Case StudyTeam coursework · IEEE-format technical reportSecurityMachine LearningDetectionAcademic

Deep-Learning RF Device Authentication

Authenticating 31 Bluetooth Low Energy devices by transmitter hardware imperfections — and measuring where that fails

ECE 478 Network Security · Oregon State University · Spring 2026

Role: Model & Training Pipeline — Four-Person TeamPeriod: Spring 2026

My contribution

I built the CNN model and the training pipeline, implemented and ran the same-domain experiment set, and authored the team's IEEE-format technical report. Teammates ran the cross-domain experiments, the phase-derivative experiments and per-device analysis, and the comparison analysis and plots.

RF fingerprinting authenticates wireless devices by the manufacturing imperfections in their transmitters, identifying hardware by physical-layer characteristics rather than credentials that can be stolen or spoofed. This project tested whether a CNN could authenticate 31 BLE devices from raw IQ signal data, and whether that held up when conditions changed. It did not: cross-channel accuracy collapsed by 65 percentage points. The failure mode was the result worth reporting.

Scope

RF fingerprinting authenticates wireless devices by the manufacturing imperfections in their transmitters — small variations in oscillators, amplifiers, mixers, and filters that produce a device-specific signature in the transmitted signal. This identifies hardware by physical-layer characteristics rather than cryptographic credentials that can be stolen or spoofed, which matters for IoT and BLE devices that cannot hold strong secrets. The project tested whether a CNN could authenticate 31 Bluetooth Low Energy devices from raw IQ signal data, and whether that held up when conditions changed.

Environment & tooling

A dataset of 31 BLE devices collected at Oregon State's NetSTAR lab, 1,850 IQ data points per sample. Two scenarios were tested: varying frequency channel (2.406, 2.408, 2.434, 2.470 GHz) with location fixed, and varying transmitter distance (1 m, 1.5 m, 2 m, 3 m) with channel fixed.

PyTorch: Model definition and training
NetSTAR lab dataset: 31 BLE devices, 1,850 IQ data points per sample

Method

A four-layer 1D convolutional network — 64, 128, 128, and 256 filters with kernel sizes 7, 5, 3, 3 — each layer using batch normalization, ReLU, and pooling, with an adaptive final pooling layer so the same architecture accepts both raw IQ and the shorter phase-derivative input. Two fully connected layers with dropout at 0.5 and 0.3. Trained with Adam at learning rate 1e-3, cross-entropy loss, and a ReduceLROnPlateau scheduler, for 30 epochs with a 10% validation split used for best-epoch selection. The test set was never used during training.

Findings

Same-domain, where training and test conditions match: 93.2% mean accuracy across frequency channels, 99.4% across transmitter locations.
Cross-domain with raw IQ, where the model is trained in one condition and tested in another: accuracy collapsed to 28.1% across channels — a 65-percentage-point drop — and 71.8% across locations, a 27.7-point drop.
Channel shift degrades performance far more than location shift. Changing carrier frequency changes how the transmitter hardware itself responds; changing distance mostly changes signal amplitude and multipath.
Using the phase derivative of the BLE preamble instead of raw IQ recovered much of the loss: cross-channel accuracy rose from 28.1% to 74.8%, and cross-location from 71.8% to 95.3%, reducing the location domain gap to 4.2 points.
Transfer was asymmetric — models trained on a mid-range channel generalized better than models trained at the edge of the frequency range.

Limits & what would confirm

What the available evidence did not establish, and what it would take to settle each open question.

Same-domain accuracy above 99% is the easy case and should not be read as deployment performance. The honest result is the cross-domain collapse: a fingerprinting model trained under one set of RF conditions cannot be assumed to authenticate the same devices under different conditions.
Would confirm: Deploying this as a real authentication control would require domain adaptation or multi-channel training, and would need validation against an adversary actively attempting to mimic a target device's signature — which this work did not test.

Takeaway

The interesting result was the failure mode, not the accuracy figure. Raw IQ mixes the device's hardware signature with channel and environment effects, and the model learns both — so the learned features stop matching when conditions change.

Tools & techniques

PyTorchConvolutional neural networks1D CNNIQ signal dataBluetooth Low EnergyRF fingerprintingDomain shift analysisPython

Reference

H. Albousayri, B. Hamdaoui, W.-K. Wong, and N. Basha, “Bluetooth Fingerprint Identification Under Domain Shift Through Transient Phase Derivative,” IEEE Conference on Communications and Network Security (CNS), 2025.

This page describes my own methodology, reasoning, and analysis. Course materials — assignment prompts, instructor- supplied evidence, lab handouts, and graded reports — are not reproduced here, and case-scenario names, hostnames, usernames, and device identifiers have been removed.