DMCA
Device identification via analog signal fingerprinting: A matched filter approach (2006)
| Venue: | In 144 Proceedings of the Network and Distributed System Security Symposium (NDSS |
| Citations: | 36 - 3 self |
BibTeX
@INPROCEEDINGS{Gerdes06deviceidentification,
author = {Ryan M. Gerdes and Thomas E. Daniels and Mani Mina and Steve F. Russell},
title = {Device identification via analog signal fingerprinting: A matched filter approach},
booktitle = {In 144 Proceedings of the Network and Distributed System Security Symposium (NDSS},
year = {2006},
pages = {78}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
As part of the Detecting Intrusions at Layer ONe (DILON) project, we show that Ethernet devices can be uniquely identified and tracked—using as few as 25 Ethernet frames—by analyzing variations in their analog signal caused by hardware and manufacturing inconsistencies. An optimal detector, the matched filter, is utilized to create signal profiles, which aid in identifying the device the signal originated from. Several non-traditional applications of the filter are presented in order to improve its ability to discriminate between signals from seemingly identical devices of the same manufacturing lot. The experimental results of applying these filters to three different models of Ethernet cards, totaling 16 devices, are presented and discussed. Important applications of this technology include intrusion detection (discovering node impersonation and network tampering), authentication (preventing unauthorized access to the physical network), forensic data collection (tying a physical device to a specific network incident), and assurance monitoring (determining whether a device will or is in the process of failing). 1.
Keyphrases
matched filter approach analog signal fingerprinting device identification manufacturing inconsistency physical device detecting intrusion specific network incident matched filter assurance monitoring important application intrusion detection analog signal signal profile ethernet card network tampering several non-traditional application different model optimal detector identical device layer one unauthorized access ethernet device physical network ethernet frame manufacturing lot forensic data collection experimental result
