System Architecture
Multi-tier detection architecture designed for scalability from personal protection to command center operations.
Multi-Tier Architecture Overview
Overlapping Frequency Challenge
graph TD
A[2.4 GHz ISM Band] --> B[DJI OcuSync]
A --> C[ELRS 2.4 GHz]
A --> D[TBS Tracer]
A --> E[WiFi Drones]
A --> F[Consumer FPV]
A --> G[Wideband Jammer]
H[900 MHz Band] --> I[Lancet Control]
H --> J[Orlan-10 Control]
H --> K[Supercam Control]
H --> L[ELRS 868/915]
H --> M[Crossfire 868/915]
H --> N[Shahed RFD900x]
style A fill:#f96,stroke:#333,stroke-width:2px
style H fill:#f96,stroke:#333,stroke-width:2px
Multiple drone types operate in the same frequency bands. Varta solves this with multi-factor heuristics combining frequency, bandwidth, modulation, hop patterns, cyclostationary features, and multi-band correlation.
Multi-Tier Detection Architecture
graph TB
subgraph MiniV1["Varta Mini v1 (TinySA)"]
M1[TinySA Spectrum Scan]
M2[Frequency + Power Only]
M3[Jammer Heuristic]
M4[Generic Band Classification]
M5[10 Generic Bands]
M1 --> M2 --> M3 --> M4 --> M5
end
subgraph MiniV2["Varta Mini v2 (HAMGEEK AD9361 + Pi 5)"]
V1[HAMGEEK Dual-RX I/Q Capture]
V2[35-Field Feature Extraction]
V3[NoiseGate + RFGate + BenignReject]
V4[CNN ONNX on CPU]
V5[Hybrid ML Decision]
V6[43+ Specific Signatures]
V1 --> V2 --> V3 --> V4 --> V5 --> V6
end
subgraph Pro["Varta Pro (Fish Ball / PlutoSDR + Jetson)"]
P1[Fish Ball/PlutoSDR I/Q Capture]
P2[35-Field Feature Extraction]
P3[NoiseGate + RFGate + BenignReject]
P4[Cyclostationary + FHSS + Modulation]
P5[CNN TensorRT on GPU]
P6[Hybrid ML Decision]
P7[43+ Specific Signatures]
P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7
end
subgraph Max["Varta Max - Command Center"]
X1[Multiple Sensor Inputs]
X2[Health-Gated Fusion]
X3[Calibration Normalization]
X4[Multi-Band Correlation]
X5[TDOA/DF/RSSI/Radar Triangulation]
X6[DroneID + MGRS Enrichment]
X7[Fused Detection + Position]
X1 --> X2 --> X3 --> X4 --> X5 --> X6 --> X7
end
MiniV1 -.MQTT.-> Max
MiniV2 -.MQTT.-> Max
Pro -.MQTT.-> Max
style MiniV1 fill:#1a3a5c,stroke:#4a9eff,stroke-width:2px
style MiniV2 fill:#21537a,stroke:#5fb3ff,stroke-width:2px
style Pro fill:#1a4a2c,stroke:#4aff4a,stroke-width:2px
style Max fill:#4a3a1a,stroke:#ffaa4a,stroke-width:2px
Product Tiers
- Hardware: Pi Zero 2W + TinySA Ultra+
- Spectrum: 100 kHz - 6 GHz
- Classification: Frequency + Power → Generic bands
- Detection Method: Frequency matching, power threshold, 5-path jammer detection
- Drone Types: 10 generic bands + jammer classification
- Deployment: Personal, rapid field, 8hr battery
- Price Point: ~$215 BOM
- Hardware: Pi 5 2GB + HAMGEEK AD9361 (dual RX)
- Spectrum: 70 MHz - 6 GHz
- Classification: Full I/Q → Specific drone ID
- Detection Method: Same ML pipeline as Pro (ONNX CPU)
- Drone Types: 43+ specific signatures + CNN hybrid ML
- Deployment: Standalone or networked sensor node
- Price Point: ~$243 BOM
- Hardware: Jetson Orin + Fish Ball SDR / PlutoSDR
- Spectrum: 70 MHz - 6 GHz
- Classification: Full I/Q → Specific drone ID
- Detection Method: Modulation, FHSS, cyclostationary, CNN+TensorRT
- Drone Types: 43+ specific signatures (DJI Phantom, Lancet, ELRS, etc.)
- Deployment: Enterprise sensor node or standalone
- Price Point: ~$800-1,200 BOM
- Hardware: Server + networked SDR receivers + local PlutoSDR
- Spectrum: 70 MHz - 6 GHz + Multi-sensor
- Classification: I/Q + Multi-sensor fusion + DF + TDOA + radar
- Detection Method: Pro methods + correlation + triangulation + DroneID enrichment
- Drone Types: Pro signatures + fused confidence + position + MGRS zones
- Deployment: Command center with tactical display
- Price Point: ~$2,500+ server tier
Mini Tier Decision Flow
Mini v1 Input: Frequency sweep (freq[], power_dbm[])
Mini v1 Output: Generic band classification
Mini v1 Decision Flow Diagram
flowchart TD
Start([TinySA Sweep]) --> Baseline[Compare to Baseline]
Baseline --> Anomaly{Anomaly Detected?}
Anomaly -->|No| Clear[CLEAR]
Anomaly -->|Yes| JammerCheck[Jammer Heuristic]
JammerCheck --> WidebandCheck{>30% bins elevated?}
WidebandCheck -->|Yes| WidebandFlat{Peak-avg < 6 dB?}
WidebandFlat -->|Yes| Wideband[WIDEBAND_JAMMING]
WidebandFlat -->|No| ContinueWB[Continue to band match]
WidebandCheck -->|No| SpotCheck{>30 dB peak in narrow region?}
SpotCheck -->|Yes| Spot[SPOT_JAMMING]
SpotCheck -->|No| ContinueSP[Continue to band match]
ContinueWB --> BandMatch[Match Frequency to Generic Bands]
ContinueSP --> BandMatch
BandMatch --> GPS{1.57 GHz?}
GPS -->|Yes| GPSJam[GPS_THREAT]
GPS -->|No| UHF433{410-480 MHz?}
UHF433 -->|Yes| D433[DRONE_433]
UHF433 -->|No| ISM900{860-1020 MHz?}
ISM900 -->|Yes| MilitaryCheck{Power > -50 dBm?}
MilitaryCheck -->|Yes| MilUHF[MILITARY_UHF]
MilitaryCheck -->|No| D900[DRONE_900]
ISM900 -->|No| ISM24{2.4-2.5 GHz?}
ISM24 -->|Yes| D24[DRONE_2G4]
ISM24 -->|No| Cband{4.4-5.85 GHz?}
Cband -->|Yes| NATO[NATO_CBAND]
Cband -->|No| ISM58{5.7-5.9 GHz?}
ISM58 -->|Yes| D58[DRONE_5G8]
ISM58 -->|No| Unknown[UNKNOWN]
style Wideband fill:#f66,stroke:#333,stroke-width:2px
style Spot fill:#f66,stroke:#333,stroke-width:2px
style GPSJam fill:#f66,stroke:#333,stroke-width:2px
style MilUHF fill:#f96,stroke:#333,stroke-width:2px
style Clear fill:#9f9,stroke:#333,stroke-width:2px
Mini v2 Input: I/Q samples from HAMGEEK dual-RX SDR (4 MSPS default)
Mini v2 Output: Specific drone signature + confidence (same classification depth as Pro)
Mini v2 Full I/Q Flow
flowchart TD
Start([HAMGEEK I/Q Capture]) --> Sweep[Stage 1 Spectrum Sweep]
Sweep --> Candidates{Candidate frequencies found?}
Candidates -->|No| Clear[CLEAR]
Candidates -->|Yes| IQCapture[Stage 2 I/Q Capture]
IQCapture --> Features[IQAnalyzer 35 Features]
Features --> SNRGate{SNR >= 10 dB?}
SNRGate -->|No| LowSNR[Cap confidence 0.35]
SNRGate -->|Yes| NoiseGate[NoiseGateClassifier]
NoiseGate --> NoiseCheck{Noise?}
NoiseCheck -->|Yes| Reject[Reject as Noise]
NoiseCheck -->|No| RFGate[RFGateClassifier]
RFGate --> RFClass{RF Class?}
RFClass -->|wifi/bt/lora/bg| SafetyCheck{FHSS_OFDM or wideband?}
SafetyCheck -->|Yes| Override[Override Never Suppress]
SafetyCheck -->|No| Benign[Suppress as Benign]
RFClass -->|drone| BenignReject[BenignRejector]
Override --> BenignReject
BenignReject --> Spectrogram[iq_to_spectrogram 256x256]
Spectrogram --> CNN[ONNX ResNet-18 on CPU]
CNN --> Hybrid[HybridDecisionEngine]
Hybrid --> Result[Specific Drone Type + Confidence]
LowSNR --> Result
style Reject fill:#666,stroke:#333,stroke-width:2px,color:#fff
style Benign fill:#666,stroke:#333,stroke-width:2px,color:#fff
style Result fill:#9f9,stroke:#333,stroke-width:2px
style Clear fill:#9f9,stroke:#333,stroke-width:2px
Pro Tier Decision Flow
Input: I/Q samples
Output: Specific drone signature + confidence
Pro Tier Decision Flow Diagram
flowchart TD
Start([PlutoSDR I/Q]) --> FFT[FFT - Power Spectrum]
FFT --> Features[Extract 35 Features]
Features --> Basic[Basic: freq, BW, power, SNR]
Features --> Spectral[Spectral: flatness, entropy, PAPR]
Features --> STFT[STFT - Hopping Analysis]
Features --> Cyclo[Cyclostationary Analysis]
Cyclo --> CycloGate{noise_conf > 0.8?}
CycloGate -->|Yes| Noise[Reject as NOISE]
CycloGate -->|No| CycloOFDM{OFDM CP detected?}
CycloOFDM -->|Yes| OFDMCP[OFDM/FHSS_OFDM confidence 0.85]
CycloOFDM -->|No| Heuristic[Heuristic Tree]
STFT --> HopDensity{Hop density > 30%?}
HopDensity -->|Yes| NoiseHop[Reject hopping - Random noise]
HopDensity -->|No| HopValid[Valid FHSS]
Spectral --> PAPR{PAPR > 8 dB?}
PAPR -->|Yes| Hopping{Hopping detected?}
Hopping -->|Yes| FHSSOFDM[FHSS_OFDM]
Hopping -->|No| BWCheck{BW > 5 MHz?}
BWCheck -->|Yes| OFDM[OFDM]
BWCheck -->|No| Continue[Continue heuristic]
PAPR -->|No| Flatness{Flatness < 0.3?}
Flatness -->|Yes| FSK[FSK/DSSS]
Flatness -->|No| Continue
OFDMCP --> Scoring[Multi-Factor Scoring]
FHSSOFDM --> Scoring
OFDM --> Scoring
FSK --> Scoring
Continue --> Scoring
Heuristic --> Scoring
HopValid --> Scoring
Scoring --> Result[Best Match + Confidence]
style Noise fill:#666,stroke:#333,stroke-width:2px,color:#fff
style NoiseHop fill:#666,stroke:#333,stroke-width:2px,color:#fff
style Result fill:#9f9,stroke:#333,stroke-width:2px
Overlapping Class Disambiguation
Example: 900 MHz band has 6+ overlapping systems. How does Varta separate them?
900 MHz Disambiguation Decision Tree
flowchart TD
Start[900 MHz Signal Detected] --> IQ{I/Q Available?}
IQ -->|No - Mini Tier| Power{Power Level}
Power -->|> -50 dBm| MilUHF[MILITARY_UHF]
Power -->|< -50 dBm| D900[DRONE_900]
IQ -->|Yes - Pro Tier| Modulation[Analyze Modulation]
Modulation --> LoRa{LoRa CSS?}
LoRa -->|Yes| DualBand{Dual-band 868+902 MHz?}
DualBand -->|Yes| Lancet[LANCET confidence 0.85]
DualBand -->|No| HopRate{Hop rate?}
HopRate -->|25-500 Hz| ELRS[ELRS confidence 0.75]
HopRate -->|~50 Hz| Crossfire[CROSSFIRE confidence 0.75]
LoRa -->|No| FHSS{FHSS detected?}
FHSS -->|Yes| SlowHop{Slow hopping 1-2 Hz?}
SlowHop -->|Yes| Channels{8-16 channels?}
Channels -->|Yes| Orlan[ORLAN-10 confidence 0.70]
Channels -->|No| Supercam[SUPERCAM confidence 0.65]
SlowHop -->|No| FastHop{40-60 Hz?}
FastHop -->|Yes| LancetFHSS[LANCET confidence 0.75]
FastHop -->|No| Generic[MILITARY_UHF confidence 0.50]
FHSS -->|No| FSK{FSK/DSSS?}
FSK -->|Yes| BW{Bandwidth?}
BW -->|200-400 kHz| OrlanFSK[ORLAN-10 confidence 0.60]
BW -->|5 MHz| SupercamWide[SUPERCAM confidence 0.60]
style Lancet fill:#f66,stroke:#333,stroke-width:3px
style Orlan fill:#f96,stroke:#333,stroke-width:3px
style Supercam fill:#fc6,stroke:#333,stroke-width:3px
style ELRS fill:#9cf,stroke:#333,stroke-width:2px
style Crossfire fill:#9cf,stroke:#333,stroke-width:2px
- Modulation type: LoRa CSS (Lancet, ELRS, Crossfire) vs FSK (Orlan legacy)
- Hop rate: 40-60 Hz (Lancet) vs 1-2 Hz (Orlan) vs 25-500 Hz (ELRS)
- Dual-band presence: 868+902 MHz (Lancet only)
- Channel count: 8-16 (Orlan) vs 10 (Supercam) vs 50 (ELRS/Crossfire)
- Bandwidth: 200-400 kHz (Orlan FSK) vs 5 MHz (Supercam) vs 500 kHz (LoRa)
Multi-Band Correlation Logic
Drones often transmit on multiple bands simultaneously (control + video). Detecting correlated signals increases confidence.
Multi-Band Correlation Flow
flowchart TD
Start[Detection on Band A] --> Store[Store in Correlation Window ±2 seconds]
Store --> Check{Other bands detected in window?}
Check -->|No| SingleBand[Single-Band Detection confidence as-is]
Check -->|Yes| Pattern[Match Multi-Band Pattern]
Pattern --> DJI{2.4 GHz + 5.8 GHz?}
DJI -->|Yes| DJIConf[DJI Confirmed +0.15 confidence boost]
Pattern --> Orlan{900 MHz + 1.1 GHz or 2.4 GHz?}
Orlan -->|Yes| OrlanConf[ORLAN-10 Confirmed +0.20 confidence boost]
Pattern --> Lancet{900 MHz dual + 2.4 GHz?}
Lancet -->|Yes| LancetConf[LANCET Confirmed +0.25 confidence boost]
Pattern --> Bayraktar{4.4-5.85 GHz + Ku?}
Bayraktar -->|Yes| BayraktarConf[BAYRAKTAR Confirmed +0.20 confidence boost]
DJIConf --> FusedEvent[Fused Multi-Band Event]
OrlanConf --> FusedEvent
LancetConf --> FusedEvent
BayraktarConf --> FusedEvent
SingleBand --> Output[Output Event]
FusedEvent --> Output
style FusedEvent fill:#9f9,stroke:#333,stroke-width:3px
style LancetConf fill:#f66,stroke:#333,stroke-width:2px
style OrlanConf fill:#f96,stroke:#333,stroke-width:2px
- Time window: ±2 seconds
- Frequency pairs must match expected platform bands
- Multi-band events are NEVER suppressed by benign filters
- Confidence boost: +0.15 to +0.25 depending on pattern rarity
FHSS Detection & Hop Analysis
Input: I/Q samples | Output: Hop rate, dwell time, hop density, channel list
FHSS Analysis Pipeline
flowchart TD
Start([I/Q Samples]) --> STFT[Short-Time Fourier Transform 256-sample window 64-sample hop]
STFT --> Spectrogram[Time-Frequency Spectrogram]
Spectrogram --> PeakTrack[Track Peak Frequency Over Time]
PeakTrack --> Transitions{Count Frequency Transitions}
Transitions --> Hops{Count Total Hops}
Hops --> Density[Hop Density = num_hops / num_transitions]
Density --> DensityGate{Density > 30%?}
DensityGate -->|Yes| Noise[Reject as Noise - Random peak jumping]
DensityGate -->|No| ValidFHSS[Valid FHSS Signal]
ValidFHSS --> HopRate[Hop Rate = num_hops / duration]
ValidFHSS --> Dwell[Dwell Time = time between hops]
ValidFHSS --> HopBW[Hop Bandwidth = max_freq - min_freq]
ValidFHSS --> Channels[Hop Frequencies = list of distinct peaks]
HopRate --> CV[Coefficient of Variation of Dwell Times]
CV --> Regularity{CV < 0.3?}
Regularity -->|Yes| Structured[Structured FHSS - High confidence]
Regularity -->|No| Irregular[Irregular Hopping - Lower confidence]
Structured --> Output[Hop Analysis Result]
Irregular --> Output
style Noise fill:#666,stroke:#333,stroke-width:2px,color:#fff
style Structured fill:#9f9,stroke:#333,stroke-width:2px
style Irregular fill:#fc6,stroke:#333,stroke-width:2px
- Hop density > 30%: Reject as noise (random peak movement, not structured hopping)
- CV < 0.3: Structured FHSS (military/FPV systems have regular dwells)
- Real FHSS density: <15% (clean, structured hops)
- Noise density: >40% (chaotic, random transitions)
- Lancet: 40-60 Hz, 50 channels, CV ~0.15 (highly regular)
- Orlan-10: 1-2 Hz, 8-16 channels, CV ~0.20 (predictable)
- ELRS: 25-500 Hz configurable, 50 channels, CV <0.25
- Crossfire: ~50 Hz, 50 channels, CV <0.25
Cyclostationary Analysis Pipeline
Physics-based signal analysis that detects periodic statistical patterns in modulated signals
Cyclostationary Analysis Flow
flowchart TD
Start([I/Q Samples]) --> LengthCheck{Length >= 8192?}
LengthCheck -->|No| Skip[Skip Cyclo - Use Heuristics]
LengthCheck -->|Yes| AlphaProfile[Compute Alpha Profile FFT of x squared]
AlphaProfile --> AlphaPeaks[Detect Alpha Peaks 20-10000 Hz]
AlphaPeaks --> FHSSDetect{Strong alpha peaks in hop range?}
FHSSDetect -->|Yes| HopRateExt[Extract FHSS Hop Rate from peak location]
FHSSDetect -->|No| NoHop[No FHSS detected]
Start --> Envelope[Compute Envelope]
Envelope --> EnvVar[Envelope Variance]
EnvVar --> ConstEnv{Variance < 0.1?}
ConstEnv -->|Yes| ConstSig[Constant-Envelope Signal - Definitively NOT noise]
ConstEnv -->|No| VarEnv[Variable Envelope]
VarEnv --> AlphaStr[Alpha Peak Strength]
AlphaStr --> NoiseConf{Alpha strength > 0.5?}
NoiseConf -->|No| HighNoiseConf[noise_confidence > 0.8 REJECT as noise]
NoiseConf -->|Yes| LowNoiseConf[noise_confidence < 0.8 Likely signal]
Start --> Autocorr[Autocorrelation]
Autocorr --> CPSearch[Search for CP Peak lag = 1024-4096]
CPSearch --> CPDetect{CP peak > 0.7?}
CPDetect -->|Yes| SymRate[Symbol Rate from CP peak location]
CPDetect -->|No| NoCP[No OFDM CP]
SymRate --> CPRatio[CP Ratio = CP_length / symbol_length]
CPRatio --> OFDMConf[OFDM Confirmed confidence 0.85]
OFDMConf --> Features[Cyclostationary Feature Output]
HopRateExt --> Features
HighNoiseConf --> Features
LowNoiseConf --> Features
ConstSig --> Features
NoCP --> Features
NoHop --> Features
Skip --> NullFeatures[All cyclo fields: None]
style HighNoiseConf fill:#666,stroke:#333,stroke-width:2px,color:#fff
style OFDMConf fill:#9f9,stroke:#333,stroke-width:2px
style ConstSig fill:#9cf,stroke:#333,stroke-width:2px
- noise_confidence > 0.8 → Reject as NOISE (definitive)
- OFDM CP detected → OFDM or FHSS_OFDM (confidence 0.85)
- Constant envelope → NOT noise (high confidence)
- DJI Inspire: 79% OFDM detection rate, symbol rate 1.4-1.7 MHz
- DJI Air: 42% OFDM detection rate
- DJI Mini: 0% OFDM detection (WiFi has no CP structure)
- Noise class: noise_confidence mean 0.208 (too low for >0.8 rejection gate)
DJI Model Sub-Classification
All DJI drones use 2.4 GHz OcuSync or WiFi. Sub-classification uses bandwidth signatures.
DJI Model Identification Flow
flowchart TD
Start[DJI Detected on 2.4 GHz] --> IQ{I/Q Available?}
IQ -->|No| Generic[DJI Generic]
IQ -->|Yes| Mod[Modulation Type]
Mod --> FHSSOFDM{FHSS_OFDM?}
FHSSOFDM -->|Yes| SymRate{Symbol Rate 1.4-1.7 MHz?}
SymRate -->|Yes| OcuSync[OcuSync Platform]
SymRate -->|No| OtherMod[Other OFDM]
FHSSOFDM -->|No| WiFiCheck{Plain OFDM No hopping?}
WiFiCheck -->|Yes| Mini[DJI Mini WiFi-based]
OcuSync --> BW[Measure 6 dB Bandwidth]
BW --> BWRange{Bandwidth Range?}
BWRange -->|0.5-1.0 MHz| Air[DJI Air 2S Narrowband]
BWRange -->|2.0-3.5 MHz| Inspire[DJI Inspire Mid-bandwidth]
BWRange -->|3.5-5.0 MHz| MiniCheck[Check Mini vs others]
BWRange -->|8.0-11.0 MHz| Phantom[DJI Phantom Classic OcuSync]
BWRange -->|15.0-18.0 MHz| Mavic[DJI Mavic Highest BW]
MiniCheck --> CPDet{CP Detected?}
CPDet -->|No| MiniWiFi[DJI Mini 4.0 MHz WiFi]
CPDet -->|Yes| OtherModel[Other DJI ~4 MHz]
Air --> Confidence[+0.10 BW match bonus]
Inspire --> Confidence
Phantom --> Confidence
Mavic --> Confidence
MiniWiFi --> Confidence
Mini --> Confidence
style Air fill:#9cf,stroke:#333,stroke-width:2px
style Inspire fill:#9cf,stroke:#333,stroke-width:2px
style Phantom fill:#9cf,stroke:#333,stroke-width:2px
style Mavic fill:#9cf,stroke:#333,stroke-width:2px
style MiniWiFi fill:#fc9,stroke:#333,stroke-width:2px
- Air 2S: 0.72 MHz (narrowband, long-range optimized)
- Inspire 2: 2.9 MHz (professional cinematography)
- Mini: 4.0 MHz (WiFi-based, no CP detection)
- Phantom 4: 9.3 MHz (classic OcuSync)
- Mavic Pro: 16.6 MHz (adaptive OFDM, highest BW)
- CP detection: Present on OcuSync (Air, Inspire, Phantom, Mavic), absent on Mini (WiFi)
- Symbol rate: 1.4-1.7 MHz fingerprint confirms OcuSync identity
- Flight mode: Powered_on → FHSS_OFDM (87%), Flying → OFDM (flight mode changes modulation)
Military 900 MHz Separation
Challenge: 6+ overlapping systems in 850-1020 MHz
Lancet, Orlan-10, Supercam, ELRS, Crossfire, and Shahed RFD900x all operate in this band.
flowchart TD
Start[900 MHz Signal] --> DualBand{Dual-band detected? 868-870 + 902-928 MHz}
DualBand -->|Yes| Lancet[LANCET Dual-band LoRa confidence 0.85]
DualBand -->|No| Mod[Modulation Analysis]
Mod --> LoRa{LoRa CSS?}
LoRa -->|Yes| HopRate{Hop Rate?}
HopRate -->|40-60 Hz| LancetSingle[LANCET Single-band confidence 0.75]
HopRate -->|25-500 Hz| Binding{Binding phrase hop pattern?}
Binding -->|Yes| ELRS[ELRS Consumer/FPV confidence 0.75]
Binding -->|No| Crossfire[CROSSFIRE ~50 Hz confidence 0.75]
LoRa -->|No| FHSS{FHSS Pattern?}
FHSS -->|Yes| HopSpeed{Hop Speed?}
HopSpeed -->|1-2 Hz| Channels{Channel Count?}
Channels -->|8-16| Orlan[ORLAN-10 Slow FHSS confidence 0.70]
Channels -->|~10| Stripe{10-stripe pattern?}
Stripe -->|Yes| Supercam[SUPERCAM Distinctive waterfall confidence 0.70]
HopSpeed -->|~20 Hz| RFD900x[RFD900x Shahed mesh confidence 0.60]
FHSS -->|No| FSK{FSK/DSSS?}
FSK -->|Yes| BWNarrow{Bandwidth 200-400 kHz?}
BWNarrow -->|Yes| OrlanLegacy[ORLAN-10 Legacy FSK confidence 0.60]
BWNarrow -->|No| BWWide{Bandwidth ~5 MHz?}
BWWide -->|Yes| SupercamWide[SUPERCAM Wide FHSS confidence 0.60]
FSK -->|No| Power{Power Level?}
Power -->|> -50 dBm| MilGeneric[MILITARY_UHF confidence 0.50]
Power -->|< -50 dBm| D900[DRONE_900 confidence 0.40]
style Lancet fill:#f33,stroke:#333,stroke-width:3px,color:#fff
style LancetSingle fill:#f66,stroke:#333,stroke-width:2px
style Orlan fill:#f96,stroke:#333,stroke-width:2px
style Supercam fill:#fc6,stroke:#333,stroke-width:2px
style ELRS fill:#9cf,stroke:#333,stroke-width:2px
style Crossfire fill:#9cf,stroke:#333,stroke-width:2px
Jammer vs Drone Discrimination
Problem: Wideband jammers overlap with drone frequency ranges
flowchart TD
Start[2.4 GHz Elevated Power] --> Occupancy{Wideband Occupancy >30% bins elevated?}
Occupancy -->|Yes| FlatnessCheck{Power Flatness Peak-avg < 6 dB?}
FlatnessCheck -->|Yes| WidebandJam[WIDEBAND JAMMING]
FlatnessCheck -->|No| BW{Bandwidth?}
BW -->|> 30 MHz| PossibleJam[Possible wideband - Check multi-band]
BW -->|< 30 MHz| Drone[Likely drone signal]
Occupancy -->|No| Narrow{Narrow peak >30 dB above avg?}
Narrow -->|Yes| SpotJam[SPOT JAMMING]
Narrow -->|No| Signal[Analyze as signal]
Signal --> ModCheck{Modulation detected?}
ModCheck -->|Yes| DJI[Drone - Confident]
ModCheck -->|No| Temporal{Temporal stability?}
Temporal -->|Stable| Drone2[Likely drone]
Temporal -->|Swept/bursts| Jammer2[Likely jammer]
PossibleJam --> MultiBand{Other bands active?}
MultiBand -->|Yes 5.8 GHz| DJIVideo[DJI with video - NOT jammer]
MultiBand -->|No| WidebandJam2[WIDEBAND JAMMING confirmed]
style WidebandJam fill:#f33,stroke:#333,stroke-width:3px,color:#fff
style SpotJam fill:#f33,stroke:#333,stroke-width:3px,color:#fff
style WidebandJam2 fill:#f33,stroke:#333,stroke-width:3px,color:#fff
style DJI fill:#9cf,stroke:#333,stroke-width:2px
style DJIVideo fill:#9f9,stroke:#333,stroke-width:2px
Confidence Scoring Algorithm
Multi-Factor Scoring: frequency, bandwidth, modulation, hop rate, cyclostationary, multi-band correlation
flowchart TD
Start([Signal Features]) --> FreqScore[Frequency Match 0.35 weight]
Start --> BWScore[Bandwidth Match 0.20 weight]
Start --> ModScore[Modulation Match 0.25 weight]
Start --> HopScore[Hop Rate Match 0.15 weight]
Start --> SymScore[Symbol Rate Match 0.05 weight]
Start --> CycloScore[Cyclostationary Bonus +0.10-0.15]
Start --> MultiBandScore[Multi-Band Bonus +0.15-0.25]
FreqScore --> Weights[Apply Weights]
BWScore --> Weights
ModScore --> Weights
HopScore --> Weights
SymScore --> Weights
Weights --> BaseConf[Base Confidence = weighted_sum / total_weight]
BaseConf --> Bonuses[Add Bonuses]
CycloScore --> Bonuses
MultiBandScore --> Bonuses
Bonuses --> BeaconCheck{Beacon/Idle? BW < 50 kHz + SNR > 30 dB}
BeaconCheck -->|Yes| BeaconCredit[+0.02 Beacon Credit Skip BW penalty]
BeaconCheck -->|No| NoPenalty[No adjustment]
BeaconCredit --> SNRGate{SNR < 10 dB?}
NoPenalty --> SNRGate
SNRGate -->|Yes| Cap35[Cap confidence at 0.35]
SNRGate -->|No| NoSNRCap[No SNR cap]
Cap35 --> MeasValid{Measurement valid?}
NoSNRCap --> MeasValid
MeasValid -->|No| Zero[Confidence = 0.0]
MeasValid -->|Yes| Final[Final Confidence]
Final --> Clamp[Clamp to 0.0-1.0]
Clamp --> Output([Confidence Score])
style Zero fill:#f33,stroke:#333,stroke-width:2px,color:#fff
style Output fill:#9f9,stroke:#333,stroke-width:2px
Max Tier Fusion Engine
Purpose: Combine detections from multiple sensors to improve confidence and estimate position
- Health-gated: Ignore FAULT/DISCONNECTED sensors, reduce weight for DEGRADED (0.7x)
- Calibration-normalized: Apply per-sensor gain offsets before RSSI comparison
- Correlation window: ±2 seconds for time-matched detections
- Frequency tolerance: ±5% for frequency matching across sensors
- Type matching: Same threat type → higher confidence, different types → generic type
- Uncalibrated penalty: 50% confidence reduction for uncalibrated sensors
- Health grade: Degraded contributors → cap threat level, mark event as degraded
- TDOA gating: Only use TDOA when all sensors report time_sync: in_spec (<1 ms drift)
- DF eligibility: 2+ sensors with DF bearings = df_eligible, enables DF bearing intersection
- Position method priority: TDOA → DF bearing intersection → DF+RSSI hybrid → Hybrid TDOA+RSSI → RSSI fallback
Max Tier Fusion Engine Diagram
flowchart TD
Start([Multiple Sensor Inputs]) --> HealthCheck[Check Sensor Health Status]
HealthCheck --> Fault{Any FAULT or DISCONNECTED?}
Fault -->|Yes| Ignore[Ignore faulted sensors]
Fault -->|No| AllOK[All sensors OK]
Ignore --> Remaining{Any remaining sensors?}
Remaining -->|No| Abort[No fusion possible]
Remaining -->|Yes| Continue[Continue with healthy]
AllOK --> Continue
Continue --> Calib[Apply Calibration Normalization]
Calib --> CorrWindow[Correlation Window +/- 2 seconds]
CorrWindow --> FreqMatch{Frequency match across sensors?}
FreqMatch -->|No| IndividualEvents[Independent events]
FreqMatch -->|Yes| Correlate[Correlated Detection]
Correlate --> TypeMatch{Same type across sensors?}
TypeMatch -->|No| Generic[Generic type - Lower confidence]
TypeMatch -->|Yes| Specific[Specific type - Higher confidence]
Specific --> Weights[Compute Weighted Confidence]
Generic --> Weights
Weights --> PositionMethod[Select Position Method - 5-method priority]
PositionMethod --> TDOACheck{3+ sensors all IN_SPEC?}
TDOACheck -->|Yes| TDOAMethod[1. TDOA 10-50m]
TDOACheck -->|No| DFCheck{2+ DF stations?}
DFCheck -->|Yes| DFMethod[2. DF Bearing Intersection 50-200m]
DFCheck -->|No| DFRSSICheck{1 DF + RSSI?}
DFRSSICheck -->|Yes| DFRSSIMethod[3. DF+RSSI Hybrid 100-500m]
DFRSSICheck -->|No| HybridCheck{2 sensors + timestamps?}
HybridCheck -->|Yes| HybridMethod[4. Hybrid TDOA+RSSI 50-300m]
HybridCheck -->|No| RSSI[5. RSSI Fallback 100-500m]
TDOAMethod --> Output([FusedDetection])
DFMethod --> Output
DFRSSIMethod --> Output
HybridMethod --> Output
RSSI --> Output
style Abort fill:#f33,stroke:#333,stroke-width:2px,color:#fff
style Output fill:#9f9,stroke:#333,stroke-width:3px
Time Sync & TDOA Eligibility
Purpose: Ensure clock synchronization before using Time Difference of Arrival (TDOA) for position estimation
Time Sync & TDOA Eligibility Diagram
flowchart TD
Start([Sensor Network]) --> SyncSource{Time Sync Source}
SyncSource -->|GPS| GPSSync[GPS PPS - Nanosecond accuracy]
SyncSource -->|NTP| NTPSync[NTP Server - Millisecond accuracy]
SyncSource -->|PTP| PTPSync[PTP Protocol - Microsecond accuracy]
SyncSource -->|DF_CLOCK| DFSync[Common Reference Osc - DF stations]
SyncSource -->|None| NoSync[System Clock - Unsynchronized]
GPSSync --> Quality[Measure Sync Quality]
NTPSync --> Quality
PTPSync --> Quality
DFSync --> Quality
NoSync --> Unknown[time_sync: UNKNOWN]
Quality --> Drift{Clock Drift?}
Drift -->|< 100 us| InSpec[IN_SPEC - TDOA eligible]
Drift -->|100 us - 1 ms| OutSpec[OUT_OF_SPEC - TDOA NOT eligible]
Drift -->|> 1 ms| Degraded[DEGRADED - TDOA NOT eligible]
InSpec --> Fusion[DataFusion Engine]
OutSpec --> Fusion
Degraded --> Fusion
Unknown --> Fusion
Fusion --> Check{All contributors IN_SPEC?}
Check -->|Yes| EnableTDOA[TDOA Triangulation 10-50m]
Check -->|No| CheckDF{2+ sensors with DF bearings?}
CheckDF -->|Yes| EnableDF[DF Bearing Intersection 50-200m]
CheckDF -->|No| DisableTDOA[RSSI Fallback 100-500m]
style InSpec fill:#9f9,stroke:#333,stroke-width:2px
style EnableTDOA fill:#9f9,stroke:#333,stroke-width:2px
style EnableDF fill:#9f9,stroke:#333,stroke-width:2px
style DisableTDOA fill:#fc6,stroke:#333,stroke-width:2px
style Unknown fill:#999,stroke:#333,stroke-width:2px,color:#fff
Safety-Critical Gates
Purpose: Prevent false certainty, invalid data propagation, and unsafe outputs
Safety-Critical Gates Pipeline
flowchart TD
Start([Detection Pipeline]) --> SNRCheck{SNR >= 10 dB?}
SNRCheck -->|No| LowSNR[Cap confidence at 0.35]
SNRCheck -->|Yes| Proceed[Proceed to classification]
LowSNR --> MeasValid{Measurement valid?}
Proceed --> MeasValid
MeasValid -->|No| Reject[Confidence = 0.0 DO NOT CLASSIFY]
MeasValid -->|Yes| Classify[Classification Engine]
Classify --> BenignCheck{Benign filter match?}
BenignCheck -->|Yes| Suppress{Multi-band or wideband FHSS?}
Suppress -->|Yes| Override[Override benign - Multi-band NEVER suppressed]
Suppress -->|No| Benign[Suppress as benign - Log at INFO]
BenignCheck -->|No| Baseline[Compare to baseline]
Override --> Baseline
Baseline --> Anomaly{Anomaly detected?}
Anomaly -->|Yes| FreezeBase[Freeze baseline 30s cooldown]
FreezeBase --> CheckStale{Frozen > 120s?}
CheckStale -->|Yes| Stale[Mark baseline stale - Sensor DEGRADED]
CheckStale -->|No| Valid[Continue detection]
Anomaly -->|No| Valid
Valid --> CalibCheck{Calibrated?}
CalibCheck -->|No| Uncalib[50% confidence penalty]
CalibCheck -->|Yes| Calib[Full confidence]
Uncalib --> ConfigCheck{Config signed?}
Calib --> ConfigCheck
ConfigCheck -->|No| ConfigWarn{REQUIRE_SIGNED?}
ConfigWarn -->|Yes| ConfigFail[SENSOR_FAILURE Config integrity error]
ConfigWarn -->|No| ConfigCont[Continue with warning]
ConfigCheck -->|Yes| Provenance[Attach provenance]
ConfigCont --> Provenance
Provenance --> HardwareFault{Hardware fault?}
HardwareFault -->|Yes| Failure[SENSOR_FAILURE NEVER return CLEAR]
HardwareFault -->|No| ThreatEvent[ThreatEvent]
style Reject fill:#f33,stroke:#333,stroke-width:2px,color:#fff
style Failure fill:#f33,stroke:#333,stroke-width:2px,color:#fff
style ConfigFail fill:#f33,stroke:#333,stroke-width:2px,color:#fff
style ThreatEvent fill:#9f9,stroke:#333,stroke-width:2px
Acoustic ML Classification Pipeline
3-Tier Acoustic Detection Flow
All tiers share the same 3-stage acoustic classification path: MFCC fingerprint matching, class-generic threshold gates, then ResNet-18 inference. Trained on a 13,997-segment corpus with balanced retraining achieving 88.9% overall accuracy (Shahed 92.3%, quadcopter 90.9%).
Acoustic ML Pipeline
flowchart TD
Mic([USB MEMS Microphone]) --> Preprocess[Audio Preprocessing
16 kHz, mono, 2s frames]
Preprocess --> MFCC[MFCC Feature Extraction
40 coefficients + delta + delta-delta]
MFCC --> Stage1{Stage 1: Fingerprint Match
Known acoustic signatures?}
Stage1 -->|Yes| FPMatch[Fingerprint Match
High confidence shortcut]
Stage1 -->|No| Stage2
FPMatch --> Output
Stage2{Stage 2: Threshold Gates
Class-generic energy thresholds}
Stage2 -->|Below threshold| Background[Background Noise
No detection]
Stage2 -->|Above threshold| Stage3
Stage3[Stage 3: ResNet-18 Inference
88.9% overall accuracy]
Stage3 --> Classes{Classification}
Classes --> Shahed[Shahed/Fixed-wing
92.3% recall]
Classes --> Quad[Quadcopter
90.9% recall]
Classes --> Heli[Helicopter
Retraining target]
Classes --> Other[Other classes]
Shahed --> Output([Acoustic Detection Event])
Quad --> Output
Heli --> Output
Other --> Output
Output --> Fusion[RF-Acoustic Bayesian Fusion
Supplementary only]
style Background fill:#666,stroke:#333,stroke-width:2px,color:#fff
style Output fill:#9f9,stroke:#333,stroke-width:2px
style FPMatch fill:#9cf,stroke:#333,stroke-width:2px
RemoteID Correlation & Anti-Spoof
Multi-Source RemoteID Correlation Flow
Correlates BLE RemoteID, WiFi RemoteID Bridge, and DJI DroneID telemetry with RF detections. Drones detected on RF with no matching RemoteID are flagged as "dark drones" and automatically escalated.
RemoteID Correlation Flow
flowchart TD
BLE([BLE RemoteID
~100m range]) --> Correlator
WiFi([WiFi RemoteID Bridge
Extended range]) --> Correlator
DJI([DJI DroneID / OcuSync
I/Q decode]) --> Correlator
Correlator[RemoteID Correlator
Match RF detections ±10s window]
Correlator --> Match{RemoteID match
found?}
Match -->|Yes| AntiSpoof{Anti-Spoof
Validation}
Match -->|No| DarkDrone[Dark Drone Alert
Threat level escalated]
AntiSpoof --> RFCheck[RF Band
Consistency Check]
AntiSpoof --> Motion[Motion
Plausibility Analysis]
AntiSpoof --> Operator[Operator Distance
Verification]
RFCheck --> Score{Spoof Score}
Motion --> Score
Operator --> Score
Score -->|Score >= 0.4| Compliant[Compliant Drone
Blue marker on map]
Score -->|Score < 0.4| Spoofed[Suspected Spoof
Escalated + flagged]
DarkDrone --> Tactical([Tactical Display
Red marker + alert])
Compliant --> Tactical
Spoofed --> Tactical
style DarkDrone fill:#f66,stroke:#333,stroke-width:2px
style Spoofed fill:#f96,stroke:#333,stroke-width:2px
style Compliant fill:#9f9,stroke:#333,stroke-width:2px
style Tactical fill:#9cf,stroke:#333,stroke-width:2px
Security Architecture
Transport Layer
- TLS 1.3: All MQTT, WebSocket, REST connections
- mTLS: Sensor-to-Max mutual certificate authentication
- CURVE: ZeroMQ command channel encryption
Data at Rest
- SQLCipher: AES-256-CBC encryption for edge databases (Mini/Pro)
- TimescaleDB: PostgreSQL encryption extensions (Max)
Configuration Security
- Signed configs: HMAC-SHA256 or Ed25519 signatures on drone_bands.yaml, threat_patterns.json
- Last-known-good rollback: LKG store on integrity failure
- Key rotation: Revocation lists, graceful key expiry
Access Control
- MQTT ACLs: Topic-level permissions per sensor ID
- API authentication: Bearer tokens, rate limiting
- Sensor registration: Certificate-based enrollment