Spectrum Sensing Brief Overview of the Research at WINLAB

P. Spasojevic

IAB, December 2008

What to Sense? Occupancy.

•

Measuring spectral, temporal, and spatial occupancy–

observation bandwidth and

–

observation time

intervals–

frequency and time sampling granularity

–

spatial coverage and resolution

•

What proportion of time/bandwidth was occupied?•

Which time/frequency slots were occupied?

•

Where?

Spectrum Sensing: More Detail?

•

how many transmitters are there?•

the spectral/temporal occupancy for each transmitter•

transmit power•

signal power spectral density•

modulation type•

transmitter-to-sensor channel transfer functions•

transmitter location•

occupancy time-variation

Why Sense?

•

Licensed spectrum: –

Detect

the presence of the primary user.

•

Unlicensed spectrum: –

Coordinate

an efficient use of spectrum between competing diverse networks.

•

Monitor spectrum:–

determine

selfish/malfunctioning transmitters.

•

Cognitive radio: –

Adapt signal modulation parameters/protocol

Spectrum Sensing: Design

Considerations

•

Propagation characteristics:–

Channel temporal variation: coherence time–

Frequency variation: coherence bandwidth–

Spatial variation

•

Level

of transmitter signal description known in advance: –

signal known or partially known (802.22, 802.11b)–

signal unknown (cordless phones, future transmitters)

•

Level

of cognition detail needed

•

Collaborative

vs

non-collaborative approaches•

Processing/protocol complexity requirements

Sensing Research at WINLAB: In Brief

•

channel characterization–

H. Kremo

•

unlicensed bands: experimental and theoretical–

G. Ivkovic, R. Miller, C. Raman, D. Borota•

licensed spectrum: detecting

the presence of the primary users–

Jing Lei

•

sensing

in vehicular channels–

H. Kremo, KC. Huang, D. Borota

•

coordination and scheduling for efficient use of spectrum–

C. Raman, KC. Huang•

sensing for security, monitoring–

L. Xiao, S. Liu

Experimental characterization of the vehicular channel: H. Kremo

Tx

Rx

pylons mark the car route

3.8m

Start/Stop15m

18m

4.4m

•

Vector Network Analyzer sweeps–

20 MHz wide channel 50 times per second–

centered at 2.462 GHz and 5.2 GHzTx

VNA

console

low lossRF cable

A

Rx

[1] H. Kremo, I. Seskar, and P. Spasojevic, “Concurrent Measurements of the Vehicular Channel Transfer Function and the 802.11 Received Signal Strength Index”

in CCNC/IVCS ‘09

Transfer function magnitude and power loss

Start/Stop

0 5 10 15 20 25 30-70

-65

-60

-55

-50

-45

time (s)

dB

Time invariant channel when the car is not

present

Time varying channel gain

Time varying channelcaused by the moving vehicle: magnitude changes by ~10dBwhen the car is close to the antennas

Spectrum Sensing in unlicensed band

•

Experimental study demonstrating the limitations of RSSI based sensing [RamanSeskarMandayam]

•

Service discovery and device identification in CR networks [MillerXuKamatTrappe]–

PHY layer approaches to distinguish WiFi

& Bluetooth networks with limited bandwidth snapshots

(( ))

(( ))(( ))

(( )) (( ))

Sensor 2

Sensor 1

Sensor 3

Sensor 4 Sensor 5

(x1

, y1

)(x2

, y2

)

(x3

, y3

)

time

f

f

freq

f1 f2

f

Bluetooth

WiFi-1WiFi-2

Radio Scene Analysis in Unlicensed Bands: Goran

Ivkovic

•

A network of sensors observes multiple packet based radio transmitters:

Packet based radio transmitters characterized by their power spectra and on/off activity sequences in time

sensors

Sink node

•Each sensor computesspectrogram with some time and frequency resolution

•

From

the collected spectrograms, we recover:

•

sources

to sensors channel gains(localization in space)•

PSD for each source(localization in frequency)•

on/off activity sequence for each source(localization in time)

4 sensors/ 2 802.11b transmitters

Average power vs. time at sensorsnon-overlapping transmissions in time (typical WLAN traffic ):

sTMHzBW

μ1020

==

Four sensors, two 802.11b nodes:Recovered(full line) and true PSDs:

DBPSKsignal with Barker sequence spreading

Recovered on/off sequences:

Packets

ACKs

Cooperative sensing in Cognitive Radio: Jing Lei

•

Cooperative sensing in a CR network based on message passing •

Tanner graph approach to identify white spaces in the CR network

Adaptive MAC: KC HuangSparse Network

Dense Network

Join with CSMA-like MAC protocol

Join with TDMA-like MAC protocol

Adaptive MAC(CSMA/TDMA)

•

Switch between CSMA and TDMA

•

Based on Spectrum Awareness, choose lowest traffic CSMA channel

as normal mode operation•

Switch to reserved TDMA channel if traffic QoS

not satisfied

CH10_TDMA

Control link

Data path

Sender

Receiver

CH1_CSMA

CH2_CSMACH4_CSMA

CH3_CSMA

CH5_CSMA

CH1_CSMA

Delay > 20%

A

B

Anomalous Spectrum Usage Detection: Song Liu

•

submitted to Infocom

2009

•

Challenge: Conventional signal processing techniques are insufficient•

Heterogeneous communication modes –

hard to enumerate•

Primary User Emulation (PUE) attack•

Unknown attacking signal’s pattern

•

Goal: Effective detection mechanism relying on non-programmable features, e.g., propagation law

•

Approach•

Spectrum sensing –

RSS based detection at spatially distributed sensors, each at a

known distance from the authorized transmitter.

•

Significance testing –

detect unknown anomalous usages

Capturing the Characteristics of the Received Power

•

Propagation Law–

The received power is roughly linear with the logarithmic distance between the transmitter and receiver

•

Normal Usage Condition–

A channel is dedicated to a single authorized user

•

Features of the Proposed Detection Methods–

Distinguishing between single and multiple transmissions in the same channel–

Utilizing a decision statistic that captures the above characteristics of the received power

Fingerprints in the Ether*: Liang Xiao

•

Fingerprints in the Ether: Spectrum sensing in security domain–

Exploits multipath to distinguish users–

Detection of identity-based attacks, e.g., spoofing and Sybil attacks–

Challenges•

Channel time variation: terminal mobility & environmental changes•

Channel estimation error

•

Proposed a channel-based authentication scheme–

Perform the Generalized Likelihood Ratio Test derived from a generalized frequency-selective Rayleigh channel model, or a more practical version

–

Use the existing channel estimation mechanism: Low system overhead

* By Liang Xiao, Larry Greenstein, Narayan Mandayam and Wade Trappe, supported in part by NSF grant CNS-0626439

0 5 10 15 20 25 30-72

-70

-68

-66

-64

-62

-60

-58

-56

time (s)

dB

Experiments with moving vehicle –

H. KremoStart/Stop

Time invariant channel when the car is not

present: fixed multipath

Time varying channelcaused by the moving vehicle: magnitude changes by ~10dBwhen the car is close to the antennas

Time varying channel gain:VNA vs. RSSI

Detecting a preamble of a 802.11b frame-

D. Borota

-

802.11b PHY Frame

SYNC(128 (or 56))

SFD(16)

LENGTH(16)

SIGNAL(8)

CRC(16)

SERVICE(8)

PLCP Preamble(144 (or 72))

PLCP Header(48)

PSDU(2304 max)

Lock/Acquire FrameFrame Details(data rate, size)

Scrambled 1’s

Preamble at 1Mbps (DBPSK)

Data Rate Locked clock, mod. select“Start of Frame”Scrambled x’FRA0’

2Mbps (DQPSK)5.5 and 11 Mbps(CCK)

Fingerprints in the Ether (cont.)•

Performance for indoor environments verified via:–

Numerical simulation based on a generic stochastic channel model

–

A ray-tracing channel emulation software tool (WiSE)–

Field test using network analyzer•

Works well, requiring reasonable values of the measurement bandwidth (e.g., W > 10 MHz), number of response samples (e.g., M ≤

10) and transmit power (e.g., PT ~ 100 mW)

–

Both the false alarm rate and miss rate in spoofing detection are below 4% (sample size M=8, SINR of the channel estimation ρ=20 dB, the normalized power of the channel variation due to environmental changes is 0.1, and the terminal displacement normalized by carrier wavelength is no more than 0.12)

•

Open issues: –

Target values for miss rate and false alarm rate–

Combining with existing higher-layer security protocols

Spectral Density-Based Sensing: Signal Decomposition-

G. Ivkovic

BT packets

WLAN packets

WLAN

BT

Research done prior to the start of the project