[Paper Review] End-to-End Radio Traffic Sequence Recognition with Deep Recurrent Neural Networks

Timothy J. O’Shea, Seth Hitefield+1 more|arXiv (Cornell University)|Oct 3, 2016

Wireless Signal Modulation Classification4 citations

TL;DR

This paper proposes an end-to-end deep learning approach using deep recurrent neural networks (LSTM) to classify and generate radio traffic sequences directly from raw I/Q baseband signals, bypassing traditional protocol parsing and demodulation. It achieves 98.5% classification accuracy under ideal conditions and demonstrates generative modeling of protocol patterns like HDLC framing and data bursts with minimal prior knowledge.

ABSTRACT

We investigate sequence machine learning techniques on raw radio signal time-series data. By applying deep recurrent neural networks we learn to discriminate between several application layer traffic types on top of a constant envelope modulation without using an expert demodulation algorithm. We show that complex protocol sequences can be learned and used for both classification and generation tasks using this approach.

Motivation & Objective

• To develop a machine learning framework that classifies high-level application-layer traffic types directly from raw radio signals without relying on protocol-specific parsers or demodulation algorithms.
• To investigate whether deep recurrent networks can learn complex protocol sequences from time-series I/Q data, even without prior knowledge of modulation or framing structure.
• To explore the feasibility of using end-to-end deep learning for both discriminative classification and generative modeling of radio traffic sequences.
• To evaluate model robustness under realistic wireless channel impairments such as frequency offset, sample rate offset, and delay spread.
• To reduce dependency on manually implemented protocol parsers, which are brittle, costly to maintain, and vulnerable to implementation flaws.

Proposed method

• The model uses a multi-layer LSTM architecture that processes in-phase (I) and quadrature (Q) components of baseband radio signals as separate input channels.
• The network is trained in a supervised manner on labeled slices of modulated radio signals, mapping raw I/Q time-series data to one of 11 application-layer protocol classes.
• A final fully connected layer with softmax activation performs multi-class classification, while a separate regression head enables sequence generation by predicting the next time-step window.
• For generative modeling, a first-order regression head predicts the next signal window using mean squared error (MSE) loss with linear output activation.
• The architecture is trained end-to-end on real-world traces captured via Wireshark and tcpdump for protocols including YouTube, Spotify, FTP, IRC, and HTTP.
• Hyperparameter tuning and model scaling are explored, though large models face memory and compute limitations on current hardware.

Experimental results

Research questions

• RQ1 Can deep recurrent neural networks learn to classify high-level application-layer traffic from raw I/Q signal sequences without any expert demodulation or protocol parsing?
• RQ2 How well can an end-to-end deep learning model generalize to unseen protocols and modulations using only raw signal data?
• RQ3 To what extent can a single learned model generate realistic radio signal sequences that mimic real protocol patterns such as framing and data bursts?
• RQ4 How do realistic wireless channel impairments like frequency offset and sample rate drift affect the performance of such a model?
• RQ5 Can generative modeling of radio traffic be effectively improved using adversarial training techniques like GANs?

Key findings

• The model achieves a classification accuracy of 98.5% under ideal, high signal-to-noise ratio (SNR) conditions with no channel impairments.
• Under realistic channel conditions involving frequency offset, sample rate offset, and delay spread, performance drops significantly to approximately 31.2% accuracy.
• The model successfully learns to generate realistic signal patterns, including HDLC idle states, equal-width framing, and data bursts, even without prior knowledge of the protocol or modulation.
• Visual inspection of generated sequences shows plausible reproduction of protocol structures such as preamble patterns and bursty data behavior.
• The generative model, while basic, captures key temporal features of protocols like IRC and Spotify, indicating potential for more advanced architectures.
• The study identifies that larger models and better hyperparameter tuning could improve performance, but are currently limited by GPU memory and training time.