Pilot Distortion Attack and Zero-Startup-Cost Detection in Massive MIMO Network: From Analysis to Experiments

Accurate channel state information (CSI) is a key requirement for massive multiple-input multiple-output to achieve multi-fold increases in throughput and secrecy rate. Consequently, an adversary targeting the channel sounding process has the potential to significantly degrade performance. In this paper, we first present and model the pilot distortion attack, a simple but devastating jamming strategy in which the adversary distorts the access point's (AP's) CSI measurement of even a single client leading to denial of service for all clients associated with the AP. We then propose multiple-antenna carrier frequency offset estimate (MACE) as a countermeasure that exploits the AP's antenna array to detect jamming with zero startup cost and zero additional network overhead. Our key insight is that with multiple antennas, the AP's variance estimator of client carrier frequency offset significantly increases when there are jamming signals present. We build a test bed with a 72-antenna AP and collect over 3 000 000 over-the-air transmissions. Our results show that a single-antenna adversary jamming no more than 1/60 of the time and having no more transmit power than any client can cause over 23% reduction of achievable rate of all clients. Moreover, by setting a single detection threshold, MACE can achieve 0.97 true positive at 0.01 false positive for various client/adversary locations and for a wide range of signal-to-noise ratio (SNR) (5 ~35 dB) and signal-to-interference ratio (SIR) (-5 ~35 dB) with SNR - SIR ≥ dB.