Wireless infrastructure protection using low-cost radio frequency fingerprinting receivers

Radio frequency (RF) fingerprint representing the inherent hardware characteristics of mobile devices has been employed to classify and identify wireless devices for the security of Internet of Things (IoT). Existing works on RF fingerprinting are usually based on the amplitude or phase of RF signal envelope, which leads to relatively coarse features. Moreover, the classification performance over small sample dataset is poor. To solve the problem, a novel device identification method based on RF fingerprinting with on deep learning is proposed. In particular, the RF signal are transformed into two dimensional representations by image preprocessing. Then the gray images representing the RF fingerprints are classified by employing classical CNN. To verify the performance of the proposed approach, a testbed is constructed by using MATLAB build framework of gray image preprocessing. Extensive experiment results show that the identification accuracy can reach at least 90%. Even with the sample rate of 20Gsps. Particularly, the accuracy of iPhone can reach 100%. It is verified that the proposed method can effectively classify mobile devices even with small sample RF fingerprints represented two dimensional gray images,

Recently, network security has become a major challenge in communication networks. Most wireless networks are exposed to some penetrative attacks such as signal interception, spoofing, and stray. Radio frequency (RF) fingerprinting is considered to be a promising solution for network security problems and has been applied with various improvements. In this paper, extensive data from Bluetooth (BT) devices are utilized in RF fingerprinting implementation. Hilbert-Huang transform (HHT) has been used, for the first time, for RF fingerprinting of Bluetooth (BT) device identification. In this way, time-frequency-energy distributions (TFED) are utilized. By means of the signals' energy envelopes, the transient signals are detected with some improvements. Thirteen features are extracted from the signals' transients along with their TFEDs. The extracted features are pre-processed to evaluate their usability. The implementation of three different classifiers to the extracted features is provided for the first time in this paper. A comparative analysis based on the receiver operating characteristics (ROC) curves, the associated areas under curves (AUC), and confusion matrix are obtained to visualize the performance of the applied classifiers. In doing this, different levels of signal to noise ratio (SNR) levels are used to evaluate the robustness of the extracted features and the classifier performances. The classification performance demonstrates the feasibility of the method. The results of this paper may help readers assess the usability of RF fingerprinting for BT signals at the physical layer security of wireless networks.

In recent years, radio frequency (RF) fingerprinting has attracted more and more attention. Many different types of RF fingerprints have been proposed, such as carrier frequency offset (CFO), sampling frequency offset and error vector magnitude. Among them, the CFO fingerprint is recognized as a promising RF fingerprint. However, for commonly used smartphones, we find that its CFO fingerprint is unstable, because the temperature of crystal oscillator varies greatly and large fluctuations of temperature significantly affect its CFO fingerprint. Therefore, the solutions of CFO-based fingerprinting will no longer be effective for smartphones if the temperature of crystal oscillator is not involved. To this end, we propose a more reliable and applicable CFO-based fingerprinting approach called temperature-aware radio frequency fingerprinting (TeRFF). First, we construct a dataset by extracting crystal oscillator's temperature and the corresponding CFO value on multiple smartphones over a period. In the dataset, the extracted temperature values constitute a set of temperature values, and each registered temperature value corresponds to a group of CFO samples. On this basis, we train multiple Naive Bayes models, each tagged with a registered temperature value. Moreover, since there are many temperature values which are not in the temperature set, we design a CFO estimation method to estimate the CFO fingerprint at the unregistered temperature. Finally, the experimental results demonstrate that our proposed solution TeRFF makes the CFO fingerprinting still effective for smartphone identification, and its performance is better than other existing RF fingerprinting schemes.

Aiming at the actual application scenario of radio frequency (RF) fingerprint identification, a low-cost, small-volume embedded system for specific identification of RF devices is designed and implemented, and the improved VGG-16 model is used to extract the RF fingerprint features of RF signals. The hardware of the system consists of two parts: the RF Signal Acquisition Module and the RF Fingerprint Identification Module. The RF Signal Acquisition Module uses Zedboard as the main control board, and the AD9361 chip is the RF signal receiving circuit; the RF Fingerprint Identification Module uses FPGA to accelerate the deep learning algorithm, and displays the identification results on the host computer. Using 6 wireless routers of the same model for testing, the system has an identification accuracy rate of 96% for wireless routers in the actual electromagnetic environment, and the real-time identification feedback time is about 6 seconds, which has a certain practical application value.

In mobile communications networks, if we can estimate the location of each user equipment (UE) with high accuracy, efficient cell planning and network optimization become possible. However, it is difficult for operators to estimate the location of most commercial UEs because they cannot feedback their location information directly to their serving base stations with the exception of UEs with Minimization of Drive Test (MDT) functions specified in LTE Release 10. Radio Frequency (RF) fingerprint method is known as an effective localization method, with which we can estimate the location of UEs with only RF signature and location information beforehand. In LTE, RF fingerprint database can be collected by conducting drive tests or using measurement data from UEs compatible with MDT. Although the estimation accuracy can be better with more RF signatures, the increase in the amount of RF signatures causes the increase in the feedback, which consumes the uplink capacity and UE battery. Furthermore, keeping all RF signatures in database is inefficient because some RF signatures do not have effect on improving estimation accuracy. Hence, it is important to clarify the effect of each RF signature and use only effective ones in the localization. In this paper, we conducted a field experiment to create an RF fingerprint database in dense urban area, and evaluated the effectiveness of each RF signature by making several localization models based on machine learning. Eventually, we clarified minimum RF signatures required to operate RF fingerprint localization in LTE network.

Radio transmitters can be identified by their unique radio frequency (RF) fingerprints, which are imparted by their distinct hardware differences and manufacturing variations. However, traditional classification approaches require all classes to be known during training - a constraint that may not hold in many real-world scenarios, with new RF devices appearing during data collection. In this paper, we present an approach for novel device detection in RF data that concurrently performs RF fingerprinting and novel device detection. We introduce a combined clustering loss that explicitly encourages a clustered representation on a lower dimensional manifold, and demonstrate when and where it is most helpful. Finally, we show how to improve performance by including additional devices during the training procedure in a semi-supervised setting.

Radio frequency (RF) fingerprinting is widely used for supporting physical-layer security in various wireless applications. While existing passive RF tags often require complex structures or suffer from negative gain in miniaturized designs, this paper presents a single-layer planar meander line antenna that uniquely achieves both miniaturization and positive realized gain, enabling direct integration with nonlinear passive devices for cost-effective RF fingerprinting. We first propose a miniaturized meander line dipole, achieved by two folded arms on two sides of the substrate. This leads to an antenna with a simple feeding structure and compact size, making it ideal for planar integration. Two antennas on Rogers 4350B and ultra-thin flexible Panasonic Felios were fabricated, achieving small size at 0.21×0.06×0.004λ<sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</sub><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">3</sup> and 0.14×0.1×0.0008λ<sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</sub><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">3</sup> with realized gain of 1.87 dBi and 1.46 dBi, respectively. The passive tag consists of the proposed antenna structure and an integrated RF Schottky diode, and is further developed on both substrates, aiming to generate inter-modulation products (IMP) due to the nonlinearity of the diode, which can be used for device identification through classification algorithms. We investigate the nonlinearity of the designed tags for transmission at 15 dBm using two-tone signals. All tags produce a significant increased power at IMP frequencies at a range of 0.4 m. The tags on Rogers substrate provide around 23 dB IMP power increase and tags on flexible substrate embedded in lossy material provide around 16 dB power increase. These findings confirm that the proposed solution offers a simple passive tag design to support unique nonlinear signatures for RF fingerprinting applications in a simple, low-cost device.

With the development of the Internet of Things, more and more devices need to be connected to the network. Wireless networks are open, and the network security of devices faces major challenges. The problem of device identification is particularly important. Some traditional signal source marking methods have greatly reduced reliability. The traditional authentication methods mainly rely on software addresses. The radio frequency(RF) fingerprint technology is an emerging device authentication technology, which identifies the device based on the inherent hardware defects of the device itself. The RF fingerprints reflect the inherent characteristics of the device and are difficult to tamper with. In this paper, we proposed an environment invariant feature extraction algorithm based on the cumulative distance. The experiments show that the algorithm proposed in this paper has good robustness. Within the allowable error range, the extracted RF fingerprint features of the same signal in different frequencies, different receivers, and different environments are invariant.KeywordsMarking methodsRF fingerprintI/Q data

The security of ultra‐low‐power Internet of Things (IoT) systems is critical yet challenging due to significant energy constraints. These networks are vulnerable to impersonation and data poisoning attacks, where malicious entities can mimic legitimate devices to gain access or corrupt system integrity. While traditional cryptographic solutions are often too energy‐intensive for these environments, radio frequency (RF) fingerprinting offers a promising physical layer security alternative by using intrinsic hardware imperfections to uniquely identify devices. However, existing RF fingerprinting methods often overlook the severe energy budgets of battery‐powered IoT devices. To address this challenge, this paper introduces two complementary deep learning models for device identification in long range wide area network systems. The first, RFNet, is a full‐capacity convolutional neural network that achieves 97.48% identification accuracy. The second, TinyRFNet, is an ultra‐lightweight model designed for resource‐constrained hardware, maintaining 93.19% accuracy with over 34 times fewer parameters than RFNet. We further propose a dynamic, energy‐aware inference strategy that adaptively selects between these two models based on the device's remaining battery level, the model's prediction confidence, and the operational context. Extensive experimental evaluation on a dataset of 30 commercial LoRa devices demonstrates that this adaptive approach achieves an overall identification accuracy of 94.54% while reducing energy consumption by 17% compared to exclusively using the high‐accuracy model. This system provides robust protection against physical‐layer threats with minimal energy overhead, thereby extending the operational lifetime of devices in secure, ultra‐low‐power IoT deployments.

Radio frequency (RF) fingerprinting technology has been developed as a unique method for maintaining security based on physical layer characteristics. In this paper, we propose the RF fingerprinting by extracting the parameter characteristics such as information dimension, constellation feature, and phase noise spectrum in the transmitted information when applied to the universal software radio peripheral (USRP) software-defined radio (SDR) platform. To achieve a great performance improvement of classification, not only the traditional support vector machine (SVM) classifier, but also the machine-based integrated classifier bagged tree and the adaptive weighting algorithm weighted k-nearest neighbor (KNN) are both discussed. It is demonstrated that the proposed method achieves good classification performance under different signal-to-noise ratios (SNR).

Cyber-physical systems have recently been used in several areas (such as connected and autonomous vehicles) due to their high maneuverability. On the other hand, they are susceptible to cyber-attacks. Radio frequency (RF) fingerprinting emerges as a promising approach. This work aims to analyze the impact of decoupling tapped delay line and clustered delay line (TDL+CDL) augmentation-driven deep learning (DL) on transmitter-specific fingerprints to discriminate malicious users from legitimate ones. This work also considers 5G-only-CDL, WiFi-only-TDL augmentation approaches. RF fingerprinting models are sensitive to changing channels and environmental conditions. For this reason, they should be considered during the deployment of a DL model. Data acquisition can be another option. Nonetheless, gathering samples under various conditions for a train set formation may be quite hard. Consequently, data acquisition may not be feasible. This work uses a dataset that includes 5G, 4G, and WiFi samples, and it empowers a CDL+TDL based augmentation technique in order to boost the learning performance of the DL model. Numerical results show that CDL+TDL, 5G-only-CDL, and WiFi-only-TDL augmentation approaches achieve 87.59%, 81.63%, 79.21% accuracy on unobserved data while TDL/CDL augmentation technique and no augmentation approach result in 77.81% and 74.84% accuracy on unobserved data, respectively.

A frequency-domain cepstrum correlation and temporal transient filtered radio frequency fingerprints (RFF) blind extraction method is proposed for long term evolution uplink device authentication in this work. With the merits of the constant-modulus nature of the Zadoff-Chu (ZC) sequence and the cyclic prefix (CP) structure of the physical random access channel (PRACH) frame, the device RFF integrated in both the frequency-domain ZC sequence and the transient ramp-on/ramp-off sequences are extracted. For the frequency-domain RFF extraction, the cepstrum of the ZC sequence is calculated to enlarge the gap between the constant RFF and the random fading effects, and the correlation between two cepstrum fragments is then calculated to mitigate the random fading components. For the temporal RFF extraction, the ramp-on and ramp-off features induced by the device-specific power amplifier are extracted by exploiting the CP structure of the PRACH frame, where the CP part and the duplicate part are adaptively filtered and the final adapted weight of the least mean square filter is used as RFF. No prior PRACH parameter knowledge is required in RFF extraction and both the frequency-domain and the temporal RFF are combined as the input of the convolutional neural network to enhance the classification accuracy. With four-months sampling of PRACH signals emitted from universal software radio peripheral devices, the experimental results show that the authentication accuracy of the proposed combined RFF can reach as high as 99.9% in the line-of-sight (LOS) scenario and 99.6% in the non-LOS scenario.

Linear frequency modulation(LFM) signals are widely used in radar technology. Accurate identification of LFM signal sources is of great significance. Radio frequency fingerprinting(RFF) is a non-cryptographic authentication method based on hardware physical differences, which is unique and therefore widely used for signal source identification. However, in practical applications, the RFF of radar signal sources generates heat after prolonged operation. This causes a certain degree of drift in the RFF within and between pulses, thereby affecting recognition accuracy. To address this issue, this paper proposes an LFM radar signal source identification method with RFF Drift Robustness(RDR). RDR first uses a frame-based coherent accumulation method to separately calculate the RFF of the front and rear halves of the pulse, then introduces a Class Principal Component Analysis layer(PCALayer) to mitigate the impact of RFF drift within the pulse. Subsequently, an Long Short-Term Memory(LSTM) Network is used to capture the temporal dependency of RFF between pulses, thereby enhancing the model's robustness to RFF drift between pulses. Experimental results demonstrate that the proposed method exhibits excellent robustness to RFF drift in real-world scenarios.

Radio frequency fingerprint recognition method based on prior information

This paper presents a performance evaluation of the Radio Frequency (RF) fingerprinting framework for positioning using Minimization of Drive Testing (MDT) measurements specified in LTE (Long Term Evolution) Release 10. Methods based on Mahalanobis distance and Kullback-Leibler divergence are used for estimating the geographical locations. Performance evaluation of the framework is verified with system simulator by generating MDT measurement data in intra- and inter-frequency LTE network deployments with rural and urban configurations. The focus of the research is to understand how RF fingerprint positioning accuracy changes when taking into account the prospects and constraints of the RF fingerprints constructed from the MDT measurement data. The results of the study indicate that the performances of Mahalanobis distance and Kullback-Leibler divergence based methods are quite similar in rural deployments. However, in denser network deployments, Kullback-Leibler divergence based method tends to be much better for both intra- and inter-frequency environments, resulting in better than 21 meters and 38 meters positioning accuracies for 68 percent of MDT samples in studied urban scenarios, being well below the E911 emergency positioning requirements.