Searcharxiv⌕ Search
Home/Archive/arXiv

arXiv · 2602.22738

CSI-RFF: Leveraging Micro-Signals on CSI for RF Fingerprinting of Commodity WiFi

Ruiqi Kong·He Chen
View original source ↗Read source document ↗Export metadata ↓

Abstract

This paper introduces CSI-RFF, a new framework that leverages micro-signals embedded within Channel State Information (CSI) curves to realize Radio-Frequency Fingerprinting of commodity off-the-shelf (COTS) WiFi devices for open-set authentication. The micro-signals that serve as RF fingerprints are termed ``micro-CSI''. Through experimentation, we have found that the presence of micro-CSI can primarily be attributed to imperfections in the RF circuitry. Furthermore, this characteristic signal is detectable in WiFi 4/5/6 network interface cards (NICs). We have conducted further experiments to determine the most effective CSI collection configurations to stabilize micro-CSI. Yet, extracting micro-CSI for authentication purposes poses a significant challenge. This complexity arises from the fact that CSI measurements inherently include both micro-CSI and the distortions introduced by wireless channels. These two elements are intricately intertwined, making their separation non-trivial. To tackle this challenge, we have developed a signal space-based extraction technique for line-of-sight (LoS) scenarios, which can effectively separate the distortions caused by wireless channels and micro-CSI. Over the course of our comprehensive CSI data collection period extending beyond one year, we found that the extracted micro-CSI displays unique characteristics specific to each WiFi device and remains invariant over time. This establishes micro-CSI as a suitable candidate for device fingerprinting. Finally, we conduct a case study focusing on area access control for mobile robots. Our experimental results demonstrate that the micro-CSI-based authentication algorithm can achieve an average attack detection rate close to 99% with a false alarm rate of 0% in both static and mobile conditions when using 20 CSI measurements to construct one fingerprint.

Explore related subjects

eess.SP

Keep this discovery

BibTeXRIS

Ruiqi Kong, He Chen. 2026-02-26. CSI-RFF: Leveraging Micro-Signals on CSI for RF Fingerprinting of Commodity WiFi. https://doi.org/10.1109/tifs.2024.3396375

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Load Balancing in Multi-Shell LEO Satellite Networks with Successive Interference Cancellation

Multi-shell low Earth orbit (LEO) networks can increase service opportunities, but altitude-dependent propagation can concentrate traffic on lower shells and create strong inter-shell interference under full frequency reuse. This paper develops a mathematical framework for load balancing in multi-shell LEO satellite networks. Satellites on each shell form an independent spherical Poisson point process (SPPP), and the typical user associates with one of the per-shell serving satellites through a shell-dependent biased received-power rule, with receiver-side successive interference cancellation (SIC) under full frequency reuse. Shell-wise association probabilities, conditioned serving-distance distributions, and the rate coverage probability under shell-dependent traffic loads are derived and validated by simulation. The results show that shell-dependent biasing alleviates lower-shell traffic concentration and improves rate coverage, while receiver-side SIC mitigates the dominant lower-shell interference experienced by users associated with upper shells. Load balancing provides its largest rate-coverage gain in traffic hotspots, while SIC becomes more valuable as receive-side isolation weakens. With a fixed satellite budget, distributing satellites across multiple shells can further improve hotspot rate coverage by adding shell-wise serving opportunities.

eess.SP↗
arXiv2026

Tensor Decomposition Based Mixed-Field Sensing for XL-MIMO AFDM Systems

Integrated sensing and communications enabled by extremely large-scale MIMO (XL-MIMO) and affine frequency division multiplexing (AFDM) is a highly promising paradigm for vehicular networks. However, the near-field spherical wavefront distortions induce severe non-linear parameter coupling, while the highly dynamic scattering environments exacerbate mismatch errors. To address these critical challenges, this paper proposes a novel tensor-based sensing scheme for XL-MIMO AFDM systems. First, the received signals are reformulated into a tensor, followed by an efficient decomposition approach that exploits the inherent Vandermonde structure of the factor matrices. This allows parameters to be directly estimated from the decomposed matrices, effectively avoiding inter-parameter coupling. Subsequently, a symmetric decoupling and real-domain manifold optimization algorithm is proposed for angle of arrival estimation, circumventing the high-dimensional searches typically induced by near-field effects. Furthermore, a baseband reconstruction and analytical gradient-based algorithm is developed to perform delay-Doppler estimation in the continuous parameter domain, fundamentally eradicating the grid-mismatch errors inherent in high-mobility scenarios. With these decoupled factors, the remaining unknown angle of departure can be readily extracted. Extensive simulation results demonstrate that the proposed scheme achieves orders-of-magnitude improvements in delay-Doppler accuracy and eliminates the error floors in angular estimation that severely bottleneck state-of-the-art baselines.

eess.SP↗
arXiv2026

Radio Map Construction with Post-Hoc Location Calibration under Quasi-Static Positioning Errors: Joint Estimation, Performance Bounds, and GNSS-Based Evaluation

Radio maps enable environment-aware wireless and Internet-of-Things applications and can be constructed from location-tagged received signal strength (RSS) measurements collected by mobile devices. In urban environments, temporally correlated GNSS errors can shift an entire sensing trajectory, causing systematic spatial misregistration that is not mitigated by collecting more measurements. This paper presents a radio-map construction framework that uses the radio measurements themselves to calibrate erroneous location tags after data collection. The dominant positioning error is modeled as a sensor-specific quasi-static offset, which is jointly estimated with radio-propagation parameters in a Gaussian process regression (GPR) framework by exploiting complementary spatial information from distance-dependent path loss and spatially correlated shadowing. We establish lower and upper bounds on the conditional Bayes risk and show that, under a translation-invariant trajectory model, trajectory information alone cannot identify the quasi-static offset, thereby motivating the use of RSS-derived spatial information for calibration. Numerical evaluations across propagation conditions show that the proposed method reduces the mean squared error (MSE) gap from ideal GPR to approximately $3.26\mathrm{dB}^2$, compared with about $10\mathrm{dB}^2$ for position-error-agnostic and noisy-input GPR baselines. Evaluation using positioning-error models derived from smartphone GNSS measurements shows that the proposed method outperforms a KF--RTS trajectory-smoothing baseline despite unmodeled time-varying positioning errors, remaining within approximately $5\mathrm{dB}^2$ of ideal GPR at the median MSE. These results demonstrate that RSS measurements can serve not only as observations for radio-map reconstruction but also as spatial cues for post-hoc calibration of imperfectly geotagged sensing data.

eess.SP↗