Source-linked AI summary
SIDE: Sensor Impersonation Detection at the Edge via Sequence Prediction
Nahom Birhan
TL;DR
Low-cost IoT deployments may lack device-level source authentication, motivating detection of sensor impersonation from behavioral readings. The paper trains a genuine-only sequence predictor and deploys it on an Arduino Nano 33 BLE in three quantization variants. In a controlled indoor-versus-hotter-outdoor testbed, the variants achieved high detection accuracy and flagged the constructed genuine-to-impostor transition, while quantization reduced size but increased measured inference time.
Problem
The paper addresses sensor impersonation when IoT sensor links lack device-level source authentication.
Method
A three-LSTM, two-fully-connected model learns genuine univariate temperature sequences and flags windows whose MAE exceeds the mean genuine MAE by six standard deviations.
Results
99.980%, 99.972%, and 98.206% detection accuracies were reported for non-quantized, 16-bit, and 8-bit variants, respectively, with each flagging the constructed change point.
Takeaways & Limitations
The study demonstrates a lightweight edge detector for the tested controlled distribution shift, with quantization shrinking the model but making measured inference slower.
Takeaways & Limitations
The threshold was selected after inspecting the test distributions, and the study used one genuine sensor, one impostor sensor, one aggregator, one collection period, and one training run.
Abstract
from arXiv · showhide
Some low-cost Internet of Things (IoT) sensor deployments lack device-level source authentication, leaving them vulnerable to impersonation or injected sensor readings. We present a lightweight approach to sensor impersonation detection in a small proof-of-concept study. We formulate detection as a sequence-prediction problem. A model with three LSTM layers and two fully connected layers is trained only on univariate temperature readings from a genuine sensor, and a window of readings is flagged when its mean absolute prediction error exceeds the mean genuine error by more than six standard deviations. The model is converted to TensorFlow Lite and deployed on an Arduino Nano 33 BLE in three variants, non-quantized (554 KB), 16-bit weight quantized (298.5 KB), and 8-bit weight quantized (185 KB). On a controlled testbed with the impostor sensor placed in a hotter outdoor location, the three variants reached detection accuracies of 99.980%, 99.972%, and 98.206%, and each flagged the change point when a test sequence switched from genuine to impostor data. Quantization made the model smaller but slower in our measurements. The genuine and impostor distributions were well separated, so these results show detection of a controlled distribution shift and should not be read as evidence of general device authentication.
I. INTRODUCTION
The paper targets sensor impersonation when sensor-to-aggregator links lack device-level authentication. It proposes behavioral detection using sequence prediction on genuine readings and evaluates a compact edge deployment with quantization variants.
- Unauthenticated sensor-to-aggregator links allow an attacker to replace genuine readings with its own stream.
- The detector predicts upcoming sensor readings from past windows and flags prediction errors that drift from learned genuine behavior.
- LSTM layers followed by fully connected layers model the genuine sensor’s univariate time series.
- The controlled study trains only on genuine indoor data, deploys TensorFlow Lite variants on an Arduino Nano 33 BLE, and evaluates size, speed, accuracy, and change-point detection.
- The study asks whether genuine-only sequence prediction can detect impersonation and how MAE thresholds, change points, and weight quantization affect performance.
II. RELATED WORK
The related work spans edge-versus-cloud deployment, IoT security, time-series modeling, and anomaly detection. The paper positions itself as a small end-to-end microcontroller experiment combining genuine-sensor training with deployed quantization analysis.
- Prior work covers edge-versus-cloud trade-offs, machine learning for IoT security, time-series modeling, and anomaly detection.
- IoT security studies include secure aggregation, implicit message authentication, and machine-learning feasibility at the edge.
- Classical and neural approaches in related work include ARMA, ARIMA, LSTM, Markov, and recurrent neuro-fuzzy models for forecasting or anomaly detection.
- The authors found little experimental work training on a genuine sensor time series and running impersonation detection on a microcontroller-class device.
- The contribution is a small end-to-end experiment that includes weight quantization effects on the deployed detector.
III. SYSTEM SETUP AND THREAT MODEL
The experimental system connects sensors, Arduino aggregators, Raspberry Pi gateways, and a personal-computer EDM. Genuine and impostor-condition temperature data come from indoor and hotter outdoor sensors, respectively.
- The testbed contains an EDM, gateways, aggregators, and sensors, while the production concept assumes wireless sensor-to-aggregator links.
- Edge Device Monitor: The EDM trains and converts the TensorFlow model to TensorFlow Lite and displays communication, detection, execution-time, and memory information.
- Gateway: Each Raspberry Pi 4 gateway relays data between the EDM and an Arduino-based aggregator over serial and SSH links.
- Aggregator: Each Arduino Nano 33 BLE is an aggregator, and aggregator-1 runs the deployed TensorFlow Lite detector.
- Sensors: Indoor LM35 sensors attached to aggregator-1 provide genuine data, while outdoor LM35 sensors attached to aggregator-2 provide hotter impostor-condition data.
B. Threat Model and Assumptions
The threat model focuses on an attacker impersonating a genuine sensor over an unauthenticated sensor-to-aggregator link. Detection uses prediction error from sliding windows of the genuine sensor’s univariate time series, while several attack paths remain outside scope.
- An attacker joining the conceptual unauthenticated wireless link can send readings under the genuine sensor’s identity.
- The detector flags incoming windows whose statistics deviate from the genuine sensor’s learned behavior.
- Gateway compromise requiring a private key, distribution-mimicking adversaries, and physical attacks on wired links are outside the experiment’s scope.
- A genuine-only model predicts each upcoming reading from a past window, and a window-level MAE threshold converts prediction error into detection.
- Sliding-window extraction uses consecutive readings as features and the following reading as the target.
B. Model
The detector uses a five-layer network with three LSTM layers followed by two fully connected layers, and flags windows whose prediction error exceeds a genuine-data threshold.
- B. Model: The network contains three LSTM layers followed by two fully connected layers and uses MAE loss, Adam optimization, and ReLU activations in the fully connected layers.Layer widths and learning rate were not recorded in the 2022 source material.
- B. Model: An LSTM cell uses prior hidden and cell states with input readings to update its state through forget, input, and output gates.The cell state carries information across many time steps, motivating LSTM layers over a plain recurrent layer.
- B. Model: A window is flagged as impostor data when its MAE e exceeds τ = µg + 6 sg, where µg and sg are genuine-data error statistics.The threshold is computed from per-window MAE on genuine data.
D. TensorFlow Lite Conversion and Quantization
The trained detector is converted to TensorFlow Lite for on-device execution in floating-point and quantized variants, and the experiment uses measured sensor data from separate indoor and outdoor conditions.
- D. TensorFlow Lite Conversion and Quantization: TensorFlow Lite conversion produces a FlatBuffer model that runs on the device without a server round trip.The study evaluates 32-bit floating-point, 16-bit floating-point, and dynamic-range 8-bit integer weight variants.
- D. TensorFlow Lite Conversion and Quantization: Weight quantization shrinks the model, while its effects on latency and accuracy are measured rather than assumed.The 16-bit variant restores weights to 32-bit values at load time; the 8-bit variant stores weights as integers.
- D. TensorFlow Lite Conversion and Quantization: The reported experiments use measured testbed data because synthetic ARMA data did not reproduce the physical sensors’ behavior.Genuine readings come from an indoor LM35 sensor, while impostor readings come from an outdoor LM35 sensor in a hotter environment.
- D. TensorFlow Lite Conversion and Quantization: The impostor condition combines a different device with a different thermal environment, so it evaluates controlled distribution-shift detection rather than general device authentication.The two effects are not separated in the experiment.
VI. RESULTS
The results evaluate three deployed variants through prediction overlays, a constructed source transition, and MAE histograms, showing low genuine error, larger impostor error, and a clear change-point signal.
- VI. RESULTS: Fig. 3 compares training, validation, genuine-test, and impostor temperature series before sliding-window feature extraction.The genuine series come from the indoor sensor and the impostor series from the outdoor sensor.
- VI. RESULTS: Prediction error remains small before index 500 and jumps immediately afterward when the constructed sequence switches from genuine to impostor data.The sequence contains 500 genuine samples followed by 500 impostor samples.
- VI. RESULTS: Genuine windows cluster at small MAE values while impostor windows cluster several times higher, with a visible gap between their distributions.Six standard deviations above the genuine mean falls within this gap for the data set.
B. 16-Bit and 8-Bit Weight-Quantized Models
The quantized variants substantially reduced model size and still flagged the constructed transition, but quantization increased measured inference time and 8-bit weights produced a larger accuracy change.
- Transition detection: The 16-bit and 8-bit variants flagged the genuine-to-impostor transition at index 500, as did the non-quantized model.The transition sequence used genuine data for indices 0–499 and impostor data for indices 500–999.
- Comparative behavior: The quantized overlay plots and MAE histograms looked almost the same as the non-quantized results, while the 8-bit variant showed a larger accuracy change than the 16-bit variant.Both quantized variants nevertheless flagged the transition at index 500.
- Model size: 554.06 KB was the TensorFlow Lite model size, falling to 298.5 KB with 16-bit weights and 185.08 KB with 8-bit dynamic-range quantization.The 8-bit model was about 11.8% of the original TensorFlow model.
- Detection accuracy: 99.980% detection accuracy was recorded for the non-quantized model, compared with 99.972% for 16-bit and 98.206% for 8-bit weights.The recorded accuracy count’s exact coverage of genuine versus impostor windows is unspecified.
- Inference time: 11.296 s was the measured time for 3569 test windows with the non-quantized model, versus 15.226 s for 16-bit and 18.544 s for 8-bit weights.The experiment did not isolate the cause of the timing difference.
VII. DISCUSSION
The discussion attributes the strong detection results to a pronounced temperature distribution shift in a controlled testbed. It also notes that quantization reduced model size while increasing measured inference time, and that deploying LSTM inference on the microcontroller posed practical difficulties.
- Detection behavior: Genuine readings were tracked closely, whereas impostor readings differed by several degrees, creating the MAE gap that supported threshold-based separation.The transition sequences showed all three variants flagging the constructed change point.
- Scope of evidence: The hotter outdoor impostor environment produced readings about ten degrees warmer, so the experiment demonstrates controlled distribution-shift detection rather than general device authentication.The study does not show performance against an impostor whose readings resemble the genuine sensor’s or an adapting adversary.
- Quantization trade-off: Quantization substantially reduced model size, with a small accuracy change for 16-bit weights and a larger change for 8-bit weights, but increased measured inference time for both.The cause of the timing difference was not isolated.
- Implementation: Deploying the LSTM model with TensorFlow Lite for Microcontrollers was practically difficult because of tensor arena requirements and limited LSTM operator support at the time.The discussion reports that convolutional layers gave poor predictions, leading to the LSTM-based design.
A. Limitations
The study’s conclusions are constrained by its single-modality, controlled, small-scale setup and by threshold selection informed by the evaluated data. It also does not evaluate adaptive adversaries that mimic genuine behavior.
- Only temperature from LM35 sensors was used, and the model consumed a single scalar series.
- The genuine and impostor sensors occupied different thermal environments, creating a controlled indoor/outdoor distribution shift.
- The six-standard-deviation threshold was selected after inspecting the experiment’s genuine and impostor MAE distributions, not an independent calibration set.Reported accuracy is therefore descriptive for this controlled dataset rather than an unbiased out-of-sample estimate.
- The testbed used one genuine sensor, one impostor sensor, one aggregator, one collection period, and a single training run.
- The threat model excluded adversaries that observe and mimic the genuine sensor.
B. Future Work
Future work extends the proof-of-concept toward broader sensing, more robust thresholding and adaptation, matched environments, and adversaries that mimic genuine behavior. The current study demonstrates a small edge detector for a pronounced controlled distribution shift, while explicitly limiting claims about general device authentication.
- Future work: Future work should test multivariate data, automatic threshold selection, online learning and device-side updates, same-environment impostors, and adversaries that mimic genuine behavior.
- Current study: The study demonstrates sequence-prediction detection of sensor impersonation on a microcontroller-class device using genuine temperature readings only.
- Current study: 99.980%, 99.972%, and 98.206% detection accuracy were obtained by the non-quantized, 16-bit, and 8-bit variants, respectively.
- Current study: The detector flagged the change point in a constructed sequence switching from genuine to impostor readings.
- Current study: 554 KB, 298.5 KB, and 185 KB were the model sizes for the non-quantized, 16-bit, and 8-bit variants, while measured inference became slower after quantization.
- Scope: The results show detection of a pronounced distribution shift, not general device authentication or robustness against mimicking adversaries.