SIGINT at the edge: processing architecture for forward collectors

A forward SIGINT collector lives on the wrong side of a bad data link. It sits close to the emitters of interest – which is exactly where the intelligence value is highest – but it reaches the rear enterprise only through a contested, intermittent, low-bandwidth path. The naive architecture, where the collector digitizes the spectrum and streams raw IQ rearward for central processing, collapses immediately under those conditions. Wideband collection produces gigabytes per second; the uplink might offer a few hundred kilobits. Edge SIGINT processing exists to resolve that mismatch: it moves detection, classification, and reporting onto the collector itself, so the only thing that crosses the link is compact, actionable intelligence. This article lays out the architecture – what runs at the edge, what stays in the rear, how reporting adapts to bandwidth, and how tasking stays coherent across an unreliable connection.

Why the edge, and what the link actually allows

The central constraint is bandwidth asymmetry. A single wideband front end sampling a few hundred megahertz of spectrum at complex baseband produces an IQ stream on the order of gigabytes per second. Even a modest tactical software-defined radio tuned to a 20 MHz channel generates tens of megabytes per second. No forward link – line-of-sight mesh radio, cellular bearer, or satellite relay – carries that continuously, and the links that do exist are precisely the ones an adversary will jam or degrade first.

Edge processing inverts the data-flow assumption. Instead of moving samples to the compute, it moves the compute to the samples. The collector runs the full detect-classify-report chain locally and emits structured records: a detection event is tens to low hundreds of bytes, an emitter report a few hundred. That is a reduction of three to five orders of magnitude relative to raw IQ. The second, less obvious benefit is autonomy. A collector that depends on a live link to a rear processor goes blind the instant the link drops. A collector that processes locally keeps working through link loss and forwards its backlog when the path returns.

Partitioning the pipeline: edge versus rear

The end-to-end SIGINT pipeline is the same one you would build for a fixed site – channelization, detection, classification, emitter identification, geolocation, archival, analyst workflow. The edge design question is where to cut it. A clean partition applies two tests to each stage: does it reduce the volume of data that must leave the collector, and must it respond within seconds rather than minutes. Any stage that passes either test belongs forward.

Stages that run on the collector

Channelization. The wideband stream is split into sub-bands so that downstream stages operate on narrow, manageable channels. This is the highest-throughput stage in the whole chain and the one that most reduces working data volume, so it always runs at the edge – almost always in FPGA fabric rather than on the CPU.

Signal detection. Energy detection and cyclostationary feature detection find signal segments within each channel and discard the empty spectrum between them. Detection is what turns a continuous sample stream into a sparse set of events, and that sparsification is the foundation of every bandwidth saving downstream.

Modulation classification. A compact neural classifier assigns a modulation type and confidence to each detected segment. The architecture mirrors the fixed-site approach covered in our walkthrough of SDR signal processing pipelines, but the model is quantized and pruned to fit an embedded accelerator's power and latency budget.

Watchlist and parametric matching. Detected signals are matched against a locally cached emitter parameter list and tasking watchlist. A watchlist hit is the highest-value event a forward collector produces and must be surfaced in seconds, which is precisely why it cannot wait on a round trip to the rear.

Stages that stay in the rear

Multi-node geolocation. TDOA and FDOA geolocation fuses time- and frequency-of-arrival measurements from several collectors. No single forward node can compute it; the edge contribution is a precise time-of-arrival tag and accurate node position, which the rear fuses across the network.

Full-corpus emitter identification and RF fingerprinting. Re-identifying a specific transmitter across intercepts separated by time and geography requires the complete emitter database and fingerprint history. That corpus is too large to cache forward, so deep identification runs centrally; the collector ships the features the rear needs to match.

Long-term archival, trend analysis, and cross-program correlation. These are inherently corpus-dependent and have no latency pressure. They belong in the rear, where storage and analyst tooling live.

One stage sits on the boundary and deserves explicit thought: IQ retention. The collector cannot keep everything, but discarding the raw samples behind a high-value detection throws away the only data a rear analyst could re-examine. The pragmatic rule is selective, detection-triggered retention – when a detection hits the watchlist or exceeds a confidence threshold, the collector preserves a short ring-buffered IQ snippet around the event and queues it for opportunistic upload. Everything else is summarized to a detection record and the samples are dropped. This keeps the forward footprint small while preserving the rare captures worth a closer look in the rear.

Edge compute: hardware that fits the platform

A forward collector cannot carry the GPU clusters a rear processing center uses. Dismounted and vehicle-mounted nodes operate within power envelopes of roughly 15 to 40 watts, with hard thermal and size limits. The practical answer is a heterogeneous embedded system-on-chip: FPGA fabric for fixed-function channelization and detection, a CPU for control and reporting logic, and a low-power NPU or small GPU for neural inference. The selection trade-offs here parallel those discussed in our guide to edge AI hardware selection for defense.

The division of labour on the chip matters as much as the chip choice. Channelization and energy detection are offloaded to FPGA logic, where they run at the full sample rate without touching the CPU. That frees the NPU and CPU to handle classification and reporting. The classifier itself is quantized to int8 and pruned so it fits the accelerator's memory and sustains the channel rate the FPGA feeds it. A model that runs comfortably on a rear GPU will not fit unchanged – edge model engineering is a first-class part of the architecture, not an afterthought.

Thermal behaviour, not peak compute, usually sets the real limit. A node sealed in a ruggedized enclosure has no fan and dumps heat through its case, so the accelerator throttles long before it reaches the clock speed its datasheet advertises. The architecture must be sized for sustained, throttled throughput in the worst-case ambient temperature the platform will see, with detection and watchlist matching protected as the last stages to be shed under thermal pressure. Designing to the burst figure produces a collector that works on the bench and fails in the field at midday.

Bandwidth-aware reporting

Once the collector produces compact records, the next problem is getting them rearward across a link whose capacity varies from moment to moment and frequently drops to zero. Bandwidth-aware reporting treats the uplink as a scarce, measured resource rather than an always-available pipe.

Every outbound record carries a priority computed from three factors: how strongly it matches current tasking, the classifier's confidence, and whether it hit a watchlist entry. A scheduler on the collector continuously measures available uplink throughput and dispatches the highest-priority records first. When bandwidth is scarce, low-priority detections are deferred or rolled up into periodic summaries rather than sent individually. Large items – IQ snippets retained for a high-value detection – are queued behind text reports and released only when surplus capacity appears.

Link loss is treated as a normal operating state, not an error. When the path drops, reports spool to a local durable store. On reconnection, the collector drains that backlog newest-and-highest-priority first, on the reasoning that a fresh watchlist hit matters more than a stale low-confidence detection from an hour ago. This ordering policy is a deliberate design choice: a strict FIFO queue would deliver the least useful intelligence first after a long outage.

Tasking sync across an unreliable link

Tasking is the mirror image of reporting: requirements flow down from the rear, and the collector must apply them without depending on a continuous session. The architecture uses a small, versioned tasking document – frequency bands to monitor, signal types of interest, watchlist emitters, and geographic priorities – that the collection manager publishes and each collector caches locally. The collector acts on its cached tasking autonomously; disconnection does not stop it collecting against the last known requirements. The broader tasking lifecycle, deconfliction, and prioritization are covered in our article on SIGINT collection management.

On reconnection, the collector pulls the latest tasking version, applies any changes, and reports its coverage – time on frequency per band – so the manager can see gaps and re-task. The protocol reconciles by version number rather than assuming an unbroken connection, so it converges correctly no matter how the link comes and goes. This is the discipline that keeps a distributed SIGINT network coherent: tasking down, coverage and detections up, both sides reconciling state on every reconnect.

Autonomy at the edge also needs a sensible default for the case the rear never wanted to think about: prolonged isolation. A collector cut off for hours should not drift or stop; it should keep applying its last valid tasking, keep prioritizing against that tasking, and keep spooling. Equally, it needs a guardrail against stale orders – if cached tasking is older than a configured horizon, the collector flags every report it produces as having been generated under expired tasking, so the rear can weight those detections appropriately once they arrive. Treating isolation as expected, rather than exceptional, is what separates a collector that survives a contested environment from one that merely tolerates a good day.

Integrating with the rear enterprise

The edge collector is one node in a larger architecture, and the interface between forward and rear is a contract that must be defined before implementation. Three properties make that contract robust. First, the record schema crossing the link is stable and versioned, so a collector running older firmware still interoperates with an upgraded rear. Second, every forward record is self-describing – it carries the collector's identity, position, precise timestamp, and the tasking version it was produced under – so the rear can fuse it correctly without out-of-band context. Third, the link layer is treated as untrusted and intermittent end to end: records are signed, deduplicated on receipt, and idempotent, so replaying a spooled backlog after reconnection never corrupts the rear corpus.

Done well, the forward collectors and the rear enterprise form a single system that degrades gracefully. Each collector remains independently useful when isolated, contributes precise measurements that only the network can fuse, and stays in step with central tasking despite a hostile link. That resilience – not raw throughput – is the measure of a good edge SIGINT architecture.