SECURITY AND COMMUNICATION NETWORKS

Security Comm. Networks. 2010; 3:71–82

Published online 24 June 2009 in Wiley InterScience
(www.interscience.wiley.com) DOI: 10.1002/sec.115

Application of wavelet denoising to improve OFDM-based

signal detection and classification‡,§

Randall W. Klein, Michael A. Temple∗,† and Michael J. Mendenhall

Air Force Institute of Technology, Wright-Patterson AFB, OH 45433, U.S.A.

Summary

The developmental emphasis on improving wireless access security through various OSI PHY layer mechanisms
continues. This work investigates the exploitation of RF waveform features that are inherently unique to specific
devices and that may be used for reliable device classification (manufacturer, model, or serial number). Emission
classification is addressed here through detection, location, extraction, and exploitation of RF ‘fingerprints’ to
provide device-specific identification. The most critical step in this process is burst detection which occurs prior
to fingerprint extraction and classification. Previous variance trajectory (VT) work provided sensitivity analysis for
burst detection capability and highlighted the need for more robust processing at lower signal-to-noise ratio (SNR).
The work presented here introduces a dual-tree complex wavelet transform (DT-CWT) denoising process to augment
and improve VT detection capability. The new method’s performance is evaluated using the instantaneous amplitude
responses of experimentally collected 802.11a OFDM signals at various SNRs. The impact of detection error on
signal classification performance is then illustrated using extracted RF fingerprints and multiple discriminant analysis
(MDA) with maximum likelihood (ML) classification. Relative to previous approaches, the DT-CWT augmented
process emerges as a better alternative at lower SNR and yields performance that is 34% closer (on average) to
‘perfect’ burst location estimation performance. Published in 2009 by John Wiley & Sons, Ltd.

KEY WORDS: RF fingerprints; wavelet denoising; OFDM; 802.11a; dual tree wavelet transform

1. Introduction that are inherently unique to a specific device and

that are difficult to replicate by an unintended party.
Considerable research has been conducted on detecting For example, some efforts have investigated received
and/or mitigating spoofing within the medium signal strength (RSS) (a power-based metric) for
access control (MAC) layer of the open systems detecting and/or locating a spoofing node [1,2]. Both
interconnection (OSI) stack [1,2]. There has been a of these efforts demonstrated some success at detecting
recent shift toward providing added security at the spoofing using experiments conducted with different
OSI Physical (PHY) layer by exploiting RF features hardware and in different physical environments.

∗
Correspondence to: Michael A. Temple, AFIT/ENG Air Force Institute of Technology, Wright-Patterson AFB, OH 45433,
U.S.A.
†
E-mail: michael.temple@afit.edu
‡
The views expressed in this paper are those of the author(s) and do not reflect official policy of the United States Air Force,
Department of Defense or the U.S. Government.
§
This article is a U.S. Government work and is in the public domain in the USA.
Published in 2009 by John Wiley & Sons, Ltd.
72 R. W. KLEIN, M. A. TEMPLE AND M. J. MENDENHALL

RF fingerprinting is one alternative PHY layer was driven by two factors, including (1) consistency
approach that is readily dismissed in Reference [2] for with previous related 802.11a work that has been
‘scale’ reasons. For applications where size constraints extensively published [3,4,14--17], and (2) the
are less restrictive, RF fingerprinting remains a viable continued emergence of OFDM-based signals as
alternative and is considered here as in previous works envisioned for 3G/4G (IMT/IMT-Advanced) radio
[3,4]. Collectively, related works in RF fingerprinting, communications. While the transient detection and
electromagnetic signatures, intra-pulse modulation, classification techniques used in this work are
and unintentional modulation [5--13] form a solid basis likely applicable to other signal types, and may
for developing techniques that may be applicable to actually perform better with some of them, the
commercial communication devices. If the inherent RF challenges posed by OFDM-based signals must be
fingerprints are repeatedly extractable and sufficiently addressed.
unique, they are potentially useful for determining the The impact of burst detection error on signal
specific make, model, and/or serial number of a given classification performance is addressed here using
device. RF fingerprints and multiple discriminant analysis
Previous work highlighted signal structure unique- (MDA) with maximum likelihood (ML) classification.
ness and attributed inter-device differences to various While VT burst detection and MDA-ML classification
manufacturing, aging, and environmental factors performance in earlier work [14] was shown to be
[5]. While several processing steps are required to consistent with ‘perfect’ burst estimation performance
effectively exploit the unique RF fingerprints, burst at higher SNRs in the range of 10 ≤ SNR ≤ 30 dB,
location is arguably the most important [8,10]. In this performance diverged at SNRs in the range of −3 ≤
context, burst location includes determining both the SNR ≤ 10 dB. These previous results demonstrated
burst start time and the subsequent signal region(s) a margin for improvement only at the lower SNRs
from which fingerprints are extracted. Both of these and highlighted the need for a more robust technique,
factors are important given that improper selection providing the impetus for the work presented in this
of either can unduly bias the processing to favor paper. More specifically, a dual-tree complex wavelet
channel noise effects or steady-state signal effects [5]. transform (DT-CWT) is introduced to denoise the
With the exception of more recent work in References signal prior to VT calculation to improve performance
[3,4,14], these previous efforts lack a detailed at lower SNRs (−3 ≤ SNR ≤ 10 dB). It is envisioned
sensitivity analysis of burst detection and fingerprint that this technique would be activated only at the
classification performance under varying channel noise operator’s discretion, since there is no gain at higher
conditions. SNRs.
Noise sensitivity analysis is imperative for deter-
mining the minimum acceptable signal-to-noise ratio
(SNR) that provides consistent and reliable classifi- 2. Background
cation results. This minimum acceptable SNR also
allows determination of maximum transmitter–receiver 2.1. Signal Characteristics
separation distances which can aide in establishing
Device emissions can be exploited using various signal
the geometric layout of physical hardware to improve
characteristics. However, instantaneous amplitude and
overall network security. Noise sensitivity performance
instantaneous phase characteristics are perhaps the
also provides a good discriminant for comparing
most extensively investigated [5,8--10]. More recently,
various detection and classification techniques. For the
these two characteristics have been augmented with
work presented here, burst location performance is
instantaneous frequency and successfully exploited
conducted for a combined channel noise and burst-to-
for device classification [3,4,14]. The instantaneous
burst variability effect using multiple 802.11a bursts
amplitude, a(k), instantaneous phase, θ(k), and
and multiple independent noise realizations for each
instantaneous frequency, f (k), responses of a complex
burst.
sampled signal s(k) are given by [18]
Related burst detection work in Reference [14]
provides preliminary results using variance trajectory
s(k) = i(k) + jq(k) (1)
(VT) of 802.11a instantaneous amplitude response.
The choice of using OFDM-based signals for

demonstration, and in particular the 802.11a signal, a (k) = i2 (k) + q2 (k) (2)

Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
 APPLICATION OF WAVELET DENOISING 73

 
−1 q (k) (a) 8
θ (k) = tan (3)
i (k) 6

Amplitude
4
1 φ(k) − φ(k − 1)
f (k) = (4) 2
2π k
0
−0.5 0 0.5 1 1.5 2 2.5 3
where i(k) and q(k) are the instantaneous in-phase and Time (Secs * 10−5)
quadrature-phase components of s(k). 1

VT
0.5
2.2. Variance Trajectory (VT)
The work in Reference [8] analyzed Bluetooth
0
signals using the VT process with instantaneous −0.5 0 0.5 1 1.5 2 2.5 3
phase. The process windows an input signal and Time (Secs * 10−5)
(b)
calculates the signal variance for each window, 8
creating a variance vector. The difference between

Amplitude
6
consecutive variance values is calculated to form 4
the VT. The work presented here generates VT
2
sequence {VTa (i)} using instantaneous amplitude
0
sequence {a(k)}, k = 1, 2, . . . , Na , to estimate the burst −0.5 0 0.5 1 1.5 2 2.5 3
Time (Secs * 10−5)
start. The ith element of sequence {VTa (i)} is given
3
by [3]
2

VTa (i) = |Wa (i) − Wa (i + 1)|

VT

1
i = 1, 2, . . . , Lw − 1 (5)
0
−0.5 0 0.5 1 1.5 2 2.5 3

1  s +Nw
1+(m−1)N Time (Secs * 10−5)
Wa (m) = [a(k) − µw ]2
Nw Fig. 1. Instantaneous signal amplitude and corresponding VT
k=1+(m−1)Ns response for (a) SNR = 6 dB and (b) SNR = 0 dB.
m = 1, 2, . . . , Lw (6)

where Nw is the window extent, and Ns is the non-uniformly distributed in the wavelet domain and
number of samples the window advances between significant signal information manifests in the large
calculations. The µw factor in Equation (6) is the magnitude wavelet coefficients. It is common to
sample mean of {aw (k)} which is the subsequence threshold the magnitude of the wavelet coefficients
of consecutive elements from {a(k)} contained in the in wavelet denoising applications where coefficients
window. Figure 1 shows a representative amplitude larger than the threshold contain significant signal
response and corresponding VT response for two contribution [19--28]. Those wavelet coefficients with
different analysis SNRs. As shown, there is a magnitude less than the threshold are understood to be
distinct VT peak response corresponding to the noise. Due to the compaction property of the wavelet
burst start which becomes less discernable as SNR transform, there are relatively few large magnitude
decreases. coefficients.
One distinct disadvantage of the DWT is the
lack of shift invariance. i.e., if the signal is shifted
2.3. Discrete Wavelet Transform Denoising
in time by some amount, the transformation of
Signal denoising is accomplished using a discrete that signal yields a different set of coefficients. In
Wavelet transform (DWT) by exploiting differences the application addressed here, this problem has
in the distribution of signal burst energy and the the consequence of complicating the computation
additive white gaussian noise (AWGN) in which it is of reasonable thresholds for signal denoising. This
embedded. The noise channel is uniformly distributed problem is mitigated by using the DT-CWT
in the wavelet domain. Signal bursts, however, are [29,30].
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
74 R. W. KLEIN, M. A. TEMPLE AND M. J. MENDENHALL

h0 (n) ↓2 where
h0 (n) ↓2

h0 (n) ↓2 h1 (n) ↓2
√  
h0(1) (n) ↓2 h1 (n) ↓2
φ (t) = 2 h0 (n)φ (2t − n) (10)
Tree1 h1 (n) ↓2

(1)
h ( n)
1
↓2 n

h0′ (n) ↓2

h0′ (n) ↓2

h0′ (n) ↓2 h1′ (n) ↓2

h0′ (1) (n) ↓2 h1′ (n) ↓2

Tree2 h1′ (n) ↓2

3. Methodology
h1′ (1) (n) ↓2

Fig. 2. Representative dual-tree complex wavelet transform 3.1. DT-CWT Denoising

(DT-CWT) structure [30].
The process for denoising with the DT-CWT
is illustrated in Figure 3. The complex input
2.4. Dual-tree Complex Wavelet Transform signal f (n) is transformed via the DT-CWT
(Section 2.4) producing two complex-valued sets
The dual-tree complex wavelet transform (DT-CWT) is of wavelet coefficients, Tree1 and Tree2, one
a DWT extension that is nearly shift-invariant, i.e., the from each filter bank. The two complex sets are
DT-CWT coefficients are independent of time domain combined into one set of real-valued coefficients d(n)
shift and more strongly dependent on inter-scale and according to
intra-scale neighborhoods [29]. Furthermore, the DT-
CWT magnitude response exhibits reduced ringing 
d(n) = |Tree1(n)|2 + |Tree2(n)|2 (11)
in the wavelet domain due to high-frequency noise
and sharp discontinuities, which make the denoising
The resultant d(n) coefficients from Equation (11) are
algorithms more reliable. The DT-CWT is commonly
compared with threshold tdenoise and all coefficients
implemented as two real-valued filter banks as shown
less than tdenoise are set to zero. That is, ∀n where
in Figure 2.
d(n ) < tdenoise , Tree1(n ) = 0 and Tree2(n ) = 0 and
For real-valued input signals, the Tree1 and
the ‘punctured’ set of coefficients d  (n) produced.
Tree2 filter banks yield real-valued coefficients
The inverse DT-CWT (IDT-CWT) is then applied
representing real and imaginary components of
to d  (n) to create the denoised complex signal
complex coefficients, respectively [29]. For complex
g(n). The denoised coefficients are subsequently
input signals as used in this work, each filter bank yields
processed using the VT technique described in
complex coefficients which are annotated as Tree1
Section 2.2 to generate Denoised VT results. Figure 4
and Tree2 for discussion. The scaling and wavelet
shows representative amplitude and corresponding
functions for Tree1 are symmetric (even functions)
VT responses for two different analysis SNRs of
while Tree2 has scaling and wavelet functions that
a denoised signal. As compared to the Traditional
are anti-symmetric (odd functions). The wavelet and
VT signal responses in Figure 1, there is a
scaling functions, ψ(t) and φ(t) respectively, for the
more distinct peak associated with the burst start
Tree1 filter bank are given by [29,30]
at Time = 0 s.
√ 
ψ(t) = 2 h1 (n)φ(2t − n) (7)
n

where
√ 
φ(t) = 2 h0 (n)φ(2t − n) (8)
n

Ideally, the corresponding functions for the Tree2

path are the Hilbert transforms of Equations (7) and
(8) and given by
√  
ψ (t) = 2 h1 (n)φ (2t − n) (9)
n Fig. 3. Illustration of DT-CWT denoising process.
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
 APPLICATION OF WAVELET DENOISING 75

(a) 8 assigned. When algorithm convergence occurs, the

6 bursts are designated as ‘convergent’ and the estimated
Amplitude

location assigned. When algorithm convergence occurs

4
for identical bursts with both location techniques, the
2
bursts are designated as ‘dual convergent’ bursts. This
0
−0.5 0 0.5 1 1.5 2 2.5 3
operational methodology is implemented here using a
Time (Secs * 10 −5 ) four step process comprised of: (1) burst detection, (2)
1.5
burst start location, (3) RF fingerprint extraction, and
(4) device classification.
1
VT

0.5
(1) Step 1---burst detection: The first step represents
0 coarse burst detection. This step monitors the RF
−0.5 0 0.5 1 1.5 2 2.5 3
Time (Secs * 10 −5 )
environment to detect the presence of RF bursts.
The received signal is segmented into a consecutive
(b) 8
series of subsections using relatively wide, non-
6
overlapping windows, Ns = Nw from Equation
Amplitude

4 (6). While not a requirement, non-overlapping

2 windows are used to minimize processing time.
0
This has the disadvantage of producing coarser
−0.5 0 0.5 1 1.5 2 2.5 3
estimates of where the actual burst response starts,
Time (Secs * 10 −5 )
while at the same time capturing more signal power
1.5
within each window and improving detectability.
1
For all results presented in this paper, a window
size of Nw = 512 signal samples (21.6 ␮s) is used
VT

0.5 for Step 1.

The two burst detection methods (VT and
0
−0.5 0 0.5 1 1.5 2 2.5 3 Denoised VT as described previously in Sections
Time (Secs * 10 −5 )
2.2 and 3.1, respectively) are applied to the
Fig. 4. Denoised instantaneous signal amplitude and windowed signal data and an a priori threshold
corresponding VT response for (a) SNR = 6 dB and (b) tdetect used to declare detection. Once detection
SNR = 0 dB. occurs, the corresponding segment of windowed
signal data is passed to Step 2 where it is assumed
that an actual burst start occurs within the window.
3.2. Overall Demonstration Process
However, as with all signal detection approaches
The sequential burst detection, transient location, and false alarms can occur with bursts falsely declared
classification process are implemented relative to what present. Results of a performance comparison
commonly occurs in an operational collection, i.e., a between the two detection methods for this step
real-time system samples the received signal, detects are provided in Section 4.1.
the ‘presence’ of a burst, locates a given starting point (2) Step 2---burst start location: This step is similar
(sample number) within the burst turn-on transient to Step 1 in that the two detection methods
region, and classifies the burst using specific extracted are reapplied. However, the objective here is to
features. If a burst is received and its ‘presence’ not accurately and precisely locate the time at which
declared, it is an undetected burst. If a burst is received an abrupt change occurs in the VTa response of
and its ‘presence’ declared, it is a detected burst. Equation (5). The effectiveness of this approach is
The focus of this work is on detected bursts with based on the implicit assumption that the 802.11a
subsequent algorithmic processing used for transient OFDM signal can be modeled as having a step
location. For those cases where the transient location change response in the burst transient region.
algorithm does not converge in accordance with This assumed response is consistent with 802.11a
prescribed criteria (number of iterations, parametric specifications [31] and has been successfully
tolerance, etc.), the detected bursts are designated as exploited in change point estimation research
‘non-convergent’ and a default transient location value [15--17].
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
76 R. W. KLEIN, M. A. TEMPLE AND M. J. MENDENHALL

The segment of windowed data passed from As a result of this process, the RF fingerprint
Step 1 is further sub-segmented using much (feature vector) used for device classification
narrower and highly overlapped windows. The consists of 27 features per burst (3 preamble re-
overlapping windows allow for better location gions × 3 waveform characteristics × 3 statistics).
accuracy at the expense of increased processing After RF fingerprints have been extracted from
time. For this work, a window size of Nw = 20 each detected burst, the feature vectors are passed
samples (0.84 ␮s) is used with a shift of Ns = 2 to Step 4.
samples (84.2 ns) between consecutive windows. (4) Step 4---device classification: The impact of detec-
A different a priori detection threshold tlocate tion error on signal classification performance is
(compared to Step 1) is used to automatically illustrated using the extracted RF fingerprints from
estimate the burst start location based on a Step 3 and MDA with ML classification. MDA
significant peak response occurring in VTa (i) of is an extension of Fisher’s Linear Discriminant
Equation (5). (FLD) process for more than two classes [32].
If a significant peak is located, the signal is Classification is demonstrated here using an MDA-
passed to Step 3. It is possible that no significant ML process [33]. For the 3-class problem, the
peak is found and the algorithm therefore does not MDA process projects higher-dimensional data
converge to a solution. This could be the case if onto a two-dimensional ‘Fisher plane’ that max-
Step 1 passed along a false alarm and no signal imizes inter-class distances while simultaneously
burst is present or if the threshold is just too minimizing intra-class distances. In principle, this
high for that particular burst. When this happens, method cannot improve classification potential.
there are two options available: the signal can However, it provides good class separation and
be discarded or a default start location can be visualization of data having dimensionality greater
assigned. In an operational environment, where than 3. Using this lower-dimensional data, ML
the algorithm has exposure to numerous bursts, decision boundaries are determined assuming
discarding signals may be a good choice. However, normally distributed input data, equal costs or risk,
for this work, the probability of detect in Step 1 is and uniform prior probabilities. To discriminate c
100%, since the data is manually extracted from classes using d-dimensional input data, the input
the RF environment. With that assumption and vector x is linearly projected onto a (c − 1)-
the limited amount of data to process, a default dimensional space using
location is assigned to those signals which had no
significant peak. As per Section 3.2, these bursts y = Wt x (12)
are denoted as ‘non-convergent’ bursts. The default
location is chosen to be the last sample number where y is the vector of projected values and W
of the window. Only those bursts that converge is a d × (c − 1) projection matrix. Classification
to a solution are used in remaining steps and are is performed using unknown data and the two-
denoted as ‘convergent’ bursts. A performance dimensional trained decision boundaries. The
comparison for this step between the two methods process classifies each unknown input data
is documented in Section 4.2. set by projecting it onto the trained ‘Fisher
(3) Step 3---RF fingerprint extraction: After locating plane’ using Equation (12). Projected points
the burst start, statistical waveform feature data falling within the correct region are correctly
is extracted from the next 16.0 ␮s of the burst to classified while those falling outside the correct
represent the RF Fingerprint. This 16.0 ␮s region of region are misclassified. The percentage of
the burst corresponds to the 802.11a preamble [31]. correct classification is determined based on the
More specifically, statistics are calculated for the total number of unknown trials. A performance
three instantaneous waveform characteristics given comparison for this step between the two methods
by Equations (2), (3), and (4) across three distinct is documented in Section 4.3.
regions within the 16.0 ␮s preamble, including
the short symbol region, the long symbol region,
and the combined short-long symbol region (entire
3.3. Data Collection and Noise Simulation
preamble). The three statistical features considered
for this work include the variance, skewness, and The process for collecting 802.11a signals is shown
kurtosis. in Figure 5. The Agilent-based RF Signal Intercept
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
 APPLICATION OF WAVELET DENOISING 77

for a final sample rate of fs = 23.75 MSPS and

corresponding sample interval of Ts = 1/fs ≈ 42.1 ns
per sample.
The near-baseband RFSICS data were further post-
processed in a MATLAB environment with each burst
visually analyzed to accurately identify the sample
number corresponding to the burst start. Starting
from this sample number, a sufficiently long portion
of the signal is extracted to capture the 802.11a
preamble response and a small portion of pseudo-
randomly modulated data. The extracted burst response
is then normalized to equal power with respect to the
other collected bursts. Next, the bursts responses are
digitally filtered and their power at the filter output
is calculated. A 6th-order baseband Chebyshev digital
filter was used with a −3 dB bandwidth of 9.2 MHz.
At this point, the final baseband signals used for
Fig. 5. Process for RFSICS 802.11a signal collection and
post-collection processing, to include noise generation, burst detection, transient location, and classification
digital filtering, and scaling for desired analysis SNR. are sampled at frequency of fs = 23.75 MSPS and are
effectively oversampled by a factor of approximately
1.3 times Nyquist. The typical collected SNR at this
and Collection System (RFSICS) was used to point in the process is on the order of SNR = 40 dB.
collect approximately 200 bursts from three different Provided that RFSICS collection and subsequent post-
802.11a devices. For all collections, the devices processing is identical for all signals, it is reasonable to
under test and RFSICS were co-located in a assume that ‘coloration’ (variation in amplitude, phase
typical wireless office environment, i.e., a room and/or frequency characteristics) induced prior to burst
containing 20–25 active workstations with various detection, transient location, and burst classification
wireless peripherals, personnel with wireless personal is approximately identical as well. This is important
communication devices, a wireless network access in the overall process and ensures that final results
node, composite cubicle partitions, metal book cases, are based on ‘as received’ signal characteristics and
metal filing cabinets, etc. As such, all collected features versus being unduly influenced by signal-
signals inherently include the desired line-of-sight dependent collection and post-processing coloration.
(LOS) signal component as well as in-band interfering To simulate varying SNR conditions, like-filtered noise
components commonly found in such an environment, is added prior to analysis. This is done by generating
e.g., non-LOS multipath, intra-system multiple access, random complex AWGN that is filtered using the
inter-system coexistence, etc. same digital filter as used for the signal. The filtered
Basic functionality of the RFSICS is provided by noise power is then calculated and used to scale the
Agilent’s E3238S system [34]. This includes an RF filtered AWGN to achieve the appropriate analysis SNR
front-end collection range of 20.0 MHz to 6.0 GHz when added to the filtered signal. A representative
from which a band of interest is selected using a tunable 802.11a RF burst is shown in Figure 6 at the
RF filter with fixed bandwidth of 36.0 MHz. The collected SNR and analysis SNRs of SNR = 10 dB and
selected RF band is down-converted to an intermediate SNR = 0 dB.
frequency (IF) of 70.0 MHz and passed to a digitizer.
The digitizing process consists of down-conversion
3.4. Threshold Determination
(near baseband), 12-bit analog-to-digital conversion
at 95 M samples-per-second (SPS), digital filtering Three distinct threshold values are required, one each
(user defined bandwidth), Nyquist compliant sub- for burst detection, burst location, and denoising
sampling, and data storage as complex in-phase (I) and when the Denoised VT process is employed. All
quadrature (Q) components. A digital filter bandwidth SNR-dependent threshold values are determined a
of 18.56 MHz was selected for all 802.11a signals priori based on noise-only analysis using 100 000
collected for this work. This resulted in the RFSICS AWGN realization. When evaluating the Denoised VT
automatically applying a sub-sampling factor of 4, technique, the DT-CWT denoising threshold tdenoise in
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
78 R. W. KLEIN, M. A. TEMPLE AND M. J. MENDENHALL

Amplitude
5
Traditional VT and Denoised VT techniques for −3 ≤
SNR ≤ 10 dB.
0
−0.5 0 0.5 1 1.5 2 2.5 3
Time (Secs * 10 −5 )

4.1. Burst Detection

Amplitude

0 ROC curves were calculated as described in Step 2

−0.5 0 0.5 1 1.5 2 2.5 3
Time (Secs * 10 −5 )
of Section 3.2 to characterize performance differences
between the two burst detection techniques. Results in
Amplitude

5
Figure 7 show that at both SNR = 6 dB and SNR =
0
0 dB, the Denoised VT technique provides a higher
−0.5 0 0.5 1 1.5 2 2.5 3
Time (Secs * 10 −5 )
probability of detection (Pd ) for a given probability of
false alarm (Pfa ). With a higher Pd for a given Pfa , the
Fig. 6. Instantaneous amplitude: (Top) collected signal, Denoised VT technique passes more bursts to the next
(Middle) filtered signal-plus-AWGN at SNR = 10 dB, and
(Bottom) filtered signal-plus-AWGN at SNR = 0 dB.
step when compared with Traditional VT. With more
bursts passing, it is possible to correctly classify the
device in less time and have a higher confidence in the
Section 3.1 is established using random realizations of classification.
noise that are generated, filtered, scaled (for appropriate
SNR), DT-CWT transformed and coefficients retained
for threshold determination. The remaining burst (a) 1

detection threshold (tdetect ) and burst location threshold

(tlocate ) are determined using a similar noise-only
analysis with appropriate window parameters for the
given technique. In all cases, results from 100 000 0.95

iterations are histogrammed and the threshold value

empirically chosen.
Pd

The DT-CWT denoising threshold value (tdenoise ) is

empirically chosen and corresponds to the histogram 0.9

bin value below which 95% of the noise-only values

occur. The burst detection threshold value (tdetect ) Traditional VT
Denoised VT
is chosen using conventional noise-only analysis of
probability of false alarm (Pfa ) and probability of 0.85
0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5
detection (Pd ) as represented on a receiver operating Pfa
characteristic (ROC) curve. Results of this analysis are
(b) 1
reported in Section 4.1.
The burst start location threshold value (tlocate ) is 0.95
chosen such that there is a trade-off between the number
of early burst location estimates (Time < 0 s) versus 0.9
the number of algorithm non-convergent solutions.
The actual values chosen were selected to ensure that 0.85
Pd

both of these conditions are present and observable

0.8
in the data. When comparing the Traditional VT and
Denoised VT processes, the threshold is constrained 0.75
to provide a similar number of early locates (10%) for
both techniques to illicit a more fair comparison. Traditional VT
0.7
Denoised VT

0.65
0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5
Pfa
4. Results
Fig. 7. Probability of false alarm (Pfa ) versus probability of
Burst detection, burst start location, and device detection (Pd ) ROC curves for Traditional VT and Denoised
classification results are presented for both the VT techniques at (a) SNR = 6 dB and (b) SNR = 0 dB.
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
 APPLICATION OF WAVELET DENOISING 79

4.2. Burst Location

To isolate the effects of burst location accuracy from
burst detection error, the RF bursts were manually
detected prior to burst location analysis. Thus, there
is no noise-only data input to this process to generate
false alarms and Pd = 100%. Plots in this section share
two common attributes, including (1) the correct burst
locations occur at Time = 0 s and (2) the default non-
convergent solutions occur at Time = 1.5 ␮s (see Step
2 of Section 3.2). For all −3 ≤ SNR ≤ 10 dB, the
Denoised VT technique outperforms the Traditional
VT technique by maintaining a more precise and
accurate burst start location estimate while converging
to a solution more often (fewer non-convergent
solutions).
These results illustrate the combined effects of noise
and burst-to-burst signal variability. In this case, 500
AWGN realizations were scaled for each SNR and
added to each of the 200 collected bursts—a total of
100 000 unique AWGN realizations per SNR. Results
for Traditional VT and Denoised VT estimation are
shown in Figure 8. Analysis of these results indicates
that the Denoised VT technique outperforms the
Traditional VT technique by (1) correctly locating
74.7% more of the burst start locations while (2)
experiencing 30.2% fewer non-convergent solutions,
i.e., fewer estimated starts at the default value of
Error = 1.5 ␮s.
In an operational implementation, only those bursts
causing location convergence according to Step 2 of Fig. 8. Burst location histograms showing impact of
Section 3.2 would be used for further processing. Combined variation across bursts and AWGN realizations
Therefore, for comparing classification performance using 200 bursts and 500 independent noise realizations.
Non-convergent algorithm solutions located at default value
of the two techniques this research only used bursts
of Error = 1.5 ␮s. (a) Traditional VT and (b) Denoised VT.
that resulted in a converged location solution with
both techniques. As per Section 3.2, these bursts are
denoted as being ‘dual convergent’. All other bursts
impact of burst estimation on MDA-ML classification
that resulted in a converged location solution with
performance. The multi-dimensional MDA-ML input
only one of the two technique are excluded from
data represents the signal ‘fingerprint’ which consists
subsequent classification given they could unduly bias
of variance, kurtosis, and skewness statistics calculated
results towards the technique having more converged
over the instantaneous amplitude, instantaneous
solutions. The burst start location error probability
frequency, and instantaneous phase responses of the
distribution for ‘dual convergent’ bursts is shown in
802.11a preamble region.
Figure 9 for two analysis SNRs. The distribution
A K-fold cross validation and Monte Carlo process
differences (and their associated ‘fingerprints’) account
was used to ensure statistical significance in simulated
for the only differences between the two techniques
results. While the actual required value of K to
being processed by the classifier.
produce validated results can vary as a function of
data ‘behavior’, the values of K = 5 and K = 10 are
common choices for K-fold cross validation [35]. As
4.3. Burst Classification
an example, for 200 ‘dual convergent’ bursts per device
A total of 200 802.11a bursts were collected from with K = 5 cross validation, the input data set is
three different devices and used to demonstrate the partitioned into five equal subsets (40 bursts each),
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
80 R. W. KLEIN, M. A. TEMPLE AND M. J. MENDENHALL

(a) 0.7 input data using W and classifying each per ML

criteria; (6) storing/accumulating classification results;
0.6 Traditional VT
Denoised VT (7) circularly shifting (re-ordering) the collected bursts
0.5
by 20%; (8) repeating Step 4 through Step 7 a total
of four more times; (9) repeating Step 1 through Step
0.4 8 a total of 500 times using different independent
PDF

AWGN realizations for each iteration; (10) averaging

0.3 accumulated classification results from Step 6 to obtain
overall classification performance.
0.2
A similar process was used in Reference [14]
0.1 to show that MDA-ML classification performance
with Traditional VT location estimation approaches
0
−5 0 5 10 15 20
that of Perfect location estimation for 10 ≤ SNR ≤
Error (Secs * 10 −6 )
30 dB, with notably poorer performance achieved for
−3 ≤ SNR ≤ 10 dB. Therefore, this work specifically
(b) 0.16 proposes the use of denoising in the lower SNR region
0.14 Traditional VT where performance improvement is realizable. This
Denoised VT
is done by iteratively applying the above process for
0.12
−3 ≤ SNR ≤ 10 dB in 1.0 dB steps. In practice, the
0.1 decision on whether or not to employ denoising could
be based on SNR estimates.
PDF

0.08
Results in Figure 10 shows average MDA-ML
0.06 classification performance including burst detection
error effects for Perfect, Traditional VT, and Denoised
0.04
VT burst detection methods. In this case, ‘Perfect’
0.02 results were obtained using a manual burst detection
and location process based on visual inspection of
0
−5 0 5 10 15 20 instantaneous amplitude responses from each burst.
Error (Secs * )10−6 As shown, the Perfect results provide an upper
Fig. 9. Burst location error probability for distribution for bound on achievable performance. Results for the VT
‘dual convergent’ bursts: (a) SNR = 6 dB and (b) SNR = and Denoised VT methods are similar for SNR >
0 dB. 6 dB and SNR < −2 dB. For −1 < SNR < 5 dB, the

with four subsets (160 bursts) used for training and 80

the remaining ‘held out’ subset (40 bursts) used for
75
classification [35].
The overall K-fold cross validation and Monte Carlo 70
Classification Accuracy (%)

simulation process included (1) generating, filtering, 65

and scaling AWGN to achieve the desired SNR; (2)
estimating the burst start location using the method 60

being evaluated; (3) determining which bursts are 55

‘dual convergent’, as per Section 4.2, and determining
50
the minimum ‘dual convergent’ bursts for the three
devices to ensure an equal number of samples for 45
Perfect
each device; (4) generating projection matrix W as Traditional VT
40
Denoised VT
per Step 4 of Section 3.2 using the first 80% ‘dual
convergent’ bursts from each device for training 35
−2 0 2 4 6 8 10
the projection matrix W for MDA and computing SNR (dB)

the parameters for the likelihoods used for the ML Fig. 10. Average MDA-ML classification accuracy for ‘dual
classifier; (5) transforming the remaining 20% ‘dual convergent’ bursts including burst detection error effects for
convergent’ bursts from each device as ‘unknown’ various burst detection methods.
Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
 APPLICATION OF WAVELET DENOISING 81

Table I. MDA/ML classification confusion matrix for various burst were used to demonstrate performance of the Denoised
detection methods at SNR = 3 dB.
VT technique at varying SNR. As implemented with
DT-CWT processing, the Denoised VT technique
Class estimate outperforms the Traditional VT technique in all areas,
Input class A B C including burst detection, burst start location, and
device classification. For burst detection, the denoising
Perfect technique provides more positive detections for a
A 68% 21% 11% given false alarm rate. For burst start location, the
B 31% 44% 25% denoising technique is 74.7% more precise in finding
C 14% 17% 69%
burst start locations and experiences 30.2% fewer
Traditional VT non-convergent solutions. Finally, device classification
A 67% 22% 11% performance was demonstrated using extracted RF
B 31% 42% 27%
C 22% 21% 57%
fingerprints and MDA with ML classification. Relative
to the Traditional VT technique, the Denoised VT
Denoised VT
process emerges as a better alternative at lower
A 67% 21% 12% SNRs and yields a classification performance increase
B 30% 43% 27%
C 18% 19% 63% of 1.75% (on average) or a 34% improvement
towards achieving ‘perfect’ burst location estimation
performance.

Denoised VT technique outperforms the Traditional

VT technique and provides an average improvement Acknowledgments
in classification accuracy of 1.75%, which is a
34% improvement towards the Perfect case upper This research was supported by the Sensors
bound. Directorate, Air Force Research Laboratory, and the
Classification performance is commonly illustrated Tactical SIGINT Technology (TST) Program.
using a confusion matrix that shows the percentage
of time a particular input class is estimated as one
of the possible classes, with the bold diagonal entries References
representing correct classification performance for a
given device. Classification results for the SNR = 1. Chen Y, Trappe W, Martin R. Detecting and localizing wireless
spoofing attacks. IEEE Conference on Sensor, Mesh and AdHoc
3 dB data points in Figure 10 are shown in Table I. Comm and Nets (SECON), June 2007; 193–202.
As indicated in the table, the greatest improvement 2. Sheng Y, Tan K, Chen G, Kotz D, Campbell A. Detecting
that Denoised VT provided when compared with 802.11 MAC layer spoofing using received signal strength. IEEE
27th Annual Conference on Computer Communications, April
Traditional VT is in correctly classifying Class C. 2008.
Comparing Perfect to Traditional VT, there is only a 3. Suski WC, Temple MA, Mendenhall MJ, Mills RF. Using
1–2% margin for improvement in correctly classifying spectral fingerprints to improve wireless network security.
In Proceedings of the 2008 IEEE Global Communications
Class A and Class B, respectively. However, there is a Conference, November–December 2008.
12% margin for improvement for Class C. Here, the 4. Suski WC, Temple MA, Mendenhall MJ, Mills RF. Radio
Denoised VT provides a 6% gain which represents a frequency fingerprinting commercial communication devices to
enhance electronic security. International Journal Electronic
50% improvement towards achieving Perfect transient Security and Digital Forensics 2008; 1(3): 301–322.
location performance. 5. Ureten O, Serinken N. Wireless security through RF
fingerprinting. Canadian Journal of Electrical and Computer
Engineering 2007; 32(1): 27–33.
6. Langley LE. Specific emitter identification (SEI) and classical
5. Conclusion parameter fusion technology. IEEE Western Electronics Show
and Conference (WESCON), September 1993; 277–381.
7. Hall J, Barbeau M, Kranakis E. Using transceiverprints for
Previous work provided noise sensitivity analysis for anomaly based intrusion detection. 3rd IASTED International
VT burst detection and highlighted the need for more Conference on Communication, Internet and Information
robust processing at lower SNRs. A new technique is Technology (CIIT), November 2004.
8. Hall J, Barbeau M, Kranakis E. Detection of transient in radio
presented here that uses a DT-CWT to denoise signals frequency fingerprinting using signal phase. IASTED Interna-
and improve overall VT capability. Instantaneous tional Conference on Wireless and Optical Communications,
amplitude responses from collected 802.11a signals May 2003.

Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec
82 R. W. KLEIN, M. A. TEMPLE AND M. J. MENDENHALL

9. Ureten O, Serinken N. Detection of radio transmitter turn-on 22. Frisch M, Messer H. Detection of a known transient signal of
transients. IEE Electronics Letters 1999; 35(23): 1996–1997. unknown scaling and arrival time. IEEE Transactions on Signal
10. Ureten O, Serinken N. Bayesian detection of WiFi transmitter Processing 1994; 42(7): 1859–1863.
RF fingerprints. IEE Electronics Letters 2005; 41(6): 373–374. 23. Del Marco SP, Weiss JE. M-band wavepacket-based transient
11. Serinken N, Ureten O. Generalised dimension characterization signal detector using a translation-invariant wavelet transform.
of radio transmitter turn-on transients. IEE Electronics Letters Optical Engineering 1994; 33: 2175–2182.
2000; 36(12): 1064–1064. 24. Fernandes Da Rocha Pitta J, Hippenstiel R, Fargues M. Transient
12. Dudczyk J, Matuszewski J, Wnuk M. Applying the radiated detection using wavelets. Master’s Thesis, Naval Post Graduate
emission to specific emitter identification. International Con- School, Monterey, CA, March 1995.
ference on Microwaves, Radar and Wireless Communications, 25. Del Marco SP, Weiss JE. Improved transient signal detection
May 2004; 431–434. using a wavepacket-based detector with an extended translation-
13. Kawalec A, Rapacki T, Wnuczek S, Dudczyk J, Owczarek R. invariant wavelet transform. IEEE Transactions on Signal
Mixed method based on intrapulse data and radiated emission Processing 1997; 45(4): 841–850.
to emitter sources recognition. 15th International Confer- 26. Thiruvengadam SJ, Chinnadurai P, Thirumalai Kumar N,
ence on Microwaves, Radar and Wireless Communications, Abhaikumar V. Wavelet based signal processing algorithms
May 2004. for early target detection. 2003 Conference on Convergent
14. Klein RW, Temple MA, Mendenhall MJ, Reising DR. Sensitivity Technologies for Asia-Pacific Region, Vol. 3, October 2003;
analysis of burst detection and rf fingerprinting classification 1175–1179.
performance. In Proceedings of the 2009 IEEE International 27. Dutta A, Anand GV. Detection of transient signals by wavelet
Conference on Communications, June 2009. packet transform and stochastic resonance. 2004 IEEE Region
15. Ureten O, Serinken N. Improved coarse timing for burst 10 Conference, Vol. 1, November 2004; 251–254.
mode ofdm. Global Telecommunications Conference, 2007. 28. Fabbroni L, Vannucci M, Cuoco E, Losurdo G, Mazzoni M,
GLOBECOM ’07. IEEE, November 2007; 2841–2846. Stanga R. Wavelet tests for the detection of transients in the virgo
16. Ureten O, Pacheco RA, Serinken N, Hatzinakos D. Bayesian interferometric gravitational wave detector. IEEE Transactions
frame synchronization for 802.11a wlans: experimental results. on Instrumentation and Measurement 2005; 54(1): 151–
Canadian Conference on Electrical and Computer Engineering, 162.
2005, May 2005; 884–887. 29. Selesnick IW, Baraniuk RG, Kingsbury NC. The dual-tree
17. Pacheco RA, Ureten O, Hatzinakos D, Serinken N. Bayesian complex wavelet transform. IEEE Signal Processing Magazine
frame synchronization using periodic preamble for ofdm-based 2005; 22(6): 123–151.
wlans. IEEE Signal Processing Letters 2005; 12(7): 524–527. 30. Bayram I, Selesnick IW. On the dual-tree complex wavelet
18. Azzouz E, Nandi A. Automatic Modulation Recognition of packet and m-band transforms. IEEE Transactions on Signal
Communication Signals. Kluwer Academic: Boston, 1996. Processing 2008; 56(6): 2298–2310.
19. Carmona RA. Wavelet identification of transients in noisy time 31. IEEE Computer Society. IEEE Std 802.11-2007, June 2007.
series. In Proceedings of SPIE: Wavelet Applications in Signal 32. Fisher RA. The use of multiple measurements in taxonomic
and Image Processing, Vol. 2034, November 1993; 392–400. problems. Annals of Eugenics 1936; 7: 179–188.
20. Frisch M, Messer H. Detection of a transient signal of unknown 33. Duda RO, Hart PE, Stork DG. Pattern Classification (2nd edn).
scaling and arrival time using the discrete wavelet transform. John Wiley & Sons, Inc.: New York, 2001.
1991 International Conference on Acoustics, Speech, and Signal 34. Agilent Technologies Inc., USA. Agilent E3238 Signal Intercept
Processing (ICASSP-91), Vol. 2, April 1991; 1313–1316. and Collection Solutions: Family Overview, Publication 5989-
21. Frisch M, Messer H. The use of the wavelet transform in the 1274EN, July 2004.
detection of an unknown transient signal. IEEE Transactions on 35. Hastie T, Tibshirani R, Friedman J. Data Mining, Inference, and
Information Theory 1992; 38(2): 892–897. Prediction. Springer: New York, USA, 2001.

Published in 2009 by John Wiley & Sons, Ltd. Security Comm. Networks. 2010; 3:71–82
DOI: 10.1002/sec