PaperlayerView exact revision on arXiv

Source-linked AI summary

Reputation-Graded Wavelet-Packet Subtree Allocation for IoT Sensor Networks

Surya Jayakumar, Arun Narayanan, Indrakshi Dey

arXiv:2610.12038v1eess.SP

TL;DR

Industrial IoT access control may reject a compromised sensor’s reports while its radio continues occupying the shared channel. This paper assigns WPDM subtrees according to reputation and derives a leakage-weighted detector. In simulation, it reduces false global decisions relative to fixed-allocation WPDM, OFDM tiers, and re-attestation under the stated emission and noise models.

  • Problem

    Upper-layer access control can reject reports but leaves a compromised radio occupying the shared channel and corrupting honest reports.

    Source: §I · p. 1

  • Method

    The paper ties reputation to WPDM subtree depth and uses the receiver’s predicted leakage profile to weight its out-of-subtree detector.

    Source: §I · p. 1, A. Test statistic and optimal weights · p. 3

  • Results

    False global decisions fall by 68% relative to fixed-allocation WPDM and OFDM tiers, and by 44% relative to re-attestation.

    Source: §VII · p. 6

  • Takeaways & Limitations

    WPDM tree depth can serve as a graded access primitive whose waveform carries entitlement and whose correlator bank holds evidence of violations.

    Source: §VII · p. 6

    The reported results hold under emission model T1 and the paper’s leaf-domain noise model.

    Source: §VII · p. 6

Abstract

from arXiv · show

Access control in Internet of Things (IoT) sensor networks usually acts above the physical layer: the fusion centre decides which reports to accept, while the radio of a compromised node keeps occupying the shared channel. This paper places the entitlement in the waveform: wavelet packet division multiplexing (WPDM) builds the channel as a binary tree of orthogonal pulses, and each sensor's reputation sets the depth of the subtree it may use: trusted sensors hold wide subbands, and low-trust sensors hold narrow subbands that the fusion centre withdraws one at a time. We prove that the allocation isolates sensors exactly under perfect timing, and that under a timing offset the energy leaking out of the lowpass leaf falls fourfold per tree level. The locally optimum detector of out-of-subtree transmission in impulsive Class-A noise weights each leaf in proportion to this predicted leakage. We bound the time needed to confine a compromised node and derive the optimal tree depth. In simulation, with demoted nodes radiating within their allocation, the scheme lowers the probability of a false global decision by 68% relative to fixed-allocation WPDM and to OFDM with the same reputation tiers, and by 44% relative to cryptographic re-attestation, which leads once more than 24% of the sensors are compromised.

I. INTRODUCTION

Industrial sensor access control can revoke reports while leaving a compromised radio on the shared channel. The paper uses WPDM tree depth to tie reputation to physical spectrum access, building on nested orthogonal subbands.

I. INTRODUCTION

  • Industrial sensor groups send one-bit local decisions over a shared channel to a fusion centre, where reports are combined into global decisions amid shadowing and impulsive noise.A compromised sensor can mislead its own group and corrupt honest reports by transmitting on their subbands.Source: §I · p. 1
  • Existing approaches address parts of the problem: access-control schemes grant binary credentials, physical-layer checks verify transmitters or permits, and reputation-based fusion acts after reports arrive.WPDM literature assumes nodes transmit where instructed, leaving graded spectrum access unaddressed.Source: §I · p. 1

A. Network and wavelet packet tree

  • Each WPDM tree split halves bandwidth and doubles symbol duration, creating nested bandwidth–time allocations for a graded access policy.The paper presents this hierarchy as the basis for assigning wider subbands to trusted sensors and narrower ones to lower-trust sensors.Source: §I · p. 1, A. Network and wavelet packet tree · p. 2

I. INTRODUCTION

  • Reputation selects a sensor’s WPDM subtree depth, tying graded trust to physical spectrum access and receiver-side compliance checks.The paper identifies this as its primary contribution; its motivation is that upper-layer revocation leaves the compromised radio occupying the channel.Source: §I · pp. 1–2

B. Time-frequency frame and depth-graded allocation

The allocation maps sensor reputation to disjoint WPDM node-and-slot entitlements, with subtree depth controlling subband size. The receiver correlates every leaf, reusing its WPDM bank to detect violations without sensor-side pilots.

B. Time-frequency frame and depth-graded allocation

  • A fusion frame contains S slots of duration T_J, each carrying one copy of the tree; each depth-J node in a slot is a cell.Each cell has area WT0 at every depth.Source: B. Time-frequency frame and… · p. 2
  • A depth-graded allocation assigns each sensor disjoint node-and-slot pairs, with reputation tier determining how many nodes it holds and their depth.The definition requires the tree depth J to be at least the number of tiers so each allocated node is a proper subband.Source: B. Time-frequency frame and… · p. 2
  • A tier-q sensor holds 4^q cells in nodes at depth J−q, so lower-trust sensors can have a narrow subband withdrawn one node at a time.Higher tiers correspond to several wider subbands; new sensors start at tier 0.Source: B. Time-frequency frame and… · p. 2

C. Received signal and noise

  • The DFC correlates the received signal with every tree leaf, including leaves owned by other sensors and free leaves, using a bank already present in the WPDM receiver.The detector therefore adds zero pilot overhead; the leaf-domain noise is modeled as independent across leaves under a tractability assumption.Source: C. Received signal and noise · p. 2

D. Isolation and leakage

With perfect timing, WPDM orthogonality isolates each sensor’s entitled leaf from every other sensor. Timing offsets create leakage, whose depth dependence differs between lowpass and bandpass leaves.

D. Isolation and leakage

  • With zero timing offset for all sensors, any component from another sensor in a leaf’s received signal marks transmission outside that sensor’s entitlement.The result follows from orthonormality and the allocation’s one-owner-per-leaf property.Source: D. Isolation and leakage · p. 2
  • Under timing offset, lowpass-leaf leakage falls fourfold per tree level because deeper lowpass symbols last twice as long, making the same offset relatively smaller.The general leakage mechanism is overlap with neighboring pulses in proportion to pulse slope.Source: D. Isolation and leakage · p. 2
  • Bandpass-leaf leakage stays near (2πfcτ)^2 across depth because its slope energy is set mainly by its centre frequency.Deeper allocations provide finer revocation everywhere and higher timing tolerance on the lowpass branch.Source: D. Isolation and leakage · p. 2

E. Threat model

The threat model covers compromised sensors that may falsify reports, transmit outside their entitlement, or collude over reputation. Its analysis depends on constrained emission, attribution, and timing-offset assumptions.

E. Threat model

  • Compromised sensors may falsify decisions, transmit on unauthorized leaves, or collude to manipulate reputation reports.The DFC is the root of trust and broadcasts the allocation table signed with its key.Source: E. Threat model · p. 3
  • The analysis assumes compromised radios emit within a time-frequency region proportional to their current allocation and that the DFC can attribute residuals using per-node timing and channel estimates.These are assumptions T1 and T2.Source: E. Threat model · p. 3
  • An attacker that aligns its clock with the DFC removes leakage evidence, while wideband jamming and DFC compromise are outside the paper’s scope.For aligned attacks, the direct residual on the violated leaf becomes the evidence; this case is left for future work.Source: E. Threat model · p. 3

III. REPUTATION DYNAMICS AND CONFINEMENT

The DFC combines smoothed neighbor ratings with physical-layer evidence to update reputation. A detection latch makes descent deterministic, while trimming limits the influence of Byzantine ratings and a bound relates detection probability and reputation memory to confinement time.

III. REPUTATION DYNAMICS AND CONFINEMENT

  • Reputation smooths neighbor-consistency ratings, combines their trimmed mean with physical-layer evidence, and applies the resulting update to the next allocation.On demotion by one tier, the DFC keeps one child of each 2^(q−1) allocated nodes, reducing entitled area fourfold and returning the rest to a free pool.Source: §III · p. 3
  • If fewer than β of a node’s neighbors are Byzantine and honest reports lie within δ of their mean, the trimmed mean remains within δ of that mean.The reputation fixed point is within (1−ω)δ of the mix of the honest mean and physical-layer evidence.Source: §III · p. 3
  • When a node is flagged, the DFC holds its physical evidence at 1 until its reputation falls below the threshold two tiers beneath its detection tier.A false alarm can hold an honest node near (1−ω)TMβ, one tier down when ω = 0.5.Source: §III · p. 3
  • A compromised node in tier q keeps at most 4^q(E[Tconf] + 1) entitled cells under the confinement bound.The bound is valid for any reputation history before detection.Source: §III · p. 3

IV. DETECTION OF OUT-OF-SUBTREE TRANSMISSION

The detector tests residuals on leaves where an out-of-subtree transmission is predicted to leak, using a score function and leakage-dependent weights. In Class-A noise the score is a soft limiter, and under stated moment conditions the statistic is asymptotically Gaussian.

A. Test statistic and optimal weights

  • The detector draws evidence from clean leakage leaves, where an out-of-subtree transmission contributes cρℓ to each residual.The violated leaf itself also carries its owner's symbol, so decision-directed cancellation there absorbs part of the violation.Source: A. Test statistic and optimal weights · p. 3
  • In Class-A noise, the score g is a soft limiter that grows linearly for small |z| and decays for large |z|.The statistic is compared with a threshold set for the target false-alarm rate.Source: A. Test statistic and optimal weights · p. 3
  • For small |c|, the locally optimum weights are proportional to the predicted leakage ρℓ.The statistic combines weighted score values across leaves; this weighting maximizes deflection under the stated small-signal condition.Source: A. Test statistic and optimal weights · pp. 3–4
  • With finite third moments of g(zℓ) and vanishing per-leaf variance share, the statistic is asymptotically Gaussian, with detection probability evaluated from its mean and variance.For log-normal gains, the paper evaluates this law using the exact mean and variance of g(cρℓ + nℓ).Source: A. Test statistic and optimal weights · p. 4

B. Optimal tree depth

The tree-depth design balances evidence gathered across leaves against declining per-leaf energy and increasing overhead. Under the stated concavity assumptions, the objective has a unique optimum; in the geometric regime, the optimum depends on the per-leaf deflection scaling.

B. Optimal tree depth

  • The objective balances the logarithm of evidence against per-interval overhead, while deeper trees add combining leaves but reduce energy per leaf and increase system-management costs.The objective is F(J) = ln d(J) − µC(J).Source: B. Optimal tree depth · p. 4
  • Under Assumption 1, the design objective is strictly concave and has a unique maximizing depth, chosen from the neighboring integers when the continuous optimum is interior.At a boundary, the optimum lies at an endpoint of the admissible depth interval.Source: B. Optimal tree depth · p. 4
  • For a < 1/2, the continuous optimum is J* = log2[(1/2 − a)/(µC0)], clipped to [Jmin, Jmax]; for a ≥ 1/2, J* = Jmin.Source: B. Optimal tree depth · p. 4
  • Whenever evidence d(J) decreases while overhead C(J) increases, the objective decreases and the optimal depth is Jmin.This conclusion holds even without Assumption 1’s condition on ln ψ(γ(J)).Source: B. Optimal tree depth · p. 4

V. SIMULATION SETUP

The simulation uses a four-group, 64-sensor network and compares reputation-graded WPDM with fixed-allocation WPDM, OFDM, and cryptographic re-attestation. The protocol averages repeated fusion decisions under specified timing offsets and compromise behavior.

V. SIMULATION SETUP

  • Each plotted point averages 40 runs of 150 fusion intervals across four groups, for 24,000 group decisions.The default compromised fraction is 0.15, swept from 0 to 0.30; timing offset is 0.1T0, swept to 0.2T0.Source: §V · p. 4
  • The experiment models compromised nodes as reporting the wrong hypothesis and transmitting on another node’s leaf; after demotion, the transmission hits with probability A(q)/A(q0) = 4^(q−q0).Under fixed allocation, the transmission hits with probability one.Source: §V · p. 4
  • Baselines include cryptographic re-attestation, fixed-allocation WPDM, OFDM with matching reputation tiers, and reputation-based fusion alone.The schemes use the same frame and cell budget per tier, giving equal spectral efficiency.Source: §V · p. 4

1) Leakage under a timing offset:

Under timing offsets, lowpass-leaf leakage falls rapidly with tree depth, while the proposed detector uses the predicted leakage pattern to detect out-of-subtree transmissions in Class-A noise. Tree depth trades detection strength against finer revocation.

1) Leakage under a timing offset:

  • Lowpass-leaf leakage falls by a factor of 4.00 per level (log slope −1.386), follows τ² (exponent 2.000), and the bound exceeds measurements by 1.6 to 3.1.Counting all leaves in the db8 tree matches the leakage bound within 1%; the gap from same-subband measurements is energy crossing into other subbands, largest for db4.Source: 1) Leakage under a timing offset · pp. 4–5
  • For db16 to db4, (2πB0)² ranges from 3.41 to 4.17 and equals 3.554 for db8 and sym8.The gap between same-subband and all-leaf measurements reflects energy crossing into other subbands, largest for the short db4 filter.Source: 1) Leakage under a timing offset · p. 5

2) Detection and tree depth:

  • The proposed detector reaches AUC 0.77, versus 0.56 for the energy detector and 0.53 for uniform weights; at PF A = 0.01, PD = 0.276.The Gaussian approximation predicts PD = 0.28 at that operating point.Source: 2) Detection and tree depth · p. 5, Figure 2 · p. 5
  • In the geometric regime, the closed-form optimum J⋆ = 4 matches the numerical maximiser, while the simulated tree’s objective is maximized at the shallowest admissible depth, J⋆ = 3.The paper uses J = 4: relative to J = 3, it halves a tier-0 subband’s bandwidth for a 0.029 loss in PD.Source: 2) Detection and tree depth · p. 5, Figure 3 · p. 5

3) Comparison with the state of the art:

The proposed scheme reduces false global decisions against fixed-allocation WPDM, OFDM tiers, and re-attestation; confinement-time results show physical-layer evidence shortens demotion. The conclusion identifies a depth trade-off between detection and finer revocation.

3) Comparison with the state of the art:

  • At fB = 0.15, false global decisions were 0.012 for the proposed scheme, 0.022 for re-attestation, 0.039 for fixed-allocation WPDM and OFDM tiers, and 0.092 for reputation fusion alone.These correspond to reductions of 44%, 68%, and 87%, respectively.Source: 3) Comparison with the state of the art · p. 5
  • Re-attestation leads above fB ≈ 0.24, all schemes perform alike below fB = 0.06, and the two mechanisms complement each other.Demotion shrinks a compromised node’s band, whereas re-attestation removes its reports but leaves its band in place.Source: 3) Comparison with the state of the art · pp. 5–6

4) Confinement and reputation robustness:

  • At ω = 1, mean confinement time was 7.2 intervals, below the 8.6-interval bound; every node was confined after at least 5 intervals.Late first detections account for the tail beyond the descent term.Source: 4) Confinement and reputation robustness · p. 6, Figure 5 · p. 6
  • Physical-layer evidence shortened confinement by 22% at ω = 0.5 and 39% at ω = 1; the default ω = 0.5 retains neighbour ratings against timing-aligned attackers.At fB = 0.15, false alarms confined honest nodes for 0.6% of intervals and moved them down one tier for 28%, without affecting decision reliability.Source: 4) Confinement and reputation robustness · p. 6

VII. CONCLUSION

  • The conclusion selects J = 3 as the shallowest admissible depth; J = 4 trades a small detection loss for finer revocation.The leakage-weighted detector reaches AUC 0.77 in Class-A noise versus 0.56 for the energy detector; results assume emission model (T1) and the leaf-domain noise model.Source: §VII · p. 6
Loading 2610.12038v1…