Improving Zig Bee Device Network Authentication Using Ensemble Decision Tree Classifiers With Radio Frequency Distinct Native Attribute Fingerprinting
Improving Zig Bee Device Network Authentication Using Ensemble Decision Tree Classifiers With Radio Frequency Distinct Native Attribute Fingerprinting
复制标题
DOI：
10.1109/tr.2014.2372432
复制
发表时间：
2015-03-01
影响因子：
5.9
通讯作者：
Baldwin, Rusty O.
中科院分区：
文献类型：
--
作者：
Patel, Hiren J.;Temple, Michael A.;Baldwin, Rusty O.
ZigBee设备由于其低成本和低功耗，在家庭自动化、交通、交通管理和工业控制系统（ICS）应用中的普及程度持续增长。然而，ZigBee ad-hoc网络的分散式架构为网络入侵检测和预防带来了独特的安全挑战。过去，ZigBee设备认证可靠性通过射频独特原生属性（RF-DNA）指纹识别来增强，该指纹识别使用基于Fisher的多重判别分析和最大似然（MDA-ML）分类过程来区分低信噪比（SNR）环境中的设备。然而，当RF-DNA特征不满足高斯正态性条件时，MDA-ML性能固有地降低，这通常发生在存在射频（RF）多径和来自其他设备的干扰的真实场景中。我们将非参数随机森林（RndF）和多类AdaBoost（MCA）集成分类器引入RF-DNA指纹竞技场，并展示了改进的ZigBee设备认证。使用相同的输入特征集的参数MDA-ML和广义相关学习矢量量化改进（GRLVQI）分类器的结果进行了比较。指纹降维检查使用三种方法，即预分类Kolmogorov-Smirnoff测试（KS测试），分类后RndF特征相关性排名，和GRLVQI特征相关性排名。使用集成方法，在%C = 90%的任意正确分类率（%C）基准下，实现了比MDA-ML处理SNR = 18.0 dB的改善;对于所有SNR，考虑[0，30] dB的元素，MDA-ML的%C改善范围为9%至24%。相对于GRLVQI处理，系综方法再次提供了所有SNR的改善，其中在最低测试SNR = 0.0 dB处实现了%C = 10%的最佳改善。使用流氓ZigBee设备测量的网络渗透表明，在SNR = 12.0 dB（%C = 90%）时，基于接收器操作特性（ROC）曲线分析和RAR <10%的任意流氓接受率，集成方法正确地拒绝了36次流氓访问尝试中的31次。这一性能优于MDA-ML和GRLVQI，它们分别拒绝了25/36和28/36的流氓访问尝试。集成方法处理的主要优点是改善了噪声环境中的流氓抑制;在GRLVQI和MDA-ML上分别实现了6.0 dB和18.0 dB的增益。综合考虑所展示的%C和流氓拒绝能力，集成方法的使用改进了ZigBee网络认证，并增强了由RF-DNA指纹识别提供的反欺骗保护。
The popularity of ZigBee devices continues to grow in home automation, transportation, traffic management, and Industrial Control System (ICS) applications given their low-cost and low-power. However, the decentralized architecture of ZigBee ad-hoc networks creates unique security challenges for network intrusion detection and prevention. In the past, ZigBee device authentication reliability was enhanced by Radio Frequency-Distinct Native Attribute (RF-DNA) fingerprinting using a Fisher-based Multiple Discriminant Analysis and Maximum Likelihood (MDA-ML) classification process to distinguish between devices in low Signal-to-Noise Ratio (SNR) environments. However, MDA-ML performance inherently degrades when RF-DNA features do not satisfy Gaussian normality conditions, which often occurs in real-world scenarios where radio frequency (RF) multipath and interference from other devices is present. We introduce non-parametric Random Forest (RndF) and Multi-Class AdaBoost (MCA) ensemble classifiers into the RF-DNA fingerprinting arena, and demonstrate improved ZigBee device authentication. Results are compared with parametric MDA-ML and Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) classifier results using identical input feature sets. Fingerprint dimensional reduction is examined using three methods, namely a pre-classification Kolmogorov-Smirnoff Test (KS-Test), a post-classification RndF feature relevance ranking, and a GRLVQI feature relevance ranking. Using the ensemble methods, an SNR = 18.0 dB improvement over MDA-ML processing is realized at an arbitrary correct classification rate (%C) benchmark of %C = 90%; for all SNR is an element of [0,30] dB considered, %C improvement over MDA-ML ranged from 9% to 24%. Relative to GRLVQI processing, ensemble methods again provided improvement for all SNR, with a best improvement of %C = 10% achieved at the lowest tested SNR = 0.0 dB. Network penetration, measured using rogue ZigBee devices, show that at the SNR = 12.0 dB (%C = 90%) the ensemble methods correctly reject 31 of 36 rogue access attempts based on Receiver Operating Characteristic (ROC) curve analysis and an arbitrary Rogue Accept Rate of RAR < 10%. This performance is better than MDA-ML, and GRLVQI which rejected 25/36, and 28/36 rogue access attempts respectively. The key benefit of ensemble method processing is improved rogue rejection in noisier environments; gains of 6.0 dB, and 18.0 dB are realized over GRLVQI, and MDA-ML, respectively. Collectively considering the demonstrated %C and rogue rejection capability, the use of ensemble methods improves ZigBee network authentication, and enhances anti-spoofing protection afforded by RF-DNA fingerprinting.