Cumulant-Based Anomaly Detection

The system continuously estimates higher-order cumulants (e.g., C40, C42) from incoming IQ samples and tracks their values over time. A stable communication link exhibits a stationary cumulant trajectory. When a jammer injects a different modulation or a transmitter's power amplifier begins to fail, the statistical fingerprint shifts. Cumulant-based drift detection algorithms compare the current trajectory against a learned baseline profile, triggering an alert when the deviation exceeds a statistically defined threshold.

Legitimate communication signals have specific non-Gaussian distributions defined by their modulation format (e.g., QPSK is sub-Gaussian). Noise and many jamming waveforms are Gaussian. The system performs a continuous Gaussianity test using sample kurtosis and other cumulant-based metrics. A sudden drop in non-Gaussianity—where the signal's distribution collapses toward Gaussian—indicates either a noise jammer, a spoofing attempt with a different modulation, or a hardware fault introducing excessive phase noise.

Unlike preamble-based methods, cumulant anomaly detection works blindly—without prior knowledge of the signal's carrier frequency, symbol rate, or timing. The system estimates a cumulant-based feature vector (e.g., |C40|/|C42| ratio, skewness) from raw IQ data and compares it to the expected theoretical cumulant values for the authorized modulation. This enables detection of modulation-switching attacks where an adversary replaces a QPSK signal with a BPSK or 16-QAM waveform to inject malicious data.

Single cumulant orders can be ambiguous—different modulations may share similar C40 values. Robust anomaly detection fuses multiple orders into a cumulant tensor or joint feature space. The system monitors the Mahalanobis distance of the current multi-order estimate from the expected cluster center. A deviation in any dimension of the cumulant space—second-order (power), third-order (skewness), or fourth-order (kurtosis)—provides a multi-faceted view of signal integrity, distinguishing between benign channel fading and malicious interference.

Beyond detecting external threats, cumulant anomaly detection identifies internal hardware degradation. Power amplifier non-linearity, IQ modulator imbalance, and oscillator phase noise each leave distinct signatures in higher-order statistics. For example, IQ imbalance introduces non-zero skewness in a normally symmetric constellation. By tracking these cumulant-based impairment indicators over days or weeks, the system predicts transmitter failure before it causes a link outage, enabling predictive maintenance of software-defined radios.

For real-time operation on edge hardware, the system uses recursive cumulant estimation algorithms that update statistics with each new IQ sample rather than requiring batch processing. This online approach maintains a running estimate of all required cumulant orders with minimal memory. The recursive formulation enables continuous anomaly scoring at the sample rate, allowing the system to detect transient attacks—such as a brief spoofing pulse—that would be missed by block-based processing. FPGA implementations achieve sub-millisecond update latencies.

A monitoring process that tracks the statistical distribution of cumulant features over time to detect concept drift in the signal environment. This technique continuously evaluates whether the observed cumulant trajectory remains within the expected profile for a given modulation. A significant deviation triggers an alert, signaling potential jamming, spoofing, or gradual hardware degradation. It is a foundational method for proactive spectrum assurance.

A statistical framework used to formally accept or reject a specific modulation format hypothesis from observed data. It compares sample cumulant estimates against theoretical values for a candidate modulation. In anomaly detection, a persistent failure to match any known hypothesis indicates an unknown or corrupted signal. Common tests include likelihood-ratio and goodness-of-fit assessments based on higher-order statistics.

A classification framework designed to reject unknown modulation types that fall outside the statistical boundaries of a trained model. It leverages the compactness of known cumulant feature clusters in high-dimensional space. Anomalies are detected when a signal's cumulant vector maps to an open space far from any known class centroid, making it ideal for identifying novel jamming waveforms or spoofing attacks.

The theoretical signal-to-noise ratio threshold below which the variance of a sample cumulant estimator exceeds its mean. Below this wall, modulation classification and anomaly detection become fundamentally unreliable, regardless of observation length. Understanding this limit is critical for designing anomaly detectors that can declare an 'unknown' state rather than making erroneous classifications in low-SNR environments.

The practical computation of cumulants from a finite block of received IQ samples. The accuracy of anomaly detection is directly tied to the variance of these estimates. Key considerations include:

• Sample size: More samples reduce estimator variance.
• Recursive algorithms: Enable streaming updates for real-time monitoring.
• Bias correction: Essential for accurate higher-order statistics from short data records.

The inherent resistance of cumulant features to small, adversarial perturbations. Unlike raw IQ samples, higher-order statistics are less sensitive to minor waveform distortions. This property makes cumulant-based anomaly detectors naturally robust against subtle evasion attacks designed to fool deep learning classifiers, providing a physics-informed layer of defense against intelligent jammers.