Design a Deep Neural Network with Simulated Data to Detect WLAN Router Impersonation

numKnownRouters = 4;
numUnknownRouters = 10;
numTotalRouters = numKnownRouters+numUnknownRouters;
SNR = 20;            % dB
channelNumber = 153; % WLAN channel number
channelBand = 5;     % GHz
frameLength = 160;   % L-LTF symbol length in samples

trainNow = false;

if trainNow
  numTotalFramesPerRouter = 5000; %#ok<UNRCH>
else
  numTotalFramesPerRouter = 10;
  rfFingerprintingDownloadData('simulated')
end

numTrainingFramesPerRouter = numTotalFramesPerRouter*0.8;
numValidationFramesPerRouter = numTotalFramesPerRouter*0.1;
numTestFramesPerRouter = numTotalFramesPerRouter*0.1;

% Create Beacon frame-body configuration object
frameBodyConfig = wlanMACManagementConfig;

% Create Beacon frame configuration object
beaconFrameConfig = wlanMACFrameConfig('FrameType','Beacon',"ManagementConfig",frameBodyConfig);

% Generate Beacon frame bits
[~,mpduLength] = wlanMACFrame(beaconFrameConfig,'OutputFormat','bits');

% Create a wlanNonHTConfig object, 20 MHz bandwidth and MCS 1 are used
nonHTConfig = wlanNonHTConfig('ChannelBandwidth',"CBW20","MCS",1,"PSDULength",mpduLength);

rxFrontEnd = rfFingerprintingNonHTFrontEnd('ChannelBandwidth','CBW20');
fc = wlanChannelFrequency(channelNumber,channelBand);
fs = wlanSampleRate(nonHTConfig);

multipathChannel = comm.RayleighChannel(...
  'SampleRate', fs, ...
  'PathDelays', [0 1.8 3.4]/fs, ...
  'AveragePathGains', [0 -2 -10], ...
  'MaximumDopplerShift', 0);

phaseNoiseRange = [0.01 0.3];
freqOffsetRange = [-4 4];
dcOffsetRange = [-50 -32];

rng(123456)  % Fix random generator

% Assign random impairments to each simulated radio within the previously defined ranges
radioImpairments = repmat(struct('PhaseNoise',0,'DCOffset',0,'FrequencyOffset',0), numTotalRouters,1);
for routerIdx = 1:numTotalRouters
  radioImpairments(routerIdx).PhaseNoise = rand*(phaseNoiseRange(2)-phaseNoiseRange(1)) + phaseNoiseRange(1);
  radioImpairments(routerIdx).DCOffset = rand*(dcOffsetRange(2)-dcOffsetRange(1)) + dcOffsetRange(1);
  radioImpairments(routerIdx).FrequencyOffset = fc/1e6*(rand*(freqOffsetRange(2)-freqOffsetRange(1)) + freqOffsetRange(1));
end

% Create variables that will store the training, validation and testing datasets
xTrainingFrames = zeros(frameLength,numTrainingFramesPerRouter*numTotalRouters);
xValFrames = zeros(frameLength,numValidationFramesPerRouter*numTotalRouters);
xTestFrames = zeros(frameLength,numTestFramesPerRouter*numTotalRouters);

% Index vectors for train, validation and test data units
trainingIndices = 1:numTrainingFramesPerRouter;
validationIndices = 1:numValidationFramesPerRouter;
testIndices = 1:numTestFramesPerRouter;

tic
generatedMACAddresses = strings(numTotalRouters,1);
rxLLTF = zeros(frameLength,numTotalFramesPerRouter); % Received L-LTF sequences
for routerIdx = 1:numTotalRouters
  
  % Generate a 12-digit random hexadecimal number as a MAC address for known routers. Set the MAC address of all unknown routers to 'AAAAAAAAAAAA'.
  if (routerIdx<=numKnownRouters)
    generatedMACAddresses(routerIdx) = string(dec2hex(bi2de(randi([0 1],12,4)))');
  else
    generatedMACAddresses(routerIdx) = 'AAAAAAAAAAAA';
  end
  elapsedTime = seconds(toc);
  elapsedTime.Format = 'hh:mm:ss';
  fprintf('%s - Generating frames for router %d with MAC address %s\n',elapsedTime,routerIdx,generatedMACAddresses(routerIdx))

  % Set MAC address into the wlanFrameConfig object
  beaconFrameConfig.Address2 = generatedMACAddresses(routerIdx);
  
  % Generate beacon frame bits
  beacon = wlanMACFrame(beaconFrameConfig,'OutputFormat','bits');
  
  txWaveform = wlanWaveformGenerator(beacon,nonHTConfig);
  
  txWaveform = helperNormalizeFramePower(txWaveform);
  
  % Add zeros to account for channel delays
  txWaveform = [txWaveform; zeros(160,1)]; %#ok<AGROW>
  
  % Reset multipathChannel object to generate a new static channel
  reset(multipathChannel)
  
  frameCount= 0;
  while frameCount<numTotalFramesPerRouter
    
    rxMultipath = multipathChannel(txWaveform);
    
    rxImpairment = helperRFImpairments(rxMultipath,radioImpairments(routerIdx),fs);
    
    rxSig = awgn(rxImpairment,SNR,0);
    
    % Detect the WLAN packet and return the received L-LTF signal using rfFingerprintingNonHTFrontEnd object
    [valid,~,~,~,~,LLTF] = rxFrontEnd(rxSig);
    
    % Save successfully received L-LTF signals
    if valid
      frameCount=frameCount+1;
      rxLLTF(:,frameCount) = LLTF;
    end
    
    if mod(frameCount,500) == 0
      elapsedTime = seconds(toc);
      elapsedTime.Format = 'hh:mm:ss';
      fprintf('%s - Generated %d/%d frames\n',elapsedTime,frameCount,numTotalFramesPerRouter)
    end
  end
  
  rxLLTF = rxLLTF(:,randperm(numTotalFramesPerRouter));
  
  % Split data into training, validation and test
  xTrainingFrames(:,trainingIndices+(routerIdx-1)*numTrainingFramesPerRouter) = rxLLTF(:,trainingIndices);
  xValFrames(:,validationIndices+(routerIdx-1)*numValidationFramesPerRouter) = rxLLTF(:,validationIndices + numTrainingFramesPerRouter);
  xTestFrames(:,testIndices+(routerIdx-1)*numTestFramesPerRouter) = rxLLTF(:,testIndices + numTrainingFramesPerRouter + numValidationFramesPerRouter);
end

% Label received frames. Label the first numKnownRouters with their MAC address. Label the rest with "Unknown”.
labels = generatedMACAddresses;
labels(generatedMACAddresses == generatedMACAddresses(numTotalRouters)) = "Unknown";

yTrain = repelem(labels,numTrainingFramesPerRouter);
yVal = repelem(labels,numValidationFramesPerRouter);
yTest = repelem(labels,numTestFramesPerRouter);
MACAddresses = unique(yTrain); %#ok<NASGU> % List of unique MAC addresses for prediction

% Rearrange datasets into a one-column vector
xTrainingFrames = xTrainingFrames(:);
xValFrames = xValFrames(:);
xTestFrames = xTestFrames(:);

% Separate between I and Q
xTrainingFrames = [real(xTrainingFrames),imag(xTrainingFrames)];
xValFrames = [real(xValFrames),imag(xValFrames)];
xTestFrames = [real(xTestFrames),imag(xTestFrames)];

% Reshape training data into a frameLength x 2 x 1 x numTrainingFramesPerRouter*numTotalRouters matrix
xTrainingFrames = permute(reshape(xTrainingFrames,[frameLength,numTrainingFramesPerRouter*numTotalRouters,2,1]),[1 3 4 2]);

% Shuffle data
vr = randperm(numTotalRouters*numTrainingFramesPerRouter);
xTrainingFrames = xTrainingFrames(:,:,:,vr);

% Create label vector and shuffle
yTrain = categorical(yTrain(vr));

% Reshape validation data into a frameLength x 2 x 1 x numValidationFramesPerRouter*numTotalRouters matrix
xValFrames = permute(reshape(xValFrames,[frameLength,numValidationFramesPerRouter*numTotalRouters,2,1]),[1 3 4 2]);

% Create label vector
yVal = categorical(yVal);

% Reshape test dataset into a numTestFramesPerRouter*numTotalRouter matrix
xTestFrames = permute(reshape(xTestFrames,[frameLength,numTestFramesPerRouter*numTotalRouters,2,1]),[1 3 4 2]); %#ok<NASGU>

% Create label vector
yTest = categorical(yTest); %#ok<NASGU>

poolSize = [2 1];
strideSize = [2 1];
layers = [
  imageInputLayer([frameLength 2 1],'Normalization','none','Name', 'Input Layer')
  
  convolution2dLayer([7 1],50,'Padding',[1 0],'Name','CNN1')
  batchNormalizationLayer('Name','BN1')
  leakyReluLayer('Name','LeakyReLu1')
  maxPooling2dLayer(poolSize,'Stride',strideSize,'Name','MaxPool1')
  
  convolution2dLayer([7 2],50,'Padding',[1 0],'Name','CNN2')
  batchNormalizationLayer('Name','BN2')
  leakyReluLayer('Name','LeakyReLu2')
  maxPooling2dLayer(poolSize,'Stride',strideSize,'Name','MaxPool2')
  
  fullyConnectedLayer(256,'Name','FC1')
  leakyReluLayer('Name','LeakyReLu3')
  dropoutLayer(0.5,'Name','DropOut1')
  
  fullyConnectedLayer(80,'Name','FC2')
  leakyReluLayer('Name','LeakyReLu4')
  dropoutLayer(0.5,'Name','DropOut2')
  
  fullyConnectedLayer(numKnownRouters+1,'Name','FC3')
  softmaxLayer('Name','SoftMax')
  ]

if trainNow

  miniBatchSize = 512; %#ok<UNRCH>
  iterPerEpoch = floor(numTrainingFramesPerRouter*numTotalRouters/miniBatchSize);

  % Training options
  options = trainingOptions('adam', ...
    'MaxEpochs', 5, ...
    'ValidationData', {xValFrames,yVal}, ...
    'ValidationFrequency', iterPerEpoch, ...
    'Verbose', false, ...
    'InitialLearnRate', 0.001, ...
    'LearnRateSchedule', 'piecewise', ...
    'LearnRateDropFactor', 0.5, ...
    'LearnRateDropPeriod', 2, ...
    'MiniBatchSize', miniBatchSize, ...
    'Plots', 'training-progress', ...
    'Shuffle', 'every-epoch', ...
    'Metrics', "accuracy", ...
    'ExecutionEnvironment', "auto");

  % Train the network
  [simNet,info] = trainnet(xTrainingFrames,yTrain,layers,"crossentropy",options);
else
  % Load trained network (simNet), testing dataset (xTestFrames and yTest) and the used MACAddresses (generated MAC addresses)
  load('rfFingerprintingSimulatedDataTrainedNN_R2024b.mat','generatedMACAddresses','simNet','xTestFrames','yTest','MACAddresses');
end

% Obtain predicted classes for xTestFrames
yTestPred = predict(simNet,xTestFrames);
yLabel = scores2label(yTestPred,MACAddresses');
% Calculate test accuracy
testAccuracy = mean(yTest == yLabel);

disp("Test accuracy: " + testAccuracy*100 + "%")

figure
cm = confusionchart(yTest,yLabel);
cm.Title = 'Confusion Matrix for Test Data';
cm.RowSummary = 'row-normalized';

framesPerRouter = 4;
knownMACAddresses = generatedMACAddresses(1:numKnownRouters);

% Assign random impairments to each simulated radio within the previously
% defined ranges
for routerIdx = 1:numTotalRouters
  radioImpairments(routerIdx).PhaseNoise = rand*( phaseNoiseRange(2)-phaseNoiseRange(1) ) + phaseNoiseRange(1);
  radioImpairments(routerIdx).DCOffset = rand*( dcOffsetRange(2)-dcOffsetRange(1) ) + dcOffsetRange(1);
  radioImpairments(routerIdx).FrequencyOffset = fc/1e6*(rand*( freqOffsetRange(2)-freqOffsetRange(1) ) + freqOffsetRange(1));
end
% Reset multipathChannel object to generate a new static channel
reset(multipathChannel)

% Run for all known routers and one unknown
for macIndex = 1:(numKnownRouters+1)
  
  beaconFrameConfig.Address2 = generatedMACAddresses(macIndex);
  
  % Generate Beacon frame bits
  beacon = wlanMACFrame(beaconFrameConfig,'OutputFormat','bits');
  
  txWaveform = wlanWaveformGenerator(beacon,nonHTConfig);
  
  txWaveform = helperNormalizeFramePower(txWaveform);
  
  % Add zeros to account for channel delays
  txWaveform = [txWaveform; zeros(160,1)]; %#ok<AGROW>
  
  % Create an unseen multipath channel. In other words, create an unseen
  % RF fingerprint.
  reset(multipathChannel)
  
  frameCount= 0;
  while frameCount<framesPerRouter
    
    rxMultipath = multipathChannel(txWaveform);
    
    rxImpairment = helperRFImpairments(rxMultipath,radioImpairments(routerIdx),fs);
    
    rxSig = awgn(rxImpairment,SNR,0);
    
    % Detect the WLAN packet and return the received L-LTF signal using rfFingerprintingNonHTFrontEnd object
    [payloadFull,cfgNonHT,rxNonHTData,chanEst,noiseVar,LLTF] = rxFrontEnd(rxSig);
    
    if payloadFull
      frameCount = frameCount+1;
      recBits = wlanNonHTDataRecover(rxNonHTData,chanEst,noiseVar,cfgNonHT,'EqualizationMethod','ZF');
      
      % Decode and evaluate recovered bits
      mpduCfg = wlanMPDUDecode(recBits,cfgNonHT);
      
      % Separate I and Q and reshape for neural network
      LLTF= [real(LLTF),imag(LLTF)];
      LLTF = permute(reshape(LLTF,frameLength,[],2,1),[1 3 4 2]);
      
      ypred = predict(simNet,LLTF);
      yLabel = scores2label(ypred,categories(yTrain));
      
      if sum(contains(knownMACAddresses,mpduCfg.Address2)) ~= 0
        if categorical(convertCharsToStrings(mpduCfg.Address2))~=yLabel
          disp(strcat("MAC Address ",mpduCfg.Address2," is known, fingerprint mismatch, ROUTER IMPERSONATOR DETECTED"))
        else
          disp(strcat("MAC Address ",mpduCfg.Address2," is known, fingerprint match"))
        end
      else
        disp(strcat("MAC Address ",mpduCfg.Address2," is not recognized, unknown device"))
      end
    end

    % Reset multipathChannel object to generate a new static channel
    reset(multipathChannel)
  end
end

function [impairedSig] = helperRFImpairments(sig,radioImpairments,fs)
% helperRFImpairments Apply RF impairments
%   IMPAIREDSIG = helperRFImpairments(SIG,RADIOIMPAIRMENTS, FS) returns signal
%   SIG after applying the impairments defined by RADIOIMPAIRMENTS
%   structure at the sample rate FS.

% Apply frequency offset
fOff = comm.PhaseFrequencyOffset('FrequencyOffset',radioImpairments.FrequencyOffset,'SampleRate',fs);

% Apply phase noise
phaseNoise = helperGetPhaseNoise(radioImpairments);
phNoise = comm.PhaseNoise('Level',phaseNoise,'FrequencyOffset',abs(radioImpairments.FrequencyOffset));

impFOff = fOff(sig);
impPhNoise = phNoise(impFOff);

% Apply DC offset
impairedSig = impPhNoise + 10^(radioImpairments.DCOffset/10);

end

function [phaseNoise] = helperGetPhaseNoise(radioImpairments)
% helperGetPhaseNoise Get phase noise value
load('Mrms.mat','Mrms','MyI','xI');
[~, iRms] = min(abs(radioImpairments.PhaseNoise - Mrms));
[~, iFreqOffset] = min(abs(xI - abs(radioImpairments.FrequencyOffset)));
phaseNoise = -abs(MyI(iRms,iFreqOffset));
end