###### Abstract  
Mobile cognitive radio networks provide a new platform to implement and adapt wireless cellular communications, increasing the use of the electromagnetic spectrum by using it when the primary user is not using it and providing cellular service to secondary users. In these networks, there exist vulnerabilities that can be exploited, such as the malicious primary user emulation (PUE), which tries to imitate the primary user signal to make the cognitive network release the used channel, causing a denial of service to secondary users. We propose a support vector machine (SVM) technique, which classifies if the received signal is a primary user or a malicious primary user emulation signal by using the signal-to-noise ratio (SNR) and Renyi entropy of the energy signal as an input to the SVM. This model improves the detection of the malicious attacker presence in low SNR without the need for a threshold calculation, which can lead to false detection results, especially in orthogonal frequency division multiplexing (OFDM) where the threshold is more difficult to estimate because the signal limit values are very close in low SNR. It is implemented on a software-defined radio (SDR) testbed to emulate the environment of mobile system modulations, such as Gaussian minimum shift keying (GMSK) and OFDM. The SVM made a previous learning process to allow the SVM system to recognize the signal behavior of a primary user in modulations such as GMSK and OFDM and the SNR value, and then the received test signal is analyzed in real-time to decide if a malicious PUE is present. The results show that our solution increases the detection probability compared to traditional techniques such as energy or cyclostationary detection in low SNR values, and it detects malicious PUE signal in MCRN. c pacs: 97.10.Kc, 97. The first step in MCRN is to detect the PU presence; we can find several spectrum-sensing techniques such as energy detection, location, feature detection, matched filter detection, covariance-based detection, and cooperative spectrum sensing, among others. The main objective is to detect if there is a PU signal at a specific frequency, and the system must do this in real-time so that the algorithms are not complex and have a good time response [1]. Due to this requirement, a specific attack on the MCRN appears. This is called the primary user emulation (PUE), because it senses the medium all the time, and a secondary user (SU) can adapt its signal to mimic the PU signal, making the MCRN or other SUs release the frequency and hop into another one or cancel the transmission [3]. The objective of the attacker in a malicious attack is to obtain control of the channel while avoiding any user of it--it does not transmit information or communicate by itself, but it is hard to distinguish between a PU or a PUE [4]. The problem of finding this difference is at its worst when analyzing the real wireless environment where PU, SU, and PUE are moving, because traditional detection systems such as energy, location or others are based on the static position attacker, that is, when they move, the systems lead to a false state of alarm [5]. We propose to use a support vector machine (SVM) [6] to learn the behavior of cellular modulation techniques such as Gaussian minimum shift keying (GMSK) or orthogonal frequency division multiplexing (OFDM), and with this information and the received data from a spectrum analyzer, recognize a malicious PUE attack on the network. An energy detector is used to release the channel very quickly and to not interfere with a possible PU that is in the process of communicating. Then, the Renyi entropy of this signal is calculated, and with the signal-to-noise ratio (SNR) value, the SVM learns the PU signal behavior. With these signals learned, the hyperplane is calculated and the system is ready to decide the PUE presence in real-time with the implementation of the algorithm on a software-defined radio (SDR) [7].