Radio Frequency Distinct Native Attribute Research Articles

Radio Identity Verification-Based IoT Security Using RF-DNA Fingerprints and SVM

It is estimated that the number of Internet-of-Things (IoT) devices will reach 75 billion in the next five years. Most of those currently and soon-to-be deployed devices lack sufficient security to protect themselves and their networks from attacks by malicious IoT devices masquerading as authorized devices in order to circumvent digital authentication approaches. This work presents a physical (PHY) layer IoT authentication approach capable of addressing this critical security need through the use of feature-reduced, radio frequency-distinct native attributes (RF-DNA) fingerprints and support vector machines (SVM). This work successfully demonstrates: 1) authorized identity (ID) verification across three trials of six randomly chosen radios at signal-to-noise ratios greater than or equal to 6 dB and 2) rejection of all rogue radio ID spoofing attacks at signal-to-noise ratios greater than or equal to 3 dB using RF-DNA fingerprints whose features are selected using the Relief-F algorithm.

Rogue device discrimination in ZigBee networks using wavelet transform and autoencoders

In modern wireless systems such as ZigBee, sensitive information which is produced by the network is transmitted through different wired or wireless nodes. Providing the requisites of communication between diverse communication system types, such as mobiles, laptops, and desktop computers, does increase the risk of being attacked by outside nodes. Malicious (or unintentional) threats, such as trying to obtain unauthorized accessibility to the network, increase the requirements of data security against the rogue devices trying to tamper with the identity of authorized devices. In such manner, focusing on Radio Frequency Distinct Native Attributes (RF-DNA) of features extracted from physical layer responses (referred to as preambles) of ZigBee devices, a dataset of distinguishable features of all devices can be produced which can be exploited for the detection and rejection of spoofing/rogue devices. Through this procedure, distinction of devices manufactured by the different/same producer(s) can be realized resulting in an improvement of classification system accuracy. The two most challenging problems in initiating RF-DNA are (1) the mechanism of features extraction in the generation of a dataset in the most effective way for model classification and (2) the design of an efficient model for device discrimination of spoofing/rogue devices. In this paper, we analyze the physical layer features of ZigBee devices and present methods based on deep learning algorithms to achieve high classification accuracy, based on wavelet decomposition and on the autoencoder representation of the original dataset.

Radio Frequency Signal Identification Using Transfer Learning Based on LSTM

Radio frequency distinct native attribute (RF-DNA) technology is very important in distinguishing RF devices. This paper presents a new method for distinguishing RF devices by combining transfer learning and long short-term memory (TL-LSTM). The main purpose of this paper is to identify which RF device sent the unknown RF signals. The data were collected from almost the same eight RF devices produced in 2011, 2014 or 2016. These RF devices emitted unintended signals at 2.4G bandwidth with frequency shift keying. The proposed method first used late production RF devices in 2011 or 2014 as source domain and transferred the trained model to target domain produced in 2016 and then used neural network LSTM model to identify the RF signals. The proposed method is advantageous because it does not require a huge amount of sampling data, and this technique is better than traditional strategies to select optimal features in the multi-domain feature space. The results reveal that the proposed method TL-LSTM can solve the problem of small sample training very well.

Identification and authentication for wireless transmission security based on RF-DNA fingerprint

For wireless transmission, radio-frequency device anti-cloning has become a major security issue. Radio-frequency distinct native attribute (RF-DNA) fingerprint is a developing technology to find the difference among RF devices and identify them. Comparing with previous research, (1) this paper proposed that mean (μ) feature should be added into RF-DNA fingerprint. Thus, totally four statistics (mean, standard deviation, skewness, and kurtosis) were calculated on instantaneous amplitude, phase, and frequency generated by Hilbert transform. (2) We first proposed using the logistic regression (LR) and support vector machine (SVM) to recognize such extracted fingerprint at different signal-to-noise ratio (SNR) environment. We compared their performance with traditional multiple discriminant analysis (MDA). (3) In addition, this paper also proposed to extract three sub-features (amplitude, phase, and frequency) separately to recognize extracted fingerprint under MDA. In order to make our results more universal, additive white Gaussian noise was adopted to simulate the real environment. The results show that (1) mean feature conducts an improvement in the classification accuracy, especially in low SNR environment. (2) MDA and SVM could successfully identify these RF devices, and the classification accuracy could reach 94%. Although the classification accuracy of LR is 89.2%, it could get the probability of each class. After adding a different noise, the recognition accuracy is more than 80% when SNR≥5 dB using MDA or SVM. (3) Frequency feature has more discriminant information. Phase and amplitude play an auxiliary but also pivotal role in classification recognition.

Detecting rogue attacks on commercial wireless Insteon home automation systems

The Internet of Things (IoT) and commercial wireless home automation applications are expanding as technical capability evolves and implementation costs continue to decrease. However, many home automation devices lack robust security and are vulnerable to a multitude of bit-level attacks. This was highlighted during the first successful Insteon network intrusion demonstration that occurred at DEF CON 23 using a Software Defined Radio (SDR) with YARD Stick One devices. In response, Radio Frequency Distinct Native Attribute (RF-DNA) Fingerprinting is introduced here as a counter-hacking approach for augmenting network bit-level Identity (ID) authentication using Physical Layer (PHY) waveform features. An RF-DNA Fingerprinting process is adopted here and applied to wireless Insteon home automation devices. Rogue device detection is addressed using a Multiple Discriminant Analysis/Maximum Likelihood (MDA/ML) ID verification process. Rogue assessments include attacks by like-model Insteon Switch (IS) devices and YARD Stick One SDR devices programmed to present actual (false) bit-level credentials for authorized Insteon devices while functionally controlling the state of an unprotected (no RF-DNA discrimination) targeted end point device. Device classification and Rogue Rejection Rate (RRR) performance is assessed using Time Domain (TD) and Slope-Based Frequency Shift Keyed (SB-FSK) Fingerprinting with features extracted from a variant (data dependent) signal response region. The Rogue Rejection Rate (RRR) for SB-FSK Fingerprinting was superior to TD Fingerprinting and included RRR ≈ 95% for 25 like-model IS attacks and RRR ≈ 100% for 36 YARD Stick One SDR attacks. SB-FSK Fingerprinting is more computationally efficient (70% fewer features) than TD Fingerprinting and provides an added benefit of being implementable using features extracted from variant data dependent FSK signal response regions.

Classification performance using 'RF‐DNA' fingerprinting of ultra‐wideband noise waveforms

Device classification is important in many applications such as industrial quality control, through-wall imaging and network security. A novel approach has been proposed to use a digital noise radar (DNR) to actively interrogate microwave devices and classify defective units using ‘radio frequency distinct native attribute (RF-DNA)’ fingerprinting and various classifier algorithms. RF-DNA has previously demonstrated ‘serial number’ discrimination of numerous passive radio frequency signals, achieving classification accuracies above 80% using multiple discriminant analysis/maximum likelihood (MDA/ML) and generalised relevance learning vector quantisation-improved (GRLVQI) classifiers. It has also demonstrated above 80% classification of limited active interrogation responses with a DNR signal using these classifiers. The performance capabilities of the two different classifiers, MDA/ML and GRLVQI, on RF-DNA fingerprints produced from the ultra-wideband noise radar correlation response is expanded.

Improving ZigBee Device Network Authentication Using Ensemble Decision Tree Classifiers With Radio Frequency Distinct Native Attribute Fingerprinting

The popularity of ZigBee devices continues to grow in home automation, transportation, traffic management, and Industrial Control System (ICS) applications given their low-cost and low-power. However, the decentralized architecture of ZigBee ad-hoc networks creates unique security challenges for network intrusion detection and prevention. In the past, ZigBee device authentication reliability was enhanced by Radio Frequency-Distinct Native Attribute (RF-DNA) fingerprinting using a Fisher-based Multiple Discriminant Analysis and Maximum Likelihood (MDA-ML) classification process to distinguish between devices in low Signal-to-Noise Ratio (SNR) environments. However, MDA-ML performance inherently degrades when RF-DNA features do not satisfy Gaussian normality conditions, which often occurs in real-world scenarios where radio frequency (RF) multipath and interference from other devices is present. We introduce non-parametric Random Forest (RndF) and Multi-Class AdaBoost (MCA) ensemble classifiers into the RF-DNA fingerprinting arena, and demonstrate improved ZigBee device authentication. Results are compared with parametric MDA-ML and Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) classifier results using identical input feature sets. Fingerprint dimensional reduction is examined using three methods, namely a pre-classification Kolmogorov-Smirnoff Test (KS-Test), a post-classification RndF feature relevance ranking, and a GRLVQI feature relevance ranking. Using the ensemble methods, an ${\rm SNR}=18.0$ dB improvement over MDA-ML processing is realized at an arbitrary correct classification rate $(\hbox{\%}C)$ benchmark of $\hbox{\%}C=90\hbox{\%}$ ; for all ${\rm SNR}\in [0, 30]$ dB considered, $\hbox{\%}C$ improvement over MDA-ML ranged from 9% to 24%. Relative to GRLVQI processing, ensemble methods again provided improvement for all SNR, with a best improvement of $\hbox{\%}C=10\hbox{\%}$ achieved at the lowest tested ${\rm SNR}=0.0$ dB. Network penetration, measured using rogue ZigBee devices, show that at the ${\rm SNR}=12.0$ dB $(\hbox{\%}C=90\hbox{\%})$ the ensemble methods correctly reject 31 of 36 rogue access attempts based on Receiver Operating Characteristic (ROC) curve analysis and an arbitrary Rogue Accept Rate of ${\rm RAR} . This performance is better than MDA-ML, and GRLVQI which rejected 25/36, and 28/36 rogue access attempts respectively. The key benefit of ensemble method processing is improved rogue rejection in noisier environments; gains of 6.0 dB, and 18.0 dB are realized over GRLVQI, and MDA-ML, respectively. Collectively considering the demonstrated $\hbox{\%}C$ and rogue rejection capability, the use of ensemble methods improves ZigBee network authentication, and enhances anti-spoofing protection afforded by RF-DNA fingerprinting.

“RF-DNA” Fingerprinting for Antenna Classification

Device classification is important for many applications such as industrial quality controls, through-wall imaging, and network security. A novel approach to detection is proposed using a random noise radar (RNR), coupled with Radio Frequency “Distinct Native Attribute (RF-DNA)” fingerprinting processing algorithms to non-destructively interrogate microwave devices. RF-DNA has previously demonstrated “serial number” discrimination of passive Radio Frequency (RF) emissions such as Orthogonal Frequency Division Multiplexed (OFDM) signals, Worldwide Interoperability for Microwave Access (WiMAX) signals and others with classification accuracies above 80% using a Multiple Discriminant Analysis/Maximum Likelihood (MDAML) classifier. This approach proposes to couple the classification successes of the RF-DNA fingerprint processing with a non-destructive active interrogation waveform. An Ultra Wideband (UWB) noise waveform is uniquely suitable as an active interrogation method since it will not cause damage to sensitive microwave components and multiple RNRs can operate simultaneously in close proximity, allowing for significant parallelization of detection systems.

Intrinsic Physical-Layer Authentication of Integrated Circuits

Radio-frequency distinct native attribute (RF-DNA) fingerprinting is adapted as a physical-layer technique to improve the security of integrated circuit (IC)-based multifactor authentication systems. Device recognition tasks (both identification and verification) are accomplished by passively monitoring and exploiting the intrinsic features of an IC's unintentional RF emissions without requiring any modification to the device being analyzed. Device discrimination is achieved using RF-DNA fingerprints comprised of higher order statistical features based on instantaneous amplitude, phase, and frequency responses as a device executes a sequence of operations. The recognition system is trained using multiple discriminant analysis to reduce data dimensionality while retaining class separability, and the resultant fingerprints are classified using a linear Bayesian classifier. Demonstrated identification and verification performance includes average identification accuracy of greater than 99.5% and equal error rates of less than 0.05% for 40 near-identical devices. Depending on the level of required classification accuracy, RF-DNA fingerprint-based authentication is well-suited for implementation as a countermeasure to device cloning, and is promising for use in a wide variety of related security problems.