Detection of pilot spoofing attack in massive MIMO systems based on channel estimation

Signal Processing 169 (2020) 107411

Contents lists available at ScienceDirect

Signal Processing journal homepage: www.elsevier.com/locate/sigpro

Detection of pilot spoofing attack in massive MIMO systems based on channel estimationR Shengbo Xu, Weiyang Xu∗, Haihua Gan, Bing Li School of Microelectronics and Communication Engineering, Chongqing University, Chongqing 400044, China

a r t i c l e

i n f o

Article history: Received 1 July 2019 Revised 1 November 2019 Accepted 1 December 2019 Available online 2 December 2019 Keywords: Physical layer security Massive MIMO Pilot spoofing attack Likelihood ratio test

a b s t r a c t In coherent massive MIMO systems, the training phase provides opportunity for an active eavesdropper to attack legitimate communication, which is known as pilot spoofing attack. Hence, this paper proposes an algorithm to detect this attack based on channel estimate. Concretely, the user sends pilots to the base station (BS), where channel estimation is carried out using least square (LS) method. According to the likelihood ratio test principle, three detectors based on LS channel estimate are proposed. Moreover, performance analysis concerning the probability of detection (Pd ) is presented, particularly the impact of key parameters on it. From the perspective of legitimate user, deploying more antennas is effective in improving Pd , whereas an eavesdropper needs to tunes its transmit power to strike a balance between eavesdropping and hidden abilities. © 2019 Elsevier B.V. All rights reserved.

1. Introduction Employing a large number of antennas at base station (BS) while sharing the same time-frequency resources, which is known as massive multiple-input multiple-output (MIMO), has recently received a great deal of interest due to its huge potential gains [1,2]. Meanwhile, physical layer security has become a key role in securing wireless communications [3,4]. Rather than high level cryptographic methods, it is possible to secure physical layer transmission by applying the principles of information-theoretic security [5] and signal processing techniques [6]. Two kinds of attack, namely the passive and active attack, are the major concern in the literature. In particular, massive MIMO provides improvements of physical layer security against passive attack, due to its capability to focus the transmit power in the desired direction [7]. However, an eavesdropper can dramatically reduce the achievable secrecy rate if it actively attack the legitimate communication [7]. Thus great efforts have been made to address the detection of active attack, and valuable approaches are obtained. Artificial noise is effective to combat active attack, and has been widely used in the area of physical layer security [8]. Random matrix theory is applied to detect jamming signals, and the final decision is

made by analyzing the maximum eigenvalue of the sample covariance matrix of the received signal [9]. Based on the principle of generalized likelihood ratio test, a detection scheme is constructed for the uplink of massive MIMO systems by utilizing unused pilots [10,11]. Moreover, linear receiver filters are introduced to reject the impact of the pilot spoofing attack [12]. Also, an effective twoway training-based scheme is presented to detect the jamming signals during the channel training phase [13]. In addition, reference [14] proposes a detector that leverages the asymmetry of received signal power levels at the transmitter and legitimate receiver when there exists a pilot spoofing attack. More recently, a pilot retransmission scheme is proposed to detect the pilot spoofing attack [15]. Specifically, users send pilots to the BS, then BS transmits the conjugate of its received signal (which may contain spoofing signal) back to users, where the final decision is made. Since it requires to collect observations over multiple channel coherence intervals, this algorithm could lead to high complexity and large processing delay. Different from existing methods, this study proposes to detect pilot spoofing attack by utilizing the channel estimate results. The main contributions are summarized as follows.

• R

This work was supported in by the Fundamental Research Funds for the Central Universities under Grant 2018CDXYTX0011 and the Key Program of Natural Science Foundation of Chongqing under Grant CSTC2017JCYJBX0047. ∗ Corresponding author. E-mail addresses: [email protected] (S. Xu), [email protected] (W. Xu), [email protected] (H. Gan), [email protected] (B. Li). https://doi.org/10.1016/j.sigpro.2019.107411 0165-1684/© 2019 Elsevier B.V. All rights reserved.

We find that the channel estimate at BS varies in the absence or presence of eavesdropping. Relying on the likelihood ratio test (LRT) principle, three decision metrics are constructed using the channel estimate. We derive closed-form expressions of probability density function (PDF) of decision metrics, and the threshold according to a predefined probability of false alarm

2

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411

•

(Pfa ). After that, the final decision is made by comparing the decision metric with the threshold. We derive the probability of detection (Pd ) and the impact of key parameters on it is analyzed in detail. The results show that deploying more antennas is an effective approach to improve Pd , while an eavesdropper needs to tunes its transmit power to balance between eavesdropping and hidden capabilities.

The remainder of this paper is organized as follows. The system model and problem formulation are illustrated in Section 2. The LRT principle is briefly reviewed in Section 3. Section 4 presents the proposed spoofing attack detection schemes. Performance analysis is carried out in Section 5. Numerical results are shown and discussed in Section 6. Finally, concluding remarks are drawn in Section 7. Notation: Cn×m indicates a complex matrix of size n × m. Bold variables represent matrices and vectors. For a random variable x, x ∼ CN (μ, σ 2 ) and x ∼ N (μ, σ 2 ) indicate complex and real Gaussian distributions with mean μ and variance σ 2 , respectively. IM is an identity matrix of size M × M. ( · )T , ( · )H , ( · )∗ and ·22 denote the transpose, conjugate transpose, complex conjugate and L2 norm operators. { · } and { · } refer to the real and imaginary parts of complex numbers.

de =

The considered system includes a BS with M antennas (Bob), a single-antenna user (Alice  ) and asingle-antenna active eavesdropper (Eve). Let h = [ βh h1 , . . . , βh hM ]T denote the channel between Alice and Bob, with β h and hi ∼ CN (0, 1 ) modeling the   large- and small-scale fading, respectively. g = [ βg g1 , . . . , βg gM ]T is the channel between Eve and Bob, with β g and gi ∼ CN (0, 1 ) being the large- and small-scale fading factors, respectively. Moreover, h and g are assumed to be mutually independent. In general, the channel state information (CSI) is required at Bob to generate the beamforming matrix. Hence, before data transmission, Alice sends pilots for the purpose of channel estimation. However, this provides opportunity for malicious nodes to attack legitimate communication. As an example, Eve may send identical pilots to Bob, so that the estimated channel is a linear combination of those of the legitimate and eavesdropping links. Such an attack is known as pilot spoofing attack [7], by which the eavesdropper can enhance its effective channel from Bob, while simultaneously degrading the channel of legitimate links. In the presence of this attack, the M × N1 received signal by Bob is

√

pu hx +

√

pe gx + n

(1)

where x ∈ C1×N1 is the pilot sequence of length N1 , pu and pe are the transmit powers of Alice and Eve, separately. n ∈ CM×N1 signifies the noise matrix with its (i, j)th element being ni, j ∼ CN (0, βn ). If pilot sequence satisfies xH x = N1 , the least square (LS) channel estimate is obtained by

˜ = h

yxH =h+ √ N1 pu



pe g+e pu

(2)

where e ∈ CM×1 indicates the error matrix with entries ei ∼ CN (0, pβu Nn ). It can be found from (2) that except for the addi1

tive noise, another interference



pe pu g

h and g. Therefore, signals received by

du =

2. System model description and problem formulation

y=

Fig. 1. The impact of pilot spoofing attack, where pu = 10dB, pe = 5dB, βh = 1, βg = 1, βn = 10dB and N1 = 10.

comes from the pilot spoof-

ing attack. In the following data transmission phase, Bob exploits the channel estimate to perform beamforming, of which the beam˜∗ forming vector W = ˜ hT ˜ ∗ . The pilot spoofing attack causes Bob to h h transmit signals towards Eve because W is a linear combination of

√ √

Alice and Eve are

T

pb h Ws + vu pb gT Ws + ve

(3)

where s ∈ C1×N2 indicates information-bearing symbols with E{s2 } = 1, pb is the transmit power of Bob, vu and ve are noise vectors of variance β v . As M grows unboundedly, achievable rates of Alice and Eve converge to

⎛

lim Cu ≈ log2 ⎝1 +

M→∞

⎛ lim Ce ≈ log2 ⎝1 +

M→∞

⎞

pb Mβh2

 βv βh +

βg p e pu

+ pβu Nn 1

β

pb pe M g2 pu

 βv βh +

βg p e pu

+ pβu Nn 1

⎠ ⎞ ⎠

(4)

Accordingly, the secrecy rate can be calculated by



lim Csc = lim (Cu − Ce ) ≈ log2

M→∞

M→∞

pu βh2



pe βg2

(5)

Obviously, the secrecy rate would be greatly degraded if Eve increases its transmit power. In an extreme situation, the secrecy rate becomes zero if pe βg2 > pu βh2 , which means the information is totally exposed to Eve. More seriously, increasing M cannot help to reduce this leakage since Cu and Ce grows simultaneously, as shown in Fig. 1. 3. The likelihood ratio test principle This section gives a brief review of the LRT principle, based on which our detection schemes are proposed. Assume there are K independent and identically distributed (i.i.d.) observations S = {S1 , S2 , . . . , SK }. The distributions of Sk under hypotheses HA and HB are

HA : HB :

 μA , σA2 , k = 1, 2, . . . , K

 Sk ∼ N μB , σB2 , k = 1, 2, . . . , K Sk ∼ N

(6)

According to the Neyman–Pearson theorem, the LRT principle is exploited to decide which hypothesis is true, i.e.,

L (S ) =

p( S; HB ) HA ≶ϒ p( S; HA ) HB

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411



=

1 2π σB2 1

2π σA2

 K2

exp −



K 1 

2σB2

where



( S k − μB )

2 HA

k=1

K 1 

 K2 exp − 2σ 2 A

  ≶ϒ (Sk − μA )2

HB

(7)

 K   K K σB2 − σA2  uA  HA uB σB 2 S + − S ≶ ln ϒ k k 2 2 σ 2σA2 σB2 σ σ H A B B A k=1 k=1

2 2  μA σB − μ2B σA2 − . 2σA2 σB2 /K

•

(8)

Case 1: μA = μB , σA2 = σB2 = 0 Case 2: μA = μB = 0, σA2 = σB2 , σA2 = 0, σB2 = 0 Case 3:

σB2 = 0

σ2 uA = A2 , μA = μB , σA2 = σB2 , μA = 0, μB = 0, σA2 = 0, uB σB

As a result, one can simplify (8) to make detection tractable. For example, if the distribution of Sk satisfies case 1, then (8) reduces to



uB

σB2

−

uA



σA2

 K HA K (u2A σB2 − u2B σA2 ) σB Sk ≶ ln ϒ − σA 2σA2 σB2 HB k=1

K 

(9)

According to (9), if the left-hand side is larger than the right-hand side, the LRT detector declares HB , otherwise it declares HA . On the other hand, if the distribution of Sk satisfies case 2 or 3, (8) reduces to

  K K HA K (u2A σB2 − u2B σA2 ) σB2 − σA2  σB 2 S ≶ ln ϒ − . k σA 2σA2 σB2 2σA2 σB2 HB k=1

2

+ 2 pβunN1

2

+

βh

H1 :

βg p e 2 pu

+ 2 pβunN1

4.1. Scheme A Let qi denote the observation, which in scheme A is defined as

qi =

As it is hard to further simplify (8), we make assumptions on the distributions of Sk . Specifically, the following three cases are considered •

βh

H0 :

βz =

In the following, we will consider three schemes for detecting the presence of Eve. Each scheme makes use of z in a different way.

k=1

where p(S; H ) is the joint distribution of S under hypothesis H, and ϒ is the threshold. When the logarithmic operation is applied, (7) changes to

•

3

zi + C



βz

,

i = 1, 2, . . . , 2M

where C is an arbitrary constant. Based on (4), (14) and (15), the distribution of qi under two hypotheses is derived by

⎛

⎞

⎜ ⎝

qi ∼ N ⎜ 

H0 :

⎜ ⎝

qi ∼ N ⎜ 

H1 :

⎟ ⎠

C

βh

+

2

⎛

, 1⎟

βn 2 pu N1

⎞ ⎟ ⎠

C

βh

+

2

βg pe 2 pu

+

, 1⎟

βn

(16)

2 pu N1

It can be seen that qi satisfies case 1 in Section II. As a result, by substituting (16) into (9), one can obtain the detector of scheme A [16]

 H1

2 C

ln (ϒ ) −

βh



φ1 ≶

H0



(10)

+

βg p e 2 pu

βh 2

+

βg p e 2 pu

+ 2 pβunN1



= ϒ1

C

C 2

2 C

+

+ 2 pβunN1

2

βh

In the next section, the proposed detection schemes will be described in detail in the light of (9) and (10).

(15)

+ 2 pβunN1

− β h + 2 pβunN1 2 (17)

2M

where φ1 = i=1 qi is the decision metric and ϒ 1 the modified threshold. z +C In reality, qi = √i is unavailable because β z is different under βz

4. The proposed pilot spoofing attack detection schemes First, the LS channel estimate under two hypotheses can be written as

H0 and H1 , and it is difficult to acquire β z in the presence of Eve. Hence, we resort to the sample variance β˜z instead of β z . To facilitate derivation, φ 1 is modified into

˜ =h+e H0 : h 

φ˜ 1 = √

˜ =h+ H1 : h

(11)

pe g+e pu

where H0 and H1 indicate hypotheses of the absence and presence of Eve. As h, g and e are mutually independent, the distribution ˜ i is derived by of h



˜ i ∼ CN 0, βh + H0 : h

βn





(13)

Besides, entries in z are i.i.d. random variables and obey the distribution

zi ∼ N (0, βz )

(18)

where φ˜ 1 denotes the modified decision metric and



2M 2M  1  1 β˜z = zi − zj 2M − 1 2M

2

(19)

j=1

Before further study, we introduce the following lemmas.

(12)

˜ and stacking them By extracting the real and imaginary parts of h together, one can obtain a vector of size 1 × 2M



2M 

i=1

pu N1  β ˜ i ∼ CN 0, βh + g pe + βn H1 : h pu pu N1

˜ 1 ), . . . ,  ( h ˜ M ),  ( h ˜ 1 ), . . . ,  ( h ˜M) z =  (h

2M 1  zi + C q˜i = √  2M i=1 2M i=1 β˜z

1

(14)

Lemma 1. Suppose x1 , x2 , . . . , xi , . . . , xn are n independent samples drawn from a Gaussian distribution with variance σ 2 , the sam ple mean is x¯ = 1n ni=1 xi . Accordingly, the sample variance s2 = 1 n 2 2 i=1 (xi − x¯ ) follows a χ distribution with (n − 1 ) degrees of n−1 freedom

(n − 1 )

s2

σ2

∼ χn2−1

Lemma 2. Suppose Y follows a standard normal distribution, V is a χ 2 random variable with v degrees of freedom that is independent of

4

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411

⎛  ⎞  βh βg p e  2 + 2 p + 2 pβnN u u 1 ⎠ = ϒ2 ln ⎝ϒ  β βn

Y, δ is a non-zero constant, then

T =

Y +δ



V/v

is a non-central t random variable with v degrees of freedom and noncentrality parameter δ , i.e., T ~ t(v, δ ). Accordingly, (18) can be further modified into

φ˜ 1 = √

2M  zi + C

1

2M



i=1

β˜z

√1 2M



=

2 M

i=1

zi +C √

βz

(20)

(2M−1 )β˜z (2M−1 )βz

√ 2M

2M  zi + C



i=1

βz



∼C

2M

βz

+ N ( 0, 1 )

Lemma 3. Suppose D is a χ 2 random variable with v degrees of freedom. If c is a positive constant, then it turns out that cD ∼ (k = v/2, θ = 2c ) is a Gamma random variable with v/2 and 2c being its shape and rate parameters, respectively. First, the decision metric of scheme B can be rewritten as

(21)

φ2 =

(22)

2M 

Combining (4), (21), (22) and Lemma 2, the distribution of φ˜ 1 is given by

i=1

φ˜ 1 ∼ t 2M − 1, C

H0 :





φ˜ 1 ∼ t 2M − 1, C

H1 :



βh 2

2M + 2 pβunN1

2

+

βg p e 2 pu

+ 2 pβunN1

(23)

Suppose fa,0 ( · ) is the expression of PDF of φ˜ 1 under H0 , then the probability of false alarm Pfa is





Pf a = P φ˜ 1 < η1 ; H0 =

 η1

where η1 is the threshold1 After η1 is computed in the light of a predefined Pfa , the final decision is then made by comparing η1 H1

with φ˜ 1 in a manner of φ˜ 1 ≶ η1 . Note that the presence of H0

Eve

is declared if φ˜ 1 < η1 , and vice versa. Moreover, it is worth noting that obtaining η1 requires the information of β h and noise variance β n , which can be estimated by observing over a long time. In addition, Pd is given by





Pd = P φ˜ 1 < η1 ; H1 =

 η1

−∞

fa,1 (x )dx

4.2. Scheme B Let pi denote the observation, which in scheme B is defined as

i = 1, 2, . . . , 2M

(24)

of which the distribution is shown in (14). As pi satisfies case 2 in Section II, one can design the detector of scheme B by substituting (14) into (10) H0

φ2 ≶

H1

1

4M β2h + 2 pβunN1

 βh 2

+

βg p e 2 pu

+ 2 pβunN1



2

zi



(26)

βz



∼ χ22M

βz

 β φ2 ∼ M, βh + n pu N1  βp β φ2 ∼ M, βh + g e + n

H1 :

pu

Note that η1 is the threshold in practice, which is different from the ϒ 1 in (17).

(28)

pu N1

Let fb,0 ( · ) be the expression of PDF of φ 2 under H0 , then Pfa is given by

 η2 0

fb,0 (x )dx



1 = 1− γ

(M )

M,



η2 βh +

(29)

βn

pu N1

where η2 denotes the threshold, γ (α , θ ) is the lower incomplete gamma function and ( · ) the Gamma function. η2 is computed based on a required Pfa , then the decision of absence or presence of

H0

Eve is made by comparing η2 with φ 2 , i.e., φ2 ≶ η2 . Different H1

from scheme A, the presence of attack is declared if φ 2 > η2 . Also, the expression of Pd is obtained by

 η2 0

fb,1 (x )dx



1 = 1− γ

(M )

M,

η2

βh +

βg p e pu

 (30)

+ pβu Nn 1

where fb,1 ( · ) is the PDF of φ 2 under H1 . Like before, numerical results of Pfa , η2 and Pd are attainable although their closed-form expressions are difficult to obtain. 4.3. Scheme C Let ri denote the observation, which in scheme C is defined as

ri =

zi + C

βz

,

i = 1, 2, . . . , 2M

(31)

where C is an arbitrary constant. Based upon (4), (14) and (31), the distribution of ri is given by



βg p e 2 pu

(27)

Based on (21) and Lemma 4, the distribution of φ 2 under H0 and H1 is

Pd = 1 −

where fa,1 ( · ) is the expression of PDF of φ˜ 1 under H1 . Although it is difficult to obtain the closed-form expressions of Pfa , η1 and Pd , the numerical results are attainable with commercial softwares, e.g., MATLAB.

pi = zi ,



2

zi

Pf a = 1 −

fa,0 (x )dx

−∞

2M  i=1



H0 :



2M βh

= βz

p2i

Then according to Lemma 3, we have

β˜ (2M − 1 ) z ∼ χ22M−1 βz 

2M  i=1

According to (14) and Lemma 1, we have that



(25)

2 pu N1

 M 2 where φ2 = 2i=1 pi is the decision metric and ϒ 2 the modified threshold. The following lemmas are required to construct scheme B.

where the numerator follows the distribution of

1

+

h

2

H0 :

ri ∼ N



C

βh 2

1

, + 2 pβunN1 β2h + 2 pβunN1

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411

 H1 :

 C

ri ∼ N

βh 2

βg p e

+

2 pu

,

+ 2 pβunN1

1 βh 2

+

βg p e 2 pu

(32)

+ 2 pβunN1

It can be found that ri satisfies case 3 in Section II. Therefore, one can obtain the detector of scheme C by substituting (32) into (10)

⎛ β

H1

4 pu φ3 ≶ ln ⎝ p H0 e βg

h

2

βg p e

+

2 pu

βh

+ 2 pβunN1



ϒ −1 ⎠ = ϒ3

+ 2 pβunN1

2

⎞

K 2

(33)

 M 2 where φ3 = 2i=1 ri is the decision metric and ϒ 3 the modified threshold. z +C Similar to scheme A, ri = iβ is unavailable since it is difficult z

to acquire β z under hypothesis H1 . Like before, the sample variance β˜z is used instead of accurate β z . First, φ 3 is modified into 2M 2M 1  2 1  φ˜ 3 = r˜i = 2M 2M i=1



i=1

zi + C β˜z

2 (34)

where φ˜ 3 denotes the modified decision metric and β˜z is shown in (19). Before further study, we introduce the following two lemmas. Lemma 4. Suppose J is a non-central χ 2 random variable with j degrees of freedom and non-centrality parameter ς = 0, K is χ 2 distributed with k degrees of freedom that is statistically independent of J, then

F=

J/ j K/k

is a non-central f random variable with j and k degrees of freedom, and non-centrality parameter ς , i.e., F ~ f(j, k, ς ).

which is the same as scheme A. Furthermore, the expression of Pd is



Pd = P β˜z φ˜ 3 < η3 ; H1  η3 = fc,1 (x )dx

⎛ 1 φ˜ 3 = 2M

r˜i2

i=1

2 M



zi +C √

2

⎞ /2M

i=1 1⎜ βz ⎟ = ⎝ ⎠ β ˜ βz (2M − 1 ) ˜z /2M − 1

(35)



zi + C



i=1

2 ∼

βz

( 2M − 1 )



β˜z

βz

∼

χ22M

2MC 2

where fc,1 ( · ) is the PDF of β˜z φ˜ 3 under H1 . To validate the derivation above, Fig. 2 compares the PDFs and numerical histogram of three decision metrics. The parameters can be referred to in Fig. 3. It can be observed that analytical results match numerical ones quite well. Interestingly, unlike the other two, φ 2 under H0 is on the left-hand side of φ 2 under H1 . Besides, increasing M could reduce the overlap region between neighboring PDFs, thus is helpful to improve detection performance. In conclusion, the difference in channel estimate under H0 and H1 makes detecting pilot spoof attack possible. Depending on LRT principle and how observations are gathered, we design three decision metrics and then propose corresponding detection algorithms. 5. Performance analysis To have a deep insight, this section will discuss the impact of M and pe on Pd for three detection schemes. 5.1. The impact of M and pe on Pd in scheme A If M is sufficiently large, φ˜ 1 converges to a Gaussian distribution. With Lemma 7, the mean and variance of φ˜ 1 under H0 are [18]







E φ˜ 1 ; H0 = C

βh

(36)

 β˜z φ˜ 3 ∼ F 2M, 2M − 1,



2MC 2 βh 2

+ 2 pβunN1 2MC 2

βh 2

+

βg p e 2 pu

 (37)

+ 2 pβunN1

Let fc,0 ( · ) be the expression of PDF of β˜z φ˜ 3 under H0 , then Pfa



2



 η3 −∞



− E2 φ˜ 1 ; H0



2M βh

+

βg pe 2 pu

+

M−

βn

2 pu N1

  2M − 1 2MC 2 var φ˜ 1 ; H1 = 1+ β p β h 2M − 3 + 2gpue + 2 pβunN1 2

β˜z φ˜ 3 ∼ F 2M, 2M − 1,



 



χ22M−1

Pf a = P β˜z φ˜ 3 < η3 ; H0 =

2 pu N1



2

βz

is

+

1 (M − 1 )

 2 M− 1

M−

βn

  2M − 1 2MC 2 var φ˜ 1 ; H0 = 1+ β h 2M − 3 + 2 pβunN1 2  E φ˜ 1 ; H1 = C  





H1 :



2M 2



Combined the results above, we find the product of φ˜ 3 and β˜z obeys a f distribution

H0 :

(39)



(40)

Moreover, its mean and variance under H1 are

βz

According to Lemma 1 and 5, it is derived that [17] 2M 



−∞

First, we rewrite the modified decision metric of scheme C into 2M 

5

fc,0 (x )dx

(38)

where η3 denotes the threshold in practice. η3 is set to achieve H1

a predefined Pfa , then the final decision is made by β˜z φ˜ 3 ≶ η3 . It H0

worth noting that the presence of attack is declared if β˜z φ˜ 3 < η3 ,

1 (M − 1 )

 2 M− 1 2





− E2 φ˜ 1 ; H1



(41)

Since φ˜ 1 approximates to Gaussian, its Pfa , η1 and Pd are given by

⎛

⎛

  ⎞⎞ ˜ η 1 − E φ1 ; H 0 1 ⎠⎠ Pf a = ⎝1 + erf ⎝    2 2 var φ˜ 1 ; H0     

 η1 = E φ˜ 1 ; H0 + 2 var φ˜ 1 ; H0 erf−1 2Pf a − 1 ⎛ ⎛   ⎞⎞ η1 − E φ˜ 1 ; H1 1 ⎠⎠ Pd = ⎝1 + erf ⎝    2 2 var φ˜ 1 ; H1

(42)

If the number of antennas increases from M to nM, then according to (40), the new mean and variance change to











E φ˜ 1 ; H0 ≈ nE φ˜ 1 ; H0 var







φ˜ 1 ; H0 ≈ n var φ˜ 1 ; H0 − n − n 2

2

  2MC 2 βh 2

+ 2 pβunN1

 (43)

6

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411

Fig. 2. Histogram and PDF of decision metrics under hypotheses H0 and H1 .

be optimized to strike a balance between eavesdropping and hidden abilities. 5.2. The impact of M and pe on Pd in scheme b Accordingly, as φ 2 converges to Gaussian if M is large enough, its mean and variance under H0 are given by

E[φ2 ; H0 ] = Mβh + M

 var [φ2 ; H0 ] = M

βh +

βn pu N1

βn

2 (45)

pu N1

And its mean and variance under H1 are

E[φ2 ; H1 ] = Mβh + M

βg pe pu

+M

βn pu N1

 2 βg pe βn var [φ2 ; H1 ] = M βh + + pu

(46)

pu N1

Fig. 3. The ROC curves of the proposed detection schemes, where M varies.

As a result, Pfa , η1 and Pd of scheme B are represented by

Since it is generally required that 0 < Pfa < 0.5, we have

1 = 1− 1 + erf 2



erf−1 (2Pf a − 1 ) < 0. Hence, one can arrive at η1 > nη1 based on     (43). In the same way, we have E φ˜ 1 ; H1 ≈ nE φ˜ 1 ; H1 and var





φ˜ 1 ; H1 < of detection is

⎛

Pd =

n2



var φ˜ 1 ; H1 . Therefore, the updated probability

⎛



η1 − E φ˜ 1 ; H1

1 ⎝1 + erf ⎝  2

⎛



⎛



η 2 = E [ φ2 ; H 0 ] + 



η − E[φ2 ; H0 ] 2 2 var [φ2 ; H0 ]

2 var [φ2 ; H0 ] erf





−1

η − E[φ2 ; H1 ] 2 2 var [φ2 ; H1 ]

1 Pd = 1 − 1 + erf 2

 ⎞⎞ ⎠⎠ 

1 − 2P f a





(47)

Via substituting (45) and (46) into (47), we have

2 var φ˜ 1 ; H1

 ⎞⎞ ˜ n η − n E φ ; H 1 1 1 1 ⎠⎠ = Pd > ⎝1 + erf ⎝    2 2 ˜ 2n var φ1 ; H1

Pf a







(44)

Hence, it has been shown theoretically that the probability of detection improves with more BS antennas. According to (5), Eve can effectively degrade the secrecy rate by increasing pe . As for attack detection, the threshold holds when pe becomes higher. In the light of (41), the new mean and variance under H1 will decrease, and consequently Pd improves based on (42). Therefore, from the point of Eve, its transmit power should

1 Pd = 1 − 1 + erf 2



βh +

βn

pu N1



−1

erf

βh +



1 − 2P f a −

βg p e pu



M βg p e 2 pu



+ pβu Nn 1 (48)

This equation reveals that Pd improves with the increase of M or pe , as erf( · ) is an increasing function of its argument. 5.3. The impact of M and pe on Pd in scheme C If M is sufficiently large, β˜z φ˜ 3 can be well approximated as a Gaussian random variable. With Lemma 9, its mean and variance

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411

7

under H0 are





E β˜z φ˜ 3 ; H0 =

( 2M − 1 ) (2M + α1 ) 2M ( 2M − 3 )



  (2M + α1 )2 + (2M + 2α1 )(2M − 3 ) 2M − 1 var β˜z φ˜ 3 ; H0 = 2 2M ( 2M − 3 )2 ( 2M − 5 )

2 (49)

where α1 =

2MC 2 βh β + 2 p nN 2

. And its mean and variance under H1 are

u 1





E β˜z φ˜ 3 ; H1 =

( 2M − 1 ) (2M + α2 ) 2M ( 2M − 3 )



  (2M + α2 )2 + (2M + 2α2 )(2M − 3 ) 2M − 1 var β˜z φ˜ 3 ; H1 = 2 2M ( 2M − 3 )2 ( 2M − 5 )

2 (50)

where α2 =

2MC 2 βh βg p e β + 2 p + 2 p nN 2 u

.

u 1

As before, Pfa , η3 and Pd of scheme C are derived as

⎛

Pf a

⎛

 ⎞⎞



Fig. 4. The comparison between the simulated Pfa and predefined Pfa .

η3 − E β˜z φ˜ 3 ; H0 1 ⎠⎠ = ⎝1 + erf ⎝    2 ˜ ˜ 2 var βz φ3 ; H0

    

 η3 = E β˜z φ˜ 3 ; H0 + 2 var β˜z φ˜ 3 ; H0 erf−1 2Pf a − 1 ⎛ ⎛   ⎞⎞ η3 − E β˜z φ˜ 3 ; H1 1 ⎠⎠ Pd = ⎝1 + erf ⎝    2 ˜ ˜ 2 var βz φ3 ; H1

(51)

If BS antennas increases from M to nM, the new mean and variance are







E β˜z φ˜ 3 ; H0 ≈ E β˜z φ˜ 3 ; H0



  1   var β˜z φ˜ 3 ; H0 ≈ var β˜z φ˜ 3 ; H0 n

(52)

Then the updated threshold is computed by





η3 = E β˜z φ˜ 3 ; H0 +



  −1  2 var β˜z φ˜ 3 ; H0 erf 2P f a − 1 n

(53)

−1

We have erf (2Pf a − 1 ) < 0 since it is normally 0 < Pfa < 0.5. Hence, it can be shown that η3 > η3 . In the same way,       one can obtain E β˜z φ˜ 3 ; H1 ≈ E β˜z φ˜ 3 ; H1 and var β˜z φ˜ 3 ; H1 ≈ 1 n





var β˜z φ˜ 3 ; H1 . Hence, the updated detection probability is

⎛

⎛

  ⎞⎞

˜ ˜ η3 − E βz φ3 ; H1 1 ⎠⎠ Pd = ⎝1 + erf ⎝    2 2

β˜ φ ˜ var ; H z 3 1 n ⎛ ⎛   ⎞⎞ ˜ ˜ η − E β φ ; H z 3 3 1 1 ⎠⎠ = Pd > ⎝1 + erf ⎝    2 ˜ ˜ 2 var βz φ3 ; H1

(54)

which proves deploying more BS antennas is beneficial to eavesdropper detection. As stated before, increasing pe could result in a higher eavesdropping rate and higher probability of detection simultaneously. Therefore, Eve should balance between Ce and Pd via adjusting its transmit power. 6. Simulation results and discussions The considered model contains a legitimate transmit-receive pair (Alice and Bob) and an active eavesdropper (Eve). Channels of different transmit-receive pairs are modeled by independent Rayleigh fading. Both analytical and numerical results are included for the purpose of comparison. All numerical results are averaged over 10,0 0 0 independent realizations.

Fig. 5. The relationship between Pd and M for the proposed schemes, where pe varies.

Fig. 3 draws the receiver operating characteristic (ROC) curves of three detection schemes, where pu = 10dB, pe = 5dB, βh = 1, βg = 1, βn = 10dB, N1 = 10 and C = 10. The well match between numerical and analytical results validate the effectiveness of our analysis. Although scheme B possesses the best performance, the difference among these three are not remarkable. This is attributed to the approximation adopted in scheme A and C, while the PDF of decision metric in scheme B is accurate. In addition, Pd improves as M grows larger when Pfa is fixed. For example, detection probabilities higher than 90% can be achieved when Pf a = 1% and M = 200. Fig. 4 shows the comparison between predefined Pfa and simulated Pfa 2 , where parameters can be referred to in Fig. 3. Since approximations are employed to derive our scheme, thus some extent of mismatch could exist between predefined Pfa and simulated Pfa . A large mismatch often signifies the simulation results are of low degree of confidence, which should be paid close attention to. Fortunate enough, the close match between predefined Pfa and simulated Pfa proves our detection schemes work well. More importantly, Fig. 4 shows our schemes would not improve the detection performance at a cost of increasing Pfa , which is crucial in practice. 2 Simulated Pfa indicates P {φ˜ 1 < η1 } in scheme A, P{φ 2 < η2 } in scheme B or P {β˜z φ˜ 3 < η3 } in scheme C.

8

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411

Fig. 6. The relationship between Pd and pe for the proposed schemes, where M varies.

Fig. 8. Probability of detection versus probability of false alarm, where the proposed algorithms and that in reference [15] are included.

Fig. 7. The relationship between Pd and β n for the proposed schemes, where M varies.

robust to noise variance. For example, Pd is approximately 100% when βn = 5dB. While Pd = 70%, 90%, 100% at M = 50, 100, 150, as the noise variance increases to βn = 20dB. Fig. 8 compares the ROC curves between the proposed three algorithms and that in reference [15]. Specifically, this algorithm relies on pilot retransmission, that is, users send pilots to the BS, then the BS transmits the conjugate of its received signal back to users, where the final decision on whether the attacker is present or not is made. For a fair comparison, we assume the common parameters are M = 100, pu = 10dB, βn = 10dB, N1 = 10 and the number of observations is 2M. As can be revealed from this figure, our proposed algorithms achieve a better Pd than reference [15] when Pfa is fixed. This can be attributed to the fact that reference [15] requires to retransmit pilot in independent channel coherence intervals, and its performance cannot be guaranteed if times of retransmission is not large enough. In contrast, based on the channel estimation results, the proposed algorithms collect observations in a single channel coherence interval, which is much easier and more practical.

Fig. 5 displays the relation between Pd and M, where pe varies. As before, the well matching between numerical and analytical results verifies our analysis. In addition, performance improvement as M increases shows the superiority of massive antennas array in physical layer security. Moreover, detection performance gets better when pe increases, thus an eavesdropper needs to tunes its transmit power trying to balance between hiding itself and eavesdropping information. It can be seen that at M = 100, Pd is approximately 60%, 92% and 100% when pe is 5dB, 7dB and 10dB, respectively. Fig. 6 shows the relationship between Pd and pe with a varying M, where other parameters can be referred to in Fig. 3. The remarkable improvement of detection accuracy as pe increases also proves the results in Fig. 5. Equivalently, one can derive that performance improves along with an increasing large-scale fading factor β g . Since β g relates to the distance between Alice and Eve, Eve needs to take this into consideration to avoid being observed or detected. In particular, at pe = 5dB, Pd equals to 35%, 60% and 90% when M = 50, 100 and 200. Fig. 7 presents the relationship between Pd and β n with a varying M, where other parameters can be referred to in Fig. 3. As before, scheme B performs the best though the superiority is not distinct. More importantly, it is observed that our schemes are

7. Conclusion This paper considers the detection of pilot spoofing attack in massive MIMO systems. The basic idea is that the difference in channel estimates under H0 and H1 can be employed to design detection schemes. Specifically, Bob carries out channel estimation using LS method after receiving pilots. Depending on how we gather observations from the channel estimate, three detectors are proposed by using LRT principle. In addition, performance analysis concerning Pd and the impact of key parameters on it are carried out. It can be derived that deploying more antennas is effective in improving Pd , whereas an eavesdropper needs to tune its transmit power to balance between eavesdropping and hidden abilities.

Declaration of Competing Interest We declare that we have no financial and personal relationships with other people or organizations that can inappropriately influence our work, there is no professional or other personal interest of any nature or kind in any product, service and/or company that could be construed as influencing the position presented in, or the review of, the manuscript entitled.

S. Xu, W. Xu and H. Gan et al. / Signal Processing 169 (2020) 107411

Supplementary material Supplementary material associated with this article can be found, in the online version, at doi:10.1016/j.sigpro.2019.107411. References [1] T.L. Marzetta, E.G. Larsson, O. Edfors, Massive MIMO for next generation wireless systems, IEEE Commun. Mag. 52 (2) (2014) 186–195. [2] T.L. Marzetta, Noncooperative cellular wireless with unlimited numbers of base station antennas, IEEE Trans. Wirel. Commun. 9 (11) (2010) 3590. [3] W. Trappe, The challenges facing physical layer security, IEEE Communications Magazine 53 (6) (2015) 16–20. [4] N. Yang, L. Wang, G. Geraci, et al., Safeguarding 5g wireless communication networks using physical layer security, IEEE Commun. Mag. 53 (4) (2015) 20–27. [5] J. Gao, M. Li, L. Zhao, et al., Contention intensity based distributed coordination for v2v safety message broadcast, IEEE Trans. Veh. Technol. 67 (12) (2018) 12288–12301. [6] F. Wang, R. Li, J. Zhang, et al., Enhancing the secrecy performance of the spatial modulation aided VLC systems with optical jamming, Signal Process. 157 (2019) 288–302. [7] D. Kapetanovic, G. Zheng, F. Rusek, Physical layer security for massive MIMO: an overview on passive eavesdropping and active attacks, IEEE Commun. Mag. 53 (6) (2015) 21–27. [8] K. Cumanan, H. Xing, P. Xu, et al., Physical layer security jamming: theoretical limits and practical designs in wireless networks, IEEE Access 5 (2016) 3603–3611.

9

[9] J. Vinogradova, E. Björnson, E.G. Larsson, Detection and mitigation of jamming attacks in massive MIMO systems using random matrix theory, in: Proceedings of the IEEE 17th International Workshop on Signal Processing Advances in Wireless Communications (SPAWC), IEEE, 2016, pp. 1–5. [10] J. Vinogradova, E. Björnson, E.G. Larsson, Jamming massive MIMO using massive MIMO: asymptotic separability results, in: Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE, 2017, pp. 3454–3458. [11] H. Akhlaghpasand, S.M. Razavizadeh, E. Björnson, et al., Jamming detection in massive MIMO systems, IEEE Wirel. Commun. Lett. 7 (2) (2017) 242–245. [12] T.T. Do, E. Björnson, E.G. Larsson, et al., Jamming-resistant receivers for the massive MIMO uplink, IEEE Trans. Inf. Forens. Secur. 13 (1) (2017) 210–223. [13] Q. Xiong, Y.C. Liang, K.H. Li, et al., Secure transmission against pilot spoofing attack: a two-way training-based scheme, IEEE Trans. Inf. Forens. Secur. 11 (5) (2016) 1017–1026. [14] S. Xu, W. Xu, C. Pan, et al., Detection of jamming attack in non-coherent massive SIMO systems, IEEE Trans. Inf. Forens. Secur. 14 (9) (2019) 2387–2399. [15] W. Xu, S. Xu, B. Li, Detection of pilot spoofing attack in massive MIMO systems, in: Proceedings of the IEEE International Conference on Communications (ICC), IEEE, 2019, pp. 1–6. [16] S.M. Kay, Fundamentals of Statistical Signal Processing, Prentice Hall PTR, 1993. [17] J.L. Devore, Probability and Statistics for Engineering and the Sciences, Cengage Learning, 2011. [18] R.G. J., L.G. J., Tables of the Noncentral t-Distribution, Stanford, Cal: Stanford University Press, 1957.