The article presents a novel method for detecting dangerous radio signals within a specified frequency range, leveraging Bayesian hypothesis testing. With the increasing sophistication of covert technical means, such as radio beacons and hidden transmitters, traditional detection techniques based on spectral analysis or power measurement are often insufficient. These modern devices employ low-power transmission, frequency agility, and signal masking to avoid detection. To address this challenge, the authors propose a statistically robust approach rooted in Bayesian inference, which allows for the integration of prior knowledge about signal characteristics and noise behavior. The methodology formalizes the detection task as a binary hypothesis test: the presence (H₁) or absence (H₀) of a dangerous signal in the observed data. By applying Bayes' theorem, the model updates prior probabilities with empirical observations, enabling more accurate and adaptive decision-making under uncertainty. The study derives key performance metrics, including false alarm probability, signal detection probability, and overall error probability, demonstrating how these indicators improve with the incorporation of additional signal features. Simulation results show that increasing the number of detection parameters from four to seven raises the success rate of identifying dangerous transmissions from 80% to 95%, confirming the effectiveness of the proposed method. This Bayesian framework enhances the reliability and precision of radio monitoring systems, particularly in complex electromagnetic environments where classical methods fail. The research contributes to the field of information security by offering a principled and flexible solution for countering technical espionage and preventing unauthorized data leakage via radio channels. The proposed method can be implemented in practical operations of technical protection services, significantly improving the efficiency of signal detection and strengthening the overall security posture of critical information infrastructure.
Information has become one of the most valuable economic assets that influence the competitiveness of enterprises, government institutions, and other entities in modern society. The acquisition of confidential information without direct physical access has evolved into a new form of technological activity known as "technical espionage." Among the most common methods for acquiring sensitive data is the use of specialized technical means designed to covertly obtain and transmit data via radio channels. These devices are often referred to as radio beacons, radio bugs, or covert listening devices.
Radio beacons can vary significantly in their design: from simple analog transmitters to complex digital systems equipped with data storage modules, remote control capabilities, encryption, and environmental adaptability. The primary goal of such devices is to ensure maximum concealment of their operation. This is achieved through the use of low-power transmitters, careful selection of operating frequencies, limited transmission duration (activation only when necessary), and the application of signal masking techniques.
As a result, the challenge of detecting such devices becomes increasingly relevant, especially at facilities where critical or classified information is stored or processed. Traditional detection methods based on spectral analysis, power measurement, or visual inspection have limited effectiveness when modern concealment technologies are employed. Therefore, researchers are increasingly turning to statistical approaches—particularly hypothesis testing—as a foundation for building automated radio monitoring analysis systems.
Hypothesis testing is one of the fundamental statistical tools used to verify assumptions about the parameters of random processes. In general, it involves comparing two mutually exclusive hypotheses: the null hypothesis (H₀) and the alternative hypothesis (H₁). The null hypothesis assumes no significant changes or relationships in the process under study, while the alternative suggests their presence. Based on collected data, a statistical analysis is performed to determine whether the null hypothesis should be accepted or rejected.
In the context of radio monitoring, this method can be applied to detect anomalies in the spectrum that may indicate the presence of illegal transmissions. For instance, if the background noise level in a certain frequency band significantly exceeds the expected level, it may suggest the presence of a hidden transmitter. Thus, hypothesis testing becomes an important tool for automating the analysis of radio environment conditions.
According to [
Works [
Studies [
A key distinction of the Bayesian approach is that model parameters are treated as random variables with known or estimated prior distributions. This enables real-time adaptation of the model, which is critically important in tasks involving the detection of weak, short-term, or chaotic signals.
In works [6] and [
Although machine learning offers opportunities for data analysis automation, expert assessments and analytical models often remain more reliable under high uncertainty. This is especially true for specialized tasks such as detecting radio signals in complex electromagnetic environments.
Considering the current state of research, the limitations of existing detection methods, and the need to improve the efficiency of radio monitoring, it is scientifically justified to develop a Bayesian approach to hypothesis testing for identifying dangerous signals within a specified frequency range at information-sensitive sites.
Therefore, it is relevant to develop a Bayesian hypothesis testing method for detecting dangerous signals of a given frequency range at objects of information activity. This will enhance the effectiveness of radio monitoring systems, ensure reliable protection of information resources, and prevent the loss of confidential data..
Based on the above, the development of a method of Bayesian hypothesis testing for detecting
dangerous signals of a given frequency range at the objects of information activity is relevant.
2. Main part
In various information systems, it is often necessary to solve problems related to distinguishing
certain random processes. This primarily refers to the task of radio monitoring of a given frequency
range, digital measurement systems and calculation of parameters of dangerous noise-like signals in
technical channels of information leakage [
The tasks of random signal recognition are related to the problems of statistics, and its solution is based on the application of the theory of statistical hypothesis testing using appropriate measures (dimensions).
To consider this issue, we will present the basic information that allows us to solve the problem of observing random signals in discrete time.
Let the result of radio monitoring (observation) receive a vector x, which is the value of a vector random variable X, which takes values from the radio monitoring frequency range (observation space) Ωx.
We take into account that random signals of the radio monitoring range can be an additive mixture, a multiplicative mixture or a combined mixture.
That is, one of a given set of fully known signals, which are given by the expression S i = [S i, S 2i,...S ni]T, i 0, m −1 and noise (interference) with a given probability distribution density.
Then the task of detecting a dangerous signal is a special case of recognition when m = 2 and one of the signals is identically zero: S0 = 0.
For example, when recognizing two signals S0 and S1 against the background of combined additive V and multiplicative U noise on observation x, hypothesis testing should be carried out H 0 : X = U 0S +V , H1: X = U1S +V , (1) (2) where is U = diagU 1,U 2,...,U n a random matrix of divisions of multiplicative noises;
T V = V 1,V 2,...,V n is a random vector of additive noise divisions.
The task of testing the hypotheses described by expression (1) can be presented in a parametric form.
Let the random variable ϑ take values from the set Ωϑ = {0;1}. An available implementation would be a random variable described by the expression It is necessary to test the hypotheses
X = (1− )(U S0 +V ) + (U S1 +V ) = = (1− )U S0 +U S1 +V
H 0 : = 0, = 1. (3) (4)
The given example shows that, given the task of detecting (recognizing) the probable value (dangerous signal) X depends on some random value (depends on the state of nature), the value of which ϑ must be determined in a specific experience.
Note that with this formulation, the tasks of detection and estimation of signal parameters do not fundamentally differ and are solved in the same way.
We will assume that the conditional distribution function F X|(x | ) = PX x | = (conditional density of the probability distribution) W x (x | ) and the density of the probability distribution W ( ) are known at the beginning of the study.
For the given example, the action space A consists of two elements: a0 and a1, which respectively mean the acceptance of the hypothesis H 0(ˆ = 0) i H1(ˆ = 1).
The solution space D consists of all mappings d: Ωx → A of the vector of observations into available actions. Thus, the frequency space of radio monitoring is divided into two areas: x = x | d(x) = a0
acceptance of hypothesis H0 (commitment of action a0 and the area x = x | d(x) = a1 } acceptance of hypothesis H1 (commitment of action а1). The task of optimal signal detection synthesis is to perform this breakdown. Note that the regions and may be disjoint.
With this formulation of the task, each action is assigned a mutually unambiguous assessment of the state (parameter) of nature, therefore the space A and Ωɵ can be equated: А = Ωɵ. Each action (decision about the value of the random parameter Ωɵ in a specific experience) is accompanied by losses, which are described by the loss function L : A → R+ R — a set of real positive numbers. The loss function maps the estimate of this parameter to each true value of the state (parameter) of nature Ωɵ. Since the decision ˆ = ˆ can be accompanied by errors, in the event of an error, the person making the decision suffers losses, which are described by the loss function. It is clear that the loss function is an integral function. At the same time, the losses in the case of a correct decision should be greater than the losses in the case of a wrong decision
We assign a risk to each solution d = d(x) and the state of nature . r(d*) = mindD R( ,d (x)W ( )d ( )
It is possible to determine that the Bayesian decision function can be found from the condition of minimum posterior risk.
To detect dangerous signals, namely to test the hypotheses of the presence of dangerous signals, we will apply the Bayes estimation method.
Bayesian hypothesis testing represents a robust statistical framework that enables researchers to assess the relative plausibility of competing hypotheses in light of observed data. Unlike classical frequentist methods, which primarily rely on p-values to reject a null hypothesis without directly quantifying the evidence in favor of alternative explanations, Bayesian hypothesis testing provides a more comprehensive and interpretable approach. It allows for the incorporation of prior knowledge or expert beliefs about the hypotheses before observing the data, making it especially valuable in domains where such information is available or critical for decision-making.
In this framework, each hypothesis is assigned a prior probability distribution that reflects existing knowledge or assumptions regarding its likelihood. Once empirical data are collected, Bayes' theorem is applied to update these prior probabilities, yielding posterior probabilities that quantify the degree of belief in each hypothesis after considering the observed data. This process not only supports hypothesis evaluation but also facilitates model comparison and uncertainty quantification in a probabilistically coherent manner.
A key feature of Bayesian hypothesis testing is its ability to compute the Bayes factor — a
quantitative measure of the strength of evidence favoring one hypothesis over another. The Bayes
factor is defined as the ratio of the marginal likelihoods of the data under two competing hypotheses,
weighted by their respective prior probabilities. When the Bayes factor exceeds 1, it indicates that
the data provide more support for the first hypothesis compared to the second; conversely, values
below 1 suggest stronger support for the alternative hypothesis [
This methodological advantage makes Bayesian hypothesis testing particularly suitable for
applications in fields such as signal processing, cybersecurity, and information protection, where
decisions must often be made under uncertainty and with limited data. For instance, in the detection
of covert radio signals or anomalies in electromagnetic environments, Bayesian techniques can
improve classification accuracy by integrating prior knowledge about signal characteristics and
noise behavior [
Characteristics of the detector. Under the condition A = Ωɵ = {0;1}), the main characteristics of the detector are:
a) the probability of a false alarm ɑ = P {d(X) = 1 | ɵ = 0}, which is equal to the probability of accepting the hypothesis H1 about the presence of a useful signal while there is no useful signal; b) the possibility of passing a signal β = P{d(X) = 0 | ɵ = 1}, which is equal to the probability of accepting the hypothesis H0 about the absence of a useful signal while a useful signal is present; c) probability of correct detection Qd = P {d(X) = 1 | ɵ = 1} = 1-β, is equal to the probability of accepting the hypothesis H1 about the presence of a useful signal while the useful signal is actually present; d) the probability of a complete error Qd = ɑР { ɵ = 0} + βР { ɵ = 1}.
The quantity ɑ is called the level of significance of the criterion d(x), and the quantity Qd is called the power of the criterion.
Bayesian hypothesis testing, adapted for the detection of whistleblowing signals, is a powerful and flexible statistical method for detecting dangerous signals of a given frequency range, which can help information security professionals make more informed decisions and draw more accurate conclusions. In general, this method can take into account complex models with many parameters and hypotheses that may be difficult to analyze using classical methods.
The basis of the decision-making method in probabilistic-statistical research is a mathematical model of the investigated process, which is characterized by its structure. A correct assessment of the structure makes it possible to make a correct decision based on such a model.
The concept of the structure of a mathematical model includes the following elements [
3. nonlinearity and its type (nonlinearity with respect to variables or non-linearity with respect to parameters); 4. the time (or lag) of delay (at the entrance) and its assessment; 5. disturbance and its type (deterministic or random, type of distribution, probability distribution parameters); 6. restrictions on model variables and parameters.
Let’s consider a practical application. Conducted radio monitoring and detected, for example, 52 unknown random signals. We denote by A the event which means that a signal exceeding the amplitude threshold was detected from these signals, and by B – the event which means that a signal of unknown frequency modulation was detected. Obviously, these events are dependently related, since their intersection means that we have detected an unknown signal, i.e. A ∩ B={unknown signal}.
Thus, the probability that we detect an unknown signal of unknown frequency modulation is
Thus, the probability of detecting an unknown signal from an unknown frequency-pulse modulation will be 80%.
How can we take not four signs of detection of dangerous signals, signals which may be signals of means of secretly obtaining information, but more, for example, five, then six and seven signs. That should significantly increase the probability of detecting random signals. This hypothesis was verified by simulation. We leave other conditions for the analysis unchanged. Then we get for five That is, the probability became 85%, which corresponds to theoretical statements.
If we use not five, but six signs of detection when detecting the signals of radio jamming devices, with unchanged initial conditions, we will get
That is, the probability became 90%, which also corresponds to theoretical statements.
If we use not six, but seven signs of detection when detecting the signals of radio jamming devices, with unchanged initial conditions, we will get
That is, the probability became 95%, which also corresponds to theoretical statements.
It should be borne in mind that there are many parameters for detecting radio signals. Therefore, probabilities must be carefully applied in mathematical calculations.
For a visual proof of the proposed method, we present a graphic representation. A graphic presentation of the results of the methodology is presented in Fig. 1. 0,90 0,85 0,80 0,75 0,70 4 5 6 7
On the x-axis, the number of detection parameters increases incrementally from four to seven. These parameters may include characteristics such as amplitude threshold exceedance, frequency modulation type, signal duration, spectral density distribution, and temporal correlation with known interference patterns. The y-axis represents the probability of signal detection expressed as a percentage.
As shown in the figure, when only four detection features are applied, the probability of identifying a dangerous signal reaches approximately 80% . With the inclusion of a fifth feature, this probability rises to 85% , indicating improved accuracy due to additional contextual information. Further enhancement is observed when six features are utilized, resulting in a detection probability of 90% . Finally, with the integration of a seventh detection parameter, the success rate reaches 95% , demonstrating that each added characteristic significantly contributes to the overall effectiveness of the detection process.
This trend confirms the theoretical assumption that increasing the number of relevant signal features enhances the reliability and precision of the decision-making mechanism based on Bayesian hypothesis testing. It also supports the practical applicability of the method in real-world scenarios where early and accurate detection of unauthorized transmissions is critical for information security.
Based on the conducted research of hypothesis testing methods with the aim of their application for detecting dangerous signals within a specified frequency range, it has been proven that the adapted Bayesian hypothesis testing method offers significant advantages over traditional classical approaches. This method provides higher accuracy in detecting dangerous radio signals, especially under conditions of uncertainty and in the presence of complex-structured noise.
The Bayesian approach enables specialists in information security not only to formalize the decision-making process but also to consistently update their prior beliefs based on new empirical data. This results in more substantiated, reliable, and flexible conclusions, which are critically important in tasks related to the detection of covert information-gathering devices. Unlike classical methods, which rely on p-value analysis and often fail to provide a quantitative measure of the strength of evidence, Bayesian methodology allows for a quantitative assessment of hypothesis probabilities, offering richer informational support for decision-making.
Simulation results have shown that the use of additional signal parameters — increasing from four to seven — during hypothesis testing increases the probability of detecting dangerous signals from 80% to 95%. This demonstrates the effectiveness of the proposed method. Such an improvement of 15% is significant and confirms the theoretical assumptions regarding the advantages of the Bayesian approach under real-world radio monitoring conditions.
Thus, the advantages of the adapted Bayesian hypothesis testing method for detecting dangerous signals within a given frequency range unquestionably confirm the feasibility of its implementation in the practical operations of technical information protection services. The proposed approach can be successfully applied to enhance the efficiency of radio monitoring systems, ensure the integrity and confidentiality of information, and counteract technical channels of data leakage.
The authors have not employed any Generative AI tools. [6] Oleksandr Laptiev, Nataliia Lukova-Chuiko, Serhii Laptiev, Tetiana Laptieva, Vitaliy Savchenko, Serhii Yevseiev. Development of a Method for Detecting Deviations in the Nature of Traffic from the Elements of the Communication Network. International Scientific And Practical Conference “Information Security And Information Technologies”: Conference Proceedings. 1319 September 2021. Kharkiv – Odesa, Ukraine. Р.1-9 ISBN 978-966-676-818-9.