Reference signal fraud attack detection method and device and electronic equipment

Abstract

The invention discloses a reference signal fraud attack detection method and apparatus, and an electronic device. The method comprises the steps of solving a null space by using a channel covariance matrix stored by a base station; the channel covariance matrix is a channel covariance matrix of the SRS signal; calculating a plurality of continuous instantaneous channel characteristics of the received signal, and obtaining projections of the plurality of instantaneous channel characteristics in the null space; if the residual noise energy existing in the plurality of projections is greater than a predetermined detection threshold, determining that an SRS attack signal exists in the received signal; the detection threshold value is determined according to a set false alarm probability. By introducing the null space of the channel covariance matrix with the low-rank structure, the separation accuracy of signal subspaces of a user and an attacker can be effectively improved, and attack detection is carried out by paying attention to abrupt energy change after null space projection based on a sequential mode, so that the detection result is more accurate and robust.

Description

Technical Field

[0001] The present invention belongs to the technical field of signal processing, and in particular relates to a reference signal fraud attack detection method, device and electronic equipment. Background Art

[0002] Reference signal fraud attacks on communication protocols seriously threaten user privacy, network security and even national security. Effective reference signal fraud attack detection methods are crucial to maintaining the stable operation and information security of communication systems. Reference signal fraud attack detection methods can timely defend against attacks such as man-in-the-middle and denial of service, protect communication content from eavesdropping, tampering or forgery, ensure the reliability of location data, and maintain the integrity and confidentiality of network data. Therefore, studying effective reference signal fraud attack detection methods has important application value for building a more secure and reliable fifth generation mobile communication (Fifth Generation, 5G) new wireless (New Radio, NR) communication environment, protecting user privacy and national security.

[0003] Currently, reference signal fraud attack detection methods are mainly divided into two categories: methods based on randomness and auxiliary transmission, and methods based on statistical characteristics.

[0004] The methods based on randomness and auxiliary transmission are essentially based on private communication protocols. The relevant technical specifications of the physical layer channels and signals in 5G NR have been standardized by the 3rd Generation Partnership Project (3GPP) committee, which makes them difficult to adopt in practice. In addition, the auxiliary transmission method has high startup costs and training time, which makes it difficult to implement in practice. For example, methods based on dual-channel training and bidirectional training require the base station to make decisions by collecting all observations generated by the introduction of auxiliary transmission.

[0005] Among the methods based on statistical features, the statistical features currently used are not robust in distinguishing fraudulent attacks from other causes such as fluctuations caused by legitimate communications themselves, and such methods rely on the attacker's prior information to select the decision threshold to distinguish between attacks and normal states. However, many potential malicious attackers will deliberately disguise their information to deceive and confuse, so it is difficult to accurately identify and obtain such statistical data. In addition, for the abnormal traffic detection method based on upper-layer statistical features, the percentage of transmission conflicts is tracked at the upper layer and attacks are detected when the percentage exceeds a certain threshold. However, this method will cause intolerable detection delays.

[0006] Therefore, how to provide a reference signal fraud attack detection method that is more accurate, more robust, and easier to implement in engineering becomes an important issue. Summary of the invention

[0007] In order to solve the above problems existing in the prior art, the present invention provides a reference signal fraud attack detection method, device and electronic equipment.

[0008] The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0009] In a first aspect, the present invention provides a reference signal fraud attack detection method, the reference signal fraud attack detection method comprising:

[0010] The null space is obtained by using a channel covariance matrix stored in the base station; the channel covariance matrix is ​​a channel covariance matrix of an SRS signal;

[0011] Calculating a plurality of continuous instantaneous channel features of a received signal, and obtaining projections of the plurality of instantaneous channel features in the null space;

[0012] If the residual noise energy existing in the multiple projections is greater than a predetermined detection threshold, it is determined that an SRS attack signal exists in the received signal; the detection threshold is determined according to a set false alarm probability.

[0013] Optionally, the detection threshold is predetermined in a manner including:

[0014] Acquire SRS residual noise energy of the SRS signal in the null space;

[0015] A test statistic is obtained by using the central limit theorem and a plurality of sample signals; the sample signals include an SRS sample signal and an SRS attack sample signal;

[0016] Determining a normal distribution of the SRS signal according to the SRS residual noise energy and the test statistic;

[0017] The detection threshold is determined according to the definition of the right-tail Q function of the normal distribution and the false alarm probability.

[0018] Optionally, determining the detection threshold according to the definition of the right-tail Q function of the normal distribution and the false alarm probability includes:

[0019]

[0020] Wherein, η represents the detection threshold; Q represents the right tail Q function of the normal distribution; P fa represents the false alarm probability; σ 2 represents the Gaussian white noise variance of the base station; τ p represents the length of the sample signal; represents the SRS transmission power of the kth user; L represents the number of sample signals; and M represents the number of antennas of the base station.

[0021] Optionally, the test statistic is:

[0022]

[0023] Wherein, l=1, 2, ..., L, L represents the number of sample signals; y np represents the projection of the instantaneous channel characteristics into the null space.

[0024] Optionally, obtaining projections of the multiple instantaneous channel features in the null space includes:

[0025]

[0026] in, An assumption indicating that there is no SRS attack in the received signal; represents the assumption that there is an SRS attack in the received signal; np represents the projection of the instantaneous channel characteristics in the null space; VV H represents instantaneous channel characteristics; N represents the number of attackers transmitting SRS attack signals; θ n,k represents the power allocation coefficient of the nth attacker attacking the kth user; represents the attack power of the nth attacker; represents the SRS transmission power of the kth user; h A,n represents the channel model between the base station and the nth attacker; w B,k represents the equivalent noise vector; np-detector represents the detector after the null space projection.

[0027] In a second aspect, the present invention provides a reference signal fraud attack detection device, the reference signal fraud attack detection device comprising:

[0028] A null space obtaining module, used to obtain the null space using the channel covariance matrix stored in the base station; the channel covariance matrix is ​​the channel covariance matrix of the SRS signal;

[0029] A projection acquisition module, used to calculate a plurality of continuous instantaneous channel characteristics of a received signal, and obtain projections of the plurality of instantaneous channel characteristics in the null space;

[0030] The SRS attack judgment module is used to determine that an SRS attack signal exists in the received signal if the residual noise energy existing in multiple projections is greater than a predetermined detection threshold; the detection threshold is determined according to a set false alarm probability.

[0031] Optionally, the detection threshold is predetermined in a manner including:

[0032] Acquire SRS residual noise energy of the SRS signal in the null space;

[0033] A test statistic is obtained by using the central limit theorem and a plurality of sample signals; the sample signals include an SRS sample signal and an SRS attack sample signal;

[0034] Determining a normal distribution of the SRS signal according to the SRS residual noise energy and the test statistic;

[0035] The detection threshold is determined according to the definition of the right-tail Q function of the normal distribution and the false alarm probability.

[0036] Optionally, determining the detection threshold according to the definition of the right-tail Q function of the normal distribution and the false alarm probability includes:

[0037]

[0038] Wherein, η represents the detection threshold; Q represents the right tail Q function of the normal distribution; P fa represents the false alarm probability; σ 2 represents the Gaussian white noise variance of the base station; τ p represents the length of the sample signal; represents the SRS transmission power of the kth user; L represents the number of sample signals; and M represents the number of antennas of the base station.

[0039] Optionally, the test statistic is:

[0040]

[0041] Wherein, l=1, 2, ..., L, L represents the number of sample signals; y np represents the projection of the instantaneous channel characteristics into the null space.

[0042] Optionally, a projection acquisition module is used to acquire projections of multiple instantaneous channel features in the null space, including:

[0043]

[0044] in, An assumption indicating that there is no SRS attack in the received signal; represents the assumption that there is an SRS attack in the received signal; np represents the projection of the instantaneous channel characteristics in the null space; VV H represents instantaneous channel characteristics; N represents the number of attackers transmitting SRS attack signals; θ n,k represents the power allocation coefficient of the nth attacker attacking the kth user; represents the attack power of the nth attacker; represents the SRS transmission power of the kth user; h A,n represents the channel model between the base station and the nth attacker; w B,k represents the equivalent noise vector; np-detector represents the detector after the null space projection.

[0045] In a third aspect, the present invention provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0046] Memory, used to store computer programs;

[0047] The processor is used to implement the method steps described in any of the above-mentioned reference signal fraud attack detection methods when executing the program stored in the memory.

[0048] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any of the above-mentioned reference signal fraud attack detection methods are implemented.

[0049] The present invention provides a reference signal fraud attack detection method, which can effectively improve the separation accuracy of the signal subspaces of legitimate users and fraud attackers by introducing the null space of the channel covariance matrix with a low-rank structure, thereby obtaining multiple continuous instantaneous channel characteristics of the received signal and obtaining the projections of multiple instantaneous channel characteristics in the null space. In the present invention, attack detection is performed based on a sequential manner focusing on the energy mutation after the null space projection. By calculating multiple continuous instantaneous channel characteristics of the received signal and obtaining the projections of multiple instantaneous channel characteristics in the null space, when the residual noise energy existing in the multiple projections is greater than a predetermined detection threshold, it is determined that there is an SRS attack signal in the received signal, so that the detection result is more accurate and robust.

[0050] Compared with the existing fraud attack detection methods, the reference signal fraud attack detection method provided by the present invention does not require modification of the communication protocol and does not require high startup costs and training time, and is easier to implement in engineering.

[0051] The present invention will be further described in detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1It is a flow chart of a reference signal fraud attack detection method provided by an embodiment of the present invention;

[0053] Figure 2 It is a schematic diagram of a communication scenario in which an SRS fraud attack exists, provided by an embodiment of the present invention;

[0054] Figure 3 It is a schematic diagram comparing the changes of residual noise energy under different spatial feature overlaps;

[0055] Figure 4 It is a schematic diagram of visualization results of detection performance of the reference signal fraud attack detection method provided by an embodiment of the present invention;

[0056] Figure 5 It is a structural schematic diagram of a reference signal fraud attack detection device provided by an embodiment of the present invention;

[0057] Figure 6 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0059] In order to solve the problems of high implementation cost and poor robustness of the existing SRS signal fraud attack detection method, the embodiment of the present invention provides a reference signal fraud attack detection method, see Figure 1 , Figure 1 1 is a flow chart of a reference signal fraud attack detection method provided by an embodiment of the present invention, which specifically includes the following steps:

[0060] Step S101, using the channel covariance matrix stored in the base station to obtain the null space; the channel covariance matrix is ​​the channel covariance matrix of the SRS signal.

[0061] In an embodiment of the present invention, under normal circumstances, an SRS (Sounding Reference Signal) fraud attack does not exist at the beginning. For example, when an attacker exists at the beginning and then stops, the base station uses the stored channel covariance matrix to perform null space projection. Once the energy of the projection drops suddenly, it also indicates that an SRS fraud attack has occurred before. In order to ensure the efficiency of the attack, the attacker often attacks after the legal transmission begins. Therefore, when the collaborative SRS fraud does not exist at the beginning, the channel covariance matrix of the SRS signal in the non-attack state stored by the base station can be used to obtain the null space of the projection. Among them, the channel covariance matrix can be used to describe the statistical characteristics of the channel.

[0062] In the embodiment of the present invention, the channel covariance matrix C of the SRS signal in the non-SRS attack state stored at the base station is decomposed to obtain orthogonal matrices U and V:

[0063]

[0064] Wherein, the superscript H represents the conjugate transpose; λ r represents the rth channel feature in the channel covariance matrix; r represents the rank of the channel covariance matrix; diag(·) represents the diagonal matrix formed by the main eigenvalues ​​of the channel covariance matrix.

[0065] When the rank of the channel covariance matrix is ​​determined, the null space of the channel covariance matrix of the SRS signal can be obtained.

[0066] Step S102, calculating a plurality of continuous instantaneous channel features of the received signal, and obtaining projections of the plurality of instantaneous channel features in the null space.

[0067] In the embodiment of the present invention, the received signal includes an SRS signal and / or an SRS attack signal, wherein the SRS signal refers to a legitimate signal sent by a user, and the SRS attack signal refers to a fraudulent signal sent by an attacker.

[0068] See also Figure 2 , Figure 2 It is a schematic diagram of a communication scenario in which an SRS fraud attack exists provided by an embodiment of the present invention. In the embodiment of the present invention, a single-cell multi-user communication scenario in time division duplex mode is adopted, and the scenario includes a base station configured with M antennas and K legitimate users configured with a single antenna.

[0069] Explain the SRS signal. The base station completes channel estimation through the SRS signal transmitted by the user. The SRS signal of the kth user is satisfy Among them, τ p represents the length of the SRS signal, the superscript T represents the transpose operation of the matrix, and the superscript * represents the conjugate operation of the matrix.

[0070] To explain the SRS attack signal, N single-antenna attackers cooperate to send multi-user SRS signals to interfere with the uplink channel estimation training. Since the SRS signal transmission protocol is public, each attacker can synchronize with the base station and obtain system information to send the same SRS signal to confuse the base station.

[0071] In the embodiment of the present invention, represents the channel model between the base station and the kth user, represents the channel model between the base station and the nth attacker. Specifically, it can be generated by a channel model based on a clustered delay line (CDL-D) that complies with the 3GPP standard.

[0072] In SRS fraud, each attacker targets all users in the system, so the attack signal is constructed as a linear combination of the SRS signals of all users. Taking the nth attacker as an example, the SRS attack signal It can be expressed as:

[0073]

[0074] Among them, θ n,k represents the power allocation coefficient of the nth attacker attacking the kth user; represents the attack power of the nth attacker; p k represents the SRS signal of the kth user; n=1,2,…,N, N represents the total number of attackers; k=1,2,…,K, K represents the total number of users.

[0075] In the uplink channel training phase, the base station will receive SRS signal combinations from the user and the attacker. The SRS signal combination Y B It can be expressed as:

[0076]

[0077] in, represents the SRS transmission power of the kth user; U represents the base station receives the distribution Noise; σ 2 represents the Gaussian white noise variance of the base station.

[0078] In order to obtain the channel estimation result of the kth user, the base station can complete the following preprocessing process based on the existing prior information:

[0079]

[0080] Among them, y B,k represents the SRS signal of the kth user; z B,k Indicates that the kth user follows the distribution The equivalent noise vector of M represents a matrix of all 1s.

[0081] Taking the channel quality estimation of the kth user as an example, at the base station, according to y B,k Construct the following binary hypothesis test question of whether or not SRS is fraudulent:

[0082]

[0083] in, It indicates the assumption that there is no SRS fraud attack; Indicates the assumption that there is an SRS spoofing attack. Is subject to distribution The equivalent noise vector of

[0084] For the actually deployed large-scale antenna system, the corresponding channel covariance matrix will expand to a limited space, that is, the channel covariance matrix will exhibit a low-rank property, so the signal subspaces sent by legitimate users and fraudulent attackers can be separated in the angle domain.

[0085] Through the above binary hypothesis test problem, it can be seen that after the null space projection, the projection of the instantaneous channel characteristics of the SRS attack signal to the null space will have more residual noise energy than the projection of the instantaneous channel characteristics of the SRS signal to the null space, that is, the residual noise energy after the null space projection of the instantaneous channel characteristics of the SRS attack signal is filtered out is higher than the residual noise energy after the null space projection of the instantaneous channel characteristics of the SRS signal is filtered out.

[0086] In the embodiment of the present invention, obtaining projections of multiple instantaneous channel features in the null space includes:

[0087]

[0088] in, It indicates the assumption that there is no SRS attack in the received signal; represents the assumption that there is an SRS attack in the received signal; np represents the projection of instantaneous channel characteristics in the null space; VV H represents instantaneous channel characteristics; N represents the number of attackers transmitting SRS attack signals; θ n,k represents the power allocation coefficient of the nth attacker attacking the kth user; represents the attack power of the nth attacker; represents the SRS transmission power of the kth user; h A,n represents the channel model between the base station and the nth attacker; w B,k represents the equivalent noise vector; np-detector represents the detector after null space projection.

[0089] Step S103: if the residual noise energy in the plurality of projections is greater than a predetermined detection threshold, it is determined that an SRS attack signal exists in the received signal; the detection threshold is determined according to a set false alarm probability.

[0090] In the embodiment of the present invention, the false alarm probability refers to the false alarm probability that the system can accept. The specific false alarm probability can be set by the technician according to the demand, and is not limited here. The predetermined detection threshold can be determined according to the set false alarm probability.

[0091] In the embodiment of the present invention, the detection threshold is obtained based on the signal in the non-attack state, that is, the SRS signal. Therefore, by judging the residual noise energy of the projection, when the residual noise energy existing in multiple projections is greater than the predetermined detection threshold, it can be determined that there is an SRS attack signal in the received signal. On the contrary, when the residual noise energy existing in multiple projections is not greater than the predetermined detection threshold, it is determined that there is no SRS attack signal in the received signal, that is, there is no SRS fraud attack.

[0092] In an embodiment of the present invention, by introducing the null space of the channel covariance matrix with a low-rank structure, the separation accuracy of the signal subspaces of legitimate users and fraudulent attackers can be effectively improved, thereby obtaining multiple continuous instantaneous channel features of the received signal and obtaining the projections of multiple instantaneous channel features in the null space. In an embodiment of the present invention, attack detection is performed based on a sequential approach focusing on the energy mutation after the null space projection. By calculating multiple continuous instantaneous channel features of the received signal and obtaining the projections of multiple instantaneous channel features in the null space, when the residual noise energy in the multiple projections is greater than a predetermined detection threshold, it is determined that there is an SRS attack signal in the received signal, so that the detection result is more accurate and robust.

[0093] Compared with the existing fraud attack detection method, the reference signal fraud attack detection method provided by the embodiment of the present invention does not require modification of the communication protocol and does not require high startup costs and training time, and is easier to implement in engineering.

[0094] In one implementation, the detection threshold is predetermined by:

[0095] Obtaining the SRS residual noise energy of the SRS signal in the null space;

[0096] The test statistic is obtained by using the central limit theorem and multiple sample signals; the sample signals include SRS sample signals and SRS attack sample signals;

[0097] Determine the normal distribution of the SRS signal based on the SRS residual noise energy and the test statistic;

[0098] The detection threshold is determined based on the right-tail Q function of the normal distribution and the definition of the false alarm probability.

[0099] In the embodiment of the present invention, the SRS residual noise energy of the SRS signal in the null space is expressed by VV H w B,k express.

[0100] In the embodiment of the present invention, VV represents the residual noise energy of the SRS signal after projection in the null space H w B,k The variance of Set up the test questions.

[0101] When the variance of the decision sample signal composed of the collected L sample signals is Not Available The confidence interval is within the range of , that is, the probability is high and the SRS signal The characteristics of the sample signal do not match, so it can be considered that there is an SRS attack sample signal in the sample signal. From the test statistics, it can be seen that it is essentially detected by comparing the distribution characteristics of the attack and the absence of the attack.

[0102] In one implementation, when the number of sample signals is large enough, based on the central limit theorem, the test statistic obtained from the variance of the decision sample signal composed of L sample signals can be approximated as a Gaussian random variable. for:

[0103]

[0104] Wherein, l=1, 2, ..., L, and L represents the number of sample signals.

[0105] Based on this, the sample signal without SRS attack can be expressed as the following normal distribution:

[0106]

[0107] The normal distribution of the sample signal without SRS attack is converted into a standard normal distribution by using the general normal distribution conversion method. The general normal distribution conversion method is:

[0108]

[0109] Where X represents a general normally distributed random variable; μ represents the mean; σ represents the standard deviation; and Y represents a standard normally distributed random variable.

[0110] In one implementation, the false alarm probability is defined as:

[0111]

[0112] Among them, P fa represents the false alarm probability; η represents the detection threshold; H 0 represents the assumption that there is no SRS attack signal.

[0113] In the embodiment of the present invention, the relationship between the false alarm probability and the detection threshold can be determined according to the right-tail Q function of the normal distribution:

[0114]

[0115] Among them, Φ(·) represents the distribution function of the standard normal distribution. The relationship between the detection threshold and the false alarm probability can be obtained through the right-tail Q function of the standard normal distribution Q(·) = 1-Φ(·). Furthermore, the detection threshold can be determined by the inverse function of the false alarm probability relationship. Since the more sample signals there are, the smaller the fluctuation, the sample signal without SRS attack is closer to the distribution of the known variance size, so the detection threshold can be obtained as:

[0116]

[0117] When the number of samples is large enough, the detection threshold will be maintained near the residual noise variance after projection. The Q function is x represents the lower limit of integration; +∞ is positive infinity, indicating the upper limit of integration; t represents the integral variable.

[0118] The inverse of the Q function can be found by storing the right-tail Q function table of the standard normal distribution, as shown in Table 1. The detection threshold can be obtained by looking up the table. For example, when the false alarm probability is 0.20, Q -1 (0.20) can be determined to be around 0.84 by looking up the table.

[0119] Table 1

[0120]

[0121]

[0122] In the embodiment of the present invention, according to a given false alarm probability requirement, the detection threshold can be determined by looking up a Q function table, and the detection recognition rate can also be calculated on this basis.

[0123] In the embodiment of the present invention, the residual noise after projection has little influence, and the influence caused by the fluctuation of legitimate users can also be eliminated, thereby effectively controlling the false alarm probability and improving the robustness of detection.

[0124] The following is a description of a simulation experiment of the reference signal fraud attack detection method provided by an embodiment of the present invention:

[0125] 1. Example scene setting.

[0126] The experiment constructs a circular area with a base station at the center and an inner radius of 50m, in which users and attackers are evenly and randomly distributed. The maximum distances between users and attackers are 400m and 300m respectively. The channel bandwidth and noise power are set to 20MHz and -90dBm respectively. In the uplink channel training phase, the SRS transmission power of each user is set to be the same, that is, The interference power of each attacker is the same, that is, Specifically, the number of base station antennas M is set to 64, the number of users K is set to 24, the number of attackers N is set to 4, and the attackers' attack distribution coefficients are uniformly distributed from 0 to 1. The signal-to-noise ratio (SNR) is considered to be 5dB and -5dB respectively, and the jamming-to-signal ratio (JSR) is considered to range from -15dB to 10dB.

[0127] The method provided in the embodiment of the present invention mainly utilizes that the channel covariance matrix will expand to a limited space, and the signal subspace and the interference subspace can be separated in the angle domain. Under the ideal assumption, the angle expansion ranges of the attacker and the legitimate user signals will not overlap, thereby achieving better detection performance.

[0128] In order to conduct a more comprehensive analysis of the detection method proposed in the embodiment of the present invention, it is also considered that there may be an overlap in the angle extension range of the attacker's SRS fraud attack and the legitimate user's non-attack signal. Therefore, the spatial feature overlap index is introduced, such as Figure 3 The simulation results show that Figure 3 It is a schematic diagram comparing the changes in residual noise energy under different spatial feature overlaps, where the horizontal axis represents the channel realization index and the vertical axis represents the residual value of the null space projection. Figure (3) a shows the case where the spatial features do not overlap, Figure (3) b shows the case where the spatial feature overlap is 50%, Figure (3) c shows the case where the spatial feature overlap is 70%, and Figure (3) d shows the case where the spatial feature overlap is 90%. The legitimate user's transmission signal will have a certain angle range when it arrives at the base station antenna through the channel. The spatial feature overlap refers to the overlap of the attacker and the legitimate user's angle range from a statistical perspective. The specific overlap setting can be determined by the position swing and angle expansion scaling of the attacker and the legitimate user in the CDL-D model.

[0129] 2. Experimental details.

[0130] 1) The change of residual energy after projection filtering when there is no attack and when there is an attack is depicted by using null space projection based on channel spatial characteristics, and the process of determining the detection threshold of the proposed scheme of the present invention is demonstrated;

[0131] 2) The changes in the detection probability of the proposed scheme and the energy signature-based scheme under different SRS transmission signal-to-noise ratios as the attacker's power increases.

[0132] Figure 3 The figure depicts the change of residual noise energy after null space projection filtering when the angle extension ranges of the attacker and legitimate user signals overlap at different degrees. The simulation results show that when the angle extension ranges of the attacker and legitimate user signals do not overlap, the size boundary of the residual energy when there is an attack or not is very obvious. When the angle extension ranges of the attacker and legitimate user signals overlap even half, an effective detection threshold can be obtained. When the overlap of the angle extension ranges of the attacker and legitimate user signals is high, for example, reaching 70% and 90%, although the size boundary of the residual energy is somewhat concentrated, detection and identification can be achieved within a certain false alarm range. In addition, in practice, because the transmission environment is more complex and changeable, transmitters at different locations have significantly different spatial characteristics and will not have a high degree of spatial characteristic overlap. Therefore, the detection method proposed in the embodiment of the present invention still has good application potential.

[0133] Figure 4 : is a schematic diagram of the detection performance visualization result of the reference signal fraud attack detection method provided by an embodiment of the present invention, wherein the abscissa represents JSR (Jamming to Signal Ration, interference signal ratio): P A / P U , the unit is dB, the ordinate represents the detection probability, Figure 4 (a) represents the detection probability under different JSRs, where SNR (Signal-to-Noise Ratio): P U / σ 2 =5dB, Figure 4 (b) represents the detection probability under different JSRs, where SNR: P U / σ 2 =-5dB. Figure 4The change of detection probability of the proposed method and the scheme based on energy characteristics under different SRS transmission signal-to-noise ratios as the attacker's power increases is depicted. The simulation results show that the detection probability of both schemes shows an upward trend as the attacker's power increases. When the angle extension ranges of the attacker and the legitimate user signals do not overlap, the overall detection performance of the detection method proposed in the embodiment of the present invention is significantly better than the scheme based on energy characteristics. This is because the proposed method only detects whether there is a residual SRS fraud attack, and has nothing to do with the size of the energy fluctuation, so it is more robust than the baseline energy detection method. In addition, when the angle extension ranges of the attacker and the legitimate user signals overlap even half, the proposed method can achieve good detection performance, especially when the attacker's power is high, it can also approach the optimal detection performance when it is not completely overlapped. It should also be noted that when the overlap of the angle extension ranges of the attacker and the legitimate user signals is high, for example, 70% and 90%, the method provided by the embodiment of the present invention can also quickly improve the detection performance when the attack power is high, and in practice it is difficult for the attacker to overlap the extension range of the legitimate user signal by more than 50%, because the transmission environment is more complex and changeable, and transmitters at different locations have significantly different spatial characteristics.

[0134] The reference signal fraud attack detection method based on the channel spatial low-rank structure zero space projection proposed in the embodiment of the present invention is more robust in detection performance and false alarm performance, and does not require protocol modification, and is easier to implement. Taking the SRS fraud attack as an example, when there is an attack, the proposed zero space projection detection essentially relies on spatial statistical characteristics, and utilizes the channel covariance matrix to expand to a limited space, and the signal subspace and the interference subspace can be separated in the angle domain. Detection is performed only by whether there is a residual SRS fraud attack, and has nothing to do with the size of the energy fluctuation; when there is no SRS fraud attack, the proposed detection algorithm is more robust to the influence of the legitimate user itself and the noise. Because the residual noise influence is very small through the zero space projection method, the noise influence that exists whether there is an attack or not can be eliminated. In addition, the parts of the legitimate users are eliminated after the zero space projection, and the influence caused by the fluctuation of the legitimate users can also be eliminated.

[0135] Based on the same inventive concept, the embodiment of the present invention further provides a reference signal fraud attack detection device, see Figure 5 , Figure 5 : is a schematic diagram of the structure of a reference signal fraud attack detection device provided by an embodiment of the present invention, the reference signal fraud attack detection device comprising:

[0136] The null space obtaining module 501 is used to obtain the null space using the channel covariance matrix stored in the base station; the channel covariance matrix is ​​the channel covariance matrix of the SRS signal;

[0137] The projection acquisition module 502 is used to calculate a plurality of continuous instantaneous channel characteristics of the received signal and obtain projections of the plurality of instantaneous channel characteristics in the null space;

[0138] The SRS attack judgment module 503 is used to determine that there is an SRS attack signal in the received signal if the residual noise energy in the multiple projections is greater than a predetermined detection threshold; the detection threshold is determined according to a set false alarm probability.

[0139] In an embodiment of the present invention, by introducing the null space of the channel covariance matrix with a low-rank structure, the separation accuracy of the signal subspaces of legitimate users and fraudulent attackers can be effectively improved, thereby obtaining multiple continuous instantaneous channel features of the received signal and obtaining the projections of multiple instantaneous channel features in the null space. In an embodiment of the present invention, attack detection is performed based on a sequential approach focusing on the energy mutation after the null space projection. By calculating multiple continuous instantaneous channel features of the received signal and obtaining the projections of multiple instantaneous channel features in the null space, when the residual noise energy in the multiple projections is greater than a predetermined detection threshold, it is determined that there is an SRS attack signal in the received signal, so that the detection result is more accurate and robust.

[0140] Compared with the existing fraud attack detection method, the reference signal fraud attack detection method provided by the embodiment of the present invention does not require modification of the communication protocol and does not require high startup costs and training time, and is easier to implement in engineering.

[0141] Optionally, the detection threshold is predetermined in a manner including:

[0142] Acquire SRS residual noise energy of the SRS signal in the null space;

[0143] A test statistic is obtained by using the central limit theorem and a plurality of sample signals; the sample signals include an SRS sample signal and an SRS attack sample signal;

[0144] Determining a normal distribution of the SRS signal according to the SRS residual noise energy and the test statistic;

[0145] The detection threshold is determined according to the definition of the right-tail Q function of the normal distribution and the false alarm probability.

[0146] Optionally, determining the detection threshold according to the definition of the right-tail Q function of the normal distribution and the false alarm probability includes:

[0147]

[0148] Wherein, η represents the detection threshold; Q represents the right tail Q function of the normal distribution; P fa represents the false alarm probability; σ 2represents the Gaussian white noise variance of the base station; τ p represents the length of the sample signal; represents the SRS transmission power of the kth user; L represents the number of sample signals; and M represents the number of antennas of the base station.

[0149] Optionally, the test statistic is:

[0150]

[0151] Wherein, l=1, 2, ..., L, L represents the number of sample signals; y np represents the projection of the instantaneous channel characteristics into the null space.

[0152] Optionally, a projection acquisition module is used to acquire projections of multiple instantaneous channel features in the null space, including:

[0153]

[0154] in, An assumption indicating that there is no SRS attack in the received signal; represents the assumption that there is an SRS attack in the received signal; np represents the projection of the instantaneous channel characteristics in the null space; VV H represents instantaneous channel characteristics; N represents the number of attackers transmitting SRS attack signals; θ n,k represents the power allocation coefficient of the nth attacker attacking the kth user; represents the attack power of the nth attacker; represents the SRS transmission power of the kth user; h A,n represents the channel model between the base station and the nth attacker; w B,k represents the equivalent noise vector; np-detector represents the detector after the null space projection.

[0155] The embodiment of the present invention further provides an electronic device, such as Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0156] Memory 603, used for storing computer programs;

[0157] The processor 601 is configured to implement the method steps described in any of the above-mentioned reference signal fraud attack detection methods when executing the program stored in the memory 603.

[0158] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not represent that there is only one bus or one type of bus.

[0159] The communication interface is used for communication between the above electronic device and other devices.

[0160] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0161] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0162] The present invention also provides a computer-readable storage medium in which a computer program is stored, and when the computer program is executed by a processor, the method steps described in any of the above-mentioned reference signal fraud attack detection methods are implemented.

[0163] Optionally, the computer-readable storage medium may be a non-volatile memory (NVM), such as at least one disk memory.

[0164] Optionally, the computer-readable memory may also be at least one storage device located away from the aforementioned processor.

[0165] It should be noted that the terms "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention.

[0166] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0167] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other changes to the disclosed embodiments by viewing the drawings and the disclosed content. In the description of the present invention, the term "comprising" does not exclude other components or steps, "one" or "an" does not exclude multiple situations, and "multiple" means two or more, unless otherwise clearly and specifically limited. In addition, certain measures are recorded in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0168] The method provided in the embodiment of the present invention can be applied to electronic devices. Specifically, the electronic device can be: a desktop computer, a portable computer, an intelligent mobile terminal, a server, etc. This is not limited here, and any electronic device that can implement the present invention belongs to the protection scope of the present invention.

[0169] As for the device / electronic device / storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0170] It should be noted that the device, electronic device and storage medium of the embodiments of the present invention are respectively the device, electronic device and storage medium applying the above-mentioned reference signal fraud attack detection method. All embodiments of the above-mentioned reference signal fraud attack detection method are applicable to the device, electronic device and storage medium, and can achieve the same or similar beneficial effects.

[0171] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A reference signal fraud attack detection method, characterized in that: The reference signal fraud attack detection method comprises: The null space is obtained by using a channel covariance matrix stored in the base station; the channel covariance matrix is ​​a channel covariance matrix of an SRS signal; Calculating a plurality of continuous instantaneous channel features of a received signal, and obtaining projections of the plurality of instantaneous channel features in the null space; If the residual noise energy existing in the multiple projections is greater than a predetermined detection threshold, it is determined that an SRS attack signal exists in the received signal; the detection threshold is determined according to a set false alarm probability.

2. The reference signal fraud attack detection method according to claim 1, characterized in that: The detection threshold is predetermined in the following manner: Acquire SRS residual noise energy of the SRS signal in the null space; A test statistic is obtained by using the central limit theorem and a plurality of sample signals; the sample signals include an SRS sample signal and an SRS attack sample signal; Determining a normal distribution of the SRS signal according to the SRS residual noise energy and the test statistic; The detection threshold is determined according to the definition of the right-tail Q function of the normal distribution and the false alarm probability.

3. The reference signal fraud attack detection method according to claim 2, characterized in that: Determining the detection threshold according to the definition of the right-tail Q function of the normal distribution and the false alarm probability includes: Wherein, η represents the detection threshold; Q represents the right tail Q function of the normal distribution; P fa represents the false alarm probability; σ 2 represents the Gaussian white noise variance of the base station; τ p represents the length of the sample signal; represents the SRS transmission power of the kth user; L represents the number of sample signals; and M represents the number of antennas of the base station.

4. The reference signal fraud attack detection method according to claim 2, characterized in that: The test statistic is: Wherein, l=1, 2, ..., L, L represents the number of sample signals; y np represents the projection of the instantaneous channel characteristics into the null space.

5. The reference signal fraud attack detection method according to claim 1, characterized in that: Obtaining projections of the multiple instantaneous channel features in the null space includes: in, An assumption indicating that there is no SRS attack in the received signal; represents the assumption that there is an SRS attack in the received signal; np represents the projection of the instantaneous channel characteristics in the null space; VV H Represents instantaneous channel characteristics; n=1,2,...,N, where N represents the number of attackers transmitting SRS attack signals; θ n,k represents the power allocation coefficient of the nth attacker attacking the kth user; represents the attack power of the nth attacker; represents the SRS transmission power of the kth user; h A,n represents the channel model between the base station and the nth attacker; w B,k represents the equivalent noise vector; np-detector represents the detector after the null space projection.

6. A reference signal fraud attack detection device, characterized in that: The reference signal fraud attack detection device comprises: A null space obtaining module, used to obtain the null space using the channel covariance matrix stored in the base station; the channel covariance matrix is ​​the channel covariance matrix of the SRS signal; A projection acquisition module, used to calculate a plurality of continuous instantaneous channel characteristics of a received signal, and obtain projections of the plurality of instantaneous channel characteristics in the null space; The SRS attack judgment module is used to determine that an SRS attack signal exists in the received signal if the residual noise energy existing in multiple projections is greater than a predetermined detection threshold; the detection threshold is determined according to a set false alarm probability.

7. The reference signal fraud attack detection device according to claim 6, characterized in that: The detection threshold is predetermined in the following manner: Acquire SRS residual noise energy of the SRS signal in the null space; A test statistic is obtained by using the central limit theorem and a plurality of sample signals; the sample signals include an SRS sample signal and an SRS attack sample signal; Determining a normal distribution of the SRS signal according to the SRS residual noise energy and the test statistic; The detection threshold is determined according to the definition of the right-tail Q function of the normal distribution and the false alarm probability.

8. The reference signal fraud attack detection device according to claim 7, characterized in that: Determining the detection threshold according to the definition of the right-tail Q function of the normal distribution and the false alarm probability includes: Wherein, η represents the detection threshold; Q represents the right tail Q function of the normal distribution; P fa represents the false alarm probability; σ 2 represents the Gaussian white noise variance of the base station; τ p represents the length of the sample signal; represents the SRS transmission power of the kth user; L represents the number of sample signals; and M represents the number of antennas of the base station.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the reference signal fraud attack detection method described in any one of claims 1-5 when executing the program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the reference signal fraud attack detection method according to any one of claims 1 to 5 is implemented.

Images