# Deterring Deepfake Attacks with an Electrical Network Frequency Fingerprints Approach
## 5 Experimental Study and Performance Analysis
### SSA Performance Analysis  
We evaluated SSA performance in terms of processing time and computational resource consumption on the host machine. During our test, we only repeated SSA functions, then evaluated the processing time and resource usages. Thus, deepfake video preprocessing was not considered in this test. Table 2 describes the devices used for the experimental study for SSA detection. The prototype was deployed on a small-scale Local Area Network (LAN) that consisted of multiple desktops and IoT devices. We used the desktop to simulate a fog server, while RPi devices to simulate edge servers. In deepfake attack scenarios, an adversary attempts to use forged or duplicate audio and video streams to fool video surveillance systems. Figure 8 shows how SSA detection identifies suspicious activities. We simulated attack scenarios that inject fake multimedia streams in attack ranges 200-240 and 400-430. Owing to the randomness and unpredictability of the ENF in streams, the injected audio or video streams demonstrate a very low ENF coefficient score by compared with the ground truth ENF. As a result, multimedia streams in attack ranges have \(W_{n}\) higher than threshold \(h\), and they will be marked as suspicious. Instead of relying on the experimental threshold of 0.8 used to compare the correlation coefficient factors, here, we rely on change-point detection of the SSA decomposition, where a structural change is detected if \(W_{n}>h\), as mentioned in Equation (3) [59]. Moreover, our SSA detection can also tolerate noise influence to mitigate false alarms. Figure 8 shows that spontaneous detection points with noise influence do not significantly change \(W_{n}\). Figure 9a shows the processing time given different stages during the SSA detection. The detection statistics' calculation in Stage D took the longest time, as it needed more \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Device** & **Redbar HPC** & **Raspberry Pi 3 (B)** & **Raspberry Pi 4 (B)** \\ \hline
**CPU** & 3.4 GHz, Core (TM) & 1.2 GHz, Quad core & 1.5 GHz, Quad core \\  & 1/7-2600K (8 cores) & Cortex-A72 (ARM v8) & Cortex-A72 (ARM v8) \\ \hline
**Memory** & 8 GB DDR3 & 1 GB SDRAM & 4 GB SDRAM \\ \hline
**Storage** & 350 G HDD & 64 GB (microSD) & 64 GB (microSD) \\ \hline
**OS** & Ubuntu 18.04 & Raspbian (Jessie) & Raspbian (Jessie) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Configuration of experimental nodes. Figure 8: The SSA detection on deepfake attack scenarios. computational resources to perform singular-value decomposition on the Hankel matrix and computing the Euclidean distances between the base matrix and test matrix. The detection score Stage S simply converts D into the normalized sum of squired distances Sn, and then, the W stage calculates the CUSUM statistics. Thus, they had less process latency than stage D. As a result, the processing time of the D stage dominated the total latency of executing SSA on all three platforms. To evaluate the run time overhead of executing SSA detection on the host machine, only one core was used to run the SSA detection thread. We used the _top_ command to monitor the running status of the SSA detection thread and obtained the CPU percentage distribution and average memory usage. Figure 9b shows the CPU usage percentage of executing SSA detection given different devices. Owing to different computing capability, executing SSA detection on the device with a powerful CPU core had a low mean and deviation of CPU usage percentage (desktop < RPi4 < RPi3). The memory usages during the SSA detection were: desktop: 96 MB, Rpi4: 99 MB, Rpi3: 72 MB. Executing our SSA on different platforms may show different memory usages owing to the heterogeneous CPU architecture (X86 vs. ARM), different OSs (Ubuntu vs. Raspbian), and even various system running status. However, the gap was marginal, and both the desktop and Rpi almost demonstrated the same memory cost as executing SSA detection.