1
On the Detection of Passive Eavesdroppers in the
MIMO Wiretap Channel
Amitav Mukherjee, Member, IEEE, and A. Lee Swindlehurst, Fellow, IEEE
Abstract—The classic MIMO wiretap channel comprises a
passive eavesdropper that attempts to intercept communications
between an authorized transmitter-receiver pair, each node being
arXiv:1308.2357v1 [cs.IT] 11 Aug 2013
equipped with multiple antennas. In a dynamic network, it
is imperative that the presence of an eavesdropper be de-
termined before the transmitter can deploy robust secrecy-
encoding schemes as a countermeasure. This is a difficult task
in general, since by definition the eavesdropper is passive and
never transmits. In this work we adopt a method that allows
the legitimate nodes to detect the passive eavesdropper from the
local oscillator power that is inadvertently leaked from its RF
front end. We examine the performance of non-coherent energy
detection and optimal coherent detection, followed by composite
GLRT detection methods that account for unknown parameters.
Numerical experiments demonstrate that the proposed detectors
allow the legitimate nodes to increase the secrecy rate of the
MIMO wiretap channel.
Index Terms—MIMO wiretap channel, passive eavesdropper,
energy detection, GLRT.
I. I NTRODUCTION
The broadcast characteristic of the wireless propagation
medium makes it difficult to shield transmitted signals from
unintended recipients. This is especially true in multiple-input
multiple-output (MIMO) systems with multi-antenna nodes,
where the increase in communication rate to the legitimate
receiver is offset by the enhanced interception capability
of eavesdroppers. A three-terminal network consisting of a
legitimate transmitter-receiver pair and a passive eavesdrop-
per where each node is equipped with multiple antennas is
commonly referred to as the MIMO wiretap or MIMOME
channel. The extent of information leakage in such systems
is captured by the notion of secrecy capacity at the physical
layer, which quantifies the maximal rate at which a transmitter
can reliably send a secret message to the receiver, with the
eavesdropper being completely unable to decode it. Maxi-
mizing the achievable secrecy rate at the physical layer can
therefore complement encryption performed at higher layers
[1]. The secrecy capacity of the MIMO wiretap channel has
been studied in [2]-[4], for example.
In the burgeoning literature on the MIMO wiretap channel, a
number of transmit precoding techniques have been proposed
to improve the channel secrecy rate by exploiting knowledge
A. Mukherjee is with the Wireless Systems Research Lab of Hi-
tachi America, Ltd., Santa Clara, CA 95050-2639, USA (e-mail:
amitav.mukherjee@hal.hitachi.com).
A. L. Swindlehurst is with the Center for Pervasive Communications and
Computing, University of California, Irvine, CA 92697-2625, USA (e-mail:
swindle@uci.edu).
This work was presented in part at IEEE ICASSP 2012, and was supported
by the National Science Foundation under grant CCF-0916073.
of either the instantaneous realizations or statistics of the
channel to the eavesdropper [2]-[3]. However, the question of
how the legitimate transmitter acquires a passive eavesdrop-
per’s CSI has yet to be answered satisfactorily. The authors
have previously proposed precoding schemes for the MIMO
wiretap channel when the eavesdropper’s CSI is completely
unknown in [5], [6]. More importantly, it is imperative that
the presence of a passive eavesdropper be determined before
the transmitter can deploy robust secrecy-encoding schemes as
a countermeasure. This is a difficult task in a dynamic wireless
network, since by definition the eavesdropper is passive and
never transmits. To our best knowledge, the problem of
determining the potential presence of passive eavesdroppers
in the wiretap channel has not been addressed previously.
In this work we propose a scheme that allows the le-
gitimate nodes to detect the passive eavesdropper from the
local oscillator power that is inadvertently leaked from its
RF front-end even when in reception mode. This technique
was recently proposed in [7]–[9] for spectrum sensing in
single-antenna cognitive radios (CR) to avoid interfering with
primary receivers under AWGN channels. We generalize this
technique to MIMO channels in a wiretap scenario for a vari-
ety of detectors based on energy detection, matched filtering,
and composite tests. We then investigate how the proposed
detection algorithms allow the legitimate nodes to increase the
MIMO secrecy rate of the channel. The eavesdropper detection
problem is essentially analogous to very low-SNR multi-
antenna spectrum sensing in cognitive radio networks. While
the majority of prior work on multi-antenna CR spectrum
sensing aim to detect a single-antenna primary transmitter in
zero-mean white Gaussian noise, in this work we explicitly
consider the detection of a full-rank signal of interest in non-
zero-mean Gaussian noise.
The remainder of this work is organized as follows. The
MIMO wiretap channel with a passive eavesdropper is intro-
duced in Sec. II. Coherent and noncoherent methods of detect-
ing Eve’s presence are characterized in Sec. II-C. Composite
tests accounting for unknown noise and leakage parameters are
examined in Sec. IV. The optimization of Eve’s parameters
given knowledge of the tests to detect her presence are
briefly discussed in Sec. V, followed by numerical results and
conclusions in Sec. VI and Sec. VII, respectively.
Notation: We will use CN (c, Z) to denote a circularly
symmetric complex Gaussian distribution with mean c and
covariance matrix Z, and N (c, Z) for the real-valued counter-
part. Furthermore, we let E{·} denote expectation, (·)T is the
transpose, (·)H is the Hermitian transpose, ℜ represents the
real part, Tr{·} is the trace operator, rank(·) is the matrix rank,

diag{a} is a diagonal matrix with a on the main diagonal,
λi (A) is the ith ordered eigenvalue of A in descending
order, 2 F1 (·, ·; ·; ·) is the hypergeometric function, and I is
an identity matrix of appropriate dimension.
II. S YSTEM M ODEL
A. Network Model
We consider a multi-user network with an Na -antenna
transmitter (Alice), an Nb -antenna receiver (Bob), and an
unauthorized eavesdropper (Eve) with Ne antennas. When
Alice is transmitting to Bob and Eve is listening in the vicinity,
the received signals at Bob and Eve at time instant t are given
by
q
yb (t) = d−α
ab Hba x (t) + nb (t) (1)
p
ye (t) = d−α
ae Hea x (t) + ne (t) , (2)
where x (t) ∈ CNa ×1 is the confidential information sig-
nal, Hba ∈ CNb ×Na , Hea ∈ CNe ×Na are the determinis-
tic and invariant complex MIMO channels from Alice, the
distances from Alice to Bob and Eve are dab > 0 and
dae > 0, respectively, and α is the path-loss exponent.
The additive complex Gaussian noise vectors are assumed
to be independent, spatially uncorrelated, and
distributed as
nb (t) ∼ CN 0, σb2 I , ne (t) ∼ CN 0, σe2 I . An average


power constraintn is imposedo on Alice’s transmit covariance
H sl (t) = s1 (t) . . . sNe (t)
matrix Q = E x (t)x (t) in the form of Tr (Q) ≤ Pa .
Irrespective of the potential presence of Eve, both Alice and
Bob are assumed to have perfect knowledge of the main
channel Hba , which can be attained by the use of conventional
training methods. If the input signal x is drawn from a
Gaussian distribution, the instantaneous MIMO secrecy rate
[3] for fixed channels when Eve is present is given by
2
when in passive reception mode [10]. While the LO leakage
signal power is on the order of -50 to -90 dBm from a single
antenna port, the LO leakage signal is boosted when multiple
RF chains are present as in the MIMO wiretap setting, and is
consequently easier to detect.
Therefore, we assume that Alice periodically ceases data
transmission in order to allow both herself and Bob to indepen-
dently sense the radio environment, followed by a joint fusion
of their individual decisions. Since the sensing algorithm and
process is assumed to be identical at both Alice and Bob, to
avoid repetition we focus on the local detection process at Bob
in the sequel. The binary hypothesis test at Bob during these
‘silent’ periods is
q
H0 :yb (t) = d−α ab Hba wl (t) + nb (t)
(4)
q q
H1 :yb (t) = d−α be Hbe sl (t) + d−α
ab Hba wl (t) + nb (t)
where Hbe ∈ CNb ×Na is the complex MIMO leakage channel
from Eve to Bob who are separated by distance dbe . The LO
leakage signals from Alice and Eve are represented by wl (t)
and sl (t), respectively. Eq. (4) can also be used to model a
distributed network of single-antenna sensors that report their
observations over orthogonal channels to a fusion center in
order to detect the presence of Eve.
The aggregate LO leakage signal from Eve is
 T
. (5)
We model the LO leakage signal from Eve’s ith antenna port
as an unmodulated frequency tone [9]:
si (t) = Ai cos (ωt + θi (t)) , (6)
where Ai is the amplitude, ω is the LO frequency, and θi is an
arbitrary time-varying phase. Similarly, the LO leakage signal
 T
from Alice is wl (t) = w1 (t) . . . wNa (t)
 
H , where
Rs,i = log2 I + d−α σ −2
H QH

ab b ba ba 
  (3) wi (t) = Bi cos (ω̃t + ξi (t)) , (7)
H
− log2 I + d−α σ −2
H QH .

ae e ea ea 
where Bi is the amplitude, ω̃ is Alice’s LO frequency, and ξi
is an arbitrary phase coefficient.
Mixer
RF Amp ×
RF Amp × Eve B. Secrecy Rate Performance
We consider the following signal transmission model. The
Hea
RF Amp ×
overall data transmission period is split into blocks of T
~ LO channel uses. At the beginning of each block, Alice and Bob
Hbe
independently sense the radio environment for the presence
of Eve. If the consensus is that Eve is absent, then for the
Alice
Hba
Bob remaining T − 1 channel uses in that block Alice designs her
input covariance Q to maximize the conventional MIMO rate
to Bob via waterfilling [11]. If Eve is determined to be present,
Fig. 1. MIMO wiretap channel with RF front end of Eve highlighted. Alice acquires the statistics of her channel Hea and optimizes
Q by splitting her transmit resources between data and an
The wiretap channel is depicted in Fig. 1. The fundamental artificial jamming signal such that the expected value of the
procedure of detecting the passive node Eve is as follows. MIMO secrecy rate for that block is maximized [2]. The block
We assume all three nodes possess either heterodyne or duration T is assumed to be long enough in order to invoke
direct-conversion transceivers. A general impairment in such information-theoretic random coding arguments.
receivers is that a small portion of the local oscillator (LO) Define Pdc and Pf c as the overall consensus detection and
signal back-propagates to the antenna ports and leaks out, even false alarm probabilities derived via an arbitrary fusion rule
 3

from the local decisions at Alice and Bob. For the commonly For convenience we aggregate the samples into a (Nb × M )
used AND and OR decision fusion rules, Pdc can be defined observation matrix
as  
P1 P2 Yb = yb [0] . . . yb [M − 1] (12)

AND rule
Pdc = Q2 D D i

(8)
1 − i=1 1 − PD OR rule which follows a matrix-variate normal distribution [14] under
i both hypotheses:
where PD , i = 1, 2, are the local detection probabilities at
Alice and Bob that are derived in subsequent sections. If Eve Yb ∼ CN MA , σb2 I


is modeled as being present in a particular transmission block
under H0 (13)
Yb ∼ CN ME + MA , σb2 I under H1
with a prior probability β that is unknown to Alice/Bob, the
expected value of the MIMO secrecy rate for an arbitrary block where we define
is written as
MA = [mA [0], . . . , mA [M − 1]] (14)
R̄s = Rb Pdc (1 − β) + Rs Pdc β + (Rb − Re ) (1 − Pdc ) β ME = [mE [0], . . . , mE [M − 1]] . (15)
+ R̃b Pf c (1 − β) , (9)
where Rs is the ergodic MIMO secrecy rate, Re is the III. N ONCOHERENT AND C OHERENT D ETECTION
information rate leaked to Eve upon missed detection, and A. Energy Detection
R̃b is the sub-optimal rate to Bob when some resources are Energy detection (ED) is a low-complexity noncoherent
mistakenly allocated for secrecy encoding by Alice. technique that obviates the need to estimate the leakage
signal parameters and channels, and only requires an accurate
C. Eavesdropper Detection estimate of the background noise variance σb2 [12]. The ED
The authors in [7] mainly focus on the use of a coherent test statistic is given by
matched filter detector [12] for determining the presence of the

M−1
X 2
primary receiver at a single-antenna cognitive radio. However, TED (Yb ) = Tr YbH Yb = kyb [n]k . (16)
the matched filter approach requires phase synchronization n=0
at Bob as well as estimation of Hbe , which is exceedingly
The ED hypothesis test compares the test statistic to a thresh-
difficult given the very low LO leakage power. Park et
old η to determine the presence of Eve:
al. propose noncoherent envelope detection in the frequency
H1
domain by applying a discrete Fourier transform (DFT) to
TED (Yb ) ≷ η , (17)
the down-converted and sampled received signal [8], [9], also H0
in a single-antenna setting. In this work we focus on multi-
where η is determined by a pre-specified probability of false
antenna detection in the time domain, and assume that Eve’s
alarm constraint PF A .
LO frequency ω̃ (or a good estimate of it) is known a priori to
From (11), under both hypotheses TED (Yb ) has a noncen-
both legitimate terminals during downconversion to baseband.
tral chi-square distribution, since it is the sum of the squares of
If Eve employs a direct-conversion receiver, then as a worst-
2M Nb real and independent nonzero-mean Gaussian random
case scenario her LO frequency can be assumed to be known
variables:
exactly since it is optimal for her to set ω̃ = ω. The same is
σb2 ′ 2
true if all terminals have an identical heterodyne architecture. H0 : TED (Yb ) ∼ 2 χ2MNb (λ0 )
σb2 ′ 2
(18)
After downconverting and sampling, the hypothesis test at H1 : TED (Yb ) ∼ (λ1 )
2 χ2MNb
Bob based on M discrete-time vector observations is
with associated noncentrality parameters
H0 : yb [n] = mA [n] + nb [n] ,
(10)
λ0 = 2 σb2 Tr ℜ MTA MA



H1 : yb [n] = mE [n] + mA [n] + nb [n] ,

 n T
o
for n = 0, . . . , M − 1, where λ1 = 2 σb2 Tr ℜ (ME + MA ) (ME + MA ) ,
q
mA [n] = d−α
ab Hba wd [n] respectively. Under the null hypothesis, TED (Yb ) has the
q density function
mE [n] = d−α
be Hbe sd [n]
/
!
2
λ0 +2t σb
T −  M N2b −1
B1 e(j ω̃n+ξ1 [n]) . . . BNa e(j ω̃n+ξNa [n])
 2
s !
wd [n] = e

2t 2tλ0
T fT (t; H0 ) = IMNb −1
A1 e(jωn+θ1 [n]) . . . ANe e(jωn+θNa [n]) σb2 σb2 λ0 σb2

sd [n] = .
The deterministic MIMO channels Hba and Hbe are assumed and the probability of false alarm is calculated as
to be constant during the detection process. It is assumed that s !
Bob’s own leakage signal is removed and does not contaminate
p 2η
PF A = QMNb λ0 , , (19)
the detection process [9]. The received signal has the following σb2
multivariate normal distributions:
R∞ t2 +a2
yb [n] ∼ CN mA [n] , σb2 I where Qk (a, b) = a1−k b tk e− 2 Ik−1 (at)dt is the



under H0 (11)
yb [n] ∼ CN mE [n] + mA [n] , σb2 I under H1 generalized Marcum Q-function, and Ik is the modified Bessel
 4

function of the first kind of order k [12], [15]. Similarly, the replica-correlator or equivalently a matched filter, which is the
probability of detection is expected outcome for detecting a known complex determinis-
s ! tic signal in Gaussian noise [12].
p 2η Next, we note that the test statistic is distributed as
PD = QMNb λ1 , . (20)
σb2 
σ2  H 
H0 : Top (Yb ) ∼ N ℜ Tr MH

E MA , 2b Tr ME ME
The value of the threshold η that corresponds to a particular 
σb2  H 
H1 : Top (Yb ) ∼ N ℜ Tr MH

PF A can be computed by empirically evaluating the Marcum E M 1 , 2 Tr M E M E
Q-function, or from the approximate inversion of the Marcum
Q-function [15]. from which we can derive the probabilities of detection and
false alarm as
B. Optimal Detector
  H

ε − ℜ Tr M MA
As an alternative to energy detection, we now consider the PF A = Q  q 2  E  (25)
σb H

optimal Neyman-Pearson detector when all parameters of the 2 Tr ME ME
leakage signals are assumed to be known to Bob. While un- 

ε − ℜ Tr MH

realizable in practice, the optimal coherent detector provides E M1
PD = Q  q 2  . (26)
an upper bound on the detection performance of any possible σb
Tr M H M

2 E E
test. From (11)-(13), the likelihood function under the null
hypothesis is It is evident that the threshold value ε that corresponds to a
M−1
Y targetqfalse-alarm probability can be computed from (25) as
f (Yb ; H0 ) = f (yb [n] ; H0 ) σb2 −1
(PF A ) + ℜ Tr MH
 H 

ε= 2 Tr ME ME Q E MA .
n=0
M−1
" #
H
Y 1 (yb [n] − mA [n]) (yb [n] − mA [n])
= exp − IV. D ETECTION U NDER U NKNOWN PARAMETERS
2
n=0 (πσb )
Nb σb2
n o Thus far we have studied the energy detector, which does
Tr (Yb − MA )H (Yb − MA )

1 not require any information of the leakage parameters, and the
= exp − 
MN
(πσb2 ) b σb2 optimal replica-correlator which assumes all parameters are
known. To do better than ED, we can treat the leakage signal
with the corresponding log-likelihood function and channel parameters of Eve as unknown deterministic
L0 (Yb ) = −M Nb ln πσb 2

parameters to be estimated at Bob, and pose generalized
likelihood ratio tests (GLRT) for these cases. The GLRT
1 n o (21)
− 2 Tr (Yb − MA )H (Yb − MA ) . is a constant false-alarm rate detector which has featured
σb prominently in the spectrum sensing literature [16]-[23], with
Define M1 , ME + MA . Under the alternative hypothesis various assumptions about the signal model. [16]-[19] consider
H1 , a similar analysis yields the detection of rank-1 signals, [21] considers a test statistic
based on the DFT of the received signal, and no performance
1
f (Yb ; H1 ) = MN
analysis of the GLRT is given in [20], [22]. Alternatives to
(πσb2 ) b GLRTs with unknown parameters are the blind test in [24]
n o
H
 
Tr (Yb − M1 ) (Yb − M1 ) based on non-parametric empirical characteristic functions,
× exp −   , and a heuristic test statistic based on the cross-correlation
σb2 among signals at all antenna pairs [25]. However, the test in
[24] cannot be characterized analytically, and [25] assumes a
2 particular channel autocorrelation model such as Clarke’s or


L1 (Yb ) = −M Nb ln πσb
1 n o Jake’s, which is not applicable when the signal of interest is
H
− 2 Tr (Yb − M1 ) (Yb − M1 ) .(22) a very low power sinewave as in our case. In the sequel, we
σb
continue to assume that the leakage channel Hba and related
The optimal Neyman-Pearson test compares the log- signal parameters from Alice are completely known at Bob
likelihood ratio to a threshold that corresponds to a particular [11], and possibly to Eve as well.
PF A :
H1
L1 (Yb ) − L0 (Yb ) ≷ ε′ . (23)
H0 A. Unknown noise variance
Simple manipulations lead to the following test statistic: We begin with the case where both the effective leakage

H1 channels are changing slowly enough to have been determined
Top (Yb ) = Tr ℜ MH ≷ ε,

E Yb (24) in previous epochs, but the background noise variance in the
H0
current test epoch σb2 is unknown, possibly due to time-varying
where ε = 12 σb2 ε′ + 0.5 Tr MH H

E (ME + MA ) + MA ME . interference. Following the standard derivation of the GLRT
Therefore, the optimal detection rule is observed to be a [12], we first compute the maximum likelihood estimates
 5

(MLEs) of σb2 under the two competing hypotheses from the have
derivatives of (21)-(22): ( P
Nb
)
i=1 γi
Pr {TG1 (Yb ) ≥ η} ≈ Pr ≥η (34)
n o
H
Tr (Yb − MA ) (Yb − MA ) PNb
ψi γi
2 i=1
σ̂b|H = (27) ( )
0
M Nb N b γ1
≤ Pr ≥η (35)
n o
Tr (Yb − M1 )H (Yb − M1 ) PNb
ψi γi
2 i=1
σ̂b|H1 = . (28) ( )
M Nb N b γ1
≤ Pr PNb ≥η (36)
These MLEs are also applicable to the energy detector in III-A ψNb γi
i=1
for the case where the noise power is unknown a priori, since
the ED test threshold is a function of σb2 .
.P
where (34) follows from (33). Let T0 , Nb γ1 i γi repre-
The log-GLRT is then obtained by substituting (27)–(28) sent the scaled largest eigenvalue of W divided by its trace.
into (21)–(22): A number of different results are available in the literature

2
 
2
 H1 for exact and approximate probability distributions of T0 . We
TG1 (Yb ) = L1 Yb ; σ̂b|H 1
− L0 Y b ; σ̂b|H 0
≷ η1 (29) adopt the approximate CDF in [28, eq. 27] due to its accuracy
H
n o 0 and relatively simple closed-form expression, which has the
H
Tr (Yb − MA ) (Yb − MA ) H1 form
= n o ≷ eη1 /MNb .
H
Tr (Yb − M1 ) (Yb − M1 ) H0 FT0 (y) = c (B (y) − B (1)) , y ∈ [1, ∞] (37)
(30)
−k

η1 /MNb
where c = Γ(m/2)(N b ̟)
kΓ(m/2−k)Γ(k) , m = 2M Nb , k and
Determining the appropriate threshold η , e to meet ̟ are constants that are functions of the matrix di-
a target PF A requires the pdf of the GLRT test statistic under mensions M and Nb [28, eqs. 12,13], and B (x) =
the null hypothesis H0 . Let 
x k
2 F1 k, 1 + k − 0.5m; k + 1; Nb ̟ x . The desired upper
X , Yb − MA (31) bound on PF A in (36) then simplifies to
H H
W , XX ; W1 , (X − ME ) (X − ME ) (32) ( )
N b γ1
Pr PNb ≥ η = 1 − FT0 (ψNb η) . (38)
based on which we can rewrite ψNb i=1 γi
Tr {W}
TG1 (Yb ) = . To compute the probability of detection for the GLRT with
Tr {W1 }
unknown noise variance, we must determine the distribution
Under the null hypothesis, we have X ∼ CN 0, σb2 I and thus


of T0 under the alternative hypothesis H1 . Returning to (30),
W is a central Wishart matrix. Clearly, the matrix
(X − ME ) we now define
is distributed as (X − ME ) ∼ CN −ME , σb2 I under H0 , X , Yb − M1 ,
thus W1 in the denominator of TG1 (Yb ) has a noncentral
Wishart distribution. such that
Therefore, under hypothesis H0 TG1 is the ratio of two Tr {W1 }
TG1 (Yb ) = .
dependent random variables: the trace of the central Wishart Tr {W}
matrix W and trace of the noncentral Wishart matrix W1 .
Next, we observe X ∼ CN 0, σb2 I , which implies that W =


Since this does not correspond to a known distribution and
no straightforward method1 exists to derive the exact pdf, we XXH in the denominator of TG1 (Yb ) is a central Wishart ma-
approximate the distribution of TG1 as follows. For tractability, trix. Now, the
matrix X + ME is distributed as (X + ME ) ∼
H
we first approximate W1 with a spatially-correlated central CN ME , σb2 I , such that W1 = (X + ME ) (X + ME )
Wishart matrix CCH , where C = Ψ1/2 X, which has ap- in the numerator of TG1 (Yb ) is a non-central Wishart ma-
proximately the same first- and second-order moments as W1 trix. Therefore, under hypothesis H1 , TG1 is the ratio of
[26], [27]. This yields Ψ = I + M −1 ME MH two dependent random variables: the trace of the noncentral
E as the effective
correlation matrix. Since the detection of a weak LO leakage Wishart matrix W1 and trace of the central  Wishart matrix
signal requires that the number of samples M be many orders W. Similar to (33) we set Tr {W} ≃ Tr ΨXXH , where
of magnitude larger than Nb , it is sufficient to consider the Ψ = I + M −1 ME MH E is the effective correlation matrix.
case of rank(Yb ) = rank(X) = Nb . Furthermore, We can then repeat the preceding steps involved in the
computation of PF A with minor modifications, to obtain the
XN b
Tr {W1 } ≃ Tr ΨXXH ≤

λi (Ψ) λi (W) (33) following lower bound on the detection probability:
i=1
 
where the eigenvalue inequality is due to [30, Thm. 2]. Defin- ςNb
Pr {TG1 (Yb ) ≥ η | H1 } ≥ FT0 , (39)
ing the ordered eigenvalues γi = λi (W) and ψi = λi (Ψ), we η

1 The trace of a non-central Wishart matrix has a distribution characterized where ςNb is the smallest eigenvalue of Ψ, and FT0 (·) is
by zonal polynomials or infinite series. defined in (37).
 6

B. Unknown noise variance and leakage channel of Eve Alice/Bob and the number of antennas Ne : decreasing dae or
We now consider the most general case where the unknown increasing Ne enhances both her interception rate as well as
parameters are the noise the likelihood of being detected.
 variance and Eve’s leakage  ampli-
tude and phase, i.e., σb2 , Hbe , {Ai }N e
, {θ [n]} . Recall First consider the impact of Eve’s distance from Alice and
i=1 i i,n
Bob for a given Ne . Let us define the instantaneous leakage
that Alice and Bob are cooperative nodes and can exchange
rate from Alice to Eve as
estimates of Alice’s leakage parameters, which we continue to  
assume are known at Bob. Since frequency ω is known, we Re = log2 I + Hea QHH −1 
ea Ze  , (45)

can rewrite (15)as ME = M′ E D, where M′ E is unknown
jω
and D = diag 1, e , . . . , e jω(M−1)

is a known full-rank which is the second term of the MIMO secrecy rate expression
matrix. Direct differentiation of (30) yields the MLE (cf. [31]) in (3). It is assumed that Eve is interested in maintaining a
threshold R̄e for the instantaneous or average leakage rate.
M̂′E = (Yb − MA ) DH . (40) For Rayleigh fading channels, a Gaussian approximation for
H1 the MIMO mutual information in the large-antenna regime [34,
The log-GLRT is then given by TG2 (Yb ) ≷ eη2 /MNb , Thm. 3] results in the following average leakage rate:
H0
where Pa
EHea {Re } ≃ d−α ae Ne log e.
Na 2
n o
H
Tr (Yb − MA ) (Yb − MA )
TG2 (Yb ) =  H  . an example, the eavesdropper can seek to minimize the
As
Tr ′
Yb − M̂E D − MA ′
Yb − M̂E D − MA probability of being detected, subject to a minimum average
leakage rate constraint:
(41)
Substituting (40) into (41), we have (P1) : min Pdc
dae ,dbe
n o (46)
H
Tr (Yb − MA ) (Yb − MA ) s.t. E{Re } ≥ R̄e
TG2 (Yb ) = n o . (42)
Tr MA H MA This problem has a straightforward solution. An average
leakage rate constraint of R̄e requires
Therefore, we can utilize existing expressions for the distribu-  −1/α
tion of the trace of a central and non-central Wishart matrix to R̄e Na Pa
dae ≤ .
compute the exact PF A and PD of the above test, respectively. Ne log2 e
The trace of a central Wishart matrix follows a (scaled) chi- Since the leakage rate constraint is independent of dbe , and
squared distribution, thus since Pdc is decreasing with respect to dae , the optimal value
  of dae is attained when the leakage rate constraint is met with
PF A = 1 − P M Nb , σb−2 Tr MH η2 /MNb

A MA e (43)
equality. The optimal value of dbe is then the furthest possible
∗
where P (·, ·) is the regularized Gamma function. Under H1 , distance from Bob for this optimal dae . Geometrically, Eve’s
(42) is the scaled trace of a non-central Wishart matrix optimal location is the point of intersection of the circle of
∗
(equivalent to a weighted sum of independent non-central chi- radius dae centered at Alice and the line joining Alice and
squared variables), the exact distribution of which is given in Bob.
[32]. Thus, The LO leakage phenomenon essentially precludes the use
∞   of fast antenna switching at Eve, therefore she must decide
X 1  H η2 /MN on how many antennas are to be deployed at the initiation
PD = 1− ck P M Nb + k, Tr MA MA e b
2λσb2 of the eavesdropping attack. A rough assessment of her risk-
k=0
(44) reward tradeoff can be obtained by simply enumerating R̄s
where coefficients ck are computed recursively based on [32, for the various possible values of Ne . Further insight can be
eqs. 2.6,2.9], and 0 < λ < ∞ is arbitrary. A simpler obtained by analyzing the behavior of Pdc , Re , and R̄s as Ne
expression can be obtained if desired by approximating the varies: does the rate at which Pdc increases outweigh the rate
above trace with a single non-central chi-squared variate of of gain in Re or vice versa? This exercise is carried out via
the same first moment [33]. simulations in Sec. VI.

V. E AVESDROPPING S TRATEGIES VI. N UMERICAL R ESULTS

We have thus far proposed and characterized various statisti-
cal tests to determine the presence of a passive MIMO eaves-
dropper. In the event that the eavesdropper is a malevolent
adversary, she may take evasive measures to avoid detection
while at the same time attempting to intercept as much
information as possible. This implies that Eve is omniscient
in the sense that she is able to estimate the relative locations
of Alice/Bob and the leakage detection scheme in place. The
key parameters under Eve’s control are her location relative to
We present simulation results obtained by averaging over
1000 i.i.d. Rayleigh channel fading instances for several net-
work scenarios. In each instance the eavesdropper is present
with probability β = 0.5. Unless stated otherwise, we set the
number of antennas as Na = Nb = Ne = 4, the distance
between Alice and Bob is assumed to be dab = 10m, and
dae = dbe . The leakage amplitude is set to -50 dBm/antenna
with an IF frequency of 200 kHZ and unit noise power for all
users, and the number of samples is fixed at M = 105 .
 7

0
ident that the eavesdropper detection schemes outperform the
10
non-adaptive strategy by reducing the unnecessary allocation
of resources for secure transmission when the eavesdropper is
absent.
Probability of Detection

6 Pdc (AND)
−1
10 ED Average leakage R̄e
MF 5
GLRT 1 Secrecy rate R̄s
GLRT 2
4
MF (theor.)
GLRT 1 (theor.)
GLRT 2 (theor.) 3
ED (theor.)
−2
10 2
−2 −1 0
10 10 10 d* = 4.5m
ae
Probability of False Alarm
1

Fig. 2. ROC performance of various eavesdropper detectors. 0

3 3.5 4 4.5 5 5.5 6 6.5 7 7.5 8

Eavesdropper distance from Alice d (m)
ae
The empirical and theoretical receiver operating charac-
teristic (ROC) curves of the detection schemes described in Fig. 4. Rates and joint detection probability as a function of distance dae .
Sec. III and Sec. IV are displayed in Fig. 2. GLRT 1 and
GLRT 2 denote the composite tests described in Sec. IV-A In Fig. 4, the eavesdropper is moved along a line parallel
and Sec. IV-B, respectively. The detection probabilities shown to the line between Alice and Bob, with dab = 9m being
here are the local metrics at Bob, and the theoretical results fixed. It is assumed Eve has a desired leakage rate target of
are generally in good agreement with simulations. The energy R̄e = 3, which translates into an optimal distance of roughly
detector fails to distinguish between the null and alternative dae = 4.5m according to (46). This predicted distance is
hypotheses and is virtually unusable, even under the assump- quite close to the observed value of dae corresponding to
tion of a perfectly known noise variance σb2 . The GLRTs are the empirical rate R̄e = 3. Furthermore, the joint detection
both more robust and perform much closer to optimal MF probability using MF is at its lowest value around this spatial
detection as compared to ED. The joint detection probability location, which is intuitive since increasing dae brings Eve
Pdc in (8) will by definition exhibit similar trends. closer to Bob, thus R̄s is seen to increase with dae due to the
combined factors of improved Pdc and diminishing leakage
Re . From the perspective of the legitimate nodes, increasing
1.4
MF the number of observation samples M to further improve Pdc
GLRT 2 detracts from the time available for data transmission, while
1.3
Non−adapt.
increasing Na or Nb will improve the interception capability
1.2
of Eve. On the other hand the interception capability of Eve
Secrecy rate (bits/s/Hz)

1.1 is degraded as dae grows; the interplay of these factors has

interesting implications for the eavesdropper when she can
1 choose where to position herself.
0.9
Fig. 5 highlights the joint detection probability based on
MF, along with leakage rate Re and average secrecy rate R̄s ,
0.8 as Ne varies for fixed Na = Nb = 2. In a conventional
MIMO system the received mutual information is always non-
0.7
decreasing in the number of receiver antennas, and this is
borne out by the behavior of Re . On the other hand, in our
5 10 15 20 25
Alice transmit power P (dB) wiretap setting an increase in Ne also boosts the ability of the
a
legitimate nodes to detect the eavesdropper, as exemplified by
Fig. 3. Ergodic secrecy rate versus transmit power Pa . Pdc . As a result, the average secrecy rate actually increases
as Ne grows from two to five, while ultimately approaching
Fig. 3 depicts R̄s versus Alice’s total power constraint Pa zero in the regime where Eve has four times as many antennas
for ED and GLRT 2 detectors, as well as a non-adaptive as Alice and Bob. Thus, an interesting tradeoff exists for Eve
scheme which pessimistically assumes that Eve is always when choosing how many antennas to activate for wiretapping.
present and always has Alice allocate a fraction of power for
artificial noise [2]. Eve is located 10m away from both legiti- VII. C ONCLUSIONS
mate terminals. The local eavesdropper detection decisions at In the MIMO wiretap channel, it is critical that the presence
Alice and Bob are combined using an OR fusion rule. It is ev- of a passive eavesdropper be determined so as to enable robust

1
Pdc (OR)
0.9
Re w/o AN
0.8
R̄s
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0 7, pp. 2835-2839, July 2006.
2 3 4 5 6 7 8 [18] J. Sala-Alvarez, G. Vazquez-Vilar, and R. López-Valcarce, “Multi-
Eavesdropper antennas N
e antenna GLR detection of rank-one signals with known power spectrum
Fig. 5. Joint detection probability and leakage/secrecy rates versus number
of eavesdropper antennas.
secrecy-encoding schemes as a countermeasure. In this work
we studied the performance of methods in which the legitimate
nodes attempt to detect the eavesdropper from the local
oscillator power that is inadvertently leaked from its RF front
end. We analyzed the performance of non-coherent energy
detection as well as optimal coherent detection to obtain
lower and upper limits on the achievable detection probability.
Subsequently, two robust detectors based on GLRTs were
derived to account for cases with unknown leakage and noise
parameters. We then showed how the proposed detectors allow
the legitimate nodes to increase the MIMO secrecy rate of the
channel. Issues of interest for further study include the design
of sequential detectors for optimizing the sensing duration
used to detect potential eavesdroppers.
R EFERENCES
[1] A. Mukherjee, S. A. A. Fakoorian, J. Huang and A. L. Swindlehurst,
“Principles of physical-layer security in multiuser wireless networks: A
survey,” 2013 [Online]. Available at http://arxiv.org/pdf/1011.3754v2.
[2] S. Goel and R. Negi, “Guaranteeing secrecy using artificial noise,” IEEE
Trans. Wireless Commun., vol. 7, no. 6, pp. 2180-2189, Jun. 2008.
[3] A. Khisti and G. Wornell, “Secure transmission with multiple antennas
II: The MIMOME wiretap channel”, IEEE Trans. Inf. Theory, vol. 56,
no. 11, pp. 5515-5532, Nov. 2010.
[4] F. Oggier and B. Hassibi, “The secrecy capacity of the MIMO wiretap
channel,” IEEE Trans. Inf. Theory, vol. 57, no. 8, pp. 4961-4972, Aug.
2011.
[5] A. Mukherjee and A. L. Swindlehurst, “Fixed-rate power allocation
strategies for enhanced secrecy in MIMO wiretap channels,” in Proc.
IEEE SPAWC, pp. 344-348, Jun. 2009.
[6] A. Mukherjee and A. L. Swindlehurst, “Robust beamforming for secrecy
in MIMO wiretap channels with imperfect CSI,” IEEE Trans. Signal
Process., vol. 59, no. 1, pp. 351-361, Jan. 2011.
[7] B. Wild and K. Ramchandran, “Detecting primary receivers for cognitive
radio applications,” in Proc. IEEE Int. Symp. DySPAN, pp. 124-130, Nov.
2005.
[8] S. Park, L. E. Larson, and L. B. Milstein, “Hidden mobile terminal
device discovery in a UWB environment,” in Proc. IEEE Int. Conf. Ultra-
Wideband, pp. 417-421, Sep. 2006.
[9] S. Park, L. E. Larson, and L. B. Milstein, “An RF receiver detection
technique for cognitive radio coexistence,” IEEE Trans. Circuits & Syst.-
II, vol. 57, no. 8, pp. 652-656, Aug. 2010.
[10] N. Hamilton, “Aspects of direct conversion receiver design,” in Proc.
Int. Conf. HF Radio Syst. Techn., pp. 299-303, July 1991.
[11] A. Mukherjee and A. L. Swindlehurst, “Detecting passive eavesdroppers
in the MIMO wiretap channel,” in Proc. of IEEE ICASSP, Kyoto, Japan,
Mar. 2012.
8
[12] S. M. Kay, Fundamentals of Statistical Signal Processing vol. II-
Detection Theory. Prentice Hall, 1998.
[13] A. Singh, M. R. Bhatnagar, and R. K. Mallik, “Cooperative spectrum
sensing in multiple antenna based cognitive radio network using an
improved energy detector,” IEEE Commun. Lett., vol. 16, no. 1, pp. 64-67,
Jan. 2012.
[14] A. T. James, “Distributions of matrix variates and latent roots derived
from normal samples,” Ann. Math. Statist., vol. 35, pp. 475-501, June
1964.
[15] C. Helstrom, “Approximate inversion of Marcum’s Q-function,” IEEE
Trans. Aero. Sys., vol. 34, pp. 317-319, Jan. 1998.
[16] A. Taherpour, M. Nasiri-Kenari, and S. Gazor, “Multiple antenna spec-
trum sensing in cognitive radios,” IEEE Trans. Wireless Commun., vol.
9, pp. 814-823, Feb. 2010.
[17] O. Besson, S. Kraut, and L. L. Scharf, “Detection of an unknown rank-
one component in white noise,” IEEE Trans. Signal Process., vol. 54, no.
in white noise with unknown spatial correlation,” IEEE Trans. Signal
Process., vol. 60, no. 6, pp. 3065-3078, July 2012.
[19] P. Wang, J. Fang, N. Han, and H. Li, “Multiantenna-assisted spectrum
sensing for cognitive radio,” IEEE Trans. Veh. Technol., vol. 59, no. 4,
pp. 1791-1800, May 2010.
[20] R. Zhang, T. J. Lim, Y.-C. Liang, and Y. Zeng, “Multi-antenna based
spectrum sensing for cognitive radios: A GLRT approach,” IEEE Trans.
Commun., vol. 58, no. 1, pp. 84-88, Jan. 2010.
[21] J. K. Tugnait, “On multiple antenna spectrum sensing under noise
variance uncertainty and flat fading,” IEEE Trans. Signal Process., vol.
60, no. 4, pp. 1823-1832, Apr. 2012.
[22] D. Ramrez, G. V.-Vilar, R. L.-Valcarce, J. Va, and I. Santamara, “De-
tection of rank-P signals in cognitive radio networks with uncalibrated
multiple antennas,” IEEE Trans. Signal Process., vol. 59, no. 8, pp. 3764-
3774, Aug. 2011.
[23] E. Soltanmohammadi, M. Orooji, and M. Naraghi-Pour, “Spectrum
sensing over MIMO Channels using generalized likelihood ratio tests,”
IEEE Signal Process. Lett., vol. 20, no. 5, pp. 439-442, May 2013.
[24] L. Shen, H. Wang, W. Zhang, and Z. Zhao, “Multiple antennas assisted
blind spectrum sensing in cognitive radio channels,” IEEE Commun. Lett.,
vol. 16, no. 1, pp. 92-94, Jan. 2012.
[25] M. Orooji, R. Soosahabi, and M. Naraghi-Pour, “Blind spectrum sensing
using antenna arrays and path correlation,” IEEE Trans. Veh. Technol., vol.
60, no. 8, pp. 3758-3767, Oct. 2011.
[26] W. Y. Tan and R. P. Gupta, “On approximating the non-central Wishart
distribution by central Wishart distribution. a Monte Carlo study,” Com-
munications in Statistics - Simulation and Computation, vol. 11, no. 1,
pp. 47-64, 1982.
[27] M. Matthaiou, M. McKay, P. Smith, and J. Nossek, “On the condition
number distribution of complex Wishart matrices,” IEEE Trans. Commun.,
vol. 58, no. 6, pp. 1705-1717, June 2010.
[28] L. Wei and O. Tirkkonen, “Analysis of scaled largest eigenvalue based
detection for spectrum sensing,” in Proc. IEEE ICC, Kyoto, Japan, 2011.
[29] A. Kortun, M. Sellathurai, T. Ratnarajah, and C. Zhong, “Distribution
of the ratio of the largest eigenvalue to the trace of complex Wishart
matrices,” IEEE Trans. Signal Process., vol. 60, no. 10, pp. 5527-5532,
Oct. 2012.
[30] F. Zhang and Q. Zhang, “Eigenvalue inequalities for matrix product,”
IEEE Trans. Autom. Control, vol. 51, no. 9, pp. 1506-1509, Sep. 2006.
[31] O. Besson, L. L. Scharf, and F. Vincent, “Matched direction detectors
and estimators for array processing with subspace steering vector uncer-
tainties,” IEEE Trans. Signal Process., vol. 53, no. 12, pp. 4453-4463,
Dec. 2005.
[32] S. Kourouklis and P. G. Moschopoulos, “On the distribution of the trace
of a noncentral Wishart matrix,” Metron, vol. 43, no. 2, pp. 85-92, 1985.
[33] K. E. Muller and C. N. Barton, “Approximate power for repeated-
measures ANOVA lacking sphericity,” Journ. American Statistical Assoc.,
vol. 84, no. 406, pp. 549-555, June 1989.
[34] B. M. Hochwald, T. L. Marzetta, and V. Tarokh. “Multi-antenna channel
hardening and its implication for rate feedback and scheduling,” IEEE
Trans. Inf. Theory, vol. 50, no. 9 , pp. 1893-1909, Sep. 2004.