Sensor mesh and signal transmission architectures for electromagnetic signature analysis

• US 10,338,191 B2
• Filed: 02/09/2015
• Issued: 07/02/2019
• Est. Priority Date: 10/30/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Maynor, David, Rouland, Christopher Jay, Engle, Michael Thomas
• Primary Examiner(s): Henning, Matthew T
• Application Number:
  US14/617,798
• Publication Number:
  US 20160127403A1
• Time in Patent Office: 1,604 Days
• Field of Search: 726 22
• CPC Class Codes: G01S 2205/01 specially adapted for specific applications
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06T 7/20 Analysis of motion motion estimation for coding, decoding, compressing or decompressing digital video signals H04N19/43, H04N19/51
• CPC Class Codes: G06T 7/60 Analysis of geometric attributes
• CPC Class Codes: G06V 20/41 Higher-level, semantic clustering, classification or understanding of video scenes, e.g. detection, labelling or Markovian modelling of sport events or news items segmenting video sequences G06V20/49
• CPC Class Codes: G06V 20/46 Extracting features or characteristics from the video content, e.g. video fingerprints, representative shots or key frames
• CPC Class Codes: G06V 20/52 Surveillance or monitoring of activities, e.g. for recognising suspicious objects recognising microscopic objects G06V20/69
• CPC Class Codes: G06V 2201/10 Recognition assisted with metadata
• CPC Class Codes: G08B 13/00 Burglar, theft or intruder alarms
• CPC Class Codes: H04B 1/18 Input circuits, e.g. for coupling to an antenna or a transmission line coupling networks between antennas or lines and receivers independent of the nature of the receiver H03H
• CPC Class Codes: H04B 17/10 of transmitters
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04K 2203/16 for telephony
• CPC Class Codes: H04K 2203/18 for wireless local area networks or WLAN
• CPC Class Codes: H04K 3/22 including jamming detection and monitoring
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04N 5/265 Mixing
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/10 : Integrity
• CPC Class Codes: H04W 12/12 : Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 : Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 : using geofenced areas
• CPC Class Codes: H04W 12/79 : Radio fingerprint
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 4/021 : Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 84/18 : Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Systems and methods can support a sensor mesh and signal transmission architecture for electromagnetic signature analysis and threat detection. Sensor antennas may be deployed within an electromagnetic environment. A configurable antenna feed network can couple radio frequency signals from the antennas to both software-defined radio receivers and hardware-defined radio receivers. A raw signal analysis engine associated with the software-defined radio receiver can receive digital samples of the radio frequency signals, identify signal features within the digital samples, and generate signal feature vectors from the identified signal features. A signal feature network can receive the signal feature. A signal aggregation and analysis engine can receive the signal feature vectors from the signal feature network, aggregate the signal feature vectors, process the signal feature vectors, and identify wireless attacks according to the signal features within the signal feature vectors. One or more updatable analysis databases can support the signal processing operations.

Claims

1. A method for a sensor mesh and signal transmission architecture for electromagnetic signature analysis and threat detection, comprising:

providing a plurality of sensor antennas within an electromagnetic environment, wherein the electromagnetic environment supports operation of a plurality of wireless devices;

coupling radio frequency signals from the plurality of sensor antennas into an antenna feed network operable to switch and route the radio frequency signals between the plurality of sensor antennas and a plurality of radio receivers through the sensor mesh;

coupling radio frequency signals from the antenna feed network into the plurality of radio receivers;

performing raw signal analysis within the plurality of radio receivers to identify signal features;

forming signal feature vectors, within the plurality of radio receivers, each of the signal feature vectors comprising two or more of the identified signal features;

transmitting the signal feature vectors from the plurality of radio receivers into a signal feature network operable to switch and route the signal feature vectors between the plurality of radio receivers and one or more feature vector processors;

aggregating, within one of the feature vector processors, the signal feature vectors from two or more of the plurality of radio receivers in response to the signal feature vectors being identified as the same simultaneous emission from one of the plurality of wireless devices;

processing the signal feature vectors, within one or more of the feature vector processors, to refine the signal features within the signal feature vectors;

classifying one of the plurality of wireless devices as malicious or benign according to the refined signal features within the signal feature vectors;

identifying wireless attacks according to the signal features within the signal feature vectors;

reconfiguring the antenna feed network according to the signal features within the signal feature vectors; and

transmitting the refined signal feature vectors from the one or more feature vector processors to support operator interfaces.

2. The method of claim 1, wherein the antenna feed network comprises direct connections between the sensor antennas and the one or more radio receivers.

3. The method of claim 1, wherein the antenna feed network comprises radio frequency signal switches.

4. The method of claim 1, wherein the antenna feed network comprises radio frequency signal splitters.

5. The method of claim 1, wherein the one or more radio receivers comprises a software-defined radio.

6. The method of claim 1, wherein the plurality of radio receivers comprises a hardware-defined radio.

7. The method of claim 1, wherein reconfiguring the antenna feed network comprises switching one of the radio frequency signals between a software-defined radio and a hardware-defined radio.

8. The method of claim 1, wherein identifying signal features comprises decoding signal content.

9. The method of claim 1, wherein one of the signal features comprises one of a duration, a bandwidth, a center frequency, a duty cycle, and an average power.

10. The method of claim 1, wherein the signal feature network comprises a packetized data network.

11. The method of claim 1, further comprising retrieving information from one or more analysis databases.

12. The method of claim 1, wherein the operator interfaces comprise an administrative user interface application.

13. A sensor mesh and signal transmission system for electromagnetic signature analysis and threat detection, comprising:

a plurality of sensor antennas deployed as a sensor mesh within an electromagnetic environment, wherein the electromagnetic environment supports operation of a plurality of wireless devices;

an antenna feed network configured to couple radio frequency signals from the plurality of sensor antennas to a plurality of radio receivers through the sensor mesh;

a raw signal analysis engine associated with the plurality of radio receivers, the raw signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to identify signal features within the radio frequency signals, form signal feature vectors from two or more of the identified signal features, and transmit the signal feature vectors;

a signal feature network configured to receive signal feature vectors transmitted from the raw signal analysis engine; and

a signal aggregation and analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

aggregate two or more of the signal feature vectors from the signal feature network in response to the signal feature vectors being identified as the same simultaneous emission from one of the plurality of wireless devices;

process the signal feature vectors to refine the signal features within the signal feature vectors;

identify wireless attacks from one of the plurality of wireless devices according to the signal features within the signal feature vectors; and

reconfigure the antenna feed network according to the signal features within the signal feature vectors.

14. The system of claim 13, wherein the signal aggregation and analysis engine is further configured to present information associated with the refined signal feature vectors to support an operator interface.

15. The system of claim 13, wherein the antenna feed network comprises one of a direct radio frequency interconnection, a radio frequency signal switch, and a radio frequency signal splitter.

16. The system of claim 13, wherein the plurality of radio receivers comprises one of a software-defined radio and a hardware-defined radio.

17. The system of claim 13, wherein one of the signal features comprises one of a duration, a bandwidth, a center frequency, a duty cycle, and an average power.

18. The system of claim 13, wherein the signal feature network comprises a packetized data network.

19. The system of claim 13, further comprising one or more analysis databases.

20. A sensor mesh and signal transmission system for electromagnetic signature analysis and threat detection, comprising:

a plurality of sensor antennas deployed as a sensor mesh within an electromagnetic environment wherein the electromagnetic environment supports operation of a plurality of wireless devices;

a configurable antenna feed network operable to couple radio frequency signals from one or more of the sensor antennas through the sensor mesh to a software-defined radio receiver and from one or more of the sensor antennas to a hardware-defined radio receiver;

a raw signal analysis engine associated with the software-defined radio receiver, the raw signal analysis engine operable to receive digital samples of one of the radio frequency signals, identify signal features within the digital samples, form signal feature vectors from two or more of the identified signal features, and transmit the signal feature vectors;

a signal feature network configured to receive the signal feature vectors from the raw signal analysis engine; and

a signal aggregation and analysis engine operable to receive the signal feature vectors from the signal feature network, aggregate two or more of the signal feature vectors in response to the signal feature vectors being identified as the same simultaneous emission from one of the plurality of wireless devices, process the signal feature vectors to refine the signal features within the signal feature vectors, and identify wireless attacks from one of the plurality of wireless devices according to the signal features within the signal feature vectors; and

one or more updatable analysis databases supporting operations of the raw signal analysis engine and the signal aggregation and analysis engine.