Blind signal classification and demodulation in a multimodal radio frequency environment

• US 9,625,564 B2
• Filed: 03/24/2015
• Issued: 04/18/2017
• Est. Priority Date: 10/30/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Maynor, David, Rouland, Christopher Jay, Engle, Michael Thomas
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US14/667,527
• Publication Number:
  US 20160127907A1
• Time in Patent Office: 756 Days
• CPC Class Codes: G01S 2205/01 specially adapted for specific applications
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06T 7/20 Analysis of motion motion estimation for coding, decoding, compressing or decompressing digital video signals H04N19/43, H04N19/51
• CPC Class Codes: G06T 7/60 Analysis of geometric attributes
• CPC Class Codes: G06V 20/41 Higher-level, semantic clustering, classification or understanding of video scenes, e.g. detection, labelling or Markovian modelling of sport events or news items segmenting video sequences G06V20/49
• CPC Class Codes: G06V 20/46 Extracting features or characteristics from the video content, e.g. video fingerprints, representative shots or key frames
• CPC Class Codes: G06V 20/52 Surveillance or monitoring of activities, e.g. for recognising suspicious objects recognising microscopic objects G06V20/69
• CPC Class Codes: G06V 2201/10 Recognition assisted with metadata
• CPC Class Codes: G08B 13/00 Burglar, theft or intruder alarms
• CPC Class Codes: H04B 1/18 Input circuits, e.g. for coupling to an antenna or a transmission line coupling networks between antennas or lines and receivers independent of the nature of the receiver H03H
• CPC Class Codes: H04B 17/10 of transmitters
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04K 2203/16 for telephony
• CPC Class Codes: H04K 2203/18 for wireless local area networks or WLAN
• CPC Class Codes: H04K 3/22 including jamming detection and monitoring
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04N 5/265 Mixing
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/10 : Integrity
• CPC Class Codes: H04W 12/12 : Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 : Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 : using geofenced areas
• CPC Class Codes: H04W 12/79 : Radio fingerprint
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 4/021 : Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 84/18 : Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Systems and methods can support detecting and identifying threats associated with wireless devices within an electromagnetic environment. One or more sensor antennas may be located within the electromagnetic environment. Radio frequency signals may be coupled from the sensor antennas into a radio receiver. The radio receiver can communicate data samples representing a portion of the radio frequency signal to a raw signal analysis engine. The raw signal analysis engine can identify features associated with a communicated signal within the data samples. The raw signal analysis engine can classify modulation features and decode information features from the communicated signal. Feature vectors may be generated comprising the data samples and the identified features associated with the data samples. The feature vectors can be transmitted to a signal aggregation and analysis engine to support detecting and identifying electromagnetic threats and to support associated operator interfaces.

Claims

1. A method for detecting and identifying threats associated with wireless devices within an electromagnetic environment, comprising:

providing one or more sensor antennas within the electromagnetic environment;

coupling a radio frequency signal from one or more of the sensor antennas into a radio receiver;

communicating data samples representing a portion of the radio frequency signal from the radio receiver to a raw signal analysis engine;

identifying, through operation of the raw signal analysis engine, features within the data samples associated with a communicated signal;

forming a feature vector comprising the identified features within the data samples;

identifying time-frequency domain signals within the data samples;

updating identifiers of the time-frequency domain signals into the feature vector;

performing clustering analysis on the time-frequency domain signals to identify one or more contiguous blocks of signals;

determining a likelihood of each contiguous block of signals having been transmitted by a common radio source;

updating the likelihood for each of the contiguous blocks of signals to the feature vector;

classifying, through operation of the raw signal analysis engine, modulation features associated with each of the contiguous blocks of signals by matching the feature vector to a known feature vector having a signal with known modulation;

decoding, through operation of the raw signal analysis engine, information features from the communicated signal according to the classified modulation features; and

aggregating features from multiple receivers to support detecting and identifying threats associated with wireless devices and to support associated operator interfaces.

2. The method of claim 1, further comprising generating a feature vector comprising the data samples representing the portion of the radio frequency signal and identified features associated with the portion of the radio frequency signal.

3. The method of claim 1, wherein aggregating features comprises transmitting the feature vector over a network to a signal analysis system.

4. The method of claim 1, wherein identifying features comprises performing a frequency-domain transformation on the data samples associated with the communicated signal.

5. The method of claim 1, wherein identifying features comprises performing energy clustering analysis on the data samples associated with the communicated signal, or on transformations of the data samples associated with the communicated signal.

6. The method of claim 1, further comprising performing angle clustering and association on the time-frequency domain signals to determine signal energy clusters within a space-time-frequency domain.

7. The method of claim 1, further comprising estimating an angle associated with a position of a radio source associated with the communicated signal.

8. The method of claim 1, wherein decoding information features comprises identifying a corresponding physical layer template from an updatable signal signature database.

9. The method of claim 1, wherein decoding information features comprises identifying a corresponding medium access layer template from an updatable signal signature database.

10. The method of claim 1, wherein detecting and identifying threats comprises comparing characteristic information about known electromagnetic attacks from an updatable attack database.

11. A signal classification and processing system for electromagnetic signature analysis and threat detection, comprising:

one or more sensor antennas within the electromagnetic environment;

a radio receiver configured to couple a radio frequency signal from one or more of the sensor antennas; and

a raw signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

receive data samples representing a portion of the radio frequency signal from the radio receiver,

identify features within the data samples associated with a communicated signal,

form a feature vector comprising the identified features within the data samples,

identify time-frequency domain signals within the data samples,

update identifiers of the time-frequency domain signals into the feature vector,

perform clustering analysis on the time-frequency domain signals to identify one or more contiguous blocks of signals,

determine a likelihood of each contiguous block of signals having been transmitted by a common radio source,

update the likelihood for each of the contiguous blocks of signals to the feature vector,

classify modulation features associated with each of the contiguous blocks of signals by matching the feature vector to a known feature vector having a signal with known modulation,

decode information features from the communicated signal according to the classified modulation features, and

transmit features to a signal aggregation and analysis engine to support detecting and identifying electromagnetic threats and to support associated operator interfaces.

12. The system of claim 11, wherein the one or more processing units are further configured to generate a feature vector comprising the identified features associated with the portion of the radio frequency signal.

13. The system of claim 11, wherein identifying features comprises performing a frequency-domain transformation on the data samples associated with the communicated signal.

14. The system of claim 11, wherein identifying features comprises performing energy clustering analysis on the data samples associated with the communicated signal.

15. The system of claim 11, wherein classifying modulation features comprises correlating data samples associated with the communicated signal to known modulation characteristics within an updatable signal signature database.

16. The system of claim 11, wherein the one or more processing units are further configured to estimate an orientation associated with a position of a radio source associated with the communicated signal.

17. The system of claim 11, wherein decoding information features comprises identifying a corresponding physical layer signature from an updatable signal signature database.

18. The system of claim 11, wherein decoding information features comprises identifying a corresponding medium access layer signature from an updatable signal signature database.

19. The system of claim 11, wherein detecting and identifying electromagnetic threats comprises comparing characteristic information about known electromagnetic attacks from an updatable attack database.

20. A signal classification and processing system for electromagnetic signature analysis and threat detection, comprising:

one or more sensor antennas within the electromagnetic environment;

a software radio receiver configured to couple a radio frequency signal from one or more of the sensor antennas and generate data samples representing a portion of the radio frequency signal; and

a raw signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

receive the data samples representing a portion of the radio frequency signal,

compute a time-frequency-domain signals in the data samples,

identify features associated with a communicated signal by performing energy clustering analysis on output from the time-frequency-domain signals,

form a feature vector comprising the identified features and the data samples,

perform clustering analysis on the time-frequency domain signals to identify one or more contiguous blocks of signals,

determine a likelihood of each contiguous block of signals having been transmitted by a common radio source,

update the likelihood for each of the contiguous blocks of signals into the feature vector,

estimate an orientation associated with a position of a radio source associated with the communicated signal,

classify modulation features associated with each of the contiguous blocks of signals by matching the feature vector to a known feature vector having a signal with known modulation,

decode information features from the communicated signal according to the classified modulation features, and

update the feature vector with the data samples, and

transmit the feature vectors to a signal aggregation and analysis engine to support detecting and identifying electromagnetic threats and to support associated operator interfaces.