Robust Wireless Fingerprinting via Complex-Valued Neural Networks

TL;DR

This paper proposes using complex-valued neural networks to learn robust wireless device fingerprints from signals, improving security by resisting spoofing and noise, demonstrated on WiFi and ADS-B protocols.

Contribution

It introduces complex-valued neural networks for wireless fingerprinting and shows noise augmentation enhances robustness against spoofing attacks.

Findings

Complex-valued neural networks effectively learn device fingerprints.

Noise augmentation improves robustness against spoofing.

Using signal parts beyond the preamble can lead to cheating by the network.

Abstract

A "wireless fingerprint" which exploits hardware imperfections unique to each device is a potentially powerful tool for wireless security. Such a fingerprint should be able to distinguish between devices sending the same message, and should be robust against standard spoofing techniques. Since the information in wireless signals resides in complex baseband, in this paper, we explore the use of neural networks with complex-valued weights to learn fingerprints using supervised learning. We demonstrate that, while there are potential benefits to using sections of the signal beyond just the preamble to learn fingerprints, the network cheats when it can, using information such as transmitter ID (which can be easily spoofed) to artificially inflate performance. We also show that noise augmentation by inserting additional white Gaussian noise can lead to significant performance gains, which indicates that this counter-intuitive strategy helps in learning more robust fingerprints. We provide results for two different wireless protocols, WiFi and ADS-B, demonstrating the effectiveness of the proposed method.

Tables

Table 1. TABLE I : Performance comparison between networks with complex and real weights (when using only the preamble).

Dataset	Network type	Accuracy	No. of real parameters
ADS-B	Complex	81.66	128,400
	Real	73.84	78,400
	Real (1.4x)	73.25	133,680
	Real (2x)	75.00	246,600
WiFi	Complex	99.53	216,219
	Real	97.32	116,219
	Real (1.4x)	97.53	217,899
	Real (2x)	97.89	430,419

Table 2. TABLE II : Accuracy as a function of SNR for ADS-B (100 devices), using only the preamble. Here low SNR corresponds to < < 2 dB, medium SNR to 2-5 dB and high SNR to > > 5 dB.

Test SNR	Train SNR	Test accuracy	Train accuracy
Low	High	32.29	90.50
	Medium	51.26	84.83
Medium	High	68.85	90.80
	Low	71.13	80.51
High	Medium	81.66	83.71
	Low	73.48	80.53

Table 3. TABLE III : Effect of noise augmentation on ADS-B and outdoor WiFi fingerprinting. The ADS-B dataset corresponds to the first row of Table II (with low test SNR, high train SNR). Noise injection improves ADS-B performance from 32.29% (which corresponds to train SNR aug aug {}_{\text{aug}} = test SNR aug aug {}_{\text{aug}} = ∞ \infty , i.e. no noise insertion) to 52.12% when train SNR aug aug {}_{\text{aug}} = 10 dB and test SNR aug aug {}_{\text{aug}} = 50 dB. Outdoor Wifi accuracy improves from 61.73% to 69.37% .

	20 dB	50 dB	100 dB	$\infty$
10 dB	48.39	52.12	51.89	43.28
15 dB	52.12	50.75	51.98	40.63
20 dB	35.25	47.63	45.44	15.29
25 dB	36.38	45.74	45.29	11.82
$\infty$	25.67	33.55	34.77	32.29

Table 4. (a) ADS-B (100 devices)

	20 dB	50 dB	100 dB	$\infty$
10 dB	48.39	52.12	51.89	43.28
15 dB	52.12	50.75	51.98	40.63
20 dB	35.25	47.63	45.44	15.29
25 dB	36.38	45.74	45.29	11.82
$\infty$	25.67	33.55	34.77	32.29

Table 5. (b) WiFi (100 devices, outdoor environment)

	20 dB	50 dB	100 dB	$\infty$
10 dB	61.65	62.21	61.90	3.04
15 dB	63.37	62.92	61.00	2.97
20 dB	69.37	69.06	67.83	2.09
25 dB	68.53	69.02	68.17	2.87
$\infty$	29.90	31.45	30.93	61.73

Equations

$$\operatorname{ModReLU}(z)=\max\mathopen{}\mathclose{{}\left(|z|-b,0}\right)\,\,e^{j\phase{z}}.$$

$$\operatorname{CReLU}(z)=\max\mathopen{}\mathclose{{}\left(\operatorname{Re}(z),0}\right)+j\max\mathopen{}\mathclose{{}\left(\operatorname{Im}(z),0}\right).$$

Full text

I Introduction

With the proliferation of wireless devices in everyday life, assuring the security of such devices becomes a critical concern. We focus here on a potentially powerful tool for this purpose: wireless fingerprints based on hardware imperfections unique to each device. Prior work shows that it is possible to extract such fingerprints, but it is often based on handcrafted features extracted with knowledge of the underlying protocol [1, 2]. In this paper, we investigate the use of a protocol-agnostic approach, employing supervised learning of fingerprints via a neural network.

Our goal is to extract a fingerprint that enables us to distinguish between two devices sending exactly the same message, using as input the complex baseband signal at the receiver. Since the input is complex-valued and one-dimensional (1D), we employ a 1D convolutional neural network (CNN) with complex-valued weights. When compared to prior approaches [3, 4] that use real-valued networks (with real and imaginary parts of input data treated as independent channels), these networks have a smaller degree of freedom available at the synaptic level. It has been observed that this confers generalization benefits [5].

While we would like to develop wireless fingerprinting techniques that are protocol-agnostic, we must remain vigilant against locking onto easily spoofed features. A naive protocol-agnostic scheme would not distinguish between any segments of the message from which the fingerprint is being extracted. However, for any communication protocol, the message contains transmitter ID information, e.g.  the MAC address in WiFi packets, the ICAO aircraft address in ADS-B (Automatic Dependent Surveillance-Broadcast) air traffic control signals, etc. Such ID information can be spoofed, hence any fingerprinting technique that uses the entire message must prove that it does not “cheat” by focusing just on the ID. We demonstrate that a completely protocol-agnostic CNN is vulnerable to such involuntary cheating, and then show that using the preamble, which is common to all packets from all transmitters, suffices to obtain reasonable accuracies, despite the relatively short length of the preamble compared to the length of the entire message. We then explore the impact of noise on training, and propose a noise augmentation strategy for enhancing performance.

Contributions

We propose a protocol-agnostic fingerprinting technique using complex-valued CNNs and demonstrate its robustness to various real-world imperfections. Our main contributions are as follows:

• •

We demonstrate that supervised learning using complex-valued CNNs works well for two different wireless protocols, WiFi and ADS-B, and compare the performance of different complex activation functions and architectures.

• •

When making use of portions of the signal beyond just the preamble, we show that networks will “cheat” whenever given the chance, resulting in artificially high accuracies (that are independent of the noise level) by focusing on the transmitter ID information present in these sections.

• •

We then focus on learning fingerprints from the preamble. Restricting to the preamble is not strictly protocol-agnostic, but, in principle, the location and extent of the preamble can be identified in unsupervised fashion for any given protocol by correlating packets across different transmitters. We study the robustness of our approach to noise in the data, and find that performance is better when the training set has lower SNR than the test set.

• •

We show that noise augmentation, or insertion of additional white Gaussian noise (AWGN), can significantly improve performance, presumably because it aids in learning more robust fingerprints. In particular, it is important to add noise to test data as well as the training data (with more noise added to training data) to yield benefits.

II Related Work

Wireless device fingerprinting can be accomplished using either the transient (microsecond-length) signals transmitted during the on/off operation of wireless devices, or via the steady-state packet information present in between the start and end transients. We focus here on work that employs the steady-state method since it is of more practical utility [6]. Work in this area can be broadly divided into two categories: traditional approaches that use handcrafted features as device characteristics, and techniques that employ machine learning to obtain fingerprints.

II-A Traditional approaches

Remote physical device fingerprinting using small, microscopic deviations in device hardware called clock skews was introduced in [7]. The clock skew of a single device was observed to be fairly consistent over time, but clock skews varied significantly across devices, enabling fingerprinting. For wired devices in wide area networks, [7] estimated clock skews using TCP/IP packet headers. This technique was extended by [8] to wireless local area networks where more accurate measurements are possible from the Time Synchronization Function timestamps in IEEE 802.11 frames. However, these two detection methods were defeated by [9] which devised attacks to spoof the clock skew of a fake device to mimic that of a real one. Using more parameters such as jitter and fitting errors to measure the authenticity of the skew can mitigate these spoofing attempts. More recently, [2] proposed using the carrier frequency offset (CFO) as a long-term device fingerprint, with the offset estimated using channel state information (CSI) measurements. While application layer spoofing of CFO is difficult [2], using the CFO as a mechanism for physical security has two key drawbacks: first, it does not provide a stable signature, since the oscillator frequency drifts over time; second, an adversary manipulating baseband signals can easily alter the CFO.

II-B Machine learning based approaches

The first use of discriminatory classifiers for fingerprinting was in [6], which used a $k$-nearest neighbor ($k$-NN) classifier after preprocessing WiFi data to extract the log-spectral-energy of the preamble. A different preprocessing step was proposed in [1], involving demodulation error metrics such as frequency offset and I/Q offset, followed by a support vector machine (SVM). For the ADS-B air traffic control protocol, [10] performed $k$-means clustering on features based on inter-arrival times of aircraft position, velocity and identification messages. A similar inter-arrival approach was shown in [11] to be effective for WiFi fingerprinting, with a real-valued neural network (NN) operating on the extracted features. In [12], the carrier phase offset of ADS-B signals was used as input to an NN to learn fingerprints. For IEEE 802.15.4 ZigBee devices, [13] proposed the use of a real-valued CNN operating on an error signal obtained by subtracting out the ideal estimated signal from received data. These techniques work well, but they rely on protocol-specific signal modeling and preprocessing prior to learning, in contrast to our approach.

A purely learning based approach was studied in [3, 14], albeit for modulation recognition and not device fingerprinting. Each packet was sliced into multiple training examples using sliding windows, with the real and imaginary parts of complex data treated as independent channels. These were then input to a real-valued CNN capable of recognizing different analog and digital modulation types. The use of a real-valued CNN for WiFi device fingerprinting was studied in [4], with sliding window preprocessing similar to prior work. As discussed in Section I, our proposed method of learning complex-valued representations has potential generalization benefits over real-valued approaches [5].

III Complex Valued CNN Architecture

III-A Overview

We use neural networks with complex-valued weights and biases to learn features from complex-valued wireless signals. Such complex-valued embeddings have found use in speech, music and vision tasks [16, 15]. Here we employ the framework of [15] which performs complex backpropagation by using partial derivatives of the cost with respect to the real and imaginary parts of each parameter. We make use of 1D complex convolutional layers with the following choices of activation functions (depicted in Fig. 2):

• •

ModReLU - This function preserves input phase and affects only the absolute value. Here $b$ is a learned bias.

[TABLE]

• •

CReLU - Unlike ModReLU this function does not preserve phase, with separate ReLUs applied on the real and imaginary parts of the input. The phase of the output is therefore limited to $[0,\pi/2]$.

[TABLE]

The loss in phase information can be potentially compensated by using filters with a larger number of channels that are capable of providing phase derotation.

Fig. 1 depicts a sample complex convolutional architecture for ADS-B signals. We use a series of complex 1D convolutions followed by an $|\cdot|^{2}$ layer to convert complex representations to real ones, and then a series of real-valued layers after a temporal averaging layer to obtain the fingerprint.

III-B Performance

We provide results for an external database for two different wireless protocols: WiFi 802.11a (5.8 GHz) and 802.11g (2.4 GHz) commercial off-the-shelf emitters with a signal bandwidth of 20 MHz, and ADS-B (1.09 GHz) narrowband air traffic control signals. We start by using only the preamble for fingerprinting, with signals normalized to unit power. When sampled at 20 MHz, the length of the preamble is 320 I/Q samples for both protocol types.

We report accuracies for the following networks:

• •

ADS-B: 100$\,C\,$40$\times$20 – 100$\,C\,$5$\times$1 – $|\cdot|^{2}$ – Avg – 100$\,D$.

• •

WiFi: 100$\,C\,$20$\times$10 – 100$\,C\,$10$\times$1 – $|\cdot|^{2}$ – Avg – 100$\,D$.

The notation should be read as follows: $<$number of filters>$$\,C\,$$<convolution size>$$\times$$<stride$>$, and $<$number of neurons>$$\,D, where $C$ represents a convolutional layer and $D$ a fully connected layer, with complex-valued layers prior to the $|\cdot|^{2}$ layer and real-valued layers afterward. ‘Avg’ denotes a temporal averaging layer. We train networks for 200 epochs with a batch size of 100, using the Adam optimizer with default hyperparameters and $\ell_{2}$ regularization constant of 10${}^{\text{-3}}$.

We achieve 99.53% fingerprinting accuracy for 19 WiFi devices without channel distortion, using 200 samples per device for training and 100 for testing. For the ADS-B protocol, we obtain 81.66% accuracy with 100 devices (using 400 samples per device for training and testing). Fig. 3 compares the convergence of ModReLU and CReLU architectures. Both activation functions have similar convergence time, with ModReLU resulting in slightly higher accuracy for both the training and test sets.

Table I compares the performance of complex-valued and real-valued networks (for which real and imaginary parts of data are treated as different channels). If we fix the number of feature maps, a complex filter would contain twice as many parameters as an equivalent real filter. Therefore, we consider real networks where the number of channels is scaled by factors of 1, 1.4 and 2. We find that the complex network outperforms its real counterparts, with a gain in accuracy of 6.66% for ADS-B and 1.64% for WiFi.

Fig. 4 visualizes the first and second convolutional layer of the ADS-B architecture, showing the input signal that maximizes the activations of each filter. Since transmitter-characteristic nonlinear effects manifest themselves primarily in short-term transitions of amplitude and phase, the filters in the first layer can capture these effects by spanning a small multiple of the symbol interval (2 symbols). To compute these signals, we start from randomly generated noise and use 200 steps of gradient ascent to maximize the absolute value of each filter output, with the signal normalized to unit power at each step.

IV Robustness to ID

In this section, we investigate the potential benefits to using post-preamble portions of the signal and analyze the robustness of our network to the presence of device ID information in such portions. We would like the network to focus on nonlinear transmitter characteristics embedded in the packets rather than the device ID which can be easily spoofed. We expect these nonlinear features to be stable over time, as compared to the device ID which is localized in time. Here we focus on the ADS-B protocol and begin by describing its packet structure.

IV-A ADS-B Packet Structure

We consider two different types of ADS-B packets: Mode S and Mode S Extended, depicted in Fig. 5. For both packet types, the first 16 symbols consist of a preamble that is identical across devices, while symbols 17-40 contain the ICAO address which is unique to each device. The two modes have different packet lengths, with 64 symbols in Mode S and 120 symbols in Mode S Extended. For this reason, we prune Mode S Extended packets to 64 consecutive symbols, using an offset to determine the first selected symbol. We consider three different scenarios for the offset: an offset of zero, a randomly chosen offset and a fixed offset where we choose the last 64 symbols.

IV-B Performance

Performance for each scenario is shown in Fig. 6. We report on accuracies for 100 devices, using 400 samples per device for training and testing. We obtain a very high accuracy of 99.29% when we do not use any offset, but this reduces to 65.64% and 75.49% in the scenarios with offsets. The picture becomes clearer when we examine the performance for Mode S and Mode S Extended: the two packet types have identical accuracies in the scenario without offset, but in the other scenarios, Mode S dominates performance. Such a temporal dependence indicates that the network is not learning the true nonlinearities, but rather focusing on device IDs from the payload for Mode S. It is easy to obtain 99% accuracy by restricting attention to just the ICAO address (which can be easily spoofed), which is a clear indicator of “cheating”.

A natural approach to prevent such involuntary cheating might be to delete symbols 17-40 (which correspond to the ICAO address). However the presence of parity bits towards the end of the packet makes this approach insufficient. One can observe that a combination of parity and preamble sections can potentially reconstruct the ICAO address, and indeed in practice we obtain artificially high accuracies similar to the previous scenarios. In contrast, when we restrict attention to the preamble alone, performance decreases to 81.66%, which is still much better than pure chance. Another approach might be to set the kernel size of the first convolutional layer to 2 symbols, so as to prohibit the network from learning the ICAO address even if we allow access to the entire packet. This reduces accuracy to 97.28%, but it is still much higher than when we use only the preamble. At first glance it may seem like small filter sizes at the first layer are sufficient to prevent cheating, but one just needs to look at the second layer to see that its filters actually extend over 6 symbols.

These experiments show that allowing networks to access ID information is unwise: networks “cheat” whenever given the chance and ignore transmitter-characteristic nonlinearities in favor of localized device information. We can mitigate this by allowing access to only the preamble, in which case we obtain the nonlinear fingerprints we are looking for.

V Robustness to Noise

In this section, we investigate the impact of noise on classification accuracy. We first study the effect of real-world noise and then discuss noise augmentation strategies to enhance performance.

V-A Impact of naturally occurring noise

We study the effect of different levels of noise in the training and test sets, using ADS-B data with 100 devices in each scenario. When we cheat by using the ICAO address as described in the previous section, we obtain artificially high accuracies that are independent of the noise level, indicating that such a network can be easily spoofed even when the data is noisy.

When we use only the preamble, we observe a surprising trend (shown in Table II): performance improves when the training data is noisier than the test data. In contrast, when the training SNR is higher than the test SNR, we obtain high training accuracies but low test accuracies. While this result might seem initially counter-intuitive, it is a reasonable hypothesis that noise forces the network to learn features that are more robust to perturbations.

V-B Noise augmentation

We perform noise augmentation by inserting various levels of additional white Gaussian noise (AWGN) in the training and test sets, and report on accuracies as a function of injected noise levels in Table III. Here SNR${}_{\text{aug}}$ denotes the signal to artificially injected noise ratio, so that SNR${}_{\text{aug}}$ = $\infty$ corresponds to no noise injection. We consider two datasets: 100 ADS-B devices corresponding to the first row of Table II, with 400 signals per device for training and testing; and 100 WiFi devices in an outdoor environment, with 800 signals per device for training and 200 for testing.

Noise insertion yields significant performance benefits, with 19.83% improvement for ADS-B and 7.64% improvement for outdoor WiFi. We note, however, that it is important to add noise to both the training and test sets. Adding noise to only the training set can result in poor performance: for the WiFi data, at 20 dB train SNR${}_{\text{aug}}$, test accuracy drops to 2.09% (with 76.32% training accuracy).

VI Conclusions

In this paper, we have demonstrated the efficacy of complex-valued CNNs for wireless fingerprinting. This technique does not rely on signal domain knowledge and, as illustrated by our experiments with WiFi and ADS-B data, can be used across diverse wireless protocols. We show the vulnerability of the approach to “cheating” using transmitter ID when using the entire message to extract the fingerprint. When using the preamble alone, reasonably high accuracies are obtained, and performance is significantly enhanced by noise augmentation. Open issues worth investigating include (a) provably non-cheating, protocol-agnostic strategies that use the entire packet, (b) automatic extraction of the preamble given data corresponding to any protocol, (c) utilizing multiple packets for decisionmaking; and (d) developing detailed insight into the nature of the signatures extracted, and the impact of noise augmentation.

Acknowledgment

This work was funded in part by DARPA under the AFRL contract number FA8750-18-C-0149, and by ARO under grant W911NF-19-1-0053. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of DARPA or Air Force Research Laboratory or ARO or the U.S. Government. The authors gratefully acknowledge research discussions with collaborators at Teledyne Scientific, including Mark Peot, Laura Bradway, Karen Zachary and Michael Papazoglou.