Primary user Emulation Attack Defense in Filter Bank based Cognitive Radio

Background/Objectives: The spectrum scarcity problem arising due to reckless development in wireless communication can be addressed using cognitive radio technology. An important step in cognitive radio technology is spectrum sensing and associated with that is an attack called primary user emulation attack. Methods/Statistical Analysis: A two channel Quadrature Mirror Filter (QMF) bank is employed for a single user spectrum sensing. The energy detection method is used as reference for comparing the performance of the filter bank method in the presence of attackers. Existing approaches like Neyman-Pearson Criterion, Improved Detection Scheme with Double threshold and Location Verification Method for detecting PUE attacks were examined. A new method which combines improved detection scheme and location verification method is proposed for detecting PUE attacks. Findings: The simulation result shows that the filter bank method shows better performance than the energy detection method in the presence of attackers. The probability of detection of PUE attacks using improved detection scheme and location verification method for the filter bank method and energy detection method was analyzed and found out that the filter bank based spectrum sensing method outperforms energy detection method. By incorporating AND rule logic, OR rule logic and Alternate logic approach into the filter bank spectrum sensing technique, the probability of detection of PUE attack was investigated and it is seen that the probability of detection has increased to 0.98 in FB method at SNR = 1 dB when employing an alternate approach. Application/Improvements: The feasibility of deploying the filter bank method integrated with the alternate logic is to be tested using Universal Software Radio Peripheral (USRP) module.


Introduction
The whole world is now moving towards wireless. Almost everything we touch, every aspect of our lives nowadays, has a wireless component to it. This wireless technology has become the most stimulating areas of telecommunications and networking. As a result, there arises the problem of spectrum scarcity. In order to tackle this issue, CR network was proposed as a technology to access the spectrum in an effective and adaptable manner so as to increase spectral efficiency. A CR network consists of PU's and SU's, where SU's are allowed to access the frequency bands allotted to PU's without upsetting them in an opportunistic manner 1 . There are four main functions in CR -spectrum sensing, spectrum management, spec-trum mobility and spectrum sharing. Among the four functions, spectrum sensing is the foremost step taken to identify the white spaces. CR nodes opportunistically engage these white spaces by operating across them without interfering with the PU's. The SU's has to vacate the occupied band when the PU begins to transmit across this frequency band. All SU's has equal right to access unoccupied band when there is no active PU communication.
The SU will act as MU by modifying the air interface, thereby mimic the PU's characteristic and gets the same privilege as the PU. Therefore, the SU's has to vacate the occupied band for the MU trusting that it is a PU. Hence, the MU gets unequaled access to the PU's band. This kind of attack against CR networks is called as PUE attacks. PUE attacks are unique to CR networks in which the intimidating user takes the advantage of the integral decorum in CR networks so that the authentic SU has to evacuate the spectrum band. The presence of PUE attack may severely affect the performance of CR networks. The consequence of PUE attacks is band width waste, QoS degradation, connection unreliability, denial of service and interference with the primary user. A PUE attack can happen while the spectrum sensing is performed by using cyclostationary, energy, matched filter or FB detection method. In this work, a FB based detection method is employed as it is considered as an optimum waveform for the 5G system 2 . An Improved Energy Detection Scheme based on Channel Estimation and implementation of energy detection scheme was discussed 3,4 . Similarly Filter Bank Multicarrier (FBMC) can be used as an integrated tool for data communication as well as channel sensing. An illustration of the launching of a PUE attack on CR network is shown in Figure 1. In 5 , the author have incorporated authentication scheme to combat a PUE attack against CR users. A hybrid machine learning method for malicious activity or policy violations in a network was proposed 6 . The author proposes a new mechanism based on physical layer network coding to detect the emulators 7 . In 8 , a PUE attack on ED method using Neyman -Pearson composite hypothesis test was discussed. A survey on security aspects in software defined radio and CR Networks was elaborated 9,10 . In 11 , the author proposes an approach that estimates the attack strength and innovatively applies in a Neyman-Pearson or likelihood ratio test to improve collaborative sensing performance. In 12 , authors has focused on Cooperative Spectrum Sensing (CSS) for double threshold improved energy detector. The vulnerabilities present in CR, attack classifications and their effect on the working of cognitive radio network are discussed 13 . A threat detection technique based on localization of primary signal was proposed 14 . The inclusion of fusion logic into cooperative spectrum sensing was discussed 15 .
The paper is organized as follows. In section 2, the basics of the FB based detection method are presented. The system model for PUE attack to frame the problem is discussed in section 3. The section 4 gives the existing approaches for PUE attacks. In section 5, a new approach for defending PUE attack in CR network is proposed. In section 6, the simulation results and discussion are provided, while section 7 concludes the paper.

Filter Bank based Detection Method
The basic building blocks for Multirate signal processing are decimation and interpolation 16 . The process of reducing the sampling rate by an integer factor M is called decimation. The process of increasing the sampling rate by an integer factor L is called interpolation. The down sampling process and up sampling process is shown in Figure 2(a) and 2(b). The filter bank is set of band pass filters with either a common input or a summed output. The decomposition and reconstruction process is called the analysis filter bank and synthesis filter bank. Three basic operations are used in filter banks: linear filter, down sampling and upsampling. The function of spectrum sensing can be performed using an analysis filter bank. A M-band analysis filter bank is shown in Figure  2(c). The analysis filter bank is used to decompose the input signal into a set of subband signal, where each subband occupies a portion of the original frequency band. A two channel Quadrature Mirror Filter (QMF) bank is adequate for a single user spectrum sensing. A block diagram of spectrum sensing based on the analysis filter bank under single user scenario is shown in figure 3.The signal received from the PU is divided into two subbands and filtered using low pass and high pass filter with equal pass band respectively, and are down sampled to reduce the sample rate by an integer M. The total energy of the down sampled subband signals is added and compared with the predefined threshold to find whether PU is present or not. Vol 10 (1) | January 2017 | www.indjst.org Sabiq P.V. and D. Saraswady

System Model For PUE Attack Detection
A system model for analyzing the PUE attacks is as shown in Figure 4 (a). The malicious and SU's is confined to a circular area of radius R. The PU's and SU's are separated by a distance of atleast d p . For PU detection, the method deployed for spectrum sensing is a FB based detection method. In the FB based detection method, the total energy of the down sampled subband signals is calculated and matched with the predefined threshold to find whether PU is present or not. The coordinates of the entire MU are transformed in such a way that the SU of interest lies at the origin as shown in Figure 4  This is because the probability of PUE attack on to any user in the network is the same as there is no support between SU's. Hence, here the Probability Density Function (PDF) of the signal received from one SU only is analyzed. The primary transmitter coordinates are transformed as (d p , θ p ). The MU's are present uniformly in an annular Region (R 0 , R).The amount of power received due to the transmission from PU at the SU, P r (p) can be obtained as: The PDF of the received power is calculated as Where γ is the random variable, The amount of power received at the secondary node due to the transmissions from all m MU's is calculated as Where d j -the distance between SU and j th MU. The PDF of received power is calculated as

Neyman-Pearson Criterion
To analyze the impact of the PUE attacks on CR network, Neyman Pearson composite hypothesis testing mathematical model are used. In this method, the PDF of the received signal due to transmission by the primary and the MU at the SU is calculated. In order to calculate the decision variable, the power of the signal received from the source is measured and is given by the ratio term, ʌ Where, P (x) is the received power from the MU calculated using (5) and The ratio term is then compared with predefined threshold and from that the SU decides the following Λ ≤ λ : D 1 : Primary user transmission is taking place Λ ≥ λ : D 2 : PUE Attack is in progress There can be two possibilities • The SU may take the decision D 2 when M 1 is true.
• The SU may take the decision D 1 when M 2 is true.
The errors associated with this probability are termed as Missed Probability: P {D 2 |M 1 } = Probability of taking decision as D2 when the hypothesis M 1 is true.
False Alarm Probability: P {D 1 |M 2 } = Probability of taking decision as D 1 when the hypothesis M 2 is true.

Improved Detection Scheme with Double Threshold
By using a conventional FB method which uses single threshold value, it is difficult to differentiate between PU signal and PUE attacker. The power level of the signal received at the SU receiver is measured. Then it is compared with that from the true PUs in order for a CR network to decide whether the signal originates from an attacker or not. The test statistics in the case of FB method is calculated as However, a FB detector is not dynamic enough to challenge an advanced PUE attack. Hence, by using a double threshold value called improved detection scheme is employed. The conditions which are used to differentiate between PU and PUE attacker is given as follows.
Test statistics < Threshold1, only noise Threshold1< Test statistics < Threshold2, Primary user Test statistics > Threshold2 PUE Attacks In order to distinguish a PUE attacker from a real PU, an improved detection scheme with two energy thresholds, denoted by and are used. Here, λ1 < λ 2 and is the earlier threshold in a conventional FB method. When the received signal energy, E < λ 1 , then it is said that there is no PU or PUE attacker. If the signal energy is between the two threshold λ 1 andλ 2 , then there is presence of PU. When the signal energy is above λ 2 , then it indicates PUE attack.

Location Verification Method
Location verification is another defense technique which is used to distinguish PU and PUE attacker based on the distance. There are two location verification schemes -Distance Ratio Test and Distance Difference Test. To perform the analysis some assumptions are considered. The assumptions are, • All users should broadcast information regarding their location. • All the users have a predefined transmit power level and are known to each other. A ground reflection model is used for calculating the power level of the received signal. The received power level is given by equation (8).
Where, =Transmit power level, h t = Height of a transmitter h r = Height of a receiver G t = Transmitter antenna gain G r = Receiver antenna gain L = System loss factor d = Distance between transmitter and receiver Here, the distance between a SU and other users is calculated based on the coordinates location and received power level. The user is a truthful user, when the distance calculated from both these technique matches. Otherwise, it is a malicious user.

Distance Estimate based on Location Coordinates
The distance between the users can be calculated based on the location coordinates. Let us assume (x, y) is x and y coordinates of a SU and (x1,y1) is x and y coordinates of an existing primary transmitter. The distance between them d, is given as The simulation is performed based on the assumption that the location coordinates of all users are broadcasted. Hence, using eq (9) it is possible to calculate the distance between any users.

Distance Estimate based on Received Power Level
In Received Signal Strength (RSS) approach, the parameter on which the received power level is depended is the transmitting power and distance on the path between two devices. Knowing the transmit power level; it is possible to calculate the distance between users from the measured received power level. Equation (10) gives the received power level, P r , for a specific transmit power level P t . Assume h t , h r , G t , G r and L are constant and equal to one. Therefore, the received power level can be expressed as a function of transmit power level and distance.
The distance between the user can be approximated based on the received power level and known transmit power level as 4 t r P d P = (11) If d 1 , the distance estimated from location coordinates and d 2 , the distance estimated from the received signal power is approximately equal, then it is decided that the signal is from the legitimate PU. Otherwise, a malicious user is in attack. The accuracy of distance calculation will depend on the presence of noise level in the signal received. However, statistically, the distance d 1 and d 2 calculated should come close.

Proposed Approach for PUE Attack Detection
The performance of existing method which employs double threshold for FB based spectrum sensing technique to detect the presence of the PU is pitiable at low signal to noise ratio. At the same time the location verification method also gives poor performance at low SNR. In order to detect PU's in the presence of PUE attack, a new method is suggested which combines improved detection scheme and location verification method. This approach is called fusion approach. Hence the probability of detecting the presence of PU can be increased. The malicious user cannot mimic the PUs location coordinates and transmit power level. Therefore, the authenticity of PU signal can be confirmed based on the distance measurement taken out from location coordinates and the signal power level received. Three different combinations are possible by using improved detection method and location verification method. They are discussed below.

AND Rule Logic
The logic is to perform both improved detection scheme and location verification method simultaneously. If both the method says that the signal is from the attacker then the final decision is made that, it is from the attacker. The flow chart for AND rule logic is as shown in Figure 5.

OR Rule Logic
The flowchart for OR rule logic is as shown in Figure 6. Here, both improved detection scheme and location verification method are carried out simultaneously. If any one of the method say that the signal is from the attacker, the final decision is made that the signal is from the attacker.

Alternate Logic
The improved detection scheme is performed initially and local decision (d) is made. If d = 0, the final decision is made that the signal is from the PUE attacker. Otherwise, it will perform location verification and match the estimated location with the content in the database. Here if d = 0, the final decision is made that the signal is from the PUE attacker. Else the final decision is made that the signal if from real PU. The flow chart for the alternate logic is as shown in Figure 7.

Result and Discussions
The proposed method was simulated in Matlab. In order to simulate FB based spectrum sensing method, the values for the system parameters considered are listed in Table 1. The values of system parameters considered for simulating PUE attacks in CR network is listed in Table 2. It is difficult to differentiate between PU signal and PUE attacker when a conventional FB method with single threshold value is used. Therefore, an improved detection scheme which uses a double threshold value is employed in order to detect PUE attackers. Two threshold values are used instead of a single threshold to make local decision in the double threshold FB method. Double threshold FB offers a benefit over conventional FB with respect to bandwidth. The thresh-old1 value is calculated using equation (1) and threshold 2 is decided such that the difference between thresholds is minimum or no decision region shown in Figure 8 should be less. For the reference purpose, ED method is used in order to compare the performance of the FB method in the presence of attackers. Figure 9 shows the comparison between ED method and FB method in the presence of a PUE attacker using improved detection scheme. The FB method shows better performance than the ED method. The probability of correctly detecting the presence of the attacker using the location verification method is shown Figure 10. This method works only, when the distance coordinates and the transmit power of the primary transmitter is known to all the users.  The performance of the improved detection scheme and location verification method is poor in low signal to noise ratio values. So by combining the improved detec-tion scheme with the location verification method the probability of detecting the presence of the PU in the presence of the attacker can be increased. There exist three different combinations when we fuse these two methods. The probability of detection versus SNR using ED method and FB method in the presence of attackers incorporating AND rule logic is plotted in figure 11. It basically illustrates how well the AND logic rule, introduce a better defense technique towards PUE attacks. Also, it explains that the FB technique along with AND rule logic works jointly to demolish PUE attacks better than ED technique.
The final decision of PUE attack is made when any one of the method says that the signal is from PUE attacker and this is called OR rule logic. OR rule logic was performed for both ED and FB method and it was found that again FB method has a better probability of detection in the presence of attackers. Figure 12 shows the PUE attack defense in the ED and FB techniques using OR Rule Logic. Comparing Figure 11 and Figure 12, it is shown that the employment of OR Rule logic introduce better probability of detection at respective SNR. For example, at SNR = 1 dB, the probability of detection of FB method is 0.28 when incorporating AND rule logic and it is 0.5 when incorporating OR rule logic. The percentage increase in probability of detection of a PU signal in the presence of PUE attacks is 78.6. As stated earlier, an alternate approach for defending PUE attack is to perform improved detection scheme at first and decide the presence of attacker based on the out-Vol 10 (1) | January 2017 | www.indjst.org Sabiq P.V. and D. Saraswady come. If unable to decide the presence of the attacker, then go for location verification method and make the final decision on the presence of PUE attacks. Using alternate logic the performance of ED method and FB method in the presence attackers is shown in Figure 13. Again the FB method is having better performance than ED method. The probability of detection has increased to 0.98 in FB method at SNR = 1dB. Figure 13. PUEA Defense in ED and FB method using alternate logic.
A comparison of different defense techniques discussed in this paper is examined for FB method alone and a graph between probability of detection versus SNR is plotted as shown in figure 14. By employing alternate logic there is a better probability of detection in the presence of attackers. Hence, by integrating alternate logic with FB method we can shield PUE attacks in a CR network.
A numerical comparison between ED method and FB method when integrating different defense techniques is enumerated in Table 3. The table highlights the probability of detection versus SNR for different defense techniques. From the table it shows that FB method integrated with alternate logic will yield better probability of detection when compared to other combination. For example, at SNR = 1 dB, the increase in probability of detection when integrating FB method with improved detection and alternate logic is 0.75. Similarly, at SNR = 5 dB, the increase in probability of detection is 0.1. It also states that the FB method produces a better probability of detection at low SNR when compared to ED method. Hence FB method integrated with the alternate logic can be deployed in CR network for shielding PUE attacks.

Conclusions and Future Work
In this work, PUE attacks on a CR network are studied. The spectrum sensing techniques employed here is ED method and FB method. Firstly, a double threshold scheme was integrated with each spectrum sensing