I/Q Data Anomaly Scoring

Unlike traditional pipelines that first extract handcrafted features like spectral kurtosis or cyclostationary signatures, I/Q anomaly scoring operates directly on the complex-valued time-domain samples. This preserves the complete phase and amplitude information that feature extraction often discards. By feeding raw I/Q streams into deep learning architectures, the model learns its own optimal representations of normality, detecting anomalies that would be lost in the dimensionality reduction of conventional feature engineering.

Standard neural networks treat real and imaginary components as separate channels, losing the inherent geometric relationship between I and Q. Advanced I/Q scoring employs complex-valued neural networks (CVNNs) with complex weights, activations, and backpropagation rules. These architectures naturally preserve the phase relationships critical for distinguishing legitimate modulation variations from hardware faults or spoofing attempts. A phase shift of 90 degrees carries fundamentally different meaning than an amplitude change, and CVNNs respect this distinction.

I/Q anomaly scorers typically employ unsupervised or self-supervised learning to model the distribution of normal transmissions without requiring labeled anomaly data. Autoencoders compress raw I/Q windows into a latent space and reconstruct them; high reconstruction error signals an anomaly. Variational autoencoders (VAEs) go further by learning a probabilistic latent distribution, enabling likelihood-based scoring where low-probability samples under the learned prior are flagged. This approach adapts to any RF environment without retraining for each new threat signature.

Raw I/Q data is inherently sequential, with sample-to-sample dependencies encoding modulation schemes and symbol transitions. Effective anomaly scoring architectures incorporate temporal modeling through LSTM autoencoders, temporal convolutional networks (TCNs), or transformer-based sequence models. These architectures capture long-range dependencies across hundreds or thousands of samples, detecting anomalies like intermittent phase discontinuities, symbol timing jitter, or gradual frequency drift that point-based detectors miss entirely.

I/Q anomaly scoring operates in an open-set recognition paradigm, where the model must identify known signal types while simultaneously detecting entirely novel, previously unseen waveforms. Unlike closed-set classifiers that force every input into a known category, anomaly scorers maintain a rejection threshold based on distance from learned normality. This is critical for spectrum enforcement, where rogue emitters may use custom or adaptive modulation schemes deliberately designed to evade signature-based detection systems.

Because I/Q anomaly scoring operates on raw samples, it captures microscopic hardware imperfections invisible to demodulated bitstream analysis. Subtle variations in oscillator phase noise, power amplifier non-linearity, and DAC quantization errors create unique transmitter fingerprints embedded in the I/Q waveform. Anomaly scorers trained on authorized device signatures can detect spoofing attacks where an adversary replicates the correct protocol but cannot duplicate the physical-layer fingerprint of the legitimate transmitter.

The quantitative difference between an autoencoder's input and its output, serving as a direct anomaly score. When applied to raw I/Q samples, a high reconstruction error indicates that the signal's complex envelope deviates from the learned manifold of normal transmissions.

• Mean Squared Error (MSE) is commonly used to calculate the per-sample difference
• Effective for detecting unauthorized transmitters or hardware faults that distort the constellation
• Requires a model trained exclusively on normal, clean I/Q data to establish a baseline

The task of identifying inputs that differ fundamentally from the training data distribution. In the context of raw I/Q, OOD detection flags signal segments whose statistical properties or modulation patterns were never seen during training, crucial for open-world spectrum monitoring.

• Relies on measuring the likelihood of a sample under a learned probabilistic model
• Can detect novel Low Probability of Intercept (LPI) waveforms
• Often implemented using energy-based models or density estimation on feature embeddings

A neural one-class classification method that learns to map normal I/Q data into a minimal hypersphere in feature space. Anomalies are identified as points that fall outside this learned boundary, providing a clean geometric interpretation of normality vs. deviation.

• Minimizes the volume of a hypersphere enclosing normal feature embeddings
• Eliminates the need for a decoder, simplifying the architecture compared to autoencoders
• Highly effective for rogue emitter identification when labeled anomaly data is scarce

A multivariate distance metric that measures how many standard deviations a point is from the mean of a distribution, accounting for the covariance structure of the I/Q features. It provides a statistically principled anomaly score for Gaussian-distributed signal representations.

• Calculated as the square root of the difference vector multiplied by the inverse covariance matrix
• Assumes the normal data follows a multivariate Gaussian distribution
• Computationally efficient for real-time, online anomaly detection on streaming I/Q data

A statistical measure of the peakedness of a signal's power spectral density, used to detect non-Gaussian components like impulsive noise or interference directly from raw samples. High kurtosis values indicate the presence of transient anomalies superimposed on normal communication signals.

• Calculated as the normalized fourth-order cumulant of the frequency-domain representation
• Sensitive to jamming pulses and bursty interference that are invisible to power detectors
• Can be computed on short-time Fourier transforms of the I/Q stream for temporal localization

The identification of changes in the underlying statistical properties of spectrum data over time. In I/Q anomaly scoring, drift detection algorithms monitor the distribution of anomaly scores themselves to detect when the RF environment has fundamentally shifted, requiring model retraining.

• Uses sequential analysis techniques like Page-Hinkley or ADWIN to detect distribution changes
• Prevents a static model from generating false positives when a new legitimate emitter appears
• Essential for maintaining long-term operational reliability in dynamic spectrum environments