## 3 Proposed System  
The proposed system is proposed as a means to enhance and integrate the higher level authentication, for identifying potential illegal nodes trying to transmit unauthorized data. The basic idea is that during the initial access procedure, each sensing node is authenticated by means of a high-level procedure, and a unique ID is assigned to each one. Consequently, the sink node has a list of \(N\) authorized nodes with their corresponding identification ID. Successively, a continuous PLA is performed during normal communication involving only the physical layer. In particular, the sink node verifies if the received message has been illegitimately modified/generated by a node other than its claimed source, exploiting the WF that provides an additional unique identifier of the radio link between two nodes. Therefore, even if the malicious node is able to intercept and use a valid ID, the WF identification allows to detect the intrusion, thanks to the spatial decorrelation of radio channels of the malicious and authorized node using the same ID. The WF is obtained by the extracting some PHY attributes from the signal received by a specific device and, hence, by a specific propagation channel. In this paper, we considered the following PHY attributes:  
* **AoA:** the direction of arrival of the signal at the sink node;
* **Maximum delay spread (MDS)**: the time interval needed to collect all paths of the signal;
* **Peak value**: the maximum value of the channel impulse response;
* **Energy**: the sum of the squared absolute value of the signal;
* **Received signal power (RSP): calculated as** the ratio between the **energy** and the **MDS**. These attributes are used for the PLA of devices by means of a ML approach. In particular, we focus on a supervised learning multi-class classification approach:  
* During the _training phase_, the ML algorithm is trained using \(N\)-labeled training sequences belonging to the \(N\) legitimate sensor devices. Each one is composed of \(X\) samples of the received signal. Hence, only data of the authorized nodes are used for training, since it is impractical to assume to know the dataset of the spoofing node. * Then, during the _communication phase_, the received signal samples are classified as belonging to one of the \(N\) classes. However, in this way, even a malicious node is identified as a legitimate one, so an additional step is needed for its detection: the classification output is cross checked with the declared ID and if they match, the authentication is successful, while otherwise it fails. In the second case, the node communication is blocked and a new authentication at higher layers must be performed. The proposed procedure is represented in Figure 2.  
More in detail, let us distinguish between two cases:  
* _The spoofing node is not present_--the ML classification algorithm detects the class of the incoming authorized data and then cross checks the classification outcome with the declared ID: if the data belong to the node with claimed \(ID=j\), the identification is successful if the ML classification result is \(j\); otherwise, it fails and an alarm of spoofing is generated for the \(j\)-th node. Hence, the ML algorithm \(accuracy\) is defined as the probability of correctly identifying the class of an authorized user. At the opposite, if the ML classification fails, an authenticated user is erroneously blocked; hence, we define the _probability of blocking an authorized node_ as \(P_{ban}=1-Accuracy\). * _The spoofing node is present_--if the transmission belongs to an authorized user, we fall into the previous case. If the transmission belongs to the spoofing node, the ML classification algorithm classifies it as an authorized node with \(ID=i\) and \(i=1,\cdots,\mathcal{N}\). At this stage, the spoofing node cannot be detected; hence, the probability of detection of a spoofing node does not directly depend on the ML algorithm.