“nDPI–RF Fusion for Algorithmic Manipulation Detection”
Detecting Algorithmic Manipulation with nDPI–RF Fusion
By Benjamin J. Gilbert, College of the Mainland – Robotic Process Automation | Spectrcyde RF Quantum SCYTHE
Why Algorithmic Manipulation Detection Matters
As networks grow more complex and adversaries more subtle, manipulation can slip through traditional defenses. RF-only methods catch signal anomalies but miss higher-layer context. Deep Packet Inspection (DPI) shines at protocol analysis but is blind to the physical quirks of radio. The result? Blind spots that attackers exploit.
That’s where fusion comes in.
Our Approach: RF + nDPI
We’ve built a reproducible pipeline that blends:
- RF features (SNR, burstiness, asymmetry, narrowband flags)
- nDPI features (protocol histograms, entropy, suspicious traffic ratios)
- Logistic regression fusion to bring the two together
- Calibration via temperature scaling, ensuring trustworthy risk scores
The pipeline is scripted end-to-end for repeatability, shipping with JSON→TeX automation so figures and tables generate seamlessly for publication.
Experimental Setup
We stress-tested the system under controlled conditions:
- SNR range: −10 dB to +20 dB
- Blockers: random injections
- Traffic: realistic protocol mixes with suspicious ratios
- Samples: 2000 per configuration
- Hardware: CPU-only benchmark for transparency and reproducibility
What We Found
- Fusion improves accuracy. Across all SNR conditions, RF+DPI outperformed RF-only detection. At 0 dB SNR, F1 jumped from 0.613 → 0.638.
- Risk scores are reliable. Temperature scaling cut Expected Calibration Error (ECE), making outputs more trustworthy in live operations.
- Protocol diversity matters. Even when RF degraded, protocol histograms from nDPI helped anchor detection.
Figures show the improvements clearly:
- F1 vs. SNR plots confirm consistent fusion benefits.
- Protocol histograms highlight TLS/QUIC dominance in traffic.
- Reliability diagrams prove calibration success.
Limitations & Future Work
This study is a CPU-only synthetic benchmark. While reproducible, real-world deployments will need:
- Live nDPI streams instead of emulated traffic
- GPU acceleration for real-time performance
- Expanded threat models to capture adversarial evasion tactics
Why It Matters
This fusion isn’t just an academic curiosity—it’s an operational upgrade. By uniting RF and DPI perspectives, we can build detectors that:
- Catch manipulations even in noisy or adversarial environments
- Deliver calibrated, decision-ready risk scores
- Run on modest hardware for reproducibility and transparency
Closing Thoughts
The nDPI–RF fusion pipeline shows that bridging physical-layer and network-layer signals makes manipulation detection stronger, more trustworthy, and reproducible. With GPU acceleration and live deployment, it could power the next generation of resilient cyber-RF defense systems.
👉 The project is reproducible (commit f2017942, seed 42) and ships a build with JSON→TeX toolchain.
