Achievable Rates of Attack Detection Strategies in Echo-Assisted Communication

TL;DR

This paper analyzes the limits of attack detection in echo-assisted communication systems under adversarial attacks, proposing new detectors and a framework to approximate mutual information despite intractability.

Contribution

It introduces a novel framework for approximating mutual information in adversarial echo-assisted channels and proposes two new attack detectors inspired by traditional and neural network methods.

Findings

Mutual information can be approximated under certain channel conditions.

Proposed detectors perform close to the ideal Genie detector for short frames.

The adversarial model degrades detection performance, highlighting the need for robust strategies.

Abstract

We consider an echo-assisted communication model wherein block-coded messages, when transmitted across several frames, reach the destination as multiple noisy copies. We address adversarial attacks on such models wherein a subset of the noisy copies are vulnerable to manipulation by an adversary. Particularly, we study a non-persistent attack model with the adversary attacking 50% of the frames on the vulnerable copies in an i.i.d. fashion. We show that this adversarial model drives the destination to detect the attack locally within every frame, thereby resulting in degraded performance due to false-positives and miss-detection. Our main objective is to characterize the mutual information of this adversarial echo-assisted channel by incorporating the performance of attack-detection strategies. With the use of an imperfect detector, we show that the compound channel comprising the adversarial echo-assisted channel and the attack detector exhibits memory-property, and as a result, obtaining closed-form expressions on mutual information is intractable. To circumvent this problem, we present a new framework to approximate the mutual information by deriving sufficient conditions on the channel parameters and also the performance of the attack detectors. Finally, we propose two attack-detectors, which are inspired by traditional as well as neural-network ideas, and show that the mutual information offered by these detectors is close to that of the Genie detector for short frame-lengths.

Tables

Table 1. TABLE I: Mutual Information Computation of Attack-Detectors in Echo-assisted Communication

Operating Region of the Detector	Mutual Information
	Computation
$p_{md}=0,p_{fa}=0$ (Genie Detector)	Tractable
$p_{md}=0,p_{fa}=1$ (Conservative Strategy)	Tractable
	Intractable
A special case of the regime	We propose
	an approximation in Theorem 1

Equations

$$y_1^n={\gamma }_1{x}^n+z_1^n\in {\mathbb{R}}^n\text{mbox}and{y}_2^n={\gamma }_2(b^n\circ x^n)+z_2^n\in {\mathbb{R}}^n,$$

$${\mathcal{M}}^{Genie}$$

$$I(x^n;y_1^n,y_2^n|A=1)=I(x^n;y_1^n)=nI(x;y_1),$$

$$I(x^n;y_1^n,y_2^n|A=0)$$

$$P(y_{c,na})=\frac{1}{\sqrt{2\pi {\sigma }_{eq}^2}}\left(\alpha e^{-\frac{(y_{c,na}-(|{\gamma }_1{|}^2+|{\gamma }_2{|}^2){)}^2}{2{\sigma }_{eq}^2}}+(1-\alpha )e^{-\frac{(y_{c,na}+(|{\gamma }_1{|}^2+|{\gamma }_2{|}^2){)}^2}{2{\sigma }_{eq}^2}}\right)$$

$$I(x;y_{c,na})=h(y_{c,na})-h(y_{c,na}|x),$$

$$P(y_{c,na}|x=\beta )=\frac{1}{\sqrt{2\pi {\sigma }_{eq}^2}}{e}^{-\frac{(y_{c,na}-\beta (|{\gamma }_1{|}^2+|{\gamma }_2{|}^2){)}^2}{2{\sigma }_{eq}^2}},$$

$$y_{c,a}^n=(|{\gamma }_1{|}^2+b^n|{\gamma }_2{|}^2)\circ x^n+z_c^n.$$

$$y_{c,na}^n=(|{\gamma }_1{|}^2+|{\gamma }_2{|}^2)x^n+z_c^n.$$

$${\mathcal{M}}_{p_{md},p_{fa}}^{non-Genie}$$

$$P(y_c^n|\hat{A}=0)$$

$${\mathcal{R}}_{\mu }\triangleq \left\{(x,y)|y\le \frac{\mu }{1-\mu }x\right\}.$$

$$\mathcal{P}\triangleq \left\{(p_{md|\bar{x}},1-p_{fa|\bar{x}})|\forall \bar{x}\in \{-1,1{\}}^n\right\},$$

$$P(y_{c,a}^n=y^n|\bar{x})$$

$$P(y_{c,a}^n=y^n)$$

$$P(y_{c,a}^n=y^n|\bar{x})\le \frac{1}{(2\pi {\sigma }_{eq}^2{)}^{\frac{n}{2}}}{e}^{-\frac{d_{min}^2(y^n,{\mathcal{S}}_{\bar{x}})}{2{\sigma }_{eq}^2}},$$

$$P(y_{c,na}^n=y^n|\bar{x})$$

$$\ge$$

$${\mathcal{M}}_{p_{fa}}^{approx}=\frac{n}{2}I(x;y_{c,na})(1-p_{fa})+\frac{n}{2}I(x;y_1)(1+p_{fa}),$$

$$I(x^n;y_c^n|\hat{A}=0)=h(y_c^n|\hat{A}=0)-h(y_c^n|x^n,\hat{A}=0),$$

$$h(y_c^n|\hat{A}=0)=-\mathbb{E}\left[\text{mbox}{log}_2\left(P(y_c^n|\hat{A}=0)\right)\right],$$

$$P(y_c^n|\hat{A}=0){\approx }_{\mu }P(y_{c,na}^n).$$

$$h(y_c^n|\hat{A}=0){\approx }_{\mu ,pdf}h(y_{c,na}^n)=nh(y_{c,na}),$$

$$h(y_c^n|\hat{A}=0,x^n)=\sum _{x^n=\bar{x}}p(\bar{x}|\hat{A}=0)h(y_c^n|\hat{A}=0,x^n=\bar{x}),$$

$$\frac{P(y_{c,a}^n|x^n=\bar{x})p_{md|\bar{x}}+P(y_{c,na}^n|x^n=\bar{x})(1-p_{fa|\bar{x}})}{p_{md|\bar{x}}+1-p_{fa|\bar{x}}}.$$

$$P(y_c^n|\hat{A}=0,x^n=\bar{x}){\approx }_{\mu }P(y_{c,na}^n|x^n=\bar{x}),$$

$$h(y_c^n|\hat{A}=0,x^n)$$

Full text

I Introduction

A number of wireless applications exists involving echo-assisted communication wherein messages transmitted by the source arrive at the destination as multiple noisy copies. Typical examples include communication over frequency-selective channels [1], relay networks [2], and multiple receive antennas [3]. In such scenarios, it is well known that suitably combining these copies can increase the effective signal-to-noise-ratio, thereby facilitating higher transmission rate.

In this work, we consider attack models on echo-assisted communication wherein a subset of the copies collected at the destination might have been manipulated by an adversary. Attacks on only a subset of copies are attributed to practical limitations on the adversary to manipulate all the copies. For instance, in the case of frequency-selective channels with delay spreads, the adversary may have processing-delay constraints to manipulate the first copy, but not the subsequent ones [1]. We study a specific adversarial attack referred to as the flipping attack [4] wherein the message bits of the attacked copy are flipped at 50% rate independently. With such attacks, the dilemma at the destination is whether to use the vulnerable copies or discard them when recovering the messages. To gain insights on the attack model, we focus on the case of two received copies, out of which the second copy might have been manipulated by an adversary. Although adversarial models on binary channels have been studied by the information-theory community [4, 5], flipping attacks on echo-assisted communication involving binary input and continuous output have not been studied hitherto. Henceforth, throughout the paper, we refer to the source and the destination as Alice and Bob, respectively.

I-A Motivation

Consider an echo-assisted communication setting, as shown in Fig. 1, wherein a binary codeword of large block-length is transmitted from Alice to Bob as a sequence of several frames, each of length $n$. Upon transmission of a frame, denoted by $x^{n}$, Bob receives two noisy copies of it, denoted by $y^{n}_{1}\in\mathbb{R}^{n}$ and $y^{n}_{2}\in\mathbb{R}^{n}$, in the presence of additive white Gaussian noise (AWGN). It is well known that appropriately combining these two copies can yield higher signal-to-noise-ratio at Bob, which in turn assists Alice to transmit at higher-rate than when only one of the copies is used to decode the codeword. The adversarial model in our setting is that the second copy is vulnerable to the flipping attack but not the first one. Specifically, we consider a non-persistent attack model, wherein the second copy is vulnerable to the flipping attack on 50% of the frames chosen at random in an i.i.d. fashion.111Persistent adversarial model, wherein all the frames of the second copy are under attack, is relatively straightforward to handle, as Bob may detect the attack accurately when the block-length of the code is large. A conservative strategy to handle this adversarial setting is as follows:

• •

Bob discards $y^{n}_{2}$ irrespective of the attack, and only uses $y^{n}_{1}$ to recover the message, i.e., $y^{n}_{c}=y^{n}_{1}$ as per Fig. 1.

• •

Alice uses a codebook designed for Gaussian channels to achieve the rate $I(x;y_{1})$, wherein $y_{1}=\gamma_{1}x+z_{1}$ such that $x\in\{-1,+1\}$, $z_{1}\sim\mathcal{N}(0,\sigma^{2})$, and $\gamma_{1}$ is a constant known to both Alice and Bob.

Keeping in view of the above conservative baseline, we are interested in designing a combining strategy at Bob which can assist Alice in transmitting at higher-rate than $I(x;y_{1})$. Towards achieving higher-rate, it is clear that Bob must first observe $y^{n}_{2}$, detect whether $y^{n}_{2}$ is attacked, and then decide to combine it with $y^{n}_{1}$ to recover the message. Since the frames are under attack in an i.i.d. fashion, Bob has to detect the attack locally by observing the $n$ samples of the frame, and this detection problem can be challenging especially when $n$ is small. Given that a practical detection strategy is typically imperfect, the combining strategy may lead to degraded performance either (i) when the flipping attack on $y^{n}_{2}$ is misdetected, or (ii) when a legitimate frame $y^{n}_{2}$ is categorized as under attack. While the performance of detectors can be evaluated by miss-detection and false-positive rates, these traditional metrics do not capture any rate-loss incurred by the source in aiding the detection strategy. As a result, there is a need to characterize the achievable rates of this adversarial echo-assisted channel in terms of the performance of the underlying attack-detectors.

I-B Contributions

The main contributions of this work are listed below:

• •

On the echo-assisted communication model discussed in Section I-A, we quantify the performance of attack detectors by computing the mutual information of the compound channel, which comprises of the source, the adversarial echo-channel, and the combining strategy, which is guided by the attack detector at Bob, as shown in Fig. 1. This way, we incorporate the traditional metrics of miss-detection rates, denoted by $p_{md}$, and false-positive rates, denoted by $p_{fa}$, indirectly into the mutual information of the compound channel. Henceforth, the mutual information of the compound channel, as shown in Fig. 1, is referred to as the mutual information of the underlying attack-detector.

• •

Although the adversarial model has memory, we show that the compound channel involving a Genie detector (which corresponds to $p_{md}=0$ and $p_{fa}=0$) is memoryless by the virtue of perfect knowledge of the attack event at Bob. As a result, we show that computation of mutual information of Genie detectors is tractable (as listed in Table I). However, it is well known that Genie detectors cannot be realized in practice especially when the frame-length is not sufficiently large. We show that the compound channel comprising a practical (imperfect) attack detector, such that $0<p_{md}<1,0<p_{fa}<1$, continues to have memory, and this in addition to finitary constraint on the input alphabet [6], renders mutual information computation intractable. To circumvent this issue, we provide a new framework to approximate the mutual information of imperfect detectors. Specifically, we provide sufficient conditions on (i) the miss-detection and false-positive rates of detectors (as shown in Fig. 2), and (ii) on the channel parameters such that the proposed approximation holds (see Theorem 1).

• •

In the last part of this work (see Section IV), we propose two attack detectors, namely: (i) k Nearest Neighbor (KNN) estimator, which measures the mutual information between $y^{n}_{1}$ and $y^{n}_{2}$ to detect the flipping attack, and (ii) a Neural Network (NN) classifier, which uses two hidden layers to solve the detection problem as a supervised classification problem. We present our approximations on the mutual information of these detectors and show that the NN classifier is capable of accurately detecting the attacks on frames-lengths as short as $100$ and $40$ symbols at low signal-to-noise-ratio of [math] dB and $5$ dB, respectively.

Notations: For an $n$-dimensional random vector $y^{n}\in\mathbb{R}^{n}$ with joint probability distribution function $P(y^{n})$, its differential entropy, denoted by $h(y^{n})$, is represented as $-\mathbb{E}[\mbox{log}_{2}(P(y^{n}))]$, where the expectation is over $P(y^{n})$. A Gaussian random variable with zero mean and variance $\sigma^{2}$ is denoted by $\mathcal{N}(0,\sigma^{2})$. An $n\times n$ identity matrix, an $n$-length vector of zeros, and an $n$-length vector of ones are denoted by $\mathbf{I}_{n}$, $\mathbf{0}_{n}$, and $\mathbf{1}_{n}$, respectively. For a given $n$-length vector, denoted by $y^{n}$, the notation $y^{n^{\prime}}$ for $n^{\prime}\leq n$, denotes the $n^{\prime}$-length vector containing the first $n^{\prime}$ components of $y^{n}$. The notation $\mbox{prob}(\cdot)$ denotes the usual probability operator.

II System Model

Alice transmits an $n$-length frame $x^{n}\in\{-1,+1\}^{n}$ such that the components of $x^{n}$ are i.i.d. over the Probability Mass Function (PMF) $\{\alpha,1-\alpha\}$ for some $0<\alpha<1$. Meanwhile, Bob receives two copies of $x^{n}$ over the Additive White Gaussian Noise (AWGN) channels as

[TABLE]

where $\gamma_{1}\in\mathbb{R}$ and $\gamma_{2}\in\mathbb{R}$ are non-zero constants known to both Alice and Bob, $z^{n}_{1}$ and $z^{n}_{2}$ represent the additive white Gaussian noise vectors distributed as $\mathcal{N}(\mathbf{0}_{n},\sigma^{2}\mathbf{I}_{n})$. We assume that $z^{n}_{1}$ and $z^{n}_{2}$ are statistically independent. Between the two copies, we assume that $y^{n}_{2}$ is vulnerable to the flipping attack, whereas $y^{n}_{1}$ is not. To model the flipping attack on $y^{n}_{2}$, we introduce Hadamard product, denoted by $\circ$, between $b^{n}\in\{-1,+1\}^{n}$ and $x^{n}$. When the frame is under attack, the components of $b^{n}$ are i.i.d. over the PMF $\{0.5,0.5\}$, and are unknown to both Alice and Bob. However, without attack, $b^{n}=\mathbf{1}_{n}$. In this adversarial setting, the attacker executes the flipping attack on a frame chosen randomly in an i.i.d. fashion with probability $0.5$. By using $A=0$ and $A=1$ to denote the events of attack and no-attack, respectively, we have $\mbox{prob}(A=0)=\mbox{prob}(A=1)=0.5$.

With no knowledge of $A$ at Bob, characterizing the mutual information (MI) of the adversarial channel is intractable due to the memory-property introduced by the attacker. However, when $A$ is perfectly known at Bob, we can compute the MI of the compound channel shown in Fig. 1, wherein the underlying detector is the Genie detector, which assigns $\hat{A}=A$ for each frame.

Proposition 1

The MI of the compound channel involving the Genie detector is

[TABLE]

where $y_{c,na}=(|\gamma_{1}|^{2}+|\gamma_{2}|^{2})x+z_{c}\mbox{ and }y_{1}=\gamma_{1}x+z_{1}$ are the scalar channels such that $x\in\{-1,+1\}$ with PMF $\{\alpha,1-\alpha\}$, and the additive noise $z_{c}=\gamma_{1}z_{1}+\gamma_{2}z_{2}$ is distributed as $\mathcal{N}(0,\sigma^{2}_{eq})$ with $\sigma^{2}_{eq}=(|\gamma_{1}|^{2}+|\gamma_{2}|^{2})\sigma^{2}$.

Proof:

The average MI offered by the compound channel comprising the Genie detector is

[TABLE]

When $A=1$, each bit of $x^{n}$ on the second copy is flipped by the attacker with probability $0.5$ in an i.i.d. fashion, and as a result, it is straightforward to prove that $I(x^{n};y^{n}_{2}~{}|~{}A=1)=0$. As a consequence, we have

[TABLE]

where the last equality is applicable due to the memoryless property of the channel on the first copy. This implies that discarding $y^{n}_{2}$ is the optimal strategy at Bob when $A=1$. On the other hand, when $A=0$, the mutual information of the compound channel is given by

[TABLE]

where $y^{n}_{c,na}$ in the second equality is obtained by combining $y^{n}_{1}$ and $y^{n}_{2}$ as $y^{n}_{c,na}=\gamma_{1}y^{n}_{1}+\gamma_{2}y^{n}_{2}=(|\gamma_{1}|^{2}+|\gamma_{2}|^{2})x^{n}+z^{n}_{c},$ such that the additive noise vector $z^{n}_{c}=\gamma_{1}z^{n}_{1}+\gamma_{2}z^{n}_{2}$ is distributed as $\mathcal{N}(\mathbf{0}_{n},\sigma^{2}_{eq}\mathbf{I}_{n})$, where $\sigma^{2}_{eq}=(|\gamma_{1}|^{2}+|\gamma_{2}|^{2})\sigma^{2}$. It is straightforward to verify that $I(x^{n},y^{n}_{c,na})=I(x^{n};y^{n}_{1},y^{n}_{2}~{}|~{}b^{n}=\mathbf{1}_{n})$, which implies that the combining strategy is optimal without the attack. Note that the last equality is applicable by using the memoryless nature of the channel, attributed to the perfect knowledge of $A$ at Bob. Finally, by using (4) and (5) in (3), we get the expression for mutual information in (2). This completes the proof. ∎

Since $x$ takes values from a finite input alphabet, $\mathcal{M}^{Genie}$ in (2) can be numerically computed as a function of the input PMF $\{\alpha,1-\alpha\}$, constants $\gamma_{1}$ and $\gamma_{2}$, and $\sigma^{2}$ [6]. Specifically, $I(x;y_{c,na})$ is given by

[TABLE]

where $h(y_{c,na})=-\mathbb{E}[\mbox{log}_{2}(P(y_{c,na}))]$ such that $P(y_{c,na})$ is as given in (6). The conditional entropy $h(y_{c,na}|x)$ can be computed using the distribution $P(y_{c,na}|x=\beta)$ given by

[TABLE]

for $\beta\in\{-1,+1\}$. Similarly, we can also compute $I(x;y_{1})$.

Although the mutual information of Genie detectors can be computed based on Proposition 1, it is well known that practical detectors not perfect. Therefore, in the next section, we address the challenges involved in computing the MI of (imperfect) practical attack-detectors.

III Mutual Information with Practical Detection Strategy

We consider a practical attack-detection strategy, as shown in Fig. 3, which uses the received samples $\{y^{n}_{1},y^{n}_{2}\}$ to detect the flipping attack on every frame. Based on the detector’s output, represented by the variable $\hat{A}\in\{0,1\}$, Bob decides either to combine $y^{n}_{1}$ and $y^{n}_{2}$, or discard $y^{n}_{2}$. Note that this detector is typically imperfect, and as a result, it has its associated miss-detection and false-positive rates, defined as $p_{md}\triangleq\mbox{prob}(\hat{A}=0~{}|~{}A=1)$ and $p_{fa}\triangleq\mbox{prob}(\hat{A}=1~{}|~{}A=0)$, respectively. When the detector outputs $\hat{A}=1$, Bob drops the samples $y^{n}_{2}$, and only uses the samples $y^{n}_{1}$ to recover the message. On the other hand, when the detector outputs $\hat{A}=0$, Bob combines $y^{n}_{1}$ and $y^{n}_{2}$ to obtain $y^{n}_{c}=\gamma_{1}y^{n}_{1}+\gamma_{2}y^{n}_{2}$ and then uses it to recover the message.

In the event of miss-detection, i.e., when $A=1$ and $\hat{A}=0$, we know that $b^{n}\in\{-1,+1\}^{n}$ is random and unknown to Bob. Therefore, $y^{n}_{c}$ is denoted as $y^{n}_{c,a}$, and is given by

[TABLE]

However, when $A=0$ and $\hat{A}=0$, we have $b^{n}=\textbf{1}_{n}$, and therefore, $y^{n}_{c}$ is denoted as $y^{n}_{c,na}$, and is given by

[TABLE]

The MI of this detection strategy, denoted by $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}$, is

[TABLE]

where $\mbox{prob}(\hat{A}=0)=\frac{1}{2}(1+p_{md}-p_{fa})$ and $\mbox{prob}(\hat{A}=1)=\frac{1}{2}(1-p_{md}+p_{fa})$.

To compute $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}$, we have to compute $I(x^{n};y^{n}_{c}~{}|~{}\hat{A}=0)$ for a given frame-length $n$. However, this needs us to evaluate the differential entropy of the probability distribution function $P(y^{n}_{c}~{}|~{}\hat{A}=0)$ given in (III). Since the input alphabet is finite in size, the corresponding differential entropy can only be computed using numerical methods, and as a result, computing $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}$ is intractable for sufficiently large $n$ (of the order of hundreds). In a nutshell, the above computational issue is because the equivalent channel when $\hat{A}=0$ is not memoryless. To circumvent this problem, we show that the MI value $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}$ of some detectors can be computed using an approximation under special conditions on $p_{md}$ and $p_{fa}$.

The following sequence of definitions and lemmas are useful to present our results on approximation in Theorem 1.

Definition 1

For $0\leq x,y\leq 1$, let a set $\mathcal{R}_{\mu}$, for some negligible $\mu>0$, be defined as

[TABLE]

Definition 2

For a given attack-detector, we define its performance profile as

[TABLE]

where $p_{md|\bar{x}}=\mbox{prob}(\hat{A}=0|A=1,x^{n}=\bar{x})$ and $p_{fa|\bar{x}}=\mbox{prob}(\hat{A}=1|A=0,x^{n}=\bar{x})$.

Definition 3

For a given $\bar{x}\in\{-1,1\}^{n}$, let $\mathcal{S}_{\bar{x}}=\{(|\gamma_{1}|^{2}+\bar{b}|\gamma_{2}|^{2})\circ\bar{x}~{}|~{}\forall~{}\bar{b}=\{-1,1\}^{n}\}$ denote an $n$-dimensional discrete constellation in $\mathbb{R}^{n}$ obtained by using $\bar{b}$ over $\{-1,+1\}^{n}$. On $\mathcal{S}_{\bar{x}}$, we define,

• •

$d^{2}_{min}(y^{n},\mathcal{S}_{\bar{x}})=\displaystyle\min_{s^{n}\in\mathcal{S}_{\bar{x}}}||y^{n}-s^{n}||^{2}_{F}$**

• •

$d^{2}_{max}(y^{n},\mathcal{S}_{\bar{x}})=\displaystyle\max_{s^{n}\in\mathcal{S}_{\bar{x}}}||y^{n}-s^{n}||^{2}_{F}$**

• •

$d^{2}_{max}(\mathcal{S}_{\bar{x}})=\displaystyle\max_{s^{n}_{1},s^{n}_{2}\in\mathcal{S}_{\bar{x}}}||s^{n}_{1}-s^{n}_{2}||^{2}_{F},$**

where $y^{n}\in\mathbb{R}^{n}$ and $||\cdot||^{2}_{F}$ denotes the squared Euclidean distance.

Lemma 1

If $a,b,\mu$ are such that $0\leq a\leq 2b$ and $\mu>0$ is a negligible number, then we have $\mu a+(1-\mu)b\approx b.$

Proof:

The convex combination $\mu a+(1-\mu)b$ can be written as $b-\mu(b-a)$. This implies that $\mu a+(1-\mu)b=b-\lambda$, where $0\leq\lambda\leq\mu b$ when $a\leq b$, and $-\mu b\leq\lambda<0$ when $b<a\leq 2b$. Since $\mu$ is negligible, $b-\lambda\approx b$ for every $b\geq 0$. ∎

Since the accuracy of the approximation depends on $\mu$, we henceforth denote $\approx$ by $\approx_{\mu}$.

Lemma 2

If $\gamma_{1}$, $\gamma_{2}$ and $\sigma^{2}_{eq}$ are such that $d^{2}_{max}(\mathcal{S}_{\bar{x}})\leq 2\mbox{log}_{e}(2)\sigma^{2}_{eq}$ for each $\bar{x}\in\{-1,+1\}^{n},$ then we have

[TABLE]

for every $y^{n}\in\mathbb{R}^{n}$.

Proof:

We only show the applicability of (13). Since $P(y^{n}_{c,a}=y^{n})$ can be written as a weighted sum of $P(y^{n}_{c,a}=y^{n}|\bar{x})$ over all $\bar{x}$, (13) can be used to show the applicability of (14). Given $x^{n}=\bar{x}$, the $n$-dimensional distribution of $y^{n}_{c,a}$ is given by $P(y^{n}_{c,a}|\bar{x})=\frac{1}{(2\pi\sigma^{2}_{eq})^{\frac{n}{2}}}\frac{1}{2^{n}}\sum_{b^{n}=\bar{b}}e^{-\frac{||y^{n}_{c,a}-(|\gamma_{1}|^{2}+\bar{b}|\gamma_{2}|^{2})\circ\bar{x}||^{2}_{F}}{2\sigma^{2}_{eq}}}.$ When evaluated at $y^{n}\in\mathbb{R}^{n}$, we can upper bound the above term as

[TABLE]

where $d^{2}_{min}(y^{n},\mathcal{S}_{\bar{x}})$ is as given in Definition 3. Meanwhile, the $n$-dimensional distribution of $y^{n}_{c,na}$ is given by

[TABLE]

where the first inequality holds since $(|\gamma_{1}|^{2}+|\gamma_{2}|^{2})\bar{x}\in\mathcal{S}_{\bar{x}}$. The second inequality holds because of triangle inequality. Finally, if $d^{2}_{max}(\mathcal{S}_{\bar{x}})\leq 2\mbox{log}_{e}(2)\sigma^{2}_{eq}$ for each $\bar{x}\in\{-1,+1\}^{n},$ then (16) can be further lower bounded as

[TABLE]

where the last inequality is due to the bound in (15). This implies that $P(y^{n}_{c,a}=y^{n}|\bar{x})\leq 2P(y^{n}_{c,na}=y^{n}|\bar{x})$ for each $y^{n}$. This completes the proof. ∎

Using the results of Lemma 1 and Lemma 2, we are now ready to present our result on approximation.

Theorem 1

If $\gamma_{1}$, $\gamma_{2}$ and $\sigma^{2}_{eq}$ are such that $d^{2}_{max}(\mathcal{S}_{\bar{x}})\leq 2\mbox{log}_{e}(2)\sigma^{2}_{eq}$ for each $\bar{x}\in\{-1,+1\}^{n},$ and if the detection strategy is such that $\mathcal{P}\subseteq\mathcal{R}_{\mu}$, for a fixed small $\mu>0$, then we have $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}\approx_{\mu,pdf}\mathcal{M}^{approx}_{p_{fa}}$, where

[TABLE]

and the notation $\approx_{\mu,pdf}$ captures the notion that the approximation on MI is a result of approximating the underlying distributions using $\approx_{\mu}$.

Proof:

Based on the expression of $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}$ in (10), it is straightforward to show that $I(x^{n};y^{n}_{1})=nI(x;y_{1})$. In this proof, we only address the computation of $I(x^{n};y^{n}_{c}~{}|~{}\hat{A}=0)$. From first principles, we have

[TABLE]

where $h(y^{n}_{c}~{}|~{}\hat{A}=0)$ can be obtained using $P(y^{n}_{c}~{}|~{}\hat{A}=0)$ as

[TABLE]

where $P(y^{n}_{c}~{}|~{}\hat{A}=0)$ is as given in (11). When the attack-detection technique operates at $\mathcal{P}\subseteq\mathcal{R}_{\mu}$, then we can show that $(p_{md},p_{fa})\in\mathcal{R}_{\mu}$, where $p_{fa}=\mathbb{E}[p_{fa|\bar{x}}]$ and $p_{md}=\mathbb{E}[p_{md|\bar{x}}]$ such that the expectation is over $x^{n}$. By applying the results of Lemma 1 and Lemma 2 on (11), we get

[TABLE]

The above approximation holds because $\frac{p_{md}}{p_{md}+1-p_{fa}}$ plays the role of $\mu$ in Lemma 1, and the condition $a\leq 2b$ of Lemma 1 is satisfied because of (14) in Lemma 2. As a result $h(y^{n}_{c}~{}|~{}\hat{A}=0)\approx_{\mu,pdf}-\mathbb{E}[\mbox{log}_{2}(P(y^{n}_{c,na}))]$. Furthermore, since each component of $y^{n}_{c,na}$ is independent across $n$, we have

[TABLE]

where $h(y_{c,na})=-\mathbb{E}[\mbox{log}_{2}(P(y_{c,na}))]$ such that $P(y_{c,na})$ is given by (6). Similarly, the conditional differential entropy $h(y^{n}_{c}~{}|~{}\hat{A}=0,x^{n})$ is given by

[TABLE]

where $p(\bar{x}|\hat{A}=0)\triangleq\mbox{prob}(x^{n}=\bar{x}|\hat{A}=0)$ and $h(y^{n}_{c}~{}|~{}\hat{A}=0,x^{n}=\bar{x})=-\mathbb{E}[\mbox{log}_{2}(P(y^{n}_{c}~{}|~{}\hat{A}=0,x^{n}=\bar{x}))]$ such that $P(y^{n}_{c}~{}|~{}\hat{A}=0,x^{n}=\bar{x})$ can be written as

[TABLE]

To arrive at (22), we assume that $A$ and $x^{n}$ are statistically independent. Again, applying the results of Lemma 1 and Lemma 2 on (22), we have the approximation

[TABLE]

for every $x^{n}=\bar{x}$. As a result, we have $h(y^{n}_{c}~{}|~{}\hat{A}=0,x^{n}=\bar{x})\approx_{\mu,pdf}h(y^{n}_{c,na}~{}|~{}x^{n}=\bar{x})$. Finally, using the above expression in (21), we get

[TABLE]

where the last equality is due to i.i.d. nature of $z_{c}^{n}$. Overall, using (23) and (20) in (10), we get the expression in (19). ∎

The proposed sufficient condition on the performance profile of attack detectors is also depicted in Fig. 2. Due to intractability in evaluating $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}$, Theorem 1 approximates the MI of a special class of detectors when (i) the detectors operate in the region $\mathcal{P}\subseteq\mathcal{R}_{\mu}$, and (ii) the channel parameters $\gamma_{1},\gamma_{2},\sigma^{2}$ satisfy Lemma 2. For such a class of detectors, the MI $\mathcal{M}^{approx}_{p_{fa}}$, given in (19) is now easy to evaluate since $I(x;y_{c,na})$ and $I(x;y_{1})$ can be computed using standard numerical methods [6]. Note that the Genie detector trivially belongs to this special class, and as a result, (19) is upper bounded by $\mathcal{M}^{Genie}$ in (2). Also note that (19) is lower bounded by $nI(x;y_{1})$, which is the MI offered by the conservative strategy of unconditionally dropping $y^{n}_{2}$ when recovering the message.

IV Experiment Results

To conduct experiments on the performance of attack detection in echo-assisted communication, we use the system model in Section II with $\alpha=0.5$, $\gamma_{1}=\gamma_{2}=1$, and $\mbox{SNR}=10\mbox{log}_{10}(\frac{1}{\sigma^{2}})\in\{0,5,10,15\}$ in dB. We propose the following two detectors which are designed to detect the flipping attack by using the first $n^{\prime}$ samples of the received frames, namely $\{y^{n^{\prime}}_{1},y^{n^{\prime}}_{2}\}$, for some $n^{\prime}\leq n$.

1) k Nearest-Neighbor (KNN) MI Estimation: Based on the attack model in Section II, we observe that $I(y_{1};y_{2}~{}|~{}A=0)>I(y_{1};y_{2}~{}|~{}A=1)$, and both these terms can be calculated off-line. As a result, we use a detection strategy that measures the MI between $y^{n^{\prime}}_{1}$ and $y^{n^{\prime}}_{2}$ by using scikit-learn [7] library’s MI calculation method using $k$ nearest neighbors [8]. The proposed detection strategy feeds an appropriate value of $\hat{A}$ to the combining block depending on whether the MI estimate is above or below the threshold, which in turn is empirically chosen such that $p_{md}$ is bounded by 0.1%.

2) Neural Network (NN) Classifier: In this method, we pose attack detection as a supervised classification problem. The proposed NN uses two hidden layers with ReLU activation function followed by a sigmoid output at the end. The inputs to the training phase constitutes channel outputs, namely, $\{y^{n^{\prime}}_{1},y^{n^{\prime}}_{2}\}$ (with 50% of the frames under attack) along with the respective ground truths on $A$. Based on the inputs, the NN estimates the probability of attack by minimizing an appropriate binary cross-entropy function. We train for eight epochs to ensure convergence over the training set with a batch size of $512$ using the Adam optimizer [9]. To achieve the constraint of $p_{md}=0.1\%$, we empirically find an appropriate threshold which gives 0.1% miss-detection rate on the training data set, and then measure $p_{md}$ and $p_{fa}$ on the validation data set.

For each combination of $n^{\prime}\in\{10,20,\ldots,100\}$ and $\mbox{SNR}\in\{0,5,10,15\}$, we repeat the experiments to compute $p_{fa}$ of the above detectors by driving their $p_{md}=0.1\%$. Subsequently, we substitute the corresponding $p_{fa}$ in (19) to obtain $\mathcal{M}^{approx}_{p_{fa}}$, as presented in Fig. 4. The plots show that the NN classifier outperforms the KNN detection significantly at $\mbox{SNR}=0\mbox{ dB}$, whereas the benefits of the NN classifier are not significant at $\mbox{SNR}=5\mbox{ dB}$. Furthermore, we highlight that $\mathcal{M}^{approx}_{p_{fa}}$ offered by the NN detector is close to that of the Genie detector for frame-lengths as short as $100$ and $40$ symbols at [math] dB and $5$ dB, respectively. For more details on our experiments, we refer the reader to [10], where the source codes of the detectors are also available.

IV-A Discussion on Relevance of Theorem 1

For each $n^{\prime}$ and SNR, we can evaluate the tightness of the MI values in Fig. 4 by first computing $\mathcal{P}$, and then determining an appropriate $\mu^{\prime}$ such that $\mathcal{P}\subseteq\mathcal{R}_{\mu^{\prime}}$. With that, (19) qualifies as an approximation with accuracy $\mu^{\prime}$. Although obtaining the performance profile $\mathcal{P}$ through exhaustive experiments is computationally challenging for large $n$, sampling techniques can be used to estimate $\mu^{\prime}$. For instance, at $n^{\prime}=50$ and $\mbox{SNR}=0\mbox{ dB}$, we have used the NN classifier to empirically compute the pairs $\{(p_{md|\bar{x}},1-p_{fa|\bar{x}})\}$ for $10000$ randomly chosen codewords, and have verified that more than $99\%$ of them lie inside $\mathcal{R}_{\mu^{\prime}}$ with $\mu^{\prime}=3\times 10^{-3}$.

As the second caveat, we recollect that Theorem 1 is applicable if $\gamma_{1},\gamma_{2}$ and $\sigma^{2}$ satisfy the conditions in Lemma 2. However, for arbitrary values of $\gamma_{1},\gamma_{2}$ and $\sigma^{2}$, we do not have a proof on the applicability of the upper bound in (13) for all $y^{n}\in\mathbb{R}^{n}$, nor we can verify (13) for a given $y^{n}\in\mathbb{R}^{n}$ due to intractable distributions. By acknowledging these limitations we caution the reader not to interpret the plots in Fig. 4 as exact MI values. Nevertheless, we have presented $\mathcal{M}^{approx}_{p_{fa}}$ as they serve as benchmarks for comparison with tighter approximations on $\mathcal{M}^{non-Genie}_{p_{md},p_{fa}}$ in future.