## 2 System Model
Therefore, to perform EVM analysis, it is necessary to extract the signal, jamming, and noise power components from \(\mathbf{\hat{X}}\). For this purpose, it is convenient to calculate the covariance matrix of \(\mathbf{\hat{X}}\). Using the statistical independence property [49] and Equation (5), the covariance matrix is calculated as follows:  
\[ \begin{split}\mathbf{\Sigma}_{\hat{X}\hat{X}}&= \mathbf{\Sigma}_{BB}\mathbf{\Sigma}_{CC}\mathbf{\Sigma}_{XX}+\frac{N_{T}}{P_{T }}\mathbf{\Sigma}_{BB}\mathbf{\Sigma}_{HH}\mathbf{\Sigma}_{VV}\\ &=\bigg{(}\sigma_{b}^{2}L^{2}\sigma_{x}^{2}+\frac{N_{T}}{P_{T}} \sigma_{b}^{2}L\sigma_{v}^{2}\bigg{)}\mathbf{I}_{\mathbf{N_{T}}},\end{split}  \tag{15}\]where \(\sigma_{x}^{2}=1\) as expressed in Equation (7), and \(\sigma_{v}^{2}\) is \(P_{V}=P_{I}+P_{N}\). The diagonals of \(\mathbf{\Sigma}_{\hat{X}\hat{X}}\) indicate the total power of each \(\hat{x_{n}}\). Thus, \(JNSR_{\hat{x}}\) can be obtained as follows:  
\[JNSR_{\hat{x}}=\frac{N_{T}}{P_{T}}\frac{\sigma_{b}^{2}L\sigma_{v}^{2}}{\sigma_{ b}^{2}L\sigma_{x}^{2}}=\frac{P_{V}N_{T}}{P_{T}L}. \tag{16}\]  
Consequently, it is revealed that the EVM is related to the parameters given in Equation (17). \[EVM_{n}\propto\sqrt{JNSR_{\hat{x}}}=\sqrt{\frac{P_{V}N_{T}}{P_{T}L}}=\sqrt{ \frac{P_{I}+P_{N}}{(P_{T}/N_{T})L}}. \tag{17}\]  
As shown in Equation (17), EVM depends directly on the jamming power represented by \(P_{I}\). Thus, the EVM metric can sense even small changes in the jamming level. However, for BER-based metrics, such as throughput and packet delivery ratio, to detect jamming signals, the jamming power must be strong enough to divert the received IQ symbols to the wrong regions in the constellation diagram, that is, to create a bit error. Because jamming signals below this jamming power do not create any bit errors, jamming is not sensed by BER-based metrics. Although such weak jamming signals do not cause denial of service, they may limit the data rate performance. Owing to the aforementioned ability of the EVM, these jamming signals can also be successfully detected. EVM also depends on the transmitted symbol power, which is denoted as \(P_{T}\). After equalization, \(P_{T}\) is normalized by \(N_{T}\). Parameter \(L\), on the other hand, is the expected improvement brought by the equalizer. This improvement is also mentioned in simulation results in Section 3.1. Another conclusion is that the EVM metric is not affected by varying system parameters, such as modulation type and code rate, and as a result, jamming signals are stably detected. However, as shown in the results in Sections 3.2 and 3.3, BER-based metrics are affected by these system parameters and exhibit unreliable results. The final EVM is expressed in both the RMS (18) and MAX (19). Because the maximum EVM can sense instantaneous distortions in the received signal, it can also detect more sophisticated jamming attacks that target a short-timed fragment of the legitimate signal. Such jammers are also called reactive or responsive jammers [50] and may adopt such short-time operating styles to minimize both their detectability and battery usage. Therefore, the maximum EVM is used in this study. \[EVM_{RMS}=\sqrt{\frac{\sum_{n=1}^{N}EVM_{n}^{2}}{N}}, \tag{18}\]  
\[EVM_{MAX}=\max_{n\in[1,\ldots,N]}EVM_{n}. \tag{19}\]  
The maximum EVM is measured for each RB in the received signal. Thus, the EVM vs. RB data are obtained. Because the RBs represent the frequency domain, the EVM vs. RB data reveal the frequency bands attacked by the jammer. After this stage, the operations in the receiver side are completed with IQ demodulation and decoding, and the data bits are obtained. The BER and throughput are measured using the data bits, and these measurements are also observed for jamming detection, whereas the EVM vs. RB detects the jamming attack at an earlier stage. This capability brings extra speed along with low computational complexity.