###### Abstract
* _Node authentication/spoofing detection_--by means of the identification of specific distinguishing features of the wireless channel experienced by a node or of the transmitting device, the receiver can detect if the message has been illegitimately modified by a node other than its legitimate source. The PLS is not thought to replace the traditional security, but it is an additional security layer which helps to enhance the security level, in particular, when low-resourced devices are used with a wireless connection [6]. Indeed, PLS (i) involves only the physical layer, (ii) lies on the variation and randomness of the wireless channel rather than on computational complexity of hard mathematical problems, (iii) uses the randomness of the wireless channel as a \"secure key\" avoiding key management burden, and (iv) can authenticate legitimate nodes quickly before demodulation and decoding, thus reducing the overall latency. The use of PLS has been proposed and adopted in the literature for several years [7], and the recent development of the IoT has given a great impetus to the research community to use PLS. Often in IoT networks, hard encryption procedures cannot been performed, at least with high frequency, and the effectiveness of encryption is related to the distribution and protection of a secret key that in IoT systems can fail [8]. Moreover, PLS approaches do not require modifications to the existing systems and hence, can be easily added in a very short time. Hence, the use of physical layer characteristics as a security tool can be seen as a method to help the higher layers to protect the system and, at the same time, implement security, even in low-resourced devices [9; 10]. This paper focuses on PHY layer continuous authentication and spoofing detection. In particular, the paper proposes a _machine-learning (ML) wireless fingerprinting_ method for a wireless sensor network (WSN), where multiple nodes communicate with a sink node that is in charge of their authentication. The idea is to exploit ML capabilities to verify if the characteristics of the propagation channel of current messages correspond to those of previous transmissions of authorized users. ML allows to implement more efficient data protection, having the capability of analyzing multi-dimensional information, without the need of an analytical model, and in a continuous way, thus taking into account the time-varying effects [1]. As specified before, the physical layer authentication (PLA) method proposed in this paper does not want to eliminate or replace the traditional procedures, but simply adds a \"first line of defense\". Traditional security protocols, such as WPA2, protect access to the communication network by using encryption. The method proposed here could be helpful in contexts where great and frequent efforts cannot be posed to perform hard encryption. In addition to the general features of PLS explained before, in the proposed method, all the computation (the ML algorithm) is executed at the sink node, while the low-complexity sensors have nothing to do, except transmit their data. This is not possible using encryption algorithms that operate at both sides of each communication link. Moreover, existing Wi-Fi security access protocols weaknesses are known [11], and protecting the massive IoT requires new security features which are currently not included into the wireless standards [8].