Jam Detector for LTE 4G

[Kai88]

Hi,

I want to start on a personal project whereby I would develop a Anti 4G LTE jammer with localisation of the source.

Here's how i think it would work. Using a spectrum analyser or something, I would get the RSSI and SNR of the 4G spectrum.
Afterwhich, based on the SNR and RSSI (LOW SNR) of the 4G spectrum, I would be able to determine if the 4G spectrum is jammed.
This is the outline of how it would work.

I looked around the internet and found some USB dongle spectrum analyser or SDR that can act as a spectrum analyser.


What I am stuck with now is that there are so many spectrum analysers out there, and I am not sure that by using a spectrum analyser, I would be able to detect a jam on the 4G LTE band using the method  I mentioned above.

Some of the products that i found online:

https://greatscottgadgets.com/hackrf/

http://nuand.com/

https://www.ettus.com/product/details/UB200-KIT

http://www.triarchytech.com/product4G.html

I would appreciate if someone could give me some pointers on this topic.

[CopperCone]

you should rename the thread to designing Jam Detector for LTE 4G. It sounds like you want to make a jammer, which is confusing.

Anyway, you will find that some GSM modules already have this functionality, I believe that they have a Interference Detect pin which goes high, based on RSSI measurements they perform.

[helius]

It's an interesting problem, since spread-spectrum radio signals already look like noise if you do not have the parameters to descramble them.
Maybe a measurement of spectral purity could distinguish real signals from jammers? Do you know what type of modulation jammers use?

[CopperCone]

Jammers can do alot. Cheap/simple ones will just sweep a single frequency in the signal bandwidth of the device, something like a yig sweeper connected to a triangle wave generator. Very effective though, since no matter what kinda protocol you use, its gonna get all fucked up, so long your sweep is powerful enough and can appear in the correct frequencies frequently enough.

More advanced ones can look at the protocol and turn on for a brief moment during some important part (i.e. hailing) to cause the device to go into some kinda loop.. Why? Because it uses less power, so rather then screaming on the top of your lungs all the time, you only scream when someone is saying their name, so they have to keep repeating themselves endlessly. This means that a battery powered jammer will work longer and require less robust electronics to get the job done, since the duty cycle is less. It's also less obvious to an outside observer that it is acting like a jammer, easier to say its malfunctioning electronics etc. The signature from a swept 'barrage' jammer is rather obvious, compared to something that could possibly be disguised as some kind of intelligent signal (i.e. putting some kinda modulation on your jam).

Also you can spoof a base station, and have that base station do nothing, to effectively jam the signal (This is hard though).

[rhb]

I hope you like math, *a lot*.

Seriously, look at the papers by Donoho and Candes:

http://statweb.stanford.edu/~donoho/reports.html

https://statweb.stanford.edu/~candes/publications.html

Also search on "blind source separation"

There are older ways of doing what you seek, but the results are nowhere near as good.  Fortunately, you only have to read all the math if you want to know why it works.  If you just want to do it, just randomly collect y, set up Ax=y and solve for x using an L1 solver.  For prototyping I suggest the simplex solver in GLPK.

Your project is not cheap.  It requires the equivalent of at *least* two LimeSDRs with GPSDOs and a Zynq FPGAs.  So ~$1500 for  a minimal setup.  For good performance you really want three stations which brings it to $2250+.  Plus quite a lot of work to write the code.

Doable?  Yes, it's been done.  Cheap?  No. Easy?  Well, not all that hard, but not trivial either.

[Kai88]

Thanks for the prompt replies.

Do you know what type of modulation jammers use?

I do not know what type of modulation the jammers use. But I would assume that it would be a brute force jammer. (Like what CopperCone mentioned for the cheap/simple jammers)

Jammers can do alot. Cheap/simple ones will just sweep a single frequency in the signal bandwidth of the device, something like a yig sweeper connected to a triangle wave generator. Very effective though, since no matter what kinda protocol you use, its gonna get all fucked up, so long your sweep is powerful enough and can appear in the correct frequencies frequently enough.

More advanced ones can look at the protocol and turn on for a brief moment during some important part (i.e. hailing) to cause the device to go into some kinda loop.. Why? Because it uses less power, so rather then screaming on the top of your lungs all the time, you only scream when someone is saying their name, so they have to keep repeating themselves endlessly. This means that a battery powered jammer will work longer and require less robust electronics to get the job done, since the duty cycle is less. It's also less obvious to an outside observer that it is acting like a jammer, easier to say its malfunctioning electronics etc. The signature from a swept 'barrage' jammer is rather obvious, compared to something that could possibly be disguised as some kind of intelligent signal (i.e. putting some kinda modulation on your jam).

The spoof of base station as you said would be hard, and i don't think someone would actually spoof a base station to get my data. (I mean I'm not a celebrity or some hot shots; although i wished i was )

I hope you like math, *a lot*.

Seriously, look at the papers by Donoho and Candes:

http://statweb.stanford.edu/~donoho/reports.html

https://statweb.stanford.edu/~candes/publications.html

Also search on "blind source separation"

There are older ways of doing what you seek, but the results are nowhere near as good.  Fortunately, you only have to read all the math if you want to know why it works.  If you just want to do it, just randomly collect y, set up Ax=y and solve for x using an L1 solver.  For prototyping I suggest the simplex solver in GLPK.

Your project is not cheap.  It requires the equivalent of at *least* two LimeSDRs with GPSDOs and a Zynq FPGAs.  So ~$1500 for  a minimal setup.  For good performance you really want three stations which brings it to $2250+.  Plus quite a lot of work to write the code.

Doable?  Yes, it's been done.  Cheap?  No. Easy?  Well, not all that hard, but not trivial either.

Will take a look at all the papers.  (Its a lot, gonna take some time to go through all of it)

Don't know what your country uses, but Chinese radio committee authority uses Tek and Anritsu handheld spectrum analyzers to bust fake cellular stations.
One thing to know is they won't be cheap. Talking $3k minimum with no options per unit. After import tax and distributor's profit, on the market the new ones should run ~$5k and above.

Thanks for the recommendations.


Thanks for all the inputs, but I do have some design constraints over on my side which i forgot to input. (SORRY!)

The design must be small and light-weight, preferably below 150g and a size not larger than a USB flash drive.
So I was thinking of something like a USB spectrum analyser/GSM modules that is able to do this.

Also, for the antenna wise, a directional log-periodic antenna might be able to help with the direction of the jam, i guess. (Of course the antenna have to be small too; haven't really go into antenna research yet, as I'm currently still doing the detection and direction hunting part)

[rhb]

Thanks for all the inputs, but I do have some design constraints over on my side which i forgot to input. (SORRY!)

The design must be small and light-weight, preferably below 150g and a size not larger than a USB flash drive.
So I was thinking of something like a USB spectrum analyser/GSM modules that is able to do this.

Also, for the antenna wise, a directional log-periodic antenna might be able to help with the direction of the jam, i guess. (Of course the antenna have to be small too; haven't really go into antenna research yet, as I'm currently still doing the detection and direction hunting part)

Probably not possible.  To do a location you need to know phase at 2-3 locations to GPSDO accuracy and you need to pass data from multiple receiving stations for processing.  You can do "it's in that direction" under your constraints, but even that is not easy.

There are a number of receiving stations around the world.  The one I read about is in Europe.  It's got a ring of vertical antennae a kilometer or so across. It's got the ability to do a directional fix on a signal that only lasts a few milliseconds.

RTL-SDR dongles will provide a semi-usable signal.  But you still need an accurate clock.

[Kai88]

RTLSDR looks good but it does not cover the 4G band, if i read correctly.

If you just want a small toy, consider RTLSDR.
If you are into larger system like USRP, there are Chinese clone of the USRP at 1/3~1/2 the price (ironically, those RF interference busting devices are also used by illegal base stations in China to send spam texts).

I have looked at USRP.
https://www.ettus.com/product/details/USRP-B205Mini-I
https://www.ettus.com/product/details/USRP-B200mini

Seems like only the Bus series fit my size considerations. (If you have other devices/brand to introduce, please do! )

Probably not possible.  To do a location you need to know phase at 2-3 locations to GPSDO accuracy and you need to pass data from multiple receiving stations for processing.  You can do "it's in that direction" under your constraints, but even that is not easy.

There are a number of receiving stations around the world.  The one I read about is in Europe.  It's got a ring of vertical antennae a kilometer or so across. It's got the ability to do a directional fix on a signal that only lasts a few milliseconds.

RTL-SDR dongles will provide a semi-usable signal.  But you still need an accurate clock.

I do not need to know the exact location, just the general direction of the jam. (Eg, north, south-east, etc)


So if now i have gotten a mini-SDR, what do i have to do in order to detect the Jam?
Does my method of detecting the jam sounds correct? (Using RSSI and SNR from the mini-SDR's calculations)
And also, how do i detect the general direction of the jam?

[firehopper]

to get the direction, as far as I know, sweep the antenna around and look for a peak. look up fox hunting with radios.
people hide a small transmitter and use other radios to find it, usually at hamfests..

[rhb]

I do not need to know the exact location, just the general direction of the jam. (Eg, north, south-east, etc)

So if now i have gotten a mini-SDR, what do i have to do in order to detect the Jam?
Does my method of detecting the jam sounds correct? (Using RSSI and SNR from the mini-SDR's calculations)
And also, how do i detect the general direction of the jam?

What's your skill level?  Here are two answers.

The advanced method:

Build an antenna switching system using FET analog muliplexers. and get a set of  N magnetic mount antennae. with a triangle of strings connecting them to a common wooden strip.  The wooden strip will be your directional reference.  The strings are so you can repeatably position them in the same configuration.  Use nylon monofilament fish line to get minimum stretch.

Generate a long random sequence either using a true random number generator or the Mersenne Twiser PRNG. The scale the numbers to the range p to q where p is the minimum number of clock ticks between ADC samples.  I don't know what q should be.  I'd start with 256 times p as an initial choice.  Program the multiplexer to select each antenna in turn.  Set a timer to go off at the Jth clock tick in your sequence.  When the timer goes off, collect a sample of he signal output from the receiver using the ADC and reset the timer to the next interval.

Divide the data into N parts, one for each antenna.  This is the y for each antenna.  Setup N instances of Ax=y where the A matrix where the Jth row is a Fourier series sampled at the Jth time.  You'll need to integrate the delay intervals.  Seek an L1 solution for x using the simplex solver in the GLPK package.  Because you're using the same random intervals, you can precompute the A matrix and store it.  You will solve Ax=y N times for each directional fix.

Evaluate the non-zero coefficients in x at a regular series of sample times which meets Nyquist criteria.  Fourier transform  and and compute the phase delays for all the channels.  Convert the phase delays to direction relative to your reference stick.  The farther apart the antennae, the better your directional location.  The  modulus of the Fourier transform is the waterfall row in the second method.

What I've described is what I call a "sparse L1 pursuit".  It also goes by the term "compressive sensing"  and is absolute state of the art.  If you implement this you have gained a major employment credential, especially with the 3 letter agencies.  If it's not been done it's a PhD level project at a major university. Though to get a degree you will have to understand the math rather than just how to implement it. Show it to the faculty and you'll get a full ride through school.

An LPC4370 runs at 204 MHz and has a 12 bit 80 MS/S ADC.  In the form of an LPC-Link2 programmer they are available from Digikey for $20 each.  You'll need two, one for the MCU and one to program it.

The basic method:

Build a multi element Yagii on a circular piece of PCB so you can rotate it rapidly without vibration..  Rotate the Yaggi and note the direction with the strongest signal.  Use a waterfall spectrum display with a reference marker for each rotation. A jammer will have a distinctive spectral signature which will repeat once per revolution. 

There are intermediate level approaches.  I'll let you investigate those.

Have Fun!
Reg

[CopperCone]

What the hell is the benefit of the advanced method? I got a headache from the wikipedia math barf.

Can you also sketchout the thing you described? Im confused as hell

[rhb]

What the hell is the benefit of the advanced method? I got a headache from the wikipedia math barf.

The ability to get a more accurate result using   a single receiver and multiplexed antennae.  If you prefer you can skip the CS and use one receiver per antenna.  In any case, you're still going to need to compute the phase differences between the antennae.

I told you how to do it.  The math is just why it works.  What I wrote is a complete description of how.  It does presume you understand how to use a Fourier transform.  If not you'll have to either learn it or just point an antenna in different directions.

Can you also sketchout the thing you described? Im confused as hell

Which thing?  The spinning Yagii?  That should be obvious.  The CS solution was sufficiently detailed to implement.