adieresis=ä,germandbls=ß

5G

    fifth generation
6G

    sixth generation
AED

    adapted energy detector
AUC

    area under the ROC curve
CU

    central unit
DBSCAN

    density-based spatial clustering of applications with noise
DT

    digital twin
FPR

    false positive rate
JCAS

    joint communications and sensing
LOF

    local outlier factor
ML

    machine learning
NPN

    non-public network
OCSVM

    one-class support vector machine
PT

    physical twin
REM

    radio environment map
ROC

    receiver operating characteristics
RM

    radio map
RSS

    received signal strength
STFT

    short-time Fourier transform
SU

    sensing unit
TPR

    true positive rate
TRP

    total radiated power

# Digital Twin of the Radio Environment: A Novel Approach for Anomaly
Detection in Wireless Networks

Anton Krause, Mohd Danish Khursheed, Philipp Schulz, Friedrich Burmeister and
Gerhard Fettweis  Vodafone Chair Mobile Communications Systems, Technische
Universität Dresden, Germany
Email: {anton.krause, mohd_danish.khursheed, philipp.schulz2,
friedrich.burmeister<EMAIL_ADDRESS>
###### Abstract

The increasing relevance of resilience in wireless connectivity for Industry
4.0 stems from the growing complexity and interconnectivity of industrial
systems, where a single point of failure can disrupt the entire network,
leading to significant downtime and productivity losses. It is thus essential
to constantly monitor the network and identify any anomaly such as a jammer.
Hereby, technologies envisioned to be integrated in 6G, in particular joint
communications and sensing (JCAS) and accurate indoor positioning of
transmitters, open up the possibility to build a digital twin (DT) of the
radio environment. This paper proposes a new approach for anomaly detection in
wireless networks enabled by such a DT which allows to integrate contextual
information on the network in the anomaly detection procedure. The basic
approach is thereby to compare expected received signal strengths from the DT
with measurements done by distributed sensing units. Employing simulations,
different algorithms are compared regarding their ability to infer from the
comparison on the presence or absence of an anomaly, particular a jammer.
Overall, the feasibility of anomaly detection using the proposed approach is
demonstrated which integrates in the ongoing research on employing DTs for
comprehensive monitoring of wireless networks.

###### Index Terms:

Anomaly detection, digital twin (DT), machine learning (ML), resilience

##  I Introduction

6G mobile networks will follow the trend of fifth generation (5G) networks to
connect more and more things from the real world, such as machines, sensors,
vehicles, etc. [1]. As the number of wirelessly connected devices increases,
so does the potential risk posed by interference from external sources.
Imagine a factory that is jammed, no matter whether it happens intentionally
or unintentionally (e.g., out-of-band radiation from a device that does not
meet the regulations). The disruption of wireless communications could lead to
immense costs by production downtime or even to life-threatening situations in
scenarios where humans and robots cooperate. Thus, resilience, i.e., the
ability to maintain functionality under adverse conditions, is envisioned as
one of the main assets of future sixth generation (6G) mobile networks [2].

To enable a network to take countermeasures against an abnormal status, the
first step is to detect the anomaly, a topic that has received strong
attention from the research community recently. Many recent works that
consider jamming on the physical layer, process spectrograms using machine
learning (ML) to detect whether there is an anomaly. Thereby, both supervised
and unsupervised learning approaches are described in the literature. For the
supervised learning approach, both normal and abnormal spectrograms are
provided to the model in order to learn the classification of them [3, 4].
Yet, supervised learning has the shortcoming that types of anomalies not seen
in the training phase are probably also not recognized in the operational
phase. Thus, unsupervised learning has been examined, either based on
autoencoders applied to the spectrogram [5, 6], whereby improperly
reconstructed parts are considered as an anomaly, or prediction of signals
[7], where deviations from the prediction are regarded as an anomaly. Another
approach for anomaly detection is to monitor parameters such as the bit error
rate and packet error rate, as described for example in [8] where also
supervised learning is used.

However, none of the presented approaches integrates contextual information on
the network, e.g., the number and accurate location of active regular
transmitters, information which are envisioned to be available in future 6G
networks. Based on the increasing need for resilience in future wireless
networks, we present a novel approach for anomaly detection in wireless
networks which incorporates such information by building a DT of the radio
environment. While already widely employed in manufacturing, DTs of
telecommunication systems still have a huge potential to unfold and are
therefore in the focus of research from both industry and academia [9, 10,
11]. DT are virtual representations of physical systems which are based on
accurate digital models as well as interconnections between the DT and its
physical world counterpart, the so called physical twin (PT) [12]. First, the
system architecture of the DT of the radio environment is introduced. The
radio environment as considered in this work is based on the concept of radio
environment maps, which already have been widely described in the literature,
for example in [13]. It includes the transmitters as well as the physical
environment (obstacles and their materials, etc.) and propagation
characteristics. Based on simulations we then show how anomalies in the radio
environment – particularly jammers – can be detected using the proposed system
together with anomaly detection algorithms. Those algorithms require no prior
knowledge on the characteristics of potential jammers but do the inference
only from normal operational data. This work provides an initial proof of
concept rather than a comprehensive performance evaluation. Therefore, we
conclude with an outlook on future research directions.

##  II System Architecture

An overview of the system intended for anomaly detection is provided in Fig.
1. The system consists of several SUs which are distributed over the area to
be monitored. Each SU measures the RSS at its fixed and exactly known location
and provides it to a central unit (CU). The location of each regular
transmitter is known by the CU. The positioning itself is considered to be
provided by the 6G system and will not be further discussed here apart from
the positioning accuracy in Section IV-A.

Figure 1: System architecture

The CU has furthermore an accurate database on the physical environment
available which can originate for example from the JCAS abilities of the 6G
system or from other types of sensors, such as LIDAR or camera. For now, we
assume isotropic transmitters, meaning that transmitter orientation has no
effect on the modeled radio environment. Employing the available information
about the transmitters, the physical environment database, and a database that
contains the electromagnetic properties of different materials, propagation
modeling (e.g., ray tracing) can be applied in a regular manner to estimate
the expected RSS at the locations of the SUs. All the information processed in
the CU together with the propagation modeling is denoted as DT of the radio
environment within the scope of this work.

Subsequently, the CU compares the expected RSS from the DT with the RSS values
that are actually measured by the SUs. The differences between the measured
and the expected RSS values for all deployed SU serve then as input for the
anomaly detection which is explained in detail in Section IV.

##  III System Model

Since resilience is of prominent significance for wireless networks in
production environments, we orient our setting towards indoor campus networks,
also referred to as non-public networks. The detailed system model used for
simulations and data generation is described in this section.

The considered area has a size of
$$40\text{\,}\mathrm{m}$\times$40\text{\,}\mathrm{m}$$. Obstacles are not
modeled to keep the scenario general. A random number $N_{\text{reg}}$ of
regular transmitters is active at random locations $\mathbf{u}_{i}$
($i\in\\{1,\dots,N_{\text{reg}}\\}$). All transmitters are assumed to use
isotropic antennas and transmit with a power
${P_{\text{tx,reg}}=$20\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$}$ at a carrier
frequency ${f_{c}=$3.7\text{\,}\mathrm{G}\mathrm{H}\mathrm{z}$}$, whereby the
values are oriented on the regulations for NPN in Germany111The maximum total
radiated power (TRP) allowed is $28\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$
[14].. In the current state of our work, we assume the transmit power to be
known exactly by the system and also to be constant, i.e., there is no power
control active. Furthermore, there are $N_{\text{SU}}$ SUs which measure the
RSS at fixed locations $\mathbf{v}_{j}$ ($j\in\\{1,\dots,N_{\text{SU}}\\}$)
(see Section II). For the scope of this work the SUs are arranged in a grid,
but other constellations would be conceivable as well. Unless otherwise
stated, a grid size of $10\text{\,}\mathrm{m}$ is used, leading to
$N_{\text{SU}}=25$.

The path loss $L$ is modeled using the log-distance path loss model with log-
normal shadowing [15]

$\displaystyle
L_{i,j}[$\mathrm{d}\mathrm{B}$]=10\;\alpha\log_{10}\left(\frac{d_{i,j}}{$\mathrm{m}$}\right)+20\log_{10}\left(\frac{f_{c}}{$\mathrm{H}\mathrm{z}$}\right)+L_{0}+X_{\sigma},$

(1)

where $d_{i,j}$ denotes the distance between transmitter $i$ and SU $j$,
$L_{0}$ the path loss offset and $X_{\sigma}$ the shadowing, which is zero-
mean Gaussian distributed with a standard deviation $\sigma$ (in dB). The
shadowing is correlated with the covariance matrix $\mathbf{C}$, whereby the
entries are given by

$[\mathbf{C}]_{k,l}=\sigma^{2}\exp\left(-\frac{d(\mathbf{x}_{k},\mathbf{x}_{l})}{d_{\text{cor}}}\right)$
(2)

for two points $\mathbf{x}_{k}$ and $\mathbf{x}_{l}$, separated by the
distance $d(\mathbf{x}_{k},\mathbf{x}_{l})$. Measurements have shown that the
correlation in indoor environments is typically limited to small areas [16],
thus we use a correlation distance $d_{\text{cor}}=$1\text{\,}\mathrm{m}$$ in
this work.

TABLE I: simulation parameters Parameter | Value
---|---
Carrier frequency $f_{c}$ | $3.7\text{\,}\mathrm{G}\mathrm{H}\mathrm{z}$
No. of regular transmitters $N_{\text{reg}}$ | 10
Transmit power of regular transmitters $P_{\text{tx, reg}}$ | $20\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$
No. of jammers $N_{\text{jam}}$ | 0 or 1
Transmit power of jammer $P_{\text{tx, jam}}$ | $20\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$
Number of sensing units $N_{\text{SU}}$ | 25
Path loss exponent $\alpha$ | 2
Path loss offset $L_{0}$ | $-147.55\text{\,}\mathrm{d}\mathrm{B}$
Positioning error distribution ($x$ and $y$ direction) | $\mathcal{N}(0,\,$1.33\text{\,}\mathrm{m}$)$

In addition to the regular transmitters, there may be $N_{\text{jam}}$ jammers
active. For the sake of simplicity, we consider only one jammer in this work,
but we expect that our approach will also be able to cope with a higher number
of jammers which will be verified in our future work. The jammer (if present)
is located at the position w equipped with an isotropic antenna and also
transmits at a carrier frequency of
$3.7\text{\,}\mathrm{G}\mathrm{H}\mathrm{z}$. The transmit power
$P_{\text{tx,jam}}$ is fixed to $20\text{\,}\mathrm{d}\mathrm{B}\mathrm{m}$ as
if the jammer would mimic a regular transmitter. An overview of the parameters
is given in Table I.

The system model is deliberately chosen simple for the proof of concept
presented in this work and to able to draw conclusion which are not drawn to a
specific scenario. For our future work, we will evaluate the concept in real-
world oriented scenarios (see Section VI).

##  IV Methods

The detection of anomalies in the radio environment as introduced in this work
bases on the construction of a DT and its comparison with real-world
measurements. While the building process is described in the first part of
this section, the methodology to detect anomalies from the difference between
real-world and DT measurements is described in the second part.

###  IV-A Building the Digital Twin

Various information from different domains allow to build a virtual
representation of the radio environment, the so called DT. As mentioned in
Section III, this is basically done by employing propagation modeling for the
regular transmitters. For the sake of simplicity, we employ in this work
isotropic transmitters. While transmit powers can be measured relatively
accurate, radio-based localization in indoor environments is still
challenging. Thus, positioning inaccuracies are modeled as follows. According
to [17], for uplink time difference of arrival localization in FR1 we can
expect a positioning error of less than $2.19\text{\,}\mathrm{m}$ in 90% of
the cases. For modeling it is assumed that the error in $x$ and $y$ direction
is normally distributed and uncorrelated, leading to a Rayleigh distribution
for the magnitude of the error vector. From this, a standard deviation of the
error in $x$ and $y$ direction of $1.02\text{\,}\mathrm{m}$ is derived.

With the given information on the transmitter, the path loss $\hat{L}_{i,j}$
between transmitter $i$ and SU $j$ is estimated using the log-distance path
loss model

$\hat{L}_{i,j}[$\mathrm{d}\mathrm{B}$]=10\;\alpha\log_{10}\left(\frac{\hat{d}_{i,j}}{$\mathrm{m}$}\right)+20\log_{10}\left(\frac{f_{c}}{$\mathrm{H}\mathrm{z}$}\right)+L_{0}$
(3)

similar to Eq. (1). Because the true distance between the transmitter and the
SU is unknown, it is replaced by the estimated distance $\hat{d}_{i,j}$
between the estimated transmitter location $\mathbf{\hat{u}}_{i}$ and the true
location of SU $j$. The shadowing term $X_{\sigma}$ is omitted as it is
unknown. The difference between the original radio environment and its DT is
visualized in Fig. 2. For a better understanding, not only the RSS at the SU
locations (which are required for anomaly detection) is shown but instead the
radio map of the complete area. Fig. 2(a) shows an example radio map with ten
regular transmitters and one jammer present. The radio map of the DT in Fig.
2(b) incorporates the regular transmitters but neither the jammer nor the
random shadowing. The resulting difference is shown in Fig. 2(c). Big
deviations occur close to the positions of the regular transmitters due to
localization inaccuracy and at the jammer location, as the jammer is not
present in the DT. Note, that Fig. 2(c) shows the difference between the
original and the DT radio map on the whole area, but as input for the anomaly
detection problem only the values at the SU locations (indicated by the black
dots) are used.

(a) Original radio map

(b) DT radio map

(c) Difference between original and DT radio maps

Figure 2: Exemplary radio maps as representation of the radio environment at
$\sigma=$4\text{\,}\mathrm{d}\mathrm{B}$$. Measurements are only available at
the SU positions indicated in (c)

###  IV-B Fundamentals of the Anomaly Detection

Given a collection of data samples, an anomaly is one or a group of samples
that is rare and differs significantly from the majority of samples in the
overall collection [18]. In this work, we consider the presence of a jammer as
an anomaly. Jamming can be intentional, i.e., aiming to disturb the operation
of the network, but it can also be unintentional. Unintentional jamming might
be for example out of band radiation of a device in a neighboring band that
does not meet the regulations or an interfering neighboring NPN.

The detection of anomalies in the radio environment as proposed in this paper
is based on comparing the RSS measured by the SUs at different locations with
the RSS expected from the DT of the radio environment. With the fundamentals
given in the previous section, the detection problem in the linear domain can
be formulated as follows

$P_{\text{rx},j}[$\mathrm{m}\mathrm{W}$]=\begin{cases}\mathcal{H}_{0}:\;\displaystyle\sum_{i=1}^{N_{\text{reg}}}\cfrac{P_{\text{tx},i}}{L_{i,j}}\\\\[12.0pt]
\mathcal{H}_{1}:\;\displaystyle\sum_{i=1}^{N_{\text{reg}}}\cfrac{P_{\text{tx},i}}{L_{i,j}}+\cfrac{P_{\text{tx,
jam}}}{L_{\text{jam},j}}\end{cases},$ (4)

where $\mathcal{H}_{0}$ refers to the hypothesis that the received power at
receiver $j$ only sums up from the powers received by all regular
transmitters. The alternative hypothesis $\mathcal{H}_{1}$ refers to the
hypothesis that there is a jammer present which contributes additional power.

However, the exact path loss $L_{i,j}$ is not known. Thus, to further
elaborate the detection problem, the vector $\boldsymbol{\Delta}$ of
differences $\Delta_{j}$ between the measured RSS values $P_{\text{rx},j}$ and
the RSS values expected from the DT $\hat{P}_{\text{rx},j}$ at each SU $j$ is
defined. The entries are given by

$\displaystyle\Delta_{j}[$\mathrm{d}\mathrm{B}$]=P_{\text{rx},j}[$\mathrm{d}\mathrm{B}\mathrm{m}$]-\hat{P}_{\text{rx},j}[$\mathrm{d}\mathrm{B}\mathrm{m}$]\;,\quad
j\in\\{1,\dots,N_{\text{SU}}\\}.$

(5)

This vector serves as input for the anomaly detection algorithms. For the
detection, each time the measurements at a single time instance are regarded.
Based on Eq. (5) and under the assumption, that the transmit power
$P_{\text{tx,reg}}$ of regular transmitters is exactly known, the detection
problem in Eq. (4) can be reformulated to

$\leavevmode\resizebox{422.77661pt}{}{$\displaystyle\Delta_{j}=\begin{cases}\mathcal{H}_{0}:\;10\log_{10}\left(\displaystyle\sum_{i=1}^{N_{\text{reg}}}\cfrac{P_{\text{tx},i}}{L_{i,j}}\right)-10\log_{10}\left(\displaystyle\sum_{i=1}^{N_{\text{reg}}}\cfrac{P_{\text{tx},i}}{\hat{L}_{i,j}}\right)\\\\[16.0pt]
\mathcal{H}_{1}:\;10\log_{10}\left(\displaystyle\sum_{i=1}^{N_{\text{reg}}}\cfrac{P_{\text{tx},i}}{L_{i,j}}+\cfrac{P_{\text{tx,
jam}}}{L_{\text{jam},j}}\right)-10\log_{10}\left(\displaystyle\sum_{i=1}^{N_{\text{reg}}}\cfrac{P_{\text{tx},i}}{\hat{L}_{i,j}}\right)\end{cases}$},$
(6)

with powers and losses given in linear scale. This means that the anomaly
detection problem boils down to the decision whether the differences in
$\boldsymbol{\Delta}$ can be purely explained by inaccuracies in path loss
modeling (due to shadowing and localization inaccuracy) or whether there is a
jammer present.

###  IV-C Anomaly Detection Methods

The procedure to implement the anomaly detection system is intended as
follows. Based on models of the physical environment and propagation models,
the DT of the radio environment is established first. In the next phase,
denoted as training phase, training samples are collected during normal
operation. Those samples are assumed to be free from anomalies and are used to
train the algorithms described later on in this section. The task is thereby
to generalize the statistics of normal data (i.e., of the modeling error) and
to be able to identify samples as anomaly that seem to stem from a different
generation process. This approach allows to identify jammer even without any
prior knowledge their characteristics. Thus, the general problem is also often
referred to as novelty detection. When the training is finished, the system
starts its regular operation to detect anomalies.

In the following, the three applied algorithms are introduced. OCSVM and local
outlier factor (LOF) are well-known unsupervised ML algorithms for anomaly
(outlier) detection, while the adapted energy detector (AED) is inspired by
the energy detector for signal detection tasks. For one-class support vector
machine (OCSVM) and LOF, the scikit library [19] implementations are used,
whereas AED is self implemented.

####  IV-C1 AED

The concept of energy detectors is well known and has already been widely
applied, for example in cognitive radio [20]. The task thereby is to detect an
unknown signal in the presence of noise. Given the decision problem in Eq.
(6), the problem can be approached from a similar perspective. Either
$\Delta_{j}$ originates only from random model inaccuracies in case
$\mathcal{H}_{0}$ or there is a jamming signal present which contributes
additional received power. For a perfect DT (i.e., $L_{i,j}=\hat{L}_{i,j}$) we
could expect either ${\Delta_{j}=0}$ in case $\mathcal{H}_{0}$ or

$\Delta_{j}=10\log_{10}\underbrace{\left(\cfrac{\sum_{i=1}^{N_{\text{reg}}}\frac{P_{\text{tx},i}}{L_{i,j}}+\frac{P_{\text{tx,
jam}}}{L_{\text{jam},j}}}{\sum_{i=1}^{N_{\text{reg}}}\frac{P_{\text{tx},i}}{\hat{L}_{i,j}}}\right)}_{>1}>0$
(7)

in case $\mathcal{H}_{1}$. Due to the previously mentioned random and unknown
inaccuracies in the DT, $\Delta_{j}$ is randomly distributed even in case no
jammer is present. The presence of random log-normal components in the path
loss, resulting from shadowing, prevents the existence of a straightforward
mathematical expression for the distribution of $\Delta_{j}$ [21]. Still, the
findings justify the following approach

$\overline{\Delta}=\frac{1}{N_{\text{SU}}}\sum_{j=1}^{N_{\text{SU}}}\Delta_{j}\begin{array}[]{l}\geq\Delta^{\text{th}}\;:\;\text{anomaly}\\\
<\Delta^{\text{th}}\;:\;\text{no anomaly}\end{array}$ (8)

with the threshold $\Delta^{\text{th}}$. It is derived from the statistics of
the training data, e.g., the 90th percentile of $\overline{\Delta}$ in the
training data.

####  IV-C2 OCSVM

The approach of OCSVM is to identify a hypersphere that encloses all (or most)
of the data points [22]. This hypersphere is fitted during the training phase.
In the test phase, samples are categorized as normal if they fall within the
hypersphere or as anomaly otherwise. The default parameters of the OCSVM
implementation remain untouched.

####  IV-C3 LOF

Instead of a binary decision whether a sample is an anomaly or not, LOF
assigns each sample a score that can be interpreted as the outlier degree of
the given sample. This score is also referred to as LOF and it is calculated
by comparing the density around the point under consideration with the density
of points in the neighborhood. The user-specified parameter $k$ thereby
defines how many of the closest points belong to the neighborhood of one point
[23].

In the scope of this work, $k$ is set to 100 to compensate for the sparsity of
the data set due to the high dimensionality. Furthermore, the parameter
novelty is set to True to ensure that the density is calculated based only on
the training data. The threshold score about which an outlier is identified as
anomaly is varied during the receiver operating characteristics (ROC)
analysis.

##  V Results

The performance of the algorithms under study for anomaly detection as well as
the influence of the shadowing level is examined in this section.

To evaluate the performance, a data set is created according to the system
model presented in Section III containing $20\,000$ samples overall. Thereby,
$10\,000$ normal (i.e., not jammed) samples are used for training and another
$10\,000$ samples for testing, whereby now half of the samples are anomalies
and the other half are normal samples. Different data sets are created to
investigate various shadowing levels. Unless otherwise stated in the
explanations of the specific algorithms in Section IV-C, no hyperparameters of
the algorithms are tuned, as this would require the evaluation on the test set
and thereby mean a leakage of test data (i.e., knowledge of anomalies) into
the training phase of the algorithms. After the training phase, the models are
evaluated on the test set by means of the metrics presented in the next
paragraph. This procedure is repeated three times to improve the reliability
of the results.

The detection is regarded as binary classification problem, where we assign
the positive class to the anomalies, and the negative class are the normal
samples. To compare the performance of different algorithms, ROC curves are
employed. The ROC curve depicts the tradeoff between the true positive rate
(TPR) and the false positive rate (FPR) which are defined in Eq. (9) [24].

$\text{TPR}=\frac{\text{TP}}{\text{TP}+\text{FN}}\qquad\text{FPR}=\frac{\text{FP}}{\text{TN}+\text{FP}}$
(9)

To create the ROC, the decision threshold of the algorithms is varied. For the
specific algorithms, this means: for AED the threshold $\Delta^{\text{th}}$,
for OCSVM the radius of the hypersphere and for LOF the score which defines an
outlier is varied. Through the parameters, it can be controlled whether
algorithms shall act more ’conservative’, i.e., identify anomalies only with
high confidence at the cost of many missed detections, or more ’liberal’,
i.e., detecting most of the anomalies at the cost of many false alarms.
Additionally, the ROC is characterized by the property that it does not change
if the ratio between normal and abnormal samples changes [24]. Thus, the
evaluation can be done without assuming a specific jamming probability.

(a) Different shadowing levels at a grid size of $10\text{\,}\mathrm{m}$

(b) Different grid sizes at a shadowing level of
$\sigma=$2\text{\,}\mathrm{d}\mathrm{B}$$

Figure 3: ROC curves for the three algorithms

The ROC curves of the three discussed algorithms (see Section IV-C) are shown
in Fig. 3(a) for the shadowing levels
$\sigma=$0\text{\,}\mathrm{d}\mathrm{B}$$ and
$\sigma=$6\text{\,}\mathrm{d}\mathrm{B}$$. A detector without skill, i.e.,
which just performs random guesses on whether there is an anomaly, would
result in the black dotted line. The better an algorithm performs, the more
its ROC curve tends towards the upper left corner. Thus, one can conclude that
LOF outperforms the other two algorithms at
$\sigma=$0\text{\,}\mathrm{d}\mathrm{B}$$, whereas AED shows the best
performance at $\sigma=$6\text{\,}\mathrm{d}\mathrm{B}$$.

Further analysis indicate that the density of the SUs also has a strong impact
on the anomaly detection performance. Reducing the grid size to
$5\text{\,}\mathrm{m}$ (i.e., $N_{\text{SU}}=81$) significantly improves the
performance as shown in Fig. 3(b) exemplarily for
$\sigma=$2\text{\,}\mathrm{d}\mathrm{B}$$. However, there is a tradeoff
between increased detection performance on the one hand and increased hardware
costs and computational complexity on the other hand, which has to be
considered for practical application.

To allow a numeric comparison between the ROC curves of different algorithms,
the area under the ROC curve (AUC) was established. It is obtained by
integrating the area under a specific ROC curve. Visualizing the AUC values at
different shadowing levels as in Fig. 4, one can see that the performance of
all three algorithms degrades with an increasing shadowing level as it can be
expected. Apart from $\sigma=$0\text{\,}\mathrm{d}\mathrm{B}$$, where LOF has
the highest AUC score, AED is the best-performing algorithm at all other
shadowing levels. This is achieved by exploiting the general knowledge that
each jammer, no matter which type, has to transmit a signal and thereby
increases the RSS. At high noise levels, the AUC scores of LOF and OCSVM
approach the value of 0.5, i.e., there is not a big performance difference
compared to a detector with no skill, whereas AED still has an AUC greater
than 0.65.

Figure 4: AUC scores for different shadowing levels at a grid size of
$10\text{\,}\mathrm{m}$

Overall, it has been demonstrated in this section that anomalies in wireless
networks – in particular jammers – can be detected employing the introduced DT
approach and unsupervised learning. Nevertheless, as can be concluded from
Fig. 4, an accurate modeling of the radio environment is required to achieve a
reliable detection. Otherwise, it is challenging for the algorithms to infer
whether high deviations between measured and expected RSS originate from model
errors or from jammers.

##  VI Future Work

This paper presents a system architecture and an initial proof of concept on
how a DT can be used for anomaly detection in wireless networks. Nevertheless,
significant steps need to be taken before the concept can be successfully
translated into practical application. Thus, we plan to address the following
steps in our future research:

####  VI-1 Detection methodology

For the initial proof of concept presented in this work, basic algorithms for
unsupervised learning have been applied. For the future work, we plan to
evaluate the performance of more sophisticated algorithms and improved
preprocessing (e.g., dimensionality reduction).

####  VI-2 Ray tracing

To achieve a high modeling accuracy for the DT, the log-distance path loss
model shall be replaced with ray tracing to achieve a more accurate model of
the path loss. At first glance, the high computational complexity of ray
tracing might limit the real-time capability of the proposed system. However,
in the literature it has already been demonstrated that ray-tracing might be
replaced by ML with a comparable accuracy but a drastically reduced
computational complexity [25].

####  VI-3 Antenna pattern

In our future work, we will integrate different antenna patterns and hence
also the orientation of the transmitter.

####  VI-4 Real-world deployment

Employing ray tracing to build the DT enables us to test the proposed concept
also in real-world environments. From this, we expect interesting insights,
e.g., about the required modeling accuracy (geometry, materials, ray tracing)
for deploying an effective anomaly detection system for the radio environment.

##  VII Conclusion

Resilience of the wireless network is key for many of its applications.
Therefore, it is essential to constantly monitor the network and identify
anomalies to enable a quick reaction to (potentially) critical situations.
This work contributes by presenting a novel approach for anomaly detection in
wireless networks by employing a DT of the radio environment, an approach that
allows to incorporate contextual information in the anomaly detection
procedure. Furthermore, no prior knowledge on jammer characteristics is
required. A system architecture is introduced and the suitability of the
approach for anomaly detection is demonstrated based on simulations. This work
serves an initial study of the concept and proposes numerous directions for
future studies, e.g., including ray tracing for the DT to be able to cope with
real-world scenarios instead of statistical models.

## Acknowledgment

This work was supported by the Federal Ministry of Education and Research,
Germany (BMBF) as part of the project 6G-CampuSens (16KISK207). The authors
alone are responsible for the content of the paper.

## References

  * [1] D. C. Nguyen _et al._ , “6G internet of things: A comprehensive survey,” _IEEE Internet of Things Journal_ , vol. 9, no. 1, pp. 359–383, 2022.
  * [2] G. P. Fettweis and H. Boche, “On 6G and trustworthiness,” _Communications of the ACM_ , vol. 65, no. 4, pp. 48–49, 2022.
  * [3] H. Xu _et al._ , “A neural network approach for wireless spectrum anomaly detection in 5G-unlicensed network,” _CCF Transactions on Pervasive Computing and Interaction_ , vol. 4, no. 4, pp. 465–473, Apr. 2022.
  * [4] Z. Wu _et al._ , “Jamming signals classification using convolutional neural network,” in _2017 IEEE International Symposium on Signal Processing and Information Technology (ISSPIT)_ , 2017, pp. 062–067.
  * [5] S. Rajendran _et al._ , “SAIFE: Unsupervised wireless spectrum anomaly detection with interpretable features,” in _2018 IEEE International Symposium on Dynamic Spectrum Access Networks (DySPAN)_ , 2018, pp. 1–9.
  * [6] X. Zhou _et al._ , “A radio anomaly detection algorithm based on modified generative adversarial network,” _IEEE Wireless Communications Letters_ , vol. 10, no. 7, pp. 1552–1556, 2021.
  * [7] N. Tandiya _et al._ , “Deep predictive coding neural network for RF anomaly detection in wireless networks,” in _2018 IEEE International Conference on Communications Workshops (ICC Workshops)_ , 2018, pp. 1–6.
  * [8] M. R. Manesh _et al._ , “Performance comparison of machine learning algorithms in detecting jamming attacks on ADS-B devices,” in _2019 IEEE International Conference on Electro Information Technology (EIT)_ , 2019, pp. 200–206.
  * [9] H. Ahmadi _et al._ , “Networked twins and twins of networks: An overview on the relationship between digital twins and 6G,” _IEEE Communications Standards Magazine_ , vol. 5, no. 4, pp. 154–160, 2021.
  * [10] H. X. Nguyen _et al._ , “Digital twin for 5G and beyond,” _IEEE Communications Magazine_ , vol. 59, no. 2, pp. 10–15, 2021.
  * [11] X. Lin _et al._ , “6G digital twin networks: From theory to practice,” _IEEE Communications Magazine_ , pp. 1–7, 2023.
  * [12] N. P. Kuruvatti _et al._ , “Empowering 6G communication systems with digital twin technology: A comprehensive survey,” _IEEE Access_ , vol. 10, pp. 112 158–112 186, 2022.
  * [13] M. Pesko _et al._ , “Radio environment maps: The survey of construction methods,” _KSII Transactions on Internet and Information Systems (TIIS)_ , vol. 8, no. 11, pp. 3789–3809, 2014.
  * [14] “Verwaltungsvorschrift für Frequenzzuteilungen für lokale Frequenznutzungen im Frequenzbereich 3.700-3.800 MHz (VV Lokales Breitband),” 2019.
  * [15] T. S. Rappaport, _Wireless communications principles and practice_ , 2nd ed. Upper Saddle River, N.J. , Boston, Mass.: Prentice Hall PTR, 2002.
  * [16] N. Jalden _et al._ , “Correlation properties of large scale fading based on indoor measurements,” in _2007 IEEE Wireless Communications and Networking Conference_ , 2007, pp. 1894–1899.
  * [17] A. Behravan _et al._ , “Positioning and sensing in 6G: Gaps, challenges, and opportunities,” _IEEE Vehicular Technology Magazine_ , vol. 18, no. 1, pp. 40–48, 2023.
  * [18] A. Toshniwal _et al._ , “Overview of anomaly detection techniques in machine learning,” in _2020 Fourth International Conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud) (I-SMAC)_ , 2020, pp. 808–815.
  * [19] F. Pedregosa _et al._ , “Scikit-learn: Machine learning in Python,” _Journal of Machine Learning Research_ , vol. 12, pp. 2825–2830, 2011.
  * [20] S. Atapattu _et al._ , _Energy detection for spectrum sensing in cognitive radio_. Springer, 2014.
  * [21] S. C. Schwartz and Y. S. Yeh, “On the distribution function and moments of power sums with log-normal components,” _The Bell System Technical Journal_ , vol. 61, no. 7, pp. 1441–1462, 1982.
  * [22] Z. Noumir _et al._ , “On simple one-class classification methods,” in _2012 IEEE International Symposium on Information Theory Proceedings_ , 2012, pp. 2022–2026.
  * [23] M. M. Breunig _et al._ , “LOF: identifying density-based local outliers,” in _Proceedings of the 2000 ACM SIGMOD international conference on Management of data_ , 2000, pp. 93–104.
  * [24] T. Fawcett, “An introduction to ROC analysis,” _Pattern Recognition Letters_ , vol. 27, no. 8, pp. 861–874, 2006, ROC Analysis in Pattern Recognition.
  * [25] S. Bakirtzis _et al._ , “DeepRay: Deep learning meets ray-tracing,” in _2022 16th European Conference on Antennas and Propagation (EuCAP)_ , 2022, pp. 1–5.

  *[6G]: sixth generation
  *[JCAS]: joint communications and sensing
  *[DT]: digital twin
  *[DTs]: digital twin
  *[5G]: fifth generation
  *[ML]: machine learning
  *[PT]: physical twin
  *[SUs]: sensing unit
  *[SU]: sensing unit
  *[RSS]: received signal strength
  *[CU]: central unit
  *[NPN]: non-public network
  *[TRP]: total radiated power
  *[LOF]: local outlier factor
  *[AED]: adapted energy detector
  *[OCSVM]: one-class support vector machine
  *[ROC]: receiver operating characteristics
  *[TPR]: true positive rate
  *[FPR]: false positive rate
  *[AUC]: area under the ROC curve