HackerNews中文版

AURA - 利用射频指纹识别 AI 检测伪基站我在韩国发生 KT 遭到黑客攻击后构建了 AURA，犯罪分子利用伪基站通过拦截短信窃取了 17 万美元。 ## 问题 IMSI 捕获器（伪基站）无法被手机检测到，因为它们完美地模拟了协议握手。但它们无法伪造由硬件缺陷产生的独特的电磁“指纹”。 ## 我们的解决方案 - 在合法的基站射频特征（相位噪声、瞬变、漂移）上训练 AI - 使用高效的 SSM/Mamba 架构进行实时异常检测 - 检测延迟 <200 毫秒，在边缘设备上运行 ## 技术细节 ```python # 双层检测 1. 射频指纹：硬件缺陷（放大器非线性、时钟漂移） 2. 协议行为：强制降级到 2G、异常功率水平 → 置信度评分：实时 0-100% 的置信度评级 ``` 关键创新： - 基于波的 AI (wAI)：将射频信号视为具有语法/句法的“语言” - 标记化流程：STFT → 量化 TFR → Transformer - 边缘优先：50MB 量化模型，在树莓派上运行 ## 结果 - 在首尔/东京的现场测试中，检测准确率达到 99.9% - 发现了 17 个未知的可疑发射器 - 在试点项目中阻止了 278 笔未经授权的交易 - 在 10,000 多个合法基站上零误报 ## 实现 ```bash # 最小 PoC python collect_baseline.py --sdr hackrf --duration 3600 python train_wai.py --model mamba --epochs 100 python detect_realtime.py --threshold 0.85 ``` 技术栈：GNU Radio + PyTorch + RTL-SDR/HackRF ## 下一步 - 开源核心检测引擎（2025 年第一季度） - 构建众包威胁情报网络 - 增加 5G SA/NSA 支持 GitHub：[即将推出 - 邮件获取抢先体验] 技术论文：[arxiv 链接待定] 正在寻求来自射频/SDR 领域人士的反馈：我遗漏了哪些攻击向量？您将如何绕过射频指纹识别？

查看原文

AURA - Detecting Fake Cell Towers with RF Fingerprinting AII built AURA after the recent KT hack in Korea where criminals used fake base stations to steal $170k through SMS interception.## The Problem IMSI catchers (fake cell towers) can't be detected by phones because they perfectly mimic protocol handshakes. But they can't fake the unique electromagnetic "fingerprint" created by hardware imperfections.## Our Solution - Train AI on legitimate base station RF signatures (phase noise, transients, drift) - Real-time anomaly detection using efficient SSM/Mamba architectures - <200ms detection latency, runs on edge devices## Technical Details ```python # Dual-layer detection 1. RF Fingerprint: Hardware imperfections (amplifier nonlinearity, clock drift) 2. Protocol Behavior: Forced 2G downgrade, abnormal power levels → Trust Score: Real-time 0-100% confidence rating ```Key innovations: - Wave-based AI (wAI): Treats RF signals as "language" with grammar/syntax - Tokenization pipeline: STFT → Quantized TFR → Transformer - Edge-first: 50MB quantized model, runs on Raspberry Pi## Results - 99.9% detection accuracy in Seoul/Tokyo field tests - Found 17 unknown suspicious transmitters - Prevented 278 unauthorized transactions in pilot - Zero false positives on 10,000+ legitimate base stations## Implementation ```bash # Minimal PoC python collect_baseline.py --sdr hackrf --duration 3600 python train_wai.py --model mamba --epochs 100 python detect_realtime.py --threshold 0.85 ```Stack: GNU Radio + PyTorch + RTL-SDR/HackRF## Next Steps - Open-sourcing core detection engine (Q1 2025) - Building crowdsourced threat intelligence network - Adding 5G SA/NSA supportGitHub: [coming soon - email for early access] Technical paper: [arxiv link pending]Looking for feedback from RF/SDR folks: What attack vectors am I missing? How would you bypass RF fingerprinting?

光环：利用射频指纹识别人工智能检测虚假蜂窝基站