Exponential Moving Average Signature

The EMA applies a smoothing factor (α) between 0 and 1 to recursively blend new observations with the existing reference. Each update requires only the previous EMA value and the current authenticated sample, eliminating the need to store historical data.

• High α (0.3–0.5): Rapid adaptation, suitable for devices with fast thermal drift
• Low α (0.05–0.1): Slow adaptation, robust against transient noise and brief spoofing attempts
• Standard α (0.2): Balances responsiveness with stability for most RF fingerprinting applications

The recursive formulation EMA_t = α · x_t + (1-α) · EMA_{t-1} makes this method ideal for resource-constrained edge deployments where memory and compute are limited.

Each past observation's contribution to the current signature decays exponentially with age. A transmission from k steps ago carries a weight of α · (1-α)^k, meaning older samples are gradually forgotten.

• The half-life of a sample is ln(0.5) / ln(1-α) update cycles
• With α=0.2, a transmission loses half its influence after approximately 3 update cycles
• This property naturally handles concept drift by prioritizing recent, authenticated behavior

The decay characteristic ensures the reference signature continuously tracks the true current hardware state rather than averaging over obsolete impairment configurations.

EMA-based signatures require dynamic authentication thresholds that account for the expected variance between the moving average and any single measurement. The system compares incoming fingerprints against the EMA reference using a drift-compensated distance metric.

• Prediction intervals can be derived from the EMA's implicit variance estimate
• A rolling standard deviation of recent residuals refines the acceptable deviation band
• Thresholds tighten after stable periods and widen during rapid environmental shifts

This prevents false rejections of legitimate devices experiencing normal thermal or aging drift while maintaining sensitivity to impersonation attempts.

The EMA's O(1) per-feature update complexity makes it deployable on microcontrollers, FPGAs, and low-power SDR platforms. Unlike batch methods requiring stored sample windows, the EMA maintains state with a single floating-point value per fingerprint feature.

• A 128-dimensional fingerprint requires only 128 stored values for the reference
• Update computation: one multiply-add per feature per authenticated transmission
• No matrix operations, gradient calculations, or iterative optimization required

This efficiency enables real-time, continuous re-enrollment on devices with severe power and memory constraints, such as IoT sensors and tactical radios.

The EMA signature often serves as the measurement update component within a broader Kalman filtering framework. While the EMA handles the weighted averaging of observations, the Kalman filter adds a predictive state transition model based on known hardware aging physics.

• The Kalman process model predicts how impairments should evolve between updates
• The EMA provides the smoothed observation that corrects the prediction
• The Kalman gain dynamically balances trust between the prediction and the new measurement

This hybrid approach combines the EMA's simplicity with the Kalman filter's ability to incorporate domain knowledge about oscillator aging rates and thermal coefficients.

When a device goes offline or transmits infrequently, the EMA reference does not update, but the authentication confidence naturally decays. The system models this as a confidence decay function tied to the elapsed time since the last successful match.

• Confidence decays proportionally to the expected drift magnitude over the gap duration
• A maximum validity interval can be defined, after which full re-enrollment is required
• The decay rate is device-specific, derived from accelerated aging characterization

This mechanism prevents an attacker from exploiting a stale reference signature to spoof a device that has been offline for an extended period.

A mechanism that incrementally adjusts the stored baseline fingerprint using authenticated transmissions. Unlike a static reference, this update prevents the stored signature from becoming stale due to natural hardware drift. The EMA signature serves as the mathematical engine for this update, applying a configurable weighting factor to balance recent measurements against historical data. This ensures the reference tracks slow component aging without overreacting to transient noise or channel anomalies.

A distance function—such as cosine similarity or Euclidean distance—modified to weight features based on their known drift rates. Standard metrics treat all feature dimensions equally, causing false rejections as some impairments naturally vary faster than others. By incorporating the EMA signature's per-feature variance estimates, the metric can widen tolerance on high-drift dimensions (e.g., carrier frequency offset) while tightening it on stable ones (e.g., DAC non-linearity patterns).

A recursive Bayesian algorithm that estimates the true state of a drifting RF fingerprint by optimally combining a predictive aging model with noisy measurements. The EMA signature can be viewed as a simplified, fixed-gain special case of the Kalman filter. The Kalman approach extends this by dynamically adjusting the gain based on measurement uncertainty, providing superior tracking when noise characteristics are well-characterized but requiring a formal state transition model.

A mathematical function that models the reduction in authentication certainty over time since the last successful match. The EMA signature's smoothing factor directly informs this decay rate:

• A high alpha (responsive) signature decays confidence faster, reflecting rapid adaptation
• A low alpha (stable) signature decays slower, trusting the historical baseline longer This function triggers re-authentication or re-enrollment when confidence drops below a security threshold.

A specific type of distribution shift where the relationship between extracted signal features and true device identity changes due to hardware aging or environmental factors. The EMA signature is a primary defense against concept drift, continuously updating the reference distribution to track the evolving feature space. Without this adaptation, a classifier trained on day-one data would experience catastrophic accuracy degradation as components age, making the system unusable within months of deployment.

A quantitative metric indicating the current reliability and distinctiveness of a device's stored fingerprint. The EMA signature contributes to this score through its variance tracking:

• Low EMA variance: High health—the device's features are stable and predictable
• High EMA variance: Low health—the signature is noisy or drifting rapidly
• Diverging EMA from baseline: Critical health—possible spoofing or component failure This score drives automated maintenance decisions in large-scale IoT deployments.