Detection of Anomalous Zigbee Transmissions Using Machine Learning

Abstract

Effective spectrum awareness is critical to a large number of wireless communication systems. Malicious actors increasingly use the spectrum for their own purposes, such as to disrupt systems via jamming and/or spoofing. Radio anomaly detection approaches have been leveraged somewhat in wireless sensor networks, but most of these prior works have focused on detecting changes in sensor data (e.g., temperature and pressure), or in expert features rather than on anomalies occurring in the physical layer. This paper is focused on the detection of anomalous Zigbee transmissions using features extracted from the in-phase and quadrature components and network traffic data. We evaluated the performance of five supervised machine learning algorithms (i.e., Random Forest, J48, JRip, Naive Bayes, and PART) for anomalous RF detection and identified the best learner. Furthermore, we experimented with training sets of different sizes. The main findings include: (1) Adding network flow-based features improved the performance of most of the supervised machine learning algorithms for the detection of anomalous Zigbee transmissions; (2) Random Forest was the best performing learner with the highest F-score and G-score values when using feature-level fusion; and (3) The learners performed similarly across the different training set sizes for all supervised machine learning algorithms.