Secondary User Data Capturing for Cognitive Radio Network Forensics under Capturing Uncertainty

Transcription

1 Secondary User Data Capturing for Cognitive Radio Network Forensics under Capturing Uncertainty Jing Xu, Qingsi Wang, Rong Jin, Kai Zeng and Mingyan Liu Department of Electrical and Information Engineering Huazhong University of Science and Technology, Wuhan, China Electrical and Computer Engineering, University of Michigan, Ann arbor, USA Computer Information Science, University of Michigan-Dearborn, Dearborn, USA Abstract Secondary user data capturing is a fundamental building block for cognitive radio network forensics. It faces great challenges mainly due to the unknown secondary user behavior, wide spectrum, and packet capturing uncertainty. There is a lack of fundamental understanding of the data capturing problem in theory. In this paper, for the first time, we formulate the dynamic sniffer channel assignment problem without the knowledge of users behavior patterns as a non-stochastic multiarmed bandit (MAB) problem. Moreover, we consider a more practical scenario with the consideration of packet capturing uncertainty and switching cost. We then propose an efficient solution to solve the problem and analyze the regret of our policy. Finally, a simulation study validates the convergence of our method. I. INTRODUCTION Cognitive radio network (CRN) is a promising paradigm to solve the contradiction of limiting wireless spectrum resources and a growing number of applications in wireless networks. By exploiting the spectrum in an opportunistic fashion, cognitive radio networks allow the secondary users (SUs) to use the licensed bands without introducing harmful interference to primary users (PUs). Many approaches have been proposed in the literature, such as spectrum sensing, spectrum management, spectrum mobility, spectrum sharing, etc. [1]. While most prior researches focus on the problem of utilizing the spectrum resources efficiently, recent work has begun to pay attention to security issues in CRNs [2]. A lot of new threats fundamental to cognitive radio itself and their countermeasures have been proposed, such as spectrum sensing data falsification [3], primary user emulation attack [4], jamming attack [5] and so on. However, systematical management of cognitive radio networks remains largely untouched in the literature. Network forensics is a discipline relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, malicious activities detection, and legal evidence collecting. It is a useful approach to prevent attacks, diagnose the network and track down criminals. Network forensics consists of two parts: data capture and data analysis. Data capture is the basic of network forensics, on which the quality of data analysis depends largely. Channel fading, signal coverage and interference make this task more difficult in a wireless environment. Existing work on data capture mainly focuses on traditional wireless networks. A passive monitoring system has been proposed [6], in which a dedicated set of hardware devices, called sniffers, are used to gather detailed PHY/MAC information. The sniffer deployment problem in this framework has been discussed [7], [8], [9]. Recently, a few of works studied the data capture problem in cognitive radio networks [10], [11]. Special characteristics of cognitive radio networks introduce more challenges. For example, there is wider spectrum and dynamic traffic due to opportunistic access. However, there is a lack of theoretical understanding of this problem. Furthermore, data capture uncertainty is not considered in the existing work, which is a common phenomenon in wireless networks. In this paper, we investigate the sniffer channel assignment problem in SU data capturing for cognitive radio network forensics. Our objective is to capture as many as possible (target) SUs packets without prior knowledge of SUs activities (traffic patterns and channel access policies). Hence, we perform online learning of SUs behavior patterns and construct the sniffer deployment schemes based on the learning results. There is an interesting trade-off between exploitation (i.e. assigning sniffers exclusively to channels believed to give the maximum rewards based on current knowledge) and exploration (i.e. trying out each channel to find the best one). Thus, we formulate this problem as a non-stochastic multiarmed bandit problem (MAB). Our model does not make

2 2 any assumption on the statistical distribution of the SUs activities, including traffic patterns and channel access policies. Moreover, our model captures the intrinsic feature of wireless monitoring, i.e., packet loss caused by wireless fading channel and sniffer impairment. In this paper, our main contributions are: We formulate the data capturing problem without the knowledge of SU activities as a non-stochastic MAB problem. In the model, we consider the impact of practical factors: imperfect monitoring conditions, sniffer heterogeneity derived from different monitoring environments, and switching cost. We propose an efficient solution to solve the problem and analyze the regret of our algorithm. We perform an extensive simulation study to validate our method. It is shown that the proposed sniffer-channel assignment policy is highly efficient. The rest of this paper is organized as follows. Section II summarizes the related work on network monitoring and data capturing in wireless networks. In Section III we present the system mode and our problem formulation. Details of our method and the regret analysis are introduced in Section IV and Section IV-C separately. Section V provides our simulation study, followed by conclusion and future work in Section VI. II. RELATED WORK Data capture for network forensics in cognitive radio networks is a new research area that is under explored. However, there has been much work done on passive wireless monitoring, which is similar to data capture. Therefore, we survey the related work from these two aspects in this section. A. Passive monitoring in traditional wireless networks A framework to collect PHY/MAC information for wireless LAN monitoring was first proposed in [6], which is the basis of passive wireless monitoring system. To determine the optimal monitoring resource allocation to maximize captured information in wireless mesh networks, the sniffer channel assignment problem was formulated as a maximum coverage problem [7]. In [8], Arun et al. defined a quality metric for monitoring, named QoM, which indicates the expected number of active users monitored, and considered the problem of maximizing QoM. Arora et al. [9] further extended the preceding work by using multi-armed bandit method to perform sequence learning under the condition of unknown users s statistics information. It is noteworthy that all the prior researches aimed to monitor the occurrence of wireless users, which is an easier job compared with packet capture. B. Data capture in cognitive radio networks Data capturing problem in cognitive radio networks has attracted attention recently. It was first studied in [10], in which support vector regression was utilized to predict packet arrival time and a greedy scheduling scheme for minimizing the number of monitor switches was proposed. Yan et al. [11] also utilized the similar idea, and designed an online nonparametric density estimation method to learn and predict the time-evolving mixed traffic patterns on all the channels for SUs. The sniffer channel assignment problems were formulated as inter programming problems by considering the channel switching costs with the goal of maximizing QoM. However, their work is different from ours in the following aspects: In their framework, the objective is to monitor all the traffic of SUs, and the special inspection sniffers are adopted to scan the channels to obtain the information whether SUs appear on each channel. It implies that the inspection sniffers can sense multiple channels on one time slot and their deployment details are not discussed. In our problem, our goal is to capture only the packets of the target SUs. There are no dedicated sniffers for channel scanning. Each sniffer monitors a channel for a time slot to capture the target packets. Then the system learns the target users activities and makes decisions of sniffer channel assignment scheme at the next time slot. In turn, the capture results will directly affect the learning process. On the other hand, all the aforementioned works assume that the monitoring system is perfect. This means that once a node has been monitored by one sniffer within its monitoring vicinity operating on the same channel, the packet will always be captured without any error. However, the assumption does not always hold in practice. A variety of factors will lead to packet miss, such as poor wireless channel condition or sniffer impairment. Imperfect monitoring conditions will decrease the quality of data capture, and even affect the learning results. In this paper, we consider the packet capturing uncertainty and heterogeneous sniffer capture effects. III. SYSTEM MODEL AND PROBLEM FORMULATION A. System model Given a cognitive radio network with K channels that are licensed by a PU network, there is a SU network where the SUs communicate using a synchronous slotted scheme, and we refer to [12] for the detailed communication system model. In each time slot, each SU chooses a set of channels to sense, and when a channel with licensed primary users is idle, it can be accessed by SUs using a CSMA/CA mechanism with acknowledgments for each successful transmission from the receiver. The entire process then repeats. Independent of the communication system, we introduce a third-part network monitoring system for forensics. We assume

3 3 that the communication scheme among SUs is known to the monitoring system, and the objective is to capture as many as possible packets of the SUs. The monitoring system consists of S sniffers and a coordinator, where S K. The coordinator dynamically assigns channels to be monitored by the sniffers for each slot, and each sniffer can only capture packets in the designated channel. Each sniffer then reports the observed information to the coordinator via a dedicated channel. The coordinator learns the behavioral patterns of SUs based on the collected information, and decides the channel assignment of the sniffers for the next slot. We consider a practical scenario where the observation of sniffers can be imperfect, i.e., the packets of SUs are only captured with certain probability, which is called the (packet) capture probability. We denote by P c the capture probability matrix, of which the (i, j)th entry P c (i, j) [0, 1] is the probability that a SU packet on channel j is captured by sniffer i when it is deployed on this channel. We assume P c is known a priori via measurement and is time invariant. Note that when a given sniffer is assigned to different channels, a non-negligible channel switching cost can be incurred, so as to model, e.g., the impact of switch delay and the energy consumption (see [13] for a detailed study). B. Problem formulation As aforementioned, the dynamic channel assignment of sniffers faces the classic exploitation-exploration dilemma modeled by the MAB problem: deploying the sniffers on the channels that have been active for immediate reward versus deploying them on under-utilized channels that can bring potentially higher reward in the future. Moreover, we do not assume any statistical model on the SUs activities, and we thus formulate the problem as a non-stochastic bandit problem as follows. Let A be the set of admissible sniffer-channel matching schemes, that is, A = {a = (a 1, a 2,..., a S ) a i [K], a i a j, i, j}, where a i = j if sniffer i is assigned to channel j, and [K] = {1, 2,..., K} 1. For any a A, there exists a unique matrix representation A such that A ij = 1 if a i = j and 0 otherwise. For example, when K = 4 and S = 2, an admissible scheme is a = ( 1 4 ), and we have ( ) A = In the rest of this paper, we use the notation a to represent the sniffer channel assignment scheme in either format whenever there is no ambiguity in the context. Also, when a is in the matrix form, a i,j denotes its (i, j)th entry. K}. 1 Other notation in the form of [ ] is similarly defined as [K] = {1, 2,..., Let A be the set of all probability distributions over A. Then, we consider the following repeated game between the coordinator and the group of SUs: For each time slot t = 1, 2,..., T : 1) the coordinator selects a probability distribution p t from A, and decides a sniffer-channel matching scheme a t A according to this distribution; 2) the group of SUs independently generates x t j packet on each channel j, where j = 1, 2,..., K and x t j {0, 1}; 3) if sniffer i is deployed on channel j, any generated packet on channel j is captured with probability P c (i, j). The objective of the coordinator is to maximize the quality of monitoring (QoM), i.e., the total number of packets captured on all channels given any traffic pattern of SUs. In particular, given any realization of the SU traffic (x t j, j [K], t [T ]) over the horizon T > 0, let yi,j t be sniffer i s observation of packets on channel j, which is 0 when sniffer i is not deployed on channel j, and y t i,j = { x t j, w.p. P c (i, j) 0, w.p. 1 P c (i, j). when sniffer i is assigned to channel j. We also associate a switching cost to each consecutive matching schemes as C(a t a t 1 ), which is a linear function of the total number of channel switchings at time t, comparing a t with a t 1, and we assume that C(a t a t 1 ) [0, 1] for all a t, a t 1 A. We then define the reward R t (a t a t 1 ) of using a t at time t when a t 1 is chosen at t 1 as S K R t (a t a t 1 ) = yi,j t βc(a t a t 1 ), i=1 j=1 where β [0, 1] is the weight assigned to the switching cost, and we set C(a 1 a 0 ) = 0 for any a 0 A for the fictitious zeroth time slot. The coordinator s decision p t is based on all past observations h t = (yi,j τ, i [S], j [K], τ [t 1]). Let the set of all possible observations over time be H, and the decision policy of the coordinator is then given by a map σ : H A. Given any realization of the traffic of SUs (x t j, j [K], t [T ]), the reward of any policy σ of the coordinator is defined as { T } G(σ) := E σ R t (a t a t 1 ), t=1 where the expectation is taken with respect to the randomness in the generation of sniffer deployment and also that in the packet capture process, which depends on the choice of σ, and we explicitly denote this dependency using the superscript.

4 4 We evaluate a given policy σ using the notion of (weak or external) regret, which is defined as the difference between the average number of packets captured by the dynamic deployment using σ, and that by the optimal static snifferchannel matching scheme a in hindsight. Formally, given (x t j, j [K], t [T ]), let { T } a = arg max a A Ea R t (a a), t=1 where the expectation is with respect to the random packet capture given a. Let σ : H A be a static policy such that σ (h t ) is a degenerate distribution with all probability mass on a for any h t H, and set G max = G(σ ). The regret is then defined as Regret = G max G(σ). IV. NO-REGRET SNIFFER-CHANNEL MATCHING POLICY In this section, we introduce sniffer-channel matching policies that achieve order-optimal sublinear regrets. We first present a policy for the case when there is no switching cost, which will be used as a building block when incorporating the switching costs in the second part. A. Sniffer-channel matching under capture uncertainty A straightforward solution to the sniffer assignment problem under capture uncertainty is to treat each sniffer-channel matching scheme as an arm, and to invoke the classic Exp3 algorithm [14]. Though sublinear in time, the regret of classical bandit no-regret learning algorithm like Exp3 typically scales polynomially in the size of the action space. A naive conversion of a combinatorial problem to the classic bandit setting like the aforementioned results in an exponentially large action space, and the regret performance is rather unsatisfactory for most applications. We note that the sniffer assignment problem under capture uncertainty is in essence a bipartite matching problem, as we have named a as a sniffer-channel matching scheme. Similar problems in a balanced bipartite graph have been studied in the literature. For a balanced bipartite graph, a perfect matching is a matching in which every vertex of the graph is incident to exactly one edge, and each matching can be expressed as a permutation. Helmbold et al. [15] first investigated online permutation learning problem with full information, where the player observes the outcomes of all arms and the instantaneous reward of permutations that are selected in a decision round can also be observed. In [16], the problem was extended from this full feedback setting to a partial feedback setting, where only the instantaneous reward of the selected permutation is observed, and the ExpMatch algorithm was proposed. The problem setting considered in ExpMatch is given by the following repeated game: For each round t = 1, 2,..., T : 1) The decision maker chooses a perfect matching between two sets of vertices U and V, where U = V = n. 2) An adversary assigns an individual loss l i,j [0, 1] for each matched pair (i, j), where i U and j V. 3) The value of l i,j is reported from each pair (i, j) to the decision maker, who suffers a loss as the sum of all individual losses, and the game proceeds to the next round. The decision maker then aims to minimize the total matching loss of rounds up to some horizon T. We note that our formulation does not exactly fit the above framework that motivates the ExpMatch algorithm. In particular, as outlined in our system model, there can be missed detection by the sniffers of packets, and the coordinator then only observes the behavior of SUs subject to uncertainty characterized by the capture probability. The reward y i,j in our formulation is hence given by a random variable with an arbitrarily assigned mean (depending on the value of x t j ), whereas l i,j in the above framework is a deterministic though arbitrary value. However, as we will soon elaborate, the Exp- Match algorithm also provides a solution to our problem with a regret that is uniformly sublinear in time and polynomial in the number of channels, and we highlight the necessary adaptation of ExpMatch to our context. The algorithm in the sniffer-channel matching context is reported in Algorithm 1. In the (adapted) ExpMatch algorithm (Algorithm 1), two matrices are maintained. One is the weight matrix ω, and the other is a doubly stochastic matrix D that is obtained from ω. At each time slot, the coordinator assigns probability masses to sniffer-channel matching schemes by decomposing the doubly stochastic matrix D (Step 2) using the subroutine Decompose, and in particular the generated distribution over A has a support of size less than S K + 1. A snifferchannel matching is then realized using the mixture of this distribution and the uniform distribution (Step 3). At the end of a time slot, the observation from each monitored channel is reported to the coordinator (Step 4), and the gathered information is then used to estimate the true rewards (the number of SU packets) on each channel (Step 5). Finally, the weight matrix is updated (Step 6) and a corresponding doubly stochastic matrix is constructed for the next slot (Step 7) using Sinkhorn-Knopp (see [16] for the detail of this subroutine). Instead of regarding each matching as an arm in the bandit problem and maintaining a weight for each matching, the (adapted) ExpMatch keeps individual weights for snifferchannel pairs, and uses the total SK weights to generate a distribution over exponentially many matchings. This is the key to induce a polynomial dependence of regret on S and

5 5 Algorithm 1 ExpMatch for sniffer-channel matching subject to imperfect detection Input: Parameters: γ (0, 1], S, K Initialize: ω 1 = (ω 1 i,j ) S K, ω 1 i,j = 1 K, D1 = (D 1 i,j ) K K, D 1 i,j = 1 K ; 1: for t = 1, 2,, T do 2: Calculate a probability distribution over A according to D t (1:S), where D t (1:S) is the truncated matrix consisting of the first S rows of D t : {(a, µ a ), a A} = Decompose(D t (1:S)) where a A µ a = 1. 3: Realize a sniffer-channel matching scheme a t with the probability γ p a = (1 γ)µ a + K for all a A. 4: Receive the packet capture rewards yi,j t [0, 1]. 5: Form the estimates ỹ t i,j = yt i,j θ i,j a t i,j for all i [S] and j [K], where θ i,j = 6: Update the weights ω t+1 i,j a A:a i,j=1 p a = ω t i,j exp (γỹ t i,j) for all i [S] and j [K]. 7: Update D and convert it to a doubly stochastic matrix: 8: end for D t+1 (1:S) = ωt+1 D t+1 = Sinkhorn-Knopp(D t+1 ) K instead of an exponential one We refer the readers to [16] for the detailed exposition and analysis of the ExpMatch algorithm, including the two subroutines Decompose and Sinkhorn-Knopp. The computational complexity of Algorithm 1 mainly depends on that of Step 1. In the original Decompose subroutine in ExpMatch, a distribution over balanced bipartite matchings is obtained by iteratively decomposing a K K doubly stochastic matrix (i.e., the input would be D t instead of ). Though the corresponding bipartite graph is unbalanced in the sniffer-channel matching problem, we can simply add K S fictitious sniffers to construct a balanced bipartite graph and apply the original Decompose. Given S K, this implementation however consumes most of the computational power for virtual sniffers in the iteration. Using Birkhoff-von Neumann theorem, we see that a row subset of a doubly stochastic matrix can be decomposed as a convex combination of matrices of the same size, where each matrix has only one non-zero element in each row. Hence, we can compute a distribution over all matchings using a maximum matching subroutine for a S K bipartite graph, and we omit the detail of the adapted Decompose for brevity. An additional improvement for efficiency in the implementation is to reuse the maximum matching from the previous iteration [15]. To summarize, the computational complexity of Algorithm 1 is in general O(SK 3 ) in our sniffer-channel matching problem. B. Switching Cost In this part, we consider the impact effect of switching cost. When there is no switching cost associated with each pair of consecutive actions by the coordinator, the adversary can be regarded oblivious who determines the reward on time slot t based on only the current sniffer-channel matching a t. In other words, the adversary is unaware of the coordinator s past deployment decisions. With the introduction of switching costs, the adversary can be consider as non-oblivious with one unit of memory for the coordinator s action in the last step, and exerts an additional cost C(a t a t 1 ) at time slot t. Online learning problems with a non-oblivious adversary have attracted considerable attention in recent years with various learning algorithms proposed [17] [18]. The main idea is to divide slots to mini-batches and the actions in each mini-batch of slots are static so as to neutralize the effect of bounded memory of the adversary. Based on the meta algorithm proposed in [18], we introduce a new algorithm by modifying Algorithm 1, shown as Algorithm 2. Algorithm 2 1: for n = 1, 2,, T/τ do 2: Execute Algorithm 1 until Step 3, i.e, compute a distribution p = (p a, a A) over A using a doubly stochastic matrix D n and generate a sniffer-channel matching scheme b n according to probability distribution p. 3: for k = 1, 2,..., τ do 4: Exercise the matching a t = b n for the time slot t = (n 1)τ + k. 5: Receive the packet capture rewards yi,j t [0, 1]: 6: end for 7: Update ω n+1 using 1 τ τ k=1 y(n 1)τ+k i,j. 8: Execute Step 7 of Algorithm 1, i.e., generate D n using ω n+1. 9: end for

6 6 In other words, each mini-batch of slots are wrapped up as one slot to feed Algorithm 1. The size of a batch, i.e., the value of τ, affects the overall regret of this algorithm. This value will be specified in the next section. C. Regret results We start from Algorithm 1. ExpMatch and its prototype for non-combinatorial bandit problems, i.e., Exp3 [14], are both learning algorithms in the family of exponential weight algorithms[19][20], and are particularly designed for the partial observation case in which only the reward of the played arm/matching is observed. The key to ExpMatch and Exp3 to work with partial observation is to maintain an unbiased estimator of reward on any arm/matching at any time, even though it may not be played in some realization. In the adapted ExpMatch algorithm, i.e., Algorithm 1, ỹi,j t also provides an unbiased estimate for the average reward of assigning sniffer i to channel j for our problem with the packet capture uncertainty characterized by the capture probability P c (i, j). Indeed, with straightforward calculation, it can be shown that E[ỹi,j t ] = xt i,j P c(i, j). Repeating then the rest of the regret analysis of ExpMatch in [16], we have the following result. Theorem 1. The expected regret of Algorithm 1 given any realization of SU traffic is upper bounded by O( 8SK 2 log K T + S). Next, we discuss how tight the upper bounds are. Helmbold et al. have proven that lower bounds of PermELearn (the full information version) are G best + Ω( G best T ln T + T ln T ), where G best is the reward of the best permutation on the entire sequence [15]. Obviously, the lower bounds will be inherited by Algorithm 1, which is the solution of a semi-bandit settings. Thus, we conclude that Algorithm 1 enjoys an order-optimal sublinear regret. Once we have established the regret bound for Algorithm 1, the regret result of Algorithm 2 follows from the meta algorithmic analysis in [18]. Specifically, we have the following regret bound for Algorithm 2. Theorem 2. The expected regret of Algorithm 2 given any realization of SU traffic is upper bounded by O((S + 1)(8SK 2 log K) 1/3 T 2/3 ), when using τ = (T/8SK 2 log K) 1/3. In the above result, the value of tau explicitly depends on T, which is in general not given a priori in practice. This dependence in fact can be removed by using the standard doubling trick, of which the idea is to partition the time into periods of exponentially increasing lengths and parameterize the algorithm for each period with fixed length, so as to achieve a horizon-independent bound on the same logarithmic order (see [21] for details). V. PERFORMANCE EVALUATION In this section, we present simulation results to demonstrate the performance of the proposed solutions. A. Parameters setup Synthetic traces are used in our simulation, and we focus on the following three types of SU access patterns: Static pattern: The SUs are conservative and attempt to use the same channel whenever it is idle for the entire simulation. Hopping pattern: Once any PU uses the currently residing channel, each SU switches to the neighboring channel. That is, the switching policy is a round-robin rule in the ascending order of channel indices. Random pattern: Each SU randomly selects a channel from all the idle channels. To generate a synthetic trace, three types of sequences are generated, namely the PU sequence, the target SU sequence and the sequence for the other SUs. The PU sequence is the activities of PUs. Each PU licenses a channel and its activity obeys a Poisson distribution with a rate randomly selected from [0, 1]. All the SU sequences, including the target SU and other SUs, are produced in two steps. For each SU, the first step is to generate a binary sequence over time. We then select one channel as the residing channel for this SU given one of the above access patterns, and replace the number one in the sequence with the channel index. The other SUs access the channels in a random pattern. Also, when multiple SUs choose the same channel, we randomly and uniformly choose one with access granted. In our simulation, we vary the number of sniffers S from 2 to 4 and the number of channels K from 5 to 10 to study the impact of these parameters on the performance. In addition, the capture probability matrix P c is randomly generated. The results for each pair (K, S) are averaged over 20 runs. B. Simulation Result We have observed similar results under various parameters, and we illustrate our observation using one representative setup. Figure 1 reports the regret of the proposed policy over time, when K = 5, S = 2 and T = As it can be seen, the regret tends to flatten over time for all user access patterns, which verifies the logarithmic regret bound. On the other hand, we observe that the static pattern has the largest regret among all patterns, while the regret of the other two is similar. This is because the regularity of the static pattern is the strictest one, which makes target users stuck on the fixed channels. Randomly selecting the monitoring channel based on a learned

7 7 REFERENCES Fig. 1. Regret of the proposed policy. distribution leads to fewer chances to capture target packets and the regret is approximately the upper bound. In contrast, the other two patterns make users disperse, so sniffers can capture the packets with a higher probability and learn users pattern more quickly. VI. CONCLUSION In this paper, we studied the sniffer-channel matching problem for network forensics in cognitive radio networks. Without assuming any prior knowledge of the SU behavior pattern, we formulated the problem as a non-stochastic multiarmed bandit problem. Moreover, considering packet capture certainty and switching cost in practice, we introduce the packet capture probability, and propose efficient solutions using existing online learning techniques, which enjoy an orderoptimal sublinear regret in performance. Simulation results validate that the proposed solution is efficient and resilient for imperfect monitoring conditions. Incorporating the spatial relationship between the sniffers and the monitored nodes can be an interesting research direction. ACKNOWLEDGMENT This work was partially supported by National Science Foundation of China under grants and Q. Wang and M. Liu were partially supported by the NSF under grants CIF and CNS J. Rong and K. Zeng were partially supported by US NSF under grant CNS [1] B. Wang and K. Liu, Advances in cognitive radio networks: A survey, IEEE Journal of Selected Topics on Signal Processing, special issue on Cooperative Communications and Signal Processing in Cognitive Radio Systems, vol. 5, no. 1, pp. 5 23, [2] T. C. Clancy and N. Goergen, Security in cognitive radio networks: Threats and mitigation, in Proc. IEEE CrownCom 2008, Singapore, May 2008, pp [3] F. R. Yu, H. Tang, M. Huang, Z. Li, and P. C. Mason, Defense against spectrum sensing data falsification attacks in mobile ad hoc networks with cognitive radios, in Military Communications Conference, MILCOM IEEE, 2009, pp [4] S. Chen, K. Zeng, and P. Mohapatra, Hearing is believing: Detecting wireless microphone emulation attacks in white space, Mobile Computing, IEEE Transactions on, vol. 12, no. 3, pp , [5] B. Wang, Y. Wu, K. R. Liu, and T. C. Clancy, An anti-jamming stochastic game for cognitive radio networks, Selected Areas in Communications, IEEE Journal on, vol. 29, no. 4, pp , [6] J. Yeo, M. Youssef, and A. Agrawala, A framework for wireless lan monitoring and its applications, in Proc. IEEE Wise 2004, Singapore, Oct. 2004, pp [7] D.-H. Shin and S. Bagchi, Optimal monitoring in multi-channel multiradio wireless mesh networks, in Proc. ACM MobiHoc 2009, U.S.A, May 2009, pp [8] N. H. S. G. Chhetri, A and Z. R., On quality of monitoring for multichannel wireless infrastructure networks, in Proc. ACM MobiHoc 2010, U.S.A, Sep. 2010, pp [9] S. C. Arora, P and Z. R., Sequential learning for optimal monitoring of multi-channel wireless networks, in Proc. IEEE Infocom 2011, China, Apr. 2011, pp [10] S. Chen, K. Zeng, and P. Mohapatra, Efficient data capturing for network forensics in cognitive radio networks, in Proc. IEEE Icnp 2011, Canada, Oct. 2011, pp [11] Q. Yan, M. Li, F. Chen et al., Non-parametric passive traffic monitoring in cognitive radio networks, in Proc. IEEE Infocom 2013, Italy, Apr. 2013, pp [12] Q. Zhao, L. Tong, A. Swami, and Y. Chen, Decentralized cognitive mac for opportunistic spectrum access in ad hoc networks: A pomdp framework, IEEE Journal on Selected Areas in Communications (JSAC): Special Issue on Adaptive, Spectrum Agile and Cognitive Wireles Networks, vol. 25, no. 3, pp , [13] D. Murray, M. Dixon, and T. Koziniec, Scanning delays in networks, in Next Generation Mobile Applications, Services and Technologies, NGMAST 07. The 2007 International Conference on. IEEE, 2007, pp [14] P. Auer, N. Cesa-Bianchi, Y. Freund et al., The non-stochastic multiarmed bandit problem, SIAM Journal on Computing, vol. 32, no. 1, p. 4877, [15] D. P. Helmbold and M. K. Warmuth, Learning permutations with exponential weights, The Journal of Machine Learning Research, vol. 10, pp , [16] K. Mohan and O. Dekel, Online bipartite matching with partially-bandit feedback, in Proc. NIPS Workshop: DISCML [17] O. Dekel, R. Gilad-Bachrach, O. Shamir, and L. Xiao, Optimal distributed online prediction using mini-batches, The Journal of Machine Learning Research, vol. 13, pp , [18] R. Arora, O. Dekel, and A. Tewari, Online bandit learning against an adaptive adversary: from regret to policy regret, in Proceedings of the 29th International Conference on Machine Learning, 2012, pp [19] Y. Freund and R. E. Schapire, A decision-theoretic generalization of on-line learning and an application to boosting, J. Comput. Syst. Sci., vol. 55, no. 1, pp , Aug [20] S. Arora, E. Hazan, and S. Kale, The multiplicative weights update method: a meta-algorithm and applications. Theory of Computing, vol. 8, no. 1, pp , 2012.