# Multiple PUE Attack Detection in Cooperative Mobile Cognitive Radio Networks
## 3 DNN Detection of Multiple PUE Attacks  
A PUE attack occurs when an attacker pretends to be a legitimate PU of a spectrum band in a cognitive radio network. The attack's goal is to deceive SUs into believing that a PU is active, which can result in SUs vacating the channel unnecessarily. This manipulation can lead to inefficient spectrum utilization and may enable attackers to monopolize the channel for their use. Interfering with all devices and not sending data can be malicious PUE and selfish PUE if the attacker wants the channel for its own communications purposes [13].  
As can be seen in Figure 1, a Primary Base Station (PBS) communicates with the PUs, and the cognitive base station (CBS) communicates with the SUs when a PU frequency is not used. If a PU appears, the system must release the channel. The PUE attack mimics the PU information and behavior, and the CBS and SUs recognize it as an authentic PU and release the channel.  
The proposed methodology for detecting multiple PUE attacks uses a DNN to decide the PUE's presence in the network based on the communication with the SUs. It starts with an energy detector, allowing the network to detect a PU/'PUE and release the channel to protect users. It automatically starts an authentication process that, in combination with the energy detector, allows the system to classify if there is a PU or a PUE. This information is calculated on each SU and shared with the FC that takes the global decision that is shared along with the PUE data to all the SUs as a blacklist. In the presence of multiple malicious PUE attacks in the environment, the algorithm continues working on each SU, continuously transmitting the detection signal and data to the FC.  
In the MCRN, each PUE attack can be seen as a base station that can manage malicious users (MUs). An MU can be identified as a PUE attack using the Downlink (DL) channel and not the Uplink (UL) channel. This information, combined with the authentication process information, allows the system to detect and share a single PUE attack. Each MU continuously senses the spectrum to select the frequency of the attack. In this case, it is looking for an empty channel, but it can even transmit signals if there is an SU in the network. In this paper, we analyze a case where each PUE attack is individual, and there are no shared data between them. This makes it difficult to detect it with simple methods.  
In this model, each SU has algorithms to detect the energy and authenticate the PUE at each frequency on the range. When it sends data to the FC, the process can start again, looking for a new frequency or detecting probable PUE attacks. Then, the data of each PUE attack are saved in the blacklist that is shared with all the SUs. Next time, if a PU/PUE signal is detected, the data are compared with the blacklist, and if it is a known attacker, the process is fast, and communication can continue forcing the MU to release the channel. The model can be seen in Figure 2.  
Figure 1: PUE attack scenario (source: own).  
In this solution, each SU must continuously monitor the spectrum to perform energy detection, which involves analyzing signal power levels and defined thresholds. It also needs to communicate its findings to the FC, which can add additional communication overhead. However, in this case, the data transmitted if it is not an attack are just a binary decision. In contrast, if the attacker is identified, its identification data are transmitted once, and some bytes of data are sent.  
The computational complexity is medium in the learning process, which needs the DNN to estimate the model parameters, while it is low in the running process because the algorithms are trained and the calculations are lower.  
In the following subsections, the detectors will be explained in detail.