Physical Layer-Based Device Fingerprinting for Wireless Security: From Theory to Practice

arXiv:2506.09807v1 [cs.CR] 11 Jun 2025 1 Physical Layer-Based Device Fingerprinting For Wireless Security: From Theory To Practice Junqing Zhang, Senior Member, IEEE, Francesco Ardizzon, Member, IEEE, Mattia Piana, Graduate Student Member, IEEE, Guanxiong Shen, and Stefano Tomasin, Senior Member, IEEE Abstract—The identification of the devices from which a message is received is part of security mechanisms to ensure authentication in wireless communications. Conventional authentication approaches are cryptography-based, which, however, are usually computationally expensive and not adequate in the Internet of Things (IoT), where devices tend to be low-cost and with limited resources. This paper provides a comprehensive survey of physical layer-based device fingerprinting, which is an emerging device authentication for wireless security. In particular, this article focuses on hardware impairment-based identity authentication and channel features-based authentication. They are passive techniques that are readily applicable to legacy IoT devices. Their intrinsic hardware and channel features, algorithm design methodologies, application scenarios, and key research questions are extensively reviewed here. The remaining research challenges are discussed, and future work is suggested that can further enhance the physical layer-based device fingerprinting. Index Terms—Channel state information, deep learning, device authentication, hardware impairments, Internet of Things, machine learning, radio frequency fingerprint, and wireless security. I. INTRODUCTION The Internet of Things (IoT) is expected to significantly impact our lifestyles. According to IoT Analytics, the number of connected devices reached to 18.8 billion in 2024, an Manuscript received xxx; revised xxx; accepted xxx. Date of publication xxx; date of current version xxx. The work of J. Zhang was supported in part by the UK Engineering and Physical Sciences Research Council (EPSRC) under grant ID EP/Y037197/1 and in part by the UK Royal Society Research Grants RGS\R1\231435. The work of J. Zhang and S. Tomasin was also supported by the EU COST Action CA22168 - Physical layer security for trustworthy and resilient 6G systems (6G-PHYSEC). The work of M. Piana was funded by the European Commission through the Horizon Europe/JU SNS project ROBUST-6G (Grant Agreement no. 101139068). The work of G. Shen was supported in part by the National Natural Science Foundation of China under Grant 62401138. The work of S. Tomasin was supported by the project ISP5G+ (CUP D33C22001300002), which is part of the SERICS program (PE00000014) under the NRRP MUR program funded by the EUNGEU. For the purpose of open access, the authors have applied a Creative Commons Attribution (CC BY) licence to any Accepted Manuscript version arising. The review of this paper was coordinated by xxx. (Corresponding author: Junqing Zhang.) J. Zhang is with the Department of Electrical Engineering and Electronics, University of Liverpool, Liverpool, L69 3GJ, United Kingdom. (email: [email protected]) F. Ardizzon, M. Piana, and S. Tomasin are with the Department of Information Engineering, University of Padova, Padova, Italy. (emails: [email protected]; [email protected]; [email protected]) G. Shen is with the School of Cyber Science and Engineering, Southeast University, China. (email: [email protected]) Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org. Digital Object Identifier xxx increase of 13% from 2023 [1]. These massively connected IoT devices have transformed our everyday lives with exciting applications such as smart homes, smart cities, connected healthcare, industry 4.0, etc. Wireless communications are preferred to connect these devices seamlessly. There have been many techniques for IoT, including WiFi (IEEE 802.11), ZigBee (IEEE 802.15.4), long range (LoRa), Bluetooth low energy (BLE), and narrowband IoT (NB-IoT), to name but a few [2]. This revolution requires security at all levels. Security is quite a broad topic, involving confidentiality, integrity, availability, authentication, etc. [3], [4]. This article will focus on device authentication, which is the first important step for network security. The receiver verifies the legitimacy of the received signal by checking specific features in the same signal. Our current computer and communications networks are protected by cryptography-based approaches, including both symmetric encryption, such as advanced encryption standard (AES), and public-key cryptography (PKC) such as Rivest-Shamir-Adleman (RSA). In particular, authentication is performed using a cryptographic challenge-response protocol based on symmetric encryption or PKC. However, cryptographic solutions may not be applicable to IoT devices. Symmetric encryption requires a key preshared, whose refresh turns to be challenging for IoT [5]. PKC requires computationally expensive algorithms, which often have severe power and computational limitations [3], hence they are unsuitable for IoT devices. In addition, on the eve of quantum computing, PKC may be compromised due to the exponential increase in the computational power of attackers [6]. Due to the above limitations, there is a lack of competent IoT security solutions, and there have been many notorious security threats to IoT devices [4]. This background is driving the development of lightweight, yet secure technologies for the IoT. Regarding device authentication, the two most promising non-cryptographic approaches are physical layer-based device fingerprinting [7], which includes hardware impairments-based radio frequency fingerprint identification (RFFI) [8] and channel-based authentication [9]. In detail, •RFFI uses unique hardware impairments as the device identifier. Due to the imperfect manufacturing process, the nominal values of hardware components slightly deviate from their specification. These hardware impairments are unique and stable, which can be exploited as device fingerprints. 2 •Channel-based authentication exploits the channel characteristics through which the signal propagates to identify the source (or, better, its location) at the receiver, taking advantage of the fact that signals transmitted by devices at different locations travel through different channels (i.e., different delays and attenuations for each path). Thus, the propagation environment, rather than the transmitting device characteristics, and the relative position between transmitter and receiver, guarantee the authenticity of the transmitter. A. Existing Surveys Here we provide a review of the recent tutorials and survey papers published on similar topics [10]–[19]. 1) Existing Surveys on Device Fingerprinting: Paper [10] provides a tutorial on fingerprinting at different layers including physical, MAC, and network layers. We will focus on the physical layer techniques and significantly extend [10] by summarizing the recent advances in the area as deep learning has brought several exciting improvements. Paper [11] focuses on device behavior fingerprinting, which is related to not only communication networks-based fingerprints but also in-device fingerprints, e.g., resource usage, software signatures, etc. Moreover, it is not solely concerned with security issues; it also encompasses a significant amount of fault detection content. The authors only briefly introduce the availability of the physical layer device fingerprinting technique but do not provide sufficient details on the latest studies and state-of-the-art schemes. Survey [12] examined device fingerprinting techniques for resource-constrained IoT applications. While traffic and impairment-based approaches were considered, the survey did not include wireless channel-based methods. From the perspective of identification algorithms, although the deep learning techniques were mentioned, they were limited to a conceptual overview, with insufficient in-depth profiling of state-of-the-art deep learning-based fingerprinting algorithms. The work in [13] surveyed numerous available device fingerprints, which span the entire cyber-physical system and encompass various characteristics, including thermal, optical, chemical, magnetic, and electrical aspects. However, it only briefly introduced the physical layer device fingerprinting problem and did not discuss the latest technologies. Furthermore, the authors focused on feature selection, while the introduction to the latest authentication algorithms is missing. 2) Existing Surveys on Physical Layer Security and Authentication: Surveys [14], [15] provide comprehensive coverage of physical layer authentication (PLA) techniques, with both passive and active approaches. Our survey will focus on the passive approaches as they can be readily applied to our pervasive IoT devices. Additionally, while the authors already considered the use of machine learning (ML) techniques, the coverage of the literature on ML solutions for device authentication is only partial, as the use of ML has become popular only in recent years. When looking at physical layer solutions, many techniques require models of specific channels they work on. Existing surveys, such as [16]–[18] cover physical layer authentication techniques tailored for specific application domains. In particular, [16] considers device fingerprinting for global navigation satellite systems (GNSS) antispoofing. Both crypto and physical layer solutions are considered in [17], but only for satellite Internet. Illi et al. focus instead on physical layer security solutions and the IoT [18]. Finally, the survey [19] reviews both physical layer authentication and secure transmission, and it mainly focuses on channel-based authentication. We will delve into device fingerprinting by covering both hardware impairments-based and channel-based approaches. 3) Summary: A common shortfall in all existing papers is the absence (or very limited coverage) of experimental results and their derivation, which are crucial for assessing the merits and fostering the implementation of new security approaches. Several new techniques have appeared in recent years that are not covered by those surveys, e.g., generative AI for authentication, reconfigurable wireless environments, e.g., with reflective intelligent surfaces (RISs) and drones for challenge-response authentication at the physical layer, etc. Lastly, fingerprinting and authentication have been investigated in several domains, including different frequency bands and applications (IoT, mobile sixth generation (6G), WiFi, ...) for radio transmissions, but also in underwater acoustic communications (UWAC). An extensive survey of such domains and their peculiarities for fingerprinting/authentication is missing. B. Survey Aims As summarized in Table I, this paper complements and extends the published surveys with a comprehensive review of the physical layer-based fingerprinting for wireless security. We will review the design principles of both RFFI and channel-based authentication. We will also compare these two approaches and discuss their integration for more secure authentication mechanisms. Among the most promising and recent advances in these areas, we mention the availability of new technologies (such as RIS), the use of new transmission bands that fostered related technologies such as integrated communication and sensing, the experimentation (thus with higher technology readiness level) of physical-layer security mechanisms, and the use of ML techniques to secure transmissions by merging information coming from different communication layers. As unique features of our survey paper, we cover topics from theoretical development to practical implementation and share our experiences and insights on the design considerations of practical implementation. Thus, while looking at a specific domain, it will still provide a general framework to discuss solutions across different domains. C. Survey Structure Section II gives an overview of physical layer-based device fingerprint, which is further categorized into two techniques. The rest of the survey is comprised of three parts. The first part will cover the first technique, which is hardware impairmentsbased authentication, i.e., RFFI. The second part will describe channel-based authentication. 3 TABLE I COMPARISON WITH EXISTING SURVEYS.✗,❍,AND ✓MEAN THE TOPIC IS NOT COVERED,PARTIALLY COVERED,AND EXTENSIVELY COVERED. Ref Year ML Exp. Domains New Tech. [10] 2015 ✗ ✗ Wireless Networks ✗ [11] 2021 ✓ ✗ IoT ✗ [12] 2022 ✓ ✗ IoT ✗ [13] 2023 ✓ ✗ Cyber-Physical System ✗ [14] 2020 ❍ ✗ Wireless Networks ✗ [15] 2020 ❍ ✗ Wireless Networks ✗ [16] 2021 ✓ ✓ GNSS ✗ [17] 2023 ✓ ✗ Satellite Internet ✗ [18] 2024 ✓ ✗ IoT ✗ [19] 2024 ✓ ✗ Wireless Networks ✗ This 2025 ✓ ✓ IoT/6G/UWANs ✓ The first part is on RFFI and spans Sections III to VI. In particular, Section III presents the RFFI tasks, while Section IV models the hardware impairments for both transmitter and receiver. The algorithm design for deep learning-based RFFI is explained in Section V. For the practical implementation of RFFI, Section VI describes the key research topics, publicly available datasets, and the investigated scenarios. Section VII explains the experimental methodologies for RFFI. The second part is on channel-based authentication and spans Sections VIII to XI. In particular, Section VIII introduces the definition and the approaches used for channel-based (CB)-PLA and Section IX is devoted to an overview of the channel features exploited for CB-PLA. An in-depth delve into the methodologies used for CB-authentication, including both statistical and ML approaches, is provided in Section X. Lastly, Section XI provides an overview of CB-authentication datasets publicly available and existing applications. The third part provides an overview of challenges and future research activities discussed in Section XII. The main conclusions are reported in Section XIII. The abbreviations used in this paper can be found in Table II. II. DEVICE FINGERPRINTING AT THE PHYSICAL LAYER The authentication on the basis of the signals exchanged at the physical layer comprises security mechanisms that can be classified as hardware fingerprinting or CB authentication techniques, which provide lightweight security mechanisms particularly useful in the IoT. As shown in Fig. 1, we will consider a system involving Ktransmitting IoT devices and a receiver. The IoT transmitter sends packets, which are captured by the receiver. Based on the received signals, the receiver aims to authenticate the transmitter based on its intrinsic hardware impairments and random channel features. 1) Transmitter: For each transmitter, the modulated signal, x(t), passes to the transmitter chain, including the mixer, oscillator, and power amplifier [8], [20]. These hardware components are not perfect due to the variation in the manufacturing process, and their specifications deviate slightly from their nominal values. Their effects are collectively represented by F(·). The radio frequency (RF) signal at the transmitter becomes s(t) = F(x(t)). Receiver Rx Chain y(t) Hardware Impairmentsbased Authentication (RFFI) sk(t)r (t) Mod. DUT 1 x(t)Tx Chain s1(t) …… sK(t) DUT k DUT K h1 (t) ℱ1∙ ℛ ∙ Mod.x(t)Tx Chain ℱ𝑘∙ Mod. x(t)Tx Chain ℱ𝐾∙ hk (t) hK (t)Channel-based Authentication Fig. 1. Physical layer-based device fingerprinting system overview. 2) Channel: The RF signal is emitted into the wireless channel, which experiences multipath channel effects, denoted as h(τ, t), resulting in the received signal as r(t) = h(τ, t)∗ F(x(t)),(1) where ∗denotes the convolution operation. Note that many IoT devices are mobile; hence the channel impulse response h(τ, t)is time-varying. 3) Receiver: The receiver captures the received signal r(t), which is passed to the receiver chain, including the mixer and oscillator too [8]. The receiver hardware components are not perfect either, and their effects are represented by R(·). Considering all the above processes, the received signal y(t) can be mathematically written as y(t) = Rh(τ, t)∗ Fk(x(t))+n(t),(2) where n(t)is the additive white Gaussian noise (AWGN). A. Device Fingerprinting As can observed from (2), the received signal, y(t), involves both the hardware impairments and channel features, which can be exploited for device authentication. 1) Hardware Impairments-Based Authentication: Due to the manufacturing process, the hardware components are not perfect. Hence, hardware components are subject to impairments, such as mixer imbalance, oscillator imperfection, and power amplifier non-linearities [8], [20]. These impairments are minute and do not affect the communication functionalities because they can be compensated for by the receiver. These features are unique and can be used as device identifiers. RFFI protocols extract the hardware impairments embedded in the signal and infer its corresponding device identity. 2) Channel Based Authentication: The channel over which the transmitted signal travels is characterized by reflections, scattering, attenuations, as well as angular / time / Doppler features, and the position of the transmitter and the receiver. CB authentication uses this information from the channel to identify the sender of the message (and the channel over which the signal is going). A basic assumption is that devices are slowly moving and the environment is slowly changing; thus, 4 TABLE II LIST OF ABBREVIATIONS Abbreviation Definition Abbreviation Definition 6G sixth generation LRT likelihood ratio test AE autoencoder LSTM long-short term memory AML adversarial machine learning LT likelihood test AoA angle-of-arrival LTE long-term evolution AoD angle-of-departure MD misdetection AWGN additive white Gaussian noise MIMO multiple-input multiple-output BAAE Bahdanau attention autoencoder ML machine learning BLE Bluetooth low energy NLOS non-line-of-sight CB channel-based NN neural network CFO carrier frequency offset OC-SVM one-class support vector machine CFR channel frequency response OFDM orthogonal frequency-division multiplexing CIR channel impulse response pdf probability density function CNN convolutional neural network PDP power-delay profile COTS commercial off-the-shelf PLA physical layer authentication CR challenge-response QuaDRiGa quasideterministic radio channel generator CSI channel state information RFF radio-frequency fingerprint DRL deep reinforcement learning RFFI radio frequency fingerprint identification DT decision tree RIS reflective intelligent surface DUT devices under test RL reinforcement learning EL enseamble learning RMS root-mean square FA false alarm RNN recurrent neural network FFT fast Fourier transform RSS received signal strength GAN generative adversarial network SCM normalized sample covariance matrix GLRT generalized likelihood-ratio test SDR software-defined radio GNN graph NN SNR signal-to-noise ratio GNSS global navigation satellite systems SVM support vector machine GPR Gaussian process regression TDOA time difference of arrival GPS global positioning system TLE two-line element GRU gated recurrent unit TOA time of arrival IoT Internet of Things USRP universal software radio peripheral KF Kalman filter UWAC underwater acoustic communications KNN K-nearest neighbors UWB Ultra-Wideband LEO low Earth orbit V2V vehicle to vehicle LLM large language models VAE variational autoencoder LoRa long range VANET vehicular ad-hoc network LOS line-of-sight VLC visible-light communications the authentication mechanism checks if different transmissions experience similar propagation channels. Other approaches are also discussed in the following, where the channel can change fast, but its consistent evolution over time provides the authentication feature. III. RADIO FREQUENCY FINGERPRINT IDENTIFICATION Deep learning has transformed many areas thanks to its powerful automatic feature extraction capability, which has also significantly enhanced RFFI. To the best knowledge of the authors, the work in [21] is the first paper applying deep learning to RFFI. Specifically, convolutional neural network (CNN) and multilayer perceptron (MLP) are used to classify LoRa devices. After that, deep learning has attracted massive interest in the RFFI area. Many deep learning approaches, such as CNN [22]–[24], recurrent neural network (RNN) including long-short term memory (LSTM) [22], [24] and gated recurrent unit (GRU) [24], Transformer [24], etc, have demonstrated significant impact, which can alleviate the difficulties of manual feature engineering. Depending on whether there are rogue devices involved, RFFI can be categorized into closed-set classification, openset recognition, and anomaly detection [25], whose implementations are illustrated in Fig. 2. A deep learning-based RFFI protocol involves two stages, namely training and inference. A deep learning model will be trained using a training dataset, Dtrain, and the trained deep learning model will be used for inference in the second stage. A. Closed-Set RFFI Classification As shown in Fig. 2(a), there are Klegitimate transmitters, a.k.a. devices under test (DUT), to be identified, and no rogue device is considered in the closed-set RFFI classification. The devices in the training and inference stages remain the same, hence the name “closed-set” comes from. The approach will predict the identity of the DUT. Close-set RFFI classification is probably the most studied scenario in RFFI, which is a multi-class classification problem. Hence, deep learning is perfect for such tasks. A training dataset, Dtrain ={(yi, ℓi)}NK i=1 , will be constructed, where ℓiis the device label of the collected i-th packet and Nis the number of packets collected for each DUT. The number of packets from each DUT should be kept the same, to ensure 5 DUT 1 DUT K DUT k 1 K … DUT 1 DUT K DUT k 1 K … DUT 1 DUT K DUT k 1 K … Rogue Device DUT 1 DUT K DUT k 1 K … DUT 1 DUT K … DUT k1 0 Rogue Device DUT 1 DUT K DUT k Rogue Device DUT 1 DUT K DUT k Training Stage Inference Stage (a) Closed-set Classification (b) Open-set Recognition (c) Anomaly Detection – Binary Classification (d) Anomaly Detection – Autoencoder Feature extractor (Encoder) 1 K … Classifier Decoder Legend: DUT 1 DUT k 𝑢𝑢′ 𝑢𝑢′ 1 0 Fig. 2. Deep learning-based RFFI tasks. Convolutional layer … … … Classifier Feature Extractor 2 1 K Input Fig. 3. Illustration of a CNN architecture. a balanced dataset. A deep learning model can be partitioned into a feature extractor and a classifier. A CNN architecture is given as an example in Fig. 3. The feature extraction includes convolutional layers and pooling layers. The classifier is composed of a few fully connected layers, and the last layer has Kneurons corresponding to Kclasses. In the training stage, the parameters Θof the deep learning model fare optimized as Θ = arg min ΘX (yi,ℓi)∈Dtrain L(f(yi; Θ), ℓi),(3) where L(·)is the loss function, e.g., the cross-entropy loss. In the inference stage, the softmax is used as the activation function, then the last fully connected layer of the classifier will return a list of probabilities p= (p1, p2, ..., pK), where pkrepresents the probability of the k-th device, given as pk=ezk PK i=1 ezi ,(4) where z= (z1, z2, ..., zK)is the output of the layer before the softmax activation. The final prediction is obtained by locating the maximum probability, given as ˆ ℓ= arg max k(p).(5) B. Open-Set Recognition Under closed-set classification, rogue devices will be classified as the legitimate DUT with the closest features, which is not acceptable as attackers will be admitted. Therefore, openset recognition is required. In open-set recognition, there are Klegitimate DUTs and rogue devices, as illustrated in Fig. 2.b. Because rogue devices do not appear in the training stage, it is named “open-set”. We need to first detect whether the DUT is legitimate or rogue, then further classify the index for legitimate DUTs. Open-set recognition can be addressed by the deep learningbased approaches with an adjustment to the softmax activation function. Hence, the training and inference stages will be similar to the closed-set classification. The training dataset can be constructed in the same way as the closed-set classification. Gritsenko et al. leveraged the output probabilities of softmax given in (4) for open-set recognition [26]. Specifically, when the signal is from an unseen rogue device, the confidence level of the neural network prediction is low, hence, the output probability will be smaller than a pre-calculated threshold. In contrast, when it is from a legitimate DUT, the neural network can predict as it does in the closed-set classification. Hanna et al. adopted a new activation function, the OpenMax [25]. The activation vector zprior to softmax is extended to K+ 1 outputs, given as z′ k=(zkωk, k ∈ {1, ..., K} PK k=1 zk(1 −ωk), k =K+ 1 (6) where ωkis a confidence parameter of the sample belonging to k-th class1and the additional K+ 1 output refers to the rogue devices. The vector z′ kis then fed into the softmax function, and the prediction can be obtained using (5). Different from [26] only leveraging the softmax output probabilities, this work exploits the entire activation vector, which is more robust. 1Please refer to [25] for the detailed calculation. 6 Open-set recognition can also be tackled by non-deep learning-based methods. Shen et al. designed a K-nearest neighbors (KNN)-based method [23]. They created a radiofrequency fingerprint (RFF) database that stores a few RFF features for each legitimate DUT. In the inference stage, RFF features will be extracted from the input signal and compared with the features in the database. The attacker is not registered beforehand, hence their features are largely different, which can be detected via a large feature distance. In contrast, the legitimate devices can be identified because there will be a matching feature in the database. C. Anomaly Detection There are Klegitimate DUTs and rogue devices involved in the inference stage. Different from open-set recognition, anomaly detection only detects whether the DUT is legitimate or rogue. Because it is not practical to assume attackers are cooperative, hence, they are not available in the training stage. Anomaly detection can be achieved by binary classification. As shown in Fig. 2.c, the Klegitimate DUTs are treated as one class (label 1). A few other DUTs will be used to represent rogue devices, which serve as the other class (label 0). The system design will be similar to the closed-set classification, but the number of classes reduced to two. However, in the inference stage, when the rogue device appears, it is supposed to be classified as label 0. Autoencoder (AE) is a popular unsupervised deep learning architecture for anomaly detection [25]. An AE-based RFFI approach is portrayed in Fig. 2.d. In the training stage, similar to the binary classification approach, the KDUTs are treated as a single class. But differently, there is no other device required. AE consists of an encoder and a decoder. The encoder first compresses the input, u, to a latent feature; the decoder will then try to reconstruct the input signal from the latent feature and output u′. The mean square error (MSE) between uand u′is typically used as the reconstruction error. The training process will learn the features of the training data and reduce the MSE. In the inference stage, if the signal is from the legitimate DUT, the trained AE can reconstruct the input, and a low MSE will be returned. Otherwise, when the signal is from a rogue device, the MSE will be higher than a threshold, indicating an outlier is detected. IV. HARDWARE IMPAIRMENTS FOR RFFI Due to the variations in the manufacturing processes, the hardware components of the radio devices will not be perfect. Their specifications will deviate from their nominal values slightly, which are referred to as RF hardware impairments. This section will provide the key parts for the modelling of transmitter and receiver impairments. The detailed mathematical derivation can be found in [8]. A. Transmitter Impairments The architecture of a direct conversion transmitter is portrayed in Fig. 4. Their overall effects are represented as F(·) in Section II while their individual effects will be modelled in this section. Digital Modulation PN ൗ 𝜋2 − 𝜃𝑡𝑥 LO PA DAC DAC xI(t) xQ(t) sRF(t) s(t) 𝑔𝐼 𝑡𝑥 𝑔𝑄 𝑡𝑥 ∅𝑡𝑥(𝑡) 𝜃𝑡𝑥 cos(Ω𝑡𝑥 𝑡 ) Mixer Fig. 4. Transmitter impairment model. The local oscillator (LO) will produce a sinusoidal waveform with a specific carrier frequency. The output frequency is not stable but is subject to temperature and ageing. When the system’s nominal carrier frequency is f0 c, the real frequency is ftx =f0 c+ ∆ftx, where ∆ftx is the offset. Besides the carrier frequency offset (CFO), the LO is also subject to phase noise (PN), ϕtx(t). Considering all the LO imperfections, the carrier phase of the transmitter can be written as Ωtx(t)=2πftx ct+ϕtx(t) = 2πf0 ct+ 2π∆ftxt+ϕtx(t).(7) The mixer will then mix the baseband signal with the carrier wave. However, the mixer is also subject to gain and phase imbalance. Specifically, gtx Iand gtx Qrepresent the gain of in-phase (I) and quadrature (Q) branches, respectively; θtx denotes the phase imbalance. Due to the existence of gain and phase imbalance, the RF band signal then becomes [27] sRF (t) =gtx IxI(t) cos(Ωtx +θtx)−gtx QxQ(t) sin(Ωtx −θtx), =ℜ{sBB(t)ejΩtx },(8) where xI(t)and xQ(t)are the baseband data at the I and Q branches, respectively, and sBB(t) = gtx IxI(t)ejθtx +jgtx QxQ(t)e−jθtx .(9) The RF signal then undergoes the power amplifier, which introduces additional nonlinearities. A power amplifier in a narrowband system is usually modelled with memoryless nonlinear effects, including amplitude/amplitude (AM/AM) and amplitude/phase (AM/PM) characteristics [28]. There are several behavioural models, such as the Saleh, Rapp, and Ghorbani models, etc. [28]. After passing through a power amplifier, the signal becomes s(t) = A(|sBB(t)|)ej(∠sBB (t)+Ωtx (t)+Φ(|sBB (t)|)), =s′(t)ejΩtx(t),(10) where ∠sBB(t)is the angle of the baseband signal and s′(t) = A(|sBB(t)|)ej(∠sBB (t)+Φ(|sBB (t)|)).(11) B. Receiver Impairments Similarly, the receiver will also have RF impairments. Fig. 5 depicts the receiver architecture and its impairments, i.e., receiver LO imperfection and mixer imbalance. Their overall 7 RFFI LNA 𝜃𝑟𝑥 PN ∅𝑟𝑥 (𝑡) ൗ 𝜋2 − 𝜃𝑟𝑥 LO yI(t) LPF ADC LPF ADC r(t) yQ(t) 𝑔𝐼 𝑟𝑥 𝑔𝑄 𝑟𝑥 cos(Ω𝑟𝑥(𝑡)) yI[n] yQ[n] Mixer Fig. 5. Receiver impairments. effects are denoted as R(·)in Section II. In this section, we will model their individual effects. The LO at the receiver is also subject to frequency offset, ∆frx, and phase noise, ϕrx(t). The receiver carrier can then be written as Ωrx(t) = 2πfrx ct+ϕrx(t) = 2πf0 ct+ 2π∆frxt+ϕrx(t).(12) The receiver uses a mixer to mix the received signal, which will downconvert the signal from the RF band to the baseband. Similarly to the transmitter mixer, the receiver mixer also has gain imbalance (grx Iand grx Q) and phase imbalance (θrx). Considering the effects of the LO imperfection and mixer imbalance, the receiver’s carrier wave becomes Crx(t) = Krx 1e−jΩrx(t)+Krx 2ejΩrx(t),(13) where Krx 1= (grx Ie−jθrx +grx Qejθrx )/2and Krx 2= (grx Iejθrx −grx Qe−jθrx )/2. The RF signal captured by the receiver can be written as r(t)=(h(τ, t)∗s)(t)=(h(τ, t)∗s′)(t)ejΩtx (t).(14) After the downconversion (by the LO and mixer) and low-pass filter, the received signal at the baseband becomes y(t) = r(t)Crx(t) =Krx 1h(τ, t)∗s′(t)ej∆Ω +Krx 2(h(τ, t)∗s′)∗(t)e−j∆Ω, (15) where ∆Ω = 2π(∆ftx −∆frx)t+ϕtx(t)−ϕrx(t),∆f= ∆ftx −∆frx is the commonly known CFO. The baseband signal y(t)in (15) possesses all the RF impairments of both the transmitter and receiver. The analogue signal is sampled by the analogue-to-digital converter (ADC), which produces a digital sequence, y[n], and is used for RFFI. The transmitter impairments are the unique hardware features that RFFI explores. Regarding the receiver impairments, when the same receiver is used for collecting training and test datasets, the effects brought by receiver impairments are consistent and can be ignored. However, when different receivers are used, they will indeed affect RFFI performance, which will be reviewed in Section VI-C. V. DEEP LEARNING-BASED RFFI ALGORITHM DESIGN The deep learning-based RFFI algorithm design is shown in Fig. 6, including dataset collection, signal preprocessing, data augmentation, signal representation, and deep learning model. Inference Training Inference Signal Preproc. Trained DL Model DL Training Signal Rep. Signal Preproc. Signal Rep. Decision Training Dataset Data Aug. Signal Collection Signal Collection Test Dataset Fig. 6. Deep learning-based RFFI algorithm design. •Training Stage: Once a training dataset is created, the sampled signals are processed by signal preprocessing (Section V-B) and then converted to a proper signal representation (Section V-D). An additional data augmentation approach is usually adopted to enhance the dataset diversity (Section V-C). The samples are then input into a deep learning model for training, which will produce a trained deep learning model when completed. •Inference Stage: The signal undergoes the same signal preprocessing and signal representation algorithms, then is input to the trained deep learning model. The deep learning training can usually be done offline, while the inference should be done in real-time in practice, even though many papers do it offline for evaluation purposes. A. Signal Collection The signal data collection is essential to collect IQ samples and build up dedicated datasets. The readers can also opt to use public datasets, which will be summarized in Section VI. As introduced in [29], most RF fingerprinting studies utilize software-defined radio (SDR) as the wireless receiver to capture IQ samples for fingerprint extraction [22]. In addition, some WiFi-focused studies have explored the extraction of RF fingerprints from channel state information (CSI) provided by commercial network interface cards (NICs) or system-on-chips (SoCs), such as the Intel 5300 NIC [30], Atheros CSI tool [31], [32], Nexmon CSI tool [33], [34], and ESP32 CSI tool [35], [36]. More details can be found in Section VII. B. Preprocessing Signal preprocessing involves power normalization and CFO compensation. Power normalization can be done by normalizing the signal power with respect to the root-mean square (RMS) value of the power. CFO represents the difference between the carrier frequencies of the transmitter and receiver, as embedded in (??). CFO has been widely adopted in the literature. For example, the work in [37] designed an accurate algorithm to estimate CFO from CSI in WiFi, as CFO is twisted with frame detection delay, sample frequency offset, and time of flight. CFO is also used together with other parameters to classify WiFi devices in [38] and ZigBee devices in [39]. However, CFO is subject to temperature drift. In a sevenmonth study carried out in [22], it is revealed that CFO is not suitable as a unique and stable feature. Specifically, the instantaneous CFO varies quickly when the device is 8 powered on due to the emitted heat of the device. While the instantaneous CFO is varying, the work in [22] also found that the CFO mean value remains relatively stable over the sevenmonth test period, which is used as an auxiliary approach to calibrate the prediction of the deep learning model. In summary, due to the time-varying nature of CFO, it is suggested to carry out CFO compensation to preprocess the sampled signals, especially for low-cost IoT devices. C. Data Augmentation Data augmentation is used to augment the training dataset in a simulation manner. It is very time-consuming and labourintensive to collect a comprehensive training dataset using experiments. In contrast, data augmentation can generate many artificial samples by adding channel and noise effects, which can significantly reduce the data collection overhead [40]. Specifically, the original training dataset can be constructed by sampling high-quality signals, {yi}, which can be achieved by placing the DUT and receivers apart with a relatively short distance (e.g., less than 1 meter). We can then augment {yi} by emulating channel and noise as y′ i(t)=(yi∗h′(τ, t))(t)s+n′(t),(16) where h′(τ, t)is the multipath channel and n′(t)is the AWGN noise, both generated by a simulation model. In particular, the multipath channel modelling involves both the power-delay profile (PDP) and Doppler shift [23]. The PDP describes the attenuation gains of each channel tap. For example, the exponential PDP can be mathematically given as P(m) = 1 τd e−mTs/τd, m = 0,1, ..., mmax,(17) where τdis the RMS delay spread, mmax is the index of the last tap, and Tsis the sampling interval. Regarding the Doppler shift, it describes how the channel gain changes over time, with common models such as the Jakes model. By incorporating as many PDP and Doppler shift models as possible, data augmentation can significantly enhance the comprehensiveness of the training dataset. The channel modelling can be achieved by employing the fading channel realization in Matlab [41]. The comm.RayleighChannel and comm.RicianChannel functions provide abundant interfaces to configure PDP and Doppler shift. Furthermore, the Wi-Fi channel models are also available in Matlab [42], with PDP pre-configured. Besides the channel effect, AWGN can be added to emulate scenarios with different signal-to-noise ratio (SNR) levels. D. Signal Representation The signal captured by the receiver is always in the time domain initially, which is named IQ samples in the literature, as shown in (1). Utilizing raw IQ samples is applicable across any wireless protocol. However, as shown in (1), it is a time convolution between the hardware features and the channel, which makes it difficult to separate them in the time domain. Hence, IQ samples tend to be less effective for channel-robust RFFI, as evidenced in [43]. Frequency domain signal is popularly employed, which can be simply obtained by applying fast Fourier transform (FFT) operations to the time domain signal [22]. The channel effect can be separated from frequency domain signals more easily compared to the time domain counterpart. The time-frequency domain spectrogram is a widely employed signal representation in RFFI research [22], [44]. This can be obtained by applying a short-time Fourier transform (STFT) to the time domain signal. The time-domain IQ samples, frequency-domain FFT coefficients, and time-frequency domain spectrogram of LoRa preambles are exemplified in Fig. 7. In addition to these domain transform methods, there are also other specially designed signal representations. For instance, Peng et al. post-process the constellation figures, generating image-like differential constellation trace figures (DCTFs) [45]. The authors in [46] subtract the ideal signals from the received ones, creating error signals as neural network inputs. Other available signal representations include bispectrum [47], and Hilbert-Huang spectrum [48], etc. Aside from the signal representations derived from the steady-state portion of signals, some studies focus on extracting RF fingerprints from the transients that occur when transmitters are powered on or off [49]. However, this approach requires high-end receivers capable of operating at high sampling rates, which can significantly increase the cost of system deployment. E. Deep Learning Model The deep learning models are capable of extracting unique features from the input signal representations and subsequently predicting the device identity. The design of neural networks should take into account the employed signal representation, as illustrated in the following example. Image-like representations, such as spectrograms [44], [50], DCTF [45], and Hilbert-Huang spectrum [48], [51], are suitable for processing with CNNs, while time-domain IQ samples are suitable for processing with 1D CNNs or specially designed complexvalued neural networks [52]. Some studies also utilize MLP to process frequency-domain spectrum [21], [22]. As the captured radio signals exhibit temporal dependencies, sequence models can be employed for RFFI tasks as well. Recent studies have investigated the application of RNN, LSTM, GRU, and the latest Transformer models [24]. VI. RFFI KEY RESEARCH TOPICS, PUBLIC DATASETS AND APPLICATIONS As shown in (2), RFFI performance is affected by channel and noise effects as well as receiver impairments. Therefore, this section reviews the RFFI research activities related to these three areas, namely channel effects elimination, noise mitigation, and receiver distortion mitigation. In addition, public datasets are critical to the development of deep learningbased RFFI techniques. As summarized in Table III, there are some RFFI datasets shared by the community. We provide a list of available datasets to evaluate the above three research topics. Finally, we review the RFFI literature in terms of their application techniques, including WiFi, ZigBee, LoRa, cellular, and Iridium satellites. 9 0.2 0.4 0.6 0.8 1 Time (ms) -0.2 0 0.2 Magnitude (a) -400 -200 0 200 400 Frequency (kHz) 10 20 30 Amplitude (b) 200 400 600 800 Time (µs) -200 0 200 Frequency (kHz) (c) Fig. 7. Signal representation: (a) Time domain signals (I branch), (b) FFT coefficients, (c) spectrogram. TABLE III SUMMARY OF PUBLICLY AVAILABLE RFFI DATASETS Wireless Technology Dataset Paper # DUT Receiver Brief Summary Evaluation Purpose Channel Noise Receiver WiFi [53] [54] up to 150 USRP B210, X310 and N210 (up to 32) WiFi signals collected from different days and positions. ✓ ✓ WiFi [55] [56] 19 Xilinx Zynq ZC706 board + FMCOMMS5 ADI daughter board WiFi signals collected from different days and positions (indoor, outdoor, car park). ✓ WiFi [57] [58] 10 USRP X310 WiFi signals collected from different days and positions (indoor, static, mobile). ✓ ZigBee [59] [60] 60 USRP N210 Outdoor-NLOS, outdoor-LOS, indoor-NLOS, and indoor-NLOS ✓ LoRa [61] [23] 60 USRP N210 LoRa preambles. Signals from different channels available ✓ ✓ LoRa [62] [24] 10 USRP N210 LoRa preambles with different spreading factors ✓ LoRa [63] [64] 10 USRP N210 (3), B210 (2), B200 mini (2), Pluto (2), RTL (9) LoRa preambles. Signals from different receivers and channels available ✓ ✓ ✓ LoRa [65] [66] 60 USRP N210, B210, B200, B200 mini, Pluto, RTL LoRa preambles. Signals from different receivers and channels available ✓ LoRa [67] [44] 100 USRP N210 Signals from indoor and outdoor testbeds, and different days ✓ LoRa [68] [69] 25 USRP B210 Signals from different days, distances, locations and receivers ✓ Bluetooth [70] [71] 10 USRP X300 Signals collected from different locations and days ✓ UWB [72] [73] 13 COST UWB board Signals collected from different locations and days ✓ LTE [74] [75] 8 USRP N210 Signals collected from different locations and days ✓ Satellite [76] [77] 66 USRP X310 Signals from 66 Iridium satellites ✓ Satellite [78] [79] 66 USRP N210 Signals from 66 Iridium satellites ✓ A. Channel Effects Elimination 1) Research Activities: The received RF signals are affected not only by the transmitter hardware impairments but also by the wireless channel. In particular, the movement or relocation of wireless transmitters can result in fluctuations in the characteristics of received RF signals, which may subsequently interfere with the RFF extraction process. The negative impacts of wireless channels have been revealed in numerous recent RFFI studies. The authors in [52] and [54] conducted comprehensive experiments to assess the effects of wireless channels on RFFI. Their findings indicate that channel variations can lead to significant performance degradation when fingerprinting WiFi signals. Similar results are also found in fingerprinting wireless signals with narrower bandwidths, such as LoRa [23], [69] and ZigBee [80]. These studies experimentally demonstrate that the inevitable channel effects can degrade the RFFI performance, presenting a significant challenge that must be addressed. Recent studies attempt to mitigate the channel effects through two categories of approaches: signal processing and deep learning algorithms. The former category often employs expertise and prior knowledge in wireless communication to design signal processing algorithms to manually separate channel distortions from the received RF signal, constructing channel-robust features for identification purposes. For example, the authors in [23] propose to mitigate the multipath effects in the time-frequency domain by dividing neighbouring columns in a spectrogram, thereby generating a channel-independent signal representation. This method has been demonstrated to be effective in identifying LoRa devices, 16 Partially controllable channel Alice Bob Authenticated channel measurements Channel M Channel 1 (a) Identification association in CR-PLA. Trudy Partially controllable channel Alice Bob Response Challenge Selected configuration Response Resulting channel Resulting channel (b) Identification verification in CR-PLA. Fig. 10. Challenge-response paradigm scheme. In formulas, given the previous channel observations [x−N,x−N+1,...,x−1], the prediction function is denoted by g(·)and it provides y0=g([x−N,x−N+1,...,x−1]) ,(19) and the consistency check for the current observation x0is ˆ H=(ˆ H0if ∥y0−x0∥< λ, ˆ H1if ∥y0−x0∥ ≥ λ. (20) Variations to (20) include tests where no prediction is performed but the threshold is dynamically updated, e.g., as in [131]. We remark that differently from tag-based PLA, channel variation PLA is typically considered as a single-sided hypothesis testing or a one-class classification problem, without any knowledge of the attacker’s behavior. D. Channel-Based Attacker Localization When dealing with PLA attacks, it is important that the receiver first detects the attack and then possibly localizes the attacker. We will also see that some features used for verification are also used for localization. Thus, when implementing CB-PLA protocols, on top of the authentication, it may be possible to add an attacker localization step at a relatively low cost. Thus ,during the rest of the survey, we will also include solutions for attacker localization. IX. CHANNEL FEATURES FOR CB-AUTHENTICATION In this Section, we describe the main channel features that are used in CB-PLA. Although most of the works consider specific features, it may be possible to extend their procedures to other features. Moreover, some works do not focus on specific channel features in their schemes but rather aim to design solutions that work for any feature selected by the user. For each channel feature, we will also include a discussion on techniques used to localize the attacker, if any. A. Channel Impulse and Frequency Response One of the most popular channel features for PLA is the entire CIR. Apart from channel estimation techniques that are common to all approaches, it is possible to distinguish between two main paradigms in their use. In the first approach, raw CIR is used for authentication, which has been proposed in different contexts, e.g., 6G [143], UWAC [147], and more recently in VLC [152]. In the second approach, preprocessing is performed on the estimated CIR, and a new metric is extracted. Often, such a metric is the result of the comparison between the measured CIR and a database of previously collected (and trusted) responses. Examples of this approach are for the UWAC context, the Froebenious norm in [150], the time reversal-based metric in [148], the maximum and minimum correlation amplitude in [151], while in the radio context, both the Euclidean distance and the Pearson correlation coefficient in [149]. A related approach for WiFi was also proposed in [132] where a channel feature is obtained by comparing the measured CIR with a locally generated replica. The CIR/CFR is also used in CR-PLA. Some of them refer to the CIR over the multiple-input multiple-output (MIMO) channels. In this case, by increasing the number of antennas in either or both the transmitter and the receiver, we obtain a richer description of the channel that typically improves the accuracy of the authentication procedure. In particular, CRPLA has been applied to scenarios with RISs [128], where the verifier controls the RIS, and the channels between the devices and the RIS are MIMO. Another context where CR-PLA has been applied, still on the CIR/CFR of the channel is in communications with drones, where the channel variations are due to the movement of the drones, not necessarily equipped with multiple antennas [136], [137]. Similar approaches of CR-PLA have been proposed in other frameworks. For example, [138] proposes a scheme in which the CIR is used to hide both the challenge and the response of the attacker using wiretap coding techniques; an extension of this approach includes the use of artificial noise [139]. An alternative to CIR is CFR, which can be easily obtained from the CIR by FFT, or is immediately available in communication systems operating in the frequency domain, e.g., the OFDM. Examples of application domains where CFR is used for CB-PLA are IoT/industrial IoT [160]–[164], cellular systems [166], [167], or WiFi [153]–[157]. Other works exploit a dataset of previously collected CFRs to derive a metric, e.g., in [162] the authors compare the performance when using the whole CFR matrix as input rather than the difference between a reference channel matrix and a measured one. Several works exploit a database of previously collected CFRs to predict the current one, which is then compared to the measured CFR to verify authenticity, e.g., [159]. The CFR in an OFDM system can also be interpreted as an image and then used to feed deep learning models [165]. 17 TABLE VI LITERATURE CLASSIFICATION OF CB-PLA MECHANISMS. Feature list Radio (Air) Acoustic Underwater Visible Light (Air) Statistical ML Statistical ML Statistical CIR [128]–[130], [132]–[140] [141]–[146] [147]–[149] [150], [151] [152] CFR [153]–[155] [156]–[168] RSS or SNR [135], [137], [169]–[172] [131], [141]–[143], [173]–[181] [182] [183] Channel Statistics [184], [185] [143] [186], [187] [188]–[190] Time Measurements [191], [192] [141] [193] AoA [175], [194]–[198] [175], [176], [199], [200] [193], [201] Doppler Frequency [169], [178], [202], [203] [142], [173], [177] Although CIR and CFR provide a complete description of the channel, resulting in a very detailed channel feature for PLA, their estimate is subject to several limitations that either reduce the accuracy of the authentication or require additional processing. Indeed, the main problem is related to synchronization, which may differ upon reception of different messages. Synchronization errors lead to time and phase shifts in the baseband equivalent CIR, and correspondingly to phase changes in CFR. Moreover, the estimate of each channel tap is affected by estimation noise that may significantly change the resulting CIR and CFR. B. Received Power To address the issues of CIR and CFR features, it is possible to use channel parameters either directly estimated from the received signal or extracted from the estimated CIR and CFR, which are robust to impairments. The first case is given by the received power, which is a channel parameter basically unaffected by small synchronization errors. Many receivers already compute the received power, for example, for signal quality assessment, range, or power control; thus, no extra effort is required to obtain the input of PLA mechanisms. Note that the received power is also denoted as received signal strength (RSS), while the estimated SNR is analogous to the received power, apart from a normalization of the noise power. Excluding the fading component, the received power is related to the path loss and thus the relative distance between the transmitter and Bob. Moreover, in a context where AliceBob’s distance is known, Bob can compute the reference power to be compared against the measured one for authentication purposes. Examples of this approach include the use of the norm between the measured and the expected RSS [131], SNR [175], received power [169], and the detection of anomalous path gains via ML [199], eventually also including dynamic scenarios [174]. Thus, many works propose the use of this already-available feature for PLA purposes in different contexts such as WiFi, vehicular ad-hoc network (VANET), UWAC, and VLC, as now discussed. For instance, in WiFi, the variations of RSS due to the movement of devices have been exploited in [171] to determine whether two pairing devices are in physical proximity to each other, thus authenticating their proximity. In [141], an reinforcement learning (RL) mechanism is used in the VANET context to dynamically adjust the authentication test threshold based on the previous results, including false alarm rates and authentication policy parameters. Concerning the UWAC context, the normalized sample covariance matrix (SCM), i.e., the power covariance measured at different receivers, is used in [182] to estimate the transmitter position, and later for channel variation PLA. In the VLC context, a first study of CB authentication is [183], where the attacker transmits when the legitimate transmitter is idle; then LOS direct current channel gain is used as an authentication feature. Then, [152] applies the CR-PLA technique to VLC. In this case, a RIS that operates on visible light signals is configured randomly to enable the receiver photodetector to authenticate the transmitter. Attacker Localization: The RSS can be used further for attacker localization [179]–[181], typically exploiting ML, as we will detail later in Section X-E. However, RSS is known to be not adequate for localization as RSS-based localization methods may be vulnerable to beamforming attacks [204]. C. Channel Statistics Beyond synchronization and estimation noise issues, in some contexts, the use of CIR and CFR becomes problematic by fast channel variations. In this case, it is better to use as a channel feature the statistics of the channel rather than its instantaneous realization. Concerning the industrial IoT context, [177] uses the mean and variance of the subcarrier amplitude, carrier phase, and carrier frequency computed over the whole CIR. A wide range of features has been tested in [185] in the UWB context, with results suggesting skew and kurtosis of the 18 tap’s magnitude, maximum peak-to-earlier peak ratio (MPEP), and the peak-to-average power ratio (PAPR) to be the most promising features. This approach is also popular in the UWAC context. In particular, in [186], while looking for features that are stable over time but not over space, several channel features have been investigated. The study concluded that the best performance was achieved using the number of channel taps, the average tap power, relative RMS delay, and smoothed received power. Such features also proved their effectiveness in the following works in authentication [188], [189]. In a dynamic UWAC context, the power-weighted arrival delay has been proposed to track the evolution of the channel; therefore, anomalous changes were associated with the start of an attack [187]. The work was extended in [190], where the new feature was integrated with those derived in [186]. D. Time Measurements In many scenarios, power-related features are not usable, as they are either too predictable by the attacker or too variable to be used for CB authentication, e.g., due to fading. An alternative is offered by time-based features, such as time of arrival (TOA), time difference of arrival (TDOA), or even the estimated transmitter clock bias. Still, it is worth pointing out that, while effective, the use of the TDOA requires the presence of multiple synchronized receivers. The TDOA is used in the satellite context in [191] and in industrial/UWB communication in [192], while the TOA has been used in the UWAC in [193], along with the angle-of-arrival (AoA). E. Angle of Arrival For a receiver equipped with multiple antennas, the AoA is another channel parameter to be used as a channel feature for PLA. Indeed, the AoA is related to the transmitter position; thus, exploiting, for instance, a prior knowledge of the legitimate transmitter position, it is possible to discriminate between the legitimate transmitter and the spoofer just by looking at the AoA. The AoA has been used in UWAC in both [193] and [201] and in [194] to profile the client’s WiFi network. For IoT authentication, AoA has been exploited in [199]. In [200], the authors exploit the massive-MIMO geometrical channel to extract an image of angle and delay and then adopt ML techniques to authenticate the transmitters. Attacker Localization: It is also possible to use the AoA of the received signal to localize the attackers [205]. SecureAngle [197] is a framework to estimate the signal’s AoA and create AoA-based signatures to identify the legitimate users. If a user’s signal does not belong to the authorized signatures pool, it gets rejected and localized by using the AoAs of the direct path of its signal, estimated by multiple access points. Pilot spoofing attacks are addressed in [195] and [196]: in such attacks, a spoofer corrupts the initial channel estimation phase by sending the same pilot sequence as the legitimate users at the same time. In particular, [195] employs an uplink and downlink training phase to detect and localize an attacker using the spatial spectra on the received signals and exploiting the reciprocity of uplink and downlink channels in time-divisionduplex (TDD) systems. Still, due to the duration of the training phases, the method is vulnerable to environment changes (e.g., a moving attacker) [196]. Thus, [196] proposes an uplink joint detection and localization of an attacker via sequential Bayesian inference (i.e., by considering the time correlation on the estimated quantities). F. Doppler Frequency The use of the Doppler frequency shift is particularly popular in the satellite communication context. Indeed, analogously to the power-based approaches, a receiver that knows the position and velocity of both itself and the satellites can compute the relative velocity and thus the Doppler shift. Such an estimate can then be compared to the measured Doppler for PLA for authentication purposes. This approach has been used, for instance, in [202], where the receiver computes its position and velocity via GNSS, and in [203], where the authors tackle the problem of inter-satellite link authentication. Often, the Doppler frequency shift is used in pair with the RSS,e.g., [169], [173]. Attacker Localization: Doppler frequency is also used to localize the attacker. The scenario considered in [206] sees a vehicle to vehicle (V2V) communication system attacked by a fixed or mobile terminal that is spoofing a GNSS signal. The vehicles use commercial GNSS receivers to measure the spoofer signal Doppler frequency. Next, the vehicles share their local measurements with the others, and by combining them, they localize the attacker. Note that, as all the vehicles are locked on the same spoofing signal, no additional synchronization among them is required. G. CB-Authentication With RISs If a verifier-controlled RIS is available in the network, specific solutions can be implemented. In [184], a generalized likelihood-ratio test (GLRT) technique is used, but the second-order statistics of both the legitimate and the attack channel are known. In this case, the configuration of the RIS is fixed, and both the direct channel and the channel through the RIS are estimated for the hypothesis testing procedure. In [140], the impact of residual hardware impairments on authentication mechanisms in the presence of a RIS is investigated. In [198], it is proposed to use the AoAs of the direct and cascaded links at Bob and the effective angle-of-departures (AoDs) at the RIS. The sparsity of the direct channel and also the unique double-structured sparsity of the beamspace cascaded channel are exploited as authentication features. In all these works, the configuration of the RIS, i.e., the setting of the phase of the elements, is fixed and typically optimized to maximize the communication performance. However, as already mentioned in Section VIII-B, the possibility to control the propagation characteristics of the channel with a RIS allows a new mechanism for authentication exploiting the CR approach. In fact, the use of RISs for this purpose was introduced in the first paper of the topic [127], and the security and communication performance were then studied in [128]. 19 Specific attacks and defense strategies (both for the control of the RISs by the verifier and for suitable beamformers to be used by the attacker to increase the chances of success) have been investigated in [129] and [130]. X. IDENTIFICATION VERIFICATION METHODOLOGIES In this Section, we describe in detail the identification verification phase of CB-PLA mechanisms, i.e., the part where the verifiers check that the currently received message is authentic. The description is organized into three parts related to statistical approaches, binary classification approaches, and one-class classification approaches. Lastly, we also provide a survey of techniques for localization based on ML models. A. Statistical Approaches With statistical approaches, we assume to have available probability density function (pdf) of the channel feature in either or both the legitimate and under-attack conditions. The authentication process is then seen as a hypothesis testing problem, and the test function is obtained from the pdfs. 1) Tag-based Authentication: Concerning the tag-based authentication, referring to binary hypothesis testing, the likelihood ratio test (LRT) is shown (by the Neyman-Pearson theorem) to minimize the missed detection probability for a fixed false alarm [207]. It provides the test function V:f(x) = p(x|H0) p(x|H1),(21) where p(x|Hi)is the pdf of the tag in case Hicomputed in x. Such a test has been used in several works, such as [148], [201], [203]. In particular, in [201], the verifier Bob, upon receiving a new message, computes the Mahalanobis distance between the current observation and a database of previously collected AoAs containing both legitimate and non-legitimate samples. Still, (21) has a major drawback as it requires the verifier to know, or at least assume to know, both legitimate and underattack tag statistics, which may be a strong assumption in many practical applications. In a single-sided testing problem, where only the tag statistics in legitimate conditions are known, the likelihood test (LT) is typically employed, which provides the test function f(x) = p(x|H0).(22) In the specific case of a Gaussian-distributed vector, e.g., when the measurement is affected by AWGN, (22) becomes f(x) = ∥x−x′∥,(23) where x′is the expected observation, which is used as a reference. Such an approach has been used, for instance, in [191], where the RMS error between the measured and the expected TDOA is thresholded. Still, it is worth noting that the LT is typically sub-optimal with respect to the LRT, but do not assume any knowledge of Trudy’s attack statistical distribution. Such an approach has been used in [131], [153]– [155], [170], [171], [183], [186], [193], [202]. Alternative tests to (22) have been considered, for instance, resorting to the Pearson correlation between the different observation sequences [171], [194]. The Pearson correlation factor between the scalar feature sequences xi,i= 1, . . . , n, and x′ i,i= 1, . . . , n, is r=Pn i=1 (xi−µ(x)) (x′ i−µ(x′)) qPn i=1 (xi−µ(x))2qPn i=1 (x′ i−µ(x′))2,(24) where µ(x) = 1 nPn j=1 xjand µ(x′) = 1 nPn j=1 x′ j. For example, in [171], witness external devices check if two devices that should be paired are in proximity by controlling if the RSS are correlated. This approach is based on the assumption that close-by transmitters will yield correlated time series of RSS to a receiver. Such tests are often integrated with more complex protocols. A common scenario considers a verifier that coordinates several independent receivers or channels and has to aggregate the local decisions to perform authentication. The local decision is often performed considering either (22) or (23), and then the verifier has to design a function to perform the final decision. A major difference between these works is that while some share with the verifier the soft output, others share only a local decision, i.e., the binary output of the combination between (22) and (18). In this context, in [203], 6channels are considered, and several methods have been investigated to aggregate the local decision, in particular, OR, AND, and majority rule. On the other hand, a distributed test is considered in [186], where soft information is provided by the devices, and the aggregation is performed by weighting the local observation, considering, for instance, the distance between each receiver. A different approach is proposed in [147] where the authentication is framed as a game, where the legitimate party utility function is a mixture of FA probability, MD probability, and spoofing cost; the legitimate party and the attacker have to choose the test threshold value and the spoofing probability respectively. A similar approach has been proposed in the satellite context in [169]. 2) Channel Variation PLA: The most popular statistical method for channel variation PLA involves the use of Kalman filters (KFs) predictors. In detail, considering a characteristic zito be tracked (e.g., the user distance or velocity), typically called state, its time evolution is modeled as zi=Aizi−1+wi,(25) where Aiis the state transition matrix at time-step i, and wi∼ N(0,Qi)represents the process noise (assumed to be Gaussian). On the other hand, the measurement, which for us is the channel feature, and the state are related xi=Bizi+ri,(26) where Biis the observation matrix and ri∼ N (0,Σi)models the observation noise. 20 The Kalman filter has two operating modes: prediction and model update. During the former, it computes the a priori state estimate and its covariance matrix, respectively, as ˜ zi|i−1=Ai˜ zi−1|i−1,(27a) Pi|i−1=AiPi−1|i−1AT i.(27b) When a new channel feature is provided ˆ xi, Bob can refine its model as ei=ˆ xi−Bi˜ zi|i−1(27c) Ci=BiPi|i−1BT i+ Σi(27d) Gi=Pi|i−1BT iC−1 i(27e) ˆ zi|i=ˆ zi|i−1+Giei(27f) Pi|i= (I−GiBi)Pi|i−1,(27g) where ˆ zi|iand Pi|iare the a posteriori state estimate and its covariance, respectively, while Giis often called Kalman gain. Finally, the prediction error eiis called innovation of the Kalman filter and can be used for security purposes. In particular, Bob computes βn=eT iC−1 iei,(28) which Bob uses as input for authenticity verification. We remark that, differently from the general model of the Kalman filter, we have no control input. The interested reader may look for a more formal introduction of the KF in [208]. Several variations can be introduced to the KF. For instance, in the so-called extended KF non-linear equation, replace either or both (25) and (26). The main issue of statistical approaches, such as the KF, is that they require an analytic model. For instance, KFs typically requires an a priori knowledge of the measurement evolution over time and the relation between the measurement and the true state (e.g., the transmitter position), e.g., Biand Aiused in the (linear) KF in (25) and (26), respectively. However, such models are often hard to obtain in practice, as they depend on both the features themselves and the environment, thus limiting the set of possible input features. In the UWAC context, in [187], a set of receivers is tracking the power-weighted arrival delay using a KF. The KF socalled innovation, which measures the discrepancy between the value predicted by the KF and the observed measurement, is monitored, thus associating high innovation values with the start of a spoofing attack. Such an approach was generalized in [190], replacing the KF with a LSTM neural network (NN). A similar approach has also been considered in [135], [172], targeting the V2X scenario. As an alternative to the KF approach, in the MIMO radio context, [134] considered a scenario where the CIR evolves following a Gauss-Markov process. The tests evaluate (the norm of) the difference between the current and the previous CIR at different transmitter-receiver pairs, considering both the cases where each pair observes statistically independent channels, and where the observed channels are correlated. Still, we notice that the check is still related to (28), eventually considering the covariance to be a diagonal matrix. Differently, the work in [209] considers an online adaptive method where the threshold is dynamically adjusted by the verifier, according to its previous statistics. Another adaptive method has been proposed in [132], where the tag symbol setup is dynamically adapted, following a water-filling approach where the power associated with each tag symbol is adjusted to match a predefined detection probability. B. ML Approaches - Binary Classification In ML-based solutions, it is assumed to have a dataset of tag samples under one or both the legitimate and attack conditions. The authentication problem is framed as a classification problem, and the test function is replaced by an ML trained with the available dataset(s). We first consider the binary classification solutions, where two datasets (of legitimate and attack conditions) are available to train the ML model. Note that the dataset of attack samples can also be artificial, i.e., generated by the verifier under suitable assumptions, when no real data are available, as discussed in Section X-C. The availability of the Trudy dataset is related to some assumptions, i.e., expected position, type of device, or resulting channel feature. To the best knowledge of the authors, no work has considered the use of two-class ML techniques for channel variation PLA and CR-PLA. Thus, all results are relative to the tag-based PLA. In [124] it has been proven that a sufficiently complex NN trained with a sufficiently large dataset, containing both positive (Alice) and negative (Trudy) samples, when used in (18) achieves the same performance as the optimal LRT. The work in [162] compares the performance of four standard classification algorithms, namely decision tree (DT), SVM, KNN, and enseamble learning (EL), in particular bagged trees (BTs). The last achieved the best performance in both simulations and tests, but at a higher computational cost with respect to the other solutions. In [144], a CNN is used to extract the relevant features from the channel observation, and then a RNN is expected to learn the spectral dependencies between the extracted features. In [200], the authors propose to use the sparse nature of the channel in a massive MIMO-OFDM communication system to first build an angle-delay image that is efficient for NN training. Then, they exploit you-only-look-once (YOLO), an advanced single-stage object detection network, to capture the angle-delay features from the received signal, and finally, a lightweight neural network to perform the classification. We remark that IoT is a relevant use case for PLA, where devices have limited computing capabilities; therefore, ML solutions can be particularly useful. For example, in [199], a two-step authentication mechanism for IoT devices in 5G networks is proposed. The first step aims to detect anomalies in the virtual AoA and path gains of all the IoT devices in the cell; the second step provides an authentication mechanism based on ML. In particular, the anomaly detected in the first step compares the number of communications at the MAC layer with those identified at the physical layer. If the anomaly is detected, a ML is used to decide if a single communication (at the MAC layer) comprises more than one path at the 21 physical layer to confirm the anomaly. The work in [161] exploits the presence of multiple devices at the edge to build a collaborative authenticator. In particular, the CFRs associated with a MIMO system are divided among different devices of an edge network, where a subclassifier makes a first classification, which is interpreted as a vote. Finally, the decision is taken by aggregating the single votes, each associated with a proper weight. Different techniques are proposed in [164], [166] to reduce the computation load, thus allowing powerconstrained devices to perform PLA. In [164], a convolutional denoising AE is used to preprocess the raw CSI measurements to reduce the dimension of the features, eliminate noise, and extract key features. After the pre-processing, a weighted KNN algorithm classifies the extracted features and authenticates the transmitters, which reduces the computational overhead compared to other ML approaches. [166] aims at reducing the computation overhead in training the NN, thus proposing three gradient descent algorithms to accelerate training. C. ML Approaches - Artificial Dataset When the dataset available for training contains only channel feature samples under legitimate conditions, two approaches are possible. One solution provides that first, an artificial dataset of attack channel features is generated, and then the binary classification approach is used for training on the available legitimate and artificial attack datasets. A second solution uses only the available dataset, which is denoted as a one-class classification approach. In this section, we consider the solution based on the artificial dataset, while in Section X-D, we detail the one-class classification approach. 1) Tag-based Authentication: The solution based on the artificial dataset is employed in [160], [177]. A DT is exploited to perform authentication in [177], in the absence of an attack dataset. In particular, they train the classifier using positive unlabeled data, where only positive (i.e., legitimate) data is used, but part of the data is labeled as non-legitimate and left out during this first training. Then, the procedure is repeated, changing positive and unlabeled data until a robust enough classifier has been trained. An automated labeling strategy is proposed in [160], which comprises an offline and online procedure. They specifically look for clone or Sybil attack data samples, which are later used to train the more refined SVM-based (online) procedure. 2) Channel Variation PLA: The solution based on the artificial dataset is employed in [149], [151], [174], [210]. An extreme learning approach is proposed in [149], where the input contains both previous trusted observations and the observation to be verified; then, the network is trained to check the coherence between the two. An artificial dataset is generated to improve the network classification performance. In particular, the artificial dataset has the same distribution as the legitimate one but contains samples that are uncorrelated with the (previous) legitimate ones. An artificial dataset is considered in [151], and it contains samples from nodes that are far from the receiver as negative. Then SVM is used to build a classifier. The features, e.g., the maximal time-reverse resonating strength, are then specifically chosen to minimize the impact of the channel time variability. Using channel measurements relative to a specific location of devices as an authentication feature makes the authentication very scenario-dependent; thus, channel time-varying patterns as scenario-independent features are used in [210] to authenticate devices even in uncalibrated scenarios, including both CIR and CFR as input to the ML model. The use of a graph NN (GNN) was considered in [174], where the verifier has to decide whether the RSSs measured from several receivers within a frame comes only from Alice or from multiple transmitters, that is, Alice and Trudy. In particular, a two-step approach is proposed. First, a NN checks whether two consecutive transmissions come from the same position. The latter step has to split the received frame sequence into regions associated with the same transmitter. In particular, in the first step, the training dataset collects pairs of consecutive transmissions where i) in the legitimate case, the transmission comes from transmitters in the same position, while ii) in the under-attack case, the pair contains samples coming from different randomly sampled positions. D. ML Approaches - One-class Classification We now consider one-class classification solutions, where only a legitimate dataset is used to train the classifier. 1) Tag-based Authentication: The first set of solutions collects anomaly detection models, such as AEs or oneclass support vector machine (OC-SVM). For example, a OCSVM is considered in [145], with both magnitude and IQ samples of CIR measured at different antennas as input. OCSVM has been also considered UWB [185]. In [165], a NN determines the position of a device (from a set of discrete positions) from the observed CSI. If the confidence metric associated with the predicted position is below a threshold, the device is considered not authentic. Indeed, this authentication mechanism boils down to a region location verification, i.e., it verifies that the device is in a set of pre-approved positions. The combination of an AE for dimensionality reduction and variational autoencoder (VAE) for its generative capabilities has been considered in [146]. Cooperative One-Class Classification: When multiple detectors are available, cooperative CB-PLA can be applied. In fact, multiple verifiers can cooperate in the final decision by merging the collected data (or local decisions) to form a distributed authenticator and improve the security performance. Two-step approaches are considered in [143], [156], [168], where first clustering-based methods are used to detect the presence of outliers within the dataset. Then the authentication is completed by using SVM [168], an ensemble of AEs [156], or graph learning [143] approaches. In [188], the authors compared binary NN and one-class AE for UWAC networks. The same techniques have also been considered in [189], where the authentication process is performed in two steps: a first pre-elaboration on each device, with a NN, and then a second central elaboration made on the pre-elaborated data, using a second NN. 2) Channel Variation PLA: A kernel-based prediction method is proposed in [142], and Gaussian process regression (GPR) is considered in [158]. The use of a Bahdanau attention AE predictor is considered to predict the current CFR 22 in [159]. Compared to a more traditional AE-based predictor, this architecture includes an attention mechanism to take into account the effects of fading and Doppler shift. A second solution aims at extending the solution developed for the static to the dynamic context, thus assuming the distribution to change slowly over time. For example, in [167], the concatenation of the legitimate features (tested) before and the measurement under test is fed to CNN, whose output represents the probability that the whole input matrix belongs to Alice. OC-SVM is used for classification in the satellite context in [173] but is progressively updated to take into account the evolution of the statistic over time. A third alternative is to optimize the test threshold. The authentication problem has been formulated as a zero-sum game, where RL, in particular, Q-learning and Dyna-Q, have been used to optimally set the threshold for LT in [131]. In [141], a deep reinforcement learning (DRL) mechanism is used for the VANET context where Bob sets the authentication threshold and Trudy plays with the attack rate. The tag-based solution in [168] has been extended in [157] to also take into account mobile users by adding a processing block that monitors the temporal correlation between subsequent CSI blocks. In the context of UWAC, Casari et al. investigate the use of OC-SVM and an AE to fuse the local KF’s innovations [187], later extended in [190], where a RNN allowed to track features that cannot have been analytically modelled and thus tracked by KF. In [163], a framework considers federated learning among cooperating edge devices: a group of edge devices is selected using a Q-learning-based adaptive search procedure and collaborates to form an authenticator. Unlike previous works, two threats are examined: the presence of external attackers (i.e., regular spoofers) and internal threats, the latter represented by malicious nodes injecting false parameters that might lead to convergence failure or convergence to a wrong model. A similar approach is also proposed in [182], where first, a CNN estimates the transmitter positions from the SCM, and next, a RNN predictor tracks the transmitter position. E. ML Approaches - Attacker Localization Various approaches for the location of the attacker have been considered using ML models. In [179], the authors use the Kmeans clustering algorithm to detect and locate attackers. In particular, after a training phase, they combine RSS readings from multiple access points and divide them into clusters in the signal space. If there are multiple transmitters at the same time (i.e., a legitimate party and one or multiple spoofers), then the resulting point in the signal space will be far from the centroids of the legitimate clusters, and thus an anomaly is detected. After the spoofer is detected, the cluster centroids are used to localize it. The authors experimentally tested their approach on WiFi and Zigbee networks, reaching Pmd >0.95 with Pfa <0.05. A drawback of [179] is that it cannot localize multiple attackers. Thus, in [180], the authors propose the IDOL (Integrated Detection and Localization) framework, capable of detecting and localizing multiple attackers. In [180], three types of algorithms were tested to locate the attackers: nearest neighbor matching in signal space, probability-based, and multilateration; while in [181], the authors used a discriminantadaptive neural network to perform the same task. XI. CB-AUTHENTICATION PUBLIC DATASETS AND APPLICATIONS This Section describes the common methodologies to test the performance of the proposed CB-PLA mechanisms, considering both simulation tools and experimental datasets. A. Simulation and Experimental Methodologies The methodology for CB-PLA mirrors the one used for RFFI, described in Section VII. It typically involves the collection of two datasets. The first is used to set up the detector. For instance, in KF-based channel variation authentication, the first dataset is used to adapt the filter parameters during the initial transient (e.g., [182], [187]). In ML-based solutions, such a dataset is instead used to train the detector. The second dataset is used for testing, to evaluate the performance of the trained detector. We remark that, while formally two datasets need to be collected, often only one is collected, which is then split into two. These operations need to be performed carefully. For instance, training on samples that are collected close to each other in time helps the detector to learn the channel stationarity, and thus, we neglect the evolution of the channel over time. On the other hand, as it happens when overfitting, this also makes the detector less robust to variations. Thus, to make the detector more robust to temporal variations, it is advisable to split the dataset randomly. Finally, it should be noted that when testing CBauthentication solutions, the hardware impairments are typically neglected, implicitly treating them as estimation noise. Indeed, even if costly, a better practice would involve the collection of multiple datasets, each collected with a different transmitter/receiver hardware pair, which would make the detector, trained on the merged dataset, truly device-independent. Alternatively, future works should include an estimation and correction step to correct the hardware impairments or, even better, a joint RFFI & CB-based authentication, which allows the detector to exploit both techniques at the same time, as detailed in Section XII. B. Simulation Tools and Setups WiFi: A broad set of simulation tools is used for the WiFi context. A simple model provides independent Gaussian distributed channel taps [134], while other solutions, such as [142], consider generating more realistic CFRs, including an exponential PDP. Other parameters have been set according to the IEEE 802.11a specification. Another alternative is to consider geometric models, e.g., ray tracing tools, as in [154]. Vehicular: Specifically targeting the V2X context, simulations have been performed in [135], [172], with communication parameters adapted from the SAE J2945/1 standard using Matlab. In [135], the authors simulated two traffic scenarios: straight and intersection. In the first, Alice and Bob are driving 23 straight on the same road, while in the second, Eve follows Alice who is driving crosswise with respect to Bob. On the other hand, [172] considers instead a more abstract model, where the RSS is modeled after a log-normal distribution. Cellular Wireless: While some papers generate the features via statistical models (e.g., [199]), three simulators are popular in the literature: •Quasideterministic radio channel generator (QuaDRiGa) channel simulator [211]: it has been used in [158], [165]. In particular, in [158] the simulation includes also the movement between transmitter and receiver, with parameters set to simulate the ground city macrocell in the Berlin survey in Germany (BERLIN UMa). •WINNER II channel model [212]: it is used for instance in [145] to model a non-line-of-sight scenario, with users moving at different velocities. •MATLAB 5G toolbox channel: this was used to test the Bahdanau attention autoencoder proposed in [159] operating in the 5G FR1 n78 band. Underwater Acoustic: Concerning PLA in the UWAC context, the most popular solution involves the Bellhop raytracing simulator [213], [214], used for instance in [182], [186]–[188], [190]. Such a tool also includes the description of several environmental parameters, such as sound speed profile and bathymetry. For instance, among others, the San Diego Bay area was considered in [182], [186], [187], [190]. An alternative simulator used in [151] has been described in [215]. Finally, in [193], the performance is evaluated considering both an AWGN channel and a coloured noise channel with and without frequency-dependent path loss, respectively. Satellite: Different channel models are considered in the satellite communication, including both AWGN [173] and Rician fading channel [202]. Specifically concerning satellite orbit datasets, two-line element (TLE) datasets have been used in both [169], [191]. In the former, the dataset was derived from [216], while in the latter via the Ansys STK [217]. UWB: Concerning UWB, a MATLAB simulation is performed in [192], modeling the UWB signals as the first derivative Gaussian pulses, and the channel is modeled as AWGN. To test the performance, [185] considers both simulation and experimental tests. The simulations have been performed in MATLAB with receivers implemented following the IEEE 802.15.4z standard and channels compliant with the IEEE 802.15.4a standard. In particular, both LOS and NLOS have been included. C. Experimental Setups and Public Datasets Table VII collects a list of datasets available online that may be used to develop/test new channel-based authentication techniques, classified by wireless technology and measured channel features. In the remaining part of the section, we discuss the use of simulation data, experiments, and datasets in wireless technology. WiFi: Several works have provided experimental results on WiFi networks. First, a public dataset containing RSS and channel measured from WiFi access points, placed at increasing distance from a reference transmitter [221]. In [224], a SDR platform for the WiFi PHY layer has been implemented and CB PLA is performed on the CSI, RSS, and frequency offset. In [153], the CSI was considered in a typical indoor scenario with fixed locations of the users. A dedicated prototype has been developed to test the performance of the AoA-based PLA solution described in [194]. The developed access point has two FPGA platforms, with four radio front ends and four antennas each. The clients are two Soekris boxes, equipped with Atheros IEEE 802.11g radios. For the proximity-based PLA solution of [171], experiments were performed with ten Nokia N800 Internet Tablets, showing that the proposed solution can reliably detect attackers as close as two meters away from legitimate devices. Experimental results on the clustering-based approach of CFR for authentication have been reported in [157], [168] where an IEEE 802.11n WiFi network was considered, with two laptops (Lenovo T500 and T61) serving as monitors that collect the wireless packets. A commercial wireless Linksys E2500 access point is the device to be authenticated, transmitting 10 packets/second. For each packet, the CFR relative to 30 subcarriers is extracted with equal spacing among the 56 subcarriers of a 20 MHz channel. In [156] experimental results are reported with a commercial WiFi device, Huawei TAS-AN00 operating as a station, transmitting at a rate of 100 packets/second in 20 MHz WiFi the channel on 2.4 GHz. The experimental results reported in [155] have been performed on the Microsoft Sora SDR, reaching a false positive and false negative ratio of 10−3. In [176], a WiFi operating at mmWave (60 GHz band) is considered, with reference to the IEEE 801.11ad standard. The considered feature is the SNR trace obtained at the receiver in the sector level sweep (SLS) process, and an ML approach is used to authenticate the message. Talon AD7200 routers and MG360 WiGig USB Adapters are used to perform experiments in a meeting room, achieving a sum of MD and FA probability less than 1%. In [175] experimental results for authentication are presented, based on the dataset of [176]. In [170], experiments are conducted for the authentication based on the verification of SNR series observed at Alice and Bob, through a statistical method. Alice, Bob, and Trudy are implemented on Dell E5400 laptops, which usethe Intel iwl5300 chipset, operating IEEE 802.11g with channel one in the 2.4 GHz frequency, with a transmission rate of 12 Mbps and transmission power of 15 dBm. Many works perform dedicated experiments [131], [132], [144], [167], deploying three or more USRPs in an indoor environment mimicking an office or industrial context, with parameters following the standards, e.g., IEEE 802.11a/g and IEEE 802.11n/ac. The GNN-based solution proposed for the channel variation in [174] in the artificial dataset training framework, exploits the dataset from [220], a publicly available WiFi fingerprint dataset which collects fingerprints collected with 21 devices in an indoor scenario. IoT & Industrial IoT: As in the WiFi context, many works only perform dedicated experiments, using again USRPs de- 24 TABLE VII SUMMARY OF PUBLICLY AVAILABLE DATASETS FOR CB AUTHENTICATION Wireless Technology Dataset Paper Features Brief Summary WiFi, IoT, Industrial IoT [218] [146], [160], [162], [164], [177], [210] CSI Data collected in industrial environments and open-area sites by NIST [219] [175], [176] SNR SLS SNR traces collected from the communication between AP and clients at mmWave frequencies WiFi [220] [174] RSS Fingerprints collected in an indoor scenario from 21 different Android devices [221] – RSS Measured from two Raspberry PIs, placed at various distances from one another UWAC [222] – CIR Experiment performed in Kauai (Hawaii) in 2011. [223] [151] CIR Long-range experiment performed in the Mediterranean Sea in 2019. ployed in an industrial-like environment, e.g., [161], [209], eventually also in a cooperative setting, such as [163]. In [166], the IoT nodes are emulated using USRPs, placed in various positions in an indoor environment. A popular dataset for testing in the industrial IoT context is [218], described in [225], [226]. For instance, both the open area test site and the automotive assembly plant scenario datasets were used in [143]. The dataset was also used for training and testing in [146], [160], [162], [164], [177], [210]. Many works use both the NIST dataset and a dataset from dedicated experiments. A first example is [164], where the experimental dataset was collected using three Lenovo X220 laptops (Alice, Bob, and Trudy) placed approximately 2–4 m apart transmitting at 2.4 GHz, using IEEE 802.11n protocol, with 3 transmitting antennas, 2 receiving antennas, and 30 subcarriers using Linux CSI Tool. In [210], the performance of the channel variation-based ML approach was tested using [226] for the static scenario, then dedicated experiments were performed using two USRPs to account for the dynamic one. Underwater Acoustic: Due to the lack of a standard channel model and the impact of the environmental condition on the measurement, experiments, and proof of concept, often called sea trials are common in UWAC studies [186], [188], [189], eventually re-using datasets from previous experiments, such as in [188], where Bragagnolo et al. used the Hadera (Israel) dataset from [186]. However, only a few datasets are actually publicly available. For instance, a popular dataset is the KAM11, which was only published with the Watermark simulator [222]. An example of a public dataset is instead the LR19 [223] used, for instance, in [151]. Another alternative is to perform tests in (typically indoor) pools: in [150] an experiment is run by collecting measurements from a 25 ×6×1.6 m3non-anechoic pool where 9 transmitters and 1receiver were deployed. Satellite: Since not many works consider PLA for satellite, very few experiments have been reported yet. An exception is [178], where the Abdrabou et al. collected real LEO satellite data using the system toolkit. UWB: Dedicated experiments have been performed to test the performance of the solution proposed in [185]. In particular, two nRF52840-DK boards have been used to implement the legitimate users, while a NUCLEO-Z429 is used for the attacker, all equipped with Qorvo DWM3000 modules. 1000 CIRs have been collected in both static and dynamic scenarios. XII. CHALLENGES AND FUTURE RESEARCH A. Challenges for RFFI Despite significant development in deep learning-driven RFFI technology, numerous challenges remain unresolved. This section elaborates on these challenges and presents a summary based on the most recent studies. 1) Lack of Capacity Evaluation: The term ‘capacity’ is used to describe the maximum number of wireless devices that can be accurately distinguished by analysis of their RFFs, which is critical for an authentication technique. Most RFFI studies use commercially available wireless transmitters, but most involve fewer than tens or dozens of devices, and few large-scale experiments have been conducted. To the best of the authors’ knowledge, the work in [52] presents the experiment with the largest number of wireless devices, up to 10,000. However, this large dataset has not been published, and researchers in this community cannot use it to explore the maximum capacity of the RFFI technique. A few studies have attempted to provide a theoretical analysis of the user capacity in RFFI systems [227], [228]. Nevertheless, achieving an accurate prediction of the user capacity remains a significant challenge, particularly for deep learning-driven RFFI systems. There is still a need for large-scale experimental evaluation and theoretical analysis to assess the capacity of RFFI. 2) Lack of Stability Evaluation: As an identifier used for authentication, the stability of RFFs is critical. However, there are rare studies that systematically investigated the stability of RFFI systems. In particular, the characteristics of RF components can change slightly due to variations in the surrounding environment, such as temperature and humidity, and hardware ageing. The authors in [21], [22] indicate that the oscillator frequency is sensitive to temperature variations and that CFO compensation at the receiver side can improve system stability. However, these studies only focus on the stability of the frequency offset function resulting from the oscillator impairments, while the other hardware characteristics are not investigated. Moreover, the authors in [229] experimentally demonstrate that the RF fingerprints of SDR 25 transmitters exhibit significant variations when transitioning between on and off states. However, the evaluation of wireless transmitters beyond SDRs remains an open area for exploration. The comprehensive evaluation of the RFF stability and the design of robust feature extraction algorithms represent crucial directions for future research. 3) Lack of Benchmark Datasets: The RFFI research community does not have a benchmark dataset that is as widely used as ImageNet in computer vision. This limits comparisons among studies. In addition, researchers without RF hardware and experience in designing wireless signal acquisition systems cannot efficiently engage in RFFI research. As discussed in Section VI, some studies have released public datasets detailing the collection environments and hardware setup [29], [54], [230]. However, most of these datasets still do not meet benchmark requirements in terms of dataset size, device population, and diversity in channel conditions. The collection and publication of large-scale benchmark datasets of various wireless protocols remains an urgent need in the field of RFFI. 4) Limited Studies on Adversarial Machine Learning Attacks and Defense: Cutting-edge RFFI schemes heavily rely on deep learning. However, recent research in the ML community has revealed that deep learning is vulnerable to adversarial machine learning (AML) attacks, including in the context of wireless systems [231], [232]. Depending on the attack phase, AML can be categorized into backdoor attacks launched in the training stage [233], [234] and adversarial/evasion attacks launched in the inference stage [235]–[239]. The AML attacks can be launched during the model training stage, named backdoor attacks [233], [234]. Zhao et al. propose the first backdoor attack on RFFI systems, and evaluate the algorithm on three WiFi datasets and a LoRa dataset. The results demonstrate that the attack can be successfully launched in either the time domain or the time-frequency domain [233]. The authors in [234] further investigate the backdoor attacks against low-earth orbit satellite fingerprinting systems. The AML attack can be launched during the model inference stage, named adversarial/evasion attacks [235]–[239]. For instance, Ma et al. demonstrate that adding perturbations to the deep learning input can interfere with the identification result and can even mislead into a specific identity [237]. More research is required to study the AML as well as the countermeasure. For example, the transmission of perturbation in evasion attacks will experience channel propagation, but the effect is not properly studied yet. Adversarial training and randomized smoothing are used as countermeasures for Wi-Fi sensing [240], but there is no such study for RFFI. 5) Limited Studies on RFF Concealment: While the majority of the research focuses on using RFF for legitimate purposes, i.e, device authentication, it can also be used maliciously, e.g., device tracking in [101]. Hence, it is essential to design RFF concealment approaches. Abanto-Leon et al. added a randomized phase to each subcarrier in a WiFi OFDM system to ensure privacy, when non-linear phase errors are used for RFFI [241]. They proved that when the phase is generated via a random number generator, the approach is robust against statistical attack. Givehchian et al. obfuscated the CFO of BLE devices for preventing tracking attacks [102]. They implemented their CFO obfuscation method using TI CC2640 chipsets and carried out a comprehensive experimental evaluation, which demonstrated the feasibility. These approaches only focus on the phase errors and CFO as hardware fingerprints, and their identification is based on comparing their similarities. However, deep learning RFFI is learning all the available hardware impairments. It is not clear how RFFI will be affected if only one hardware feature is obfuscated as other impairments remain the same. B. Challenges for Channel-Based Authentication 1) Lack of Scalability: Attacks against CB authentication can be deployed by transmitting from different positions until the features estimated by Bob are similar to those of Alice’s transmissions. An alternative is that the attacker precodes the signal before transmission to introduce the features suitable for authentication [9]. At the moment, the search space for an attack is limited, making the attack easy. Indeed, more efforts should be focused on the factors that make the attack harder in a scalable way. Such efforts include the investigation of a) scaling laws for the attack success probability with respect to design parameters such as the number of antennas or the length of pilot signals, b) new approaches such as the CR-PLA that introduce further randomness in the authentication process, c) new bounds on attacks based on physical constraints obtained from specific technologies (i.e., type of antennas used by Bob): a recent example is given by [242] that proved that an effective attack on AoA-based PLA can succeed only under very stringent conditions on the attacker location and hardware capabilities. 2) Lack of Integration: Since the first studies, PLA has been proposed as a security technique to be integrated with other approaches for authentication. However, such an integration has not been thoroughly investigated. A full protocol for PLA that integrates cryptographic approaches, for example, to secure the identification association phase or to be deployed when PLA is under attack, is yet to be investigated. Moreover, integration of CB-PLA with authentication based on wiretap coding is still in its early stages and deserves further investigation. Lastly, integration may also include the use of diversified features for authentication, also coming from different layers of the communication stack: this is also an area that deserves more studies. In this case, ML techniques could be particularly beneficial to capture the relation among the features, but such solutions should be, at the same time, effective in the specific scenario of deployment and robust against adversarial attacks, which leaves many open research points. 3) Lack of Benchmark Datasets: Also for CB-PLA as RFFI, there are not yet well-established datasets to be used for benchmarking different approaches. The difficulty of obtaining such datasets is related to the specific technologies that can be deployed (type of antennas, operating frequencies), the different kinds of environments in which the testbed operates (indoor, outdoor, with different transmit-receive distances), and the need to obtain measurements from several positions at 32 [239] W. Li, S. Wang, Y. Zhang, L. Guo, Y. Liu, Y. Lin, and G. Gui, “Slpa: Single-line pixel attack on specific emitter identification using timefrequency spectrogram,” IEEE Trans. Veh. Technol., 2024. [240] G. Yin, J. Zhang, X. Yi, and X. Wang, “Evasion attacks and countermeasures in deep learning-based Wi-Fi gesture recognition,” IEEE Trans. Mobile Comput., 2025. [241] L. F. Abanto-Leon, A. B¨ auml, G. H. Sim, M. Hollick, and A. Asadi, “Stay connected, leave no trace: Enhancing security and privacy in wifi via obfuscating radiometric fingerprints,” Proc. ACM on Meas. and Anal. of Comput. Syst., vol. 4, no. 3, pp. 1–31, 2020. [242] T. M. Pham, L. Senigagliesi, M. Baldi, G. P. Fettweis, and A. Chorti, “Machine learning-based robust physical layer authentication using angle of arrival estimation,” in Proc. IEEE Global Commun. Conf. (GLOBECOM), 2023, pp. 13–18. [243] C. Zhao, H. Du, D. Niyato, J. Kang, Z. Xiong, D. I. Kim, X. Shen, and K. B. Letaief, “Generative ai for secure physical layer communications: A survey,” IEEE Trans. on Cogn. Commun. Netw., pp. 3 – 26, 2025. [244] N. Wang, T. Zhao, S. Mao, and X. Wang, “AI generated wireless data for enhanced satellite device fingerprinting,” in Proc. IEEE Int. Conf. on Commun. Workshops, 2024, pp. 88–93. [245] H. Zhou, C. Hu, Y. Yuan, Y. Cui, Y. Jin, C. Chen, H. Wu, D. Yuan, L. Jiang, D. Wu, X. Liu, C. Zhang, X. Wang, and J. Liu, “Large language model (LLM) for telecommunications: A comprehensive survey on principles, key techniques, and opportunities,” IEEE Commun. Surveys Tuts., pp. 1–1, 2024. [246] K. Merchant and B. Nousain, “Securing IoT RF fingerprinting systems with generative adversarial networks,” in Proc. of Military Commun. Conf. (MILCOM), 2019, pp. 584–589. [247] X. Chen, Z. Liu, X. Zhang, Y. Wang, D. Shi, and X. Liu, “Optic fingerprint: Enhancing security in visible light communication networks,” in Proc. IEEE INFOCOM Workshops, 2024, pp. 1–6. Junqing Zhang received a Ph.D. degree in Electronics and Electrical Engineering from Queen’s University Belfast, UK in 2016. From Feb. 2016 to Jan. 2018, he was a Postdoctoral Research Fellow at Queen’s University Belfast. From Feb. 2018 to Oct. 2022, he was a Tenure Track Fellow and then a Lecturer (Assistant Professor) at the University of Liverpool, UK. Since Oct. 2022, he has been a Senior Lecturer (Associate Professor) at the University of Liverpool. His research interests include the Internet of Things, wireless security, physical layer security, key generation, radio frequency fingerprint identification, and wireless sensing. Dr. Zhang is a co-recipient of the IEEE WCNC 2025 Best Workshop Paper Award. He is a Senior Area Editor of IEEE Transactions on Information Forensics and Security and an Associate Editor of IEEE Transactions on Mobile Computing. Francesco Ardizzon (Member, IEEE) received the B.Sc. degree in 2016, the M.Sc. degree in 2019, and the Ph.D. degree in Information Engineering in 2023 from the University of Padova, Italy. In 2022, he was a visiting scientist at the ESA European Space Research and Technology Centre. He is currently an Assistant Professor at the University of Padova. His current research interests include authentication for global navigation satellite systems, physical layer security, and underwater acoustic communications. Mattia Piana (Student Member, IEEE) received a B.Sc. in Information Engineering and an M. Sc in Telecommunication Engineering from the University of Padova in 2021 and 2023, respectively. In 2023, he was at National Instruments (Dresden, Germany), where he collaborated on the development of novel techniques for mmWave antenna characterization. He is currently a PhD student at the University of Padova within the EU ROBUST-6G project, and his research interests include physical layer security and reflective intelligent surfaces. Guanxiong Shen received the B.Eng degree from Xidian University, Xi’an, China, in 2019, and the Ph.D degree from the University of Liverpool, UK, in 2023. He is currently an Associate professor at Southeast University, Nanjing, China. His research interests include the Internet of Things, wireless security, physical layer security, and radio frequency fingerprint identification. Stefano Tomasin received the Ph.D. degree from the University of Padova, Italy (2003), where he is now a Full Professor. During his career, he has visited IBM Research (Switzerland), Philips Research (Netherlands), Qualcomm (California), the Polytechnic University in Brooklyn (New York), and Huawei (France). His current research interests include physical layer security, security of global navigation satellite systems, signal processing for wireless communications, synchronization, and scheduling of communication resources. He is a senior member of IEEE and a member of EURASIP. He is or has been an Editor of the IEEE Transactions on Vehicular Technologies, the IEEE Transactions on Signal Processing (2017-2020), the EURASIP Journal of Wireless Communications and Networking, and the IEEE Transactions on Information Forensics and Security.