Detecting Multi-Channel Wireless Microphone User Emulation Attacks in White Space with Noise

Transcription

1 Endorsed Transacions on Research Aricle Deecing Muli-Channel Wireless Microphone User Emulaion Aacks in Whie Space wih Noise Dan Shan, Kai Zeng, Weidong Xiang, Paul Richardson 49 Evergreen Rd, Dearborn, MI, USA, 489 Absrac Cogniive radio neworks (CRNs) are suscepible o primary user emulaion (PUE) aacks. Convenional PUE aack deecion approaches consider elevision broadcasing as he primary user. In his work, however, we sudy a special kind of PUE aack named wireless microphone user emulaion (WMUE) aack. Exising work on WMUE aack deecion deals wih single channel senario. Alhough muli-channel WM (MCWM) sysems are common, deecing WMUE aacks under a muli-channel seing in noisy environmens has no been well sudied. In his work, we propose a novel muli-channel WMUE aack deecion scheme which operaes in low signal-o-noise raio (SNR) environmens wih low compuaional complexiy, hanks o he firs.5-bi FM demodulaor whose oupus are represened by only, and -. Experimenal resuls show ha, he proposed scheme can effecively deec muli-channel WMUE aacks wihin.5 second when SNR is lower han 6 db. Received on May 3; acceped on June 3; published on 4 July 4 Keywords: CRN, WMUE, MCWM, FM demodulaor Copyrigh 4 D. Shan e al., licensed o ICST. This is an open access aricle disribued under he erms of he Creaive Commons Aribuion license (hp://creaivecommons.org/licenses/by/3./), which permis unlimied use, disribuion and reproducion in any medium so long as he original work is properly cied. doi:.48/cogcom...e4. Inroducion Cogniive radio (CR) enables secondary users (SUs) o share he specrum emporarily unused by primary users (PUs). To open he door for his new echnique and enhance he specrum efficiency, regulaors in many counries have issued permission for radio frequency (RF) ransmissions for license-exemp users on par of elevision (TV) bands, known as whie space. The wireless devices ha are carried by SUs and operae on whie space are called whie space devices (WSDs). WSDs perform specrum sensing on whie space o avoid collisions o he signals from PUs (incumben signals), mainly including TV signals and wireless microphone (WM) signals. Many specrum sensing echniques are proposed o deec hese wo ypes of incumben signals [3, 8,, 6, ]. When PUs emerge, SUs are required o evacuae from he specrum in order o avoid inerference o PUs. Exploiing his policy adversely, an aacker may block all SUs wihin an area by emulaing he signal of a cerain PU. This kind of aack is named primary user emulaion (PUE) aack [4]. Corresponding auhor. kzeng@umich.edu Over he years, remendous effors have been expended in he area of PUE aack deecion. By evaluaing he received signal s coverage area, one can differeniae beween he signal from a PUE aacker and he real TV signal [4, ]. However, hese deecion echniques do no apply o he aack ha emulaes WM signals (named WM user emulaion aack, or WMUE aack), because WM signals may be ransmied from anywhere. Moreover, WMUE aacks may be launched on a frequency band where no WM sysem has ever worked on; as a resul, one canno deec hese aacks by comparing heir channel-specific feaures wih he feaures conained in real WM signals [4]. In shor, deecing a WMUE aack is no easy, while launching a WMUE aack is as simple as building a cheap FM modulaor. Exising work deecs WMUE aacks in a singlechannel sysem by comparing he FM signal wih he audio signal acquired simulaneously [5]. Since a WMUE aacker wans o abuse he whie space and meanwhile hide himself, he is no willing o generae any audio signals correlaed wih he FM signal(s) he ransmis, and his fac leads o low similariy beween he FM signal and audio signal around he WM sysem. for Innovaion Endorsed Transacions on -7 4 Volume Issue e4

2 D. Shan e al. Alhough muli-channel WM (MCWM) sysems are are common, PUE aacks in hese sysems are rarely sudied, leaving several open challenges. Firsly, muliple WM users in he same MCWM sysem may speak simulaneously. This siuaion frequenly happens; for examples, muliple performers sing a song a he same ime on a sage, or several invied speakers on a conference are having a heaed discussion wih many overlapped alks. Then he audio signals on differen channels inerfere each oher, and he relaionship beween he mixed audio signal and he FM signals on muliple audio channels become more complicae. Secondly, he audio signal and FM signals are furher conaminaed by boh acousic noises and RF noises (we use he erm noise o represen boh hermal noise and inerferences coming from oher sysems, bu no including inerferences coming from oher audio channels in he same MCWM sysem). Thirdly, some WSDs have only one receiver branch and may monior he FM signal only on one audio channel. As a resul, RF signals on differen audio channels may no be observed simulaneously. An inuiive idea o solve hese challenges is o check he cross-correlaion beween a demodulaed FM signal and he audio signal acquired simulaneously. Since a WM user s speech is uncorrelaed wih noises and oher users speeches, inerferences from oher channels and noises can be resised by a cross-correlaor effecively. However, wo issues remain: () his soluion requires a FM demodulaor which only works in high signalo-noise raio (SNR) condiions; () a cross-correlaor conducs massive muliplicaions and has very high compuaion complexiy. These issues are ackled by a major conribuion in his work: a.5-bi FM receiver, which maps he FM signal o a piece of acousic signal whose ampliude is represened by, or -. This is no only he firs.5-bi FM receiver, bu also he firs FM receiver ha works effecively when SNR is as low as -3 db. This novely no only lowers he complexiy and SNR requiremen of a FM demodulaion, bu also significanly reduces he complexiy of a crosscorrelaor, since massive muliplicaions are eliminaed by he simple coefficiens and ±. The.5-bi FM receiver resuls in a cross-correlaor wih hreelevel quanizaion, which is he opimal quanizaion ha processes he leas informaion wih he given quanizaion error [7]. We evaluae he performance of he proposed.5- bi FM demodulaor by simulaions, and evaluae he performance of he whole deecion scheme in a real-world esing environmen, which includes an off-he-shelf MCWM sysem and a WSD prooype. Based on he waveforms acquired in his real-world esing environmen, we derive he deecion rae β and false alarm rae α of he proposed deecion scheme. Experimen resuls show ha, he proposed scheme requires only -3 o db SNR when wo audio channels are used, and requires abou 5-6 db SNR when four audio channels are used, wih he performance ha β >.9 and α <.. The deecion ime is as low as a quarer second. Our conribuions are summarized as follows: We propose a cross-correlaion based WMUE aack deecion scheme wih he abiliy o resis noises and inerferences in MCWM sysems; We propose he firs.5-bi FM demodulaor which enjoys low complexiy and simplifies he cross-correlaor, and evaluae is performance by boh heoreical analysis and compuer based simulaions; We design a hardware based prooype and validae he performance of he proposed deecion scheme in a real-world environmen. Throughou he paper, acousical signal and audio signal are synonymous. We use he erms wireless channel and acousic channel o represen he channels experienced by RF signal and sound, respecively. All SNR s in his work are measured over he effecive bandwidh of a FM signal which is a he level of 5 KHz, while hose in some oher works are measured over he enire 6MHz TV band [3, 8, ]. The -3 db SNR in his work is equivalen o -3.4 db in hose works, and is close o he limiaion of hose FM signal deecion schemes.. Relaed Works Various mehods are proposed o deec PUE aacks. Among hem, localizaion based mehods draw much aenion, wih he basic principle ha he locaion of some incumben signal ransmiers, for example, he TV owers, are preknown and hard o be emulaed. By localizing he ransmier using received signal srengh (RSS), one can differeniae beween legiimae users and PUE aackers [4, ]. Alernaively, PUE aacks may be deeced hrough he fac ha, he channel characerisics a differen users are differen and hard o be alered [6, 4]. Alhough his mehod is able o differeniae beween differen users, i canno ell which user is he aacker. In oher words, addiional informaion abou he legiimae user, like locaion or channel sae informaion (CSI), are also required. All hese mehods canno deec WMUE aacks, since boh he locaions and CSIs of MCWM users are hard o acquire. The algorihm proposed in [5] deecs he WMUE aacks by correlaing he acousic signal wih he RF signal acquired simulaneously, and his principle is also adoped in his work. However, he work in [5] only considers he single-channel WM sysem, while for Innovaion Endorsed Transacions on -7 4 Volume Issue e4

3 Deecing Muli-Channel Wireless Microphone User Emulaion Aacks in Whie Space wih Noise his work covers boh single-channel and muli-channel cases. Auhors in [] propose a cooperaive specrum sensing scheme ha maximizes he deecion rae when PUE aacks exis. Moreover, a frequency hopping sraegy is proposed in [3] o comba wih PUE aacks under a game-heoreic model. These works are devoed o alleviaing PUE aacks, raher han deecing PUE aacks. Several all-digial FM receivers are proposed in [, 5, 9], and all of hem ignore noises. A FM receiver ha works when SNR is as low as -3 db is no found in he lieraure. Moreover, no.5-bi FM demodulaor is found in he exising lieraure o deec WMUE aacks. In his work, a low-precision FM demodulaor can significanly reduce he compuaion complexiy, and is sudied for he firs ime. The design of muliplierless cross-correlaors is discussed in [], while design consideraions and performance evaluaion for he complex cross-correlaor wih hree-level quanizaion are presened in [7]. These works guide us o he idea of.5-bi daa precision; however, he main focus of his work is o deec PUE aacks, while he muliplierless cross-correlaors is only par of he whole scheme. Some preliminary resuls of his work are presened in [8]. In his paper, we add more echnical deails and evaluae he performance of he proposed FM demodulaor in noisy environmens hrough boh heoreical analysis and simulaions. Moreover, deecing hreshold of he proposed WMUE aack deecor is also discussed. 3. Sysem Model 3.. Sysem Seup A MCWM sysem is surrounded by a se of WSDs, as shown in figure. This MCWM sysem is composed of M audio ransmiers (WMs) where M, one MCWM receiver and one loudspeaker. The audio signals acquired by differen WMs are modulaed on differen wireless channels, and are all received by he MCWM receiver and mixed ogeher. We denoe he audio signal and FM signal a he m h WM as a m () and s m (), respecively. Then he audio signal oupu a T () a he MCWM receiver equals o M a m (), m= which is furher amplified by he loudspeaker and overcas all acousic signals generaed by WM users. The WSD is able o acquire (some of) he FM signals s m (), as well as acousic signal a() which conains a T (), is reverberaions and acousic noises. The cenral frequency of s m () is denoed as f m. Aacker FM signal srengh WSD Acousic Sensor MCWM Sysem WSD Scenario Scenario Scenario 3 Audio signal srengh WSD Figure. The sysem model and hree scenarios considered in his paper. Scenarios differ from each oher in he qualiies of FM signals and acousic signals. According o [3], he FM signal can be modelled by [ ] s m () = A C cos πf m + π f a m ()d + θ where A C and f conrol he ampliude and bandwidh of his FM signal, respecively, and θ represens a random phase wih uniform disribuion over [, π]. We consider ha he qualiy of acousic signal a() drops much faser han he qualiies of s m (), when he propagaion disance d increases. The reasons are wofold. Firsly, acousic signals are more easily being blocked by obsacles like buildings, compared wih FM signals operaing on very high frequency (VHF) and ulra high frequency (UHF) bands. According o he measuremen resuls in [9], FM signals may have more han 3 db SNR when d = 5m, while effecive ranges of he acousic signals from mos MCWM sysems are less han m. Secondly, he sources of RF inerference are much less han he sources of acousic inerferences, since differen wireless sysems operae on differen frequency bands, while many ypes of acousic inerferences collide wih human speeches in boh ime-domain and frequency-domain. According o he propagaion models above, we define hree operaing scenarios: () Scenario : d < m, so boh s m () and a() are noise-free; Scenario : m < d < m, so s m () is noise-free, bu a() is noisy; Scenario 3: d > m, so s m () is noisy, bu highqualiy a() is acquired by he sensor close o he for Innovaion 3 Endorsed Transacions on -7 4 Volume Issue e4

4 D. Shan e al. MCWM sysem and sen o he WSD hrough infrasrucure. These hree scenarios are also illusraed in figure. Our proposed WMUE aack deecion algorihm covers all hese hree scenarios. For each scenario, we will focus on one WSD in he following analysis. We assume ha he power of s m () is above he noise floor a each WSD in all scenarios, so ha f m can be esimaed by he WSD [8]. Since f m can only be a muliple of 5 khz [], he WSD is able o adjus is esimaes on f m according o his rule. As a resul, he WSD knows exac values of f m for m =,..., M. 3.. Aacker Model An aacker emulaes he MCWM sysem by ransmiing FM signals on one or muliple channels used by he legiimae MCWM sysem. These emulaed FM signals and he FM signals ransmied by WMs are indisinguishable in erms of he modulaion scheme and ransmission power. The aacker is no willing o conver he demodulaed FM signal o audio signal and send i o he loudspeaker, since such audio signal would be very srange and expose he aacker direcly, unless he original daa ransmied by he aacker is jus a piece of analogue audio signal (he excepional case). Therefore, we consider ha he aacker does no generae any audio signal, or generaes audio signal ha is no correlaed o he FM signal. We consider ha he aacker in he excepional case is acually a legiimae WM sysem which may use he specrum legally. We assume ha he aacker has he abiliy o sense he specrum and avoids collisions wih exising MCWM sysems. Therefore, here is one and only one source of s m () The Deecion Problem The deecion problem we sudy here is defined as he ask o idenify he source (eiher he MCWM sysem or he aacker) of s m (), given a se of a() and s m (). I can be modelled as a hypohesis es: H : s m () is generaed by he MCWM sysem; H : s m () is generaed by he WMUE aacker. H and H are called null hypohesis and alernaive hypohesis, respecively. 4. The WMUE Aack Deecion Scheme The proposed WMUE aack deecion scheme is based on he principle ha, he acousic signal and FM signals coming from he MCWM sysem correlae o each oher, while hose coming from he WMUE aacker do no. Then by evaluaing he cross-correlaion beween he demodulaed FM signal on a specific wireless channel and he acousic signal, one can disinguish beween a MCWM user and a WMUE aacker. Basic procedures of he proposed scheme are shown in figure. The WSD firs searches any FM-like signal on he frequency band ineresed. Once deecing a signal, i records he RF signal s m () and acousic signal a() simulaneously. Then i down-convers s m () o an inermediae frequency (IF) signal s m (IF) (), and feeds he laer one ino a low-complexiy FM demodulaor. In oher words, a superheerodyne receiver is considered here. Finally, he scheme compues he peak value X of he cross-correlaion beween he demodulaed signal Y n and he down-sampled acousic signal A n. X is close o if s m () is ransmied from he MCWM sysem, and close o if no. The same operaions are repeaed for oher channels ineresed. The cross-correlaor suffers from very high compuaion complexiy. To solve his problem, we firs noice ha reducing he daa precision reduces he complexiy of cross-correlaor dramaically, bu only degrades he performance slighly [7]. Consider he operaion Y n A n required in he cross-correlaor shown in figure n ; if Y n equals o eiher or -, all he muliplicaions are unnecessary. Moreover, if Y n = a some poins, he number of addiions is also reduced. Moivaed by hese facs, we represen Y n by only, and -. In oher words, we propose a.5-bi FM demodulaor wih inpu s m (IF) () and oupu Y n, and show he relaionship beween he original audio signal a m () and he desired oupu Y n in figure 3. This simplified FM demodulaor in urn simplifies he cross-correlaor significanly. We inroduce he.5-bi FM demodulaor in subsecion 4., and discuss is performance in noisy environmens in subsecion 4.3. Audio signal processing and he cross-correlaor are inroduced in subsecions 4.4 and 4.5, respecively. Finally, he WMUE aack deecor is given in subsecion Preliminaries We firs analyse he properies of IF signal s m (IF) () wih cenral frequency f I : and [ ] s m (IF) () = A C cos πf I + π f a m ()d + θ. () For mos superheerodyne receivers, f I > f max (3) f I > f a max (4) where f max and a max denoe he maximum frequency and maximum ampliude of a m (), respecively. Then for Innovaion 4 Endorsed Transacions on -7 4 Volume Issue e4

5 Deecing Muli-Channel Wireless Microphone User Emulaion Aacks in Whie Space wih Noise Wireless ransceiver s () m Frequency downconversion ( IF s ) m ().5-bi FM demodulaor Y n Corss-correlaor X Deecor Acousic sensor a() Downsampler Figure. Basic procedures of he proposed WMUE aack deecion scheme. a max a max - a () m Y n Figure 3. The relaionship beween a m () and he desired oupu Y n of a.5-bi FM demodulaor, where η and η are wo decision hresholds. A n we define T as a number ha saisfies and ge he following observaions. Observaion : where (n+)t f max /T < f I (5) s (IF) m ()e jπg k d A C T sinc((g k f )T ) (6) and sinc(x) := sin(πx)/(πx). f := f I + f a m ( ) (7) g k f /(T ) (8) Proof. Define θ := π f a m()d and θ := π f a m ( ). From () we have s m (IF) () = A C cos [ πf I + π f a m ()d + θ + θ A C cos [ πf + θ ] (9) n ] where θ := θ θ + θ. The approximaion in (9) is due o he reason ha, /T f max according o (5), a m () shows limied change during [, ], and a m ()d a m ( )( ). Then we ge +T s m (IF) ()e jπg d +T A C cos [ πf + θ ] e jπg d = A C [ +T e jπ(g+f )+jθ d + } {{ } d +T e jπ(g f ) jθ d ] } {{ } () The inegrands in d and d are wo periodical funcions wih frequencies g + f and g f. According o (5) (7) and (8), g + f f I > /T 4 g f. As a resul, d is much smaller han d. By ignoring d, () becomes +T s m (IF) ()e jπg d A C +T e jπ(g f ) jθ d = A C e jθ (e jπ(g f )T )/(jπ(g f )) where θ := θ π(g f ). Then from () we have (n+)t s m (IF) ()e jπgk d A C e jθ (e jπ(g f )T )/jπ(g f ) = A C ( cos(πt (g f )))/(4π (g f ) ) = A C T sinc((g k f )T ) d () () Observaion : If g f g f /(T ), S m,n () S m,n () where S m,n (k) := (n+)t s (IF) m ()e jπgk d and f := f I + f a m ( ). Proof. I is easily shown ha Sm,n k equals o he lef par of (6) when =. According o Observaion, S m,n (k) is a monoonically decreasing funcion wih respecive o g f during [, /(T )]. Therefore, Observaion holds. Since we focus on he m h audio channel here, we drop he index m in S m,n (k) if doing his would no cause misundersanding. 4.. The.5-bi FM Demodulaor Def iniion: A demodulaor wih oupu Y m,n is he.5- bi FM demodulaor of he IF signal s m (IF) () defined in () if and only if, a m ( ) < ηa max Y m,n =, ηa max a m ( ) < ηa max (3), ohers for Innovaion 5 Endorsed Transacions on -7 4 Volume Issue e4

6 D. Shan e al. s ( IF ) m () e e j ( fi fr) j fi e j ( fi fr) ( n ) T () d ( n ) T () d ( n ) T () d ( n ) T () ( n ) T () ( n ) T (3) Y arg maxs S n i ( i) Sn () () (3) : { Sn, Sn, Sn } Figure 4. The proposed.5-bi FM demodulaor. where n =,,..., while η and η are wo decision hresholds wih < η <. Figure 3 shows he relaionship beween a m () and he desired oupu of his.5-bi FM demodulaor. The hresholds η and η should guaranee ha Y m,n equals o, or - wih equal probabiliies, so ha he amoun of informaion conained in Y m,n is maximized. For example, if he ampliude of a m () is evenly disribued over [, a max ], η =.5. P roposision : The demodulaor shown in figure 4 wih oupu Y n = arg max is he.5-bi FM i (i) demodulaor defined in Def iniion, where := {S () n, S () n, S (3) n }, g = f I f R, g = f I, g 3 = f I + f R, f R = ηa max f, and where k =,, 3. Proof. When a m ( ) < ηa max, g k f /(T ) (4) g f = f R + f a m ( ) = ηa max f + f a m ( ) < f a m ( ) = g f /(T ) (5) and i is easily shown ha g f < g 3 f /(T ). Then according o Observaion, () > () and () > (3). As a resul, arg max = and Y n =. i (i) By he same way, one can verify ha Y n = when ηa max a m ( ) < ηa max, and Y n = when a m ( ) ηa max. The.5-bi FM demodulaor proposed in figure 4 borrows he design of mached-filer [3]; however, heir basic principles are differen. In our sysem, he local signals fed ino he mulipliers, e jπf I and e jπ(f I ±f R ), do no necessarily mach any pieces of he FM signal ransmied. Insead, our sysem is designed such ha he inegraors generae larger oupus when a () m a Normalizaion m() Sampler am( ) Three-level ( m) P F s =/T Quanizer a Figure 5. The proposed.5-bi FM demodulaor can be inerpreed as a sampler for he audio signal a m () wih sampling frequency F s = /T followed by a hree-level quanizer. hese local signals mach he presen signal beer. Then by searching he larges oupus from hree inegraors, he demodulaor deermines he bes value (, or -) for Y n. This.5-bi FM demodulaor can also be inerpreed as a sampler for he normalized audio signal ã m () wih sampling frequency F s = /T followed by a hree-level quanizer, as shown in figure 5. Afer normalizaion, we assume ha he average power of ã max () equals o. This FM demodulaor may also operae in digial domain, if he inpu sm IF () is sampled wih sampling rae G s. I is easily shown ha, basic principle of his demodulaor sill holds in digial domain, while he only change is o replace he inegraors in figure 4 by adders. By adoping inegraors, he proposed.5-bi FM demodulaor is able o work in low-snr environmens wih low compuaion complexiy. On he oher hand, convenional digial FM demodulaors [, 5, 9] eiher suffer from high complexiy or require high SNR Performance of he FM demodulaor in Noisy Environmens We define he noisy IF signal fed ino he FM demodulaor as s (IF) m (), which is modelled as s (IF) m () = s m (IF) () + w m () (6) where w m () is he addiive whie Gaussian noise (AWGN) wih power σ m a he m h wireless channel. Then according o figure 4, oupu of he i h inegraor is given by where S (i) n = (n+)t = ρ (i) n e jφ i + (n+)t (s m (IF) () + w m ())e jπgi d w m ()e jπg i d (7) ρ (i) n := A C T sinc((g k f )T ) (8) according o Observaion, and φ i denoes he angle of he complex value in () when g = g i. Le N m := +T w m ()e jπgi d represen he random par in (7). One can easily verify ha N m is a random variable which follows complex normal disribuion wih mean value and variance σmt. As a resul, (i) in (7) follows Rician disribuion whose probabiliy Y n for Innovaion 6 Endorsed Transacions on -7 4 Volume Issue e4

7 Deecing Muli-Channel Wireless Microphone User Emulaion Aacks in Whie Space wih Noise (a) f = (a) f = () () (3) () () (3).. x Errors 4 (b) f =f I -f R fi fr () () (3).. x Errors 4 (b) f =f I -f R fi fr () () (3).. x Figure 6. The PDF curves for (), () and (3) wih (a) f = f I and (b) f = f I f R, respecively, and γ = db... x Figure 7. The PDF curves for (), () and (3) wih (a) f = f I and (b) f = f I f R, respecively, and γ = 8 db. densiy funcion (PDF) is given by [] x p i (x) = σ mt e, x < x +(ρ (i) n ) σ m T I ( xρ(i) n σmt ), x (9) where ρ n (i) follows he same definiion as in (8), and I (x) is he modified Bessel funcion of he firs kind wih order zero. Similar o he bi-error-rae (BER) performance in digial communicaion sysems [], performance of he proposed.5-bi FM demodulaor is closely relaed o he raio γ defined by γ := ρ n /(σmt ), which is proporional o A C T /σm according o (8). Noe ha A C /σm jus equals o (wice of) he SNR of s m (). As a resul, larger SNR leads o larger γ and beer ani-noise abiliy. Larger T also leads o larger γ. However, T is also resriced by (5) and (4), while larger T makes boh Observaion and Observaion less accurae and may increase demodulaion error (we call i modelling error). In pracice, he opimal value of T may no sricly saisfy boh (5) and (4) due o he rade-off beween γ and modelling error. We will derive he opimal value of T by simulaions in subsecion 5.. PDF s of (), () and (3) are ploed in figure 6, wih A C =, f I = 5 khz, f R = 5 khz, T = 5µs and γ = db. When f = f I as shown in figure 6.a, () has he bes chance o be he larges one among { (), (), (3) }; as a resul, Y n ends o be, which is correc. When f = f I f R as shown in figure 6.b, () is mos likely he larges one, and Y n ends o be -. The shaded area denoes he chance of decoding error. When γ is changed o 8 db and oher condiions keep unchanged, as shown in figure 7, he shaded areas become smaller compared wih hose in figure 6, and he demodulaion performance is beer. Alhough a closed-form expression on he BER of his demodulaor can be derived from PDF s, we noe ha his expression is valid only when his demodulaor operaes in analog domain. Performance of his FM demodulaor operaing in digial domain is affeced by he sampling rae F s, and we will show he normalized mean square error (NMSE) performance of his demodulaor under he sampling rae adoped by he real-world experimens in subsecion Audio Signal Processing We model he acousic signal a() arriving a he WSD under H as a() H = a (T ) () h() = where J h j a (T ) ( j ) + z() () j= h() := J h j δ( j ) represens he impulse j= response of he acousic channel beween loudspeaker and WSD, and z() denoes audio noises. In pracice, acousic signal ravels slower han RF signal. To address his issue, we define he ime = as he ime when FM signal is deeced by he WSD. Accordingly, all j s in he acousic channel model h() incorporae propagaion delay of he acousic signal. As an example, if here is line-of-sigh wih disance D beween audio amplifier and WSD, = D/v where v denoes he speed of sound in he air, while propagaion delay of FM signal is much smaller han and has been ignored. for Innovaion 7 Endorsed Transacions on -7 4 Volume Issue e4

8 D. Shan e al. A he WSD side, a() is sampled by he acousic sensor a a high sampling rae (for example, 44. khz). In order o mach his acousic signal wih he FM demodulaor oupu, we resample his acousic signal a he rae /T, which equals o he sampling rae of Y n. Since /T = khz is good enough o capure human voices, we consider his operaion as a downsampler as shown in figure. Moreover, his downsampler feaures a lowpass filer wih sop-band /T o resis ou-of-band noises. Denoe he downsampled acousic signal as A n, which is obained by A n H = a (T ) () h() h s () + z L () () where h s () := δ( ) serves as he sampling funcion, and z L () denoes he lowpass-filered noises. We combine he sampling operaion wih he acousic channel response, and define d( ) := h() h s () := L d l δ( l T ) + Z n () l= where l is a non-negaive ineger, and Z n denoes he samples of noises. Combining () and (), we ge A n H = M = M m= m= l= a m () L d l δ( l T ) l= L d l a m ( l T ) + Z n. On he flip side, A n under H is modelled by (3) A n H = Z n (4) which incorporaes boh audio noise and possible audio signal generaed by he aacker. We denoe he average powers of Z n and Z n as P Z and P Z, respecively. When he aacker emulaes boh audio signal and FM signals, P Z > P Z, whereas P Z = P Z if he aacker only emulaes FM signals The Cross-correlaor In his subsecion, we will se up he connecion beween he audio samples A n and he FM demodulaor oupus Y n under hree scenarios defined in subsecion 3.. Scenario. We firs look a he simples scenario (scenario ) in which boh audio noises and RF noises are ignored. According o (3) and (3), boh A n and Y n are funcions of a m () under H. Moreover, he relaionship beween Y n and a m () can be simplified by he inerpreaion given in figure 5: Y m,n = a m( ) P (m) a + Q m,n (5) where P a (m) denoes he average power of a m (), and Q m,n denoes he quanizaion error a =. Then from (3) and (5), we ge where C () m,p := Corr(A n H, Y m,n, p) := P W (A m,p n H )Y m,n p n= = P (C () m,p m,p + C m,p () + C m,p), () p = l P (C () m,p m,p + C m,p), (3) ohers n= (6) W W P m,p := ( (A n ) )( (Y m,n p ) ) (7) P (m) a C m,p () := W C (3) m,p := C () m,p := W n= M n= m= l= P (m) a W d l P (m) a W n= m,l, m m + l l n= m = l = n= a m (n l ) (8) a m (n l )a m (n l ) (9) L d l a m (n l )Q m,n + W Z n Y n p n= (3) M L d l a m (n l )a m (n p). (3) and W deermines he window size of his crosscorrelaor. Similarly, Corr(A n H, Y m,n, p) is obained by seing a m () = for m =,..., M in (6): Corr(A n H, Y m,n, p) = W Z P ny m,n p. (3) m,p n= The audio noises Z n and Z n and quanificaion error Q n are considered as uncorrelaed o Y n and a m (), respecively. As a resul, Corr(A n H, Y m,n, p) is close o. On he flip side, due o he exisence of C m,p () given in (8), Corr(A n H, Y m,n, p) always conains some values ha are much larger han (bu smaller han ). If audio signals a m () on differen channels are correlaed wih each oher, Corr(A n H, Y m,n, p) is even larger because of C m,p () given in (9). In any case, Corr(A n H, Y m,n, p) is expeced o exceed Corr(A n H, Y m,n, p) when p = l. Finally, we design he oupu X of he cross-correlaor as X = max {Corr(A n, Y m,n, p)} (33) p=,...,τ max where τ max represens he maximum delay spread of he audio channel divided by T (and rounded for Innovaion 8 Endorsed Transacions on -7 4 Volume Issue e4

9 Deecing Muli-Channel Wireless Microphone User Emulaion Aacks in Whie Space wih Noise o he neares ineger if necessary). Equaion (33) searches he peak value X of he cross-correlaion beween demodulaed FM signal and down-sampled audio signal wihin he ime window [, τ max ], and X H is expeced o exceed X H. This searching process synchronizes he demodulaed FM signal Y m,n wih he sronges (sampled) pah in A n. Scenario and Scenario 3. Scenario differs from Scenario only in ha, he audio signal a() has poor qualiy, or in oher words, Z n has larger ampliude. As a resul, all he analysis in Scenario direcly applies o Scenario. Scenario 3 differs from Scenario only in ha, s m () has poor qualiy. As a resul, Y m,n is conaminaed by boh quanificaion error and noises. For simpliciy, we merge he he quanificaion error ino noises, and le Q m,n represen boh. As a resul, all he analysis in Scenario sill applies o Scenario 3. The value of Corr(A n H, Y m,n, p) increases when he ampliude of Z n or Q m,n increases. As a resul, he window size W of he cross-correlaor in Scenario and Scenario 3 should be larger han he window size adoped in Scenario. However, larger window size also leads o longer deecion ime which equals o T W, and here is a rade-off beween he deecion performance and compuaion complexiy. We will discuss his issue in secion The Deecor n= According o he analysis in subsecion 4.5, X H is expeced o be greaer han X H under all hree scenarios. Then he proposed WMUE aack deecor is given as follows: The Deecor: a WMUE aack is deeced if and only if X < X, where X is he deecion hreshold. To deermine he deecion hreshold X, we firs ignore he quanificaion error Q m,n, and assume ha audio signals a differen audio channels are uncorrelaed and have same average power P R measured a he WSD. Then he firs erm in (3) (he power of he mixed audio signal a he WSD) has he average power MP R, C m,p () = and C m,p () = W Z n Y n p. I is easily shown ha P m,p W MP R + P Z, C m,p () W P R, and C m,p () W P Z, where P Z denoes he average power of Z n. Then we ge and X H W P R + W P Z W MP R + P Z (34) X H / W. (35) When W is large, X H approaches and X H approaches P R / MP R + P Z. The deecion hreshold X equals o PR / MP R + P Z accordingly, which only needs he second-order saisics of audio signal and background noise. X may be furher simplified as / M when P Z is small compared wih P R. When audio signals on differen channels are correlaed, X H increases while X H keeps unchanged. Wih he same deecion hreshold derived above, deecion rae will be enhanced, while he false alarm rae is no affeced Discussions Wih he models (3) and (4), i seems ha WMUE aacks can be deeced simply by energy deecion. However, such deecion mehod is vulnerable if he aacker emulaes audio signal in order o increase he audio noise floor. On he flip side, he proposed scheme always works as long as he emulaed audio signal is uncorrelaed o he FM signal. In order o ge X, Corr(A n, Y m,n, p) needs o be calculaed for τ max + imes wih differen values of p. In he definiion of Corr(A n, Y m,n, p) given in W (6), he calculaion of (A n H )Y m,n p requires n= only addiions, because Y m,n only akes he values of and ±. Moreover, he normalizaion facor P m,p can be derived ieraively [7], and akes only one muliplicaion and one square roo operaion per updae, only excep for he firs updae (when p = ). The.5-bi FM demodulaor requires only hree analogue mulipliers and hree inegraors if operaing a analogue domain, and akes hree muliplicaions and hree addiions per sample if operaing a digial domain. As a resul, he whole deecion scheme enjoys low compuaion complexiy. 5. Experimens Performance of he proposed WMUE aack deecion scheme is deermined by he performances of he.5-bi FM demodulaor and he cross-correlaor. We firs conduc compuer-based simulaions o evaluae he NMSE performance of he FM demodulaor, hen prooype he whole scheme and conduc real-world experimens o evaluae deecion rae and deecion ime. 5.. Performance of he FM demodulaor Performance of he FM demodulaor is quanified by NMSE, which is defined as NMSE := N All n= N All (Y () m,n Y () m,n) n= (Y () m,n) (36) for Innovaion 9 Endorsed Transacions on -7 4 Volume Issue e4

10 D. Shan e al. where Y m,n () denoes he oupus of he ideal FMdemodulaor defined in (3), Y m,n () denoes he oupus from he proposed FM-demodulaor shown in figure 4, and N All represens he lengh of boh oupus. In his definiion, we have excluded he quanizaion error, since he ask of his demodulaor is no o recover he original audio signal a m (), bu o provide valid coefficiens for he cross-correlaor. The NMSE performances are derived from compuer based simulaions, wih f = 5kHz, f I = khz, η =.5 and N All = 5. The audio signal a m () is read from an audio file which records a piece of human voice, wih a max (a lile smaller han ). Moreover, he IF signal sm IF () is sampled a G s = 5 khz, which is he same sampling rae ha will be used in our real-world esing, and he FM demodulaor operaes a digial domain. The sampling inerval T is considered as an imporan design parameer, since larger T leads o larger γ as discussed in subsecion 4.3, bu also reduces he sampling rae of Y m,n and may cause aliasing. Moreover, SNR of he FM signal, which equals o A /(σm), is also an imporan facor of NMSE. We plo NMSEs of he FM-demodulaor as a funcion of SNR in figure 8, when T equals o.,.5,.5 and ms, respecively. I is shown ha he seing T =.5ms leads o he bes performance in mos cases, and is adoped in he following esing. The corresponding opimal sampling rae Fs is khz, which jus saisfies (5) wih he fac ha he mos energy in human voice concenraes in he frequency band below khz. On he flip side, Fs is smaller han he value required by (4) which equals o khz, since smaller sampling rae leads o longer inegraion window and beer ani-noise abiliy, which compensaes for he increased modelling error. 5.. The Prooype We prooype he proposed WMUE aack deecion scheme by a commercial MCWM sysem and a selfdesigned WSD in a m 7m room, as shown in figure 9. A commercial MCWM sysem and a WSD prooype are se up in a m 7m room. The MCWM sysem conains an 8-channel WM receiver manufacured by Pyle Audio Inc. wih model number PDWM84, a 4W loudspeaker, and eigh WMs. The carrier frequencies of hese 8 channels are wihin he range of 7-4 MHz, which falls ino VHF band. The WSD prooype is composed of wo funcion blocks: () audio signal acquisiion and () RF signal acquisiion. An acousic sensor conneced o a lapop wih sampling rae F s = 44. khz akes response of audio signal acquisiion, while RF signal acquisiion is realized by a mulichannel oscilloscope and wo RF branches, which is NMSE (db) T=.ms T=.5ms T=.5ms T=ms SNR (db) Figure 8. NMSE of he proposed.5-bi FM demodulaor when T equals o.,.5,.5 and ms, respecively. Audio signal Loudspeaker The MCWM sysem The WSD prooype Acousic Sensor Lapop Audio signal acquisiion MCWM Receiver s Oscilloscope ( IF ) m () s ( IF ) m () RF signals WMs RF Branch RF Branch RF signal acquisiion Figure 9. Block diagram of he real-world esing environmen. Anenna Amplifier Mixer RF LO IF Carrier Signal Generaor LPF s ( IF ) m () Figure. Block diagram of one RF branch. capable o capure RF signals on wo wireless channels simulaneously. The wo RF branches in figure 9 share he same design as shown in figure, which is mainly a frequency down-conversion circui realized by a level-7 mixer. A signal generaor serves as he local oscillaor. Moreover, he wireless signal is amplified by an amplifier a RF and filered by a LPF a IF. Boh he for Innovaion Endorsed Transacions on -7 4 Volume Issue e4

11 Deecing Muli-Channel Wireless Microphone User Emulaion Aacks in Whie Space wih Noise ( IF ) s () Y,n - n Figure. Phoo of he WSD prooype. image in he mixer s IF oupu and he ou-of-band inerferences are also rejeced by he LPF; herefore, we do no apply any RF filer here. The IF signals s m (IF) () and s m (IF) () coming from wo RF branches are recorded by he muli-channel oscilloscope wih sampling rae F a = 5 khz and f I = khz. Figure shows he picure of he WSD prooype Tesing Mehod We consider such a WMUE aacker who replaces he speaker of a commercial WM sysem wih an earphone and uses he modified sysem as his personal wireless phone. This aacker is very similar o a legiimae WM user and hard o be deeced. As a resul, he WM user is emulaed by he MCWM sysem wih loudspeaker urned on, while he WMUE aacker is emulaed by he same MCWM sysem wih loudspeaker urned off. Meanwhile, we define deecion rae β as he rae ha he WMUE aack is deeced when he loudspeaker is urned off, and define false alarm rae α as he rae ha he WMUE aack is deeced when he loudspeaker is urned on. For each scenario described in secion 3., we es wo cases ha () wo wireless channels or () four wireless channels are used simulaneously; we will use he erms wo channels and four channels o represen hese wo es cases, respecively. The FM demodulaor operaes in digial domain wih = n T where T = µs and n =,,... We se τ max =, since he maximum delay spread of he acousic channel experienced in our experimens does no exceed. s. Two RF branches are designed o emulae some WSDs wih muliple anennae; he waveforms acquired by wo RF branches are considered as wo independen samples, upon which our deecion scheme are execued wice and he resuls are averaged. We se η =.5 in boh cases and all scenarios. Figure. Waveform pieces of he IF signal and demodulaor oupu acquired in he esing. Performance of he proposed WMUE aack deecion scheme in Scenario is evaluaed by he original waveforms acquired in he experimens, wih abou 3 samples for each es case. For he oher wo scenarios, we add random noises o eiher he acousic signal (in Scenario ) or IF signals (in Scenario 3) wih cerain SNR Tesing Resuls A snapsho of he waveform pieces of s (IF) () and Y,n derived in he experimens is plo in figure. The IF signal s (IF) () is close o a sine wave bu wih varying frequency; is ampliude is no consan due o he limied over-sampling rae (which equals o 5 according o he seings in subsecion 5.). The demodulaor oupu Y,n equals o when he insan frequency of s (IF) () is high, while equals o when he insan frequency of s (IF) () is low. Nex, we evaluae he relaionship beween deecion rae β and deecion ime T W in hree scenarios wih he simpler case of wo channels, as shown in figure 3. Boh he SNR of he audio signal in Scenario and he SNR of he IF signals in Scenario 3 are se o 3 db, and he false alarm rae α in all curves are kep below.. The proposed scheme achieves good performance in all scenarios when he deecion ime is no less han.5 s, or W >= 5. We focus on he case of W = 5 in he following experimens. Finally, he performances in Scenario and Scenario 3 under differen SNR condiions are furher evaluaed by receiver operaing characerisic (ROC), which represens deecion rae β versus false alarm rae α. In Scenario, he proposed deecion scheme achieves he performance α <. and β >.9 (named good performance) when SNR is higher han -3 db and 6 db in he cases of wo channels and four channels, respecively, as shown in figure 4. In Scenario 3, he SNRs required o achieve good performance in he wo for Innovaion Endorsed Transacions on -7 4 Volume Issue e4

12 D. Shan e al Scenario 3 Deecion Rae β Scenario, wo channels. Scenario, wo channels Scenario 3, wo channels Deecion Time (s) Figure 3. Deecion rae versus deecion ime in hree scenarios in he cases of wo channels and four channels, respecively. Deecion Rae β.6.4 Two channels, SNR=dB Two channels, SNR=3dB. Four channels, SNR=3dB Four channels, SNR=5dB Four channels, SNR=7dB False Alarm Rae α Figure 5. ROC curves in Scenario 3 under differen SNR condiions in he cases of wo channels and four channels, respecively. Deecion Rae β.8.6 Scenario.4 Two channels, SNR= 3dB Two channels, SNR=dB Two channels, SNR=3dB. Four channels, SNR=3dB Four channels, SNR=6dB Four channels, SNR=9dB False Alarm Rae α Figure 4. ROC curves in Scenario under differen SNR condiions in he cases of wo channels and four channels, respecively. cases are db and 5 db, respecively, as shown in figure 5. These esing resuls validae ha, he proposed scheme perform well in boh noiseless environmens and noisy environmens. 6. Conclusions In his paper, we propose a novel and simple algorihm o deec WMUE aacks imposed on MCWM sysems in noisy environmens. To he bes of our knowledge, his is he firs work ha considers he MCWM sysems. The cross-correlaion beween demodulaed FM signal and he acousic signal acquired simulaneously provides an effecive way o deec WMUE aacks, and show good abiliy o resis noises/inerferences. Moreover, compuaion complexiy of he cross-correlaor can be significanly reduced by he proposed.5-bi FM demodulaor. The opimal sampling rae of he FM demodulaor is khz according o he simulaion resuls. We se up a MCWM sysem and design a WSD prooype for performance evaluaion. Hardware based experimens show ha, he proposed algorihm is able o deec WMUE aacks wihin.5 s in all scenarios when wo or four wireless channels are used simulaneously, wih deecion rae β >.9 and false alarm rae α <.. The minimum and maximum SNRs required o achieve such performance in various condiions equal o -3 db and 6 db, respecively. We conclude ha, boh he.5-bi FM demodulaor and he WMUE aack deecion algorihm achieve good performances in noisy environmens. Performance of he proposed scheme may be furher enhanced by muliple anenna or collaboraive sensing echniques, which are considered as our fuure works. Acknowledgemen. This maerial is based upon work parially suppored by he US Naional Science Foundaion CAREER award under Gran Number (CNS-495). References [] Communicaion Sysems and Techniques. New York: McGraw-Hill, 966. [] C. Chen, H. Cheng, and Y.-D. Yao. Cooperaive specrum sensing in cogniive radio neworks in he presence of he primary user emulaion aack. IEEE Transacions on Wireless Communicaions, (7):35 4, 7 July. [3] H.-S. Chen and W. Gao. Specrum sensing for v whie space in norh america. IEEE Journal on Seleced Areas in Communicaions, 9():36 36, Feb.. for Innovaion Endorsed Transacions on -7 4 Volume Issue e4

13 Deecing Muli-Channel Wireless Microphone User Emulaion Aacks in Whie Space wih Noise [4] R. Chen, J.-M. Park, and J. Reed. Defense agains primary user emulaion aacks in cogniive radio neworks. IEEE Journal on Seleced Areas in Communicaions, 6():5 37, Jan. 8. [5] S. Chen, K. Zeng, and P. Mohapara. Hearing is believing: Deecing wireless microphone emulaion aack in whie space. IEEE Transacions on Mobile Compuing, (3):4 4, 3. [6] Z. Chen, T. Cooklev, C. Chen, and C. P. Raez. Modeling primary user emulaion aacks and defenses in cogniive radio neworks. In Proc. Performance Compu. Commun. Conf. (IPCCC), 9. [7] L. R. D Addario, A. R. Thompson, F. R. Schwab, and J. Granlund. Complex cross correlaors wih hree-level quanizaion design olerances. Radio Science, 9:93 945, May-June 984. [8] H. S. Dhillon, J.-O. Jeong, D. Dala, M. Benonis, R. M. Buehrer, and J. H. Reed. A sub-space mehod o deec muliple wireless microphone signals in v band whie space. Analog Inegr Circ Sig Process, (69):97âĂŞ36, Sep.. [9] T. Erpek, M. McHenry, and A. Sirling. Dynamic specrum access operaional parameers wih wireless microphones. IEEE Communicaions Magazine, 49(3):38 45, Mar.. [] FCC. Fm broadcas ranslaor saions and fm broadcas booser saions, 47 cfr par 74. [] J. Garodnick, J. Greco, and D. Schilling. Theory of operaion and design of an all-digial fm discriminaor. IEEE Transacions on Communicaions, (6):59 65, 97 Dec. [] S. Kim, J. Lee, H. Wang, and D. Hong. Sensing performance of energy deecor wih correlaed muliple anennas. Signal Processing Leers, IEEE, 8(8):67 674, Aug. 9. [3] H. Li and Z. Han. Dogfigh in specrum: Combaing primary user emulaion aacks in cogniive radio sysems, par i: Known channel saisics. IEEE Transacions on Wireless Communicaions, 9(): , Nov. [4] N. Nguyen, R. Zheng, and Z. Han. On idenifying primary user emulaion aacks in cogniive radio sysems using nonparameric bayesian classificaion. IEEE Transacions on Signal Processing, 6(3):43 445, March. [5] A. Saha and B. Mazumder. A digial phase-locked loop for generaing frequency discriminaing codes and frequency muliplicaion. Proceedings of he IEEE, 69(4):47 473, 98 April. [6] A. Sahai, N. Hoven, and R. Tandra. Some fundamenal limis in cogniive radio. In Proc Alleron Conf Commun Conrol Compu, 4. [7] D. Schmidl, T.M.; Cox. Robus frequency and iming synchronizaion for ofdm. IEEE Transacions on Communicaions, 45():63 6, Dec [8] D. Shan, K. Zeng, P. Richardson, and W. Xiang. Deecing muli-channel wireless microphone user emulaion aacks in whie space wih noise. In The 8h Inernaional Conference on Cogniive Radio Oriened Wireless Neworks (CROWNCOM 3), 3. [9] B.-S. Song and I. S. Lee. A digial fm demodulaor for fm, v, and wireless. Circuis and Sysems II: Analog and Digial Signal Processing, IEEE Transacions on, 4():8 85, 995 Dec. [] S. Xu, S. Xu, and H. Wang. Svd based sensing of a wireless microphone signal in cogniive radio neworks. In In. Conf. on Compuaional Science (ICCS), 8. [] K.-W. Yip, Y.-C. Wu, and T.-S. Ng. Design of muliplierless correlaors for iming synchronizaion in ieee 8.a wireless lans. IEEE Transacions on Consumer Elecronics, 49():7 4, 3 Feb. [] Z. Yuan, D. Niyao, H. Li, J. B. Song, and Z. Han. Defeaing primary user emulaion aacks using belief propagaion in cogniive radio neworks. IEEE Journal on Seleced Areas in Communicaions, 3():85 86, Nov.. [3] L. Zadeh and J. Ragazzini. Opimum filers for he deecion of signals in noise. 4():3 3, Oc. 95. Proceedings of he IRE, for Innovaion 3 Endorsed Transacions on -7 4 Volume Issue e4