The proliferation of the Internet of Things (IoTs) and pervasive use of many different types of mobile computing devices make wireless communication spectrum a precious resource. In order to accommodate the still fast increasing number of devices requesting wireless connection, more efficient, fine-grained spectrum allocation and sharing schemes are badly in need. Cognitive radio networks (CRNs) have been widely recognized as one promising solution, in which the secondary users (SUs) are allowed to share channels with licensed primary users (PUs) as long as bringing no interference to the normal operations of the PUs. However, malicious attackers or selfish SUs may mimic the behavior of PUs to occupy the channels illegally. It is nontrivial to accurately, timely detect such kind of primary user emulation (PUE) attacks. In this paper, an efficient PUE attacked detection method is introduced leveraging the recurrent neural network (RNN). After a fundamental algorithm using basic RNN, an advanced version taking advantage of long-short-term-memory (LSTM) is proposed, which is more efficient on processing time series with long term memory. The experimental study has provided deeper insights about the different performances the RNNs achieved and validated the effectiveness of the proposed detectors.
In 2014, a signal activity pattern (SAP) based PUE attack detection method was proposed @cite_21 . The main idea is that the PU signal activities can be well reconstructed by some sparse combination of a set of feature vector bases, while attack activities can not be sparsely reconstructed by such bases. Besides a lengthy training process, the proposal may suffer from two practical issues. Firstly, it requires a consecutive long enough observation duration to preserve ON OFF features of the signal activities (30 ON OFF periods in the literature). Secondly, it is expensive to find an optimal solution of the signal reconstruction problem by solving a convex optimization problem for each detection, which consumes a great amount of resources. Although the proposed SAP based PUE attack detection is theoretically sound, it is not advantageous in practical implementation.
@cite_21
2114317796 2110383222 2123002543 2535351647
Promising to significantly improve spectrum utilization, cognitive radio networks (CRNs) have attracted a great attention in the literature. Nevertheless, a new security threat known as the primary user emulation (PUE) attack raises a great challenge to CRNs. The PUE attack is unique to CRNs and can cause severe denial of service (DoS) to CRNs. In this paper, we propose a novel PUE detection system, termed Signal activity Pattern Acquisition and Reconstruction System . Different from current solutions of PUE detection, the proposed system does not need any a priori knowledge of primary users (PUs), and has no limitation on the type of PUs that are applicable. It acquires the activity pattern of a signal through spectrum sensing, such as the ON and OFF periods of the signal. Then it reconstructs the observed signal activity pattern through a reconstruction model. By examining the reconstruction error, the proposed system can smartly distinguish a signal activity pattern of a PU from a signal activity pattern of an attacker. Numerical results show that the proposed system has excellent performance in detecting PUE attacks. We propose to detect abnormal events via a sparse reconstruction over the normal bases. Given a collection of normal training examples, e.g., an image sequence or a collection of local spatio-temporal patches, we propose the sparse reconstruction cost (SRC) over the normal dictionary to measure the normalness of the testing sample. By introducing the prior weight of each basis during sparse reconstruction, the proposed SRC is more robust compared to other outlier detection criteria. To condense the over-completed normal bases into a compact dictionary, a novel dictionary selection method with group sparsity constraint is designed, which can be solved by standard convex optimization. Observing that the group sparsity also implies a low rank structure, we reformulate the problem using matrix decomposition, which can handle large scale training samples by reducing the memory requirement at each iteration from O(k^2) to O(k) where k is the number of samples. We use the columnwise coordinate descent to solve the matrix decomposition represented formulation, which empirically leads to a similar solution to the group sparsity formulation. By designing different types of spatio-temporal basis, our method can detect both local and global abnormal events. Meanwhile, as it does not rely on object detection and tracking, it can be applied to crowded video scenes. By updating the dictionary incrementally, our method can be easily extended to online event detection. Experiments on three benchmark datasets and the comparison to the state-of-the-art methods validate the advantages of our method. This paper develops two parametric methods to detect low-rate denial-of-service attacks and other similar near-periodic traffic, without the need for flow separation. The first method, the periodic attack detector, is based on a previous approach that exploits the near-periodic nature of attack traffic in aggregate traffic by modeling the peak frequency in the traffic spectrum. The new method adopts simple statistical models for attack and background traffic in the time-domain. Both approaches use sequential probability ratio tests (SPRTs), allowing control over false alarm rate while examining the trade-off between detection time and attack strength. We evaluate these methods with real and synthetic traces, observing that the new Poisson- based scheme uniformly detects attacks more rapidly, often in less than 200 ms, and with lower complexity than the periodic attack detector. Current entropy-based detection methods provide an equivalent time to detection but require flow-separation since they utilize source destination IP addresses. We evaluate sensitivity to attack strength (compared to the rate of background traffic) with synthetic traces, finding that the new approach can detect attacks that represent only 10 of the total traffic bitrate in fractions of a second. For achieving optimized spectrum usage, most existing opportunistic spectrum sensing and access protocols model the spectrum sensing and access problem as a partially observed Markov decision process by assuming that the information states and or the primary users' (PUs) traffic statistics are known a priori to the secondary users (SUs). While theoretically sound, the existing solutions may not be effective in practice due to two main concerns. First, the assumptions are not practical, as before the communication starts, PUs' traffic statistics may not be readily available to the SUs. Second and more serious, existing approaches are extremely vulnerable to malicious jamming attacks. By leveraging the same statistic information and stochastic dynamic decision-making process that the SUs would follow, a cognitive attacker with sensing capability can sense and jam the channels to be accessed by SUs, while not interfering PUs. To address these concerns, we formulate the antijamming, multichannel access problem as a nonstochastic multi-armed bandit problem. By leveraging probabilistically shared information between the sender and the receiver, our proposed protocol enables them to hop to the same set of channels with high probability while gaining resilience to jamming attacks without affecting PUs' activities. We analytically show the convergence of the learning algorithms and derive the performance bound based on regret . We further discuss the problem of tracking the best adaptive strategy and characterize the performance bound based on a new regret . Extensive simulation results show that the probabilistic spectrum sensing and access protocol can overcome the limitation of existing solutions and is highly resilient to various jamming attacks even with jammed acknowledgment (ACK) information.