Radio Frequency Fingerprinting (RFF) is the attribution of uniquely identifiable signal distortions to emitters via Machine Learning (ML) classifiers. RFF approaches relying on pre-determined expert features lack generalizability, and state-of-the-art approaches based on Convolutional Neural Networks (CNNs) can be too demanding for endpoint devices to train. This work presents Fingerprint Extraction through Distortion Reconstruction (FEDR), a best-of-both-worlds technique which employs a pre-trained CNN to identify and extract a small, salient set of unique features, amenable for use in lightweight machine learning models. Given a received distorted signal, the FEDR network encodes signal distortions into “fingerprints,” which can be used by lightweight ML classifiers to perform RFF with minimal resource consumption at the endpoint. FEDR learns by transforming generated signals into reconstructions of received signals, relying solely on the fingerprints as representations of the distortions – as the reconstructions improve, the fingerprints better encode the distortions. The FEDR technique was evaluated on synthetic IQ-imbalanced IEEE 802.11a/g data, where FEDR fingerprints were shown to encode actual IQ imbalance parameters, signifying successful isolation of distortion information and validating the FEDR technique. FEDR was further evaluated on a representative real-world WiFi dataset, where extracted fingerprints were coupled with a lightweight two-layer dense network. When compared against two common RFF techniques, the FEDR-based approach achieved state-of-the-art performance with Matthews Correlation Coefficient ranging from 0.984 (5 classes) to 0.851 (100 classes), using nearly 73% fewer training parameters than the next-best technique.

Radio frequency (RF) fingerprinting extracts fingerprint features from RF signals to protect against masquerade attacks by enabling reliable authentication of communication devices at the “serial number” level. Facilitating the reliable authentication of communication devices are machine learning (ML) algorithms which find meaningful statistical differences between measured data. The Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) classifier is one ML algorithm which has shown efficacy for RF fingerprinting device discrimination. GRLVQI extends the Learning Vector Quantization (LVQ) family of “winner take all” classifiers that develop prototype vectors (PVs) which represent data. In LVQ algorithms, distances are computed between exemplars and PVs, and PVs are iteratively moved to accurately represent the data. GRLVQI extends LVQ with a sigmoidal cost function, relevance learning, and PV update logic improvements. However, both LVQ and GRLVQI are limited due to a reliance on squared Euclidean distance measures and a seemingly complex algorithm structure if changes are made to the underlying distance measure. Herein, the authors (1) develop GRLVQI-D (distance), an extension of GRLVQI to consider alternative distance measures and (2) present the Cosine GRLVQI classifier using this framework. To evaluate this framework, the authors consider experimentally collected Z-wave RF signals and develop RF fingerprints to identify devices. Z-wave devices are low-cost, low-power communication technologies seen increasingly in critical infrastructure. Both classification and verification, claimed identity, and performance comparisons are made with the new Cosine GRLVQI algorithm. The results show more robust performance when using the Cosine GRLVQI algorithm when compared with four algorithms in the literature. Additionally, the methodology used to create Cosine GRLVQI is generalizable to alternative measures.

This work provides development of Constellation Based DNA (CB-DNA) Fingerprinting for use in systems employing quadrature modulations and includes network protection demonstrations for ZigBee offset quadrature phase shift keying modulation. Results are based on 120 unique networks comprised of seven authorized ZigBee RZSUBSTICK devices, with three additional like-model devices serving as unauthorized rogue devices. Authorized network device fingerprints are used to train a Multiple Discriminant Analysis (MDA) classifier and Rogue Rejection Rate (RRR) estimated for 2520 attacks involving rogue devices presenting themselves as authorized devices. With MDA training thresholds set to achieve a True Verification Rate (TVR) of TVR = 95% for authorized network devices, the collective rogue device detection results for SNR ≥ 12 dB include average burst-by-burst RRR ≈ 94% across all 2520 attack scenarios with individual rogue device attack performance spanning 83.32% < RRR < 99.81%.

The need for improved critical infrastructure and key resource security is unquestioned and there has been minimal emphasis on level-0 (PHY process) improvements. Wired signal distinct native attribute finger-printing is investigated here as a non-intrusive PHY-based security augmentation to support an envisioned layered security strategy. Results are based on experimental response collections from highway addressable remote transducer differential pressure transmitter devices from three manufacturers (Yokogawa, Honeywell, and Endress+Hauser) in an automated process control system. Device discrimination is assessed using time domain (TD) and slope-based FSK (SB-FSK) fingerprints input to multiple discriminant analysis, maximum likelihood and random forest (RndF) classifiers. For 12 different classes (two devices per manufacturer at two distinct set points), both classifiers performed reliably and achieved an arbitrary performance benchmark of average cross-class percent correct of %C > 90%. The least challenging cross-manufacturer results included near-perfect %C ≈ 100%, while the more challenging like-model (serial number) discrimination results included 90%Δ= 3% to %CΔ= 4% performance degradation.

Hackers have multiple avenues for accessing Industrial Control System (ICS) and can adversely impact network hardware, operating systems, and executables. This includes attacking hardware/software switches commonly used in waste water, water treatment, and power substation facilities. Unauthorized network intrusion can be mitigated by augmenting Media Access Control (MAC) based device identity (ID) verification processes using Physical-Layer (PHY) features. PHY augmentation is addressed here using Constellation Based Distinct Native Attribute (CB-DNA) features derived from unintentional Ethernet cable emissions. Collected emission symbols are mapped to a gradient-based binary constellation space where, for the first time, conditional constellation symbol features are used for device ID verification. Serial number discrimination is assessed using 16 devices from 4 different manufactures, with 12 serving as authorized devices and 4 (one from each manufacturer) serving as attacking rogue devices. Collectively considering 12,288 rogue attack scenarios using 256 verification models, the proposed CB-DNA method is promising and yielded average Rogue Reject Rates (RRR) of 85.2%26.0 dB using two network access criteria.

The proliferation of low-cost IEEE 802.15.4 ZigBee wireless devices in critical infrastructure applications presents security challenges. Network security commonly relies on bit-level credentials that are easily replicated and exploited by hackers. Unauthorized access can be mitigated by physical layer (PHY) security measures that exploit device-dependent emission characteristics that are sufficiently unique to discriminate devices. RF distinct native attribute (RF-DNA) fingerprinting is a PHY-based security measure, which computes statistical features extracted from such device emissions. However, the RF-DNA fingerprints can be numerous, correlated, and noisy, therefore, a dimensional reduction analysis (DRA) via feature selection is, therefore, of interest. Device classification with DRA feature subsets is evaluated using a multiple discriminant analysis (MDA) classifier. Determining feature relevance from MDA was generally dismissed in prior RF fingerprinting work and is seldom considered in other applications. Here, the MDA feature relevance is revisited using a proposed eigen-based MDA loadings fusion (MLF) methodology. The MDA classification models are adopted and used to assess device identification (ID) classification and verification performance for both the authorized and unauthorized (rogue) devices using a claimed versus actual biometric methodology. Performance is compared for six DRA methods using: 1) a two-sample Kolmogorov-Smirnov test; 2) one-way analysis of variance F-test statistics; 3) a Wilk's lambda ratio; 4) generalized relevance learning vector quantized-improved relevance; 5) randomly selected; and 6) the proposed MLF method. Quantitative and qualitative dimensionality assessment methods are compared and contrasted to establish upper bounds on the number of retained features. Experimentally collected ZigBee emissions are considered and ZigBee device classification and ID verification performance using DRA subsets are compared with a full-dimensional feature set. Results show that DRA via the proposed MLF method is superior and more robust than competing methods.

Wireless networks are particularly vulnerable to spoofing and route poisoning attacks due to the contested transmission medium. Recent works investigate physical layer features such as received signal strength or radio frequency fingerprints to localize and identify malicious devices. In this paper we demonstrate a novel and complementary approach to exploiting physical layer differences among wireless devices that is more energy efficient and invariant with respect to the environment. Specifically, we exploit subtle design differences among transceiver hardware types. Transceivers fulfill the physical-layer aspects of wireless networking protocols, yet specific hardware implementations vary among manufacturers and device types. In this paper we demonstrate that precise manipulation of the physical layer header prevents a subset of transceiver types from receiving the manipulated packet. By soliciting acknowledgments from wireless devices using a small number of packets with manipulated preambles and frame lengths, a response pattern identifies the true transceiver class of the device under test. Herein we demonstrate a transceiver taxonomy of six classes with greater than 99 percent accuracy, irrespective of environment. We successfully demonstrate wireless multi-factor authentication, intrusion detection, and transceiver type fingerprinting through preamble manipulation.

Unauthorized network access and spoofing attacks at wireless access points (WAPs) have been traditionally addressed using bit-centric security measures and remain a major information technology security concern. This has been recently addressed using RF fingerprinting methods within the physical layer to augment WAP security. This paper extends the RF fingerprinting knowledge base by: 1) identifying and removing less-relevant features through dimensional reduction analysis (DRA) and 2) providing a first look assessment of device identification (ID) verification that enables the detection of rogue devices attempting to gain network access by presenting false bit-level credentials of authorized devices. DRA benefits and rogue device rejection performance are demonstrated using discrete Gabor transform features extracted from experimentally collected orthogonal frequency division multiplexing-based wireless fidelity (WiFi) and worldwide interoperability for microwave access (WiMAX) signals. Relative to empirically selected full-dimensional feature sets, performance using DRA-reduced feature sets containing only 10% of the highest ranked features (90% reduction), includes: 1) maintaining desired device classification accuracy and 2) improving authorized device ID verification for both WiFi and WiMAX signals. Reliable burst-by-burst rogue device rejection of better than 93% is achieved for 72 unique spoofing attacks and improvement to 100% is demonstrated when an accurate sample of the overall device population is employed. DRA-reduced feature set efficiency is reflected in DRA models requiring only one-tenth the number of features and processing time.

The popularity of ZigBee devices continues to grow in home automation, transportation, traffic management, and Industrial Control System (ICS) applications given their low-cost and low-power. However, the decentralized architecture of ZigBee ad-hoc networks creates unique security challenges for network intrusion detection and prevention. In the past, ZigBee device authentication reliability was enhanced by Radio Frequency-Distinct Native Attribute (RF-DNA) fingerprinting using a Fisher-based Multiple Discriminant Analysis and Maximum Likelihood (MDA-ML) classification process to distinguish between devices in low Signal-to-Noise Ratio (SNR) environments. However, MDA-ML performance inherently degrades when RF-DNA features do not satisfy Gaussian normality conditions, which often occurs in real-world scenarios where radio frequency (RF) multipath and interference from other devices is present. We introduce non-parametric Random Forest (RndF) and Multi-Class AdaBoost (MCA) ensemble classifiers into the RF-DNA fingerprinting arena, and demonstrate improved ZigBee device authentication. Results are compared with parametric MDA-ML and Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) classifier results using identical input feature sets. Fingerprint dimensional reduction is examined using three methods, namely a pre-classification Kolmogorov-Smirnoff Test (KS-Test), a post-classification RndF feature relevance ranking, and a GRLVQI feature relevance ranking. Using the ensemble methods, an SNR=18.0 dB improvement over MDA-ML processing is realized at an arbitrary correct classification rate (%C) benchmark of %C=90%; for all SNR ∈ [0, 30] dB considered, %C improvement over MDA-ML ranged from 9% to 24%. Relative to GRLVQI processing, ensemble methods again provided improvement for all SNR, with a best improvement of %C=10% achieved at the lowest tested SNR=0.0 dB. Network penetration, measured using rogue ZigBee devices, show that at the SNR=12.0 dB (%C=90%) the ensemble methods correctly reject 31 of 36 rogue access attempts based on Receiver Operating Characteristic (ROC) curve analysis and an arbitrary Rogue Accept Rate of . This performance is better than MDA-ML, and GRLVQI which rejected 25/36, and 28/36 rogue access attempts respectively. The key benefit of ensemble method processing is improved rogue rejection in noisier environments; gains of 6.0 dB, and 18.0 dB are realized over GRLVQI, and MDA-ML, respectively. Collectively considering the demonstrated %C and rogue rejection capability, the use of ensemble methods improves ZigBee network authentication, and enhances anti-spoofing protection afforded by RF-DNA fingerprinting.

We propose a segment averaging matched-filter solution for recovering radar phase history data from orthogonal frequency division multiplex (OFDM) signals. The impact of digital communication features—guard bands, preambles, pilots, sync symbols, and cyclic prefixes—is discussed, and the derived matched-filter solution is modified accordingly. Experimental images using generic OFDM and IEEE 802.16 WiMAX signals demonstrate the success of the proposed signal processing approach for passive bistatic radar imaging.

Cognitive Radio (CR) networks create an environment that presents unique security challenges, with reliable user authentication being essential for mitigating Primary User Emulation (PUE) spoofing and ensuring the cognition engine is using reliable information when dynamically reconfiguring the network. Unfortunately, wireless network edge devices increase spoofing potential as all devices can “see” all network traffic within RF range. Conventional bit-level security helps, but additional security based on physical-layer (PHY) attributes is required to ensure unauthorized devices do not adversely impact CR reliability during environmental assessment. RF Distinct Native Attribute (RF-DNA) fingerprinting is one PHY technique for reliably identifying devices based on inherent emission differences. These differences are exploited to uniquely identify, by serial number, hardware devices and aid cognitive network security. Reliable device discrimination has been achieved using Multiple Discriminant Analysis, Maximum Likelihood (MDA/ML) processing. However, MDA/ML provides no insight into feature relevance which limits its use for optimizing feature selection. This limitation is addressed here using Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) and Learning from Signals (LFS) classifiers. Comparative assessment shows that GRLVQI and LFS classification performance rivals that of MDA/ML, overcomes inherent MDA/ML limitations, and provides benefit for CR network applications where reliable RF environment assessment and PUE mitigation is essential.

Orthogonal Frequency Division Multiplexing (OFDM) has been considered as a strong candidate for next generation wireless communication systems. Compared to traditional OFDM, Single Carrier OFDM (SC-OFDM) has demonstrated excellent bit error rate (BER) performance, as well as low peak to average power ratio (PAPR). Similar to other multi-carrier transmission technologies, SC-OFDM suffers significant performance degradation resulting from intercarrier interference (ICI) in high mobility environments. Existing techniques for OFDM can be directly adopted in SC-OFDM to improve performance, however, this improved performance comes at costs such as decreased throughput. In this paper, we analyze the effect of ICI on an SC-OFDM system and propose a novel modulation scheme. The proposed Magnitude-Keyed Modulation (MKM) modulation provides SC-OFDM system immunity to ICI and with an easy implementation it significantly outperforms OFDM, SC-OFDM and MC-CDMA systems with Phase Shift Keying (PSK) modulation and Quadrature Amplitude Modulation (QAM) in severe ICI environment. Analysis also illustrates the proposed SC-OFDM system with MKM modulation maintains low PAPR compared to traditional OFDM and SC-OFDM systems with PSK and QAM modulations. Simulation results for different modulation schemes in various ICI environments confirm the effectiveness of the proposed system.

Side-channel analysis has been used to successfully attack many cryptographic systems. However, to improve trace quality and make collection of side-channel data easier, the attacker typically modifies the target device to add a trigger signal. This trigger implies a very powerful attacker with virtually complete control over the device. This paper describes a method to collect side-channel data using a software defined radio (SDR) in real-time without requiring a collection device trigger. A correlation-based frequency-dependent leakage mapping technique is introduced to evaluate a 32-bit microprocessor, revealing that individual key bytes leak at different frequencies. Key byte-dependent leakage is observed in both SDR collected and triggered oscilloscope-based collections (which serve to validate the SDR data). This research is the first to demonstrate effective differential attack using SDRs. Successful attacks are presented using two SDRs, including a US$20 digital television receiver with modified drivers.

The ZigBee specification builds upon IEEE 802.15.4 low-rate wireless personal area standards by adding security and mesh networking functionality. ZigBee networks may be secured through 128-bit encryption keys and by MAC address access control lists, yet these credentials are vulnerable to interception and spoofing via free software tools available over the Internet. This work proposes a multi-factor PHY-MAC-NWK security framework for ZigBee that augments bit-level security using radio frequency (RF) PHY features. These features, or RF fingerprints, can be used to differentiate between dissimilar or like-model wireless devices. Previous PHY-based works on mesh network device differentiation predominantly exploited the signal turn-on region, measured in nanoseconds. For an arbitrary benchmark of 90% or better classification accuracy, this work shows that reliable PHY-based ZigBee device discrimination can be achieved at SNR ≥ 8 dB. This is done using the entire transmission preamble, which is less technically challenging to detect and is over 1000 times longer than the signal turn-on region. This work also introduces a statistical, pre-classification feature ranking technique for identifying relevant features that dramatically reduces the number of RF fingerprint features without sacrificing classification performance.

Considerable effort has been put forth to exploit physical layer attributes to augment network bit-level security mechanisms. RF-DNA fingerprints possess such attributes and can be used to uniquely identify authorized users and mitigate unauthorized network activity. These attributes are unique to a given electronic device and difficult to replicate for cloning, spoofing, etc. Device discrimination (identification) of WiMAX devices has been successfully demonstrated using a one-to-many comparison against a pool of unknown device fingerprints. The work here now addresses device authentication using a one-to-one comparison against the specific fingerprint associated with a claimed bit-level identity (MAC, SIM, IMEI, etc). The concept is demonstrated using Gabor-based RF-DNA extracted from near-transient burst responses of 802.16e WiMAX mobile subscriber devices-device identification of better than 96% is achieved with verification EER ≤ 1.6% for SNR ≥ -3 dB.

Radio-frequency distinct native attribute (RF-DNA) fingerprinting is adapted as a physical-layer technique to improve the security of integrated circuit (IC)-based multifactor authentication systems. Device recognition tasks (both identification and verification) are accomplished by passively monitoring and exploiting the intrinsic features of an IC's unintentional RF emissions without requiring any modification to the device being analyzed. Device discrimination is achieved using RF-DNA fingerprints comprised of higher order statistical features based on instantaneous amplitude, phase, and frequency responses as a device executes a sequence of operations. The recognition system is trained using multiple discriminant analysis to reduce data dimensionality while retaining class separability, and the resultant fingerprints are classified using a linear Bayesian classifier. Demonstrated identification and verification performance includes average identification accuracy of greater than 99.5% and equal error rates of less than 0.05% for 40 near-identical devices. Depending on the level of required classification accuracy, RF-DNA fingerprint-based authentication is well-suited for implementation as a countermeasure to device cloning, and is promising for use in a wide variety of related security problems.

Computer and communication network attacks are commonly orchestrated through Wireless Access Points (WAPs). This paper summarizes proof-of-concept research activity aimed at developing a physical layer Radio Frequency (RF) air monitoring capability to limit unauthorized WAP access and improve network security. This is done using Differential Evolution (DE) to optimize the performance of a "Learning from Signals" (LFS) classifier implemented with RF "Distinct Native Attribute" (RF-DNA) fingerprints. Performance of the resultant DE-optimized LFS classifier is demonstrated using 802.11a WiFi devices under the most challenging conditions of intra-manufacturer classification, i.e., using emissions of like-model devices that only differ in serial number. Using identical classifier input features, performance of the DE-optimized LFS classifier is assessed relative to a Multiple Discriminant Analysis / Maximum Likelihood (MDA/ML) classifier that has been used for previous demonstrations. The comparative assessment is made using both Time Domain (TD) and Spectral Domain (SD) fingerprint features. For all combinations of classifier type, feature type, and signal-to-noise ratio considered, results show that the DE-optimized LFS classifier with TD features is superior and provides up to 20% improvement in classification accuracy with proper selection of DE parameters.

Wireless communication networks remain under attack with ill- intentioned "hackers" routinely gaining unauthorized access through Wireless Access Points-one of the most vulnerable points in an Information Technology (IT) system. The goal here is to demonstrate the feasibility of using Radio Frequency (RF) air monitoring to augment conventional bit-level security at WAPs. The specific networks of interest include those based on Orthogonal Frequency Division Multiplexing (OFDM), to include 802.11a/g WiFi and 4G 802.16 WiMAX. Proof-of-concept results are presented to demonstrate the effectiveness of a "Learning from Signals" (LFS) classifier with Gaussian kernel bandwidth parameters optimally determined using Differential Evolution (DE). The resultant DE-optimized LFS classifier is implemented within an RF "Distinct Native Attribute" (RF-DNA) fingerprinting process with both Time Domain (TD) and Spectral Domain (SD) features input to the classifier. The RF-DNA is used for intra-manufacturer (like-model devices from a given manufacturer) discrimination of IEEE compliant 802.11a WiFi devices and 802.16e WiMAX devices. A comparative performance assessment is provided using results from the proposed DE-optimized LFS classifier and a Bayesian-based Multiple Discriminant Analysis/Maximum Likelihood (MDA/ML) classifier as used in previous demonstrations. The assessment is performed using identical TD and SD fingerprint features for both classifiers. Preliminary results of the DE-optimized classifier are very promising, with correct classification improvement of 15% to 40% realized over the range of signal to noise ratios considered.

Successful "cracking" of bit-level security compromises network integrity and physical layer augmentation is being investigated to improve overall security. Intra-cellular security is addressed here using device-specific RF "Distinct Native Attribute" (RF-DNA) fingerprints in a localized regional air monitor, with targeted applications including cellular networks such as the Global System for Mobile (GSM) Communications and last mile Worldwide Interoperability for Microwave Access (WiMAX) systems. Previous work demonstrated GSM inter-manufacturer classification (manufacturer discrimination) using RF-DNA fingerprinting and achieved accuracies of 92% at SNR = 6 dB. These results are extended here for intra-manufacturer classification (serial number discrimination). Historically, intra-manufacturer discrimination has posed the greatest challenge and RF-DNA fingerprinting has been effective with both Orthogonal Frequency Division Multiplexed (OFDM) and Direct Sequence Spread Spectrum (DSSS) network signals. Intra-manufacturer GSM results are provided here based on identical signal collection, fingerprint generation, and MDA/ML classification processes used for previous inter manufacturer assessment. When comparing performance, the trend for GSM intra-manufacturer classification is consistent with previous work for other network-based signals and device classification is much more challenging. For classification accuracies of 80% or better, intra manufacturer fingerprinting requires an increase of 20-25 dB in SNR to achieve inter-manufacturer performance.

For orthogonal frequency division multiplexing (OFDM) communication systems, the orthogonality among subcarriers is lost in mobile applications due to frequency offset resulting from either transmitter-receiver local oscillator differences or Doppler shift caused by mobility. As a direct result, inter-carrier interference (ICI) is observed on each and every subcarrier, leading to significant performance degradation. There are a lot of OFDM carrier frequency offset (CFO) estimation schemes classified as data aided estimation and blind estimation. Due to the system power and high bandwidth efficiencies, blind estimators have received a lot of attention recently. Many blind CFO schemes were proposed for OFDM systems, some of which are based on power spectrum smoothing, kurtosis-type cost functions and minimum output variance. In this paper, we propose a novel blind CFO estimator based on Minimum Reconstruction Error (MRE). In contrast to other blind CFO estimators, the proposed technique can be used for any constellation schemes, does not require a large number of blocks to reach acceptable estimation error and provides reliable estimation performance with very low mean square error (MSE). Simulation results in AWGN and multi-path fading channels confirm that performance of the proposed highly accurate blind CFO estimator is superior when frequency offset or time variation occurs in the channel - the proposed technique outperforms most existing blind CFO estimation methods.

Applicability of Spectrally Modulated, Spectrally Encoded (SMSE) waveform design has been expanded for future Cognitive Radio (CR)-based Software Defined Radio (SDR) applications. As previously demonstrated, the SMSE waveform design process can exploit statistical knowledge of PU spectral and temporal behavior to maximize SMSE system throughput (bits/second) while adhering to SMSE and Primary User (PU) spectral constraints. The capacity of SMSE systems is extended here using spectral partitioning with carrier-interferometry (CI) coding to increase SMSE waveform agility in the presence of a spectrally diverse transmission channel. By adaptively varying the modulation order and optimally allocating power within each spectral partition, inherent SMSE flexibility is more fully exploited and substantially increases system throughput while meeting Power Spectral Density (PSD) constraints. A coexistent scenario is provided in which the analytic optimization of the SMSE waveform is demonstrated while meeting spectral mask requirements. Results show that spectrally partitioned CI-SMSE waveforms have a significantly greater ability to adapt to varying spectral requirements.

Wireless communication security is addressed using device-specific RF-DNA fingerprints in a localized regional air monitor. The targeted application includes IEEE 802.16 WiMax-based airport communications such as being proposed by the Euro control and FAA organizations-concept validation is currently underway using the Aeronautical Mobile Airport Communications System (AeroMACS) network. Security enhancement via RF-DNA fingerprinting is motivated by earlier RF-DNA work using GMSK-based intra-cellular GSM signals and OFDM-based 802.11a peer-to-peer WiFi signals. The commonality that WiMax shares with these two existing communication systems, i.e., the cellular control structure of GSM and the multi-carrier OFDM modulation of 802.11a, suggests that RF-DNA fingerprinting may be effective for WiMax device discrimination. This is important given that WiMax shares some common features that may prove detrimental, to include bit-level authentication, privacy, and security mechanisms. It is reasonable to assume that these bit-level mechanisms will come under attack as ``hackers'' apply lessons learned from their previous successes. The contributions of this paper include: 1) the introduction of a Spectral Domain (SD) RF-DNA fingerprinting technique to augment previous Time Domain (TD) and Wavelet Domain (WD) techniques, and 2) a first look at AeroMACS physical waveform features and the potential applicability of RF-DNA fingerprinting using operationally collected signals.

The impact of channel estimation error is investigated for Spectrally Modulated, Spectrally Encoded (SMSE) waveform designs in a coexistent environment containing multiple 802.11 Primary User (PU) systems. As previously demonstrated, the SMSE waveform design process can exploit statistical knowledge of PU spectral and temporal behavior to maximize SMSE system throughput (bits/second). This can be done by enforcing SMSE and PU bit error rate constraints while limiting mutual coexistent interference limited to manageable levels. Since maximum system performance requires accurate channel state knowledge at the SMSE transmitter, the presence of channel estimation error decreases the ability to design spectrally agile signals that optimally exploit coexistent spectral regions. Relative to a spectrally-only adapted system, the spectrally-temporally adapted SMSE system provides significant performance improvement by leveraging knowledge of PU temporal statistics to design temporally agile signals while maintaining desired performance levels for each system. Superiority of spectrally-temporally adapted signals is demonstrated here in terms of increased SMSE throughput (bits/symbol) and greater tolerance to increased channel estimation error.

Improved intra-cellular security is addressed using device-specific RF fingerprints to mitigate malicious network activity that can occur through unauthorized use of digital identities. In air monitoring applications where physical equipment constraints are not overly restrictive, RF fingerprinting remains a viable option for providing regional intra-cellular security for systems such as cellular telephone and last mile WiMax networks. Proof-of-concept results are provided for GSM signals given they are readily available in most areas. Recent RF fingerprinting work has demonstrated average device classification accuracies (serial number identification) of 92% using OFDM-based 802.11a preamble responses at SNR = 6 dB. The goal here was to determine if similar performance could be achieved using RF fingerprints extracted from near-transient and midamble regions of GSM signals. This was done using instantaneous phase responses from each region to form RF statistical fingerprints that are subsequently classified using Fisher-based MDA/ML processing. Considering all GSM device permutations from four different manufacturers, near-transient RF fingerprinting provided nearly 13% improvement in classification performance when compared with midamble RF fingerprinting and achieved average classification performance consistent with the 802.11a benchmark of 92% correct classification at SNR = 6 dB.

Abstract The developmental emphasis on improving wireless access security through various OSI PHY layer mechanisms continues. This work investigates the exploitation of RF waveform features that are inherently unique to specific devices and that may be used for reliable device classification (manufacturer, model, or serial number). Emission classification is addressed here through detection, location, extraction, and exploitation of RF [fingerprints] to provide device‐specific identification. The most critical step in this process is burst detection which occurs prior to fingerprint extraction and classification. Previous variance trajectory (VT) work provided sensitivity analysis for burst detection capability and highlighted the need for more robust processing at lower signal‐to‐noise ratio (SNR). The work presented here introduces a dual‐tree complex wavelet transform (DT‐ℂWT) denoising process to augment and improve VT detection capability. The new method's performance is evaluated using the instantaneous amplitude responses of experimentally collected 802.11a OFDM signals at various SNRs. The impact of detection error on signal classification performance is then illustrated using extracted RF fingerprints and multiple discriminant analysis (MDA) with maximum likelihood (ML) classification. Relative to previous approaches, the DT‐ℂWT augmented process emerges as a better alternative at lower SNR and yields performance that is 34% closer (on average) to [perfect] burst location estimation performance. Copyright © 2009 John Wiley & Sons, Ltd.

Interest in Cognitive Radio (CR) remains strong as the communications community strives to solve the spectrum congestion problem. In conventional CR implementations, interference to primary users is minimized using either overlay waveforms that exploit unused (white) spectrum holes or underlay waveforms that spread their power spectrum density over an ultra-wide bandwidth. In Part I, we proposed a novel hybrid overlay/underlay waveform that realizes benefits of both waveforms and demonstrated its performance in an AWGN channel. This was done by extending the original Spectrally Modulated Spectrally Encoded (SMSE) framework to enable soft decision CR implementations that exploit both unused (white) and underused (gray) spectral areas. In Part II, we analyze and evaluate performance of the proposed hybrid overlay/underlay waveform in frequency selective fading channels. A simulated performance analysis of overlay, underlay and hybrid overlay/ underlay waveforms in frequency selective fading channels is presented and benefits discussed.

There has been a recent shift toward improving wireless access security within the OSI PHY layer by exploiting RF features that are inherently device specific and difficult to replicate by an unintended party. This work addresses the extraction and exploitation of RF "fingerprints" to classify emissions and provide device-specific identification. Burst transient detection precedes RF fingerprint extraction and is generally the most critical step in the overall process. This work provides a much needed sensitivity analysis of burst detection capability. The analysis is conducted using instantaneous amplitude responses with both Fractal-Bayesian Step Change Detection (Fractal-BSCD) and Variance Trajectory (VT) processes. The performance of each method is evaluated under varying SNR conditions using experimentally collected 802.11a OFDM signals. The impact of transient detection error on signal classification performance is then demonstrated using RF fingerprints and Multiple Discriminant Analysis (MDA) with Maximum Likelihood (ML) classification. The VT technique emerges as the better alternative for all SNRs considered and yields MDA-ML classification accuracy that is consistent with "perfect" transient estimation performance.

An analytic approach is presented for optimizing spectrally modulated, spectrally encoded (SMSE) waveforms using independent selection of intra-symbol (within a symbol) subcarrier power and modulation order. The SMSE framework is well-suited for cognition-based, software defined radio (SDR) applications. By exploiting statistical knowledge about the spectral and temporal behavior of interfering signals, the inherent SMSE framework flexibility is leveraged to substantially increase system throughput while limiting coexistent interference. Results for a coexistent scenario are provided in which the analytic optimization of the SMSE waveform is demonstrated in the presence of multiple direct sequence spread spectrum (DSSS) signals. The results reveal significant performance benefits that demonstrate the potential of the SMSE framework to dynamically adapt to changing environmental conditions-key functionality required for future SDR implementations.

MC-CDMA (Multi-carrier Code Division Multiple Access) remains a strong candidate for next generation wireless communication systems. Due to its capability of exploiting frequency diversity, MC-CDMA provides high BER performance in multi-path fading channels. In our previous work, we proposed CI/MC-CDMA (Carrier Interferometry MC-CDMA) and demonstrated better performance relative to traditional MC-CDMA using novel polyphase CI spreading codes. In this work, we evaluate the BER performance of MC-CDMA and CI/MC-CDMA systems in the presence of narrowband interference (NBI). Specifically, theoretical analysis of BER performance for both systems in a multi-path fading channel is derived. We show that the CI/MC-CDMA system provides better NBI suppression capability than MC-CDMA and offers better BER. Simulation results over frequency selective fading channels confirm the validity of the theoretical analysis.

Recent studies suggest that spectrum congestion is primarily due to inefficient spectrum usage rather than spectrum availability. Dynamic spectrum access (DSA) and cognitive radio (CR) are two techniques being considered to improve spectrum efficiency and utilization. The advent of CR has created a paradigm shift in wireless communications and instigated a change in FCC policy towards spectrum regulations. Within the hierarchical DSA model, spectrum overlay and underlay techniques are employed to enable primary and secondary users to coexist while improving overall spectrum efficiency. As employed here, spectrum overlay exploits unused (white) spectral regions while spectrum underlay exploits underused (gray) spectral regions. In general, underlay approaches use more spectrum than overlay approaches and operate below the noise floor of primary users. Spectrally modulated, spectrally encoded (SMSE) signals, to include orthogonal frequency domain multiplexing (OFDM) and multi-carrier code division multiple access (MC-CDMA), are candidate CR waveforms. The SMSE structure supports and is well suited for CR-based software defined radio (SDR) applications. This paper provides a general soft decision SMSE (SDSMSE) framework that extends the original SMSE framework to achieve synergistic CR benefits of overlay and underlay techniques. This extended framework provides considerable flexibility to design overlay, underlay and hybrid overlay/underlay waveforms that are scenario dependent. Overlay/underlay framework flexibility is demonstrated herein for a family of SMSE signals, including OFDM and MC-CDMA. Analytic derivation of CR error probability for overlay and underlay applications is presented. Simulated performance analysis of overlay, underlay and hybrid overlay/underlay waveforms is also presented and benefits discussed, to include improved spectrum efficiency and channel capacity maximization. Performance analysis of overlay/underlay CR waveform in fading channels will be discussed in Part II of the paper.

The proliferation of affordable RF communication devices has given every individual the capability to communicate voice and/or data worldwide. This has increased wireless user exposure and driven the need for improved security measures. While earlier works have primarily focused on detecting and mitigating spoofing at the MAC layer, there has been a shift toward providing protection at the PHY layer by exploiting RF characteristics that are difficult to mimic. This research investigates the use of RF "fingerprints" for classifying emissions by exploiting transient signal features to provide hardware-specific identification. Reliable transient detection is the most important step in the process and is addressed here using variance trajectory of instantaneous amplitude and instantaneous phase responses. Following transient detection performance characterization, power spectral density fingerprints are extracted and spectral correlation used for classification. For proof-of-concept demonstration, the overall detection and classification process is evaluated using experimentally collected 802.11a OFDM signals. Results show that amplitude-based transient detection is most effective. Classification performance is demonstrated using three devices with overall classification accuracy approaching 80% for 802.11a signals at SNRs greater than 6 dB.

A spectrally modulated, spectrally encoded (SMSE) framework is adopted for implementing code division multiple access (CDMA) with partial band interference suppression. SMSE signals are constructed within an architecture governed by cognitive radio (CR) principles and supported by software defined radio (SDR) implementation, a union referred to as CR- based SDR. Orthogonal frequency division multiplexing (OFDM) signals, a foundational part of future 4G systems, are collectively classified as SMSE because data modulation and encoding are applied in the spectral domain. Framework applicability was demonstrated for realistic 4G signals by illustrating consistency between resultant analytic SMSE expressions and published results. Framework implementability and flexibility is further demonstrated herein using more complex CDMA signal structures. Modeling and simulation results are presented for a form of multi-carrier CDMA using polyphase codes with adaptive spectral notching (interference avoidance). Collectively, the SMSE implementation of this system correlates very well with theoretical predictions for multiple access scenarios.

An experimental design approach is used to determine which factors (design parameters) of spectrally modulated, spectrally encoded (SMSE) waveforms have the greatest impact on coexistence with other communication waveforms. The SMSE framework supports cognition-based, software defined radio (SDR) applications and is well-suited for coexistence analysis. For initial proof-of-concept, a two factor (parameter), three-level (value) experimental design technique is applied to a coexistent scenario to characterize SMSE waveform impact on direct sequence spread spectrum (DSSS) receiver performance. The experimental design methodology reliably captures factor-level sensitivities and identifies those factors having greatest impact on system coexistence behavior (bit error variation). Given these initial results and its effectiveness in other engineering fields, it is believed that experimental design may pave the way for developing more rigorous waveform design methods and allow more robust coexistence analysis of conventional, DSSS and SMSE waveforms.

This paper applies a recently introduced general analytic framework for spectrally modulated and spectrally encoded (SMSE) signals to carrier interferometry (CI) signals. The SMSE framework mathematically incorporates the waveform adaptivity and diversity found in SMSE signals. Future fourth generation (4G) radios are likely to operate using cognitive principles whereby the system adapts to changing traffic loads, interfering signals, spectrum availability, and channel conditions. Because 4G architectures are contemplating the use of SMSE techniques to enable cognitive communications, a general analytic framework was recently introduced in which SMSE signals can be derived, analyzed, and implemented. This paper adopts this concise mathematical model and applies it to CI signals, including those that couple CI coding techniques with orthogonal frequency division multiplexing (OFDM), coded OFDM, or multi-carrier code division multiple access (MC-CDMA). As shown herein, the model may be implementable using adaptive software defined radio (SDR) techniques.

The growth of wireless applications and spectral limitations are serious concerns for both the military and civilian communities. Cognitive radio (CR) technologies expand spectrum efficiency using elements of space, time and frequency diversity that up to now have not been exploited. An adaptive waveform (AW) generation technique is presented which adapts to the changing electromagnetic environment and synthesizes waveform features in the frequency domain. Spectral coexistence with other applications is also addressed and can be accomplished in both static and dynamic environments. Bit error rate (BER) serves as the primary performance metric for evaluating and comparing AW processing with other waveforms and systems.

Spectral encoding is employed to provide interference avoidance and multiple access capability using M-ary phase shift keyed (MPSK) data modulation. Communication symbols are formed using composite phase modulation (independent data and coded multiple access) on selected spectral components and then inverse Fourier transforming to obtain time domain waveforms. This technique enables multiple access and adaptive channel interference suppression. One inherent advantage is analytic tractability of phase modulation components across domains which enables robust theoretical performance prediction with variation in multiple access phase value assignment. Detection and estimation is accomplished using conventional correlation receiver techniques and error performance is shown to be consistent with conventional MPSK signaling. Analytic and simulated results are provided for multiple access bit error performance and interference suppression demonstrated using randomly assigned, uniformly distributed multiple access phase values.

This research focuses on performance of two ultra wide band (UWB) techniques for implementing multiple access (MA) communications. Specifically, a Gaussian monocycle with time hopping pulse position modulation (TH-PPM) and direct sequence binary phase shift keying (DS-BPSK) is considered. Previous research on UWB system performance using Gold spreading sequences forms the basis for this work. The knowledge base of UWB MA performance characterization is expanded here using codes generated from a random integer selection process and a simulated annealing code generation process. Communication performance is first validated for a single user operating over an AWGN channel and subsequently extended to incorporate multiusers, TH-PPM with Gold coding provides an average MA BER improvement factor of 2.0 /spl times/ 10/sup -2/ and 5.1 /spl times/ 10/sup -2/ over random integer and simulated annealing codes, respectively. Likewise, DS-BPSK with Gold coding provides an average MA BER improvement factor of 3.8/spl times/ 10/sup -4/ and 9.8 /spl times/ 10/sup -4/ over random integer and simulated annealing codes, respectively.

A recently proposed wavelet domain communication system (WDCS) using transform domain processing demonstrates enhanced interference avoidance capability under adverse environmental conditions. This work extends previous results by incorporating a wavelet packet based decomposition technique that permits demonstration of an M-ary orthogonal signaling capability and provides increased adaptability over a larger class of interference signals. The newly proposed WDCS and its response to various interference scenarios are modeled and simulation results obtained using MATLAB/sup /spl reg//. Bit error rate is the key metric for analysis and performance comparisons. Relative to the non-packet based system, the packet based WDCS provides improved/comparable bit error performance in several interference scenarios - single-tone, multiple-tone, swept-tone, and partial-band interference. The system was evaluated using an E/sub b//N/sub 0/ of 4.0 dB and interference energy-to-signal energy (I/E) ratios ranging from 0.0 dB to 16.0 dB. For binary, 4-ary, and 8-ary CSK data modulations, the packet based WDCS exhibited average interference suppression capabilities of 6.7, 9.2, and 12.0 dB, respectively.

Satellite-based mobile multicasting is a largely unexplored and untested area of networking. This paper examines the performance associated with applying distance vector multicast routing protocol (DVMRP) and on demand multicast routing protocol (ODMRP) to a six plane, 66-satellite low Earth orbit satellite (LEOs) constellation. ODMRP provides high quality-of-service performance at the expense of bandwidth efficiency. In contrast, DVMRP is over twice as efficient, with only a 10% lower quality-of-service. Both protocols are stressed under a single satellite failure. For DVMRP, this leads to greater end-to-end delay and slightly higher efficiency. ODMRP shows no significant change from the non-failure case.