Pilot Contamination Attack Detection using
Random Symbols for Massive MIMO Systems
Xiaoyi Wang
∗
, Ming Liu
∗
, Dong Wang
†
∗
Beijing Key Lab of Transportation Data Analysis and Mining
†
Institute of Information Science
Beijing Jiaotong University, Beijing 100044, China
Email: {xiaoyiwang007, mingliu, wangdong}@bjtu.edu.cn
Caijun Zhong
Institute of Information and Communication Engineering
Zhejiang University
Hangzhou 310058, China
Email: caijunzhong@zju.edu.cn
Abstract—The massive multiple-input multiple-output
(MIMO) technique is recognized as the corner stone of the
next generation mobile communication systems. However, its
uplink-training downlink-transmission mechanism contains
a severe security breach. If the uplink training sequence is
artificially contaminated by some active attackers, the downlink
beamforming can significantly deviate from the legitimate user
and could be focused on the eavesdropper’s location. This
active pilot contamination attack (PCA) not only blocks the
legitimate communication, but yields user information leakage.
In this work, a random symbol based PCA detection method is
proposed. The “secure region” is derived theoretically according
to the statistical distribution of the detection statistics, which
enables a more accurate PCA detection. The energy examination
mechanism is also used to force the attacker sending the random
symbols and exposing itself in the random symbol based attack
detection. Finally, the theoretical analysis and simulation results
demonstrate the superior performance of the proposed method.
I. INTRODUCTION
Pilot contamination (PC) phenomenon originates from the
pilot reuse among proximate users and is seen as the major
bottleneck that limits the performance of the massive MIMO
systems [1], [2]. In fact, it has been noticed recently that the
PC phenomenon also results in a severe security breach. As
the transmission protocol, the frame structure, and the pilot
sequence set are publicly known to all users, a malicious
user (eavesdropper) can actively affect the channel estimation
process at the base station (BS) by sending the same pilot
sequence as the legitimate user’s during the training phase.
The channel state information (CSI) at BS is hence biased,
which consists of the CSI of legitimate user to BS and that
of malicious user to BS. As for BS, it cannot distinguish
the eavesdropper’s signal from a multipath component. Con-
sequently, a part of the legitimate user’s downlink signal
is deviated to the eavesdropper’s location. The greater the
eavesdropper’s signal power, the larger portion of legitimate
user’s signal power captured by the eavesdropper. This may
block the communication of the legitimate user and, more
seriously, lead to information leakage to eavesdropper. This
phenomenon is referred to as active eavesdropping [3], [4],
[6], [8] or pilot contamination attack (PCA) problem [5], [7],
[9]. To prevent it from happening, it is crucial to design
proper PCA detection mechanisms for secure physical layer
communication.
The work of [3] investigated enhancing eavesdropper’s
capability through the advanced full-duplex transceiver. It was
sketchily pointed out in its conclusion that the PCA detection
may be achieved by monitoring the variance of the received
pilot signal at BS. Later, it was proposed in [4] to employ
the signal power distribution to detect potential PCA. Yet,
the decision threshold is not theoretically derived. Other two
methods which perform PCA detection with the participation
of legitimate user were also proposed in [4]. However, they
take the assumption that the eavesdropper contaminates the
signal of both uplink and downlink, which does not always
hold. The signal power based PCA detection was developed
with more details in a recent work [5]. The basic idea is to
exploit the asymmetry of the signal power levels at BS and
at legitimate user given the fact that the eavesdropper injects
additional power in the uplink signal, while the legitimate user
loses a portion of the downlink signal power. A similar idea
that detects the eavesdropper according to the legitimate user’s
received signal power was also seen in [6]. It works under a
close-loop power control assumption. A likelihood ratio test
based PCA detection method was discussed in [7]. Yet, its
performance relies on the knowledge of channel and noise
covariance matrices.
Another family of PCA detection methods introduces ran-
domness, which can neither be predicted nor replicated, in
the pilot transmission stage [6], [8], [9], [11]. In [8], authors
proposed to transmit pilot symbols that are randomly chosen
from the PSK constellation set, and to use the phase difference
between consecutive received symbols to detect the presence
of eavesdropper. However, as mentioned in [8], the proposed
detection region is not optimal. A subspace-base method was
considered in [6] to improve the random pilot method. The
idea is to compare the largest and second largest eigenvalues
of the covariance matrix of the received random pilots. If the
difference is greater than a threshold, one can assert that there
exists at least one eavesdropper. However, the way to analyt-
ically determine the threshold remains unclear. Similarly, it
was proposed to use the minimum description length (MDL)
method to estimate the number of signal sources in [9], which
avoids the calculation of the threshold as in [6]. However, the
MDL method tends to underestimate the number of sources at
low SNR, which suggests higher miss detection rate [10]. The
978-1-5090-5932-4/17/$31.00 ©2017 IEEE