Due to the publicly known and deterministic characteristic of pilot tones, pilot authentication (PA) in multi-user multi-antenna orthogonal frequency-division multiplexing systems is very susceptible to the jamming nulling spoofing behaviors. To solve this, in this paper, we develop a hierarchical 2-D feature (H2DF) coding theory that exploits the hidden pilot signal features, i.e., the energy feature and independence feature, to secure pilot information coding which is applied between legitimate parties through a well-designed five-layer hierarchical coding model to achieve secure multiuser PA (SMPA). The reliability of SMPA is characterized using the identification error probability (IEP) of pilot encoding and decoding with the exact closed-form upper and lower bounds. However, this phenomenon of non-tight bounds brings about the risk of long-term instability in SMPA. Therefore, a reliability bound contraction theory is developed to shrink the bound interval, and practically, this is done by an easy-to-implement technique, namely, codebook partition within the H2DF code. In this process, a tradeoff between the upper and lower bounds of IEP is identified and a problem of optimal upper and lower bound tradeoff is formulated, with the objective of optimizing the cardinality of sub-codebooks such that the upper and lower bounds coincide. Solving this, we finally derive an exact closed-form expression for IEP, which realizes a stable and highly reliable SMPA. Numerical results validate the stability and resilience of H2DF coding in SMPA.
@cite_18: 
@cite_26: In this paper, we investigate secure and reliable transmission strategies for multi-cell multi-user massive multiple-input multiple-output systems with a multi-antenna active eavesdropper. We consider a time-division duplex system where uplink training is required and an active eavesdropper can attack the training phase to cause pilot contamination at the transmitter. This forces the precoder used in the subsequent downlink transmission phase to implicitly beamform toward the eavesdropper, thus increasing its received signal power. Assuming matched filter precoding and artificial noise (AN) generation at the transmitter, we derive an asymptotic achievable secrecy rate when the number of transmit antennas approaches infinity. For the case of a single-antenna active eavesdropper, we obtain a closed-form expression for the optimal power allocation policy for the transmit signal and the AN, and find the minimum transmit power required to ensure reliable secure communication. Furthermore, we show that the transmit antenna correlation diversity of the intended users and the eavesdropper can be exploited in order to improve the secrecy rate. In fact, under certain orthogonality conditions of the channel covariance matrices, the secrecy rate loss introduced by the eavesdropper can be completely mitigated.
@cite_4: 
@cite_7: This paper describes a new class of attacks specific to cognitive radio networks. Wireless devices that can learn from their environment can also be taught things by malicious elements of their environment. By putting artificial intelligence in charge of wireless network devices, we are allowing unanticipated, emergent behavior, fitting a perhaps distorted or manipulated level of optimality. The state space for a cognitive radio is made up of a variety of learned beliefs and current sensor inputs. By manipulating radio sensor inputs, an adversary can affect the beliefs of a radio, and consequently its behavior. In this paper we focus primarily on PHY-layer issues, describing several classes of attacks and giving specific examples for dynamic spectrum access and adaptive radio scenarios. These attacks demonstrate the capabilities of an attacker who can manipulate the spectral environment when a radio is learning. The most powerful of which is a self-propagating AI virus that could interactively teach radios to become malicious. We then describe some approaches for mitigating the effectiveness of these attacks by instilling some level of "common sense" into radio systems, and requiring learned beliefs to expire and be relearned. Lastly we provide a road-map for extending these ideas to higher layers in the network stack.
@cite_28: We propose joint spatial division and multiplexing (JSDM), an approach to multiuser MIMO downlink that exploits the structure of the correlation of the channel vectors in order to allow for a large number of antennas at the base station while requiring reduced-dimensional channel state information at the transmitter (CSIT). JSDM achieves significant savings both in the downlink training and in the CSIT uplink feedback, thus making the use of large antenna arrays at the base station potentially suitable also for frequency division duplexing (FDD) systems, for which uplink downlink channel reciprocity cannot be exploited. In the proposed scheme, the multiuser MIMO downlink precoder is obtained by concatenating a prebeamforming matrix, which depends only on the channel second-order statistics, with a classical multiuser precoder, based on the instantaneous knowledge of the resulting reduced dimensional “effective” channel matrix. We prove a simple condition under which JSDM incurs no loss of optimality with respect to the full CSIT case. For linear uniformly spaced arrays, we show that such condition is approached in the large number of antennas limit. For this case, we use Szego's asymptotic theory of Toeplitz matrices to show that a DFT-based prebeamforming matrix is near-optimal, requiring only coarse information about the users angles of arrival and angular spread. Finally, we extend these ideas to the case of a 2-D base station antenna array, with 3-D beamforming, including multiple beams in the elevation angle direction. We provide guidelines for the prebeamforming optimization and calculate the system spectral efficiency under proportional fairness and max-min fairness criteria, showing extremely attractive performance. Our numerical results are obtained via asymptotic random matrix theory, avoiding lengthy Monte Carlo simulations and providing accurate results for realistic (finite) number of antennas and users.
@cite_29: This paper investigates efficient jamming attacks against MIMO-enabled systems. Previous research has focused on jamming data transmissions. We instead focus on jamming channel sounding symbols, and introduce the MIMO Singularity Attack, which attempts to reduce the rank of the channel gain matrix estimate by the receiver through transmission of specific jamming signals. All MIMO systems need a method to estimate and equalize their channel, whether through channel reciprocity or sounding, and most modern OFDM-based MIMO waveforms use sounding via OFDM pilot tones. We develop the constraints associated with jamming MIMO sounding channels, and further describe how these attacks specifically impact data symbol estimates for OFDM pilot-based sounding systems.
@cite_21: Orthogonal Frequency Division Multiplexing (OFDM) uses pilot tones to estimate and equalize the channel's frequency response whose locations and values are known. This makes OFDM prone to pilot tone based jamming attacks. Our previous research analyzed such jamming attacks. This paper builds on this idea and proposes approaches to mitigate the effect by randomizing pilot tone locations. It also presents OFDM channel and equalizer model, formulates channel estimation error, and then undertakes an analysis of OFDM system for randomized pilot tones, verifying through simulation. Both analytics and simulation show that randomized pilot tone schemes perform worse when a jammer is not present but perform better in the presence of pilot tone based jammer. Of the two proposed randomization schemes, the one that constrains the distance between random tones performs better in both scenarios.
@cite_6: The pilot spoofing attack is one kind of active eavesdropping conducted by a malicious user during the channel estimation phase of the legitimate transmission. In this attack, an intelligent adversary spoofs the transmitter on the estimation of channel state information (CSI) by sending the identical pilot signal as the legitimate receiver, in order to obtain a larger information rate in the data transmission phase. The pilot spoofing attack could also drastically weaken the strength of the received signal at the legitimate receiver if the adversary utilizes large enough power. Motivated by the serious problems the pilot spoofing attack could cause, we propose an efficient detector, named energy ratio detector (ERD), by exploring the asymmetry of received signal power levels at the transmitter and the legitimate receiver when there exists a pilot spoofing attack. Our analysis shows that by setting the ratio of received signal power levels at the transmitter and the legitimate receiver as the test statistic, the detecting threshold is derived without using the knowledge of the CSI of the legitimate channel as well as the illegitimate channel. Furthermore, we study the performance of the proposed ERD in various special cases in order to obtain useful insights. Numerical results are presented to further demonstrate the performance of our proposed ERD.
@cite_19: Channel estimation attacks can degrade the performance of the legitimate system and facilitate eavesdropping. It is known that pilot contamination can alter the legitimate transmit precoder design and strengthen the quality of the received signal at the eavesdropper, without being detected. In this paper, we devise a technique which employs random pilots chosen from a known set of phase-shift keying (PSK) symbols to detect pilot contamination. The scheme only requires two training periods without any prior channel knowledge. Our analysis demonstrates that using the proposed technique in a massive MIMO system, the detection probability of pilot contamination attacks can be made arbitrarily close to 1. Simulation results reveal that the proposed technique can significantly increase the detection probability and is robust to noise power as well as the eavesdropper's power.
@cite_2: This paper considers the problem of detecting the pilot contamination attack for multi-antenna secrecy systems. The detection problem is formulated as a binary hypothesis problem and the likelihood ratio or the generalized likelihood ratio is employed as a decision statistic for the detection of the pilot contamination. Using the Neyman-Pearson criterion, we then develop several detection methods under the different assumptions of the channel and noise statistics. To be specific, the cases of interest are as follows: (i) exact knowledge of all covariance matrices, (ii) exact knowledge of the legitimate channel and noise covariance matrices, but no knowledge of the jamming channel covariance matrix and (iii) no knowledge of all covariance matrices. The performance comparison of the proposed schemes with the conventional scheme is performed by simulations.
@cite_15: Orthogonal Frequency Division Multiplexing (OFDM) uses pilot tones to estimate the channel's frequency response and perform equalization. It is commonly known that jamming pilot tones is more efficient than broadband attacks against an entire OFDM signal. This paper builds on this idea and introduces the pilot nulling attack, which is considerably more efficient than simple pilot jamming, by driving received pilot energy as close to zero as possible. This paper presents our channel and equalizer model, and then undertakes an analysis of OFDM under these attacks, verifying the assessment through simulation. For a target bit error rate of 0.4, QPSK underlying modulation, and pilot tone density of 1 8, we discover that pilot jamming is roughly 2 dB more efficient than barrage jamming, and pilot nulling is roughly 7.5 dB more efficient than barrage jamming. In all cases, pilot nulling is capable of fully denying the target signal at 4 dB of signal-to-jamming ratio by driving the QPSK bit error rate to 0.5.
@cite_13: We consider physical layer security of massive MIMO systems in TDD mode. We show that with massive MIMO a passive eavesdropper is not very dangerous and must therefore be active and attack the training phase. An attack on the training phase is potentially very harmful to the physical layer security, and we therefore investigate three different schemes for detecting the presence of an active eavesdropper. The three schemes differ in the location where the detection is done (base station, intended user, or jointly), and also in the level of system parameters that are assumed known to the base station and or intended user.
@cite_25: Existing studies on physical layer security often assume the availability of perfect channel state information (CSI) and overlook the importance of channel training needed for obtaining the CSI. In this letter, we discuss how an active eavesdropper can attack the training phase in wireless communication to improve its eavesdropping performance. We derive a new security attack from the pilot contamination phenomenon, which targets at systems using reverse training to obtain the CSI at the transmitter for precoder design. This attack changes the precoder used by the legitimate transmitter in a controlled manner to strengthen the signal reception at the eavesdropper during data transmission. Furthermore, we discuss an efficient use of the transmission energy of an advanced full-duplex eavesdropper to simultaneously achieve a satisfactory eavesdropping performance whilst degrading the detection performance of the legitimate receiver.
@cite_20: In a time-division duplex (TDD) multiple antenna system, the channel state information (CSI) can be estimated using reverse training. A pilot contamination (spoofing) attack occurs when during the training phase, an adversary also sends identical training (pilot) signal as that of the legitimate receiver. This contaminates channel estimation and alters the legitimate beamformimg design, facilitating eavesdropping. A recent approach proposed superimposing a random sequence on the training sequence at the legitimate receiver and then using the minimum description length (MDL) criterion to detect pilot contamination attack. In this paper we augment this approach with joint estimation of both legitimate receiver and eavesdropper channels, and secure beamforming, to mitigate the effects of pilot spoofing. The proposed mitigation approach is illustrated via simulations.
@cite_17: Due to the publicly-known deterministic character- istic of pilot tones, pilot-aware attack, by jamming, nulling and spoofing pilot tones, can significantly paralyze the uplink channel training in large-scale MISO-OFDM systems. To solve this, we in this paper develop an independence-checking coding based (ICCB) uplink training architecture for one-ring scattering scenarios allowing for uniform linear arrays (ULA) deployment. Here, we not only insert randomized pilots on subcarriers for channel impulse response (CIR) estimation, but also diversify and encode subcarrier activation patterns (SAPs) to convey those pilots simultaneously. The coded SAPs, though interfered by arbitrary unknown SAPs in wireless environment, are qualified to be reliably identified and decoded into the original pilots by checking the hidden channel independence existing in sub- carriers. Specifically, an independence-checking coding (ICC) theory is formulated to support the encoding decoding process in this architecture. The optimal ICC code is further devel- oped for guaranteeing a well-imposed estimation of CIR while maximizing the code rate. Based on this code, the identification error probability (IEP) is characterized to evaluate the reliability of this architecture. Interestingly, we discover the principle of IEP reduction by exploiting the array spatial correlation, and prove that zero- IEP, i.e., perfect reliability, can be guaranteed under continuously-distributed mean angle of arrival (AoA). Besides this, a novel closed form of IEP expression is derived in discretely-distributed case. Simulation results finally verify the effectiveness of the proposed architecture.
Basically, secure PA here refers to confirming the authenticities of pilot tones from LUs suffering above three attacks. This includes how to detect any alteration to their authenticities and how to protect and further maintain high authenticities. Since PA also means authenticating CSIs, much work have been extensively investigated on this area, from narrow-band single-carrier systems @cite_25 @cite_19 @cite_26 @cite_20 @cite_6 @cite_13 @cite_2 @cite_28 to wide-band multi-carrier systems @cite_17 @cite_18 @cite_7 @cite_15 @cite_29 @cite_4 @cite_21 .