Primary User Emulation (PUE) Attack

The attacker replicates the defining physical-layer characteristics of a legitimate primary user to deceive spectrum sensors. This goes beyond simple energy transmission to include:

• Modulation scheme cloning: Replicating the exact constellation and symbol rate of signals like ATSC pilots or LTE cell-specific reference signals
• Cyclostationary signature forgery: Embedding the periodic statistical features that cyclostationary feature detectors rely on to distinguish primary users from noise
• Pilot tone insertion: Injecting known reference signals at precise subcarrier positions to match the expected frame structure of the emulated protocol

The attack exploits the regulatory and protocol-level requirement that secondary users must vacate a channel upon detecting a primary user. The operational impact cascades through the network:

• Forced spectrum evacuation: Legitimate cognitive radio nodes immediately cease transmission and initiate spectrum handoff procedures
• Throughput collapse: The constant need to sense and vacate channels destroys the secondary network's ability to maintain a stable data link
• Resource exhaustion: Repeated handoffs consume processing power and battery life on mobile cognitive radio devices, compounding the denial-of-service effect

PUE attackers are categorized by their objective, which dictates their transmission strategy:

• Selfish PUE (PUE-S): The attacker's goal is to clear the channel for its own exclusive use. It transmits the emulated signal only when it wants to transmit data, then ceases to allow its own secondary transmission
• Malicious PUE (PUE-M): The attacker's sole objective is disruption. It transmits the emulated signal continuously or randomly to prevent any legitimate secondary user from accessing the spectrum, with no intention of using the band itself
• Hybrid PUE: An attacker that alternates between selfish and malicious modes based on its own traffic demands or to evade detection

PUE attacks are particularly devastating because they exploit the fundamental asymmetry of spectrum sensing. A secondary user's sensor can only measure the local electromagnetic environment:

• Spatial advantage: An attacker positioned near a legitimate secondary user can transmit a low-power emulated signal that overwhelms the local sensor, while the actual primary user remains distant and undetectable
• Cooperative sensing bypass: The attacker can strategically position itself to corrupt the local observations of multiple nodes, feeding false occupancy data into the fusion center and degrading the global decision
• Shadowing correlation exploitation: In environments with correlated shadowing, a single attacker can simultaneously deceive a cluster of co-located sensors

The primary defense against PUE attacks relies on verifying that the source of a detected signal is physically consistent with a known primary transmitter location:

• Received Signal Strength (RSS) profiling: Comparing the measured signal strength to the expected path loss from the known primary transmitter coordinates; an attacker at a different location will produce an anomalous RSS signature
• Angle of Arrival (AoA) estimation: Using antenna arrays to determine the bearing of the incoming signal and cross-referencing with the known primary transmitter geolocation
• Time Difference of Arrival (TDOA): Multiple cooperating sensors timestamp the arrival of the signal to multilaterate its source, flagging emitters that do not map to the licensed transmitter's position

Even a perfectly modulated emulated signal carries the unique hardware-level imperfections of the attacker's transmitter, which can be used to distinguish it from the legitimate primary user's equipment:

• Transient analysis: The turn-on and turn-off transients of a power amplifier are unique to each device and extremely difficult to forge
• Non-linear distortion profiling: The specific pattern of amplifier non-linearity, IQ imbalance, and phase noise creates a hardware fingerprint that deep learning classifiers can identify
• Clock skew detection: Microscopic differences in oscillator stability between the attacker's and the legitimate transmitter's hardware manifest as measurable timing errors in the symbol stream

A broader category of physical-layer attacks where malicious nodes report falsified sensing data to corrupt the global decision. While a PUE attack mimics the signal of a primary user, an SSDF attack targets the fusion center's logic directly.

• Also known as a Byzantine attack in cooperative sensing.
• Can involve reporting a signal when the band is vacant (false alarm attack) or reporting vacancy when a signal is present (missed detection attack).

A trust-aware countermeasure that assigns a dynamic trust score to each cooperating node based on the historical consistency of its reports with the global decision.

• Nodes consistently reporting anomalies receive lower weights.
• Mitigates both SSDF and PUE attacks by isolating malicious actors.
• Requires a warm-up period to establish baseline trust levels.

The central processing node in a cooperative sensing network that collects local observations and applies a fusion rule to make a global occupancy decision.

• Vulnerable to becoming a single point of failure.
• Must distinguish between a legitimate primary user signal and a PUE signal using advanced authentication techniques.
• Often employs soft decision fusion to preserve signal characteristics for deeper analysis.

A physical-layer authentication technique that identifies unique hardware-level imperfections in transmitter waveforms.

• Uses deep learning to detect microscopic differences in I/Q imbalance, oscillator phase noise, and power amplifier non-linearity.
• A robust defense against PUE attacks because a malicious actor cannot perfectly clone the hardware fingerprint of a licensed primary user.
• Requires a high signal-to-noise ratio for reliable feature extraction.

An advanced sensing method that exploits the periodic statistical properties of modulated signals to distinguish them from stationary noise and emulated signals.

• Primary user signals exhibit unique cyclic frequencies tied to their modulation scheme, symbol rate, and carrier frequency.
• A PUE attacker must replicate these exact cyclostationary signatures to evade detection.
• Computationally more intensive than energy detection but offers superior robustness against emulation.

A fundamental challenge in wireless sensing where a secondary user is shadowed from a primary transmitter but not from other secondary users, leading to false vacancy assessments.

• Cooperative spectrum sensing was designed to solve this problem.
• A PUE attacker exploits this architecture by creating a phantom hidden node that falsely claims to be a primary user.
• Mitigated by spatial diversity and location verification of the signal source.