Computational signal processing architectures for electromagnetic signature analysis

• US 9,945,928 B2
• Filed: 02/09/2015
• Issued: 04/17/2018
• Est. Priority Date: 10/30/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Dinh, Trung, Rouland, Christopher Jay, Engle, Michael Thomas
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US14/617,845
• Publication Number:
  US 20160127404A1
• Time in Patent Office: 1,163 Days
• CPC Class Codes: G01S 2205/01 specially adapted for specific applications
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06T 7/20 Analysis of motion motion estimation for coding, decoding, compressing or decompressing digital video signals H04N19/43, H04N19/51
• CPC Class Codes: G06T 7/60 Analysis of geometric attributes
• CPC Class Codes: G06V 20/41 Higher-level, semantic clustering, classification or understanding of video scenes, e.g. detection, labelling or Markovian modelling of sport events or news items segmenting video sequences G06V20/49
• CPC Class Codes: G06V 20/46 Extracting features or characteristics from the video content, e.g. video fingerprints, representative shots or key frames
• CPC Class Codes: G06V 20/52 Surveillance or monitoring of activities, e.g. for recognising suspicious objects recognising microscopic objects G06V20/69
• CPC Class Codes: G06V 2201/10 Recognition assisted with metadata
• CPC Class Codes: G08B 13/00 Burglar, theft or intruder alarms
• CPC Class Codes: H04B 1/18 Input circuits, e.g. for coupling to an antenna or a transmission line coupling networks between antennas or lines and receivers independent of the nature of the receiver H03H
• CPC Class Codes: H04B 17/10 of transmitters
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04K 2203/16 for telephony
• CPC Class Codes: H04K 2203/18 for wireless local area networks or WLAN
• CPC Class Codes: H04K 3/22 including jamming detection and monitoring
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04N 5/265 Mixing
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/10 : Integrity
• CPC Class Codes: H04W 12/12 : Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 : Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 : using geofenced areas
• CPC Class Codes: H04W 12/79 : Radio fingerprint
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 4/021 : Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 84/18 : Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Systems and methods can support a computational signal processing architecture for electromagnetic signature analysis and threat detection. A plurality of sensor antennas can couple a radio frequency signal into a radio receiver. The radio receiver can generate digital samples of the signal. A raw signal analysis engine can identify signal features within the digital samples, generate signal feature vectors from the identified signal features, decode signal content from the signal feature vectors, and transmit the signal feature vectors into a signal feature network. The signal feature vectors may be aggregated from the signal feature network into a signal aggregation and analysis engine. The signal aggregation and analysis engine can refine feature vectors through processing such as identifying wireless attacks according to the signal features within the signal feature vectors. One or more operator interfaces and one or more analysis databases may support these operations.

Claims

1. A method for a computational signal processing architecture for electromagnetic signature analysis and threat mitigation, comprising:

providing a plurality of radio receivers, each associated with a unique plurality of sensor antennas;

providing a plurality of raw signal analysis engines;

providing one or more signal aggregation and analysis engines coupled to the plurality of raw signal analysis engines via a signal feature network;

receiving unique radio frequency signal instances associated with a transmitting device into each unique plurality of sensor antennas;

coupling respective unique radio frequency signal instances from each unique plurality of sensor antennas into respective ones of the radio receivers;

sampling, within each radio receiver, a digital representation of the respective radio frequency signal instance;

communicating each digital representation from the respective radio receiver to one or more of the plurality of raw signal analysis engines;

identifying, by each respective raw signal analysis engine, signal features within the digital representation;

generating, by each respective raw signal analysis engine, signal feature vectors from the identified signal features;

providing a signal database to support each respective raw signal analysis engine;

transmitting the respective signal feature vectors into the signal feature network;

aggregating, from the signal feature network, the signal feature vectors into one of the signal aggregation and analysis engines;

generating, within the signal aggregation and analysis engine, an aggregated signal feature vector from two or more signal feature vectors in response to the two or more signal feature vectors originating from the transmitting device;

providing analysis databases to support the signal aggregation and analysis engine;

processing, within the signal aggregation and analysis engine to identify wireless attacks according to signal features within the aggregated signal feature vector; and

mitigating operation of the transmitting device in response to identified wireless attacks.

2. The method of claim 1, wherein the signal aggregation and analysis engine comprises a plurality of distributed signal processing modules.

3. The method of claim 1, wherein the signal aggregation and analysis engine comprises a hierarchy of signal processing modules.

4. The method of claim 1, wherein the radio receiver comprises a software-defined radio.

5. The method of claim 1, wherein the radio receiver comprises a hardware-defined radio.

6. The method of claim 1, wherein the identified signal features comprise an angle associated with the signal and expressed with respect to a geometry associated with the sensor antennas.

7. The method of claim 1, wherein processing by the signal aggregation and analysis engine comprises performing a space-time-frequency analysis.

8. The method of claim 1, wherein processing by the signal aggregation and analysis engine comprises geolocation.

9. The method of claim 1, wherein processing by the signal aggregation and analysis engine comprises estimating data throughput.

10. The method of claim 1, wherein the identified signal features comprise one of a duration, a bandwidth, a center frequency, a duty cycle, and an average power.

11. A computational signal processing system for electromagnetic signature analysis and threat mitigation, comprising:

a plurality of radio receivers, each coupled to a unique plurality of sensor antennas and operable to receive unique radio frequency signal instances associated with a transmitting device into each unique plurality of sensor antennas and generate digital representations of the unique radio frequency signal instances;

a plurality of raw signal analysis engines, each one operable to;

receive respective digital representations from the respective radio receivers,

identify signal features within the digital representations,

generate signal feature vectors from the identified signal features,

and

transmit the signal feature vectors into a signal feature network;

one or more signal aggregation and analysis engines coupled to the plurality of raw signal analysis engines via the signal feature network and operable to;

aggregate the signal feature vectors from the signal feature network,

generate an aggregated signal feature vector from two or more signal feature vectors in response to the two or more signal feature vectors originating from the transmitting device,

identify wireless attacks according to signal features within the aggregated signal feature vectors, and

mitigate operation of the transmitting device in response to identified wireless attacks;

and

one or more updatable analysis databases supporting operations of the plurality of raw signal analysis engines and the one or more signal aggregation and analysis engines.

12. The system of claim 11, wherein the signal aggregation and analysis engine comprises a plurality of distributed signal processing modules.

13. The system of claim 11, wherein the radio receiver comprises a software-defined radio.

14. The system of claim 11, wherein the radio receiver comprises a hardware-defined radio.

15. The system of claim 11, wherein processing further comprises performing a space-time-frequency analysis.

16. The system of claim 11, wherein processing further comprises geolocation.

17. The system claim 11, wherein processing further comprises estimating data throughput.

18. The system of claim 11, wherein the identified signal features comprise one of a duration, a bandwidth, a center frequency, a duty cycle, an angle, and an average power.

19. The system of claim 11, wherein the operator interface comprises an administrative user interface application.

20. A computational signal processing system for electromagnetic signature analysis and threat mitigation, comprising:

a plurality of radio receivers, each coupled to a unique plurality of sensor antennas and operable to receive unique radio frequency signal instances associated with a transmitting device into each unique plurality of sensor antennas and generate digital representations of the unique radio frequency signal instances;

a plurality of raw signal analysis engines, each one operable to receive respective digital representations from the respective radio receivers, identify signal features within the digital representations, generate signal feature vectors from the identified signal features, and transmit the signal feature vectors into a signal feature network;

one or more signal aggregation and analysis engines coupled to the plurality of raw signal analysis engines via the signal feature network and operable to aggregate the signal feature vectors from the signal feature network, generate aggregated signal feature vectors from two or more signal feature vectors in response to the two or more signal feature vectors originating from the transmitting device, geolocate wireless devices according to the signal features within the aggregated signal feature vectors to refine the signal feature vectors with geolocation information, identify wireless attacks according to the signal features within the aggregated signal feature vectors to refine the signal feature vectors with identified wireless attack information, and mitigate operation of the transmitting device in response to identified wireless attacks;

and

one or more updatable analysis databases supporting operations of the plurality of raw signal analysis engines and the one or more signal aggregation and analysis engines.