DNA Feature Selection for Discriminating WirelessHART IIoT Devices

Abstract

The proliferation of Wireless Highway Addressable Remote Transducer (WirelessHART) communications in support of Industrial Internet of Things (IIoT) applications is accompanied by increased vulnerability concerns that amplify the need for improved pre-attack security and post-attack forensic methods. This paper summarizes demonstration activity aimed at applying Time Domain Distinct Native Attribute (TD-DNA) fingerprinting and improving feature selection to increase computational efficiency and the potential for near-real time operational application. Assessments include both pre-classification and post-classification dimensional reduction using TD-DNA fingerprint features extracted from experimentally collected WirelessHART signals.Results show that pre-classification selection methods are superior, with average percent correct classification differential of 8% < %CD < 1% being maintained using selected feature subsets containing only 24 (10%) of the 243 full-dimensional features.

A Tool to Support the Investigation and Visualization of Cyber and/or Physical Incidents

“…Also, future combinations of visualizations with intelligent forensics might provide better results. Rondeau, C., et al [5] try to improve pre-attack security and post-attack forensic methods in the context of WirelessHART -IIoT (Wireless Highway Addressable Remote Transducer in support of Industrial Internet of Things). They investigate activity aimed at applying Time Domain Distinct Native Attribute (TD-DNA) fingerprinting and improving feature selection to increase computational efficiency and the potential for near-real time operational application.…”

Considerations for Radio Frequency Fingerprinting across Multiple Frequency Channels

“…In works providing single channel demonstrations, channel carrier frequency details are often omitted, given that the RF signals are commonly down-converted to accommodate baseband fingerprint generation. For example, ZigBee research in [ 10 , 11 , 12 , 13 ], and similarly, WirelessHART research in [ 14 ], cited the collection bandwidth but omitted carrier frequency information. Furthermore, from an experimental perspective, it is more time-consuming to collect signals across multiple carrier frequencies, given the narrow RF bandwidth limitations of commonly accessible Software-Defined Radios (SDRs).…”

“…Furthermore, from an experimental perspective, it is more time-consuming to collect signals across multiple carrier frequencies, given the narrow RF bandwidth limitations of commonly accessible Software-Defined Radios (SDRs). Therefore, the omission of carrier frequency information suggests that researchers in [ 10 , 11 , 12 , 13 , 14 ] did not consider the effects of multi-channel operation.…”

“…For instance, researchers have proposed an energy criterion-based technique [ 19 ] and a transient duration-based technique [ 20 ] to detect and extract features from the transient region of the signal during power-on. Researchers in [ 14 ] extract features from the signal preamble region, focusing on down-selecting statistical features to reduce computational overhead while maintaining classification accuracy. Yet another technique presented in [ 21 ] extracts features from a 2-dimensional representation of the time series data.…”

Tuning Hyperparameters for DNA-based Discrimination of Wireless Devices

“…In general, there are "no hard-and-fast rules" in determining hyperparameter and their selection is part of the "art of [algorithm] design" [8]. Prior works in related areas such as feature selection, have even cited the complexity of the task of hyperparameter selection and tuning as a reason to utilize more simple ML algorithms [9]. In some cases -particularly in postattack forensics where the amount of data may be very largethis could limit the utility of more powerful computing paradigms, such as ANNs.…”