A Taxonomy of Multi-Modal Cyber Radio Frequency (CRF) Mitigation Based on Passive Geo-Location and Hardware Characteristics

This paper provides a taxonomy of multi-modal detection of Cyber Radio Frequency (CRF) threats from Malicous-IoT (MIoT). Adversaries are becoming more sophisticated and utilize commodity Software-Defined-Radios (SDRs) to initiate RF attacks. We consider a CRF threat of a fake-cellular-base-station (IMSI-Catcher). To mitigate this threat, an IMSI-Catcher-Catcher is required (i.e. devices that detect IMSI Catchers). Existing solutions have mainly considered software-based solutions which limits their effectiveness. We take a more comprehensive approach by adding (1) geo-Iocation and (2) hardware characteristics. Both encompass imperfections and unique signatures visible in signals rather than in decoded or processed data. Our holistic approach significantly enhances the conceptual possibility of detecting MloT threats, possibly assembled from Commercial-Off-The-Shelf (COTS) devices and even jammers which do not have to comply with any protocol. We believe that this type of approach is of cardinal importance since it constitutes a physical-layer detection mechanism utilizing raw IQ data to handle these adversaries. This is the first paper to present a comprehensive approach that incorporates reliable information from hardware characteristics into raw IQ data, to provide a robust CRF detector.