LSTM Autoencoder

The core structure consists of two LSTM networks. The encoder ingests a sequence of normal I/Q samples or spectral features and compresses the temporal dynamics into a fixed-length context vector. The decoder takes this compressed representation and attempts to reconstruct the original input sequence step-by-step. The bottleneck forces the model to learn only the essential, normal patterns of the signal, discarding noise.

Unlike feed-forward autoencoders, the LSTM variant explicitly models time. Internal gating mechanisms (input, forget, and output gates) allow the network to remember relevant past signal states over long durations while ignoring irrelevant ones. This is critical for capturing the cyclostationary properties of legitimate transmissions, such as a Wi-Fi beacon interval or a radar pulse repetition interval, and flagging breaks in these patterns as anomalies.

Anomaly detection is driven by a quantitative score. For each input sequence, the Mean Squared Error (MSE) or Mean Absolute Error (MAE) is calculated between the original input and the decoder's output. A high reconstruction error indicates the sequence contains temporal dynamics the model did not learn during training. A threshold is set on a validation set to separate normal signal variance from true anomalies like rogue emitters or jamming.

The model is trained exclusively on normal, labeled spectrum data in a self-supervised manner. The training objective is to minimize the reconstruction loss. The input and target output are the same sequence. This forces the model to function as an identity function for normal behavior. No anomalous data is required during training, making it ideal for detecting unknown or zero-day interference types.

For real-time spectrum monitoring, the trained decoder is deployed in a streaming pipeline. A sliding window continuously feeds the latest I/Q samples into the encoder. The decoder generates a reconstruction, and the error score is computed instantly. If the score exceeds the dynamic threshold, an alert is triggered. This architecture supports online anomaly detection without requiring batch processing of historical data.

A common enhancement uses Bidirectional LSTMs (BiLSTMs) in the encoder. This processes the input sequence both forward and backward, providing the context vector with future context relative to each time step. For spectrum analysis, this allows the model to understand a signal anomaly not just by what preceded it, but also by the signal structure that follows, improving detection accuracy for subtle, non-causal interference patterns.

The quantitative difference between an LSTM autoencoder's input sequence and its output reconstruction, serving as the primary anomaly score. Mean Squared Error (MSE) is the most common metric, calculated across all time steps. A high reconstruction error indicates the input sequence deviates from the learned manifold of normal spectrum behavior.

• MSE: Average squared difference, sensitive to large deviations
• MAE: Mean absolute error, more robust to outliers
• Dynamic thresholding: Adaptive error thresholds that adjust to changing noise floors

The encoder-decoder structure where an encoder LSTM compresses an input time window into a fixed-length context vector, and a decoder LSTM reconstructs the original sequence from this compressed representation. This architecture forces the model to learn a compact, salient representation of normal temporal dynamics.

• The bottleneck prevents identity mapping
• Teacher forcing is used during training but disabled during inference
• Bidirectional encoders can capture both forward and backward temporal dependencies

The task of identifying spectrum inputs that differ fundamentally from the training data distribution. LSTM autoencoders perform OOD detection implicitly—sequences containing novel modulation schemes, jamming patterns, or rogue emissions produce high reconstruction errors because they fall outside the learned normal manifold.

• Critical for open-world spectrum environments where unknown signal types appear
• Differs from supervised classification which fails on unseen classes
• Complements Open Set Recognition frameworks for comprehensive threat detection

An alternative sequence modeling architecture using causal dilated convolutions instead of recurrent connections. TCNs offer parallelizable training, stable gradients, and flexible receptive fields that can be tuned to capture specific temporal dependencies in spectrum data.

• Dilated convolutions exponentially expand the receptive field without increasing parameters
• Causal padding ensures no future information leakage
• Often compared against LSTMs for spectrum anomaly tasks where training speed is critical

The identification of gradual or abrupt changes in the statistical properties of spectrum data over time. An LSTM autoencoder trained on historical normal behavior may degrade as the RF environment evolves—new legitimate emitters appear, noise floors shift, or seasonal patterns change.

• Sudden drift: A new permanent transmitter begins operating
• Incremental drift: Gradual environmental changes like urbanization
• Requires periodic retraining or online adaptation strategies to maintain detection accuracy

Algorithms designed to process streaming I/Q samples or spectral snapshots in real-time, updating their model of normality incrementally. Unlike batch processing, online LSTM autoencoders maintain a sliding window buffer and compute reconstruction error for each new sample as it arrives.

• Enables sub-millisecond detection latency for time-critical electronic warfare applications
• Requires efficient state management to avoid recomputing full sequences
• Often deployed on FPGA or edge GPU hardware for line-rate processing