Ground and air vehicle electromagnetic signature detection and localization

• US 10,122,736 B2
• Filed: 06/02/2015
• Issued: 11/06/2018
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay
• Primary Examiner(s): Le, David
• Application Number:
  US14/728,931
• Publication Number:
  US 20150350914A1
• Time in Patent Office: 1,253 Days
• Field of Search: None
• CPC Class Codes: G06K 7/0095 Testing the sensing arrangement, e.g. testing if a magnetic card reader, bar code reader, RFID interrogator or smart card reader functions properly testing of electrical circuits G01R31/28
• CPC Class Codes: H04B 1/0028 wherein the AD/DA conversion occurs at baseband stage
• CPC Class Codes: H04B 1/0064 with separate antennas for the more than one band H04B1/0053 takes precedence
• CPC Class Codes: H04B 7/01 Reducing phase shift
• CPC Class Codes: H04K 2203/34 involving multiple cooperating jammers
• CPC Class Codes: H04K 3/22 including jamming detection and monitoring
• CPC Class Codes: H04K 3/42 characterized by the control of the jamming frequency or wavelength
• CPC Class Codes: H04K 3/44 characterized by the control of the jamming waveform or modulation type
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/825 by jamming
• CPC Class Codes: H04K 3/84 related to preventing electromagnetic interference in petrol station, hospital, plane or cinema
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04K 3/88 related to allowing or preventing alarm transmission
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 72/20 : Control channels or signalling for resource management
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Systems and methods can support identifying radio transmissions associated with autonomous or remote-controlled vehicles. Radio frequency signals may be received using one or more sensors, wherein the sensors comprise radio receivers. Radio frequency fingerprints may be identified within one or more of the radio frequency signals, wherein the radio frequency fingerprints comprise radio signal characteristics or radio hardware identifiers. A stored radio frequency fingerprint may be determined as matching the received radio frequency fingerprint. A motion characteristic may be computed. The received radio frequency fingerprint may be associated with an autonomous or remote-controlled vehicle based upon the stored radio frequency fingerprint or the motion characteristic. Information regarding the identified autonomous or remote-controlled vehicle may be presenting to one or more operator interfaces.

Claims

1. A method for identifying radio transmissions associated with autonomous or remote-controlled vehicles, comprising:

providing one or more sensors, wherein the sensors comprise radio receivers;

receiving radio frequency signals associated with a potentially malicious, autonomous or remote-controlled vehicle using the one or more sensors;

identifying a radio frequency fingerprint associated with a control channel of the potentially malicious, autonomous or remote-controlled vehicle from one or more of the radio frequency signals, wherein the radio frequency fingerprint comprises a radio signal characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle;

determining, from known examples of benign and malicious devices stored in a signal signature database, matches to the received radio frequency fingerprint;

computing a time sequence of locations associated with received radio frequency fingerprint based upon received signal strengths from two or more of the one or more sensors;

computing a motion characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle from the computed time sequence of locations;

classifying the potentially malicious, autonomous or remote-controlled vehicle as benign or malicious based upon one or both of the received radio frequency fingerprint or the motion characteristic matching the known examples of malicious devices stored in the signal signature database; and

presenting, via one or more operator interfaces, information regarding the classifying of the potentially malicious, autonomous or remote-controlled vehicle.

2. The method of claim 1, wherein the motion characteristic comprises a path and speed appropriate for autonomous or remote-controlled vehicles.

3. The method of claim 1, wherein the motion characteristic comprises a Doppler effect within one or more of the radio frequency signals.

4. The method of claim 1, wherein the motion characteristic is derived by triangulating received power levels over time at a plurality of the one or more sensors.

5. The method of claim 1, wherein the motion characteristic is localized in elevation as well as direction relative to the one or more sensors.

6. The method of claim 1, wherein information regarding the identified autonomous or remote-controlled vehicle comprises associating the autonomous or remote-controlled vehicle with a human entity.

7. The method of claim 1, wherein information regarding the identified autonomous or remote-controlled vehicle comprises an estimated location of a source of radio communication with the autonomous or remote-controlled vehicle.

8. The method of claim 1, wherein the autonomous or remote-controlled vehicle comprises an unmanned aerial vehicle.

9. The method of claim 1, wherein the autonomous or remote-controlled vehicle comprises a self-driving car or a self-driving truck.

10. A system for identifying radio transmissions associated with autonomous or remote-controlled vehicles, comprising:

one or more sensor antennas;

one or more sensors configured to couple radio frequency signals from the one or more sensor antennas and generate data samples representing at least a portion of the radio frequency signals, wherein the radio frequency signals are associated with a potentially malicious, autonomous or remote-controlled vehicle;

one or more operator interfaces; and

a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

receive the data samples from the one or more sensors,

identify a radio fingerprint associated with a control channel of the potentially malicious, autonomous or remote-controlled vehicle from the data samples, wherein the radio fingerprint comprises a radio signal characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle,

determine, from known examples of benign and malicious devices stored in a signal signature database, matches to the received radio fingerprint,

compute a time sequence of locations associated with received radio frequency fingerprint based upon received signal strengths from two or more of the one or more sensor antennas,

compute a motion characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle from the computed time sequence of locations,

classify the potentially malicious, autonomous or remote-controlled vehicle as benign or malicious based upon one or both of the received radio frequency fingerprint or the motion characteristic matching the known examples of malicious devices stored in the signal signature database, and

present, via the one or more operator interfaces, information regarding classification of the potentially malicious, autonomous or remote-controlled vehicle.

11. The system of claim 10, wherein the motion characteristic comprises a path and speed appropriate for autonomous or remote-controlled vehicles.

12. The system of claim 10, wherein the motion characteristic comprises a Doppler effect within one or more of the radio frequency signals.

13. The system of claim 10, wherein the motion characteristic is derived by triangulating received power levels over time at a plurality of the one or more sensors.

14. The system of claim 10, wherein the motion characteristic is localized in elevation as well as direction relative to the one or more sensors.

15. The system of claim 10, wherein information regarding the identified autonomous or remote-controlled vehicle comprises associating the autonomous or remote-controlled vehicle with a human operator of the autonomous or remote-controlled vehicle.

16. The system of claim 10, wherein information regarding the identified autonomous or remote-controlled vehicle comprises an indication of an estimated location of a source of radio communication with the autonomous or remote-controlled vehicle as a location of a human operator of the autonomous or remote-controlled vehicle.

17. The system of claim 10, wherein the autonomous or remote-controlled vehicle comprises one of an unmanned aerial vehicle, a self-driving car, a self-driving truck, and a remotely controlled hybrid-amphibious-air vehicle.

18. A system for identifying multiple radio transmitters within a single wireless device, comprising:

one or more sensor antennas within the electromagnetic environment;

one or more updatable analysis databases configured to provide signatures of known examples of benign and malicious devices;

one or more operator interfaces for communicating information associated with wireless devices;

one or more software radio receivers configured to couple a radio frequency signal from one or more of the sensor antennas and generate data samples representing a portion of the radio frequency signal, wherein the radio frequency signal is transmitted from a potentially malicious, autonomous or remote-controlled vehicle; and

a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

receive the data samples,

generate feature vectors comprising at least a portion of the data samples,

cluster and extract signal features from within one or more of the feature vectors and update the feature vectors with attributes associated with clustering and extraction,

identify, within one or more of the feature vectors, a radio fingerprint comprising a radio signal characteristic associated with a control channel of the potentially malicious, autonomous or remote-controlled vehicle,

determine, from the known examples of benign and malicious devices, matches to the received radio fingerprint,

compute a motion characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle from the received radio fingerprint based upon time sequences of received signal strengths from two or more of the one or more sensor antennas,

classify the potentially malicious, autonomous or remote-controlled vehicle as benign or malicious based upon one or both of the received radio frequency fingerprint or the motion characteristic matching the known examples of malicious devices stored in the signal signature database, and

present, via the one or more operator interfaces, information regarding classification of the potentially malicious, autonomous or remote-controlled vehicle.