Source-linked AI summary
Cyber-Electromagnetic Anomaly Detection Through Time-Series Analysis
María Teresa Guillén Navarro, Juan Luis Serradilla Tormos, Sergio López Bernal, Daniel Díaz-López, Gregorio Martínez Pérez
TL;DR
The paper targets the limited joint use of electromagnetic and traffic evidence for cyber-electromagnetic anomaly detection. It evaluates Random Forest and LSTM-Autoencoder models on ZBDS2023, with the supervised approach achieving the stronger reported performance. The findings support CSA while identifying feature richness and dataset scope as important limitations.
Problem
Existing anomaly detection approaches often focus on only physical-layer or traffic-level information, despite the need to characterize events across both domains.
Method
The study evaluates a supervised Random Forest and an unsupervised LSTM-Autoencoder using temporal sequences from the ZBDS2023 Zigbee dataset.
Results
The window-based Random Forest achieved an F1-score of 89.76%, while the LSTM-Autoencoder provided lower but promising anomaly-detection results.
Takeaways & Limitations
The results suggest that combining temporal physical and traffic features can support CSA by aiding observation and interpretation of abnormal cyber-electromagnetic behavior.
Takeaways & Limitations
The feature set is limited, and the study uses a single dataset and technology associated with a fixed topology and particular devices.
Abstract
from arXiv · showhide
Military operations benefit from the coordination between kinetic and non-kinetic domains. In particular, the coordination of cyber operations and electromagnetic warfare has become increasingly relevant for gaining operational advantage. This coordination is also relevant for Cyber Situational Awareness (CSA), where the Observe-Orient-Decide-Act (OODA) loop requires monitoring and interpreting evidence from heterogeneous sources. In this context, anomalies may appear not only in the physical behavior of signals, but also in the communication behavior observed at the traffic level. However, many existing anomaly detection proposals focus on only one of these perspectives, limiting their ability to characterize events that manifest simultaneously in the electromagnetic spectrum and cyberspace. To address this limitation, this work develops and evaluates two anomaly detection models that combine features from both domains. More specifically, the study uses the ZBDS2023 dataset, which contains traffic from nodes in a mesh network, including benign and attack behaviors. Thus, this dataset provides physical-level features, traffic-level features, and labeled attacks. Two detection approaches are evaluated: a supervised model based on Random Forest and an unsupervised model using LSTM-Autoencoder. The results show that learning-based models can detect patterns combining both levels, especially under a supervised approach, achieving an F1-score of 89.76% with Random Forest and 64.09% with LSTM-Autoencoder. Although these results indicate that the proposed models can support CSA by improving the observation and interpretation of anomalous behavior, the subtle differences between normal and attack samples highlight the need for richer discriminative features.
1 Introduction
The paper addresses cyber-electromagnetic anomaly detection by combining evidence from the electromagnetic spectrum and cyberspace. It evaluates supervised and unsupervised temporal models using the ZBDS2023 dataset to support CSA.
- Military operations increasingly require coordination across kinetic domains, cyberspace, the electromagnetic spectrum, and information operations.
- Cyber Situational Awareness requires correlating heterogeneous evidence during the Observe and Orient phases of the OODA loop.
- Most existing anomaly detection approaches examine either signal-level or traffic-level information rather than both perspectives jointly.
- The study evaluates a supervised Random Forest and an unsupervised LSTM-Autoencoder on ZBDS2023 temporal sequences containing physical, traffic, and labeled attack features.
2 Related work
Prior work and datasets commonly treat physical-layer signals and network traffic separately, while publicly available resources rarely combine both with consistently labeled attack scenarios. The review motivates using ZBDS2023 for joint anomaly detection.
- Anomaly detection literature: Most reviewed methods use reconstruction-based detection, learning normal behavior and flagging anomalies when reconstruction error exceeds the expected range.
- Anomaly detection literature: Transformer and LSTM autoencoder studies apply reconstruction-based methods to network traffic, while VAE and adversarial autoencoder studies apply related strategies to electromagnetic representations.
- Dataset landscape: ZBDS2023 combines MAC-layer frame data, RSSI values, benign periods, and labeled attacks for Zigbee-based anomaly detection.
- Anomaly detection literature: Existing anomaly detection methods generally use either physical-layer signal features or network-traffic features, limiting joint analysis of channel events and communication behavior.
- Dataset landscape: Public datasets often have limited samples, partial environmental coverage, sparse traffic, restricted variability, insufficient metadata, or no labeled anomalies.
- Dataset landscape: The review identifies a shortage of datasets jointly providing physical-layer information, traffic traces or metadata, and representative attacks with consistent annotations.
- Dataset landscape: ZBDS2023 was selected as the reference dataset because it provides both physical-layer and traffic-level information with benign and labeled attack scenarios.
3 Design and Implementation of the Proposed Solution
The proposed solution processes Zigbee mesh-network data and evaluates supervised and unsupervised anomaly detection models using temporal information and physical- plus traffic-level features.
- Workflow: The workflow collects Zigbee mesh-network traffic, cleans and labels frames, extracts features, normalizes data, and evaluates two anomaly-detection perspectives.Random Forest performs supervised binary classification, while an LSTM-Autoencoder learns normal behavior for unsupervised detection.
- Dataset: The ZBDS2023 dataset was collected in a smart home with 10 Philips Hue devices and includes normal operation periods and attack periods.Four passive Raspberry Pi–CC2531 probes provide MAC-layer redundancy and RSSI measurements from multiple locations.
- Data processing: Approximately 34 000 000 valid rows were obtained, including 33 829 336 normal rows and 55 638 attack rows.Attack samples represent 0.16% of the complete dataset; restricting analysis to July 3rd–9th raises the attack ratio to 0.31%.
- Data processing: Labels were converted into a binary target: 0 for normal samples and 1 for attack samples.Unknown-device frames were discarded before label transformation and feature engineering.
- Supervised detection: Random Forest classifies fixed-size windows from statistical features including mean, median, extrema, percentiles, and interquartile range.Each window contains consecutive messages from the same device and Raspberry Pi; F1-score is the primary model-selection metric because of class imbalance.
- Unsupervised detection: The LSTM-Autoencoder reconstructs sequences learned from attack-free traffic and classifies sequences with reconstruction errors above a selected threshold as anomalous.Sequences use consecutive same-device messages, and the data are reshaped as samples, timesteps, and features before training.
4 Results
The supervised Random Forest performs best, using windowed temporal features to distinguish normal from attack traffic. The unsupervised LSTM-Autoencoder also detects anomalous windows, but with lower precision and F1-score.
- Random Forest: Aggregating consecutive frames into statistical window features provides a robust representation of local behavior for separating normal and attack traffic.
- Random Forest: 89.76% F1-score, 97.74% precision, and 82.99% recall were achieved by the tuned Random Forest on the test set.
- Random Forest: The Random Forest confusion matrix uses actual classes as rows and predicted classes as columns, with high precision indicating a low false-alarm rate.
- LSTM-Autoencoder: A 4-layer LSTM-Autoencoder with seq_length = 8 and stride = 8 was selected after architectural and hyperparameter searches.
- LSTM-Autoencoder: 64.09% F1-score, 56.90% precision, 73.36% recall, and 86.55% balanced accuracy were obtained by the LSTM-Autoencoder on the test set.
- LSTM-Autoencoder: The LSTM-Autoencoder is trained only on normal traffic and detects attacks through reconstruction errors, so performance depends on attack sequences clearly deviating from normal behavior.
5 Conclusions
The proposed models combine physical- and traffic-level information for cyber-electromagnetic anomaly detection and can support CSA's Observe and Orient phases. Results favor the supervised approach, while limited features and narrow evaluation scope constrain generalization.
- The supervised model improves accuracy and precision over the dataset authors’ original IDS baseline while maintaining similar recall.
- Both models transform physical- and traffic-level indicators into anomaly information that can support subsequent situational-awareness decision-making.
- The LSTM-Autoencoder remains relevant when labeled attack data are scarce because it can provide a warning mechanism despite lower precision.
- Limited features reduce separability between normal and attack windows, especially for unsupervised detection.
- Evaluation on a single dataset and technology requires further validation before generalizing results to other environments.