## 4 In-Lab Validation  
In this section, the jamming detection performance of the EVM vs. RB measurement is demonstrated through experiments performed in a laboratory environment in addition to theoretical analysis and simulations. Because broadcasting interfering (jamming) signals alongside legitimate communication is illegal, experiments are performed in a closed-loop manner by adopting the following procedure to overcome this legal limitation:  
First, the vector signal generator shown in Figure 13 generates a 5G signal by modulating the IQ symbols in the baseband to the RF band with OFDM. The IQ modulation, OFDM subcarrier spacing and number of OFDM subcarriers are set to 16-QAM, 30 kHz and 612, respectively, to make the generated signal similar to that in the base scenario (Section 3.1). The jamming signal, on the other hand, is generated in the RF band using the analog signal generator. The 5G signal is then contaminated with the jamming signal using the RF combiner module, and the resulting signal is transferred to the spectrum analyzer, which represents the receiver.  
The spectrum analyzer calculates the RF power spectrum that provides the RSS information and performs RF demodulation to obtain IQ symbols. To calculate the EVM vs. RB data, the correct (reference) IQ symbols transmitted by the vector signal generator  
Figure 11: Tone Jammer Case, MmWave Conditions, SJR = \(-\)10 dB. (**a**) the Rx signal spectrum and (**b**) EVM vs. RB.  
Figure 12: Chirp Jammer Case, MmWave Conditions, SJR = \(-\)10 dB. (**a**) the Rx signal spectrum and (**b**) EVM vs. RB.  
and jammed IQ symbols obtained by the spectrum analyzer are transferred to the test PC. EVM vs. RB data are then obtained by calculating the EVM metric using Equation (14) for each RB.  
The first experiment is conducted for a no-jammer scenario. Figure 13(a) shows the power spectrum of the received RF signal and Figure 13(b) shows EVM vs. RB results. It is observed that there is no jamming signal in the spectrum other than the 5G signal, and on the other hand, the EVM values are low as expected.  
Figures 15 and 16 show the results for the tone and chirp jamming cases, respectively, where SJR is \(-10\) dB. The effects of the jamming signals on the spectrum are clearly visible in Figures 14(a) and 15(a). In parallel, the EVM vs. RB measurement successfully reveals jamming attacks for RBs corresponding to the frequency bands exposed to the jamming signals (Figures 14(b) and 15(b)).  
In the next experiment, to test the jamming detection sensitivity of both the RF power spectrum and the EVM-vs-RB metric, the SJR parameter is set to 0 dB by reducing the power of the jamming signals by 10 dB. The results obtained for the tone and chirp jamming cases are shown in Figures 17 and 18, respectively. As shown in Figures 17a and 18a, the jamming signals become no longer detectable in the RF power spectrum. However, the EVM-vs-RB metric (Figures 17b and 18b) can still clearly detect jamming threats hidden in the spectrum.  
Figure 16: Chirp Jammer Case, SJR = \(-\)10 dB, (**a**) the Rx signal spectrum and time-domain IQ waveform obtained after RF demodulation and (**b**) EVM vs. RB.  
Figure 17: Tone Jammer Case, SJR = 0 dB, (**a**) the Rx signal spectrum and time-domain IQ waveform obtained after RF demodulation and (**b**) EVM vs. RB.  
Figure 15: Tone Jammer Case, SJR = \(-\)10 dB, (**a**) the Rx signal spectrum and time-domain IQ waveform obtained after RF demodulation and (**b**) EVM vs. RB.