Detection of Pilot Spoofing Attack in Multi-Antenna Systems Using Modified FDC
Criterion: A Random Matrix Approach
Xizhu Nie, Hong Jiang, Minghang Zhang
College of Communication Engineering
Jilin University
Changchun, 130012 China
e-mail: niexz15@mails.jlu.edu.cn, jiangh@jlu.edu.cn, zmh16@mails.jlu.edu.cn
Abstract—We investigate the detection of one kind of active
eavesdropping which happened in the physical layer of a time-
division-duplex (TDD) multi-antenna system, in which
malicious eavesdroppers send the identical pilot signal in the
uplink channel estimation phase to disguise as the legitimate
receivers This attack could lead to a huge secrecy information
leakage to the eavesdroppers, called pilot spoofing attack.
Consider a multi-antenna system which has one base station
with M antennas, N single-antenna users, and K single-antenna
eavesdroppers. Aiming at the physical layer security which
would be threatened by the pilot spoofing attack, we propose a
novel pilot spoofing attack detection algorithm by using
random matrix theory (RMT) to modify flexible detection
criterion (FDC). The simulation shows that the detection
performance of the modified FDC is much better than FDC,
especially when the length of pilot signal becomes smaller and
has the same order magnitude as M.
Keywords-detection; pilot spoofing attack; physical layer
security; random matrix theory; flexible detection criterion
I. INTRODUCTION
Wireless network is very vulnerable to malicious
eavesdropper attack as a result of its broadcast nature,
such as pilot contamination attack [1] and pilot spoofing
attack [2]. Eavesdroppers disrupt the channel state
information (CSI) estimation in the training phase of uplink,
so as to confuse beamformer/precoder design in the
transmission phase of downlink. This kind of attack is
named as pilot contamination attack. In [1], the minimum
description Length (MDL)-based method was firstly
presented and then an improved method was given to detect
spoofing relay attack [2]. Pilot spoofing attack is considered
even worse than pilot contamination attack, which aims at
replacing the legitimate receiver. The pilot spoofing attack
was initially proposed in [3], which is extended from pilot
contamination attack. Until now, only a few works
mentioned the detection of the pilot spoofing attack [4-7]. It
was shown in [4] that the energy-ratio detector (ERD) needs
to calculate the received signal power of both sides and the
calculation is extremely complex. Besides, [4, 5] are both in
MISO system and do not match next generation wireless
system very well. In [6], the authors have compared the
current and previous CSI which is obtained from
neighboring time slot in multiple-input-multiple-output
(MIMO) system. Since eavesdroppers and users send pilot
signal at the same time, one cannot confirm totally different
neighboring time slots. Moreover, this method detects the
existence of spoofing attack based on that. Other methods
are investigated like adding some special signals (unknown
to BS and eavesdroppers) in training sequence (see,
e.g.,[1],[5],[7]), in which every user needs its own special
signal.
Despite the fact that the currently proposed methods
could detect the pilot contamination/spoofing attack in a
multi-antenna system, they work well under the assumption
that we know the previous CSI and additive special signal or
via complex operation. The pilot signals are usually
repeatedly used and publicly known, which provides great
chance for eavesdroppers to attack users during the training
phase. We should not choose to add special signal which is
unrealistic or use outdated CSI. The work developed by
Vinogradova etc in [8] has applied the random matrix theory
(RMT) to detect the jamming attack under ideal Gaussian
white noise in massive MIMO system. In recent years, RMT
has become an important signal processing tool in
communication field [9]. To our best knowledge, only a few
works have mentioned RMT for attack detection until now.
Following this, we will exploit random matrix approach to
detect the pilot spoofing attack.
In this paper, we apply the ideas of [10] and [11] in a
time-division duplex (TDD) multi-antenna system with one
base station (BS) with M antennas, N signal-antennas users
and K signal-antenna eavesdroppers. A binary hypothesis
testing approach is taken in order to detect the existence of
pilot spoofing attack by analyzing the received sample
covariance matrix at the BS. We propose this algorithm by
using random matrix theory to modify flexible detection
criterion (FDC) under additive Gaussian white noise. The
proposed algorithm has the following advantages: (i) Better
detection performance can be obtain than conventional FDC,
especially when the length of pilot sequence is small and
has the same order magnitude as the number of BS antennas;
(ii) Only the calculation at the BS side is needed, and any
previous or current CSI is not required, which means that
the algorithm is a blind detection; (iii) A normal pilot
(training) signal is used, and every user needn’t generate its
special signal to detect pilot spoofing attack.
1117
2017 3rd IEEE International Conference on Computer and Communications
978-1-5090-6351-2/17/$31.00 ©2017 IEEE