End-to-End Radio Fingerprinting with Neural Networks

With the advent of 5G and other wireless standards, an increasing number of devices will be connected to the internet to assist various vertical applications, such as autonomous driving, telemedicine, industrial applications, and drone communications. As the number of these low cost IoT devices increases, security from illicit eavesdroppers is a primary concern. To mitigate malicious eavesdroppers, this work looks into the problem of distinguishing RF devices from their transmission fingerprints, commonly known as as RF fingerprinting. Along with security improvements, new applications like device identification in heterogeneous networks, vehicle recognition by self-driving cars and network regulation could be improved by RF fingerprinting.

Every transmitting device has subtle inherent differences, even following the same transmission protocol, which are reflected in the transmitted signals. Through radio fingerprinting, a receiver tries to learn these differences by characterizing devices by distinguishable features like its power amplifier non-linearities. This process is further complicated by the dynamic nature of wireless channels, which affects both the power and the phase of the incoming signals. In this work, we train a neural network classifier to identify devices by directly learning the differences from the IQ samples of extremely precise X310 USRP software-defined radios (SDRs).

Besides RF fingerprinting, some other aspects of wireless communication where machine learning is applicable are channel estimation and symbol detection [5], frequency estimation [3], spectrum sensing (cognitive radio) [9], resource allocation using multi-armed bandit [11], energy modelling [2], and end-to-end communication systems [6].

Given a set of signals from bit-similar, identical devices, our goal is to accurately predict both the distance of each device from the receiver and to identify which specific device the signal came from, by capturing the unique hardware irregularities of each device. This paper presents 3 models, each building on the previous, that lead to an end-to-end multiple classifier system that accurately discriminates between channels and classifies devices using normalized in-phase and quadrature samples from the dataset presented in [4]. These 3 models are a device-classifier, a distance-classifier, and an ensemble-classifier that combines the first two into an end to end network. We found that our ResNet based architecture is able to reach over $88.33\%$ accuracy in classifying devices over 11 different channels and two different runs, on a task that was previously not successfully learnable.

We use the 16 device test bed dataset from [4]. To collect this dataset, 16 different bit-similar X310 USRP SDRs are placed at a specific distance of {2, 8, 14, 20, 26, 32, 38, 44, 50, 56, 62} feet from an X210 USRP SDR which serves as the receiver. The transmitting device then transmits OFDM modulated random data at 5 MS/s with a carrier frequency of 2.45 GHz. The raw IQ samples are then recorded prior to channel estimation or synchronization. In this setup, each of the 16 devices are run twice at each distance for about 0.4 seconds, reaching over $7\times 10^{9}$ total samples, where each sample is a complex value, $Z[n]\in\mathbb{C}$.

In [4], the authors chose a sliding window approach to partition the training samples into overlapping windows of length 128. The step size between each window is never specified, however, one graphic suggests they chose a step size of 1, which would enhance the shift in-variance but cause windows to be highly correlated with each other. Alternatively, we divide each I/Q sequence into non-overlapping windows of length 256 to reduce correlation between windows.

We used normalization on each window before training. This served two purposes. First, normalized data generally leads to faster convergence during training. Second, it requires our distance-classifiers to predict distance irrespective of the power of the received data. This second point is particularly compelling, because we force our models to learn differences within the changing phase rather than simply the amplitude of the data. This means that there are complex, non-amplitude changes in the channel that the model can detect and associate with a change in distance, even without knowledge of the symbols being transmitted. In practice, there may be no prior knowledge or consistency to the power that a device decides to transmit at, meaning that the receive power may not be a robust indicator of distance. In Fig. 1, we visualized sets from 3 distances before and after normalization. Before normalization, the amplitude decreases drastically with distance. As such, classifying these sets by distance is trivial for a neural network. After normalization, there is no perceivable amplitude difference between sets. This makes classification by distance much more interesting.

We begin by defining the set of transmission distances as $D$, and the set of transmitting machines as $M$. Then we propose three models, the first is a function which takes a sequence of IQ samples, $\{\operatorname{\boldsymbol{x}}_{j}[i]\}_{0}^{N-1}$ and predicts which machine; $\operatorname{\hat{m}}_{j}$, transmitted the signal assuming the device was at a distance $d=j$. In this setup, the model assumes the machines are all transmitting from the same distance. Then, the goal is to approximate the function $\phi_{j}(\cdot)$ such that

We train separate models for each distance with this learning model in mind, because the differences in channel make the device identification task unlearnable when the channel is inconsistent.

The second model predicts the distance between the transceivers. In this setup, the sequence is the same, but the data is drawn from a set where all of the devices at a specific distance have the same label and normalized samples, but the labels now correspond to the distance that the transmitter was transmitting from. This way, the model learns to recognize channels based on latent channel features such as scattering, fading, and frequency selectivity. The task is made more difficult by the use of random data transmission, reducing the structure and information of the problem such that direct channel state information is unrecoverable. We identify each distance as a separate label and produce an estimate of the distance as

This model allows us to detect the distance, and is an orthogonal goal to (1).

In the final model, we consider the end-to-end system, where we first identify the distance, then classify the device given the selected distance. This is a fundamental problem, as the task of identifying bit-similar devices from random IQ data without CSI has, to the best of our knowledge, never been done successfully. We show that the task of end-to-end learning is possible by combining (1) and (2) to produce a jointly learnable end to end model of the form

Given the learning model, we now review our contributions which lead to classifiers for (1)-(3).

Given a set of IQ samples, $\{\operatorname{\boldsymbol{x}}_{d}[i]\}_{0}^{N-1}$, from identical wireless devices our goal is to accurately predict both the distance of the transmitter and the identity of that specific device. We do this by modeling the unique hardware irregularities of each device. Several deep learning architectures were developed and tested to achieve this task. We first recreated the simple architecture from [4] but with different window sizes and a more diverse dataset. We then explored the application of a ResNet architecture [7] to predict distance and device. Finally we settled on an ensemble of residual networks to first predict the transmission distance then the unique device ID. Each model is trained with various splits of the training data to achieve the network that best generalizes.

We show the results from our models trained on the three tasks from (1) - (3). We first evaluate our model and compare with the model from [4], named "ORACLE", for each distance with normalization. The accuracy for each distance is higher than ORACLE as shown in Fig. 3. These results show that we are able to improve on the original network by training deeper network by preventing vanishing gradients through the residual connections and batch normalization.

For the learning problem from (2), there is no comparable network, as [4] only concluded that the difference in channels made the results inconsistent, likely suggesting that they could not actually learn to identify the devices if the channel was not identical in training and testing. Our distance network was able to reach greater than $98\%$ accuracy for distance prediction on unseen data from all of the devices, suggesting that the channel is learnable from random data, even after normalization.

Using the results from the two models, we test our ensemble network first without any fine-tuning, which resulted in accuracy of more than $95\%$ on data from the same run, but less than $25\%$ accuracy on data from the untrained second run data. We then fine-tune the network using data from each machine, distance, and run, leading to an overall accuracy above $88.33\%$ and the corresponding classification precision map is shown in Fig. 4.

We can see that receiver saturation is likely a problem, since transmitters very close to the receiver perform poorly. Interestingly, device 10 had generally good performance throughout the test, with an average precision of $94.73\%$. This device may have actually been performing outside of specifications, making it distinctly different from the others. We also note that our network performs best at 44ft, with an average precision of $97.19\%$.

Due to the poor classification accuracy of our ensemble network on second run data prior to fine tuning, it is likely that the features or channel representations learned are time-variant, even though the runs are collected only a few minutes apart. Despite the large size of this dataset, we are limited in that only two runs of data were collected. A more robust system may be learnable if the dataset included several more runs, encompassing the features that change as a result of time. This may, however, be an unlearnable task when allowing for a continuous channel instead of discrete channel identification. We leave this investigation to future work.

We have presented an end to end neural network which is able to accurately differentiate channels and classify devices from normalized in-phase and quadrature samples. We found that our ResNet based architecture is able to reach over $88.33\%$ accuracy in classifying devices over 11 training channels and two separate time windows, on a task that was previously unsuccessful. Furthermore, we have demonstrated the need for pre-training in our networks which are identifying subtle, latent features from massive data domains.

Our study focused only on classification in discrete distances, which is a coarse approximation of true wireless channels. In future work, we will consider how the network can handle continuous, time-varying channels. Additionally, we envision restructuring this problem into a semi-supervised problem where new devices could be added or removed from the network based on clustering techniques.