## 3 Support Vector Machine for Malicious Primary User Emulation Detection  
In this section, we define the MCRN, users and interactions, variables, and scenarios for the attack. We propose the SVM for malicious PUE detection by using the energy detector and entropy detector. In the primary network, operators have a BTS, an eNodeB depending on the technology; this element establishes a communication with the PU in some licensed frequencies by using some modulation methods such as GMSK or OFDM. The MCRN uses a spectrum analyzer to sense the medium and detect the spectral holes according to the selected frequency range. When it finds a hole, it starts the communication with the SU that needs some service. SUs connected to the MCRN utilize a cognitive base station (CBS) device to operate phone calls or messages (or anything else that is required) while continuously listening to the presence of the PU [18]. The PUE attack is given by an SU, which, in this case, emulates the PUE signal as a jammer for interfering with the transmission in the selected frequency range. Depending on the detection strategy of the MCRN, the attack will be identified as a licensed PU and has to change its frequency or deny the service to the SUs. One of the most used methods for detection is energy detection, as it senses the PU power in a defined frequency and if it is over a threshold, it is identified as a PU. This is where the PUE attacks by generating a signal in the frequency range. Detections methods vary in terms of energy, features, cyclostationary, and location detection, trying to separate and decide if what they encounter is a PU or a PUE signal [19]. The MCRN, users, and interactions are shown in Figure 1. The PUE attack can affect the MCRN and the primary network depending on the used configuration [20]. We analyzed the mobile network signals such as 3G or 4G systems, identifying the patters in the energy detection in time and calculating the entropy of these values. Combining these with the SNR value and with the measured values, we obtain a database for the training system of the SVM. The SVM algorithm generates the hyperplane based on the feature vectors maximizing the space between the limit values for each case in the presence or absence of a PU. With these values, the system can now decide if the experimental input is a PU or a malicious PUE attack [1]. The SVM is divided into two parts [21]: The first one is the SVM learning process where we extract parameters such as SNR, entropy, and modulation signal behavior of GMSK and OFDM modulationsfrom the energy detector that makes an analog to digital conversion (A/D). The second is the fast Fourier transform (FFT), which calculates the square and makes an average of the energy signal. These results are stored in the SVM and train the algorithm just one time. This is shown as the SVM learning process in Figure 2.  
After the learning process, the algorithm calculates the hyperplane and vectors and is ready to classify the inputs. In the middle, part of the data is used to test the algorithm and measure the accuracy. The second part is to decide the presence of a malicious PUE. For this process, we made the energy detection and entropy calculation so that it is capable of identifying the signal. These values are the inputs for the SVM classification system and, according to the database and the algorithm of the SVM, it is decided if the presence is a PUE or not. This is shown in Figure 2 as the SVM classification process. The SVM is a classification model of two classes, it maps the input vectors of energy into a high-dimensional feature space in which they could become linearly separable and if it is not linear it can use kernel functions. In our case, the two dimensions are the SNR and the Entropy of the input signal. In the classification process, a hyperplane in this high-dimensional space is found, that is why it is called a maximal margin classifier where the margin is the distance from a separating hyperplane to the closest data points.