Automatic Modulation Parameter Detection In Practice Johannes Pohl and Andreas Noack November 28, 2019
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Proprietary wireless protocols everywhere Example: Smart Home Increase comfort of users through wireless sockets, door locks, valve sensors . . . Devices are designed under size and energy constraints Limited resources for cryptography Risks of Smart Home Manufactures design custom proprietary wireless protocols Hackers may take over households and, e.g., break in without physical traces How can we speed up the security investigation of proprietary wireless protocols? November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 2
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Software Defined Radio Why Software Defined Radios? Send and receive on nearly arbitrary frequencies a Flexibility and extendability with custom software a e.g. HackRF: 1 MHz to 6 GHz (a) USRP N210 (b) HackRF November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 3
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Universal Radio Hacker November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 4
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Universal Radio Hacker Popularity Supported Platforms Available at official linux repositories Windows � , Linux � and OS X URH is available in official repositories of Arch Linux , Gentoo , Void Linux , Fedora and openSUSE (and homebrew for macOS). Most starred repo on GitHub with #sdr tag Publications DeepSec 2018 [1] Blackhat Arsenal USA 2017 [2] Blackhat Arsenal Europe 2018 [3] WOOT 2018 (USENIX Workshop) [5] IoT S&P 2017 (CCS Workshop) [6] November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 5
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Digital Modulations Bits 1 0 1 0 0 So what is a digital modulation? + Mapping the binary data, i.e. bits , to Carrier a analog carrier to transport the signal over the air ASK Analog signal has the form A · sin(2 π Ft + ϕ ) We can transport information in FSK amplitude A , frequency F or phase ϕ Amplitude Shift Keying (ASK) PSK Frequency Shift Keying (FSK) Phase Shift Keying (PSK) November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 6
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Interpretation in URH Demodulating signals made easy Interpretation Phase Features (apart from demodulation) Synchronized selection between demodulated and raw signal Signal Editor , that is, copy, paste, crop, mute signal selections Configurable moving average and bandpass filters How can we make this even simpler? Automatically detect modulation parameters! November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 7
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Visualization of Parameters For all plots: x axis represents current sample 1 T noise 0 A − T noise − 1 0 1 , 000 2 , 000 3 , 000 4 , 000 5 , 000 6 , 000 7 , 000 1 0 A − 1 0 200 400 600 800 1 , 000 1 , 200 1 , 400 1 , 600 Inst. Freq. 0 . 3 0 . 2 center 0 . 1 Bit length 0 200 400 600 800 1 , 000 1 , 200 1 , 400 1 , 600 November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 8
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Detecting Modulation Parameters Automatic detection of modulation type and parameters in Interpretation IQ Signal Message T noise Non-weak Noise level Modulation Segmen- detection segments Detection tation M Quadrature Rectangular center Bit Length Center Demod- Detection Detection signal ulation November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 9
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Noise Level Detection Finding the noise level T noise of a signal is the basis for message segmentation and works the following way: 1 Divide the signal into equal sized chunks C i . 2 For each chunk, calculate the mean magnitude m i = | C i | . 3 Get minimum mean magnitude m min = min { m i : ∀ i } . 4 Pick magnitudes of chunks those mean magnitudes do not exceed m min by 10%: M noise = {| C j | , m j < 1 . 1 · m min } Finally, the noise level T noise is returned as the maximum of M noise , to cover the full noise range. November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 10
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Message Segmentation: Separate Messages from Noise Message Segmentation Algorithm Based on noise level T noise from previous step Must be robust against outliers Use two internal states: s noise – reading noise, s msg – reading message. Switch states only if consequent samples above/below noise ( c a / c b ) surpass a threshold t o (= outlier tolerance ). In practice, t o = 10 samples performs well. c b ≥ t o s msg s noise c a ≥ t o November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 11
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Modulation Detection with help of Wavelet Transform 5 10 | HWT | | HWT | | HWT | 8 4 6 9 . 5 3 0 500 1 , 000 0 500 1 , 000 0 500 1 , 000 τ τ τ (b) 2-ASK (c) 2-PSK (a) 2-FSK 5 9 . 27 10 | HWT | | HWT | | HWT | 9 . 26 4 9 . 25 9 . 5 3 9 . 24 0 500 1 , 000 0 500 1 , 000 0 500 1 , 000 τ τ τ (e) Normalized 2-ASK (f) Normalized 2-PSK (d) Normalized 2-FSK Figure: Wavelet transforms for FSK/ASK/PSK signals and their amplitude normalized versions November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 12
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Modulation Detection: Feature Extraction Signal σ 2 | HWT | Median filter Variance 1 normalization σ 2 Variance Signal 2 σ 2 | HWT | Median filter Variance 3 σ 2 Variance 4 November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 13
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Modulation Detection: Decision Tree ASK yes σ 2 2 > 1 . 5 · σ 2 PSK 4 yes no no σ 2 σ 2 2 > 10 · σ 2 i < 0 . 15 ∀ i FSK 1 yes no yes Pass FFT OOK check no OOK November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 14
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Center Detection: Take mean of histogram peaks 1 0 A − 1 0 200 400 600 800 1 , 000 1 , 200 1 , 400 1 , 600 Sample (a) 2-FSK modulated message Inst. Freq. 100 0 . 25 Count 0 . 2 50 c = 0 . 125+0 . 25 0 . 15 2 0 . 1 0 0 500 1 , 000 1 , 500 0 . 1 0 . 15 0 . 2 0 . 25 Sample Instantaneous Frequency (b) Rectangular signal R ( n ) after Quad Demod (c) Histogram of R ( n ) with two peaks November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 15
Introduction Automate the Interpretation Experimental Validation Going live Further Steps References Bit-Length and Tolerance Detection How to determine the Bit-Length? Count subsequent samples above/below found center ⇒ plateau lengths vector In theory, vector only contains multiples of bit-length; but: interrupted by outliers Set tolerance to maximum of values smaller than 5% of maximum plateau length Merge plateaus based on found tolerance like this: (200 , 100 ) → (200 , 200 ) , 53 , 3 , 44 , 100 ���� ���� ���� ���� ���� ���� ���� ���� Hi Lo Hi Lo Hi Hi Lo Hi Count how often each plateau length nearly divides other lengths, e.g., for (40 , 40 , 40 , 40 , 40 , 30 , 50 , 30 , 90 , 40 , 40 , 80 , 160 , 30 , 50 , 30) the counts are N near = { 30 : 10 , 40 : 35 , 50 : 3 , 80 : 2 } so bit-length is 40 (most frequent) November 28, 2019 Johannes Pohl and Andreas Noack Automatic Modulation Parameter Detection In Practice Slide 16
Recommend
More recommend
