MISP now supports Signal Metadata Format Specification SigMF

As one of the outcomes of GeekWeek8, MISP now supports a new set of features useful for handling radio frequency information in the Signal Metadata Format Specification) (SigMF), commonly used in Software Defined Radio (SDR), digital signal processing and data analysis applications.

SigMF

Signal Metadata Format Specification (SigMF) has emerged as a powerful tool for describing and annotating signals. It provides a standardized way to store and exchange metadata related to various signal types, enabling seamless collaboration and efficient data sharing across diverse domains.

It was designed with the intention of promoting interoperability among signal processing tools, making it easier for researchers, engineers, and data scientists to work with a wide range of signals.

SigMF metadata includes information such as signal frequency, sample rate, time stamps, annotations, and other relevant attributes that aid in comprehending the nature of the signal.

SigMF Data Handling on MISP

New Object Templates

New object templates based on the Signal Metadata Format Specification (SigMF) such as:

• SigMF Recording (.sigmf-meta + sigmf-data)
• SigMF Archive
• SigMF Expanded Recording

Implemented via PR #398.

Enriching Objects

MISP version 2.4.175 now allows enriching objects. misp-modules can handle objects and can define which template name or uuid applies to certain objects.

When defining your misp-module you can add an object template name as input to the mispattributes dictionary, example:

mispattributes = {
    'input': ['sigmf-recording'],
    'output': [
        'MISP objects'
    ],
    'format': 'misp_standard'
}

sigmf-recording is a object template name, when click on the enrichment icon ( ) in the object envelop, MISP will propose a list of possible enrichments that match that object template:

For accessing the full object in the misp-module, you can do the following:

def handler(q=False):
    request = json.loads(q)
    object = request.get("object")
    ...

Implemented via PR #9187

SigMF enrichment MISP Module

Thanks to this new object enrchment feature, a new MISP module that expands a SigMF Recording into a SigMF Expanded Recording was added, it turns some of the signals metadata items into MISP attributes so users can use MISP search and other feature and generates a waterfall plot of the signal.

Additionally, if the enrichment module is applied to a SigMF Archive, it extracts the archive into several SigMF Recording objects.

Implemented via PR #628