Ground and air vehicle electromagnetic signature detection and localization

A system for identifying radio transmissions associated with autonomous or remote-controlled vehicles, comprising:

• one or more sensor antennas;
• one or more sensors configured to couple radio frequency signals from the one or more sensor antennas and generate data samples representing at least a portion of the radio frequency signals, wherein the radio frequency signals are associated with a potentially malicious, autonomous or remote-controlled vehicle;
• one or more operator interfaces;
• and
• a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to:
• receive the data samples from the one or more sensors,
• identify a radio fingerprint associated with a control channel of the potentially malicious, autonomous or remote-controlled vehicle from the data samples, wherein the radio fingerprint comprises a radio signal characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle,
• determine, from known examples of benign and malicious devices stored in a signal signature database, matches to the received radio fingerprint,
• compute a time sequence of locations associated with received radio frequency fingerprint based upon received signal strengths from two or more of the one or more sensor antennas,
• compute a motion characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle from the computed time sequence of locations,
• classify the potentially malicious, autonomous or remote-controlled vehicle as benign or malicious based upon one or both of the received radio frequency fingerprint or the motion characteristic matching the known examples of malicious devices stored in the signal signature database, and
• present, via the one or more operator interfaces, information regarding classification of the potentially malicious, autonomous or remote-controlled vehicle.

A system for identifying multiple radio transmitters within a single wireless device, comprising:

• one or more sensor antennas within the electromagnetic environment;
• one or more updatable analysis databases configured to provide signatures of known examples of benign and malicious devices;
• one or more operator interfaces for communicating information associated with wireless devices;
• one or more software radio receivers configured to couple a radio frequency signal from one or more of the sensor antennas and generate data samples representing a portion of the radio frequency signal, wherein the radio frequency signal is transmitted from a potentially malicious, autonomous or remote-controlled vehicle;
• and
• a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to:
• receive the data samples,
• generate feature vectors comprising at least a portion of the data samples,
• cluster and extract signal features from within one or more of the feature vectors and update the feature vectors with attributes associated with clustering and extraction,
• identify, within one or more of the feature vectors, a radio fingerprint comprising a radio signal characteristic associated with a control channel of the potentially malicious, autonomous or remote-controlled vehicle,
• determine, from the known examples of benign and malicious devices, matches to the received radio fingerprint,
• compute a motion characteristic associated with the potentially malicious, autonomous or remote-controlled vehicle from the received radio fingerprint based upon time sequences of received signal strengths from two or more of the one or more sensor antennas,
• classify the potentially malicious, autonomous or remote-controlled vehicle as benign or malicious based upon one or both of the received radio frequency fingerprint or the motion characteristic matching the known examples of malicious devices stored in the signal signature database, and
• present, via the one or more operator interfaces, information regarding classification of the potentially malicious, autonomous or remote-controlled vehicle.