# Unsupervised Learning-Based Spectrum Sensing Algorithm with Defending Adversarial Attacks
## 2 Related Work  
\(PUEA\)[13] and \(SSDF\)[14] attack traditional spectrum sensing algorithms, while \(PUAA\) attacks the spectrum sensing models based on deep learning [15]. As shown in Table 1, some effective defense algorithms have been proposed according to the characteristics of different attacks. \(PUEA\) is a typical spectrum sensing malicious attack mode used to prevent other secondary users from employing the authorized spectrum for proper or other purposes. The attacker sends a signal that is similar to that of the primary user to increase the false alarm probability of the secondary users, making the SU mistakenly think that the current frequency band is occupied by the PU, thus losing the opportunity to use the spectrum hole, resulting in the waste of spectrum resources. In addition to \(PUEA\), the \(SSDF\) attack also deteriorates the spectrum sensing performance, and malicious nodes send forged data to adjacent secondary users or fusion centers, causing incorrect decisions. At present, the defense algorithms against \(PUEA\)[16, 17, 18, 19] and \(SSDF\)[20, 21, 22, 23] have been widely studied as shown in Table 1. Because of the vulnerability of neural networks, \(PUAA\) only needs to add small perturbations to the input samples of the spectrum sensing model, which can cause the sensing model fail to accurately detect the PU signal. \(PUAA\) can be divided into white box \(PUAA\) and black box \(PUAA\) according to the different ways of obtaining adversarial samples [24]. The attacker of white box \(PUAA\) knows all the information such as the internal structure and parameters of the target model, and can directly use the target model to obtain adversarial samples. However, the attacker of black box \(PUAA\) knows nothing about the structure and parameters of the target model, and can only obtain adversarial samples by interacting with the target model or training the proxy model, requiring a large number of experiments to find effective attack strategies. Therefore, the attack effect of white box \(PUAA\) is better than that of black box \(PUAA\). \(PUAA\) uses a neural network to add perturbations to clean samples to achieve the purpose of attack, so the defense algorithms targeting \(PUEA\) and \(SSDF\) cannot effectively defend \(PUAA\). Several defense algorithms were designed against black box attacks [25, 26, 27]. The attacker was tricked into receiving the wrong training data set by SU deliberately carrying out a small number of false transmissions [25], but this defense approach requires SU transmitters to balance performance and defense effectiveness. In [26], three black box \(PUAA\)s were designed to attack the spectrum sensing model based on residual network, and the vulnerability of spectrum sensing network was verified; convolutional neural network (CNN) and long short-term memory (LSTM) algorithms were used to design a Deep Filter (DF) encoder to extract fusion features of clean samples and adversarial samples, and the decoder reconstructed clean samples according to fusion features. The proposed algorithm can effectively defend black box adversarial attacks without affecting the detection performance of clean samples. Additionally, a proxy model was used to obtain adversarial samples, and a wireless receiver was designed to combine time-domain and frequency-domain characteristics [27] which can effectively defend black box adversarial attacks. Currently, most research focuses on the defense algorithms of spectrum sensing against black box \(PUAA\), but there is a limited number of studies on defense algorithms against white box \(PUAA\). FGSM [28] and PGD [29] are two classic white box \(PUAA\) methods. To defend these two attacks, the defense algorithm was designed based on a denoising autoencoder and distillation (DAED) [12]. CNN and transposed convolutional neural networks were used to design the denoising autoencoder to filter out the perturbations, and clean samples were obtained in this algorithm.