1.3 Illustration of PUE attacks. ((q)) Attacker User location-based method is a common and easy way to differentiate between attackers and PUs. Malicious attackers are rarely in the same place as PUs. Since the received signal strength (RSS) varies by location, it can be adopted to identify location and, by the same token, user type. Some other methods are based on statistical analysis. They use features such as signal power, spectrum occupancy time, and cyclostationarity extracted from received signals to analyze transmitters. Finally, the physical layer approaches use the hardware behaviors of transmitters or channel behaviors to detect attackers. For example, 11 Secure Spectrum Sharing with Machine Learning: Methodologies phase and frequency shifts are commonly used as transmitter fingerprints. A detection problem based on received signals is a classification problem, which ML is particularly good at solving. To detect and defend against PUE attacks, an adaptive learning-based detection method in CRN was developed in [12] by analyzing the transmitters' power features. Specifically, cyclostationary feature analysis was used to differentiate attackers from low-power PUs. The proposed method also estimated the distance variance and communication time to improve classification accuracy and communication rate. A k-nearest neighbor (KNN) classifier-based detection method was used to classify mali- cious users to forestall PUE attacks in [86]. KNN was trained with the parameters such as data rate, distance, power, frequency of request. Moreover, Elliptical Curve Cryptography (ECC) was applied to encrypt the data and improve network security. the proposed classi- fier achieved a higher accuracy detection performance than the Artificial Neural Network (ANN)-based method. A channel-based method that relied on the behavior of the multi-path channel was inves- tigated in [4], where the authors proposed an ML framework based on various classification models for detecting PUE attacks. It was trained/tested using four featur