# Primary User Emulation Attacks: A Detection Technique Based on Kalman Filter
## 1 Introduction  
Cognitive radio (CR) technology is a viable solution that addresses the problem of the spectrum scarcity [1]. It enables secondary users to sense, dynamically adjust their transmission parameters, and access the idle frequency channels (spectrum holes) without causing any harmful interference to the primary users [2]. Due to the unreliable nature of the wireless communication, cognitive radio networks can be subject to various cyber-attacks which can have a negative impact on their performance [3; 4; 5]. Examples of these attacks include asynchronous sensing attacks [3], primary user emulation (PUE) attacks [5; 6], spectrum sensing data falsification (SSDF) attacks [6; 7], and jamming attacks [8; 9]. A PUE attack targets the CR physical and MAC layers and is considered as one of the most severe attacks in which a malicious user emulates the transmission characteristics of the primary user (PU) and mimics its behavior to mislead legitimate secondary users. Such an attack can create a harmful interference to the primary user and prevent other secondary users from using the idle spectrum frequency channels [5; 6]. There are two types of primary user emulation attackers [10]: selfish and malicious. The purpose of the selfish attacker is to use and selfishly exploit an idle frequency channel without sharing it with other legitimate secondary users. The malicious attacker, on the other hand, aims at causing a denial of service in cognitive radio networks and preventing secondary users from accessing the available frequency channels. Several approaches have been proposed to cope with the PUE attacks [11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24]. For instance, the authors of Reference [11] proposed an energy-based detection approach to detect the source of the signal and decide if it is emitted by a legitimate primary user or an attacker. In their approach, each secondary user measures the power level of the received signal and compares it to that from a legitimate PU. The authors of Reference [12] proposed a belief propagation framework based on a Markov random field to detect the primary user emulation attacker. Each secondary user decides whether the signal is coming from a legitimate primary user or not using the energy detection technique then calculates the belief and exchanges it with other secondary users. If the average of the belief values is lower than a predefined threshold, then the signal is coming from a malicious user, otherwise, it is coming from a legitimate user. However, techniques based on energy detection are not efficient in distinguishing between noise and signal, and they suffer from a high probability of false alarm [13]. Feature-based techniques, such as autocorrelation and matched filter [14; 15], are also inefficient in distinguishing between the PU signals and those of the PUE attacker. For instance, the authors of Reference [16] used the cyclostationary feature of the transmitter's signal to detect the source of the incoming signal. However, this technique is not efficient in detecting malicious users which can mimic the primary user signal features. In Reference [17], the authors proposed a radio-frequency fingerprinting detection technique. In this technique, the transmitter is identified based on some unique radiometric features extracted from its analog signals. In another paper [18], the authors proposed a detection technique using the characteristics of wireless channels. As the statistical property of the wireless channel between the transmitter and the receiver is unique in a wireless environment, this feature is used as a radio fingerprint to detect the primary user emulation attacker. However, radio fingerprinting based approaches require additional hardware or software to implement. In addition, these techniques are inefficient in identifying the primary user signal effectively since the characteristic of the noise introduced by the hardware is random.