Non-parametric feature generation for RF-fingerprinting on ZigBee devices

As the Internet of Things becomes a reality, proliferation of wireless devices such as ZigBee nodes has accelerated. Their presence is now wide spread in sensitive areas such as home automation, industrial control systems, medical devices and security systems. As their popularity has increased, so has the urgency to protect and defend these networks. The decentralized nature of ZigBee ad-hoc networks creates unique security challenges for maintaining network security and intrusion detection. RF-fingerprinting provides a unique physical (PHY) layer defense against node counterfeiting by identifying rogue devices through their RF-emissions. In previous work, feature generation from received RF signals was accomplished with parametric variables such as standard deviation, variance, skewness, and kurtosis, all based on the assumption of a normal distribution of a particular region of interest. We show in this work that most collected signals are either multi-modal or non-parametric. Use of non-parametric methods for feature generation such as mean, median, mode, and trend represented by linear model coefficient estimates are shown to be much more applicable to the non-parametric distribution of the collected ZigBee preamble, resulting in improved classification performance of devices. Non-parametric classifier Random Forest is used with both parametric and non-parametric features to provide a classification performance comparison. Performance improvements of upto 9% in correct classification rates have been achieved and an effective gain of 4 dB SNR was realized.1