Primary User Emulation Attack

The attacker replicates the modulation scheme, pilot patterns, or cyclostationary signatures of a legitimate primary user. This can involve simply replaying a captured transmission or synthesizing a waveform that matches known broadcast standards (e.g., ATSC, DVB-T).

• Replay Attack: A recorded primary user signal is retransmitted verbatim.
• Feature Forgery: The attacker artificially generates specific statistical features to fool cyclostationary detectors.

The primary goal is to monopolize a spectrum band, preventing legitimate secondary users from accessing idle spectrum holes. By constantly emulating a primary user, the attacker forces all cognitive radios in the vicinity to vacate the channel indefinitely.

• Spectrum Hoarding: The attacker reserves the band for its own malicious transmission or simply renders it unusable.
• Network Starvation: Legitimate secondary networks suffer complete throughput collapse.

PUE attacks are most effective when the attacker targets secondary users that are geographically separated from the real primary transmitter. The victim cannot verify the signal's origin through direct comparison with the legitimate source.

• Spatial Disadvantage: The victim is in the attacker's range but outside the real primary user's detection range.
• Shadowing Effects: Physical obstacles prevent the victim from hearing the true primary user, making the emulation signal seem authentic.

A robust countermeasure involves RF fingerprinting and transmitter localization. By estimating the angle of arrival (AoA) or time difference of arrival (TDoA), a sensing network can verify if a signal originates from the known geolocation of the licensed tower.

• Angle of Arrival (AoA): Detects if the signal is coming from an unexpected direction.
• Received Signal Strength (RSS) Profiling: Compares the measured power to the expected propagation loss from the known primary user location.

Defense systems can analyze hardware-level imperfections in the transmitted waveform. Since the attacker's power amplifier and oscillator differ from the licensed transmitter, RF-DNA can be extracted to distinguish the emulator.

• I/Q Imbalance Detection: Identifies unique gain and phase mismatches in the modulator.
• Oscillator Phase Noise: Uses the unique spectral skirt of the transmitter clock as an identifier.

In a cooperative spectrum sensing architecture, a fusion center can cross-reference reports from multiple nodes. If only a subset of nodes detects the 'primary user' while others report a vacant channel, the fusion center can flag the discrepancy as a potential PUE attack.

• Consensus Anomaly: A lack of spatial correlation in detection reports triggers an alert.
• Trust Metrics: Nodes reporting anomalous data are temporarily deprioritized in the fusion algorithm.

The critical monitoring function subverted by a PUE attack. This is the process by which a cognitive radio observes the RF spectrum to detect the presence of primary users. Common techniques include:

• Energy Detection: A simple but noise-vulnerable method.
• Cyclostationary Feature Detection: Exploits periodic signal patterns for robust, low-SNR detection. A PUE attacker must precisely mimic the signal features that the sensing algorithm is designed to identify.

A powerful physical-layer defense against PUE attacks. This technique uses deep learning to identify unique hardware-level imperfections in a transmitter's waveform, such as I/Q imbalance or oscillator phase noise. These unintentional features act as an unforgeable identity, allowing a sensing network to distinguish a genuine primary user from an emulator, even if the signal's protocol and modulation are perfectly cloned.

An unsupervised learning approach to identifying PUE attacks without prior knowledge of the attacker's strategy. These models establish a baseline of normal RF activity in a band and flag statistically significant deviations. A sudden, powerful signal that perfectly matches a primary user's profile but appears at an unusual time, location, or with an atypical transmission pattern would be flagged as an anomaly for further investigation.

A classic sensing vulnerability that a PUE attacker can weaponize. This occurs when a cognitive radio is shadowed from a legitimate primary user but exposed to the attacker. The attacker can transmit an emulated signal that the hidden cognitive radio detects clearly, causing it to falsely yield the channel. The legitimate primary user remains undetected, and the attacker successfully monopolizes the spectrum through a localized denial-of-spectrum attack.