, SEI performs very poorly when the waveforms used to train it are collected at a different time from those it is being tasked with classifying. A solution to this cross-collection problem must be found before SEI can be deployed as a viable IoT security solution. This paper assesses cross-collection SEI when waveform time offset is and is not present, the intentional waveform structure is removed, and SEI is performed using handcrafted and DL-based approaches. The results show removing the intentional waveform structure improves SEI performance by as much as 8% versus using the raw received time domain samples. The results also show that cross-collection SEI accuracy is highest when using a Graphical Neural Network (GNN).

Internet of Things (IoT) deployments are anticipated to reach 29.42 billion by the end of 2030 at an average growth rate of 16% over the next 6 years. These deployments represent an overall growth of 201.4% in operational IoT devices from 2020 to 2030. This growth is alarming because IoT devices have permeated all aspects of our daily lives, and most lack adequate security. IoT-connected systems and infrastructures can be secured using device identification and authentication, two effective identity-based access control mechanisms. Physical Layer Security (PLS) is an alternative or augmentation to cryptographic and other higher-layer security schemes often used for device identification and authentication. PLS does not compromise spectral and energy efficiency or reduce throughput. Specific Emitter Identification (SEI) is a PLS scheme capable of uniquely identifying senders by passively learning emitter-specific features unintentionally imparted on the signals during their formation and transmission by the sender’s radio frequency (RF) front end. This work focuses on image-based SEI because it produces deep learning (DL) models that are less sensitive to external factors and better generalize to different operating conditions. More specifically, this work focuses on reducing the computational cost and memory requirements of image-based SEI with little to no reduction in performance by selecting the most informative portions of each image using entropy. These image portions or tiles reduce memory storage requirements by 92.8% and the DL training time by 81% while achieving an average percent correct classification performance of 91% and higher for SNR values of 15 dB and higher with individual emitter performance no lower than 87.7% at the same SNR. Compared with another state-of-the-art time-frequency (TF)-based SEI approach, our approach results in superior performance for all investigated signal-to-noise ratio conditions, the largest improvement being 21.7% at 9 dB and requires 43% less data.

The number of Internet of Things (IoT) deployments is expected to reach 75.4 billion by 2025. Roughly 70% of all IoT devices employ weak or no encryption; thus, putting them and their connected infrastructure at risk of attack by devices that are wrongly authenticated or not authenticated at all. A physical layer-based security approach–known as Specific Emitter Identification (SEI)–has been proposed and is being pursued as a viable IoT security mechanism. SEI is advantageous because it is a passive technique that exploits inherent and distinct features unintentionally imparted upon the signal during its formation and transmission within and by the IoT device’s Radio Frequency (RF) front end. SEI’s passive exploitation of unintentional signal features removes any need to modify the IoT device, which makes it ideal for existing and future IoT deployments. Despite the amount of SEI research conducted, challenges must be addressed to make SEI a viable IoT security approach. One of these challenges is extracting SEI features from signals collected under multipath fading conditions. Multipath corrupts the inherent SEI exploited features that discriminate one IoT device from another; thus, degrading authentication performance and increasing the chance of attack. This work presents two semi-supervised Deep Learning (DL) equalization approaches and compares their performance with the current state of the art. The two approaches are the Conditional Generative Adversarial Network (CGAN) and the Joint Convolutional Auto-Encoder and Convolutional Neural Network (JCAECNN). Both approaches learn the channel distribution to enable multipath correction while preserving the SEI exploited signal features. CGAN and JCAECNN performance is assessed using a Rayleigh fading channel under degrading SNR, up to thirty-two IoT devices, and two publicly available signal sets. The JCAECNN improves SEI performance by 10% beyond the current state of the art.

Specific Emitter Identification (SEI) has proven to be an effective means for passively identifying emitters using unique and distinct features that are unintentionally imparted to waveforms during their formation and transmission. Primarily, the assumption is that the to-be-identified emitters are passive devices incapable or unwilling to resist SEI. However, cost-effective software-defined radios and open-source deep learning algorithms are leading investigators to challenge this assumption. They show that previously exploited features can be modified to reduce or defeat SEI. Recently, RF-Veil has been proposed to combat such attacks by providing emitters with an active means to obfuscate their waveform features. The result is an eavesdropping and impersonation attack resilient SEI process. Despite RF-Veil's security and privacy focus, it is fair to assume that nefarious actors will attempt to abuse it to thwart legitimate SEI security processes. Therefore, this work investigates the identification of nefarious emitters that employ RF-Veil to thwart legitimate SEI security processes. The results show that there is an inherent Residual Phase Offset (RPO) present in preambles that are not removed in traditional phase offset correction. Removing RPO improves SEI performance when using the phase representation of IQ samples and significantly reduces RF-Veil's negative impact on SEI.

Specific Emitter Identification (SEI) is advantageous for its ability to passively identify emitters by exploiting distinct, unique, and organic features unintentionally imparted upon every signal during formation and transmission. These features are attributed to the slight variations and imperfections that exist in the Radio Frequency (RF) front end, thus SEI is being proposed as a physical layer security technique. The majority of SEI work assumes the targeted emitter is a passive source with immutable and difficult-to-mimic signal features. However, Software-Defined Radio (SDR) proliferation and Deep Learning (DL) advancements require a reassessment of these assumptions, because DL can learn SEI features directly from an emitter’s signals and SDR enables signal manipulation. This paper investigates a strong adversary that uses SDR and DL to mimic an authorized emitter’s signal features to circumvent SEI-based identity verification. The investigation considers three SEI mimicry approaches, two different SDR platforms, the presence or lack of signal energy as well as a "decoy" emitter. The results show that "off-the-shelf" DL achieves effective SEI mimicry. Additionally, SDR constraints impact SEI mimicry effectiveness and suggest an adversary’s minimum requirements. Future SEI research must consider adversaries capable of mimicking another emitter’s SEI features or manipulating their own.

Internet of Things (IoT) deployments continue at an accelerated rate and are projected to reach 75 billion by 2025. Most IoT devices employ weak or no encryption at all due to constrained onboard resources, prohibitive manufacturing costs, and challenges due to implementing and managing encryption at scale. Specific Emitter Identification (SEI) is an approach intended to address the security risks associated with unencrypted or weakly encrypted IoT deployments. SEI passively exploits inherent, unintentional waveform features that are imparted during normal device operations, thus it does not require modification of the device being identified. Recently, Deep Learning (DL)-based SEI has garnered a lot of interest due to its ability to learn discriminatory features directly from an emitter's digitally sampled waveforms, thus eliminating feature engineering commonly associated with SEI. DL-based SEI uses the entirety of the digitally sampled waveform, which includes the unintentional as well as intentional waveform structure. The intentional waveform structure does not convey emitter specific features, thus it is information not used by the DL-based SEI process. In fact, this work shows that the intentional waveform structure acts as a confuser that inhibits the DL network's ability to learn the features needed to discern one emitter from another and its negative impacts worsen as the number of emitters increases. Our work shows that frequency-domain removal of the intentional waveform structure coupled with a Long Short-Term Memory (LSTM) results in superior SEI performance.

Specific Emitter Identification (SEI) was conceived to detect, characterize, and identify radars using their transmitted signals. SEI’s success is linked to the imperfections of an emitter’s Radio Frequency (RF) front-end, which imparts unique "coloration" to the signal during its formation and transmission without impeding normal transceiver operations. Recent works propose Deep Learning (DL) based SEI due to its demonstrated successes in image and facial recognition, as well as its ability to learn radio-specific features directly from the sampled signals. This removes the needless, handcrafted feature engineering of traditional SEI. However, signal energy, its impacts, and its susceptibility to adversary mimicry has received little attention by DL-based SEI works. This work is the first to investigate the impacts and threats posed to DL-based SEI by the presence, lack, or manipulation of signal energy. Our work shows that Long Short-Term Memory (LSTM)-based SEI provides the highest average percent correct classification performance of 89.9% and the lowest rate, 0.68%, at which an adversary can circumvent the SEI process by manipulating the energy of its signals.

Internet of Things (IoT) deployments continue to grow at an accelerated rate, thus presenting a growing surface over which nefarious actors can conduct attacks. This disturbing revelation is exacerbated by the fact that roughly 70% of all IoT devices employ weak or no encryption. Deep learning (DL)-based Specific Emitter Identification (SEI) has been put forward as a possible approach by which to secure IoT devices and related infrastructures. This work presents a DL-based SEI approach that remains robust under degrading signal-to-noise ratio (SNR) conditions while greatly reducing the complexity that is typically associated with DL-based approaches. The presented approach achieves an average percent classification performance of 97% or higher for SNR values greater than or equal to 6 dB.

It is estimated that the number of Internet-of-Things (IoT) devices will reach 75 billion in the next five years. Most of those currently and soon-to-be deployed devices lack sufficient security to protect themselves and their networks from attacks by malicious IoT devices masquerading as authorized devices in order to circumvent digital authentication approaches. This work presents a physical (PHY) layer IoT authentication approach capable of addressing this critical security need through the use of feature-reduced, radio frequency-distinct native attributes (RF-DNA) fingerprints and support vector machines (SVM). This work successfully demonstrates: 1) authorized identity (ID) verification across three trials of six randomly chosen radios at signal-to-noise ratios greater than or equal to 6 dB and 2) rejection of all rogue radio ID spoofing attacks at signal-to-noise ratios greater than or equal to 3 dB using RF-DNA fingerprints whose features are selected using the Relief-F algorithm.

The Internet of Things (IoT) is a collection of Internet connected devices capable of interacting with the physical world and computer systems. It is estimated that IoT will consist of more than seventy five billion devices by the year 2025. In addition to the sheer numbers, the need for IoT security is exacerbated by the fact that many of the edge devices employ weak to no encryption of the communication link. It has been estimated that almost 70% of IoT devices use no form of encryption. Previous research has suggested the use of Specific Emitter Identification (SEI), a physical layer technique, as a means of augmenting bit-level security mechanisms such as encryption. Radio Frequency-Distinct Native Attributes (RF-DNA) fingerprinting is an SEI technique that has demonstrated success in discriminating radios operating within a noise only channel. This work extends RF-DNA fingerprinting to the discrimination of radios operating under Rayleigh fading conditions through the use of a Nelder-Mead (N-M) simplex-based channel estimator. The N-M estimator estimates the multipath channel directly from the received waveform; thus, eliminating the need for demodulation that is required when using constellation-based estimators. N-M estimator proves superior to three alternative waveform-based estimation approaches under increasing fading paths/reflections and decreasing Signal-to-Noise Ratio (SNR). Radio discrimination performance is maximized through the assessment of: (i) RF-DNA fingerprints generated from the magnitude versus phase representation of the Gabor transform's coefficients, (ii) a statistic-based classifier versus a neural network-based classifier, and (iii) the size of patch used to subdivide the Gabor-based time-frequency response prior to calculation of the RF-DNA fingerprint features. The resulting RF-DNA fingerprinting process achieves an average percent correct classification of 92.3% or greater for Rayleigh fading channels consisting of: two, three, or five reflections/paths at SNR≥15 dB.

Radio-Frequency Distinct Native Attributes (RFDNA) fingerprinting is a Specific Emitter Identification (SEI) approach developed as a mechanism for enhancing wireless network security. RF-DNA fingerprinting exploits unintentional and distinctively unique Physical (PHY) Layer characteristics that are imparted upon the waveform during its generation and transmission. The RF-DNA fingerprinting approach specifically leverages those PHY Layer characteristics that color a fixed, known sequence of waveform symbols (e.g., IEEE 802.11a preamble). This makes the RF-DNA fingerprinting process well suited to matched filter (MF) integration, because (i) both are generated from a fixed sequence and (ii) the MF maximizes SNR while RF-DNA based radio identification performance is degraded as SNR decreases. In this work, the MF is applied prior to signal transformation, which results in four RF-DNA fingerprint generation scenarios: Fast Fourier Transform (FFT) with a MF (FFT-MF), FFT with an All-Pass Filter (FFT- APF), Gabor Transform with a MF (GT-MF), and GT with an APF (GT-APF). Performance of these four scenarios is assessed using average percent correct classification over degrading signal- to-noise channel conditions. When considering classification performance and IoT device constraints (e.g., memory, computation resources and time), RF-DNA fingerprints generated using the FFT-MF scenario proved superior to the other three.

The Internet of Things is a collection of Internet connected devices capable of interacting with the physical world and computer-based systems and is estimated to consist of 20 to 50 billion devices by the year 2020. Due to these numbers and the fact that 70% of the edge devices have no or poor encryption, there is a need for mechanisms by which to secure these devices and associated networks. Specific Emitter Identification (SEI) is one proposed mechanism for IoT security; however, performance within multipath environments has received little attention. This work presents the integration of a novel, Nelder-Mead (N-M)-based channel estimator within the Radio Frequency-Distinct Native Attributes (RF-DNA) fingerprinting process to facilitate serial number discrimination when IoT devices are operating within a multipath environment and degrading Signal-to-Noise Ratio. Percent correct classification performance is used to assess the developed RF-DNA fingerprinting process. Two additional SEI approaches are assessed to facilitate comparative analysis of the serial number discrimination of four IEEE 802.11a Wi-Fi radios using a Rayleigh fading channel. Relative to the Adaptive Compensator (A-C) and N-M SEI approaches, RF-DNA fingerprinting provides the best means for achieving reliable (better than 95%) identification of all radios within a L=2 Rayleigh fading channel at SNR ≥ 21 dB.

Unauthorized network access and spoofing attacks at wireless access points (WAPs) have been traditionally addressed using bit-centric security measures and remain a major information technology security concern. This has been recently addressed using RF fingerprinting methods within the physical layer to augment WAP security. This paper extends the RF fingerprinting knowledge base by: 1) identifying and removing less-relevant features through dimensional reduction analysis (DRA) and 2) providing a first look assessment of device identification (ID) verification that enables the detection of rogue devices attempting to gain network access by presenting false bit-level credentials of authorized devices. DRA benefits and rogue device rejection performance are demonstrated using discrete Gabor transform features extracted from experimentally collected orthogonal frequency division multiplexing-based wireless fidelity (WiFi) and worldwide interoperability for microwave access (WiMAX) signals. Relative to empirically selected full-dimensional feature sets, performance using DRA-reduced feature sets containing only 10% of the highest ranked features (90% reduction), includes: 1) maintaining desired device classification accuracy and 2) improving authorized device ID verification for both WiFi and WiMAX signals. Reliable burst-by-burst rogue device rejection of better than 93% is achieved for 72 unique spoofing attacks and improvement to 100% is demonstrated when an accurate sample of the overall device population is employed. DRA-reduced feature set efficiency is reflected in DRA models requiring only one-tenth the number of features and processing time.

Cognitive Radio (CR) networks create an environment that presents unique security challenges, with reliable user authentication being essential for mitigating Primary User Emulation (PUE) spoofing and ensuring the cognition engine is using reliable information when dynamically reconfiguring the network. Unfortunately, wireless network edge devices increase spoofing potential as all devices can “see” all network traffic within RF range. Conventional bit-level security helps, but additional security based on physical-layer (PHY) attributes is required to ensure unauthorized devices do not adversely impact CR reliability during environmental assessment. RF Distinct Native Attribute (RF-DNA) fingerprinting is one PHY technique for reliably identifying devices based on inherent emission differences. These differences are exploited to uniquely identify, by serial number, hardware devices and aid cognitive network security. Reliable device discrimination has been achieved using Multiple Discriminant Analysis, Maximum Likelihood (MDA/ML) processing. However, MDA/ML provides no insight into feature relevance which limits its use for optimizing feature selection. This limitation is addressed here using Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) and Learning from Signals (LFS) classifiers. Comparative assessment shows that GRLVQI and LFS classification performance rivals that of MDA/ML, overcomes inherent MDA/ML limitations, and provides benefit for CR network applications where reliable RF environment assessment and PUE mitigation is essential.

Considerable effort has been put forth to exploit physical layer attributes to augment network bit-level security mechanisms. RF-DNA fingerprints possess such attributes and can be used to uniquely identify authorized users and mitigate unauthorized network activity. These attributes are unique to a given electronic device and difficult to replicate for cloning, spoofing, etc. Device discrimination (identification) of WiMAX devices has been successfully demonstrated using a one-to-many comparison against a pool of unknown device fingerprints. The work here now addresses device authentication using a one-to-one comparison against the specific fingerprint associated with a claimed bit-level identity (MAC, SIM, IMEI, etc). The concept is demonstrated using Gabor-based RF-DNA extracted from near-transient burst responses of 802.16e WiMAX mobile subscriber devices-device identification of better than 96% is achieved with verification EER ≤ 1.6% for SNR ≥ -3 dB.

Successful "cracking" of bit-level security compromises network integrity and physical layer augmentation is being investigated to improve overall security. Intra-cellular security is addressed here using device-specific RF "Distinct Native Attribute" (RF-DNA) fingerprints in a localized regional air monitor, with targeted applications including cellular networks such as the Global System for Mobile (GSM) Communications and last mile Worldwide Interoperability for Microwave Access (WiMAX) systems. Previous work demonstrated GSM inter-manufacturer classification (manufacturer discrimination) using RF-DNA fingerprinting and achieved accuracies of 92% at SNR = 6 dB. These results are extended here for intra-manufacturer classification (serial number discrimination). Historically, intra-manufacturer discrimination has posed the greatest challenge and RF-DNA fingerprinting has been effective with both Orthogonal Frequency Division Multiplexed (OFDM) and Direct Sequence Spread Spectrum (DSSS) network signals. Intra-manufacturer GSM results are provided here based on identical signal collection, fingerprint generation, and MDA/ML classification processes used for previous inter manufacturer assessment. When comparing performance, the trend for GSM intra-manufacturer classification is consistent with previous work for other network-based signals and device classification is much more challenging. For classification accuracies of 80% or better, intra manufacturer fingerprinting requires an increase of 20-25 dB in SNR to achieve inter-manufacturer performance.

Improved intra-cellular security is addressed using device-specific RF fingerprints to mitigate malicious network activity that can occur through unauthorized use of digital identities. In air monitoring applications where physical equipment constraints are not overly restrictive, RF fingerprinting remains a viable option for providing regional intra-cellular security for systems such as cellular telephone and last mile WiMax networks. Proof-of-concept results are provided for GSM signals given they are readily available in most areas. Recent RF fingerprinting work has demonstrated average device classification accuracies (serial number identification) of 92% using OFDM-based 802.11a preamble responses at SNR = 6 dB. The goal here was to determine if similar performance could be achieved using RF fingerprints extracted from near-transient and midamble regions of GSM signals. This was done using instantaneous phase responses from each region to form RF statistical fingerprints that are subsequently classified using Fisher-based MDA/ML processing. Considering all GSM device permutations from four different manufacturers, near-transient RF fingerprinting provided nearly 13% improvement in classification performance when compared with midamble RF fingerprinting and achieved average classification performance consistent with the 802.11a benchmark of 92% correct classification at SNR = 6 dB.

There has been a recent shift toward improving wireless access security within the OSI PHY layer by exploiting RF features that are inherently device specific and difficult to replicate by an unintended party. This work addresses the extraction and exploitation of RF "fingerprints" to classify emissions and provide device-specific identification. Burst transient detection precedes RF fingerprint extraction and is generally the most critical step in the overall process. This work provides a much needed sensitivity analysis of burst detection capability. The analysis is conducted using instantaneous amplitude responses with both Fractal-Bayesian Step Change Detection (Fractal-BSCD) and Variance Trajectory (VT) processes. The performance of each method is evaluated under varying SNR conditions using experimentally collected 802.11a OFDM signals. The impact of transient detection error on signal classification performance is then demonstrated using RF fingerprints and Multiple Discriminant Analysis (MDA) with Maximum Likelihood (ML) classification. The VT technique emerges as the better alternative for all SNRs considered and yields MDA-ML classification accuracy that is consistent with "perfect" transient estimation performance.