In recent years, cognitive radios and cognitive wireless networks have been introduced as a new paradigm for enabling much higher spectrum utilization, providing more reliable and personal radio services, reducing harmful interference, and facilitating the interoperability or convergence of different wireless communication networks. Cognitive radios are goal-oriented, autonomously learn from experience and adapt to changing operating conditions. Cognitive radios have the potential to drive the next generation of radio devices and wireless communication system design and to enable a variety of niche applications in demanding environments, such as spectrum-sharing networks, public safety, natural disasters, civil emergencies, and military operations. This research first introduces an innovative approach to developing cognitive radios based on the Radio Environment Map (REM). The REM can be viewed as an integrated database that provides multi-domain environmental information and prior knowledge for cognitive radios, such as the geographical features, available services and networks, spectral regulations, locations and activities of neighboring radios, policies of the users and/or service providers, and past experience. The REM, serving as a vehicle of network support to cognitive radios, can be exploited by the cognitive engine for most cognitive functionalities, such as situation awareness, reasoning, learning, planning, and decision support. This research examines the role of the REM in cognitive radio development from a network point of view, and focuses on addressing three specific issues about the REM: how to design and populate the REM; how to exploit the REM with the cognitive engine algorithms; and how to evaluate the performance of the cognitive radios. Applications of the REM to wireless local area networks (WLAN) and wireless regional area networks (WRAN) are investigated, especially from the perspectives of interference management and radio resource management, which illustrate the significance of cognitive radios to the evolution of wireless communications and the revolution in spectral regulation. Network architecture for REM-enabled cognitive radios and framework for REM-enabled situation-aware cognitive engine learning algorithms have been proposed and formalized. As an example, the REM, including the data model and basic application programmer interfaces (API) to the cognitive engine, has been developed for cognitive WRAN systems. Furthermore, REM-enabled cognitive cooperative learning (REM-CCL) and REM-enabled case- and knowledge-based learning algorithms (REM-CKL) have been proposed and validated with link-level or network-level simulations and a WRAN base station cognitive engine testbed. Simulation results demonstrate that the WRAN CE can adapt orders of magnitude faster when using the REM-CKL than when using the genetic algorithms and achieve near-optimal global utility by leveraging the REM-CKL and a local search. Simulation results also suggest that exploiting the Global REM information can considerably improve the performance of both primary and secondary users and mitigate the hidden node (or hidden receiver) problem. REM dissemination schemes and the resulting overhead have been investigated and analyzed under various network scenarios. By extending the optimized link state routing protocol, the overhead of REM dissemination in wireless ad hoc networks via multipoint relays can be significantly reduced by orders of magnitude as compared to plain flooding. Performance metrics for various cognitive radio applications are also proposed. REM-based scenario-driven testing (REM-SDT) has been proposed and employed to evaluate the performances of the cognitive engine and cognitive wireless networks. This research shows that REM is a viable, cost-efficient approach to developing cognitive radios and cognitive wireless networks with significant potential in various applications. Future research recommendations are provided in the conclusion. / Ph. D.

As traditional wireless systems that only operate on fixed frequency bands are reaching their capacity limits, advanced frequency-agile radio systems are developed for more efficient spectrum utilization. For example, white space radios dynamically leverage locally unused TV channels to provide high-speed long-distance connectivity. They have already been deployed to connect the unconnected in rural areas and developing countries. However, such application scenarios are still limited due to low commercial demand. Hence, exploring better applications for white space radios needs more effort. With the benefits come the threats. As frequency-agile radio systems (e.g., software-defined radios) are flexible and become extremely low-cost and small-sized, it is very convenient for attackers to build attacking tools and launch wireless attacks using these radios. For example, civilian GPS signals can be easily spoofed by low-cost portable spoofers built with frequency-agile radio systems. In this dissertation, we study both the threat and application of frequency-agile radio systems. Specifically, our work focuses on the spoofing threat of frequency-agile radio towards GPS-based systems and the application of TV white space radio for ocean communications. Firstly, we explore the feasibility of using frequency-agile radio to stealthily manipulate GPS-based road navigation systems without alerting human drivers. A novel attacking algorithm is proposed, where the frequency-agile radio transmits fake GPS signals to lead the victim to drive on a wrong path that looks very similar with the navigation route on the screen. The attack's feasibility is demonstrated with real-world taxi traces in Manhattan and Boston. We implement a low-cost portable GPS spoofer using an off-the-shelf frequency-agile radio platform to perform physical measurements and real-world driving tests, which shows the low level of difficulty of launching the attack in real road environment. In order to study human-in-the-loop factor, a deceptive user study is conducted and the results show that 95% of the users do not recognize the stealthy attack. Possible countermeasures are summarized and sensor fusion defense is explored with preliminary tests. Secondly, we study similar GPS spoofing attack in database-driven cognitive radio networks. In such a network, a secondary user queries the database for available spectrum based on its GPS location. By manipulating GPS locations of surrounding secondary users with a frequency-agile radio, an attacker can potentially cause serious primary user interference and denial-of-service to secondary users. The serious impact of such attacks is examined in simulations based on the WhiteSpaceFinder spectrum database. Inspired by the characteristics of the centralized system and the receiving capability of cognitive radios, a combination of three defense mechanisms are proposed to mitigate the location spoofing threat. Thirdly, we explore the feasibility of building TV white space radio based on frequency-agile radio platform to provide connectivity on the ocean. We design and implement a low-cost low-power white space router ($523, 12 watts) customized for maritime applications. Its communication capability is confirmed by field link measurements and ocean-surface wave propagation simulations. We propose to combine this radio with an energy harvesting buoy so that the radio can operate independently on the ocean and form a wireless mesh network with other similar radios. / PHD / As traditional wireless systems, such as mobile phones and WiFi access points, only operate on some fixed frequency bands, it becomes increasingly crowded for those popular bands. Hence, for more efficient frequency resource utilization, frequency-agile radio systems that can dynamically operate on different frequency bands are developed. With these new technologies come new threats and applications, which are the focus of our work. On the one hand, as frequency-agile radio systems become low-cost and portable, attackers can easily launch wireless attacks with them. For example, we explored the feasibility, impact, and countermeasures for GPS spoofing attacks using frequency-agile radio systems in different scenarios. In a GPS spoofing attack, an attacker transmits false GPS signals to manipulate users’ GPS receivers. This kind of attack can be very dangerous and even life-threatening if it is launched against critical GPS-based applications. For example, once GPS-based navigation systems in self-driving cars are stealthily manipulated by remote attackers, attackers can divert self-driving cars to pre-defined destinations or dangerous situations like wrong-way driving on highway. On the other hand, since there is rich under-utilized spectrum resource in remote areas with no broadband connection yet, frequency-agile radio systems can be used to provide broadband internet connectivity there. For example, based on frequency-agile radio platform, we developed a low-cost low-power wireless router that can dynamically operate on TV broadcasting band. It is able to provide high-speed wireless connection to a large area on the ocean. This technology has the potential to bring low-cost high-speed connection to people and industry on the ocean, which will facilitate various maritime applications.

This dissertation provides theory and analysis on the impact resource management has on software-defined radio platforms by investigating the inherent trade-off between spectrum and processing effciencies with their relation to both the power consumed by the host processor and the complexity of the algorithm which it can support. The analysis demonstrates that considerable resource savings can be gained without compromising the resulting quality of service to the user, concentrating specifically on physical-layer signal processing elements commonly found in software definitions of single- and multi-carrier communications signals. Novel synchronization techniques and estimators for unknown physical layer reference parameters are introduced which complement the energy-quality scalability of software-defined receivers. A new framing structure is proposed for single-carrier systems which enables fast synchronization of short packet bursts, applicable for use in dynamic spectrum access. The frame is embedded with information describing its own structure, permitting the receiver to automatically modify its software configuration, promoting full waveformfl‚exibility for adapting to quickly changing wireless channels. The synchronizer's acquisition time is reduced by exploiting cyclostationary properties in the preamble of transmitted framing structure, and the results are validated over the air in a wireless multi-path laboratory environment. Multi-carrier analysis is concentrated on synchronizing orthogonal frequency-division multiplexing (OFDM) using offset quadrature amplitude modulation (OFDM/OQAM) which is shown to have significant spectral compactness advantages over traditional OFDM. Demodulation of OFDM/OQAM is accomplished using computationally effcient polyphase analysis filterbanks, enabled by a novel approximate square-root Nyquist filter design based on the near-optimum Kaiser-Bessel window. Furthermore, recovery of sample timing and carrier frequency offsets are shown to be possible entirely in the frequency domain, enabling demodulation in the presence of strong interference signals while promoting heterogeneous signal coexistence in dynamic spectrum environments. Resource management is accomplished through the introduction of a self-monitoring framework which permits system-level feedback to the radio at run time. The architecture permits the radio to monitor its own processor usage, demonstrating considerable savings in computation bandwidths on the tested platform. Resource management is assisted by supervised intelligent heuristic-based learning algorithms which use software-level feedback of the radio's active resource consumption to optimize energy and processing effciencies in dynamic spectrum environments. In particular, a case database-enabled cognitive engine is proposed which abstracts from the radio application by using specific knowledge of previous experience rather than relying on general knowledge within a specific problem domain. / Ph. D.

Jamming is an ongoing threat that plagues wireless communications in contested areas. Unfortunately, jamming complexity and sophistication will continue to increase over time. The traditional approach to addressing the jamming threat is to harden radios, such that they sacrifice communications performance for more advanced jamming protection. To provide an escape from this trend, we investigate the previously unexplored area of jammer exploitation. This dissertation develops the concept of antifragile communications, defined as the capability for a communications system to improve in performance due to a system stressor or harsh condition. Antifragility refers to systems that increase in capability, resilience, or robustness as a result of disorder (e.g., chaos, uncertainty, stress). An antifragile system is fundamentally different from one that is resilient (i.e., able to recover from failure) and robust (i.e., able to resist failure). We apply the concept of antifragility to wireless communications through several novel strategies that all involve exploiting a communications jammer. These strategies can provide an increase in throughput, efficiency, connectivity, or covertness, as a result of the jamming attack itself. Through analysis and simulation, we show that an antifragile gain is possible under a wide array of electronic warfare scenarios. Throughout this dissertation we provide guidelines for realizing these antifragile waveforms. Other major contributions of this dissertation include the development of a communications jamming taxonomy, feasibility study of reactive jamming in a SATCOM-type scenario, and a reinforcement learning-based reactive jamming mitigation strategy, for times when an antifragile approach is not practical. Most of the jammer exploitation strategies described in this dissertation fall under the category of jammer piggybacking, meaning the communications system turns the jammer into an unwitting relay. We study this jammer piggybacking approach under a variety of reactive jamming behaviors, with emphasis on the sense-and-transmit type. One piggybacking approach involves transmitting using a specialized FSK waveform, tailored to exploit a jammer that channelizes a block of spectrum and selectively jams active subchannels. To aid in analysis, we introduce a generalized model for reactive jamming, applicable to both repeater-based and sensing-based jamming behaviors. Despite being limited to electronic warfare scenarios, we hope that this work can pave the way for further research into antifragile communications. / Ph. D.

In recent years, extensive research has been devoted to opportunistically exploiting spectrum in a distributed cognitive radio network. In such a network, autonomous secondary users (SUs) compete with each other for better channels without instructions from a centralized authority or explicit coordination among SUs. Channel selection relies on channel occupancy information observed by SUs, including whether a channel is occupied by a PU or an SU. Therefore, the SUs' performance depends on the quality of the information. Current research in this area often assumes that the SUs can distinguish a channel occupied by a PU from one occupied by another SU. This can potentially be achieved using advanced signal detection techniques but not by simple energy detection. However, energy detection is currently the primary detection technique proposed for use in cognitive radio networks. This creates a need to design a channel selection strategy under the assumption that, when SUs observe channel availability, they cannot distinguish between a channel occupied by a PU and one occupied by another SU. Also, as energy detection is simpler and less costly than more advanced signal detection techniques, it is worth understanding the value associated with better channel occupancy information. The first part of this thesis investigates the impact of different types of imperfect information on the performance of secondary users (SUs) attempting to opportunistically exploit spectrum resources in a distributed manner in a channel environment where all the channels have the same PU duty cycle. We refer to this scenario as the homogeneous channel environment. We design channel selection strategies that leverage different levels of information about channel occupancy. We consider two sources of imperfect information: partial observability and sensing errors. Partial observability models SUs that are unable to distinguish the activity of PUs from SUs. Therefore, under the partial observability models, SUs can only observe whether a channel was occupied or not without further distinguishing it was occupied by a PU or by SUs. This type of imperfect information exists, as discussed above, when energy detection is adopted as the sensing technique. We propose two channel selection strategies under full and partial observability of channel activity and evaluate the performance of our proposed strategies through both theoretical and simulation results. We prove that both proposed strategies converge to a stable orthogonal channel allocation when the missed detection rate is zero. The simulation results validate the efficiency and robustness of our proposed strategies even with a non-zero probability of missed detection. The second part of this thesis focuses on computing the probability distribution of the number of successful users in a multi-channel random access scheme. This probability distribution is commonly encountered in distributed multi-channel communication systems. An algorithm to calculate this distribution based on a recursive expression was previously proposed. We propose a non-recursive algorithm that has a lower execution time than the one previously proposed in the literature. The third part of this thesis investigates secondary users (SUs) attempting to opportunistically exploit spectrum resources in a scenario where the channels have different duty cycles, which we refer to as the heterogeneous channel environment. In particular, we model the channel selection process as a one shot game. We prove the existence of a symmetric Nash equilibrium for the proposed static game and design a channel selection strategy that achieves this equilibrium. The simulation results compare the performance of the Nash equilibrium to two other strategies(the random and the proportional strategies) under different PU activity scenarios. / Master of Science

The following thesis consists of two main contributions to the fields of network coding and resource allocation. The first is a quantitative analysis of the effects of channel estimation errors and time synchronization errors on the performance of different network coding algorithms. It is shown that the performance improvement gained by a relay-based network scheme is significant for small number of users and when the quality of the relay link is better than that of the direct link. However, it is shown that potential performance improvement resulting from the considered relay-based network coding scheme could be negated by channel estimation errors. To consider the effects of time synchronization errors, we study a digital network coding (DNC) system and a physical-layer network coding (PNC) system with non-coherent frequency shift keying (FSK) modulation. For each of these two systems, we investigate the effects of received Eb/N0, unequal link quality, and time synchronization errors. The second contribution is an analysis of the value and cost of cognition obtained by investigating three resource allocation algorithms with different levels of channel knowledge in the context of ad hoc networks. The performance (quantified in terms of "percentage of users reaching target data rate" and "average effective data rate") and cost ("power consumption" and "number of channel estimations") of these algorithms are analyzed. Results show that a resource allocation algorithm with a higher level of channel knowledge results in better performance, but greater cost in terms of number of channel estimations, as expected. In addition, a resource allocation algorithm with a higher level of channel knowledge converges quicker when channel adaptation are necessary. Both an ideal medium access control (MAC) protocol and a non-ideal MAC protocol (dedicated control channel) are considered. / Master of Science

Traditional hardware radios provide very rigid solutions to radio problems. Intelligent software defined radios, also known as cognitive radios, provide flexibility and agility compared to hardware radio systems. Cognitive radios are well suited for radio applications in a changing radio frequency environment, such as dynamic spectrum access. In this thesis, a cognitive radio is demonstrated where the system self reconfigures to demodulate a detected waveform. The GNU Radio framework is used to provide basic software defined radio building blocks and is supplemented with FPGA accelerators. The use of GNU Radio compliant hardware interfaces allows for seamless hardware/software radio deployments. Dynamic resource mapping allows radio designers to operate at a layer of abstraction above the physical radio implementation. By establishing lower level abstraction layers, future researchers can focus on larger picture concepts such as learning algorithms and behavioral models for the cognitive engine. / Master of Science

Dynamic Spectrum Access allows wireless users to access a wide range of spectrum which increases a node's ability to communicate with its neighbors, and spectral efficiency through opportunistic access to licensed bands. Our study focuses on the scalability of network performance, which we define in terms of network transport capacity and end-to-end throughput per node, as the network density increases. We develop an analytical procedure for performance evaluation of ad hoc DSA networks using Markov models, and analyze the performance of a DSA network with one transceiver per node and a dedicated control channel. We also develop and integrate a detailed model for energy detection in Poisson networks with sensing. We observe that the network capacity scales sub-linearly with the number of DSA users and the end-to-end throughput diminishes, when the number of data channels is fixed. Nevertheless, we show that DSA can improve network performance by allowing nodes to access more spectrum bands while providing a mechanism for spectrum sharing and maintaining network wide connectivity. We also observe that the percentage of relative overhead at the medium access layer does not scale with the number of users. Lastly, we examine the performance impact of primary user density, detection accuracy, and the number of available data channels. The results help to answer the fundamental question of the scaling behavior of network capacity, end-to-end throughput, and network overhead in ad hoc DSA networks. / Master of Science

Deep learning has become an ubiquitous part of research in all fields, including wireless communications. Researchers have shown the ability to leverage deep neural networks (DNNs) that operate on raw in-phase and quadrature samples, termed Radio Frequency Machine Learning (RFML), to synthesize new waveforms, control radio resources, as well as detect and classify signals. While there are numerous advantages to RFML, this thesis answers the question "is it secure?" DNNs have been shown, in other applications such as Computer Vision (CV), to be vulnerable to what are known as adversarial evasion attacks, which consist of corrupting an underlying example with a small, intelligently crafted, perturbation that causes a DNN to misclassify the example. This thesis develops the first threat model that encompasses the unique adversarial goals and capabilities that are present in RFML. Attacks that occur with direct digital access to the RFML classifier are differentiated from physical attacks that must propagate over-the-air (OTA) and are thus subject to impairments due to the wireless channel or inaccuracies in the signal detection stage. This thesis first finds that RFML systems are vulnerable to current adversarial evasion attacks using the well known Fast Gradient Sign Method originally developed for CV applications. However, these current adversarial evasion attacks do not account for the underlying communications and therefore the adversarial advantage is limited because the signal quickly becomes unintelligible. In order to envision new threats, this thesis goes on to develop a new adversarial evasion attack that takes into account the underlying communications and wireless channel models in order to create adversarial evasion attacks with more intelligible underlying communications that generalize to OTA attacks. / Master of Science / Deep learning is beginning to permeate many commercial products and is being included in prototypes for next generation wireless communications devices. This technology can provide huge breakthroughs in autonomy; however, it is not sufficient to study the effectiveness of deep learning in an idealized laboratory environment, the real world is often harsh and/or adversarial. Therefore, it is important to know how, and when, these deep learning enabled devices will fail in the presence of bad actors before they are deployed in high risk environments, such as battlefields or connected autonomous vehicle communications. This thesis studies a small subset of the security vulnerabilities of deep learning enabled wireless communications devices by attempting to evade deep learning enabled signal classification by an eavesdropper while maintaining effective wireless communications with a cooperative receiver. The primary goal of this thesis is to define the threats to, and identify the current vulnerabilities of, deep learning enabled signal classification systems, because a system can only be secured once its vulnerabilities are known.

For the past 70 years, the Federal Communications Commission (FCC) has been the licensing authority for wireless spectrum. Traditionally, spectrum was commercially licensed to primary users with defined uses. With the growth of personal communication systems in the 1990''s, unallocated spectrum has become a scarce commodity. However, since most primary users are active only at certain times and places, much of the allocated spectrum remains underutilized. Substantial holes exist in the spatio-temporal spectrum that could be opportunistically used by unlicensed secondary users. As a result, the FCC is considering allowing secondary users to opportunistically use frequencies that are not being used by primary users. If multiple secondary users are present in the same geographical area, the concept of Dynamic Spectrum Sharing (DSS) allows these users to share the opportunistic spectrum. If several secondary users want to use a limited set of frequency resources, they will very likely interfere with each other. Sensing is a distributed technique where each transmitter/receiver pair senses (both passively and actively) the available channels and uses the channel that provides the best performance. While sensing alone allows sharing of the spectrum, it is not the optimal method in terms of maximizing the capacity in such a shared system. If we allow the secondary users to collaborate and share information, optimal capacity might be reached. However, collaboration adds another level of complexity to the transceivers of the secondary users, since they must now be able to communicate (Note that in general, the secondary users may have completely different communication protocols, e.g., Wi-Fi and Bluetooth). Additionally, optimizing the capacity of the available spectrum could have other negative side effects such as impacting the fairness of sharing the resources. Our primary goal is to explore the benefit of this cost-benefit tradeoff by determining the capacity increase obtainable from collaboration. As a secondary goal, we also wish to determine how this increase in capacity affects fairness. To summarize, the goal of this work is to answer the question: Fundamentally, what is the benefit of collaboration in Dynamic Spectrum Sharing? / Master of Science