Jammer Detection by Random Pilots in Massive MIMO Spatially Uncorrelated Rician Channels Jammer Detection by Random Pilots in Massive MIMO Spatially uncorrelated Rician Channels Giang Quynh Le Vu Facu[.]
2021 8th NAFOSTED Conference on Information and Computer Science (NICS) Jammer Detection by Random Pilots in Massive MIMO Spatially-uncorrelated Rician Channels Hung Tran Giang Quynh Le Vu Kien Trung Truong Undergraduate Faculty Faculty of Computer Science Faculty of Information Technology Fulbright University Vietnam Phenikaa University National Academy of Education Management Ho Chi Minh city, Vietnam Hanoi, Vietnam Hanoi, Vietnam Email: hung.tran@phenikaa-uni.edu.vn Email: kien.truong@fulbright.edu.vn Email: quynhgiang81@gmail.com Abstract—Pilot contamination is a major problem affecting the secrecy capacity of communication systems The jammer is difficult to detect This issue is also linked to numerous research projects In this study, the authors propose a pilot attack detection method with a high detection probability and a reduced false-alarm probability in Massive MIMO Spatiallyuncorrelated Rician Channels Index Terms—Massive MIMO, physical layer security, Rician fading, eavesdropper detection, jammer detection I I NTRODUCTION Massive Multiple-Input Multiple-Output (MIMO) is a significant transmission technology used in both 5th Generation (5G) New Radio (NR) networks and 6th Generation (6G) networks [?], [1]–[4] In such systems, a base station (BS) with a higher number of antennas simultaneously supports one or more antenna users Previous research has shown that if the number of antennas at the base station is big enough, the channels between the BS and the users are orthogonal to each other under certain situations, but this does not negate the impacts of noise and co-channel interference This orthogonality of the transmission channels, in particular, makes Massive MIMO systems with Rayleigh fading extremely safe at the physical layer [5], [6] Unauthorized devices can influence the security, integrity, and availability of information in ways (passive eavesdropper and jammer) because of the features of the radio environment These ways show up in the following studies: [5], [7]–[11] Eavesdroppers and jammers use pilot contamination as one way of listening to and trying to decode the transmitter’s signal This has a negative influence on legal communication networks, even disrupting them The detection jammers in Massive MIMO uncorrelated Rician fading channels were the subject of this study It should be noted that practically all prior studies of systems with one passive eavesdropper assumed Rayleigh fading channels Because they incorporate a Line-Of-Sight component, the Rician fading channels in this study are theoretically more generic than the Rayleigh fading channels [12] In [13], [14] the authors provided the analysis of the secrecy capacity analysis of the point-to-point transmission systems with a finite number of antennas In [15] We, also investigated a way for detecting the existence of Eavesdropper, who induced channel estimation jamming utilizing the contamination pilot 978-1-6654-1001-4/21/$31.00 ©2021 IEEE training approach Different from the methods in [7], [15] where only two pilots are selected as N-PSK, in this study we use the method of randomly selecting a pair of pilots from a set of pilots which is phase-shift keying N-PSK This choice makes it difficult for jammers to correctly predict the user’s pilots and pretend to be the user This makes it easy for the system to detect jammers and reduces the false-alarms probability As pilot symbols that are transmitted by random, we use phase-shift keying (N -PSK) Jammer’s existence was detected in the scalar product between the received vectors The remainder of this paper is organized as follows Section I is Introduction II introduces the system model We present a detection procedure based on random training pilots in the presence of received noise, as well as the construction of detection regions, in Section III The simulation results are presented in Section IV, and the paper is wrapped up in Section V Notation: a is scalar, a is vector, A is matrix, [A]i,j represents (i, j), AH , is Hermitian matrix transposed, E[˙] is main value II S YSTEM M ODEL We study a network with a single-cell single-user massive multiple-input multiple-output (MIMO) system where a base station A communicates with a legitimate user terminal B in the presence of an illegitimate user terminal J, also known as a jammer, as illustrated in Fig For notation convenience, denote X = {B, J}, which is the index set of user terminals The base station A is equipped with M antennas, where M ≫ 2, while both the user terminals are single antenna Assume the system operates in the halfduplex time division duplexing (TDD) mode, where the base station and the user terminals cannot transmit and receive at the same time Moreover, the uplink transmission and the downlink transmission happen in the same frequency We assume frequency-flat block-fading channel model where channel coefficients keep unchanged during the duration of each radio frame and change independently frame-by-frame Let hX,k ∈ CM ×1 be the uplink channel coefficient vector from user terminal X ∈ X to base station A during radio frame k Assume that channel reciprocity is perfect, thus 1×M hH is the downlink channel coefficient vector from X,k ∈ C the base station to user terminal X ∈ X 440 2021 8th NAFOSTED Conference on Information and Computer Science (NICS) given by √ √ yk,ℓ = pB hB,k sB,k,ℓ + αk,ℓ pJ hJ,k sJ,k,ℓ + nk,ℓ (1) Let fk,ℓ ∈ CM ×1 be the equivalent channel coefficient vector, which is defined as √ √ fk,ℓ = pB hB,k + αk,ℓ pJ hJ,k sk,ℓ (2) We can rewrite yk,ℓ as yk,ℓ =fk,ℓ sB,k,ℓ + nk,ℓ Fig A diagram depicting the geometry of the investigated system model, in which a base station A connects with a legitimated user terminal B and illegal user terminal J We assume that the transmission between the legitimate user B and the base station is perfectly frame synchronized This means that the base station knows exactly the position of training symbols in the uplink radio frame Denote Kk be the index set of those symbols in radio frame k Obtaining accurate channel state information is crucial for the base station to perform data detection and to design downlink beamforming vectors Thus, one of the most effective strategy for the illegitimate user terminal J to attack the legitimate communication is to contaminate the uplink training phase Let S be the set of all possible pilot symbols for uplink training In practice, for most standardized wireless applications, the pilot set S used by legitimate user terminals are often explicitly specified in the technical specifications In the paper, we assume that S is a N -PSK alphabet with N possible symbols defined as S = {ejm2π/N : m ∈ Z, ≤ m ≤ (N − 1)} Denote pX as the transmit power of user terminal X ∈ X during the training period Assume that pX remains constant over many frames In training symbol ℓ ∈ Kk , we assume that legitimate user terminal B is able to transmit a random pilot symbol sB,k,ℓ ∈ S in order to make it unpredictable by illegitimate user terminal J In other words, at any time, illegitimate user terminal J knows exactly S but it does not know which pilot symbol is transmitted Thus, one of the best strategies that illegitimate user terminal J could is to transmit a random pilot symbol sJ,k,ℓ ∈ S We can rewrite sJ,k,ℓ = sJ,k,ℓ s∗B,k,ℓ sB,k,ℓ = sk,ℓ sB,k,ℓ where sk,ℓ = sJ,k,ℓ s∗B,k,ℓ ∈ S because sJ,k,ℓ , sB,k,ℓ ∈ S Define αk,ℓ as the indicator parameter such that αk,ℓ = if illegitimate user terminal J transmits in training symbol ℓ ∈ Kk and that αk,ℓ = if illegitimate user terminal J does not transmit In other words, pilot contamination occurs in training symbol ℓ ∈ Kk if and only if αk,ℓ = Denote nk,ℓ ∈ CM ×1 as additive white Gaussian noise at the base station in the training symbol ℓ ∈ Kk such that nk,ℓ ∼ CN (0M ×1 , σ IM ×M ) Denote yk,ℓ ∈ CM ×1 as the received training signal in training symbol ℓ ∈ Kk , which is (3) Assume that the locations of the base station and the user terminals not change over many frames For analytical tractability, we assume that the antenna elements of base station A collectively form a Uniform Linear Array (ULA) Denote d¯A = πdA /λ as the normalized distance between adjacent antennas at the base base station, where dA is the distance between the adjacent antenna elements at base station A and λ is the wavelength corresponding to the carrier frequency Denote dX , ∀X ∈ X , is the distance from the base station to user terminal X Denote θX ∈ [−π, π], ∀X ∈ X , as the angle between the line connecting the base station to user terminal X and the boresight of the antenna array of the base station We believe that this system model is a good starting point for analytical tractability in order to obtain useful insights More complicated models, such as those with a larger number of user terminals and/or with multiple-antenna user terminals, are left for future work Under the assumption of uniformly-linear array (ULA) at the base station, the array response gX ∈ CM ×1 of the channel vector hX,k is independent of radio frame k and is computed as h iT ¯ ¯ gX = ej2dA sin θX · · · ej2dA (M −1) sin θX (4) H Note that gX gX = M, ∀X ∈ X and sin(M d¯A (sin θB − sin θJ )) j(M −1)d¯A (sin θB −sin θJ ) e sin(d¯A (sin θB − sin θJ )) (5) =ψ(θB , θJ , M ) (6) gJH gB = It can be proved that ¯ B , θJ ) = lim |ψ(θB , θJ , M )| ψ(θ M →∞ M ( 1, if sin θB = sin θJ , = 0, otherwise (7) (8) In this paper, we assume spatially-uncorrelated Rician fading channels [16] Denote κX as the Rician coefficient and βX as the large-scale fading coefficient of hX In general, κX and βX remain constant in many consecutive radio frames In other words, they are independent of the radio frame index Thus, it is justifiable to assume that κX and βX are known perfectly Define the large-scale fading coefficients 441 2021 8th NAFOSTED Conference on Information and Computer Science (NICS) corresponding to the Line-of-Sight (LoS) part and the NonLine-of-Sight (NLoS) part of hX,k as βX,L = κX βX ; κX + βX,N = βX κX + (9) The channel vector hX,k is decomposed as follows 1/2 1/2 hX,k =βX,L gX + βX,N wX,k 1/2 (10) 1/2 where βX,L gX ∈ CM ×M is the LoS part and βX,N wX ∈ CM ×M with wX ∼ CN (0M ×1 , IM ×M ) is the NLoS part The Rayleigh fading model considered in much related prior work corresponds to a special case of having no LoS part in this uncorrelated Rician fading channel model, i.e κX = and hence βX,L = and βX,L = βX for all X ∈ X For notational convenience and for later comparison purposes, let the following two subscripts ()Ri and ()Ra indicate the parameters related to the Rician fading channel model and those related to the Rayleigh fading channel model, respectively transmitted N -PSK symbol, ak,q is the equivalent complex channel coefficient and nk,q is equivalent noise Since it is challenging to determine the exact distribution of nk,q , we adopt the same approach as [7] in which we study its statistical property when M is large enough For a given realization of the channel vectors and the transmitted pilot symbols, both fq,u and fk,ℓ are given Note H yq,u − ak,q sB , where yk,ℓ and yq,u that nk,q = √1M yk,ℓ are two independent Gaussian vectors of size M with the same variance N0 IM and means fk,ℓ sB,k,ℓ and fq,u sB,q,u , respectively It follows that E[nk,q ] = It also follows that nk,q is a sum of M complex-valued normal product Gaussian variables By applying the Lyapunov central limit theorem, we obtain lim M →∞ σM = A Proposed Metric We propose a new scalar-valued metric that is defined as a scaled inner product of the received signals in two random different training symbols ℓ ∈ Kk and u ∈ Kq as follows H yq,u (11) zk,q = √ yk,ℓ M Although the proposed metric has a similar expression as the one proposed in [7] for the Rayleigh channel model, it does not require that the two training symbols be in the same radio frame Define sB = s∗B,q,u sB,k,ℓ , which is also a N -PSK symbol because both s∗B,q,u and sB,k,ℓ are N -PSK symbols For notational convenience, we define H fk,ℓ (12) ak,q = √ fq,u M H H nk,q = √ fq,u nk,ℓ + nH (13) q,u fk,ℓ + nq,u nk,ℓ M By substituting (3) into (11), we obtain zk,q =ak,q sB + nk,q (14) Note that (28) can be treated as the input-output relationship of a single-input single-output (SISO) channel where sB is the (15) where σM is defined as below and will be shown later to be finite when M grows very large III P ROPOSED R ANDOM P ILOT C ONTAMINATION D ETECTION M ETHOD In this section, we propose a new pilot contamination detection method that takes into account the special characteristics of the Rician channel model We first present how the detection regions are constructed and the detection algorithm We then show that the proposed detection method is likely to take the advantage of the features of the Rician channel to provide a higher detection probability than the prior work that only works in the Rayleigh channel model Similarly, let ()J and ()0 indicate the parameters when the illegitimate user terminal J transmits jamming signals and those when J does not transmit jamming signals, respectively nk,q d −→ CN (0, 1) σM N0 ∥fq,u ∥2 + ∥fk,ℓ ∥2 + M N0 M (16) In other words, when M grows very large, nk,q converges in distribution to a complex-valued Gaussian random variable Numerical results in [7] with mean and variance σM showed that this approximation is relatively tight even for the not-so-large number of antennas at the base station M = In general, the effective noise variance σM depends on a number of factors, including the presence of jamming signals, the channel model, and the positions of the two training symbols B With Jamming Signals When there are jamming signals in both training symbols, i.e αk,ℓ = αq,u = Replacing these values into (16) results σRi,J,M = N0 √ √ ∥ pB hB,k + pJ hJ,k sk,ℓ ∥2 M √ √ + ∥ pB hB,q + pJ hJ,q sq,u ∥2 + M N0 (17) As M grows very large, we have 2 σ ¯Ri,J = lim σRi,J,M (18) M →∞ = N0 2β¯B,k,k + 2β¯J,k,k + N0 q + β¯B,k,k β¯J,k,k ψ(θB , θJ )Re{sk,ℓ + sq,u } (19) The equivalent channel coefficient in this case is given by √ √ aRi,J,k,q = √ ( pB hB,q + pJ hJ,q sq,u )H M √ √ × ( pB hB,k + pJ hJ,k sk,ℓ ) (20) This parameter depends on whether the two training symbols are in the same radio frame or not It also depends on whether the training symbols guessed by J match with those 442 2021 8th NAFOSTED Conference on Information and Computer Science (NICS) transmitted by B, i.e., sq,u = sk,ℓ , or not Define aRi,J,k,q √ a ¯Ri,J,k,q = lim M →∞ M = β¯B,k,q + β¯J,k,q s∗q,u sk,ℓ q + β¯B,k,q β¯J,k,q ψ(θB , θJ )(s∗q,u + sk,ℓ ) (21) (22) When sq,u = sk,ℓ , which happens with the probability of 1/N , then a ¯Ri,J,k,q is a real-valued scalar value regardless of the comparison of k and q In this case, it has a high probability that the contaminated metric zk,q is located within the circle of radius σ ¯Ri,J and centered at an N -PSK symbol scaled by a ¯Ri,J,k,q When sq,u ̸= sk,ℓ , which happens with the probability of (N − 1)/N , then a ¯Ri,J,k,q is a complexvalued scalar In this case, it has a high probability that the contaminated metric zk,q is located within the circle of radius σ ¯Ri,J and centered at an N -PSK symbol scaled by |¯ aRi,J,k,q | and rotated by a certain angle C Without Jamming Signals When the illegitimate user terminal J does not transmit signals in both training symbols, we have αk,ℓ = αq,u = 2 Replacing as the corresponding value of σM Denote σ0,M αk,ℓ = αq,u = into (16) and (12), we obtain (23) aRi,0,k,q = √ hH B,q hB,k , M N0 σRi,0,M = pB ∥hB,k ∥2 + pB ∥hB,q ∥2 + M N0 (24) M For notational convenience, we define for all X ∈ X ( pX βX , if k = q, (25) β¯X,k,q = pX βX,L , otherwise Using the properties of the Rician channel model provided in Section II and after some manipulation, we obtain |aRi,0,k,q | √ = β¯B,k,q M = lim σRi,0,M = N0 2β¯B,k,k + N0 a ¯Ri,0,k,q = lim M →∞ σ ¯Ri,0 M →∞ (26) (27) While a ¯Ri,0,k,q depends on the positions of the training symbols, σ ¯Ri,0 does not justifiable to assume that the base station could estimate the large-scale fading coefficients βB and βB,L accurately enough Thus, for a given N -PSK modulation scheme and for a largeenough number of antennas M , we propose the detection regions as the circles of radius σ ¯Ri,0 with the centers at the √scaled N -PSK symbols with the common scaling factor ¯Ri,0,k,q In order to reduce the effects of noise on of M a detection accuracy, we also propose that K, where K ≥ 2, N -PSK pilots are used for jammer detection purpose Based on these detection regions and the use of K training symbols, we propose the following detection method • The base station selects a number of different pairs of training symbols from the K training symbols Note that the maximum number of pairs of training symbols is K(K − 1)/2 • For each pair of training symbols ℓ ∈ Kk and u ∈ Kq , the base station performs the following steps: – Compute the scalar-valued equivalent received signal zk,q √ ¯Ri,0,k,q ejm2π/N | for – Compute dm = |zk,q − M a each m ∈ 0, 1, · · · , N − Note that dm can be considered as the distance from the scalar-valued equivalent received signal to the m-th scaled N PSK symbol – Compute the minimum distance dmin = min0≤m≤(N −1) dm – If dmin < σ ¯Ri,0 then the base station decides that the training symbols are not contaminated; otherwise, it decides that they are contaminated, i.e there exists an active illegitimate user terminal • The base station makes the decision on the existence of the jamming signals based on the majority of the detection results of the selected pairs Note that the larger the number of selected pairs, the more accurate the detection decision The benefits, however, comes at the cost of more overhead and more computational complexity Note also that the use of more pairs of training symbols to take the advantage of temporal diversity is one of the main differences of this paper in relative comparison with prior work, including our own prior work D Proposed Detection Algorithm E Asymptotical Analysis of Detection Probability Recall that zk,q can be treated as the equivalent received signal of the SISO channel with the input-output relationship given in (28) We now construct the detection region based on the scalar metric zk,q so that the base station could decide whether an illegitimate user terminal is contaminating the desired pilots or not Recall that zk,q is the sum of a N -PSK symbol scaled by aRi,0,k,q and a Gaussian noise with mean and variance σRi,0,M In general, the base station has not obtained accurate estimates of small-scale fading coefficients before the training periods This means that it hasn’t known exactly aRi,0,k,q and σRi,0,M before the making the decision on the presence of jamming signals Nevertheless, as the user terminals not move in a long enough period, it is In this section, we analyze the detection probability of the proposed method when the number of antennas M at the base station grows very large to obtain insights on the impacts of the channel model By dividing both sides of (28) by ak,q , which is non-zero, we obtain the following processed metric nk,q z˜k,q =sB + (28) ak,q The radius of each proposed detection region is proportional σRi,0,k,q to with DRi,0,k,q = |aRi,0,k,q |2 In addition, the radius of the circle in which the metric zk,q lies with high probability when there exist jamming signal is proportional to DRi,J,k,q = 443 σRi,J,k,q |aRi,J,k,q |2 In principle, the detection probability is close 2021 8th NAFOSTED Conference on Information and Computer Science (NICS) to zero when DRi,J,k,q ≤ DRi,0,k,q and it increases with the ratio of DRi,J,k,q /DRi,0,k,q when DRi,J,k,q > DRi,0,k,q Thus, it is desired that DRi,J,k,q /DRi,0,k,q is as large as possible Notably, we can show that DRi,J,k,q /DRi,0,k,q = DRi,J,k,k /DRi,0,k,k for all q This means that the performance of the proposed approach does not depend on the number of radio frames containing the two considered training symbols In other words, the proposed approach allows flexibility and frequent checking of the existence of jamming signals IV N UMERICAL RESULTS We simulate the detection probability and the false-alarm probability to evaluate the efficiency of our detection scheme The probability of false alarm is defined as the probability that jammer is detected because jammer does not exist We studied a network with only one cell, where the base station is at the cell’s center and the legitimated user Bob and the eavesdropper device are randomly across the cell Assuming the effect of shadowing is ignored, then large-scale fading is computed as [17] Fig Detection probability as a function of SNR for M = 128, N = and for different values of K βX,Y = 32.4 + 10nY log10 (d3D,X ) + 20 log10 (fc ) where X ∈ X , Y ∈ Y = {L, N}, d3D,X is the distance in meters from base station to node X in 3-D space,fc = 3.5GHz is the carrier frequency, nY is the exponential coefficient of transmission Moreover, we assume that d3D,X is computed as q follows d3D,X = d22D,X + (hA − hX )2 , where d2D,X is the distance from the base station to the node X in the 2-D space, hA is height of the base station A, and hX is height of the node X [17] Suppose hA = 10m and hB = hJ = 1.5m The paper investigates the urban cell environment, then nL = for LOS and nN = 2.9 for NLOS Follow [17], for UMa environment then κ measured in dB is a Gaussian random variable N (9, 3.5) For simplicity, we assume κB = κJ = 9dB We assume that the system works at bandwidth 10MHz and that the base station transmission power is pd = 43dBm We assume that the distance between adjacent antennas at the base station is half wavelength, that is dA = 0.5λ Simulation results are averaged over 100.000 realizations First, we consider a simulation scenario where the illegitimate user terminal J is 300 meters from the legitimate user terminal B The parameters of the Rician channel model is selected as κB = κJ = 9dB Fig shows the detection probability as a function of SNR when the base station has M = 128 antennas and uses 8-PSK pilots As expected, the probability of detection increases SNR; in the high SNR domain, detection probability go to Notably, even with a small number of pilots, e.g K = 5, we have a very high probability of detecting jammers, much higher than using only a pair of pilots, i.e K = Figure presents the detection probability as a function of SNR for a number of N -PSK pilots when the base station has only M = 64 antennas Notice that the detection probability also increases with SNR and gets very close to when SNR is larger than 15dB From this observation, we can conclude that Fig Detection probabilities vs SNR for K = 10, M = 64 antennas, and N = 4; 8; 16-PSK by using a sufficient number of pilots, the base station does not need to use too many antennas for the jammer detection purpose Figure presents the numerical results of the false-alarm probability as a function of the number of antennas M as the base station when 8-PSK pilots are used at the SNR of 5dB As expected, the false-alarm probability decreases with the number of antennas at the base station Moreover, this result show that the likelihood of false-alarms probability is relatively low when a sufficient number of pilots are used When the number of antennae is big enough, the falsealarm probability rapidly approaches zero This means that 444 2021 8th NAFOSTED Conference on Information and Computer Science (NICS) R EFERENCES Fig vs M False-alarm probabilities N = PSK , SNR=5; K = 2; 5; 10; 15 the jammer can be detected with very high probability by using a large number of pilots as well as a large number of antennas V C ONCLUSION AND FUTURE WORK We proposed a strategy for detecting the presence of an illegitimate user terminal based on the use of random PSK pilots in a massive MIMO system under the assumption of Rician spatially-uncorrelated channel model We proposed performance metric that measure a form of correlation between the received signals in two different training symbols The main idea for the detection strategy was based on the analytical results of the differences in the value of the performance metric when the jamming signal was present and when it was absent Moreover, our proposed method could take the advantage of the temporal diversity of training symbols to reduce the negative effects of noise on detection accuracy The numerical results showed that the proposed method could achieve relatively high detection probability and relatively low false-alarm probability in various simulation scenarios Suggestions for future work could focus on a more complicated channel model, such as spatially-correlated Rician channel model, and/or on the use of other pilot signal modulations [1] T L Marzetta, “Noncooperative cellular wireless with unlimited numbers of base station antennas,” IEEE Trans on Wireless Commun., vol 9, no 11, pp 3590–3600, 2010 [2] J Zhang, J Fan, B Ai, and D W K Ng, “Noma-based cell-free massive mimo over spatially correlated rician fading channels,” in ICC 2020 - 2020 IEEE International Conference on Communications (ICC), 2020, pp 1–6 [3] L Sanguinetti, E Bjăornson, and J Hoydis, Toward massive mimo 2.0: Understanding spatial correlation, interference suppression, and pilot contamination,” IEEE Transactions on Communications, vol 68, no 1, pp 232–257, 2020 [4] I F Akyildiz, A Kak, and S Nie, “6g and beyond: The future of wireless communications systems,” IEEE Access, vol 8, pp 133 995– 134 030, 2020 [5] D Kapetanovic, G Zheng, and F Rusek, “Physical layer security for massive MIMO: An overview on passive eavesdropping and active attacks,” IEEE Commun Mag., vol 53, no 6, pp 21–27, 2015 [6] Y Zou, J Zhu, X Wang, and L Hanzo, “A survey on wireless security: Technical challenges, recent advances, and future trends,” Proc of the IEEE, vol 104, no 9, pp 1727–1765, Sep 2016 [7] D Kapetanovi´c, G Zheng, K Wong, and B Ottersten, “Detection of pilot contamination attack using random training and massive MIMO,” in Proc of IEEE Int Symp Personal, Indoor, Mobile Radio Commun (PIMRC), Sep 2013, pp 13–18 [8] T Yang, R Zhang, X Cheng, and L Yang, “Secure massive MIMO under imperfect CSI: Performance analysis and channel prediction,” in IEEE Trans Info Forensics Security, 2018 [9] X Zhang, D Guo, and K Guo, “Secure performance analysis for multipair AF relaying massive MIMO systems in Ricean channels,” IEEE Access, vol 6, pp 57 708–57 720, 2018 [10] A Mukherjee and A Swindlehurst, “A full-duplex active eavesdropper in MIMO wiretap channels: Construction and countermeasures,” in Proc IEEE Asilomar Conf on Signals, Systems and Computers, Pacific Grove, U.S.A., Nov 2011, pp 265–269 [11] D B Rawat, K Neupane, and M Song, “A novel algorithm for secrecy rate analysis in massive MIMO system with target SINR requirements,” in Proc of IEEE Int Conf Computer Commun (INFOCOM), Apr 2016, pp 53–58 [12] O Ozdogan, E Bjornson, and E G Larsson, “Massive MIMO with spatially correlated rician fading channels,” in IEEE Trans Commun., 2018 [13] G Q L Vu and K T Truong, “Secret capacity of massive mimo with a passive eavesdropper,” Journal of Research and Development on Information and Communication Technology, vol V-3, no 40, p 1, 12 2018 [14] C.-Y Yeh and E W Knightly, “Feasibility of passive eavesdropping in massive MIMO: An experimental approach,” in Proc of IEEE Conf Commun Network Security (CNS), Beijing, China, May 2018 [15] G Q Le Vu, T Le Nhat, and K T Truong, “Physical layer security of massive mimo spatially-uncorrelated rician channels,” in 2021 International Conference on Advanced Technologies for Communications (ATC), 2021, pp 22–27 [16] L Sanguinetti, A Kammoun, and M Debbah, “Theoretical performance limits of massive MIMO with uncorrelated Rician fading channels,” IEEE Trans Commun., 2018 [17] 3GPP TR 38.901, “Study on channel model for frequencies from 0.5 to 100 GHz,” 3GPP, Technical Report v.15.0.0, Jun 2018 445 ... Kapetanovi´c, G Zheng, K Wong, and B Ottersten, ? ?Detection of pilot contamination attack using random training and massive MIMO, ” in Proc of IEEE Int Symp Personal, Indoor, Mobile Radio Commun (PIMRC), Sep... assume spatially- uncorrelated Rician fading channels [16] Denote κX as the Rician coefficient and βX as the large-scale fading coefficient of hX In general, κX and βX remain constant in many... user terminal X ∈ X during the training period Assume that pX remains constant over many frames In training symbol ℓ ∈ Kk , we assume that legitimate user terminal B is able to transmit a random