Primary User Emulation Attack (PUEA)

The attacker replicates the modulation scheme, center frequency, pilot tones, and cyclostationary signatures of a legitimate primary user (e.g., a TV broadcaster or radar). By generating a signal that is statistically indistinguishable from the incumbent, the attacker exploits the spectrum sensing module's reliance on feature detection. The cognitive radio's matched filter or cyclostationary feature detector is triggered, forcing an immediate channel vacation.

PUEA objectives fall into two categories:

• Selfish PUEA: The attacker reserves the spectrum hole exclusively for its own transmission, gaining unfair priority access and degrading the spectrum sharing fairness among secondary users.
• Malicious PUEA: The attacker has no intention of transmitting data. The sole purpose is to trigger mass spectrum handoffs, causing denial of service, network fragmentation, and increased control channel overhead.

PUEA is particularly effective when exploiting the hidden node problem in distributed sensing architectures. A malicious emitter positioned near a legitimate secondary user can generate a strong primary signal that the secondary user detects, while the actual primary receiver is geographically distant and unaffected. Without cooperative spectrum sensing to correlate observations, the isolated secondary user cannot distinguish the attack from a real incumbent.

A primary defense involves verifying the physical location of the transmitter. Legitimate primary users (e.g., TV towers) have fixed, known coordinates. Techniques include:

• Received Signal Strength (RSS) triangulation by multiple sensors
• Angle of Arrival (AoA) estimation
• Time Difference of Arrival (TDOA) If the signal originates from a location inconsistent with the licensed primary transmitter's database coordinates, it is flagged as an emulation attack.

This defense leverages radio frequency fingerprinting to identify unique hardware-level imperfections in the transmitter's waveform. Every power amplifier introduces non-linear distortions, I/Q imbalance, and oscillator phase noise that form a unique, unforgeable signature. A deep learning classifier trained on the incumbent's known fingerprints can distinguish the genuine primary user from an emulator, even if the emulator perfectly replicates the modulation format.

PUEA directly undermines the Listen-Before-Talk (LBT) and Dynamic Frequency Selection (DFS) protocols. In the 3.5 GHz CBRS band, a successful PUEA against the Environmental Sensing Capability (ESC) sensor network could trick the Spectrum Access System (SAS) into falsely evacuating the entire band. This represents a critical vulnerability in the three-tier spectrum sharing framework.

A broader category of attacks where malicious nodes report fabricated sensing data to a fusion center. While a PUEA targets the air interface directly by mimicking a primary signal, SSDF attacks corrupt the cooperative decision-making process by injecting false spectrum occupancy reports, leading to incorrect global spectrum access decisions.

A critical physical-layer defense against PUEA. This technique uses deep learning to identify unique hardware impairments in a transmitter's waveform—such as I/Q imbalance or oscillator phase noise—that are impossible to perfectly clone. By authenticating the device's radiometric identity, the network can distinguish a legitimate primary user from an emulator even if signal parameters match.

A distributed detection architecture that mitigates PUEA risk through spatial diversity. Multiple cognitive radios independently sense the spectrum and share observations with a fusion center. An attacker must simultaneously emulate the primary user at multiple geographically dispersed sensors to succeed, significantly raising the bar for a successful attack compared to single-node sensing.

A regulatory metric defining the maximum tolerable interference at a primary receiver. In a PUEA context, the attacker exploits the fact that secondary users must strictly avoid exceeding this threshold. By transmitting a signal that appears to occupy the band, the emulator forces legitimate secondary users to vacate, creating an artificial interference temperature violation that only benefits the attacker.

Unsupervised machine learning models that identify statistical deviations from normal spectrum usage patterns. These systems build a baseline of legitimate primary user behavior—including transmission schedules, power profiles, and spectral signatures—and flag PUEA attempts as anomalies. This approach is effective against attackers who cannot perfectly replicate the temporal and spectral habits of the real primary user.

A class of defenses that validate the physical position of a claimed primary user. Methods include:

• Time Difference of Arrival (TDOA) multilateration
• Angle of Arrival (AoA) estimation
• Received Signal Strength (RSS) profiling If the emulated signal originates from a location inconsistent with the known primary transmitter site, the PUEA is detected regardless of waveform fidelity.