The use of wireless sensor networks (WSNs) in critical applications such as environmental monitoring, smart agriculture, and industrial automation has created significant security concerns, particularly due to the broadcasting nature of wireless communication. The absence of physical-layer authentication mechanisms exposes these networks to threats like spoofing, compromising data authenticity. This paper introduces a multi-attribute physical layer authentication (PLA) scheme to enhance WSN security by using physical attributes such as received signal strength indicator (RSSI), battery level (BL), and altitude. The LoRaWAN join procedure, a key risk due to plain text transmission without encryption during initial communication, is addressed in this study. To evaluate the proposed approach, a partially synthesized dataset was developed. Real-world RSSI values were sourced from the LoRa at the Edge Dataset, while BL and altitude columns were added to simulate realistic sensor behavior in a forest fire detection scenario. Machine learning (ML) models, including Logistic Regression (LR), Random Forest (RF), and K-Nearest Neighbors (KNN), were compared with deep learning (DL) models, such as Multi-Layer Perceptron (MLP) and Convolutional Neural Networks (CNN). The results showed that RF achieved the highest accuracy among machine learning models, while MLP and CNN delivered competitive performance with higher resource demands.

LoRaWAN is widely used for IoT environmental monitoring, but its lightweight security mechanisms leave the physical layer vulnerable to availability attacks such as jamming and battery-depletion. These risks are particularly critical in mission-critical environmental monitoring systems. This paper proposes a multi-attribute physical-layer authentication (PLA) framework that supports uplink legitimacy assessment by jointly exploiting radio, energy, and temporal attributes, specifically RSSI, altitude, battery_level, battery_drop_speed, event_step, and time_rank. Using publicly available Brno LoRaWAN traces, we construct a device-aware semi-synthetic dataset comprising 230,296 records from 1921 devices over 13.68 days, augmented with energy, spatial, and temporal attributes and injected with controlled jamming and battery-depletion anomalies. Five classifiers (Random Forest, Multi-Layer Perceptron, XGBoost, Logistic Regression, and K-Nearest Neighbours) are evaluated using accuracy, precision, recall, F1-score, and AUC-ROC. The Multi-Layer Perceptron achieves the strongest detection performance (F1-score = 0.8260, AUC-ROC = 0.8953), with Random Forest performing comparably. Deployment-oriented computational profiling shows that lightweight models such as Logistic Regression and the MLP achieve near-instantaneous prediction latency (below 2 µs per sample) with minimal CPU overhead, while tree-based models incur higher training and storage costs but remain feasible for Network Server-side deployment.

LoRaWAN has become a widely adopted communication technology for Internet of Things applications because of its long-range communication capability and low power consumption. However, resource-constrained LoRaWAN networks remain vulnerable to physical-layer attacks such as jamming and battery-depletion attacks. This paper investigates architectural compression and Knowledge Distillation (KD) for lightweight multi-attribute Physical Layer Authentication (PLA) in LoRaWAN networks. A higher-capacity Teacher model is used to train progressively smaller Student models, and three Student-training strategies—Direct training, Hard-KD, and Soft-KD—are systematically compared to determine whether Teacher supervision provides an advantage beyond architectural compression alone. The framework uses the Received Signal Strength Indicator (RSSI), altitude, and the battery level as input attributes and is evaluated offline using a device-aware semi-synthetic dataset derived from the publicly available Brno LoRaWAN dataset. The resulting dataset contains Normal Communication, Jamming Attack, and Battery Depletion Attack traffic. The experimental results show that Student (8) preserves a classification performance close to that of the Teacher across all three training strategies, achieving Macro F1-scores of 90.619 ± 0.056% for Direct training, 90.591 ± 0.069% for Hard-KD, and 90.626 ± 0.083% for Soft-KD, compared with 91.007% for the Teacher. Student (8) reduces the number of trainable parameters from 2435 to 59 (97.6%) and the serialised model size from 46.65 KB to 2.80 KB (94.0%), while exhibiting a substantially higher measured batch-processing throughput under the evaluated CPU-based implementation. A feature-ablation analysis further indicates that the RSSI and battery level provide the dominant discriminatory information, while the altitude provides a smaller but measurable contextual contribution. The comparable performance of Direct, Hard-KD, and Soft-KD demonstrates that KD does not consistently outperform direct training for the evaluated Student architectures; rather, architectural compression itself accounts for much of the retained performance. These findings demonstrate that compact Student architectures can substantially reduce the model complexity while preserving a strong classification performance within the evaluated multi-attribute PLA framework, supporting the further investigation of lightweight network-side security mechanisms for LoRaWAN deployments.