Primary user emulation and jamming attack detection in cognitive radio via sparse coding

Abstract

Cognitive radio is an intelligent and adaptive radio that improves the utilization of the spectrum by its opportunistic sharing. However, it is inherently vulnerable to primary user emulation and jamming attacks that degrade the spectrum utilization. In this paper, an algorithm for the detection of primary user emulation and jamming attacks in cognitive radio is proposed. The proposed algorithm is based on the sparse coding of the compressed received signal over a channel-dependent dictionary. More specifically, the convergence patterns in sparse coding according to such a dictionary are used to distinguish between a spectrum hole, a legitimate primary user, and an emulator or a jammer. The process of decision-making is carried out as a machine learning-based classification operation. Extensive numerical experiments show the effectiveness of the proposed algorithm in detecting the aforementioned attacks with high success rates. This is validated in terms of the confusion matrix quality metric. Besides, the proposed algorithm is shown to be superior to energy detection-based machine learning techniques in terms of receiver operating characteristics curves and the areas under these curves.

1 Introduction

Due to the rapid growth in wireless technology and services, the scarcity of the wireless spectrum has become a major problem [1]. To meet the requirements of future wireless networks and to alleviate this spectrum scarcity problem, cognitive radio (CR) is one of the most promising solutions. CR allows spectrum sharing between the primary users (PUs) and secondary users (SUs). More specifically, it enables SUs to opportunistically utilize empty spectrum bands without harming the PUs by following these steps: (i) determining whether the channel is occupied or not, (ii) choosing the best part of the spectrum based on their quality of service (QoS) requirements, (iii) coordinating with other users to access the spectrum, and (iv) leaving the channel whenever a PU starts to transmit its data [2].

Although CR is a promising solution to address the spectrum shortage problem, it is inherently vulnerable to both traditional and new security threats [3]. This is due to the wireless nature and unique characteristics of CR. Traditional security threats include eavesdropping, spoofing, and jamming attacks [4], while new security threats include spectrum sensing data falsification (SSDF) and primary user emulation attack (PUEA) [3, 5].

An eavesdropper tries to “hear” the secret communication between legitimate nodes while a spoofer can modify, intercept, and replace the messages between the legitimate parties. On the other hand, a jammer can generate intentional interference signals to degrade the quality of communication for both PUs and SUs. Thus, a jammer can also prevent an SU from efficiently utilizing the white spaces of the spectrum by causing false alarms regarding spectrum occupancy [4].

In an SSDF attack, an illegitimate node provides false sensing information to degrade the performance of the collaborative spectrum sensing approach, where collaborative approaches include the interaction of multiple CRs to improve the sensing performance in the fading environment. On the other hand, PUEA is based on emulating the characteristics of the PU transmission to deceive the SUs about spectrum occupancy. PUEA prevents them from utilizing the existing spectrum holes and can even cause interference to the PUs in some cases [6].

Popular PUEA types include malicious and selfish attacks. The malicious attackers objective is to degrade the CR performance by preventing them from opportunistic exploitation of spectrum. Particularly, a malicious attacker destroys the operations of the CR network. Thus, it can stop CRs from sensing and can also disengage the already used spectrum by them. On the other hand, a selfish attacker aims at exploiting the space of the spectrum by preventing other secondary users from using it. More specifically, it focuses on enhancing its consumption of the spectrum by degrading the overall fairness of the system.

The focus of this work is to detect false alarm about the spectrum occupancy that is caused by illegitimate nodes. An illegitimate node can transmit a signal similar to that of a PU, considered as a primary user emulator (PUE), or can send an unstructured signal, considered as a jamming attack. In the literature, several solutions are proposed for illegitimate node detection. For instance, the power level of the signal through the energy detection (ED) algorithm can decide on the source of the signal [7] using a pre-defined threshold. In [8], the authors presented a Markov random field-based belief propagation framework with ED for PUEA detection. Firstly, SUs employ the energy-based algorithm and calculate the belief values about the real source of the signal. Afterwards, the belief values are shared between different users. Finally, the average belief value is compared with the pre-defined threshold. If the average is less than the threshold, it is assumed that the signal source is fake; otherwise, the source of the signal is assumed to be real. These approaches are simple; however, they are shown to create high levels of false alarm rates. Cross-layer techniques are also effective for illegitimate node detection. In [9], the authors proposed a cross-layer approach for jamming attack and PUEA detection in CR networks by using information from physical layer spectrum sensing, statistical analysis of routing information, and prior knowledge about PUs. This technique is effective for detecting PUEA and jamming attack. However, there is an excessive overhead in analyzing and comparing information from physical and network layers.

The wireless channel and inherent physical characteristics of communication devices are also effective for illegitimate node detection [10–13]. For instance, wireless channel-based detection schemes are proposed in [10–12] for PUEA detection. These techniques are based on the fact that the channel between different transmitter-receiver pairs is different due to its spatial decorrelation nature. In [13], the inherent physical layer features of devices based on hardware impairments are exploited for PUEA detection. Nevertheless, these techniques require excessive software and hardware overheads for their implementation.

Localization-based detection is also popular for PUEA detection. The basic idea is to infer the position of the signal’s source by using the received signal and compare it with a database of pre-known locations of legitimate PUs. However, database management is not applicable in all scenarios [14, 15]. Similarly, the authors in [16] used the time difference of arrival-based position estimation approach for PUEA detection. However, this requires a strict synchronization between the receiver and the transmitter.

Machine learning (ML)-based solutions also received considerable attention for CR security. In [17], an anomaly detection framework for CR networks based on the characteristics of radio propagation is proposed. However, it does not consider specific attacks and is designed only for the detection of general anomalies. In [18], the authors proposed a technique based on support vector data description (SVDD) and zoom fast Fourier transform (zoom FFT). In the first step, the pilot and symbol rate are estimated using zoom FFT. Afterwards, a boundary around the PU objects is constructed using the SVDD classifier which is used to distinguish between PU and PUE. However, this method does not perform well in low signal-to-noise ratio (SNR) operating conditions. Furthermore, the method fails when the PUE is extremely intelligent (the only information unknown by the PUE is the channel). In [19], the authors proposed an ML-based algorithm for PUEA detection that exploits the signal strength and boundaries around the position of PU for the correct detection. This method is good in terms of complexity, but it suffers from performance degradation.

Recently, compressive sensing (CS)-based approaches were applied in spectrum sensing where CS offers several benefits. For example, it can alleviate the need for high sampling rate analog-to-digital converters [20–22]. This results in a reduction of the overall complexity, energy consumption, and memory requirements. Following its success in various application areas [20], CS has been applied to the problem of PUEA detection. Works along this line include PUEA detection based on CS and received signal strength [23]. This approach needs multiple sensors throughout the network. Hence, it increases the overall complexity. Another example considers exploiting belief propagation and CS for PUEA detection [24]. However, this requires a centralized node for its implementation. In [25], the authors proposed an algorithm for jamming attack detection in wide-band CR. In the first step, CS is performed to estimate a wide-band spectrum. Afterwards, an ED algorithm is applied to identify the occupied spectrum sub-bands. Lastly, waveform parameters of the sub-bands are compared with the known user database to determine the jamming attack. However, this method also requires database management.

In this paper, we propose an algorithm for PUEA and jamming attack detection corresponding to the narrow-band spectrum using the convergence patterns of the sparse coding over channel-dependent sampled dictionary. This convergence is characterized by the sparse coding residual signal energy decay rates. The proposed algorithm does not require a centralized node or strict synchronization between transceiver ends. Moreover, it does not require information from multiple sensors for the implementation. Furthermore, it eliminates the need for estimating the sparse coding error tolerance or the sparsity level, as typically required in CS-based approaches. The reason is that the sparse recovery in the proposed algorithm is just used for energy convergence rate revelation rather than accurate signal reconstruction. The main contributions of this paper are as follows:

• First, the decaying pattern of sparse coding is used for PUEA detection. This is achieved by exploiting the convergence patterns of the sparse coding over a PU channel-dependent dictionary. In this context, these patterns guide on identifying a spectrum hole, a PU, and a PUE through ML approaches.

• Second, jamming attack detection is also performed based on the decay pattern of sparse coding. Here, the idea is that the noise and jamming signals are not compressible because they are not structured. So, residual energy decay patterns with a channel-dependent dictionary along with the non-compressive nature of jamming signals are used for efficient jamming attack detection via ML classification.

The rest of this paper is organized as follows. Preliminary information and the system model are presented in Section 2. Section 3 provides the proposed algorithm, while the complexity analysis is presented in Section 4. Section 5 presents the simulation results and discussions. Finally, the paper is concluded in Section 6.

Notation: Uppercase bold-faced, lowercase bold-faced, and lowercase plain letters represent matrices, vectors, and scalars, respectively. The symbols ∥.∥₀ and ∥.∥₂ denote the number of nonzero elements and the 2-norm of a vector, respectively. The 〈·,·〉, †, and $\mathbb {C}$ symbols represent inner product, Moore-Penrose pseudoinverse, and complex number field.

2 Preliminaries and system model

This section reviews background information related to CS, sparse recovery, and ML approaches.

2.1 Compressive sensing and sparse recovery

Using a random sensing matrix, CS merges data measurement and compression into a unified operation. CS applies to compressible signals, i.e., either the explicitly sparse signals or the ones admitting sparsity in a certain domain [26].

Let us assume a signal vector $\boldsymbol {y} \in \mathbb {C}^{N}$. A compressed version of y can be obtained by applying a measurement matrix $\boldsymbol {\Phi } \in \mathbb {C}^{M\times N}$ as y_c=Φy, where M≪N. Hence, a reduction in dimensionality from N-to-M is achieved. A high-dimensional version of the original signal can be reconstructed from this low dimensional measurement via sparse recovery [26].

Generally speaking, let us assume that a signal y admits sparse coding over a dictionary $\left (\boldsymbol {D} \in \mathbb {C}^{N \times K}\right)$. The signal can be represented in terms of D as y≈Dw, where $\boldsymbol {w}\in \mathbb {C}^{K}$ is a sparse coefficient vector. The calculation of w can be cast as follows.

$$ {\arg\min\limits}_{\boldsymbol{w}}{\left\|\boldsymbol{y}-\boldsymbol{Dw}\right\|}_{2}^{2} ~ s.t. ~ {\left\|\boldsymbol{w}\right\|}_{0} <S, $$

(1)

where S denotes the sparsity level of the signal. Sparse recovery is an NP-hard problem. However, sparse recovery methods offer efficient approximate solutions. As shown in (1), the ℓ₀ pseudo-norm is principally used to exactly quantify the sparsity level. However, its minimization is mathematically intractable and highly complex. Therefore, there exist only approximate solutions to ℓ₀ minimization, such as the matching pursuit and orthogonal matching pursuit (OMP) approaches. Alternatively, this problem can be overcome by relaxing the ℓ₀ norm minimization condition to minimizing the ℓ₁ norm which is a loose bound on sparsity. Still, ℓ₁ minimization is convex and accepts linear programming. Thus, replacing ℓ₀ minimization with ℓ₁ minimization offers a significant reduction to the computational complexity of sparse coding. However, ℓ₁ minimization requires information about the noise level of the signal being recovered. Thus, in this work, we adopt approximate ℓ₀ minimization through the OMP algorithm.¹

The intrinsic sparsity of the signal can be revealed by a dictionary. This dictionary can be formed of fixed basis functions such as Fourier basis, Gabor functions, wavelets, and contourlets. Alternatively, it can be generated as a learned dictionary. In this setting, a dictionary is obtained by training over training data signals $\boldsymbol {Y} \in \mathbb {C}^{N\times L}$ [28]. This dictionary learning process can be formulated as

$$ {\arg\min\limits}_{\boldsymbol{W, D}} {\left\|\boldsymbol{W}_{i}\right\|}_{0} ~ s.t. ~ {\left\|\boldsymbol{Y}_{i}- \boldsymbol{DW}_{i}\right\|}_{2}^{2} < \epsilon ~\forall~ ~i, $$

(2)

where ε represents error tolerance. Since the problem is non-tractable and non-convex, most of the dictionary learning algorithms perform the learning by iteratively alternating between a sparse representation stage and a dictionary update stage. As an example, the K-SVD algorithm [28] is one of the widely used algorithms for the dictionary learning process.

The abovementioned dictionary learning is a computationally demanding process. Therefore, developing efficient alternatives to the classical dictionary learning approach is needed for CR-related applications [21]. In this context, the use of sampled dictionaries is an efficient alternative. One can obtain a sampled dictionary by picking a set of randomly selected data vectors that serve for the sparse coding without the need for applying an expensive learning process. Thus, this offers a compromise in terms of computational complexity at a tolerable loss in the representational power of the dictionary. In [22], the use of sampled dictionaries is justified by their usage to represent data points in a specific class, which have a general similarity. Similarly, sampled dictionaries are used in this work to represent signals.

2.2 Residual components in pursuit sparse coding

A widely used sparse representation algorithm is OMP. This algorithm is based on iteratively obtaining the coefficients in a sparse coefficient vector (w). Particularly, each iteration identifies the location and adjusts the value of a nonzero element in w. This is achieved by selecting one atom (column) from a dictionary D and adjusting its respective weight.

To implement the above-explained atom selection and coefficient update processes, algorithms such as OMP define a so-called residual signal r. Conceptually, r represents signal portions that have not yet been represented by the selected dictionary atoms. Hence, sparse coding initializes r with the signal itself, as r←x. In the first iteration, the sparse representation algorithm loops through all dictionary atoms and selects the one most similar to the current residual r. Once this atom is selected, the corresponding weight is calculated. To this end, the next residual is calculated by subtracting the resultant one-atom sparse approximation from the original residual. Then, the residual is considered as a new signal for which another dictionary atom is selected and another coefficient is calculated and the process continues until a certain halting condition is met.

The interesting point to consider in the above-explained sparse coding approach is that the energy of the residual components should dramatically decrease as sparse coding progresses. Intuitively, this is because more atoms are selected, and thus, more signal portions are excluded from the residual.

2.3 Machine learning for classification

The successful works of the ML algorithms in many application areas such as computer vision, fingerprint identification, image processing, and speech recognition led these algorithms to become appealing for the area of wireless communication [29]. These ML algorithms are categorized under three categories called supervised, unsupervised, and reinforcement learning. Supervised learning-based ML algorithms are widely used for classification problems when the number of present classes is known and the information of the classes that samples belong to in the training stage is available.

Amongst many supervised learning-based algorithms, the feed-forward neural network has received growing interest in classification problems since it can recognize classes accurately and quickly [30]. This network can be used with a single-layer and multi-layer. Although single-layer algorithms are computationally good, these algorithms can only be used for simple problems. Alternatively, the multi-layer-based algorithms that include the usage of one or more hidden layers are used. Even though these algorithms increase computational complexity, they are able to solve more complex problems. Besides the effect of the extra layers, the number of neurons that are used in hidden layers is also effective on the accuracy and complexity performances. Therefore, it is quite significant to set these hyper-parameters optimally. Moreover, the complexity and accuracy performances can be increased by feature extraction (with the domain knowledge). Along this line, CS is used to extract features in this work with the aim of increasing the performance of the ML.

2.4 System model

The system model used is intended to characterize the existence of legitimate and illegitimate source nodes. Thus, it consists of a PU node, an SU node, and an illegitimate node as presented in Fig. 1. In this setting, an SU node opportunistically exploits the spectrum in the presence of an illegitimate node that can launch either PUEA or jamming attack. A jammer transmits a random signal, while a PU node and a PUE transmit structured signals that mimic the legitimate PUs.

Fig. 1

The basic system model: a PUE and a jammer want to degrade SU’s spectrum utilization by sending fake signals

We can represent the transmitted signal as x=As, where A is a coefficient matrix with a size of N×N. Each component is denoted by a_i,j with i,j=1,…N, and s=[s₁(t),…,s_N(t)]^T represents the transmitted data vector. Any coordinate of s is given as $s_{i}(t)= \sum ^{\infty }_{k=-\infty } d_{k} u(t-k T_{s}) e^{j2\pi f_{c,o}t}$, where T_s is the symbol duration, f_c,o represents the center frequency, d represents digitally modulated data symbols, u(t) represents the pulse shaping filter, and o=1,2,…,N.

The signal at the receiver sent by any node can be written as

$$ \boldsymbol{y}=\boldsymbol{h}\boldsymbol{x} +\boldsymbol{n}, $$

(3)

where h is a multipath Rayleigh fading channel between any transmitter-receiver pair and n is additive white Gaussian noise. Due to the spatial decorrelation concept, the channel between different transmitter-receiver pairs is assumed to be different [31].

3 The proposed algorithm for PUEA and jamming attack detection

The objective of this work is to differentiate between the following hypotheses:

$$ \boldsymbol{y}= \left\{\begin{array}{ll} \boldsymbol{n} & \mathcal{H}_{0}: \text{there is no PU}, \\ \boldsymbol{h}_{PU}\boldsymbol{x_{s}}+\boldsymbol{n} & \mathcal{H}_{1} : \text{a PU is present},\\ \boldsymbol{h}_{i}\boldsymbol{x_{s}}+\boldsymbol{n} &\mathcal{H}_{2} : \text{a PUE is present},\\ \boldsymbol{h}_{i}\boldsymbol{x_{n}}+\boldsymbol{n} &\mathcal{H}_{3} : \text{a jammer is present}, \end{array}\right. $$

(4)

where n is additive white Gaussian noise and y is the received signal. Besides, h_PU denotes the channel corresponding to the legitimate PU, h_i is the channel corresponding to PUE or jammer, x_n represents the (unstructured) jamming signal, and x_s is a structured signal. In this work, two goals are set. The first is to detect PUEA, i.e., to differentiate between the $\mathcal {H}_{0}$, $\mathcal {H}_{1}$, and $\mathcal {H}_{2}$ hypotheses. The second goal is to detect jamming attacks, i.e., to differentiate between $\mathcal {H}_{0}$, $\mathcal {H}_{1}$, and $\mathcal {H}_{3}$.

To meet the abovementioned goals, a compressed version of the received signal is observed by the CS algorithm and its sparse coding is calculated with respect to a PU channel-depended dictionary D_PU. As detailed in Section 2, sparse coding iteratively minimizes the energy of a residual (∥r∥₂). For each iteration, we calculate the value of ∥r∥₂. Then, we quantify the rate of its decay using the gradient operator (|G|). It is noted that the speed of this decay depends on the harmony between the received signal and the dictionary.

The convergence profile of this residual or gradient versus iteration can be used to distinguish between the aforementioned hypotheses. The idea behind this approach is that the unstructured signals (noise and jamming) are not compressible, while structured signals are compressible. Hence, different signals have different ∥r∥₂ and |G| profiles that help to distinguish between different hypotheses. Following the same logic, different signals have different patterns based on the similarity between the dictionary atoms and signals. In other words, residual energy patterns show how much dictionary atoms can guarantee accurate and sparse representation for signals that can also help in distinguishing between various hypotheses. Intuitively speaking, a signal that is compressible in the given dictionary has a faster decay speed compared to other signals. Thus, if the dictionary is channel-dependent, it will also affect the pattern corresponding to ∥r∥₂ and |G|, which can be used also to differentiate between different hypotheses.

To this end, we analyze the usefulness of ∥r∥₂ and |G| in distinguishing between the aforementioned hypotheses in (4) with the following test. We use a test set of 10³ quadruplets of synthetically generated received signals (y) that correspond to the hypotheses $\mathcal {H}_{0}, \mathcal {H}_{1}$, $\mathcal {H}_{2}$, and $\mathcal {H}_{3}$, respectively. In other words, one signal is mere noise, the other one is the signal received from the legitimate PU, the third one is a PUE signal that mimics the PU signal, and the fourth one is an unstructured jamming signal. These signals are generated as described in Section 5.

For each quadruplet, we calculate a PU-dependent dictionary (D_PU) based on the known PU channel (h_PU). In this work, a channel-dependent dictionary is obtained by convolving a set of randomly selected data (X) with the channel corresponding to the legitimate PU. Formally stated, D_PU=h_PU∗X, where ∗ denotes convolution. Afterwards, we perform an iterative sparse coding operation on a compressed version of each signal in the quadruplet with D_PU while calculating ∥r∥₂. Next, we calculate the gradient of each residual vector as |G|.

The average values of ∥r∥₂ and |G| in the above-explained test are presented in Fig. 2. In view of this figure, it is seen that one can differentiate between the four hypotheses based on |G| and ∥r∥₂ using ML approaches. For example, the gradient of $\mathcal {H}_{1}$ has faster decay as compared to $\mathcal {H}_{0}$, $\mathcal {H}_{2}$, and $\mathcal {H}_{3}$ as presented in Figs. 2f–h, respectively. The reason for exhibiting a faster decay is that the received signal in $\mathcal {H}_{1}$ (corresponding to PU) is the only one compressible in the given dictionary.

Fig. 2

The averages of {r}₂ versus sparse coding iteration for received signals under hypotheses $\mathcal {H}_{0}$, $\mathcal {H}_{1}$, $\mathcal {H}_{2}$, and $\mathcal {H}_{3}$ are in (a), (b), (c), and (d), respectively, while the averages of |G| versus sparse coding iteration are presented in (e), (f), (g), and (h), respectively

Based on the above discussion, we present the proposed algorithm. It is divided into two main stages. First, is a classifier training stage, where one uses a comprehensive set of training signals. We can either concatenate ∥r∥₂ and its absolute gradient |G| into a unified feature vector or use them separately as classification features. These features are used to make training data sets $\boldsymbol {f}_{0}^{i}$, $\boldsymbol {f}_{1}^{i}$, $\boldsymbol {f}_{2}^{i}$, and $\boldsymbol {f}_{3}^{i}$ according to the hypotheses explained in (4).

For the case of PUEA detection, the training set contains $\boldsymbol {f}_{0}^{i}$, $\boldsymbol {f}_{1}^{i}$, and $\boldsymbol {f}_{2}^{i}$ corresponding to the hypotheses $\mathcal {H}_{0}, \mathcal {H}_{1}$, and $\mathcal {H}_{2}$, respectively. On the other hand, for the case of jammer detection, the training set contains $\boldsymbol {f}_{0}^{i}$, $\boldsymbol {f}_{1}^{i}$, and $\boldsymbol {f}_{3}^{i}$ corresponding to the hypotheses $\mathcal {H}_{0}, \mathcal {H}_{1}$, and $\mathcal {H}_{3}$, respectively. Afterwards, these training vectors, along with their class labels are fed to the ML training stage, where a classifier model is trained accordingly. The workflow of the training set preparation stage is pictorially described in Fig. 3a. In this figure, ${\mathbf {Y}}_{n}^{i}$ represents the set of compressed received signals $\boldsymbol {y}_{0}^{i}$, $\boldsymbol {y}_{1}^{i}$, and $\boldsymbol {y}_{2}^{i}$ for the case of PUEA detection or $\boldsymbol {y}_{0}^{i}$, $\boldsymbol {y}_{1}^{i}$, and $\boldsymbol {y}_{3}^{i}$ for the case of jamming attack detection. Similarly, ${\mathbf {F}}_{n}^{i}$ represents the set of training vectors.

Fig. 3

An illustration of the proposed algorithm for (a) training stage and (b) testing stage

After classifier training, the testing stage represents the run-time operation of the proposed algorithm. This process is explained in Fig. 3b. For each incoming test signal, y, sparse coding is performed over D_PU and feature vector f is obtained. Afterwards, f is fed into the learned classifier. Finally, this classifier will decide on the hypothesis corresponding to the current signal of interest. An analysis of this idea is provided in the Appendix.

4 Complexity analysis

In this section, we roughly quantify the computational complexity of the proposed algorithm. This complexity is primarily required by sparse coding and ML.

The OMP computational complexity at the kth iteration is $\mathcal {O}\left (MK+KS+KS^{2}+S^{3}\right)$ while the overall complexity is $\mathcal {O}\left (MKS+KS^{2}+KS^{3}+S^{4}\right)$, where S represents the sparsity level [32]. Thus, the overall computational complexity of sparse coding with a sparsity level of M is $\mathcal {O}\left (KM^{2}+KM^{2}+KM^{3}+M^{4}\right)$. This can be simplified as $\mathcal {O}\left (2KM^{2}+KM^{3}+M^{4}\right)$. Note that sparse coding is used during both the training and the testing phase in the proposed algorithm.

The computational complexity of ML is divided into two main stages which are training and testing. The computational complexity of two-layer neural network per sample is $\mathcal {O}(e(lk+ml))$ for training stage, where e denotes the number of epochs, while k, l, and m represent the number of neurons at the input, hidden, and output layers, respectively. The total complexity of training stage is $\mathcal {O}(ep(lk+ml))$ for p number of samples. Moreover, the computational complexity of training per sample is roughly double as compared to the complexity of testing per sample [33]. It is worth to note that k=2M, since ∥r∥₂ and |G| are concatenated into a unified feature vector in the simulations.

5 Results and discussion

This section presents numerical experiments to assess the performance of the proposed algorithm comparing it with the ED approach.

5.1 Parameter setting

The simulations are conducted with different modulation settings based on the system model specifications presented in Section 2. The modulation types used include quadrature amplitude modulation (QAM), pulse amplitude modulation (PAM), frequency-shift keying (FSK), and phase-shift keying (PSK). Moreover, the proposed algorithm uses a 100 × 400 dictionary. For each received signal, a channel realization [34] is generated for the PU and uncorrelated channel realizations are generated for illegitimate node based on channel decorrelation concept [31]. The assumed model of h_PU is h_PU=ρh+(1−ρ), where ρ is the correlation factor and h is Rayleigh fading channel [35]. The details of the simulation parameters are presented in Table 1.

Table 1 Synthetic received signal simulation parameters

We use a standard two-layer feed-forward network [30] for that consists of a hidden layer and an output layer with sigmoid functions. The number of hidden neurons is set to 64 while the number of output neurons is set to the number of elements in the target vector which is 3 (corresponding to the number of classes in PUEA or jamming attack detection). For the case of PUEA detection, the vectors $\boldsymbol {f}_{0}^{i}$, $\boldsymbol {f}_{1}^{i}$, and $\boldsymbol {f}_{2}^{i}$ are used for training. For jamming attack detection, $\boldsymbol {f}_{0}^{i}$, $\boldsymbol {f}_{1}^{i}$, and $\boldsymbol {f}_{3}^{i}$ are used as input vectors. Energy decay rate and gradient vectors ∥r∥₂ and |G| are used as feature vectors. Here, the dimension of both ∥r∥₂ and |G| is 1×M. Therefore, the feature vector dimension 1×2M.

It is noted that we take 4000 samples from each class in the training stage for all cases and 1000 samples from each class in the testing stage for each of the SNR values. Also, the neural network is trained over the SNR values ranging between − 5 dB and 15 dB with a step size of 5 dB.

5.2 Performance analysis

This section presents the performance analysis of the proposed algorithm in terms of confusion matrices, receiver operating characteristics (ROC) curves, and area under ROC (AUROC) curves. For the jamming detection scenario, it is assumed that the illegitimate node broadcasts non-structured signals. On the other hand, it is assumed that PUE signal’s parameters are identical to that of PU signal.

To examine the performance of the classification, confusion matrices are often used. They present the number of both correctly and incorrectly classified observations. Thus, diagonal elements present the number of those observations correctly classified while off-diagonal elements indicate the number of incorrectly classified observations.

Table 2 presents the confusion matrices for the case of PUEA detection for different M and SNR values, where M is the number of samples in the compressed received signal. It is observed from Table 2 that the overall performance of the proposed algorithm is satisfactory for PUEA detection, especially at high SNR. Besides, the performance also improves with the increase in the values of M. Table 3 presents the confusion matrices for the case of jamming detection for different M and SNR values. It is seen from the table that the classification accuracy based on the proposed algorithm improves with the increase in M and SNR similar to PUEA case.

Table 2 Confusion matrices for PUEA detection

Table 3 Confusion matrices for jamming attack detection

It is also observed from Tables 2 and 3 that the performance of the proposed jammer detection outperforms PUEA detection. This is because the jammer detection benefits from both the non-compressive nature of the jamming signal and the channel-dependent dictionary while the PUEA detection benefits only from the channel-dependent dictionary.

In classification, if a signal belongs class i and is correctly classified in to belong to the same class, then it is said to be as true positive (TP). If it is wrongly classified to belong to a different class j, then it is said to be a false negative (FN). If, however, the signal does not belong to class i and is wrongly classified as such, then it is counted as false positive (FP). Finally, if it does not really belong to i and is classified to belong to j, then it is a true negative (TN). To this end, the true positive rate (TPR) or recall can be defined as TPR=TP/(TP+FN), whereas the false positive rate (FPR) can be defined as FPR=FP/(FP+TN). ROC curves and AUROC curve values show the capability of a classifier to distinguish between different classes. ROC is a probabilistic curve which is plotted with a TPR on the vertical axis and FPR on the horizontal axis. Ideally, the TPR equals 1 and the FPR equals 0. Generally speaking, the closer the ROC curve is to the top-left corner, the better the performance. Similarly, the higher values of the AUROC curve shows better performance. In this work, there are three classes ($\mathcal {H}_{0}$, $\mathcal {H}_{1}$, $\mathcal {H}_{2}$ or $\mathcal {H}_{0}$, $\mathcal {H}_{1}$, $\mathcal {H}_{3}$) and ROC curve for each class is plotted separately.

Figures 4 and 5 present a performance comparison of the proposed algorithm with the ED-based ML algorithm for PUEA and jamming attack detection, respectively. In the case of ED-based ML, the energy of the received signals is used for the detection of different hypotheses while using ML structure similar to the one used for the proposed algorithm. It is observed from Figs. 4 and 5 that the ROC curves of the proposed algorithm are closer to the top-left corner compared to ROC curves of the ED-based algorithm for PUEA and jamming attack detection. Moreover, Tables reftab4 and 5 also show that the values of AUROC of the proposed algorithms are higher compared to the AUROC values of the ED-based algorithms to detect different hypothesis presented in (4). For example, the proposed algorithm outperforms the ED-based algorithm by 2.24% in the case of PUEA and 6.88% in case of jamming attack detection in terms of AUROC values. This is because the energy patterns in the residual and gradient vector enhance the detection capability of the proposed algorithm compared to the ED-based algorithm.

Fig. 4

Comparison of the proposed algorithm with the ED-based ML algorithm for PUEA detection using ROC curves

Fig. 5

Comparison of the proposed algorithm with the ED-based ML algorithm for jamming attack detection using ROC curves

Table 4 AUROC values for PUEA

Table 5 AUROC values for jamming attack

From an ML point-of-view, a trained model (classifier in this work) should not memorize the inputs used in its training. To investigate this quality in the trained ML classifier model in the proposed algorithm, Fig. 6 shows the training and testing losses versus epochs for the PUEA detection when M=100. In view of this figure, it is evident that the accuracy of the training sets converges to the test set. These results signify the absence of overfitting, thereby validating the generalizability of the proposed model. In other words, the trained model does not memorize the training data. Here, it should be noted that we include the loss graph only for M=100 case of PUEA to avoid repetition. For the other values of M and for the jammer case, we observe the similar behavior in loss graphs.

Fig. 6

Model loss graph for the PUEA detection when M=100

6 Conclusions

In this paper, the convergence patterns of sparse recovery are exploited for the purpose of PUEA and jamming attack detection. Sparse recovery was conducted over a legitimate PU channel-dependent dictionary. Consequently, the signal from the legitimate node has smooth convergence as compared to the signal from the illegitimate node. Essentially, this awes to the fact that this signal is the only one compressible in the domain exclusively defined by this sparsifying dictionary. Besides, the non-compressive nature of a jamming signal with sparse coding over a PU channel-dependent dictionary was also exploited to detect jamming attacks. This detection algorithm made use of ML-based approaches. Numerical experiments showed the effectiveness of the proposed algorithm and its superior performance compared to ED-based ML algorithms. These results were validated in terms of confusion matrices, ROC curves, and values of AUROC curves, as quality metrics. In terms of AUROC curve values, the proposed algorithm outperformed the ED-based algorithm by 2.24% in the case of PUEA and 6.88% in case of jamming attack detection.

7 Appendix residual energy gradient decay analysis

The proposed algorithm is based on the convergence patterns in the sparse coding of the compressed received signal. More specifically, the proposed algorithm uses a channel-dependent dictionary to identify different characteristics of gradients and residuals to detect PUEA and jamming attack.

In this work, we employ the computationally efficient OMP for sparse coding. Let us focus on its first iteration for the sake of simplicity. At the start of the first OMP iteration, the signal itself is used to initialize the zero-th residual r₀. Afterwards, OMP chooses an atom (d) from the atoms of the given dictionary D_PU that have the strongest similarity to the r₀. This similarity is characterized by the projection corresponding to each atom as E=dd^†. The updated residual after the selection of atom can be given as

$$ \boldsymbol{r}_{1}=\boldsymbol{r}_{0} - \boldsymbol{E r}_{0}. $$

(5)

For simplicity, the least-squares refinement of OMP is ignored. With each iteration, the residual magnitude is decreasing and the pattern of the concatenated residual values $\left (\|\boldsymbol {r}_{1}\|^{2}_{2}\right)$ is used for classification.

To this end, the first element in G can be represented as

$$ \boldsymbol{G}(1)=\|\boldsymbol{r}_{1}\|^{2}_{2}-\|\boldsymbol{r}_{0}\|^{2}_{2}= \left \langle \boldsymbol{r_{1}},\boldsymbol{r_{1}}\right \rangle- \left \langle \boldsymbol{r_{0}},\boldsymbol {r_{0}}\right \rangle. $$

(6)

Using this gradient magnitude property, we can differentiate the cases $\mathcal {H}_{0}$, $\mathcal {H}_{1}$, $\mathcal {H}_{2}$, and $\mathcal {H}_{3}$. The general received signal can be given as y=hx+n, and we can write the G(1) as follows:

$$ \boldsymbol{G}(1)=\|\boldsymbol{y-{E}y}\|^{2}_{2}-\|\boldsymbol{y}\|^{2}_{2}. $$

(7)

For the first hypothesis, $\mathcal {H}_{0}$, x=0. Thus, y is merely noise and can be written as

$$\begin{array}{*{20}l} \boldsymbol{G}(1)_{\mathcal{H}_{0}}&=\|\boldsymbol{n-{E}n}\|^{2}_{2}-\|\boldsymbol{n}\|^{2}_{2}, \\ &=\left \langle\boldsymbol{n}-\boldsymbol{En},\boldsymbol{n}-\boldsymbol{En}\right \rangle-\left \langle\boldsymbol{n},\boldsymbol{n}\right \rangle, \\ &= \left \langle\boldsymbol{n},\boldsymbol{n}\right \rangle-2\left \langle\boldsymbol{n},\boldsymbol{En}\right \rangle+\left \langle\boldsymbol{En},\boldsymbol{En}\right \rangle-\left \langle\boldsymbol{n},\boldsymbol{n}\right \rangle. \end{array} $$

(8)

With respect to the properties of projection, we know that $\left \langle \boldsymbol {En},\boldsymbol {n}\right \rangle = \left \langle \boldsymbol {En},\boldsymbol {En}\right \rangle = \|\boldsymbol {En}_{2}^{2}\|$. Hence, (8) can be written as

$$ \boldsymbol{G}(1)_{\mathcal{H}_{0}}=-\|\boldsymbol{En}\|_{2}^{2}. $$

(9)

Following the same logic, G(1) for $\mathcal {H}_{1}$, $\mathcal {H}_{2}$, and $\mathcal {H}_{3}$ can be expressed as follows

$$\begin{array}{*{20}l} \boldsymbol{G}(1)&=\left \langle\boldsymbol{hx+n}-\boldsymbol{E(hx+n)}, \boldsymbol{hx}+\boldsymbol{n}-\boldsymbol{E(hx+n)}\right \rangle\\&\qquad-\left \langle\boldsymbol{hx}+\boldsymbol{n},\boldsymbol{hx}+\boldsymbol{n}\right \rangle, \\ &=\boldsymbol{a}-2\boldsymbol{b}+\boldsymbol{c}-\boldsymbol{d}, \end{array} $$

(10)

where a, b, c, and d are defined next. Specifically, a can be written as

$$\begin{array}{*{20}l} \boldsymbol{a}&=\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{n},\boldsymbol{h}\boldsymbol{x}+\boldsymbol{n}\right \rangle, \\ &=\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{h}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{n}\right \rangle+\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{n}\right \rangle+\left \langle\boldsymbol{n}+\boldsymbol{n}\right \rangle, \\ &=\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{h}\boldsymbol{x}\right \rangle+2\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{n}\right \rangle+\left \langle\boldsymbol{n}+\boldsymbol{n}\right \rangle. \end{array} $$

(11)

Assuming that the noise is independent of hx, 〈hx+n〉=0, we can write (11) as

$$\begin{array}{*{20}l} \boldsymbol{a}=\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{h}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{n}+\boldsymbol{n}\right \rangle. \end{array} $$

(12)

By its turn, b can be expressed as

$$\begin{array}{*{20}l} \boldsymbol{b}&=\left \langle \boldsymbol{hx+n}, \boldsymbol{E(hx+n)}\right \rangle, \\ &=\left \langle\boldsymbol{hx+n},\boldsymbol{Ehx+En}\right \rangle, \\ &=\left \langle\boldsymbol{h}\boldsymbol{x},\boldsymbol{Eh}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{h}\boldsymbol{x},\boldsymbol{En}\right \rangle+\left \langle\boldsymbol{n},\boldsymbol{Eh}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{n},\boldsymbol{En}\right \rangle, \\ &= \left \langle\boldsymbol{Eh}\boldsymbol{x},\boldsymbol{Eh}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{h}\boldsymbol{x},\boldsymbol{En}\right \rangle+\left \langle\boldsymbol{n},\boldsymbol{Eh}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{En},\boldsymbol{En}\right \rangle, \\ &= \left \langle\boldsymbol{Eh}\boldsymbol{x},\boldsymbol{Eh}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{En},\boldsymbol{En}\right \rangle, \end{array} $$

(13)

where 〈hx,En〉=〈n,Ehx〉=0.

Moreover, c can be expressed as

$$\begin{array}{*{20}l} \boldsymbol{c}&=\left \langle\boldsymbol{E}({\boldsymbol{h}\boldsymbol{x}+\boldsymbol{n}}),\boldsymbol{E}({\boldsymbol{h}\boldsymbol{x}+\boldsymbol{n}})\right \rangle, \\ &=\left \langle\boldsymbol{Eh}\boldsymbol{x}+\boldsymbol{En},\boldsymbol{Eh}\boldsymbol{x}+\boldsymbol{En}\right \rangle,\\ &=\left \langle\boldsymbol{Eh}\boldsymbol{x},\boldsymbol{Ehx}\right \rangle+\left \langle\boldsymbol{En},\boldsymbol{En}\right \rangle. \end{array} $$

(14)

Lastly, d can be given as

$$\begin{array}{*{20}l} \boldsymbol{d}=\left \langle\boldsymbol{h}\boldsymbol{x}+\boldsymbol{h}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{n}+\boldsymbol{n}\right \rangle=\boldsymbol{a}. \end{array} $$

(15)

Based on (12), (13), (14), and (15), and making the appropriate substitution, G(1) can be written as

$$\begin{array}{*{20}l} \boldsymbol{G}(1)&=\boldsymbol{a}-2\boldsymbol{b}+\boldsymbol{c}-\boldsymbol{d}, \\ &=-2\left \langle\boldsymbol{Eh}\boldsymbol{x},\boldsymbol{Eh}\boldsymbol{x}\right \rangle-2\left \langle\boldsymbol{En},\boldsymbol{En}\right \rangle\\&\qquad+\left \langle\boldsymbol{Eh}\boldsymbol{x},\boldsymbol{Eh}\boldsymbol{x}\right \rangle+\left \langle\boldsymbol{En},\boldsymbol{En}\right \rangle, \\ &=-\left \langle\boldsymbol{Ehx},\boldsymbol{Ehx}\right \rangle-\left \langle\boldsymbol{En},\boldsymbol{En}\right \rangle. \end{array} $$

(16)

Finally, the generic expression of the gradient magnitude for hypotheses $\mathcal {H}_{1}$, $\mathcal {H}_{2}$, and $\mathcal {H}_{3}$ can be expressed

$$ \boldsymbol{G}(1)_{\mathcal{H}_{1},\mathcal{H}_{2},\mathcal{H}_{3}}=-\|\boldsymbol{Ehx}\|_{2}-\|\boldsymbol{En}\|_{2}, $$

(17)

where h corresponds to h_PU in case of PU or h_i in case of PUE/jammer as explained in (4). Moreover, x will be structured in case of PU and PUE, while unstructured in the case of a jamming attack.