# A Distributed RF Threat Sensing Architecture
###### Abstract  
The scope of this work is to propose a distributed RF sensing architecture that interconnects and utilizes a cyber security operations center (SOC) to support long-term RF threat monitoring, alerting, and further centralized processing. For the purpose of this work, RF threats refer mainly to RF jamming, since this can jeopardize multiple wireless systems, either directly as a Denial of Service (DoS) attack, or as a means to force a cellular or WiFi wireless client to connect to a malicious system. Furthermore, the possibility of the suggested architecture to monitor signals from malicious drones in short distances is also examined. The work proposes, develops, and examines the performance of RF sensing sensors that can monitor any frequency band within the range of 1 MHz to 8 GHz, through selective band pass RF filtering, and subsequently these sensors are connected to a remote SOC. The proposed sensors incorporate an automatic calibration and time-depended environment RF profiling algorithm and procedure for optimizing RF jamming detection in a dense RF spectrum, occupied by heterogeneous RF technologies, thus minimizing false-positive alerts. The overall architecture supports TCP/IP interconnections of multiple RF jamming detection sensors through an efficient MQTT protocol, allowing the collaborative operation of sensors that are distributed in different areas of interest, depending on the scenario of interest, offering holistic monitoring by the centralized SOC. The incorporation of the centralized SOC in the overall architecture allows also the centralized application of machine learning algorithms on all the received data. wireless security; wireless threats; cyber; security operations center (SOC); RF jamming; RF sensing +
Footnote †: journal: Information Letters  
security and wireless system resilience are essential elements that need to be safeguarded due to their increased vulnerability [8] as well as the evolution of enhanced intentional passive attacks or active interference/jamming techniques [9]. Jamming is defined as an active adversary attack that transmits energy to disrupt wireless communications, and can drastically degrade system performance [10]. A comprehensive survey on jamming attacks and anti-jamming strategies in wireless networks is given in [9; 11]. Since a jamming attack is an effective way to disrupt and/or degrade any wireless network and system, it is important that it is detected in time. Due to the complexity and wide spread of wireless communications in all environments, it is of extreme importance to provide modular, low-cost RF jamming detection sensors for monitoring the spectrum bands of interest. Of equal importance is to provide sensors that automatically adjust in the the locality of the areas of interest, and provide reliable alarms to respective security operations centers, in order to take effective and immediate measures. With this concept, the contributions of this paper can be summarized as follows:  
* Design of a low-cost RF monitoring sensor, based on a wideband, wide dynamic range logarithmic amplifier, to be utilized for multi-band interference, RF jamming monitoring, with distributed and collaborative capabilities. * Interconnection of the proposed sensor with a security operations center (SOC), providing raw RF data and alerts, per monitored frequency band, in case of an anomaly--either interference or jamming activity. * Provision of an automated calibration process, allowing reliable, long-term RF recordings and RSS threshold analysis, for optimizing sensor operation in typical rural, suburban, and urban environments. * Analysis of the main radio contributing factors for detecting drone operations, in the scope of this work. The remaining of this paper is organized as follows. Section 2 covers related research on jamming techniques and jamming sensing. Section 3 describes the proposed design of the low-cost RF sensor, the sensor calibration procedure, the sensing algorithm, and the sensor configuration for optimized performance.