Sub-Nyquist-Sampling-Based Device Fingerprint Extraction for Gigabit Ethernet

Abstract

The proliferation of wired Gigabit Ethernet has greatly increased communication bandwidth, while introducing new challenges for device identification and security. Conventional physical-layer fingerprinting techniques are constrained by the Nyquist sampling theorem, limiting their suitability for large-scale deployment. To overcome this limitation, we propose a lightweight fingerprint extraction scheme based on sub-Nyquist sampling. The scheme introduces two types of fingerprints: the signal rearrangement distribution fingerprint ($f_{sort}$) and the amplitude–frequency distribution fingerprint ($f_{hist}$). The $f_{sort}$ adopts a low-complexity unsupervised classification framework based on amplitude rearrangement, principal component analysis (PCA), and a support vector machine (SVM), making it suitable for resource-constrained scenarios. The $f_{hist}$ establishes a high-accuracy supervised classification framework using amplitude–frequency statistical representations, linear discriminant analysis (LDA), and a deep learning classifier. Multi-instance and cross-type scenarios are used to evaluate classification accuracy and generalization capability. Experimental results show that the $f_{hist}$ method, employing the LDA-DL framework, achieves an accuracy of 97.4% in identifying 18 different devices at a sampling rate of 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$. This approach reduces dependence on the sampling rate and data volume while maintaining high identification accuracy. It therefore provides a robust and cost-effective physical-layer authentication solution for Gigabit Ethernet.

1. Introduction

The proliferation of Gigabit Ethernet has substantially increased communication bandwidth, while simultaneously intensifying challenges related to device identity security [1,2,3]. Attackers can bypass authentication mechanisms by spoofing legitimate device identities [4], leading to risks such as data leakage [5] and distributed denial-of-service (DDoS) attacks [6,7]. Several studies have explored device identification methods based on network behavior characteristics. These methods can be broadly classified into three categories, based on the type of features used. The first category focuses on network traffic features [8,9,10], including packet size, inter-arrival time, session duration, and protocol type [11]. These features are relatively easy to extract and can effectively support device identification in IP-based and wired environments. The second category centers on MAC layer features [12], such as beacon frames and probe request frames [13]. These features provide non-intrusive information and are suitable for passive monitoring in wireless networks. The third category exploits radio frequency (RF) signal characteristics [14,15] and leverages inherent hardware-level imperfections [16], such as frequency offset and phase noise [17], to generate device-specific fingerprints. These fingerprints are robust against spoofing and are independent of higher-layer protocols [18].

While conventional physical-layer fingerprinting facilitates hardware-level authentication, it is constrained by the Nyquist sampling theorem [19,20]. In Gigabit Ethernet environments, this constraint requires the use of ultra-high-speed analog-to-digital converters (ADCs), which increases hardware cost and produces extremely large volumes of raw sampled data [21]. Meanwhile, although sub-Nyquist sampling has been well established in signal reconstruction [22,23], its application in the security domain of physical-layer device authentication and fingerprint recognition remains underexplored.

To overcome these challenges, this study proposes a fingerprint extraction method based on sub-Nyquist sampling. Instead of adhering strictly to the Nyquist criterion, the proposed approach exploits sparsity and distribution characteristics in high-speed Ethernet signals to extract raw features that preserve essential device-specific hardware differences. The standardized spectral structure of wired Gigabit Ethernet and its low external noise level enable sub-Nyquist sampling to extract device fingerprints more reliably and efficiently than is typically achievable with radio frequency (RF) signals.

The innovations of this paper are summarized as follows:

• A signal rearrangement distribution fingerprint ($f_{sort}$) is proposed. It constructs an unsupervised classification framework that integrates amplitude rearrangement with principal component analysis (PCA) for dimensionality reduction and a support vector machine (SVM) for classification. With low computational complexity and minimal storage overhead, the scheme is suitable for deployment in resource-constrained environments such as embedded devices, demonstrating strong engineering practicality and scalability.
• An amplitude–frequency distribution fingerprint ($f_{hist}$) is introduced. The scheme constructs a supervised dimensionality-reduction-based classification framework based on the amplitude–frequency distribution, linear discriminant analysis (LDA), and a deep learning (DL) model. It is sensitive to subtle hardware variations and remains robust under low sampling rates. Experimental results show that $f_{hist}$ achieves a recognition accuracy exceeding 97.4% even at a sampling rate as low as 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$. These results suggest that the approach is well-suited for deployment on cloud servers or resource-capable devices to support high-accuracy, large-scale authentication tasks.
• A multi-scenario experimental validation framework is established, including multi-instance and cross-type scenarios. The multi-instance scenario focuses on identifying multiple instances of the same network interface card (NIC) model across different production batches. The cross-type scenario evaluates devices from different manufacturers and interface types. Two classification pipelines, PCA-SVM and LDA-DL, are evaluated under these two scenarios. The evaluation focuses on the classification accuracy of the proposed fingerprints and their generalization capability across different device instances and hardware types.

The remainder of this paper is organized as follows: Section 2 reviews related work in the fields of physical-layer fingerprint identification and sub-Nyquist sampling. Section 3 presents the proposed fingerprint extraction framework based on sub-Nyquist sampling. Section 4 evaluates the performance of the proposed methods in various scenarios, including multi-instance and cross-type scenarios. Section 5 concludes the paper and discusses future research directions.

2. Literature Review

Research on physical-layer fingerprinting for Gigabit Ethernet has evolved along a well-defined and systematic technological trajectory. This paper identifies three primary research directions within this framework. These directions contribute to the advancement of Gigabit Ethernet device authentication from the perspectives of traditional physical-layer signal processing, Ethernet fingerprint extraction techniques and sub-Nyquist sampling technology. These directions form the theoretical and methodological foundation for the work presented in this paper.

2.1. Traditional Physical-Layer Fingerprint

Traditional physical-layer signal processing and fingerprint recognition techniques aim to extract distinguishable fingerprints from the inherent hardware characteristics of transmitted signals. Device authentication is then performed using signal processing and machine learning algorithms. These approaches lay the groundwork for further optimization in high-speed network scenarios.

Yin Kuang et al. [24] investigated the degradation of recognition performance for radar modulation signals under low signal-to-noise ratio (SNR) conditions. They proposed a phase-difference rearrangement process for instantaneous phase features to construct transform domain signal representations, which were then combined with a convolutional neural network for rapid identification. This method significantly enhances the discriminability of signal features under low SNR, achieving recognition accuracies of 91.7% at −5 $\mathrm{d}\mathrm{B}$ and nearly 98% at 0 $\mathrm{d}\mathrm{B}$. In a similar approach, ref. [25] proposed a differential constellation trace figure (DCTF) method for radio frequency fingerprint extraction in wireless ZigBee devices, in which time-domain I/Q samples are converted into two-dimensional images containing fingerprint features and classified using a convolutional neural network. Experiments on 54 ZigBee devices achieved an accuracy of 99.1% at 30 $\mathrm{d}\mathrm{B}$ SNR with low computational complexity.

Z. Wang et al. [26] addressed the challenges of large storage demands by introducing a neural network approach. The proposed method extracts fingerprint minutiae, converts the images into fixed-dimensional descriptors, and performs classification using the D-LVQ algorithm. With GPU-based preprocessing, the system markedly improves the efficiency of conventional fingerprint recognition. R. M. Gerdes et al. [27] focused on wired Ethernet devices and used matched filters to analyze the steady-state synchronization signals of Ethernet frames. Device discrimination is achieved using a single frame, and an adaptive threshold is employed to reduce the impact of random fluctuations. Although there is strong real-time performance, the method is limited to Ethernet devices operating at 10 $\mathrm{M}\mathrm{b}\mathrm{p}\mathrm{s}$, and its applicability to Gigabit Ethernet requires further validation.

2.2. Ethernet Device Fingerprint

Research on Ethernet device fingerprinting has focused on the development of specialized fingerprint extraction and identification schemes tailored to the signal characteristics of Ethernet at different data rates. This work primarily addresses challenges such as signal mixing and limited feature discriminability in high-speed, full-duplex environments, and provides technical support for physical-layer authentication in Gigabit Ethernet.

In the field of Gigabit Ethernet, E. F. Haratsch et al. [28] introduced a joint equalizer and trellis decoder architecture. By combining a parallel decision feedback decoder, an enhanced decision feedback prefilter, and a single-tap look-ahead PDFD, the architecture effectively mitigates inter-symbol interference. It reduces both the hardware gate count and the critical path by approximately 50%, achieving a 125 $\mathrm{M}\mathrm{H}\mathrm{z}$ clock frequency and 1 $\mathrm{G}\mathrm{b}/\mathrm{s}$ throughput under CMOS technology. Hua, M. et al. [29] examined the signal mixing problem in full-duplex transmission. They used a pre-trained convolutional neural network to separate single-ended signals from mixed signals, extracted spectral features via grouped Fast Fourier Transform, and applied KNN after dimensionality reduction with mRMR. The approach achieved 85.9% accuracy in an eight-device classification task and showed strong robustness across heterogeneous connection scenarios. Ref. [30] focused on fiber-optic Ethernet devices and proposed an Adjacent Constellation Trace Figure (ACTF) feature extraction method. The method converts amplitude signals into two-dimensional images and applies a two-dimensional convolutional neural network for device classification. Experiments on 24 fiber-optic Ethernet devices demonstrated an accuracy of 99.49% at 30 dB SNR, outperforming both traditional statistical approaches and LSTM models. However, since the validation was mainly conducted on fixed device states, further work is required to assess its adaptability under dynamic transmission conditions in Gigabit Ethernet.

In the domain of Fast Ethernet, J. Liu et al. [31] proposed a spectrum-based fingerprint extraction method. The method utilizes Kullback–Leibler divergence to reduce the dimensionality of single-ended signal spectra and integrates multi-class linear discriminant analysis for device identification. By exploiting the stability of spectral features, the approach achieves high identification accuracy at 100 $\mathrm{M}\mathrm{b}\mathrm{p}\mathrm{s}$ transmission rates.

In radio frequency (RF) fingerprinting research, ref. [32] incorporated RF fingerprinting into the trust management framework for device-to-device (D2D) communication. By extracting physical-layer fingerprints from D2D devices, the scheme builds trusted communication links and improves the anti-spoofing capability of D2D networks.

2.3. Sub-Nyquist-Sampling-Rate-Based Fingerprint

Research on signal acquisition using sub-Nyquist sampling addresses the limitations imposed by the Nyquist–Shannon sampling theorem. By leveraging signal sparsity or structural prior knowledge, this approach enables the acquisition of key information at low sampling rates, while reducing hardware cost and data volume in Gigabit Ethernet fingerprint extraction.

X. Luo et al. [33] conducted an extensive study on sub-Nyquist sampling of linearly modulated baseband signals. They derived upper bounds for the minimum Euclidean distance of Direct Sub-Nyquist Sampling (DSNS) and Filtered Sub-Nyquist Sampling (FSNS) and proposed a time-varying Viterbi algorithm for data recovery. This method reveals the performance limits of signal recovery under sub-Nyquist sampling rates, with the bit error rate of the time-varying Viterbi algorithm (VA) approaching that of Nyquist sampling at low rates.

Addressing electrocardiogram (ECG) signals, ref. [34] proposed a sub-Nyquist sampling scheme based on an integrate-and-fire time encoding machine (IF-TEM). It operates without a synchronous clock and uses only about 1/66 of the Nyquist sampling rate. Because biomedical and Ethernet signals differ in modulation and frequency characteristics, additional validation is still needed before applying this approach to Gigabit Ethernet scenarios.

In the field of sparse signal reconstruction, B. Liu et al. [35] developed a frequency-domain adaptive method that uses the discrete Hartley transform together with an ℓ₀-normalized least mean squares algorithm. This approach yields lower mean square error than both IRLS and OMP at comparable signal-to-noise ratios, while reducing computation time by about 40% compared with discrete Fourier-transform-based schemes. For uniform rectangular arrays, L. Liu et al. [36] proposed an identical delay, sub-Nyquist sensing framework that jointly estimates carrier frequency and two-dimensional direction of arrival (DOA). This framework reduces hardware costs and avoids parameter pairing by utilizing tensor techniques. Simulations demonstrate improved estimation accuracy and robust performance over a wide SNR range with fewer ADCs.

In the field of modulated wideband converters (MWC), J. Jang et al. [37] introduced the aliasing modulated wideband converter (AMWC). By intentionally introducing aliasing at the ADC stage, the method improves sampling efficiency while reducing the sampling rate and the number of channels under fixed pseudo-random signal parameters. Fine-tuning the aliasing parameters further enhances efficiency, and incorporating a random low-pass filter helps optimize performance, giving the approach strong multiband signal-processing capability.

Table 1. Summary table of related works.

Technical Category	Core Methodology/Features	Applicable Scenarios	Main Limitations
Traditional Fingerprinting	Phase rearrangement, DCTF imaging, steady-state signal matched filtering	$\mathrm{Radar}/\mathrm{ZigBee}/10 \mathrm{M}\mathrm{b}\mathrm{p}\mathrm{s}$ Ethernet	Limited to low-rate scenarios; poor adaptability to high-speed signals
High-Speed Ethernet Fingerprint	Joint equalization architecture, ACTF imaging, spectral feature separation	Gigabit/Fast/Fiber Ethernet	Adaptability in dynamic environments requires further validation
Sub-Nyquist Sampling Fingerprint	Sparse reconstruction, tensor estimation, modulated wideband converter (MWC)	High-bandwidth signals	Migration to Ethernet signals needs verification; insufficient modulation adaptability
Cross-Domain/Efficient Processing Fingerprinting	Biomedical sparse sampling, fingerprint database, fingerprint image processing, D2D networks	Biomedical signals/fingerprint images/D2D networks	Highly domain-specific; difficult to directly migrate to communication scenarios

provides the summary of related works.

Traditional physical-layer signal processing methods exhibit strong noise resistance in specific scenarios. However, these methods were not designed for the high-speed, wired characteristics of Gigabit Ethernet, which limits their applicability. Several feature extraction schemes for Ethernet device fingerprinting have been proposed, but most rely on Nyquist sampling. This results in high hardware costs and substantial data overhead, hindering large-scale deployment in resource-constrained environments. Meanwhile, research on sub-Nyquist sampling has matured in signal reconstruction, but its application in physical-layer device authentication and fingerprint recognition remains scarce. These gaps highlight the need for low-sampling, high-precision authentication techniques for Gigabit Ethernet physical-layer security, thereby motivating the framework proposed in this paper [38].

3. The Proposed Fingerprinting Solutions

The core workflow of the proposed framework is shown in Figure 1. Raw data are acquired through sub-Nyquist sampling and preprocessed. Two primary fingerprint features, namely $f_{sort}$ and $f_{hist}$, are derived from the segmented sub-Nyquist signals. The extracted features are processed through PCA-SVM or LDA-DL pipelines for dimensionality reduction and classification.

In resource-constrained environments, methods such as KNN are not suitable because they require high memory usage and computational overhead during inference. By contrast, SVM is more suitable due to its fast inference speed and low memory footprint, while maintaining strong generalization with small sample sizes. When dealing with large-scale data, deep learning can automatically extract more robust features through end-to-end learning, achieving higher precision in device identification. For these reasons, this study focuses on the use of SVM and deep learning techniques. The fingerprints combined with the two processing pipelines form an end-to-end framework for accurate device authentication at low sampling rates, encompassing signal acquisition, preprocessing, feature extraction, and classification.

3.1. Signal Acquisition and Preprocessing

Signal acquisition and preprocessing constitute the foundational stage of the sub-Nyquist-sampling-based physical-layer fingerprint extraction framework. The goal is to capture and refine feature data from Gigabit Ethernet transmission signals under low sampling rates so that intrinsic hardware differences can be revealed. Figure 1 shows the overall workflow of the proposed scheme.

3.1.1. Theory and Signal Modeling

The mathematical foundation of the rearranged distribution fingerprint lies in extracting statistical characteristics of the signal amplitude distribution. These characteristics probabilistically converge to a quantity that is independent of the sampling rate. Let the continuous time signal generated by the device be denoted as $X\left(t\right)$, whose amplitude distribution is characterized by the probability density function $p_X\left(x\right)$. The corresponding cumulative distribution function is defined as $F_X\left(x\right) = P\left(X \le x\right)$. Sampling $X\left(t\right)$ at an arbitrary sampling rate $f_s$ results in a discrete sequence $\{V_1,V_2,\dots ,V_m\}$. Each sample $V_j$ is a random variable drawn from the distribution $p_X\left(x\right)$.

For a data segment $t_i = \{V_1,\dots ,V_m\}$, sorting the samples in ascending order yields the order statistics

$$V_{\left(1\right)}\le V_{\left(2\right)}\le \cdots \le V_{\left(m\right)}$$

(1)

This corresponds to approximating the true distribution $F_X\left(x\right)$ using the empirical distribution function $F_m\left(x\right)$, defined as

$$F_m\left(x\right)={\displaystyle \frac{1}{m}}\sum _{j=1}^{m}I\left(V_j\le x\right)$$

(2)

Here, $I\left(\cdot \right)$ denotes the indicator function. According to the Glivenko–Cantelli theorem, as $m\to \mathrm{\infty }$,

$$\underset{x}{\mathit{sup}}\left|F_m\left(x\right)-F_X\left(x\right)\right|\stackrel{a.s.}{\to }0$$

(3)

Thus, the empirical distribution converges uniformly and almost surely to the true distribution, independent of the sampling rate.

The received signal can be modeled as

$$y_A\left(t\right)=\underset{\begin{array}{c}the intrinsic nonlinear\\ characteristics of NIC\end{array}}{\underbrace{f_A\left(s_A\left(t\right)\right)}}+\underset{the linear echo of NIC}{\underbrace{{ϵ}_A\cdot s_A\left(t\right)}}+\underset{\begin{array}{c}the remote signal\\ from router\end{array}}{\underbrace{\alpha \cdot s_B\left(t\right)}}+\underset{noise}{\underbrace{n\left(t\right)}}$$

(4)

where each term represents a distinct physical component of the received signal.

In this experiment, a stable reference signal path is established by fixing the probing device, the cable, and the remote terminal. Under this configuration, the NIC under test is the sole variable. As a result, the statistical characteristics of the differential signal at the probing point primarily originate from the NIC under test. These characteristics consist of hardware-induced nonlinear distortions and linear echo components, which together form the principal components of the NIC fingerprint, as well as additional circuit noise. Although the received signal contains a remote component from the opposite terminal, its power is relatively low, and its statistical properties are independent of the NIC under test. Consequently, its impact is effectively minimized during power normalization and feature extraction.

3.1.2. Signal Acquisition

During data transmission through a wired NIC, analog signals are generated on the transmission medium. These signals are produced in accordance with the data transmission protocols and encoding rules specified by the IEEE 802.3 standard [39]. To obtain the NIC fingerprint, the signal needs to be captured in a way that preserves its physical-layer features, since these features form the basis for fingerprint identification. The network structure used for NIC signal acquisition in this study is shown in Figure 2:

The NIC under test is connected to a switch via four twisted pairs that support a 1 Gbps transmission rate. A single twisted pair effectively captures the hardware fingerprint of the Ethernet device, as its hardware characteristics remain consistent across all pairs. ADC or oscilloscope is inserted between the NIC and the switch, where its probes make direct contact with the NIC-side RJ-45 connector to capture the two differential signals on a selected twisted pair.

The captured signals are forwarded through an Ethernet port and stored on a computer. To account for variations in the distance between the NIC and the switch, power normalization is applied to mitigate these differences. To further suppress interference arising from data-dependent signal components, the two differential signals undergo an additional differential operation after power normalization. The final differential signal serves as the final effective input for fingerprint extraction.

3.1.3. Signal Segmentation Processing

To improve model performance and recognition accuracy, this study uses a fingerprint extraction strategy based on signal segmentation. For each original signal sample containing $Num$ data points, segmentation preprocessing is first applied. Letting the segment length be $fragment\_length$, the number of segments, $fragment\_num$, is given by

$$fragmen{t}_{num }=⌊ Num/fragment\_length ⌋$$

(5)

where $fragment\_length$ represents the number of data samples in each segment, and $fragment\_num$ denotes the number of sub-signal groups produced after segmentation. As shown in Figure 3, the original signal is partitioned and reorganized. The complete sequence containing $Num$ is divided into multiple signal blocks, each with a length of $fragment\_length$. The sampling sequence $V1$ to $V_N$ is therefore divided into $n$ segments such that $Num =n \times m$, where $n =fragment\_num$ and $m =fragment\_length$.

Fingerprint features are extracted independently from each segment, and the resulting features are then averaged. This averaging process increases the representational capacity of the extracted features and improves both the accuracy and robustness of the fingerprint-recognition algorithm.

After noise filtering the original signal sample set described in Section 3.1.2, the signal is segmented according to the procedure outlined above to obtain the processed signal set T. The resulting set consists of $n$ data segments ($fragment\_num$), each of length $m$ ($fragment\_length$):

$$T=\left\{t_1,t_2,\dots t_n\right\}$$

(6)

3.2. Fingerprint Extraction Scheme

This section focuses on the core task of extracting fingerprints from sub-Nyquist sampled signals. We propose two extraction schemes, $f_{sort}$ and $f_{hist}$. The two schemes exhibit structural symmetry in their design while retaining complementary functional characteristics.

3.2.1. Signal Rearrangement Distribution Fingerprint

This subsection introduces the fingerprint constructed from signal rearrangement distribution features. For signal rearrangement, the data segment $t_i=\{V_1,V_2{,V}_3\dots {,V}_m\}$ in Equation (6) is first considered, with $V$ denoting the amplitude of each sampling point. Sorting algorithms such as quicksort are then applied to reorder the sampling points in ascending amplitude, producing the rearranged sequence $t_i^{\prime }$:

$$t_i^{\prime }=\{V_1^{\prime },V_2^{\prime },V_3^{\prime }\dots ,V_m^{\prime }\}$$

(7)

where $i\in [1,fragment\_length]$. For subsequent statistical feature extraction, the rearranged segment $t_i^{\prime }$ is sequentially partitioned into intervals of length $k$. The parameter $k$ is determined by the relation $k={\displaystyle \frac{m}{r}}$. The fingerprint dimension $r$ serves as a robust hyperparameter, for which stable identification accuracy is observed when $r$ ranges from 5 to 20. The only constraint is that $m$ be divisible by $k$. Based on this consideration, $r$ is set to 10 by default in this work, yielding:

$$t_i^{\prime }=\left\{\begin{array}{c} \\ \end{array}\left(V_1^{\prime }\dots V_k^{\prime }\right),\left(V_{k+1}^{\prime }\dots V_{2k}^{\prime }\right)\dots \left(V_{m-k+1}^{\prime }\dots V_m^{\prime }\right)\right\}$$

(8)

The statistical feature is subsequently extracted from $t_i^{\prime }$. Specifically, the sum of the $t$-th interval, denoted $S_t$, is computed and averaged as follows (with $t$ ranging from 1 to ${\displaystyle \frac{m}{k}}$):

$$S_t={\displaystyle \frac{{\sum }_{j=1}^k{V}_{t\ast k+j}}{k}}$$

(9)

The sums obtained from all intervals are aggregated to construct the preliminary fingerprint vector for the dataset:

$$w_{sum}=\left\{S_1,S_2,S_3\dots S_{{\displaystyle \frac{m}{k}}}\begin{array}{c} \\ \end{array}\right\}$$

(10)

During the averaging optimization step, fingerprints corresponding to the $n$ data segments are extracted, yielding a fingerprint set derived from the segmented signals:

$$\left\{w_{sum1},w_{sum2},w_{sum3}\dots w_{sumn}\right\}$$

(11)

The final fingerprint $f_{sort}$ is then obtained by averaging the elements of this set, which represent the signal rearrangement distribution feature:

$$f_{sort}={\displaystyle \frac{{\sum }_{i=1}^n{w}_{sumi}}{n}}$$

(12)

The dimension of $f_{sort}$ is ${\displaystyle \frac{m}{k}}$. This feature effectively characterizes the signal’s energy distribution. It is inherently independent of the sampling rate, which facilitates accurate device identification. The computational complexity of this proposed algorithm is $O\left(mlogm\right)$. The space complexity is $O\left(m\right)$, which is primarily determined by the sorting operation. A schematic representation of the fingerprint is shown in Figure 4.

3.2.2. Amplitude–Frequency Distribution Feature Fingerprint

Frequency distribution statistics are calculated for each segment of the signal data in Equation (6), yielding the statistical vector $H$:

$$H =\left\{{interval}_1,{interval}_2,\dots {interval}_{num}\right\}$$

(13)

Interval filtering is then carried out by removing intervals whose frequency counts are zero across all NIC fingerprints. The remaining intervals are collected into a set denoted by $S$. Derived from statistical analysis, the set $S$ is insensitive to distribution magnitude and random perturbations, and experimental results confirm its high consistency across different NICs. Therefore, a set $S$ obtained from one NIC can be reused for fingerprint extraction in other NICs.

$$S=\left\{{index}_1, {index}_2, {index}_3\dots \right\}$$

(14)

$index$ denotes the position of a retained interval, ranging from 0 to $num-1$. The cardinality of $S$ corresponds to the optimized fingerprint dimensionality. All intervals contained in $S$ are regarded as valid candidates. Subsequent fingerprint extraction computes frequency statistics exclusively for the intervals indexed by $S$, yielding the statistical fingerprint $w_{hist}$:

$$w_{hist}=\left\{{interval}_i|i\in S\right\}$$

(15)

For $n$ datasets, the frequency distribution statistical fingerprint for each dataset is obtained using the above procedure, producing a fingerprint set derived from the segmented signals:

$$W_{hist}=\left\{w_{hist1},w_{hist2},\dots w_{\begin{array}{c}histn\\ \end{array}}\right\}$$

(16)

An averaging operation is then performed on $W_{hist}$ to obtain the final fingerprint $f_{hist}$, which characterizes the amplitude–frequency distribution of the signal:

$$f_{hist}={\displaystyle \frac{{\sum }_{i=1}^n\begin{array}{c} \\ \end{array}{w}_{histi}}{n}}$$

(17)

A schematic illustration of $f_{hist}$ is presented in Figure 5.

3.3. Feature Transformation and Classification Frameworks

In the physical-layer fingerprint extraction framework operating under sub-Nyquist sampling conditions, feature transformation bridges fingerprint extraction with subsequent classification and authentication. This section describes how the feature transformation stage, following the procedures outlined in Section 3.2.1 and Section 3.2.2, is integrated into the overall experimental methodology. The primary objective of feature transformation is to compress high-dimensional fingerprint features via dimensionality reduction, thereby removing redundancy, enhancing discriminative capability, and providing more efficient inputs for downstream classification models. Two independent feature transformation pipelines are developed. The first integrates PCA with SVM to construct a classical classification framework based on unsupervised dimensionality reduction, and the second combines LDA with a deep learning model to establish an intelligent classification framework that incorporates supervised dimensionality reduction. These two approaches cater to different resource constraints and accuracy requirements, offering flexibility, adaptability, and robustness for low-sampling-rate applications.

3.3.1. PCA–SVM Pipeline

PCA is applied directly to the fingerprint features extracted and is used as a preprocessing step before the SVM classifier. The objective is to project high-dimensional features into a lower-dimensional subspace while retaining as much variance as possible, reducing computational complexity and lowering the risk of overfitting. As shown in Figure 6, PCA applies a linear transformation that converts the original features into a new set of variables called principal components, which are expressed as linear combinations of the original features.

The implementation workflow consists of three core stages:

• Feature Standardization and Centering.
  The fingerprint feature matrix $X\in {\mathbb{R}}^{\left\{n\times m\right\}}$, obtained from signal rearrangement or amplitude–frequency distribution, is standardized. The mean is subtracted and each feature is scaled to unit variance, which reduces the effect of heterogeneous measurement scales and yields the centered matrix ${\mathrm{X}}_{centered}$.
• Covariance Decomposition and Projection Matrix Construction.
  The covariance matrix of the centered data is computed as $C = {\displaystyle \frac{1}{n-1}}{X}_{centered}^T{\mathrm{X}}_{centered}$. Eigenvalue decomposition is then performed on $C$. The top $k$ principal components ($k \ll m$) with the largest eigenvalues are selected to construct the projection matrix $W_{PCA}\in {\mathbb{R}}^{\left\{m\times k\right\}}$. The low-dimensional representation is obtained as $Z_{PCA} = X \times W_{PCA}$, where $Z_{PCA} = {\mathbb{R}}^{\left\{n\times k\right\}}$ denotes the compressed feature matrix.
• SVM Classifier Integration.
  The reduced features $Z_{PCA}$ are used as input to an SVM classifier. A Radial Basis Function (RBF) kernel is adopted to construct a maximum-margin decision boundary for device classification. Because PCA is unsupervised, it reduces dependence on labeled data and is suitable for preliminary feature screening. The computational efficiency of the SVM further supports use in resource-constrained environments. This pipeline serves as a standardized post-extraction module with low computational overhead under sub-Nyquist sampling conditions.

3.3.2. LDA–DL Pipeline

LDA is applied after fingerprint extraction and is designed to support the deep-learning-based classification pipeline. Its objective is to use device category labels to project the features into a discriminative subspace that maximizes inter-class separation and minimizes intra-class variance, improving classification accuracy.

The implementation consists of the following steps:

• Within-class and between-class scatter computation.
  Given the labeled fingerprint feature matrix $X$, the within-class scatter matrix $S_w$ and the between-class scatter matrix $S_b$ are computed. The matrix $S_w$ describes the dispersion of samples within each category, whereas $S_b$ reflects the separability between category centroids. The projection matrix $W_{LDA}$ is obtained by solving the generalized eigenvalue problem $S_{b}W = \lambda$ $S_{w}W$.
• Projection onto the Discriminant Subspace.
  The original features are projected into a lower-dimensional discriminant space as $ZLDA = XWLDA$, where $ZLDA\in Rn \times d$ and $d$ equals the number of categories minus one. The resulting features exhibit reduced dimensionality and improved class separability, providing suitable input for the deep learning model.
• Deep Learning Model Integration.
  The projected features $Z_{LDA}$ are used as input to a deep learning classifier. Through multilayer nonlinear transformations, the model performs end-to-end device authentication and learns complex feature relationships, complementing the linear assumptions of LDA and improving robustness under noisy or time-varying conditions. This pipeline combines the discriminative capability of LDA with the representation learning capacity of deep learning, yielding a complementary integration.

Through this design, the PCA-SVM and LDA-DL pipeline form the core processing stages following fingerprint extraction, establishing a complete experimental framework. Under sub-Nyquist sampling rates, the resulting fingerprints support efficient and accurate device authentication and provide a scalable solution for Gigabit Ethernet physical-layer security.

4. Experimental Results

This section describes the experimental design and evaluation used to validate the proposed physical-layer fingerprint extraction framework under sub-Nyquist sampling conditions. The discussion covers dataset construction, evaluation scenarios, and key experimental results. To assess performance in a Gigabit Ethernet setting, the proposed method is compared with a baseline that employs the traditional averaged spectrum method.

For the baseline, feature extraction is performed in the frequency domain, focusing on the average spectrum across multiple frequency bands, with metrics such as energy, spectral centroid, bandwidth, and spectral entropy. To ensure a fair comparison, the same two processing pipelines described in Section 3.3 are independently applied to both the proposed sub-Nyquist features and the baseline frequency features.

The experiments use a multidimensional set of evaluation metrics, including accuracy, precision, recall, and the F1-score, to comprehensively assess authentication reliability. The dataset is divided into five subsets for iterative training, and the mean performance across folds is reported.

All experiments are implemented on a high-performance computing platform. The hardware configuration includes an Intel Core i9-12900K processor (Intel Corporation, Santa Clara, CA, USA), an NVIDIA GeForce RTX 3070 GPU (NVIDIA Corporation, Santa Clara, CA, USA), and 64 GB of DDR4 RAM (Kingston Technology, Fountain Valley, CA, USA). The software stack is based on Python 3.8 and includes scikit-learn 1.0.2, TensorFlow 2.6, and NumPy 1.21.5. Sampled data are obtained using a Tektronix oscilloscope (Tektronix, Inc., Beaverton, OR, USA) and the ADC of an STM32F407 microcontroller with triple sampling technique. Signal preprocessing and feature extraction are performed using custom-developed scripts.

4.1. Evaluation Scenarios

The evaluation is conducted under two experimental scenarios, each focusing on different levels of recognition granularity.

• Multi-instance scenario.
  This scenario evaluates the recognition of multiple instances of the same device model, where NICs from different production batches of the same model are used. The aim is to assess the method’s ability to distinguish subtle hardware variations between instances.
• Cross-type scenario.
  This scenario examines recognition of NICs produced by different manufacturers or incorporating different interface types. It serves to evaluate the method’s generalization and classification performance across heterogeneous device models and interface specifications.

For both scenarios, two technical pipelines including PCA-SVM and LDA-DL, are employed in parallel for validation. The PCA-SVM pipeline performs unsupervised dimensionality reduction and combines it with support vector machine classification for efficient processing. The LDA-DL pipeline applies supervised dimensionality reduction together with deep neural networks to support high-precision classification.

4.2. Model Design

Key parameters and their rationale are summarized in

Table 2. Key parameters used in the experiments.

Processing Stage	Parameter Name	Parameter Value
Data Partition	Train-Test Split Ratio	80%
	Normalization Method	StandardScaler
PCA Dimensionality Reduction	Feature Dimension	16
LDA Dimensionality Reduction	Maximum Reduced Dimension	Number of Classes—1
SVM Classifier	Kernel Function	RBF
	Regularization Parameter C	100
Deep Learning Network	Hidden Layer Neuron Count	25,612,864
	Dropout Rate	0.3
	Activation Function	ReLU
	Regularization Parameter C	10
	Output Layer Activation	softmax
	Loss Function	sparse_categorical_crossentropy
	Initialization Method	Glorot uniform
Optimizer	Type	Adam
	Learning Rate	0.001
Training Control	Early Stopping Patience	20
	Batch Size	32 (sort)/64 (hist)
	Max Epochs	150

. The number of principal components retained by PCA is determined based on feature characteristics, using variance contribution analysis and estimates of intrinsic dimensionality. This approach balances information preservation with control of dimensionality. LDA uses a supervised dimensionality reduction strategy to exploit inter-class discriminative information. For the SVM classifier, the kernel function and regularization parameter are selected to balance model complexity and generalization performance. The deep learning model employs a multilayer fully connected architecture, introducing nonlinearity through appropriately configured neurons and activation functions. Dropout is incorporated to reduce overfitting risk. The optimizer is selected to balance convergence speed with training stability, with the learning rate set to trade off training efficiency and accuracy. An early-stopping mechanism is further employed to prevent overfitting while avoiding undertraining. The hyperparameters used in the experiments are common generic settings and were not specifically tuned on the validation data.

4.3. Dataset

The experimental dataset includes 18 wired NICs from eight manufacturers, and the detailed list is provided in

Table 3. Network interface cards used in the experiments.

Interface Type	Manufacturer	Model	Batch Number
PCI-E	Realtek	TXA092	U2408A002147
	Intel	9301CT	WW.2406.SH
	TP-Link	TG-3468	L24M08U0876C
	Samzhe	Samzhe PCI-E	S2307A01U, S2308B15U, S2406B32U, S2409B08U
		PE10, PE25	-
	Ugreen	UGREEN PCI-E	SU0819Y456
USB 3.0	comfast	CF-P50-1, CF-P50-25, CF-P50-50	-
	Youlian	2183-1,2183-2,2183-5
	Pisen	WK04	-
	Samzhe	HWK01, HWK02
	TP-Link	UE300	-
	Samzhe	ARX01	S2406B32P

. The devices cover two widely used interface standards, PCI-E and USB 3.0. This selection reflects the hardware heterogeneity commonly encountered in practical deployments.

Data acquisition was performed in a controlled laboratory environment to minimize external interference. The acquisition period lasted four days, during which the ambient temperature was stabilized at 25 °C ± 1 °C. Electromagnetic shielding was applied, and a fixed network topology was maintained to eliminate temperature, electromagnetic, and connection variability. Each day, 2000 valid samples were collected from each NIC, with each sample containing 800,000 raw signal points, yielding 8000 total samples. High-precision oscilloscopes or ADC captured differential signals over a single twisted pair at programmable sampling rates to ensure data consistency and reliability.

The dataset partitioning strategy was designed to emphasize temporal generalization. The 6000 samples collected during the first three days were used for training, and the 2000 samples collected on the fourth day formed the test set. This design reflects realistic use cases in which models are trained on historical data and then applied to new observations, enabling evaluation of long-term fingerprint stability. Five-fold cross-validation is employed exclusively within the training set consisting of samples collected during the first three days. After cross-validation, the final model was retrained on the full training set. Performance evaluation was then conducted once on the independent test set collected on the fourth day, representing a future time point. This strategy prevents information leakage and provides an unbiased assessment of model generalization over time.

4.4. Device Recognition Experiment in Multi-Instance Scenario

This chapter examines device fingerprint classification in multi-instance scenario. It systematically evaluates the discriminative capability of fingerprint features across three experimental scenarios. Experiments are conducted on a dataset containing four NICs of the same model from the same manufacturer but produced in different batches, while maintaining time-separated data collection to improve robustness and reliability. All experiments are conducted at a sampling rate of 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$ to emulate resource-constrained conditions and to allow comparison with traditional frequency-domain identification methods.

4.4.1. Baseline Scenario Evaluation in Multi-Instance Scenario

The baseline scenario is designed as a comparative benchmark to assess the capability of the signals for device identification. To ensure fairness, the baseline model employs the same dimensionality reduction algorithms, SVM classifier, and deep learning architectures as the proposed method. Analog filtering or anti-aliasing filtering is applied during signal acquisition to limit out-of-band signals and prevent aliasing. Under a sampling rate of 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, the raw time-domain signals were first transformed into the frequency domain using the Fast Fourier Transform (FFT). The frequency ranges from 0 to the sub-Nyquist were evenly divided into 50 frequency bands after spectral averaging, and the energy within each subband was calculated as a feature. Three statistical features were then extracted from the spectrum, namely the spectral centroid, spectral bandwidth, and spectral entropy. The 50 subband energies and the three statistical features were combined to construct a 53-dimensional frequency domain feature vector for model training. Performance is reported in terms of identification accuracy for four multi-instance devices including S2307A01U, S2308B15U, S2406B32U, and S2409B08U across two evaluation pipelines.

As shown in Figure 7a, the PCA-SVM method yields the highest accuracy, reaching 87.1% on the S2406B32U instance, followed by 54.2% on the S2307A01U instance. The LDA-DL approach performs slightly worse, with accuracy values between 30.4% and 74.8%. The confusion matrix is presented in Figure 7b. These results indicate that, under sub-Nyquist sampling conditions, the frequency-domain features of the original signal are affected by spectral aliasing and information overlap, which limits device discrimination. Consequently, conventional frequency-domain analysis methods face notable challenges under such conditions.

The precision, recall, and F1-scores of the baseline model are summarized in

Table 4. Precision, recall, and F1-score of the baseline model in the multi-instance scenario.

Algorithm Type	NIC Batch	Precision	Recall	F1-Score
PCA-SVM	S2307A01U	0.42	0.54	0.48
	S2308B15U	0.38	0.27	0.32
	S2406B32U	0.65	0.87	0.74
	S2409B08U	0.37	0.25	0.30
LDA-DL	S2307A01U	0.40	0.40	0.40
	S2308B15U	0.37	0.33	0.35
	S2406B32U	0.63	0.73	0.67
	S2409B08U	0.33	0.32	0.32

. The results indicate that the frequency-domain-based model shows weak performance across all metrics, indicating that the deep learning model is unable to extract stable discriminative representations from the aliased frequency-domain features. This performance degradation is primarily due to the reliance of conventional frequency-domain approaches on full-spectrum signal information for feature extraction. Consequently, at low sampling rates, frequency-domain features struggle to reflect hardware-level differences, and aliasing exacerbates feature overlap across classes, diminishing the classifier’s ability to discriminate between devices.

4.4.2. Evaluation Based on Signal Rearrangement Distribution Fingerprint in Multi-Instance Scenario

This experiment assesses the effectiveness of the proposed $f_{sort}$ in extracting intrinsic hardware characteristics by deriving hardware-related features from low-rate sampled data through signal rearrangement processing. The experiment adopts the same dual-path classification framework.

As shown in Figure 8, the experimental results outperform those of the baseline scenario, indicating improvements in accuracy. In the LDA-DL, the recognition accuracy of $f_{sort}$ exceeds 87.1%, surpassing the baseline performance. The PCA-SVM pipeline achieves better performance, with all accuracy values above 92.3%. Figure 9 shows that the original fingerprints of each NIC already exhibit distinguishable patterns. Feature visualization indicates that the $f_{sort}$ fingerprints form separated clusters in the low-dimensional space, as shown in Figure 10, demonstrating improved identifiability under sub-Nyquist sampling conditions.

Table 5. Precision, recall, and F1-score of $f_{sort}$ in the multi-instance scenario.

Algorithm Type	NIC Batch	Precision	Recall	F1-Score
PCA-SVM	S2307A01U	1.00	1.00	1.00
	S2308B15U	0.92	0.93	0.92
	S2406B32U	0.93	0.92	0.92
	S2409B08U	1.00	1.00	1.00
LDA-DL	S2307A01U	1.00	1.00	1.00
	S2308B15U	0.89	0.90	0.89
	S2406B32U	0.90	0.88	0.89
	S2409B08U	1.00	1.00	1.00

summarizes the recognition performance of $f_{sort}$ for multi-instance scenario under sub-Nyquist sampling rates. In the LDA-DL method, precision, recall, and F1-score for each NIC batch remain high. The S2307A01U and S2409B08U batches perform best, with precision, recall, and F1-scores all close to 1. In the PCA-SVM method performance increases further, indicating better results than the traditional frequency-domain method in the baseline scenario.

These results show that the proposed method performs well under sub-Nyquist sampling rates. Traditional frequency-domain recognition methods typically rely on high sampling rates to retain the full signal spectrum. At low sampling rates, aliasing and information loss hinder the extraction of discriminative features. In contrast, the proposed approach instead captures hardware differences through signal rearrangement and statistical processing, reducing dependence on high sampling rates.

4.4.3. Evaluation Based on Amplitude–Frequency Distribution Fingerprint in Multi-Instance Scenario

This experiment employs the same multi-instance scenario described previously. Low-sampling-rate signals are processed with amplitude–frequency distribution statistics to obtain hardware-specific differential features. As shown in Figure 11, LDA-DL further improves performance, raising the average accuracy to 96.3%. For the S2409B08U and S2307A01U NIC batches, both precision and recall reach 100%, highlighting the benefit of combining supervised dimensionality reduction with nonlinear models.

Figure 12 shows that the original fingerprints for each NIC remain distinguishable. The feature visualization in Figure 12 indicates that $f_{hist}$ forms separated clusters in the low-dimensional space. As shown in Figure 13, the amplitude–frequency method suppresses environmental noise and data-content interference. Interval filtering extracts features that are stable and independent of sampling rate, improving the ability to capture intrinsic hardware properties.

The performance of $f_{hist}$ in the multi-instance scenario is summarized in

Table 6. Precision, recall, and F1-score of $f_{hist}$ in the multi-instance scenario.

Algorithm Type	NIC Batch	Precision	Recall	F1-Score
PCA-SVM	S2307A01U	1.00	1.00	1.00
	S2308B15U	0.85	0.84	0.84
	S2406B32U	0.84	0.85	0.85
	S2409B08U	1.00	1.00	1.00
LDA-DL	S2307A01U	1.00	1.00	1.00
	S2308B15U	0.91	0.94	0.93
	S2406B32U	0.94	0.90	0.92
	S2409B08U	1.00	1.00	1.00

. Under the LDA-DL scheme, the precision of $f_{hist}$ remains above 0.91, while recall falls between 0.90 and 1.00. The experimental results show that $f_{hist}$ maintains high accuracy under sub-Nyquist sampling conditions and outperforms the baseline approach. Interval filtering and averaging mitigate information loss caused by low sampling rates while preserving subtle inter-device differences. This method provides a viable solution for reliable device authentication in wired Gigabit Ethernet environments, achieving high-precision identification when sufficient resources are available.

4.5. Device Recognition Experiment in Cross-Type Scenario

This section evaluates the generalization and classification performance of the proposed method in a cross-type scenario, simulating device heterogeneity in real network environments. The experiments are conducted on a dataset containing NICs from eight manufacturers in Table 3 to assess whether the fingerprint features remain discriminative at a broader, cross-category level.

4.5.1. Baseline Scenario Evaluation in Cross-Type Scenario

The frequency-domain feature extraction process follows the same procedure as outlined in Section 4.4.1. Figure 14 shows the recognition accuracy of the baseline model on the cross-type scenario. The PCA-SVM yields low overall accuracy, with an average accuracy of 52.0%. LDA-DL performs slightly better, with the average accuracy of 55.3%, indicating that the baseline approach still struggles to capture hardware differences across device types.

The experimental results are summarized in

Table 7. Average precision, recall, and F1-score of the baseline model in the cross-type scenario.

Algorithm Type	Precision	Recall	F1-Score
PCA-SVM	0.53	0.53	0.52
LDA-DL	0.52	0.56	0.53

. For brevity, only the average values are reported rather than per-device results. The baseline model performs poorly on the cross-type scenario, highlighting the limitations of traditional frequency-domain features for cross-type identification under sub-Nyquist sampling conditions.

4.5.2. Evaluation Based on Signal Rearrangement Distribution Fingerprint in Cross-Type Scenario

This section evaluates the generalization capability of $f_{sort}$ in cross-type scenario. As shown in Figure 15, the original fingerprints corresponding to each NIC exhibit a notable degree of distinguishability.

Figure 16 presents the recognition performance of $f_{sort}$ in cross-type scenario. Both methods achieve relatively high classification performance on most tested devices. The average accuracy is 88.4% for PCA-SVM and 93.1% for LDA-DL. This result indicates that both approaches can extract discriminative features from the majority of network card data. However, for the PE25 and 2183-1 devices, PCA-SVM exhibits a notably lower recognition accuracy. This could be due to increased inter-class overlap or stronger noise interference. On the other hand, LDA-DL maintains better performance by leveraging class information.

Table 8. Average precision, recall, and F1-score of $f_{sort}$ in the cross-type scenario.

Algorithm Type	Precision	Recall	F1-Score
PCA-SVM	0.88	0.90	0.87
LDA-DL	0.93	0.94	0.94

summarizes the average performance metrics of $f_{sort}$ in the cross-type scenario.

4.5.3. Evaluation Based on Amplitude–Frequency Distribution Fingerprint in Cross-Type Scenario

The experiments in this section are conducted under sub-Nyquist sampling conditions to evaluate the adaptability of the proposed features to heterogeneous devices. The goal is to assess the discriminative capability of $f_{hist}$ in cross-type scenario. The original fingerprint distribution is illustrated in Figure 17.

Figure 18a presents the accuracy and stability of $f_{hist}$ using an accuracy trend chart, and Figure 18b displays the confusion matrix for device classification. In the comparative experiment between the two classification methods, LDA-DL achieves an average accuracy of 97.4%, while PCA-SVM achieves 88.6%.

The LDA-DL method shows higher performance, with recognition accuracies above 96% on all tested NICs except CF-P50-25 model. This model was intentionally retained to ensure experimental completeness and objectivity. Although LDA-DL performs poorly on this device, the PCA-SVM method achieves an accuracy of 95.1%. This result suggests that the lower accuracy is not due to the inherent unidentifiability of the device, but rather the adaptability of specific classification methods to its data characteristics. These results indicate that method selection has an important impact on hardware fingerprint identification performance.

Table 9. Average precision, recall, and F1-score of $f_{hist}$ in the cross-type scenario.

Algorithm Type	Precision	Recall	F1-Score
PCA-SVM	0.90	0.91	0.88
LDA-DL	0.98	0.98	0.97

summarizes the average performance metrics. The results show that $f_{hist}$ performs effectively in the cross-type scenario, preserving its discriminative capability at low sampling rates. A paired t-test on 100 experimental data sets showed an 8.77% difference in mean accuracy between the multi-instance and cross-type authentication scenarios. This difference was statistically significant (t = 277.92, p < 0.001)

As shown in

Table 10. Metrics of $f_{hist}$ in the cross-type scenario.

Metric	PCA-SVM	LDA-DL
Training Time (seconds)	16.14	40.25
Model Size (×1000 parameters)	9841	46,930
Per-Sample Inference Time (ms)	2.51	42.23

, PCA-SVM requires approximately 40% of the training time of LDA-DL, while using substantially fewer model parameters. This indicates favorable characteristics for lightweight deployment. In terms of single-inference latency, PCA-SVM exhibits lower inference time, meeting the requirements for real-time application scenarios. By contrast, LDA-DL achieves higher classification accuracy at the cost of increased computational and storage resources.

4.6. Fingerprint Validity Verification Experiments

This section evaluates the recognition performance of the proposed physical-layer fingerprint extraction method under sub-Nyquist sampling across multiple sampling frequencies. The goal is to assess the robustness and effectiveness of the extracted features at extremely low sampling rates. The experiments emulate resource-constrained acquisition environments by configuring different sampling-rate levels, with performance assessed using the LDA-DL method.

4.6.1. Sampling Frequency Evaluation

To investigate the influence of sampling frequency on fingerprint recognition accuracy, a range of sampling rates is used, from high to ultra-low: 500 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, 250 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, 100 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, 50 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, 10 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, 1 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, and 500 $\mathrm{K}\mathrm{s}\mathrm{p}\mathrm{s}$. Experimental data are collected from the 18 NICs listed in Table 3. Feature extraction follows the LDA-DL framework described in Section 3.2.

The experimental results reveal the relationship between sampling frequency and fingerprint performance. As shown in

Table 11. Recognition accuracy of $f_{sort}$ and $f_{hist}$ as a function of sampling rate.

	Sampling Rate	$500 \mathbf{M}$	$100 \mathbf{M}$	$50 \mathbf{M}$	$10 \mathbf{M}$	$5 \mathbf{M}$	$1 \mathbf{M}$	$500 \mathbf{K}$
Fingerprint Features
$f_{sort}$		99.4%	97.8%	95.4%	91.0%	88.2%	81.2%	58.2%
$f_{hist}$		99.9%	99.8%	98.8%	98.1%	97.4%	93.1%	71.1%

, both proposed fingerprints maintain good recognition accuracy when the sampling rate is at least 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$. Even at a sampling rate of 1 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, the accuracy of $f_{hist}$ remains 93.1%, indicating strong robustness. Further comparison shows that $f_{hist}$ outperforms $f_{sort}$ at nearly all sampling rates.

Although the LDA–DL framework used for $f_{hist}$ requires greater computational and storage resources, it delivers higher recognition accuracy, making it suitable for scenarios with stricter performance demands. The results also show that performance deteriorates more rapidly when the sampling rate drops below 1 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, suggesting that 1 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$ is a practical lower bound for stable deployment in Gigabit Ethernet edge environments.

4.6.2. Interval Length Evaluation

This section examines how the interval-length parameter $l$ affects the recognition performance of physical-layer fingerprint features under sub-Nyquist sampling. The parameter $l$ represents the number of sampling points included in each sub-interval during signal reordering and statistical processing, directly influencing the granularity and robustness of feature extraction. If $l$ is too small, the extracted features become overly sensitive to noise and random fluctuations, reducing stability. If $l$ is too large, important hardware-related details may be smoothed out. Optimizing $l$ is crucial to balance sensitivity with generalization capability.

To assess the influence of $l$, a range of interval settings is tested. Using the dataset described in Section 4.3, signals are collected at a sub-Nyquist sampling rate of 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$. The fingerprint extraction process follows the procedure in Section 3.2. Figure 19 shows how the recognition performance of $f_{sort}$ and $f_{hist}$ varies as $l$ changes.

The experimental results reveal a nonlinear relationship between interval length and fingerprint recognition performance. Taking a sampling rate of 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$ as an example, Figure 19 shows that both $f_{sort}$ and $f_{hist}$ exhibit an inverted U-shaped trend as $l$ varies. When $l$ is between 30 and 100, $f_{hist}$ achieves near-optimal performance, with accuracy above 95%.

As $l$ exceeds 100, performance gradually declines. At $l = 500$, the accuracy of $f_{hist}$ falls below 90%. When $l$ < 20, performance also degrades due to short intervals that fail to effectively suppress noise. This suggests that fingerprint recognition depends on selecting an appropriate interval length to balance statistical robustness and feature resolution. Further analysis shows that the optimal range of l shifts as the sampling rate changes.

Figure 20 presents the average identification accuracy for different combinations of sampling rates and parameter l. Darker colors indicate better performance of a given l value at the corresponding sampling rate. In practical deployments, the value of l should be dynamically selected or adjusted according to the sampling rate of the target device.

5. Conclusions

This paper presents a physical-layer fingerprint extraction framework based on sub-Nyquist sampling, which reduces the dependence of Gigabit Ethernet device authentication on high-speed sampling hardware. Experimental results show that, even at a sampling rate of 5 $\mathrm{M}\mathrm{s}\mathrm{p}\mathrm{s}$, the proposed method achieves an identification accuracy above 97.4% in cross-type scenario. This rate is only about 2% of that required by traditional Nyquist sampling, yet it still outperforms the frequency-domain baseline model in terms of identification accuracy.

The main contribution of this work lies in the design of fingerprint extraction frameworks with symmetrical architectures and complementary functions. The $f_{sort}$ feature scheme uses signal rearrangement, interval averaging, and unsupervised PCA-based dimensionality reduction, followed by an SVM classifier. This classical framework offers low computational cost and modest storage requirements, making it suitable for resource-limited scenarios such as embedded devices. For applications requiring higher precision, the $f_{hist}$ scheme adopts amplitude–frequency statistics, valid-interval filtering, and supervised LDA-based dimensionality reduction, combined with a deep learning model. This framework is intended for large-scale authentication tasks with high concurrency and abundant computing resources, such as cloud environments

Despite the obtained results, several issues require further investigation. With respect to technical reliability, the long-term stability of fingerprint features remains to be validated. This requirement is critical under device aging conditions, where systematic evaluation of performance degradation patterns is essential. In addition, the influence of environmental factors in real-world deployments, such as temperature fluctuations and electromagnetic interference, on fingerprint stability indicates the need for effective adaptive compensation mechanisms. Future work will focus on improving system robustness, increasing adaptability to environmental variations, and developing efficient online learning methods. These efforts aim to improve the reliability and practical applicability of the proposed technology.