This article provides a short introduction to RF anomaly detection using machine learning with two practical examples using an autoencoder to detect anomalies in FSK and PSK communication signals.
Introduction to RF Anomaly Detection
RF anomaly detection is a radio signal monitoring task. Anomaly detection can find rare or unusual signal patterns, such as interference events, transmitter defects or new signal types. Once such an anomaly is detected the radio system can react depending on the type of anomaly, e.g. a change in operating frequency, maintenance request or law enforcement.
RF anomaly detection is in principle a classification, that needs to distinguish between two choices:
- Normal behaviour: The currently observed signal properties are common and occur frequently
- Abnormal behaviour: The currently observed signal properties occur only rarely or are unusual
The task of anomaly detection can be solved using modern methods of machine learning and artificial intelligence, which learn anomalies from training data. Training data often consists of a large collection of observed radio data examples, with which a machine learning model is trained. During training, the model focusses to learn typical signal properties, that occur frequently. At the same time it learns rare signal patterns less well, because fewer training data is present from these cases.
The result is a detector, that can classify new data as “normal” or “abnormal”. Anomaly detection is unsupervised learning and therefore does not require any labelled training data (unlike ordinary classification, which is supervised and requires labelled training data). Since anomaly detection is unsupervised, there is no simple objective measure of the success of such a system, which heavily depends on the application.
What is an RF anomaly?
Basically, there is no concrete and objective definition of an anomaly, that can be detected by a machine learning algorithm. Based on the training data, the machine learning model tries to identify signals, that stand out from the mass of data. For an RF signal possible anomalies may include:
- Sporadic interference or unusual noise
- Unusual high or low transmission power
- Unusual radio signal types or modes
- Unusual center frequency
- Unusual transmitted content
- Unusual user or transmitting device
- Unusual occurrence of harmonics, intermodulation or other spurs
Anomaly Detection with Autoencoders
Autoencoders are widely used machine learning models, that are well suited for anomaly detection. An autoencoder is a special type of neural network, that takes some data as input and aims to output exactly the same data. This may sound irrational at first, but a closer look at the structure of an autoencoder reveals the idea behind it: An autoencoder neural network sucessively reduces the data dimensions first and then expands back to the input dimension. This reduction to a lower dimensionality, called latent space, forces the model to learn compact representations of the input data during the training phase. Reconstructing the input image at the output is therefore not a trivial task. Note, that basic autoencoders do not require labelled data, which simplifies the collection of training data.
Autoencoders are useful for anomaly detection in the following way: An anomaly detecting autoencoder is trained to reconstruct the input data as good as possible. This works well for input data examples, that have frequently occurring signal patterns (normal), since these training examples are common in the training data. Reconstructing data with rarely occurring patterns (anomalous) is harder to learn, because there are only few training data with these rare patterns. Consequently, this results in less good reconstruction for anomalous inputs. The ability of the autoencoder to reconstruct a given input data is called “reconstruction error” and is a good metric for the amount of anomaly of an input data.
The following simple procedure for anomaly detection has been applied in this article:
- Train an autoencoder on a large amount of (unlabelled) data from which anomalies are to be detected.
- Record the reconstruction error of the trained autoencoder as an anomaly metric for each data sample
- Abnormal data are the ones with highest reconstruction error
Note, that this is a simple approach to anomaly detection and there is a lot of room for improvement with respect to the training data, model and anomaly metric. However, the following application examples show some use cases for RF anomaly detection.
Application Example 1: FSK communications
As an application example the FSK modulated signal of the German Meteorological Service (DWD) is considered. This radio station continuously transmits weather information on 10.1 MHz modulated onto a 2-FSK RTTY signal with 50 baud and a frequency shift of 450 Hz.
I have recorded this frequency for 2 hours and sliced the signal into short spectrograms of approximately 1 s. With this collection of spectrograms an autoencoder model has been trained and the reconstruction error was used as a measure of anomaly, as shown above. Analyzing the data with the autoencoder results in the following input spectrograms being identified as “most abnormal”:
In fact, most of these spectrograms clearly show typical anomalies, such as interference in the form of short sweeps (probably ionosondes) or continuous CW sine signals visible close to the FSK modulated signal. This shows that, the anomaly detector can identify interference events on the observed channel.
For comparison, here are the “most normal” samples, where interference is absent:
Application Example 2: HF ACARS (HFDL)
HF ACARS or HFDL is an automatic identification system for aircraft, similar to ADS-B, but operating in the HF band at specific frequencies. It transmits short PSK modulated telegrams containing status data, such as GPS position, heading, altitude. It may be useful to detect anomalies occurring at those reserved frequencies, since the stability and integrity of this communication channel is important for aviation safety.
To investigate RF anomaly detection, I have recorded the HF ACARS signal on 11.18 MHz, which is reserved for communcations between aircraft and the ground station located in Reykjavik / Iceland. The typical channel use consists of transmissions of PSK bursts with a duration of 2-4 s.
The total recording time of the HFDL channel for training the anomaly detector is approximately 2 hours. The long recording is sliced into portions of 6.2 s chunks and converted into a spectrogram representation, which is then used to train the autoencoder model. Comparing the input spectrogram with the autoencoder output (=reconstruction error) again provides the measure of anomaly.
The most abnormal signal examples are shown below in the first row. The anomaly detector has mostly detected interference events as anomalies. Here, extra pulsed signals close to the HFDL transmissions are visible. In addition, noise (no transmission) is also sometimes considered as an anomaly, presumably because the frequency was very busy at the time of recording and signal pauses can therefore also be considered as abnormal.
The most normal signal examples shown below contain only the start of the PSK transmission, which is a single strong tone. Probably the autoencoder considers these as normal, because the tone is a characteristic, that is present in every telegram transmission and is even detectable in low SNR conditions.
Conclusion
RF anomaly detection is useful for detecting unusual events in the radio signal spectrum. A simple autoencoder model already provides useful results, as demonstrated with two exemplary FSK and PSK-burst RF signals, for which interferers could be detected. More advanced models and feature selection can improve the quality of the anomaly detection and enable the detection of specific types of anomalies of interest.
If you are interested in RF anomaly detection, please contect me at research@panoradio-sdr.de.
