Cross-range resolution in spotlight synthetic aperture radar (SAR) is primarily a function of the angular extent (DeltaPhi) over which data is collected. One proposed means for improving cross-range resolution for a given DeltaPhi is the use of frequency diverse array (FDA) techniques. The goal is to exploit an apparent increase in DeltaPhi to improve cross-range resolution while retaining benefits of shorter synthetic apertures and integration times.

Radio Frequency Fingerprinting (RFF) is often proposed as an authentication mechanism for wireless device security, but application of existing techniques in multi-channel scenarios is limited because prior models were created and evaluated using bursts from a single frequency channel without considering the effects of multi-channel operation. Our research evaluated the multi-channel performance of four single-channel models with increasing complexity, to include a simple discriminant analysis model and three neural networks. Performance characterization using the multi-class Matthews Correlation Coefficient (MCC) revealed that using frequency channels other than those used to train the models can lead to a deterioration in performance from MCC > 0.9 (excellent) down to MCC < 0.05 (random guess), indicating that single-channel models may not maintain performance across all channels used by the transmitter in realistic operation. We proposed a training data selection technique to create multi-channel models which outperform single-channel models, improving the cross-channel average MCC from 0.657 to 0.957 and achieving frequency channel-agnostic performance. When evaluated in the presence of noise, multi-channel discriminant analysis models showed reduced performance, but multi-channel neural networks maintained or surpassed single-channel neural network model performance, indicating additional robustness of multi-channel neural networks in the presence of noise.

Cross‐layer forensic investigation is addressed for Industrial Internet of Things (IIoT) device attacks in Critical Infrastructure (CI) applications. The operational motivation for cross‐layer investigation is provided by the desire to directly correlate bit‐level network anomaly detection with physical layer (PHY) device connectivity and/or status (normal, defective, attacked, etc.) at the time of attack. The technical motivation for developing cross‐layer techniques is motivated by (a) having considerable capability in place for Higher‐Layer Digital Forensic Information exploitation—real‐time network cyberattack and postattack analysis, (b) having considerably less capability in place for Lowest‐Layer PHY Forensic Information exploitation—the PHY domain remains largely under exploited, and (c) considering cyber‐physical integration as a means to jointly exploit higher‐layer digital and lowest‐layer PHY forensic information to maximize investigative benefit in IIoT cyber forensics. A delineation of higher‐layer digital and lowest‐layer PHY elements is provided for the standard network Open Systems Interconnection model and the specific Perdue Enterprise Reference Architecture commonly used in IIoT Industrial Control System/Supervisory Control and Data Acquisition applications. A forensics work summary is provided for each delineated area based on selected representative publications and provides the basis for presenting the envisioned cross‐layer forensic investigation.This article is categorized under: Digital and Multimedia Science > Cyber Threat Intelligence Digital and Multimedia Science > IoT Forensics

Radio Frequency Fingerprinting (RFF) is the attribution of uniquely identifiable signal distortions to emitters via Machine Learning (ML) classifiers. RFF approaches relying on pre-determined expert features lack generalizability, and state-of-the-art approaches based on Convolutional Neural Networks (CNNs) can be too demanding for endpoint devices to train. This work presents Fingerprint Extraction through Distortion Reconstruction (FEDR), a best-of-both-worlds technique which employs a pre-trained CNN to identify and extract a small, salient set of unique features, amenable for use in lightweight machine learning models. Given a received distorted signal, the FEDR network encodes signal distortions into “fingerprints,” which can be used by lightweight ML classifiers to perform RFF with minimal resource consumption at the endpoint. FEDR learns by transforming generated signals into reconstructions of received signals, relying solely on the fingerprints as representations of the distortions – as the reconstructions improve, the fingerprints better encode the distortions. The FEDR technique was evaluated on synthetic IQ-imbalanced IEEE 802.11a/g data, where FEDR fingerprints were shown to encode actual IQ imbalance parameters, signifying successful isolation of distortion information and validating the FEDR technique. FEDR was further evaluated on a representative real-world WiFi dataset, where extracted fingerprints were coupled with a lightweight two-layer dense network. When compared against two common RFF techniques, the FEDR-based approach achieved state-of-the-art performance with Matthews Correlation Coefficient ranging from 0.984 (5 classes) to 0.851 (100 classes), using nearly 73% fewer training parameters than the next-best technique.

The need for improved Critical Infrastructure and Key Resource (CIKR) security is unquestioned and there has been minimal emphasis on Level-0 (PHY Process) improvements. Wired Signal Distinct Native Attribute (WS-DNA) Finger-printing is investigated here as a non-intrusive PHY-based security augmentation to support an envisioned layered security strategy. Results are based on experimental response collections from Highway Addressable Remote Transducer (HART) Differential Pressure Transmitter (DPT) devices from three manufacturers (Yokogawa, Honeywell, Endress+Hauser) in an automated process control system. Device discrimination is assessed using Time Domain (TD) and Slope-Based FSK (SB-FSK) fingerprints input to Multiple Discriminant Analysis, Maximum Likelihood (MDA/ML) and Random Forest (RndF) classifiers. For 12 different classes (two devices per manufacturer at two distinct set points), both classifiers performed reliably and achieved an arbitrary performance benchmark of average cross-class percent correct of %C > 90%. The least challenging cross-manufacturer results included near-perfect %C ≈ 100%, while the more challenging like-model (serial number) discrimination results included 90%< %C < 100%, with TD Fingerprinting marginally outperforming SB-FSK Fingerprinting; SB-FSK benefits from having less stringent response alignment and registration requirements. The RndF classifier was most beneficial and enabled reliable selection of dimensionally reduced fingerprint subsets that minimize data storage and computational requirements. The RndF selected feature sets contained 15% of the full-dimensional feature sets and only suffered a worst case %CΔ = 3% to %CΔ = 4% performance degradation.