Pilot contamination attack detection for multi-cell MU-massive MIMO system

Int. J. Electron. Commun. (AEÜ) 113 (2020) 152945

Contents lists available at ScienceDirect

International Journal of Electronics and Communications (AEÜ) journal homepage: www.elsevier.com/locate/aeue

Regular paper

Pilot contamination attack detection for multi-cell MU-massive MIMO system Muhammad Hassan, Muhammad Zia ⇑, Awais Ahmed, Naeem Bhatti COMSIP LAB, Department of Electronics, Quaid-i-Azam University, Islamabad, Pakistan

a r t i c l e

i n f o

Article history: Received 23 January 2019 Accepted 4 October 2019

Keywords: PCA PHY Active eavesdropping Multi-cell MU-MaMIMO Detection Low-complexity

a b s t r a c t This work presents a low-complexity pilot contamination attack (PCA) detector for a multi-cell multiuser massive multiple-input, multiple-output (MU-MaMIMO) system. An active eavesdropper (Eve) in the reference cell transmits synchronized training sequence of the legitimate user (LU) under attack in order to alter precoder to steel information in the downlink data phase. The detection of an active Eve is vital for the information security and enhances secrecy capacity of the LU. We formulate binary hypotheses for active Eve detection from the contaminated channel estimation. We provide performance analysis of the proposed detector. The comparison of analysis and Monte Carlo runs verifies the accuracy of the analysis. The simulation results demonstrate that the performance of the proposed PCA detector is better than the well-known minimum descriptive length (MDL) method in low SNR regime. Ó 2019 Elsevier GmbH. All rights reserved.

1. Introduction Wireless communication systems are vulnerable to both active and passive eavesdropping due to broadcast nature of the wireless channels [1–4]. The secret key generation from channel randomness [5] and secrecy capacity [6–10] are two fundamental approaches to secure information of the wireless networks at the physical layer (PHY). The secret key generation from the reciprocal and non-reciprocal channel by exploiting channel randomness has been interest of the research community [11–14]. The secrecy capacity of the MaMIMO system is much higher as compared to MIMO system due to the availability of large number of base station (BS) antennas to design beam (precoder) towards the LU [15–17]. Thus, passive eavesdropping is not effective when transmitter has large number of transmit antennas [18]. In MaMIMO system, Eve launches PCA on the LU in training phase by transmitting pilot sequence of the user under attack [19] in order to steer partial beam towards Eve in the downlink direction. The PCA has detrimental impact on the secrecy capacity of MaMIMO system [19]. The secrecy capacity of MaMIMO system under PCA can be enhanced by adding artificial noise (AN) in the null sub-space of the signal space [20,21] at the expense of signal power. In the event of absence of PCA, the knowledge of PCA can further improve the secrecy capacity of the LU by allocating all power to the signal. The impact of pilot contamination on the performance of multi⇑ Corresponding author. E-mail address: [email protected] (M. Zia). https://doi.org/10.1016/j.aeue.2019.152945 1434-8411/Ó 2019 Elsevier GmbH. All rights reserved.

cell MaMIMO systems can also be reduced by optimizing the pilot assignment [8,9]. The detection of an active attack (PCA) is important to prevent leakage of private information towards Eve. The detection of Eve foretells the BS whether to add AN or not with the precoded data during the downlink phase. AN shares downlink power with the precoded data. Hence, Eve detection is vital to enhance secrecy capacity due to the fact that in the absence of Eve, total downlink power will be allocated to signal part. 1.1. Related work The seminal work in [19] investigated PCA for BS with multiple antennas. Work in [22] used the random pilot sequence for PCA detection. Multiple PCA detection approaches for MaMIMO systems were discussed in [23]. Secure transmission under PCA and jamming for MaMIMO system was presented in [24]. Pilot spoofing attack (PSA) detection and channel estimation for single cell MaMIMO system using sub-space based MDL method was proposed in [25]. The two-way pilot method for discriminatory channel estimation was presented in [26] using whitening-rotation based semi-blind technique. A number of PCA detection techniques for MIMO systems were presented in [26,27], which are based on the NeymanPearson test assuming the knowledge of channel and noise covariance matrices. The energy ratio based PCA detector presented in [28] exploited the asymmetry power levels of the received signal at the legitimate receiver and transmitter. The two-way pilot assisted PCA detector in

2

M. Hassan et al. / Int. J. Electron. Commun. (AEÜ) 113 (2020) 152945

[29] achieves better performance than [28] and also estimates channels from user and Eve. However, the techniques in [28,29] need uplink and downlink pilots. A recent work in [30] added a random signal to the pilot sequence for reverse channel estimation at LU. The BS used the source enumeration method to detect Eve. The MDL scheme in [30,31] depends on uplink pilots and is extended for multi-user time-division duplex/space-division multiple access (TDD/SDMA) uplink model [2]. The PCA detector based on MDL technique has poor performance at low SNR regime and higher complexity. The proposed PCA detector for single user in [32] using random symbols has better performance in low SNR regime. The improved energy detector (IED) in [33,34] achieves better performance in comparison with the conventional energy detector (ED). Gahane et al. [33] extended the IED for the mobile cognitive users of cooperative cognitive networks for fading channels, which have generalized Nakagami-q, Nakagami-m; m
l and j
l distributions. Authors in [33] investigated the receiver operating characteristic (ROC) curves and its area under the curves. Moreover, the performance of the cooperative spectrum sensing for the multihop cognitive radio network using multiple antennas is investigated in [34] with the help of IED. Gahane and Sharma [35] explored the performance of improved energy detector in cooperative cognitive radio, which have selection combining diversity. Furthermore, imperfect channel state information and cognitive user mobility are considered to assess probability of false alarm, probability of miss detection, and probability of error over a Rayleigh fading wireless channel. However, detection statistics in [35] were obtained based on single sample of the signal. In [33– 35], authors constructed hypotheses H0 (noise only) and H1 (primary user active) from the observation for the detection of primary user in cognitive network. In the proposed PCA detector, least square (LS) channel estimate is used to construct H0 (LU only in training phase) and H1 (LU and Eve both active). Furthermore, the proposed method also considers interference from the neighboring cells due to pilot reuse. The existing methods have higher complexity due to sub-space based approaches and PCA detection for multi-cell MU-MaMIMO systems is not addressed. 1.2. Contributions The existing works focused on the PCA detection for single cell communication systems. The sub-space based PCA detection methods have poor performance in low SNR regime and higher complexity [31] and references therein. Most of the existing methods transmit customized waveform with pilot sequence, which impairs channel estimate of the LU [31,28]. We propose a low-complexity PCA detector for multi-cell MU-MaMIMO systems, which has better performance in low SNR regime. The proposed method works for short pilot length and does not require modifications in the pilot sequence. The proposed method evaluates the energy of LU’s estimated channel and compares it with the threshold value which is obtained from likelihood ratio test [36] to detect PCA in a multicell MU-MaMIMO system. We also explore the impact of location of Eve and change in the number of BS antennas in our proposed PCA detector. This work has the following key contributions:  We formulate binary hypotheses from the channel estimate of LU to detect PCA for a multi-cell MU-MaMIMO system. The proposed method uses norm of the reverse channel estimate in pilot phase at BS for Eve’s detection. The performance of the proposed method is better than the existing methods.  We also provide performance analysis of the proposed PCA detector for single and multiple cells. The comparison of analysis and Monte Carlo results reveal that our analysis agrees with simulation results.

 The complexity of the proposed method increases linearly with the number of BS antennas, whereas the complexity of subspace based methods increases exponentially with the number of BS antennas [2,30,31].  The proposed method does not impose constraints on the length of pilot sequence. The existing sub-space based methods require training length larger or equal to the BS antennas [2,30,31].  The proposed method achieves better performance in low SNR regime as compared to MDL based PCA detectors and is applicable for the multi-cell MU-MaMIMO network. The rest of our work is organized as follows. In Section 2, we present the system model for PCA. In Section 3, we propose PCA detector for multi-cell MU-MaMIMO system. Section 4 provides analysis of the proposed PCA detector. Section 5 discusses the performance of the proposed PCA detector and its comparison with MDL based method. We conclude our work in Section 6. 1.2.1. Notations We represent vectors and matrices by bold-face lowercase and bold-face uppercase letters, respectively. We use ð:ÞH for Hermitian, ð:ÞT for transpose and Ef:g for expectation operator. IN represents N  N identity matrix. Note that C is set of complex numbers. 2. System model We consider a multi-cell MU-MaMIMO system in Fig. 1 consisting of L þ 1 cells, each cell has a BS equipped with M antennas and K single antenna users (M  K). A single antenna active Eve contaminates pilot of a user under attack in the reference (0-th) cell. We assume time-division duplex (TDD) mode and channel reciprocity. All the users in a cell transmit orthogonal pilot sequences of length s to the respective BS for the estimation of reverse channel state information (CSI). The BS designs precoders using estimate of the reverse CSI of each user in the cell for data transmission in the downlink direction. An active Eve in the reference cell launches PCA by transmitting synchronized pilot sequence of the LU (the 1st user of 0-th cell) under attack towards the BS in order to contaminate channel estimation of the LU [19,21]. In this work, we assume that LUs and Eve transmit signals with unit power, whereas interference from the neighboring cells in pilot and data phases are scaled by power normalization factor

Fig. 1. System model of a multi-cell MU-MaMIMO wireless communication system with an active Eve present in the reference cell.

3

M. Hassan et al. / Int. J. Electron. Commun. (AEÜ) 113 (2020) 152945

pffiffiffiffi

q [21]. Consequently, instead of estimating LU’s channel h001 , the pffiffiffiffi P 0 0 reference BS estimates the sum h01 þ hE þ q  Ll¼1 hl1 , where 0

h01 2 CM1 and hE 2 CM1 are the channel from the LU and the p channel from Eve to the 0-th cell BS, respectively. Note that hlk is the channel vector from the k-th user of l-th cell to p-th cell BS, p where l ¼ p ¼ 0; 1; . . . ; L. The channel vectors hlk and hE are independent and identically distributed (i.i.d.) with distribution   CN 0; M1 IM . The PCA alters the precoder to steer beam towards Eve without being detected, which compromises information security at PHY. Thus, PCA detection is vital to achieve information security. In the following section, we present a low-complexity PCA detection method by formulating binary hypotheses.

  1 f zjH0 ðzÞ ¼ qffiffiffiffiffiffiffiffiffiffiffiffiffiffi exp
2rE 2 ; M 0 ð2pr20 Þ   1 f zjH1 ðzÞ ¼ qffiffiffiffiffiffiffiffiffiffiffiffiffiffi exp
2rE 2 ; M 1 ð2pr21 Þ

Þ r and r2 ¼ 2 þ qðL
1Þ þ r are the where kzk2 ¼ E; r20 ¼ M1 þ qðL
1 þM 1 M M s Ms M instantaneous energy and variances of both hypotheses, respectively. The binary detector under both hypotheses by using likelihood ratio test (LRT) [36] is 2

H1

f zjH1 ðz=H1 Þ

R

During pilot phase for reverse channel estimation, each user in a cell transmits orthogonal pilot sequence of length s to the corresponding BS. Eve in the reference cell transmits pilot sequence of the user under attack to alter precoder design in downlink data phase to steel information. For PCA detection, we formulate binary hypotheses from the estimated channel during the reverse pilot phase. The received pilot signal Y0 at the BS of the 0-th cell is

k¼1

ð1Þ

l¼1 k¼1

s1

where xlk 2 C is the pilot sequence of the k-th user located in l-th cell having length s; Ie 2 f0; 1g is an indicator function. The elements of noise matrix N are i.i.d. having Gaussian distribution of zero mean and variance rM . All the users and Eve transmits pilot sequence with equal power (Plk =PE ¼ 1). The same K orthogonal publicly known pilot sequences are used from the K users of each cell [17]. That is, x0k ¼ x1k ¼    xlk ¼ xk ; xHlk xlk ¼ s; xHlk xlp ¼ 0, where k – p. The least square estimate (LSE) of reverse channel of the LU under attack is

R

H0

By substituting H1

R

E

H0

ln

  1 qffiffiffiffiffiffiffiffiffiffiffiffiffiffi exp
2rE 2 ; M 0 H0 ð2pr20 Þ  2 2   2 r r r M r20
r12 ln r12 : R

1

0

ð6Þ

0

r20 and r21 in (6), we have



2 2þqðL
1Þþrs 2 1þqðL
1Þþrs

ð5Þ

H1

g ¼ 1 þ qðL
1Þ þ rs2



K pffiffiffiffiffiffiffi L P K pffiffiffiffiffiffi P pffiffiffiffi P 0 0 Y0 ¼ P0k h0k xT0k þ q Plk hlk xTlk þ

pffiffiffiffiffi 0 Ie PE hE xT01 þ N;

H1

E

2

f zjH0 ðzjH0 Þ;

H0

  1 qffiffiffiffiffiffiffiffiffiffiffiffiffiffi exp
2rE 2 M 1 ð2pr21 Þ

3. PCA detection

ð4Þ

  2 2 þ qðL
1Þ þ rs

ð7Þ

 :

Next, we present performance analysis of the proposed PCA detector for multi-cell MU-MaMIMO system. 4. Analysis

2

x

0 x01 T x01

z ¼ Y0 kx 01k2 ¼ h01 01

kx01 k2

þ I e hE

x01 T x01

01

We

suppose

ð2Þ

l¼1

that each

pilot

symbol

has

unit

energy

(kxlk k ¼ s P K). In the absence of an active Eve, pilot reuse is the only pilot contamination source during reverse training phase. The hypotheses H0 and H1 for the absence and presence of an active attack, respectively, are 2

0

H0 : z ¼ h01 þ

L  pffiffiffiffiX q h0l1 þ Nxs01 and l¼1

0

H1 : z ¼ h01 þ hE þ

L pffiffiffiffiX

q

ð3Þ 0

the reference user, E ¼ kzk2 with threshold g to detect the PCA. The elements of vector z are i.i.d. complex random variables. The real and imaginary components of each element of z j H0 and z j H1 are also i.i.d. with mean zero and variances

kx01 k2

L L pffiffiffiffiX pffiffiffiffiX Nx Nx 0 0 0 þ q hl1 þ kx 01k2 ¼ h01 þ Ie hE þ q hl1 þ s01 : l¼1

In this section, we provide performance and complexity analysis of the proposed PCA detector. The proposed PCA detector in (7) compares the instantaneous energy, which is channel estimate of

Nx

hl1 þ s01 :

l¼1

r20 2

and

r21 2

, respec-

tively. The random variable v ¼ E ¼ kzk2 has chi-square distribution of degrees 2M. The average energies of z j H0 and z j H1 , respectively, are



2 Ea0 ¼ E zH z j H0 ¼ 1 þ qðL
1Þ þ rs ; H

2 Ea1 ¼ E z z j H1 ¼ 2 þ qðL
1Þ þ rs :

ð8Þ

Now, we evaluate performance of the proposed PCA detector in the form of probability of false alarm PF , probability of miss PM , probability of detection PD and probability of detection error P e . Let the instantaneous energies under hypothesis H0 and H1 be E0 ¼ E j H0 and E1 ¼ E j H1 , respectively. The PM and PF , respectively, are P M ¼ PðE1 ¼ E j H1 < gÞ and P F ¼ P ðE0 ¼ E j H0 P gÞ. Thus [37,36],

  x n
1 2 dx x exp
  n 1 r21 22 C 12 n 0 2  X  c g m
1 1 g ¼ 1
exp
2 ; r1 c¼0 c! r21 Z

g

1

Path gains from LU to the BS are i.i.d. with Gaussian distribution of zero mean and r2h ¼ M1 variance each. Thus, distribution of z and H1 are z j H0  under hypotheses H     0     Þ qðL
1Þ r2 r2 I 2 CN 0; M1 þ qðL
1 þ  CN 0; þ þ and z j H I , M 1 M M Ms Ms M M

PM ¼

respectively. The probability density functions under hypothesis H0 and H1 are

where m ¼ M. Similarly,

r n

ð9Þ

4

M. Hassan et al. / Int. J. Electron. Commun. (AEÜ) 113 (2020) 152945

 
1  g mX 1 g PF ¼ 1
1
exp
2 r0 c¼0 c! r20  X  c g m
1 1 g ¼ exp
2 : r0 c¼0 c! r20

c !

s P M. We do not impose such constraint on the training length in the proposed method. ð10Þ

The P D can be written as

 X  c g m
1 1 g PD ¼ 1
PM ¼ exp
2 : r1 c¼0 c! r21

ð11Þ

Note that the probability of error is Pe ¼ 12 ðPM þ PF Þ. By using (9) and (10) in above equation, we have

 m
1 X  g c 1 Pe ¼ 12
12 exp
rg2 þ c! r2 1

1 2

c¼0

1

ð12Þ

 m
1 X  g c 1 exp
rg2 : c! r2 0

c¼0

0

The comparison of analytical and simulation results is provided in Section 5. The complexity of the proposed method is OðMÞ, which increases linearly with the number of antennas at the BS. Most of the existing methods [2,4,30,31] use MDL algorithm as follows:

b d ¼ arg

ð13Þ

min16d6M
1 MDLðdÞ;

where M 1 X MDLðdÞ ¼
lnðki Þ þ ðM
dÞ ln ki M
d i¼dþ1 i¼dþ1 M X

þ

!

dð2M
dÞ lnðsÞ : 2s

ð14Þ

Note that k1 P k2 . . . P kM are the ordered eigenvalues of correlation matrix of received pilot signal Y0 . The MDL method uses second order statistics of the observation and eigenvalues of the auto  correlation matrix. Thus, the complexity of MDL method is O M 3 , which is much higher than the proposed method. The comparison of the elapsed time of the proposed PCA detector and the MDL based PCA detector for 1000 iterations in MATLAB is presented in Table 1. In the simulation setup, the proposed method and MDL based PCA detector use the same machine with L ¼ 0 and K ¼ 5. Remarks:

5. Numerical results In this section, we present the performance of the proposed PCA detector in comparison with MDL based PCA detection for multicell MU-MaMIMO system [2]. We also provide comparison of the Monte Carlo simulation results and analysis of the proposed PCA detector. The impact of Eve location and BS antennas M on the performance of the proposed PCA detector is also presented. In the simulation setup, we consider L ¼ 3; K ¼ 5, Plk ¼ P E ¼ 1 and q ¼ 0:1. We evaluate simulation and analytical performance for M antennas at the BS. Each LU and Eve is equipped with single antenna. Note that BS and LUs communicate in TDD mode. The channel gains between BS and LUs are i.i.d. Gaussian distributed with zero mean and variance M1 as discussed in Section 2. The pilot reuse in the neighboring cells with power scaling q also causes pilot contamination. In simulation setup, LU and Eve transmit equal power (P 01 ¼ PE ¼ 1) unless otherwise specified. Fig. 2 compares Monte Carlo simulation and analytical results of PCA detection threshold g, average energies under hypothesis H0 and H1 of the proposed PCA detector. In simulation setup, we consider training length s ¼ 12, number of cells (L ¼ 3), BS antennas M ¼ 128 and K ¼ 5 users in each cell. The results in Fig. 2 reveal that the analytical and Monte Carlo simulations match under hypothesis H0 and hypothesis H1 . Furthermore, analytical and simulation thresholds also agree in all SNR regimes. The average energies Ea0 and Ea1 under hypothesis H0 and H1 , respectively, are function of noise variance. In low SNR regime, noise is stronger than signal power. The detection threshold Ea0 < g < Ea1 decreases as SNR increases due to weaker noise. The optimal threshold given in (7) is derived from likelihood ratio test [36]. Fig. 3 compares the Monte Carlo probability of detection error Pe with analytical Pe in (12) of the proposed method for training length s ¼ 12 and M ¼ 64; 128 and 140 antennas. We consider 4 cells (L ¼ 3) and each cell has K ¼ 5 users. The comparison of analysis with Monte Carlo runs verifies the accuracy of the proposed analysis in Section 4. Furthermore, probability of detection error Pe decreases by increasing M due to higher diversity order. In high SNR regime, the proposed method suffers from probability of error floor due to overlap of distributions under hypothesis H0 and H1 in (3).

 The sub-space based methods such as MDL have poor performance at low SNR regime and higher complexity. The poor performance of MDL in low SNR regime is due to the large eigenvalues corresponding to the noise sub-space. However, the proposed PCA detector performs comparatively better in low SNR regime.  In case of multi-cell scenario, MDL based detector fails to differentiate between pilot reuse and PCA from the active Eve. However, the proposed PCA detector works effectively for multi-cell network.  The sub-space methods work for full rank correlation matrix. For correlation matrix to be full rank, length of pilot sequence

Table 1 Elapsed time for the proposed and MDL methods. Parameters

Proposed

MDL

M ¼ 64; s ¼ 64 M ¼ 128; s ¼ 128 M ¼ 256; s ¼ 256

12.650 s 31.042 s 106.571 s

100.743 s 420.665 s 2682.405 s

Fig. 2. Comparison of Monte Carlo simulation and analysis of average energies under hypothesis H0 and H1 , and threshold g of the proposed method for 4 cells (L ¼ 3), K ¼ 5 users in each cell, training length s ¼ 12 and M ¼ 128 BS antennas.

M. Hassan et al. / Int. J. Electron. Commun. (AEÜ) 113 (2020) 152945

Fig. 3. Comparison of Monte Carlo and analytical probability of detection error P e for 4 cells (L ¼ 3), K ¼ 5 users in each cell, training length s ¼ 12 and different values of BS antennas M.

Receiver operating characteristic curve is a well-known measure of the performance of a binary detector, which is a function of detection threshold g at specific SNR. In Fig. 4, we present ROC curve of the proposed PCA detector for the training length s ¼ 12, 4 cells (L ¼ 3), K ¼ 5 users in each cell and M ¼ 128 at
15 dB,
10 dB and
5 dB SNR. It is clear that ROC curve achieves (P D ¼ 1; P F ¼ 0) point in very low SNR regime for the case of multicell system with the training length s ¼ 12. The impact of detection threshold g on the probability of detection error Pe of the proposed method for multi-cell MU-MaMIMO system is presented in Fig. 5. In simulation setup, we perform exhaustive search on the detection threshold g, which minimizes the probability of the detection error for different BS antennas and training length at
5 dB SNR. The results suggest that detection error probability Pe is a convex function of g presented for training length s ¼ 5 and 12, and BS antennas M ¼ 64 and 128 at
5 dB SNR. The optimal detection threshold g, which minimizes P e agrees with the analytical detection threshold g in (7). Any value of g other than optimal g causes higher detection error probability P e , which is clear from Fig. 5. Furthermore, detection threshold g is independent of the number of BS antennas as shown in (7). The

Fig. 4. ROC of the proposed binary detector at P 01 =r2 ðdBÞ ¼
15 dB,
10 dB and
5 dB for training length s ¼ 12; M ¼ 128 BS antennas, 4 cells (L ¼ 3) and K ¼ 5 users in each cell.

5

Fig. 5. Probability of detection error P e vs detection threshold g of multi-cell MUMaMIMO system for 4 cells (L ¼ 3), K ¼ 5 users in each cell at P 01 =r2 ðdBÞ ¼
5 dB for the proposed PCA detector.

Fig. 6. Comparison of Probability of detection P D of the proposed and MDL based PCA detector for single and multiple cell L ¼ 0 and 3, training length s ¼ 128 and K ¼ 5 users in the cell.

detection error probability P e decreases by increasing antennas M at the BS with the same detection threshold g due to higher diversity order. In Fig. 6, we provide comparison of probability of detection P D as a function of SNR for the proposed method with the MDL based detector in [2]. We consider single cell (L ¼ 0) and 4 cells (L = 3) with K ¼ 5 users, s ¼ 128 and different number of BS antennas M. Note that MDL based PCA detector fails to differentiate PCA and pilot reuse from the neighboring cells. The proposed PCA detector uses analytical threshold g in (7). Fig. 6 shows that the proposed method has better performance as compared to the existing MDL method in low SNR regime. MDL based method uses eigenvalues of auto-covariance matrix to detect PCA. In low SNR regime, eigenvalues based detectors have poor performance as compared to in high SNR regime. We notice that the number of BS antennas have subtle impact on the probability of detection. However, the number of BS antennas significant impact on the probability of detection error Pe for single and multiple cells as shown in Fig. 7 and Fig. 8. Fig. 7 presents the comparison of detection error probability Pe of the proposed method with the MDL based PCA detector in [2] for

6

M. Hassan et al. / Int. J. Electron. Commun. (AEÜ) 113 (2020) 152945

Fig. 7. Impact of number of users K in a cell on the probability of detection error P e of the MDL based and proposed PCA detector for training length s ¼ 128 and 256 with number of antennas M ¼ 128 and 256.

Fig. 8. Impact of BS antennas M on the probability of detection error P e of the proposed PCA detector for 4 cells (L ¼ 3), K ¼ 5 users in each cell and training length s ¼ 12 at different values of SNR.

single cell (L ¼ 0), K ¼ 5; 20 and 50 users. The training length and Antenna number s ¼ M ¼ 128 and 256 are considered. The proposed method has better performance in low SNR regime, whereas the MDL based detector has poor performance in low SNR regime. Sub-space based MDL method is in fact blind detector, which uses eigenvalues of the second order statistics, which has poor performance in low SNR regime and require large observations to work. Note that the MDL method uses eigenvalues of the estimated autocorrelation matrix of the received signal to enumerate the sources. It has been shown in [38] that asymptotically (when M  K and s  K) the MDL criteria achieves Kb ¼ K with probability one (w. p. 1). In the simulation setup of Fig. 7, M ¼ 128 and 256 with K ¼ 5 and training length s ¼ 128 and s ¼ 256 (M  K and s  K). Thus, even in low SNR regime (i.e. at
6 dB SNR), the estimated value of source enumeration approaches to the actual number of sources K (which is the rank of source signal correlation matrix) for large training and receive antennas. Consequently, the probability of detection error approaches zero. Fig. 7 also shows the impact of number of users K on the MDL and the proposed PCA detector. Fig. 7 reveals that the performance of MDL based PCA detector deteriorates by increasing number of users K,

Fig. 9. Diversity of BS antennas M for the probability of detection error P e of the proposed PCA detector for 4 cells (L ¼ 3), K ¼ 5 users in each cell and training length s ¼ 12.

Fig. 10. Impact of location of Eve on the probability of detection error P e on the proposed PCA detector for 4 cells (L ¼ 3), K ¼ 5 users in each cell and training length s ¼ 12 at different SNR values.

whereas the proposed PCA detector remains unaffected by the number of users K due to orthogonal pilot sequences within the cell. Note that probability of detection error Pe of the proposed method has an error floor due to comparable variances of binary hypotheses H0 and H1 . Fig. 8 presents impact of BS antennas M on the probability of detection error of the proposed PCA detector. In the simulation setup, we consider 4 cells (L ¼ 3), K ¼ 5 users in each cell and training length s ¼ 12. We investigate impact of number of BS antennas M by varying antennas from 16 to 400 for PE =r2 ¼ P01 =r2 (dB)=-10 dB,
5 dB and 0 dB. It is clear from Fig. 8 that PCA detection error probability decreases by increasing BS antennas due to higher diversity. Impact of antennas diversity of BS on the detection error of PCA is presented in Fig. 9. In the simulation setup, we consider BS antennas M = 256, 350, 400 and 512 to observe diversity for 4 cells and 5 users in each cell. Eve is in the reference cell and transmits pilot signal with same power as that of LU. That is, PE ¼ P 01 ¼ 1. Fig. 9 reveals that slope of the detection error probability of PCA is steeper for the higher number of BS antennas due to diversity gain. Note that diversity order of detection method is the performance gain of the receiver for unit SNR

M. Hassan et al. / Int. J. Electron. Commun. (AEÜ) 113 (2020) 152945

improvement. Due to diversity, probability of detection error curve split apart in high SNR regime. Fig. 10 presents the impact of location of Eve on the probability of detection error Pe of the proposed PCA detector. In Fig. 10, we fix position of the LU in reference cell by setting P01 =r2 (dB) = 5 dB for 4 cells (L ¼ 3), K ¼ 5 users in each cell and training length s ¼ 12. Note that position of Eve in cell has direct relationship with SNR of Eve PE =r2 (dB). In Fig. 10, we vary PE =r2 (dB) from 0 dB to 7 dB to investigate the impact of position of Eve. The detection probability of Eve is higher when the energy difference under hypotheses H0 and H1 is large. The detection error probability P e of PCA decreases by increasing PE =r2 (dB). That is, when BS receives higher pilot contamination from Eve. Fig. 10 reveals that detection error probability of PCA lowers when Eve is closer to the BS.

6. Conclusion We presented a low-complexity PCA detector for a multi-cell MU-MaMIMO system. We formulated binary hypotheses from pilot assisted reverse channel estimate at BS for detection of an active Eve. We also provided performance analysis of the proposed detector. The complexity of the proposed method increases linearly with number of transmit antennas M. The proposed method has better performance as compared to the sub-space based MDL detector, especially, in low SNR regime. Unlike MDL based detectors, the proposed method does not impose restriction on the pilot length s. Declaration of Competing Interest There are no conflict of interest in this work. References [1] Tugnait JK. On detection of pilot contamination attack in multiple antenna systems. In: 2015 49th Asilomar conference on signals, systems and computers. IEEE; 2015. p. 1757–61. [2] Tugnait JK. Detection of pilot contamination attack in TDD/SDMA systems. In: 2016 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE; 2016. p. 3576–80. [3] Nie X, Jiang H, Zhang M. Detection of pilot spoofing attack in multi-antenna systems using modified FDC criterion: a random matrix approach. In: 2017 3rd IEEE international conference on computer and communications (ICCC); 2017. p. 1117–20. https://doi.org/10.1109/CompComm.2017.8322717. [4] Zhang W, Lin H, Zhang R. Detection of pilot contamination attack based on uncoordinated frequency shifts. IEEE Trans Commun 2018;66(6):2658–70. https://doi.org/10.1109/TCOMM.2018.2791535. [5] Ren K, Su H, Wang Q. Secret key generation exploiting channel characteristics in wireless communications. IEEE Wireless Commun 2011;18(4):6–12. https:// doi.org/10.1109/MWC.2011.5999759. [6] Wyner AD. The wire-tap channel. Bell Syst Tech J 1975;54(8):1355–87. https:// doi.org/10.1002/j.1538-7305.1975.tb02040.x. [7] Xiong Q, Gong Y, Liang YC, Li KH. Achieving secrecy of MISO fading wiretap channels via jamming and precoding with imperfect channel state information. IEEE Wireless Commun Lett 2014;3(4):357–60. https://doi.org/ 10.1109/LWC.2014.2317194. [8] Kenarsari SR, Naeiny MF. Adaptive pilot reuse scheme for nonzero neighborhood structured downlink channel in massive MIMO. AEU - Int J Electron Commun 2019;99:48–58. https://doi.org/10.1016/j.aeue.2018.11.020. [9] Marinello JC, Abrão T. Pilot distribution optimization in multi-cellular large scale MIMO systems. AEU - Int J Electron Commun 2016;70(8):1094–103. https://doi.org/10.1016/j.aeue.2016.05.007. [10] Kumar R, Chauhan SS. Secrecy analysis of MRT/RAS system under Nakagami-m fading channels in the presence of imperfect channel state information. AEU – Int J Electron Commun 2018;85:68–73. https://doi.org/10.1016/j. aeue.2017.12.034.

7

[11] Hong YWP, Lan PC, Kuo CCJ. Enhancing physical-layer secrecy in multiantenna wireless systems: an overview of signal processing approaches. IEEE Signal Process Mag 2013;30(5):29–40. [12] Kapetanovic D, Dzevdan G, Zheng F Rusek. Physical layer security for massive MIMO: an overview on passive eavesdropping and active attacks. IEEE Commun Mag 2015;53(6):21–7. [13] Zhao N, Yu FR, Li M, Leung VC. Anti-eavesdropping schemes for interference alignment (IA)-based wireless networks. IEEE Trans Wireless Commun 2016;15(8):5719–32. [14] Zhao N, Yu FR, Li M, Yan Q, Leung VC. Physical layer security issues in interference-alignment-based wireless networks. IEEE Commun Mag 2016;54 (8):162–8. [15] Larsson EG, Edfors O, Tufvesson F, Marzetta TL. Massive MIMO for next generation wireless systems. IEEE Commun Mag 2014;52(2):186–95. [16] Hoydis J, Ten Brink S, Debbah M. Massive MIMO in the UL/DL of cellular networks: how many antennas do we need? IEEE J Sel Areas Commun 2013;31 (2):160–71. [17] Marzetta TL. Noncooperative cellular wireless with unlimited numbers of base station antennas. IEEE Trans Wireless Commun 2010;9(11):3590–600. [18] Rusek F, Persson D, Lau BK, Larsson EG, Marzetta TL, Edfors O, et al. Scaling up MIMO: opportunities and challenges with very large arrays. IEEE Signal Process Mag 2013;30(1):40–60. [19] Zhou X, Maham B, Hjorungnes A. Pilot contamination for active eavesdropping. IEEE Trans Wireless Commun 2012;11(3):903–7. [20] Zhou X, McKay MR. Secure transmission with artificial noise over fading channels: achievable rate and optimal power allocation. IEEE Trans Veh Technol 2010;59(8):3831–42. [21] Wu Y, Schober R, Ng DWK, Xiao C, Caire G. Secure massive MIMO transmission with an active eavesdropper. IEEE Trans Inf Theory 2016;62(7):3880–900. [22] Kapetanovic D, Zheng G, Wong KK, Ottersten B. Detection of pilot contamination attack using random training and massive MIMO. In: Proc IEEE 24th annual international symposium on personal, indoor, and mobile radio communications (PIMRC ’13); 2013. p. 13–18. https://doi.org/10.1109/ PIMRC.2013.6666096. [23] Kapetanovic D, Al-Nahari A, Stojanovic A, Rusek F. Detection of active eavesdroppers in massive MIMO. In: 2014 IEEE 25th annual international symposium on personal, indoor, and mobile radio communication (PIMRC). IEEE; 2014. p. 585–9. [24] Wang H, Huang K, Tsiftsis TA. Multiple antennas secure transmission under pilot spoofing and Jamming attack. IEEE J Sel Areas Commun 2018;36 (4):860–76. https://doi.org/10.1109/JSAC.2018.2825148. [25] Tugnait JK. Pilot spoofing attack detection and countermeasure. IEEE Trans Commun 2018;66(5):2093–106. [26] Yang J, Xie S, Zhou X, Yu R, Zhang Y. A semiblind two-way training method for discriminatory channel estimation in MIMO systems. IEEE Trans Commun 2014;62(7):2400–10. [27] Kang J-M, In C, Kim H-M. Detection of pilot contamination attack for multiantenna based secrecy systems. In: 2015 IEEE 81st vehicular technology conference (VTC Spring). IEEE; 2015. p. 1–5. [28] Xiong Q, Liang YC, Li KH, Gong Y. An energy-ratio-based approach for detecting pilot spoofing attack in multiple-antenna systems. IEEE Trans Inf Foren Secur 2015;10(5):932–40. https://doi.org/10.1109/TIFS.2015.2392564. [29] Xiong Q, Liang Y-C, Li KH, Gong Y, Han S. Secure transmission against pilot spoofing attack: a two-way training-based scheme. IEEE Trans Inf Foren Secur 2016;11(5):1017–26. [30] Tugnait JK. Self-contamination for detection of pilot contamination attack in multiple antenna systems. IEEE Commun Lett 2015;4(5):525–8. https://doi. org/10.1109/LWC.2015.2451638. [31] Tugnait JK. Detection and identification of spoofed pilots in TDD/SDMA systems. IEEE Trans Wireless Commun Lett 2017;6(4):550–3. https://doi.org/ 10.1109/LWC.2017.2715814. [32] Wang X, Liu M, Wang D, Zhong C. Pilot contamination attack detection using random symbols for massive MIMO systems. In: Proc IEEE 85th vehicular technology conference (VTC Spring ’17); 2017. p. 1–7. https://doi.org/10.1109/ VTCSpring.2017.8108303. [33] Gahane L, Sharma PK, Varshney N, Tsiftsis TA, Kumar P. An improved energy detector for mobile cognitive users over generalized fading channels. IEEE Trans Commun 2017;66(2):534–45. [34] Singh A, Bhatnagar MR, Mallik RK. Performance of an improved energy detector in multihop cognitive radio networks. IEEE Trans Veh Tech 2015;65 (2):732–43. [35] Gahane L, Sharma PK. Performance of improved energy detector with cognitive radio mobility and imperfect channel state information. IET Commun 2017;11 (12):1857–63. [36] Mourad B. Signal detection and estimation. London: Artech House; 2005. [37] Proakis JG. Digital communications. New York: McGraw-Hill; 1995. [38] Zhao L, Krishnaiah PR, Bai Z. On detection of the number of signals in presence of white noise. J Multivar Anal 1986;20(1):1–25.