Real-Time Detection of Radio Receivers Using Stimulated Emissions Colin Stagner, Christopher Osterwise, Daryl Beetner, and Steven Grant Missouri University of Science and Technology
Introduction Challenges to Detection Simulated Performance
RF Mixer IF Filter Local Oscillator Duty Cycle I Superheterodyne receivers can be Matched Filter Detector Periodogram Detector fH I Two-way radios are designed for GMRS LO Emissions, Unstimulated used to initiate explosive devices fRF fIF ROC: Matched Filter Detector with Simulated Noise ROC: Periodogram Detector with Simulated Noise f IF intermittent use 1400 1 ≥ -25 dB 1 I Potential threats can be detected by -15 dB fLO 1200 -30 dB )
locating radio receivers I Receiver deactivates its local ∆ 1000 0.8 0.8 -20 dB oscillator (LO) to conserve power 800 I Receivers use high-frequency 0.6 0.6 600 I There are no emissions of any kind -35 dB ≤ -25 dB signals in their RF mixers Magnitude ( 400 Variable Local Oscillator 0.4 0.4 when the LO is inactive 200 I These signals escape into the fIF = fRF − fLO Stimulation improves the duty cycle 0 True Positive Rate 0.2 -25 dB (area 1.00) True Positive Rate 0.2 -15 dB (area 0.99) environment as unintended I 0 100 200 300 400 500 600 -30 dB (area 0.96) -20 dB (area 0.82) Time (ms) -35 dB (area 0.54) -25 dB (area 0.55) fH = fRF + fLO I 20% when unstimulated 0 0 electromagnetic emissions [1, 2] 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 I 60% when stimulated False Positive Rate False Positive Rate
Emissions’ Frequency Range I Quantitative improvements Unintended Emissions Freq Range (MHz) I Difficult to compare algorithms experimentally Name Min Max Bandwidth (MHz) I The fH frequency depends on I Different initial emissions power GMRS Receiver in TEM Cell, Unstimulated fIF 21.4 21.7 0.3 I The channel the radio is tuned to -60 fLO 440.8 446.3 5.5 Different RF propagation I Superheterodyne radios use mixers I fRF 462.6 467.7 5.2 I The radio’s intermediate frequency -65 2nd LO to perform frequency translation [3] fH 903.4 914.0 10.7 I Tested receiver operating characteristics using a MATLAB simulation -70 I For GMRS radios, this range is I The matched filter detector is more sensitive than existing techniques 1st LO 2x 1st LO fH = 2fRF − fIF -75 I Mixers have multiple unintended about 10 MHz wide I Qualitative improvements -80 Power (dBm) emissions signals I High-frequency oscillators are not unique to radio receivers -85 All signals are either: I Periodogram Detector I If a device has a clock or other sinusoidal output near fLO -90 0 100 200 300 400 500 600 700 800 900 I Local oscillators: locally-generated I Periodogram detector will detect it, causing a false positive Frequency (MHz) I Matched filter detector only reacts to stimulated emissions sinusoids Stream GMRS Receiver in TEM Cell, CW Stimulation Emissions Detection to FFT 1 2 -60 I Mixer outputs: a frequency-translated Vector I Matched filter ensures that the detected device is a radio receiver 1st LO Stimulation N N|x| -65 copy of the signal the radio is receiving N Magnitude Threshold 2nd LO Up 2nd LO EWMA -70 I The mixer outputs consist of: 2x 1st LO Blackman(N) = 0.25 Research to Reality -75 1st IF 1st LO Up fIF Intermediate frequency -80 Power (dBm) I Passive detector: does not require a stimulation signal
-85 fH Up-mixing frequency I Assembled working detector I First proposed in [4] for detecting television sets using a Universal Software -90 I Mixer outputs only occur when the Laptop 0 100 200 300 400 500 600 700 800 900 I Searches for sinusoidal local oscillator emissions Radio Peripheral (USRP) Frequency (MHz) radio is receiving a signal I Uses periodogram averaging to improve sensitivity I Software-defined radio uses an ordinary computer for baseband I The local oscillator duty cycle makes the emissions Amp signal processing Stimulated Emissions non-stationary, decreasing the effectiveness of this approach TX Ant I Low power transmitter (200 mW)
USRP I Completely off-the-shelf components I The stimulated emissions I Demonstrates feasibility of effect: GMRS Stimulated Emissions: 5 kHz LFM Chirp Matched Filter Detector RX Ant constructing a hand-held detector 10000 I Mixer outputs (fH) contain the Stream Emissions to Max Detection original stimulation signal Vector I The USRP System is capable of detecting nearby 5000 |x| N fs I Mixer outputs radiate back into Matched Filter Magnitude N Threshold N superheterodyne receivers in real-time the environment as unintended 0 emissions I Active detector: uses stimulated emissions I Can use this method to inject I Transmits an LFM chirp to the radio receiver References Frequency (Hz) -5000 a known signal into the fH I Searches for the transmitted chirp with a matched filter [5] (1) D. Beetner, S. Seguin, and H. Hubing, “Electromagnetic emissions stimulation and detection system,” emissions -10000 I Optimal linear filter for detecting a known signal in noise United States Patent 7 464 005, 2008 0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 I Example: linear frequency I We know what the unintended emissions signal is (2) S. Seguin, “Detection of low cost radio frequency receivers based on their unintended electromagnetic Time (s) modulated (LFM) chirp emissions and an active stimulation,” Ph.D dissertation, Missouri S&T, 2009. [Online] Available: I Key advantages: Works for arbitrary FM signals http://scholarsmine.mst.edu/thesis/pdf/Seguin_09007dcc80708216.pdf I Integration period is not limited by the LO duty cycle (3) R. Oki and T. Ebisawa, “Double Superheterodyne Receiver,” United States Patent 4 395 777, 1983 (4) B. Wild and K. Ramchandran, “Detecting primary receivers for cognitive radio applications,” Proc. First I Known signals are easier to detect than unknown signals Shift-immunity: LFM chirps are resistant to frequency shift IEEE Int’l Symp. New Frontiers in Dynamic Spectrum Access Networks (DySPAN 2005), Nov. 2005, pp. 124–130 (5) G. Turin, “An introduction to matched filters,” IRE Trans. Inf. Theory, vol. 6, no. 3, pp. 311–329, June 1960
Department of Electrical Engineering - Missouri University of Science and Technology - Rolla, MO Mail: cbsfg8