## 3 Support Vector Machine for Malicious Primary User Emulation Detection
Its principle is to find an optimal hyperplane in a given positive and negative two types of data, there could be many hyperplanes between the two sets of data, but only one allows for the maximum margin. The corresponding closest data points are called support vectors and the  
Figure 1: Primary network (BTS), mobile cognitive radio network (MCRN) (cognitive base station—CBS), users and primary user emulation (PUE) attack. Figure 2: Proposed support vector machine (SVM) learning and classification process. hyperplane allowing for the maximum margin is called an optimal separating hyperplane [22] as is shown in Figure 3.  
In Figure 3, assuming \(H\) as the optimal hyperplane, \(H_{1}\) and \(H_{2}\) are the two support planes chosen by the support vectors parallel to \(H\). The margin is defined as the distance between the two support planes. To make the classification, we have to separate the two classes of data by maximizing the margin so that the hyperplane divides the two classes of data [23]. The hyperplane can be defined as Equation (1). \[ \begin{split} H:w\times x+b=0\\ H_{1}:w\times x+b=-1\\ H_{2}:w\times x+b=1\end{split}  \tag{1}\]  
where \(x\) represents the argument, \(w\) is the weight and \(b\) is a constant value [23]. Based on \(w\), we need to minimize the vector norm of \(w\) to maximize the category margin, and hence the objective function is Equation (2) [24]. \[ \begin{split}\min\Bigl{(}\frac{1}{2}\|w\|^{2}\Bigr{)}\\ s.t.\qquad\begin{array}{c}y_{i}(w\times x_{i}+b)\geq 1\\ i=1..n\end{array}\end{split}  \tag{2}\]  
A Lagrange dual method is used to obtain the optimal solution. After introducing the Lagrange multiplier, the problem changes to Equation (3) [23]. \[ \begin{split}\min\Bigl{(}\frac{1}{2}\|w\|^{2}\Bigr{)}-\sum_{i=1}^ {n}a_{i}(y_{i}(w\times x_{i}+b)-1)\\ s.t.\quad a_{i}\geq 0\end{split}  \tag{3}\]  
The solution can be simplified to obtain the final classification decision function Equation (4) [23]. \[ \begin{split} f(x)&=\operatorname{sgn}((w\times x_{i })+b)\\ f(x)&=\operatorname{sgn}\Bigl{(}\sum_{i=1}^{n}a_{i} \times y_{i}(x_{i}\times x+b)\Bigr{)}\end{split}  \tag{4}\]  
where \(x_{i}\) are the support vectors, a is the Lagrange multiple vectors and \(\operatorname{sgn}(x)\) is the symbolic function [23]. Figure 3: Support vector machine (SVM) operation with two dimensions [22]. Once the general functionality of the SVM has been explained, we proceed to describe the structure of the SVM for the detection model, which is shown in the following pseudocode:  
1. GNURadio starts measuring the energy signal at the desired frequency and estimates the SNR value by using the RTLSDR device using the equations described in Section 3.2. 2. The entropy of the energy is calculated with a modified GNURadio main python code using the equations described in Section 3.3. 3. Using the previously installed scikit software, the kernel SVM code is invoked with the fit function and the supported vectors, and the margin and the hyperplane are calculated. 4. The results of the learning process are stored in the scikit program. 5. The second part (classification process) begins with measuring the averaged energy signal and SNR values in real-time by using the RTLSDR device. 6. The entropy of the averaged energy signal is calculated. 7. The prediction code is invoked with entropy and SNR value as an input. 8. The classification is made with the results of the prediction code by giving a binary result if there is a PU (1) or a malicious PUE (0) present. 9. According to these results, the SDR-USRP-2922, configured as a CBS for the MCRN, starts the transmission to the SU.