Automatic Modulation Parameter Detection in Practice
Total Page：16
File Type：pdf, Size：1020Kb
Automatic Modulation Parameter Detection In Practice Johannes Pohl and Andreas Noack November 28, 2019 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Proprietary wireless protocols everywhere Example: Smart Home Increase comfort of users through wireless sockets, door locks, valve sensors . Devices are designed under size and energy constraints Limited resources for cryptography Risks of Smart Home Manufactures design custom proprietary wireless protocols Hackers may take over households and, e.g., break in without physical traces How can we speed up the security investigation of proprietary wireless protocols? November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 2 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Software Defined Radio Why Software Defined Radios? Send and receive on nearly arbitrary frequenciesa Flexibility and extendability with custom software ae.g. HackRF: 1 MHz to 6 GHz (a) USRP N210 (b) HackRF November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 3 Interpretation 101010 Stateless Stateful Analysis Format Format Generation Simulation Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Universal Radio Hacker November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 4 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Universal Radio Hacker Popularity Supported Platforms Available at official linux repositories Windows q, Linux ± and OS X URH is available in official repositories of Arch Linux, Gentoo, Void Linux, Fedora and Most starred repo on GitHub with openSUSE (and homebrew for macOS). #sdr tag Publications DeepSec 2018 [1] Blackhat Arsenal USA 2017 [2] Blackhat Arsenal Europe 2018 [3] WOOT 2018 (USENIX Workshop) [5] IoT S&P 2017 (CCS Workshop) [6] November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 5 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Digital Modulations So what is a digital modulation? Bits 1 0 1 0 0 + Mapping the binary data, i.e. bits, to Carrier a analog carrier to transport the signal over the air Analog signal has the form ASK A sin(2πFt + ϕ) · We can transport information in FSK amplitude A, frequency F or phase ϕ Amplitude Shift Keying (ASK) Frequency Shift Keying (FSK) PSK Phase Shift Keying (PSK) November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 6 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Interpretation in URH Demodulating signals made easy Interpretation Phase Features (apart from demodulation) Synchronized selection between demodulated and raw signal Signal Editor, that is, copy, paste, crop, mute signal selections Configurable moving average and bandpass filters How can we make this even simpler? Automatically detect modulation parameters! November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 7 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Visualization of Parameters For all plots: x axis represents current sample 1 Tnoise A 0 T 1 − noise − 0 1,000 2,000 3,000 4,000 5,000 6,000 7,000 1 A 0 1 − 0 200 400 600 800 1,000 1,200 1,400 1,600 0.3 0.2 center 0.1 Bit length Inst. Freq. 0 200 400 600 800 1,000 1,200 1,400 1,600 November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 8 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Detecting Modulation Parameters Automatic detection of modulation type and parameters in Interpretation IQ Signal Message Noise level Tnoise Non-weak Modulation Segmen- detection segments Detection tation M Quadrature Bit Length center Center Rectangular Demod- Detection Detection signal ulation November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 9 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Noise Level Detection Finding the noise level Tnoise of a signal is the basis for message segmentation and works the following way: 1 Divide the signal into equal sized chunks Ci . 2 For each chunk, calculate the mean magnitude m = C . i | i | 3 Get minimum mean magnitude m = min m : i . min { i ∀ } 4 Pick magnitudes of chunks those mean magnitudes do not exceed mmin by 10%: M = C , m < 1.1 m noise {| j | j · min} Finally, the noise level Tnoise is returned as the maximum of Mnoise, to cover the full noise range. November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 10 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Message Segmentation: Separate Messages from Noise Message Segmentation Algorithm Based on noise level Tnoise from previous step Must be robust against outliers Use two internal states: snoise – reading noise, smsg – reading message. Switch states only if consequent samples above/below noise (ca/cb) surpass a threshold to (=outlier tolerance). In practice, to = 10 samples performs well. c t b ≥ o snoise smsg c t a ≥ o November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 11 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Modulation Detection with help of Wavelet Transform | | | 5 8 10 4 HWT 6 HWT . HWT 9 5 | | | 3 0 500 1,000 0 500 1,000 0 500 1,000 τ τ τ (a) 2-FSK (b) 2-ASK (c) 2-PSK | | | 5 9.27 10 4 9.26 9.25 HWT HWT . HWT 9 5 | | | 3 9.24 0 500 1,000 0 500 1,000 0 500 1,000 τ τ τ (d) Normalized 2-FSK (e) Normalized 2-ASK (f) Normalized 2-PSK Figure: Wavelet transforms for FSK/ASK/PSK signals and their amplitude normalized versions November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 12 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Modulation Detection: Feature Extraction Signal HWT Median filter Variance σ2 normalization | | 1 2 Signal Variance σ2 HWT Median filter Variance σ2 | | 3 2 Variance σ4 November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 13 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Modulation Detection: Decision Tree ASK yes σ2 > 1.5 σ2 PSK 2 · 4 no no yes σ2 < 0.15 i σ2 > 10 σ2 FSK i ∀ 2 · 1 yes no yes Pass FFT OOK check no OOK November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 14 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Center Detection: Take mean of histogram peaks 1 A 0 1 − 0 200 400 600 800 1,000 1,200 1,400 1,600 Sample (a) 2-FSK modulated message 0.25 100 0.2 50 0.125+0.25 0.15 c = 2 0.1 Count Inst. Freq. 0 0 500 1,000 1,500 0.1 0.15 0.2 0.25 Sample Instantaneous Frequency (b) Rectangular signal R(n) after Quad Demod (c) Histogram of R(n) with two peaks November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 15 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Bit-Length and Tolerance Detection How to determine the Bit-Length? Count subsequent samples above/below found center plateau lengths vector ⇒ In theory, vector only contains multiples of bit-length; but: interrupted by outliers Set tolerance to maximum of values smaller than 5% of maximum plateau length Merge plateaus based on found tolerance like this: (200, 53 , 3 , 44 , 100) (200, 100, 200) |{z} |{z} |{z} |{z} |{z} → |{z} |{z} |{z} Hi Lo Hi Lo Hi Hi Lo Hi Count how often each plateau length nearly divides other lengths, e.g., for (40, 40, 40, 40, 40, 30, 50, 30, 90, 40, 40, 80, 160, 30, 50, 30) the counts are N = 30 : 10, 40 : 35, 50 : 3, 80 : 2 so bit-length is 40 (most frequent) near { } November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 16 Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Evaluation with real-world signals # Manufacturer Description Mod. Samplerate SNR Bitlen #Msgs ? Length 1 Action remote (four but- OOK 2 MS/s 10.8 dB 500 19 11.95 Byte tons) for a LED light 2 Audi car open command OOK 5 MS/s 25.8 dB 2400 1 106 Byte 3 Unknown command to sink a OOK 1 MS/s 18.9 dB 300 17 5 Byte bus bollard 4 Brennenstuhl wireless socket re- OOK 1 MS/s 11.7 dB 300 64 13 Byte mote (four buttons) 5 Elektromaten open command for OOK 2 MS/s 16.2 dB 600 11 17 Byte parking gate 6 ESaver remote (four but- 2-FSK 1 MS/s 28.3 dB 100 12 42 Byte tons) for a wireless socket 7 RWE pairing command of 2-FSK 1 MS/s 12.7 dB 100 18 27.17 Byte a wireless socket 8 Scislo garage door open 2-FSK 500 kS/s 14.6 dB 200 8 64.75 Byte command 9 Volkswagen car open command OOK 1 MS/s 32.3 dB 2500 1 53 Byte 10 Xavax radiator valve tem- 2-FSK 1 MS/s 21.8 dB 100 6 231.5 Byte perature command November 28, 2019 Johannes Pohl and Andreas Noack Automatic