Member, IEEE Arsenia Chorti
email: arsenia.chorti@ensea.frachorti@princeton.edu

Sotiris Skaperas

Real-Time Algorithms for the Detection of Changes in the Variance of Video Content Popularity

Keywords: . . . . . . . . . . . . . 4.7 . . . . . . . 4.8 . . . . . . . . . . . . . . . . . . [J21], [C37], [C33], [S2] o Authentication protocols leveraging PUFs, SKG and proximity estimation [BC3], [U1] o Resource allocation in 5G using change point analysis [J17], [J20], [C32] o Anomaly detection in software defined networks [C39], [J18], [S1], [U2] o Active attacks in PHY [J15], [J16], [C36], [C28-C31] [BC2] o Low latency B5G communications, non-orthogonal multiple access (NOMA), NOMA-R, flexible numerology for B5G [J22], [U3-U5] Stochastic signals, systems and processes, spectrum, • Source coding: entropy, Huffman encoders, Lempel-Ziv encoders, • Channel coding: block and convolution encoders, introduction to Turbo encoders, • Digital modulation, OFDM systems, • Multiple access techniques, TDMA, FDMA, CDMA, OFDMA, popularity dynamics detection, change point analysis, variance change detection, volatility detection

In my role as a research advisor, I strove to give to my students the opportunity to work on promising and far fetching -whenever possible -research topics in the general framework of fifth generation (5G) wireless. The works presented in this thesis reflect our studies in two areas of central importance for bringing 5G to life: wireless security and resource allocation.

With respect to security, novel challenges emerged in 5G with the Internet of things (IoT) paradigm and device to device (D2D) low latency communications. Novel verticals, such as haptics and vehicle to everything (V2X), require low complexity and low latency security mechanisms, particularly in the context of device authentication. In the present manuscript, lightweight solutions for device authentication using physical unclonable functions (PUF) and secret key generation (SKG) at the physical layer are presented.

Furthermore, as video content is responsible for more than 70% of the global IP traffic, it is important for content delivery infrastructures to rapidly detect and respond to changes in content popularity dynamics. In this thesis, we propose a flexible edge resource allocation approach leveraging unikernel and container technologies. The allocation of the edge server resources is driven by a real-time and low-complexity content popularity detector, implemented using off-line and on-line change point analysis. Variations of these algorithms have applications in intrusion detection in wireless sensor software defined networks, discussed next.

Finally, the potential use of non-orthogonal multiple access (NOMA) in the wireless uplink is considered. Early results on the performance comparison of NOMA vs orthogonal allocation schemes in asymptotic regimes, show that the gains in using NOMA carry on to the scenario of communications under statistical delay quality of service (QoS) constrains.

3.9 The aggregated overall processing cost, per time-instance, of the RCPD algorithm over 882 time-series. . . . . . . . . . . . . . . . . . . .

To my family

Blessed are the cheesemakers.

-The Life of Brian (1979) List of Tables My current research activities relate to various topics in wireless communications and physical layer security with an emphasis on the proposal of low latency communication systems and the development of new security protocols for future generations of wireless. I actively work on topics in flexible numerology, non-orthogonal mutiple access (NOMA) and fast authentication protocols for CHAPTER 1. ACTIVITY REVIEW delay constrained systems using physical unclonable functions (PUFs) and RF fingerprinting. In this framework, with my current research team, that comprises four PhD students and two postdoctoral researchers, we investigate resource allocation in beyond fifth generation (B5G) leveraging NOMA, the efficient design of Slepian Wolf and Wyner Ziv reconciliation decoders at the short block-length, the development of zero-round-trip-time (0-RTT) authentication protocols using resumption keys generated from wireless fading coefficients, the analysis of the wireless channel secrecy capacity under statistical delay quality of service (QoS) constraints and the development of quick anomaly detection algorithms for software defined networks.

List of Figures

My research lies at the interface of wireless communications, signal processing and security studies, as depicted in Fig. 1.1; at this -not so-frequented -scientific crossroad, new engineering problems are encountered, a few of which will be discussed in later chapters of this thesis, along with proposed solutions.

With respect to my contribution as an academic teacher and supervisor, I have a long experience in teaching and supervising students in security, coding and wireless communications for more than 8 years in the UK and France. I have had the chance to teach a variety of courses both at the undergraduate and graduate level and contribute in teaching in the continuous education engineering track of ENSEA. I have taught to a variety of class sizes and have customarily received very positive feedback from my students, both in formal assessment and in face-to-face interaction. Furthermore, since last September I am acting as the liaison of the international mobility for ENSEA students towards the UK and have secured internships at Imperial College London, the University of York, etc.

In my academic employment I have had the opportunity to undertake a number of important administrative responsibilities. I currently head the research team ICI (information, communications, imaging) of the ETIS Lab that comprises 13 permanent faculty (3 PU, 8 MCF, 2 CNRS CR) and more than 18 research students and teaching fellows. In this role my aim is to help maintain and enhance the quality and quantity of the team's collective research output, its ability to attract research funding and good young researchers, increase further the team's visibility in the national and international level and ensure the team members work in a friendly and fertile learning environment. Furthermore, during my employment at the School of Computer Science and Electronic Engineering in the UK, I have acted in 2017 as the President of the Athena Swan Committee, steering 15 faculty and admin staff for the preparation of the department's gender equality and diversity charter.

With respect to my involvement in professional bodies, I am a member of the IEEE INGR Roadmap Security Workgroup, of the IEEE P1940 Standardization Workgroup on "Standard profiles for ISO 8583 authentication services" and have been a member of the IEEE Teaching Awards Committee for the last three years.

I feel that my overall experience is of sufficient standing to allow me to lead independent research and act as a stand-alone thesis advisor / director. A brief overview of my research and teaching activities the last 8 years is provided in Sections 1.4 and 1.5 respectively. First, I introduce myself to the reader through a detailed academic CV in Section 1.2. and the full list of my publications in Section 1.3.

Curriculum Vitae

In the following pages my full academic Curriculum Vitae is provided, including a full record of my publications in Section 1.3. The interested reader may also consult my web page and my google scholar page. The goal of physical layer security (PLS) [1][2][3] is to make use of the properties of the physical layerincluding the wireless communication medium and / or the transceiver hardware -to enable critical security aspects. In particular, PLS can be employed to provide i) node (device) authentication, ii) message authentication, iii) message confidentiality through the use of secrecy encoders, and, iv) key management and distribution solutions through symmetric secret key generation from shared randomness. Furthermore, proposals for intrusion detection and counter-jamming at PHY have recently emerged [4]; indeed these two topics emerge as important research areas in B5G systems, particularly in the industrial Internet of things (IoT) and the mmWave era. PLS has been explicitly mentioned in the first white paper on 6G: "The strongest security protection may be achieved at the physical layer". Importantly, it is stated as an enabling technology in the IEEE International Network Generations Roadmap 1st Edition 2019 in the Chapters on "Security" (Section 1.1 pp. 1-2) and on "Massive MIMO" (Section 4.3 pp. [8][9]. The increasing interest in PLS has been stimulated by many practical needs. Notably, many critical IoT networks require ultra-low latency communications (< 1msec), e.g., in autonomous driving and vehicle to everything (V2X) applications, telemedicine and haptics. However, standard authentication often requires significant processing time. We note in passing that in the Third Generation Partnership Project (3GPP) technical report "Study on the Security of URLLC" [5], all aspects related to low latency (fast) authentication remain open and no solutions have so far been standardized. An added complication is due to hardware limitations of low-end sensors and their ineptest to execute sophisticated security protocols such as the IPSec or the DTLS.

Research Funding and Grants

Research Supervision

A further challenge comes from quantum computing, which has seen significant progress after massive investment by companies such as Google, Intel and IBM to build prototypes with more than 50 qubits. In October 2019 Google published in the journal "Nature" their quantum computer experiments showing they have achieved quantum supremacy for a particular set of problems [6]. In this aspect, PLS, that relies upon information-theoretic security proofs, could resist quantum computers, unlike corresponding asymmetric key schemes relying on the (unproven) intractability in polynomial time of certain algebraic problems. Even state-of-the-art elliptic curve cryptography (ECC) schemes, that require substantially shorter keys than RSA or Diffie Hellman (DH) schemes, are still considerably more intensive computationally than their PLS counterparts and are not post-quantum.

As a result, the study of novel PLS based solution for 5G and B5G security is highly pertinent. Related proposals using physical unclonable functions [7] and secret key generation from shared randomness [8] are included in this thesis.

Resource Allocation

The roll-out of fifth-generation (5G) mobile networks and the forthcoming 6G will bring about fundamental changes in the way we communicate, access services and entertainment.With respect to the latter, the multi-fold increase in the service data rates will provide users with ultra high resolution in video-streaming, multi-media and virtual reality, offering immersive experiences. To this end, it is important for Edge content delivery infrastructures to rapidly detect and respond to changes in content popularity dynamics. For flexible and highly adaptive solutions, the capability for quick resource (re-)allocation should be driven by early (real-time) and low-complexity content popularity detection schemes. In this thesis, we study aspects of low-complexity detection of changes in video content popularity in real-time, addressed as a statistical change point (CP) detection problem [9], breaking completely new ground compared to earlier works that relied upon prediction models [10], [11]. CHAPTER 1. ACTIVITY REVIEW Furthermore, novel exciting use cases were introduced in 5G in the context of ultra-reliable low latency communications (URLLC) and massive machine type communications (mMTC); the new industrial revolution, dubbed as Industry 4.0, along with emerging verticals in telemedicine, smart agriculture, etc., will bring about automation and intelligence to levels never seen before.

As 5G is required to support a large variety of services, novel solutions to enable higher resource efficiency are sought; amongst the various possible solutions, in this thesis we study non-orthogonal multiple access (NOMA) because of its advantages over conventional orthogonal multiple access (OMA) schemes in terms of spectral efficiency [12], cell-edge throughput [13], and energy efficiency [14], rendering it an attractive solution in particular for the mMTC uplink scenario.

Additionally, to account for media access control (MAC) sub-layer latency, we use the theory of the effective capacity [15], which can serve in wireless networks to provide statistical delay guarantees. The pertinence of the theory of the effective capacity as a suitable metric results from the fact that in the wireless MAC, due to small scale fading and shadowing, it is inherently impossible to provide hard delay guarantees.

In the following, a brief presentation of my principal past contributions over the last 7 years is given in reverse chronological order, to emphasize more recent results. Section 1.4.2 offers an outline of recent results in the area of resource allocation using NOMA, the theory of the effective capacity and CP analysis, while results in the area of PLS are described in Section 1.4.3.

Results in Resource Allocation

NOMA and Effective Capacity

Related Contributions: [J22], [J19], [C38], [C34]

In our works a flexible delay quality of service (QoS) model was employed using the theory of large deviations (Gärtner-Ellis theorem [16]) that allows defining the metric of the effective capacity (EC) in block fading additive white Gaussian noise (BF-AWGN) channels. The EC denotes the maximum constant arrival rate that can be served by a given service process, while guaranteeing a required statistical delay provisioning and is closely related to the concept of the effective bandwidth [17]. In order to capture the impact of link layer (MAC) delays in the secrecy capacity of wireless BF-AWGN channels, we introduced a novel metric, referred to as the "effective secrecy rate" (ESR); the ESR represents the maximum constant arrival rate that can be securely served (with perfect secrecy), on the condition that the required delay constraint can be statistically satisfied.

In more detail, in [J19] a novel approach was introduced to study the achievable delay-guaranteed secrecy rate, focusing on the downlink of a NOMA network with one base station, multiple singleantenna NOMA users and an eavesdropper. Two possible eavesdropping scenarios were considered; an internal, unknown, eavesdropper in a purely antagonistic network and an external eavesdropper in a network with trustworthy peers. For a purely antagonistic network with an internal eavesdropper, the only receiver with a guaranteed positive ESR was proved to be the one with the highest channel gain. The ESR in the high signal to noise ratio (SNR) regime was shown to approach a constant value irrespective of the power coefficients, while the strongest user was shown to achieve a higher ESR when it had a distinctive advantage in terms of channel gain with respect to the second strongest user. For a trustworthy NOMA network with an external eavesdropper, a lower bound and an upper bound on the ESR were proposed and investigated for an arbitrary legitimate user. For the lower bound, a closed-form expression was derived in the high SNR regime. For the upper bound, the analysis showed that if the external eavesdropper could not attain any channel state information (CSI), the legitimate NOMA user at high SNRs would always achieve positive ESR. Simulation results numerically validated the accuracy of the derived closed-form expressions and verified the analytical results given in the theorems and lemmas.

Furthermore, in [J22], [C38], [C34], we turned our attention to NOMA uplink networks. We provided performance analyses in asymptotic regimes (low and high SNR) and also proposed a novel multiple access (MA) scheme referred to as NOMA-Relevant (NOMA-R). In NOMA-R, a flexible MA scheme is proposed based on the requirement that any user will opt for NOMA only when there is a rate gain associated. We have shown that NOMA-R outperforms both NOMA and OMA in terms of sum rates achievable in all SNR regions. Importantly, using the theory of the effective capacity we demonstrated that the NOMA-R strategy is more favorable when the target delay-bound violation probabilities are more stringent, especially for weak NOMA users.

Resource Allocation Using Change Point Analysis

Related Contributions: [J17], [J20], [C32]

In [J17], [J20] and [C32] we developed novel algorithms for the real-time detection of changes in the mean and the variance of content popularity. Approaching the problem statistically, we efficiently combined off-line and on-line non-parametric CUSUM procedures. The use of non-parametric CUSUM allowed us to avoid making assumptions about the underlying statistics of the popularity of any particular content, with the additional benefit of reduced computational cost. For the detection of changes in the mean we divided the algorithm in two phases. The first phase was an extended retrospective (off-line) procedure with an improved binary segmentation step and was used to adjust on-line parameters, based on historical data of the particular video. The second phase integrated a modified trend indicator to the sequential (on-line) procedure, to reveal the direction of a detected change. We provided extensive simulations, using real data, that demonstrated the performance of the first phase of our algorithm. We also provided proof-of-concept results that highlighted the efficiency of the overall algorithm.

The approach of combining off-line and on-line CP algorithms was also employed in [J20] for the detection of changes in the variance. However, a major difference concerned the choice of the underlying test statistic, as unlike in the case of the mean, tracking changes in the variance is inherently a nonlinear estimation problem. To develop the test statistic we proposed three different approaches: i) a non-parametric approach, ii) a parametric approach using an autoregressive moving average (ARMA) model, and, iii) a parametric approach using a nonlinear generalised autoregressive conditional heteroskedasticity (GARCH) model. Our studies using synthetic data indicated that the ARMA parametric approach did not generalize well. Due to this fact, we only performed experiments on real data using the non-parametric and the GARCH approaches. We concluded that both can equally well identify large deviations in the variance and that in the general case the non-parametric approach can provide quicker detection of CPs in the datasets studied in this work. In the future, we will develop joint detectors for the mean and the variance of video content popularity.

Results in PLS

PLS for 5G

Related contributions: [J21], [BC3], [C37], [C33], [C27]

With the emergence of 5G low latency applications, such as haptics and V2X, low complexity and low latency security mechanisms are needed. Promising lightweight mechanisms include physical unclonable functions (PUF) and secret key generation (SKG) at the physical layer from wireless fading coefficients, as considered in [J21], [C37], [C33]. In this framework we proposed a zero-round-trip-time (0-RTT) authentication protocol combining PUF for fast authentication and generation of resumption keys using SKG. Furthermore, a novel authenticated encryption (AE) scheme using SKG and standard symmetric key block ciphers for encryption and message authentication -first proposed in [C27] -was enhanced in [J21]. Aiming at a fast PHY protocol we proposed the pipelining of the AE SKG process and the encrypted data transfer at PHY in order to reduce latency. Looking at various alternatives to implement the pipelining at PHY, we investigated a "parallel" SKG approach for multi-carrier systems (e.g., using orthogonal frequency division multiplexing (OFDM) as in LTE and 5G new radio). In the parallel approach a subset of the subcarriers was used for SKG and the rest for encrypted data transmission (using the keys generated on the subset of SKG subcarriers). The optimal solution CHAPTER 1. ACTIVITY REVIEW to the respective PHY resource allocation problem was identified under security, power and delay constraints, by formulating the subcarrier scheduling as a subset-sum 0-1 knapsack optimization [18] . A heuristic algorithm of linear complexity was proposed and shown to incur negligible loss with respect to the optimal dynamic programming solution [J21], [C37], [C33]. The proposed mechanisms, have the potential to pave the way for a new breed of latency aware PHY security protocols with an emphasis on URLLC and IoT emerging systems.

Finally, the main lines of application of PLS in B5G systems were reviewed in [BC3], starting with node authentication, moving to the information theoretic characterization of message integrity, and finally, discussing message confidentiality both in the SKG and from the wiretap channel point of view. The aim of this review was to provide a comprehensive roadmap on important relevant results by the authors and other contributors and discuss open issues on the applicability of PLS in 6G systems.

Anomaly Detection in Software Defined Networks

Related contributions: [C39], [J18]

Software-defined networking (SDN) is a promising technology to overcome many challenges in wireless sensor networks (WSN), particularly with respect to flexibility and reuse. Conversely, the centralization and the planes' separation turn SDNs vulnerable to new security threats in the general context of distributed denial of service (DDoS) attacks. State of-the-art approaches to identify DDoS do not always take into consideration restrictions in typical WSNs e.g., computational complexity and power constraints, while further performance improvement is always a target. The objective of the works in [J18], [C39] was to propose a lightweight but very efficient DDoS attack detection approach using CP analysis. Our approach was shown to have a high detection rate and linear complexity with respect to the observed time series length, rendering it suitable for WSNs. We demonstrated the performance of our detector in software-defined WSNs of 36 and 100 nodes with varying attack intensity (the number of attackers ranging from 5% to 20% of nodes).

We used CP detectors to monitor anomalies in two metrics: the data packets delivery rate and the control packets overhead. Our results showed that as the intensity of the attack increased, our approach could achieve a detection rate close to 100% and that, importantly, the type of the attack could also be inferred. As an extension of this work, we will look into distributed anomaly detection by allowing clusters of nodes to act on local early detection systems. A trade-off to be studied will concern the cluster size versus the speed of the detection while maintaining the ability to localize the source of the anomaly.

Shielding PLS Against Active Attacks

Related contributions: [BC2], [J16], [J15], [J12], [C36], [C31], [C30], [C29], [C28], [C24], [C22], [C21]

SKG schemes have been shown to be vulnerable to DoS attacks in the form of jamming and to man in the middle attacks implemented as injection attacks. In [BC2] and [C36], a comprehensive study on the impact of correlated and uncorrelated jamming and injection attacks in wireless SKG systems was presented. First, two optimal signaling schemes for the legitimate users were proposed and the impact of injection attacks as well as counter-measures were investigated. Finally, it was demonstrated that the jammer should inject either correlated jamming when imperfect channel state information (CSI) regarding the main channel was at their disposal, or, uncorrelated jamming when the main channel CSI was completely unknown.

As jamming attacks represent a critical vulnerability for wireless SKG systems, in [J15], [C31], [C30], [C29], [C28] two counter-jamming approaches were investigated for SKG systems: first, the employment of energy harvesting (EH) at the legitimate nodes to turn part of the jamming power into useful communication power, and, second, the use of channel hopping or power spreading in BF-AWGN channels to reduce the impact of jamming. 1 In both cases, the adversarial interaction between the pair of legitimate nodes and the jammer was formulated as a two-player zero-sum game and the Nash and Stackelberg equilibria (NE and SE) were characterized analytically and in closed form. In particular, in the case of EH receivers, the existence of a critical transmission power for the legitimate nodes allowed the full characterization of the game's equilibria and also enabled the complete neutralization of the jammer. In the case of channel hopping vs. power spreading techniques, it was shown that the jammer's optimal strategy was always power spreading while the legitimate nodes should only use power spreading in the high signal-to-interference ratio (SIR) regime. In the low SIR regime, when avoiding the jammer's interference becomes critical, channel hopping is optimal for the legitimate nodes. Numerical results demonstrated the efficiency of both counter-jamming measures.

Furthermore, in [J16] the novel proposal of using EH as a counter-jamming measure for point-topoint communication was investigated on the premise that part of the harmful interference could be harvested to increase the transmit power. We formulated the strategic interaction between a pair of legitimate nodes and a malicious jammer as a zero-sum game. Our analysis demonstrated that the legitimate nodes were able to neutralize the jammer. However, this policy was not necessarily a Nash equilibrium and hence was sub-optimal. Instead, harvesting the jamming interference could lead to relative gains of up to 95%, on average, in terms of Shannon capacity, when the jamming interference was high.

Finally, in our earlier works [J12], [C24], [C22], [C21] the resilience of wireless multiuser networks to passive (interception of the broadcast channel) and active (interception of the broadcast channel and false feedback) eavesdroppers was investigated. Stochastic characterizations of the secrecy capacity (SC) were obtained in scenarios involving a single transmitter (base station) and multiple destinations. The expected values and variances of the SC along with the probabilities of secrecy outage were evaluated in the following cases: (i) in the presence of passive eavesdroppers without any side information; (ii) in the presence of passive eavesdroppers with side information about the number of eavesdroppers; and (iii) in the presence of a single active eavesdropper with side information about the behavior of the eavesdropper. This investigation demonstrated that substantial secrecy rates are attainable on average in the presence of passive eavesdroppers as long as minimal side information is available. On the other hand, it was further found that active eavesdroppers could potentially compromise such networks unless statistical inference was employed to restrict their ability to attack. Interestingly, in the high SNR regime, multiuser networks were shown to become insensitive to the activeness or passiveness of the attack.

PLS Encoders and Secrecy Enhancement in Collaborative Networks

Related contributions: [J14], [J13], [C23], [C19], [C18]

Physical layer network coding (PNC) has been proposed for future generations of wireless networks. In [J14], we investigated PNC schemes with embedded perfect secrecy by exploiting structured interference in relay networks with two users and a single relay. In a practical scenario where both users employed finite and uniform signal input distributions, we established upper bounds (UB) on the achievable perfect secrecy rates and made these explicit when pulse amplitude modulation (PAM) modems were used, while our results extend straightforwardly to quadrature amplitude modulation (QAM) modems. We then described two simple, explicit encoders that could achieve perfect secrecy rates close to these UBs with respect to an untrustworthy relay in the single antenna and single relay setting. Lastly, we generalized our system to a MIMO relay channel where the relay had more antennas than the users and studied optimal precoding matrices which satisfied a required secrecy constraint. Our results established that the design of PNC transmission schemes with enhanced throughput and guaranteed data confidentiality was feasible.

Finally, in [J13] the optimal power allocation that maximizes the SC of BF-AWGN networks with causal CSI, M -block delay tolerance and a frame based power constraint was examined. In particular, transform (IFFT) transmitter employed in OFDM systems; spreading requires no change in the canonical OFDM transmitter, while hopping requires setting all but one of the IFFT inputs to zero.

the SC maximization was formulated as a dynamic program. First, the SC maximization without any information on the CSI was studied; in this case the SC was shown to be maximized by equidistribution of the power budget, denoted as the "blind policy". Next, extending earlier results on the capacity maximization of BF-AWGN channels without secrecy constraints, transmission policies for the low SNR and the high SNR regimes were proposed. When the available power resources were very low the optimal strategy was a "threshold policy". On the other hand, when the available power budget was very large a "constant power policy" was shown to maximize the frame secrecy capacity. Subsequently, a novel universal transmission policy was introduced, denoted as the "blind horizon approximation" (BHA), by imposing a blind policy in the horizon of unknown events. Through numerical results, the novel BHA policy was shown to outperform both the threshold and constant power policies as long as the mean channel gain of the legitimate user was distinctively greater than the mean channel gain of the eavesdropper. Furthermore, the secrecy rates achieved by the BHA compared well with the secrecy rates of the secure waterfilling policy in the case of acausal CSI feedback to the transmitter.

Recent Teaching Activities

I have had the opportunity to teach for over 7 consecutive years in France and the UK, a variety of courses from cryptography and network security, to networking and wireless communications. A detailed description of my teaching record is presented in reverse chronological order in the following Sections.

Overview of Teaching Activities in France (ENSEA)

Since September 2017 I have been engaged with teaching at ENSEA, giving courses both in French and in English. I have taught in the second and third year of the engineering track of ENSEA, as well as in the continuing education track (cycle par alternance). Furthermore, since September 2019 I am responsible of the students' international mobility towards the UK.

Engineering Track (teaching in English)

I have been teaching in the third year specialization "Networks and Telecommunications" the modules of "Network Security" (module responsible), "Internetworking" (module responsible) and "Wireless Communications". In parallel I am teaching Cryptography in the M2 MSc of ETIS SIT (Systèmes, Information, Télécommunications), whose syllabus mirrors in great extent that of "Network Security". A brief presentation of the courses is given below:

(1) Network Security / Cryptography: 10 hours of lectures. Topics covered include:

• Data Confidentiality: perfect secrecy, semantic security, block ciphers, DES, 3DES, AES;

• Data Integrity: message authentication codes (MAC), authenticated encryption;

• Key management using a trusted third party;

• Public key encryption, Diffie Hellman, El Gamal, RSA;

• Digital signatures, digital certificates, public key infrastructure;

• SSL / TLS.

(2) Internetworking: 16 hours of lectures, 24 hours of lab work (on GNS3), 6 hours of seminars (classes)

• IP protocol, DHCP, ARP, ICMP, NAT;

• Routing protocols: RIP, OSPF, BGP, Mobile IP, Dynamic Source Routing, Reverse Path Forwarding, Multicasting;

• Quality of Service: Integrated Services, Differentiated Services, MPLS;

• Congestion control, TCP Tahoe, TCP Reno, TCP Vegas, Fast-TCP.

(3) Wireless Communications: 6 hours of lectures, 4 hours of lab work, 4 hours of seminars (classes)

• Signal space, maximum a posteriori detection, maximum likelihood detection;

• Design of communication system, power / bandwidth limited systems, digital modulations;

• Narrowband fading channel models and channel capacity;

• Waterfilling algorithm, adaptive QAM.

Furthermore, immediately after my recruitment at ENSEA I was tasked with developing the second year option on "Internet of things" (IoT Option: 36 hours of lectures, 28 hours of lab work in total). I have engaged with the FIT IoT-lab of INRIA in Saclay and secured three related lab sessions with remote access to the FIT-IoT lab. In the IoT option, typically 2 instructors from the industry (Nokia, Huawei or Orange) give a number of lectures on topics related to low power wide area networks (LPWAN), 3GPP standards (NB-IoT, MTC), vehicular IoT, wireless sensor networks. In the IoT option I give 6 hours of lectures on (4) IoT security and 4 hours of lab work, covering the following topics:

• Background concepts, introduction to DTLS and IPSec;

• Introduction to blockchains for IoT;

• RFID authentication;

• Jamming attacks (primarily through lab work).

Student satisfaction in the IoT Option has been strong with an average 4/5 in the first year, bringing it amongst the best ranked second year options with a consistently high demand.

Continuous Education Track (teaching in French)

Additionally, I am teaching at the final year of the "cycle par alternace" of ENSEA in the specialization "Réseaux et Télécommunications" the module "Interconnexion et Administration des Réseaux", mirroring a reduced syllabus of the topics covered in the engineering track module "Internetworking". The module consists of 10 hours of lectures, 16 hours of lab work and 10 hours of seminars (classes).

Overview of Teaching Activities in the UK

Since July 2015 I have been a Fellow of the Higher Education Academy (FHEA) of the UK. FHEA is a professional title in higher education that is recognized (and currently required) by academic institutions in the United Kingdom. To become FHEA, I followed the courses offered at the University of Essex as part of the CADENZA program, between October 2014 and March 2015. Then, I prepared my teaching portfolio which included: (i) factual aspects concerning my teaching experience, (ii) in-depth familiarization with recognized teaching theories, showcased in a pedagogical thesis. The evaluation of my portfolio by the HEA took place in May 2015 and I obtained the title of a FHEA the following July. In addition, student satisfaction in the courses I have taught has been particularly strong. Notably, in the Student Evaluation of Teaching (SET) for the year 2014-2015 I scored a perfect 5/5 for my teaching of the course CE702 Digital Communications at the University of Essex.

CHAPTER 1. ACTIVITY REVIEW

University of Essex

I served as a Lecturer at the University of Essex, School of Computer Science and Electronic Engineering between 2013-2017. From 2014 to 2017 I was responsible for the module "CE702 -Digital Communications" of the MSc in Advanced Communication Systems. The 12-week module included weekly lectures and seminars (classes). Throughout the semester, 2 different assignments were given. Topics covered include:

• Systems and signals, channel coding, modulation, OFDM, MIMO;

• Multiple access methods: TDD, FDD, TDMA, FDMA, CDMA, OFDMA;

• Wireless multipath channels, equalization;

• Antennas, satellite communication;

• Optical networks, wavelength division multiplexing (WDM), dense WDM (DWDM).

In January 2015 I became the responsible of the module "CE823 -Network Security and Cryptographic Principles" of the MSc in Computer Networks and Security and of the optional third-year BSc module CE324 (with the same description). The 12 weeks long module included weekly lectures and lab sessions. Throughout the semester, 2 different assignments were given. The course syllabus is described below:

• Data Confidentiality: perfect secrecy, semantic security, stream ciphers, block ciphers, DES, 3DES, AES;

• Data Integrity: message authentication codes (MAC), authenticated encryption;

• Key management using a trusted third party, Kerberos protocol;

• Public key encryption, Diffie Hellman, El Gamal, RSA;

• Digital signatures, digital certificates, public key infrastructure;

• SSL / TLS, HTTPS, SSH, IPSec, DNSSec;

• Denial of service (DoS), intrusion detection, firewalls;

• Security of wireless networks, WEP, WPA, WPA2.

After my maternity leave (Sep. 2015-Jun. 2016) I became responsible for the reorganization of the module "CE740 Mobile Communications" of the MSc Computer Networks and Security and of the MSc in Electronic Engineering. The 12-weeks long module consisted of weekly lectures. Throughout the semester, 3 different assignments are given. Topics covered included:

• Routing: routing for static networks (Dijkstra algorithm), dynamic source routing for ad-hoc networks, clustering, data aggregation;

• MAC: Static access methods (TDMA, FDMA, CDMA, OFDMA), random access (Aloha, Slotted Aloha, CSMA, CSMA / CD, CSMA / CA), MACA protocol, scatternets, piconets, master-slave protocols, management power management / wake-up patterns, infrastructure networks and ad-hoc networks, 802.11;

• Physical layer: wireless channel, capacity, waterfilling, diversity, modulation, OFDM, Direct Sequence Spread Spectrum, Frequency Hopping Spread Spectrum, MIMO, 5G.

In addition, while at the University of Essex I supervised 3 MSc students in their projects, one of which obtained an MSc by research dissertation (year-long research project, related conference paper [C27]). Finally, I supervised 8 BSc projects, one of which was awarded the best departmental project award on "Securing DNS on Android".

• Introduction to MIMO systems, multi-path wireless channels, equalization;

• Introduction to optical systems.

In addition, I have supervised more than 10 master students in their projects, in a variety of subjects and areas of research, including physical layer security, network security, detection of anomalies in networks.

Research Supervision

My supervision activities at the PhD level include 2 students that have scheduled theses' defences for September 2020 and two further that are ongoing. In detail:

1.6.1 PhD Theses to be Defended in September 2020 Finally, my perspectives for future research in 6G technologies are presented in Chapter 5 and selected publications are included in the Appendix.

Chapter 2

Security Protocols for Internet of Things Applications

Introduction

With the emergence of 5G low latency applications, such as haptics and V2X, low complexity and low latency security mechanisms are needed. Promising lightweight mechanisms include physical unclonable functions (PUF) and secret key generation (SKG) at the physical layer, as considered in this Chapter. In this framework we propose i) a zero-round-trip-time (0-RTT) resumption authentication protocol combining PUF and SKG processes; ii) a novel authenticated encryption (AE) using SKG; iii) pipelining of the AE SKG and the encrypted data transfer in order to reduce latency. Implementing the pipelining at PHY, we investigate a parallel SKG approach for multi-carrier systems, where a subset of the subcarriers are used for SKG and the rest for data transmission. The optimal solution to this PHY resource allocation problem is identified under security, power and delay constraints, by formulating the subcarrier scheduling as a subset-sum 0 -1 knapsack optimization. A heuristic algorithm of linear complexity is proposed and shown to incur negligible loss with respect to the optimal dynamic programming solution. All of the proposed mechanisms, have the potential to pave the way for a new breed of latency aware security protocols.

Contributions and Chapter Organization

Many standard cryptographic schemes, particularly those in the realm of public key encryption (PKE), are computationally intensive, incurring considerable overheads and can rapidly drain the battery of power constrained devices [1], [2], notably in Internet of things (IoT) applications [3]. For example, a 3GPP report on the security of ultra reliable low latency communication (URLLC) systems notes that authentication for URLLC is still an open problem [4]. Additionally, traditional public key generation schemes are not quantum secure -in that when sufficiently capable quantum computers will be available they will be able to break current known PKE schemes -unless the key sizes increase to impractical lengths.

In the past years, physical layer security (PLS) [5][6][7][8][9] has been studied as a possible alternative to classic, complexity based, cryptography. As an example, signal properties as in [10], can be exploited to generate opportunities for confidential data transmission [11,12]. Notably, PLS is explicitly mentioned as a 6G enabling technology in the first white paper on 6G [13]: "The strongest security protection may be achieved at the physical layer." In this work, we propose to move some of the security core functions down to the physical layer, exploiting both the communication radio channel and the hardware, as unique entropy sources.

Since the wireless channel is reciprocal, time-variant and random in nature, it offers a valid, inherently secure source that may be used in a key agreement protocol between two communicating parties. The principle of secret key generation (SKG) from correlated observations was first studied in [14] and [15]. A straightforward SKG approach can be built by exploiting the reciprocity of the wireless fading coefficients between two terminals within the channel coherence time [16] and the contributions in this Chapter build upon this mechanism. This is pertinent to many forthcoming B5G applications that will require a strong, but nevertheless, lightweight security key agreement; in this direction, PLS may offer such a solution, or, complement existing algorithms. With respect to authentication, physical unclonable functions (PUFs), firstly introduced in [17] (based on the idea of physical one-way functions [18], [19]), could also enhance authentication and key agreement in demanding scenarios, including (but not limited to) device to device (D2D) and tactile Internet. We note that others also point to using physical layer security to reduce the resource overhead in URLLC [20].

A further advantage of PLS is that it is information-theoretic secure [21], i.e., it is not open to attack by future quantum computers, and, it requires lower computation costs. In this work, we will discuss how SKG from shared randomness [22] is a promising alternative to PKE for key agreement. However, unauthenticated key generation is vulnerable to man in the middle (MiM) attacks. In this sense, PUFs, can be used in conjunction with SKG to provide authenticated secret key agreement. As summarised in [19], the employment of PUFs can decrease the computational cost and play a pivotal role in reducing the authentication latency in constrained devices.

In this study we introduce the joint use of PUF authentication and SKG in a zero-round-trip-time (0-RTT) [23,24] approach, allowing to build quick authentication mechanisms with forward security. Further, we develop an authenticated encryption (AE) primitive [25][26][27] based on standard SKG schemes. To investigate a fast implementation of the AE SKG we propose a pipelined (parallel ) scheduling method for optimal resource allocation at the physical layer (PHY) (i.e., by optimal allocation of the subcarriers in 5G resource blocks).

Next, we extend the analysis to account for statistical delay quality of service (QoS) guarantees, a pertinent scenario in B5G. The support of different QoS guarantee levels is a challenging task. In fact, in time-varying channels, such as in wireless networks, determining the exact delay-bound depending on the users' requirements, is impossible. However, a practical approach, namely the effective capacity [28], can provide statistical QoS guarantees, and, can give delay-bounds with a small violation probability. In our work, we employ the effective capacity as the metric of interest and investigate how the proposed pipelined AE SKG scheme performs in a delay-constrained scenario.

The system model introduced in this work assumes that a block fading additive white Gaussian noise (BF-AWGN) channel is used with multiple orthogonal subcarriers. In our parallel scheme a subset of the subcarriers is used for SKG and the rest for encrypted data transfer. The findings of this study are supported by numerical results, and the efficiency of the proposed parallel scheme is shown to be greater or similar to the efficiency of an alternative approach in which SKG and encrypted data transfer are sequentially performed.

To summarize, the contributions of this Chapter are as follows:

1. We combine PUF authentication and SKG for resumption key agreement in a single 0-RTT protocol.

2. We develop an AE SKG scheme.

3. We propose a fast implementation of the AE SKG based on pipelining of key generation and encrypted data transfer. This parallel approach is achieved by allocation of the PHY resources, i.e., by optimal scheduling of the subcarriers in BF-AWGN channels.

4. We propose a heuristic algorithm of linear complexity that finds the optimal subcarrier allocation with negligible loss in terms of efficiency. scenarios:

• When a relaxed QoS delay constraint is in place;

• When a stringent QoS delay constraint is in place.

A roadmap of the Chapter's contributions is shown in Fig. 2.1.

Threat Model

In this work we assume a commonly used adversarial model with an active man-in-the-middle attacker (Eve) and a pair of legitimate users (Alice and Bob). For simplicity, we assume a rich Rayleigh multipath environment where the adversary is more than a few wavelengths away from each of the legitimate parties. This forms the basis of our hypothesis that the measurements of Alice and Bob are uncorrelated to the Eve's measurements.

Notation

Random variables are denoted in italic font, e.g., x, vectors and matrices are denoted with lower and upper case bold characters, e.g., x and X, respectively. Functions are printed in a fixed-width teletype font, e.g., F. All sets of vectors are given with calligraphic font X and the elements within a set are given in curly brackets e.g. {x, y}, the cardinality of a vector or set is defined by vertical lines e.g., |x| or |X | . Concatenation and bit-wise XORing are represented as [x||y] and x ⊕ y, respectively. We use H to denote entropy, I mutual information, E expectation and C the set of complex numbers.

Chapter Organization

The rest of the Chapter is organized as follows: related work is discussed in Section 2.3 followed by the general system model introduced in Section 2.4. The use of PUF authentication is illustrated in Section 2.4.1, the baseline SKG in Section 2.4.2; next, in Sections 2.4.3 and 2.4.4 we present an AE scheme using SKG and a resumption scheme to build a 0-RTT protocol. Subsequently, we evaluate the optimal power and subcarrier allocation at PHY considering both the long term average rate in Section 2.5 and the effective rate in Section 2.6. In Section 2.7, the efficiency of the proposed approach is evaluated against that of a sequential approach, while conclusions are presented in Section 2.8.

Related Work

This work assumes the use of PUF-based authentication with SKG. PUFs are hardware entities based on the physically unclonable variations that occur during the production process of silicon. These unique and unpredictable variations allow the extraction of uniformly distributed binary sequences. Due to their unclonability and simplicity, PUFs are seen as lightweight security primitives that can offer alternatives to today's authentication mechanisms. Furthermore, employing PUFs can eliminate the need of non-volatile memory, which reduces cost and complexity [29]. Common ways of extracting secret bit sequences are through measuring jitter on oscillators, delays on gates, or, observing the power up behavior of a silicon.

Numerous PUF architectures have been proposed for IoT applications in the literature. A few of these architectures are: arbiter PUF [30], ring oscillator PUF [17], transient effect ring oscillator PUF [31], static random-access memory PUF [32], hardware embedded delay PUF [33] and more [34]. Utilising these basic properties, many PUF-based authentication protocols have been proposed, both for unilateral authentication [35,36] and mutual authentication [29,[36][37][38]. A comprehensive survey on lightweight PUF authentication schemes is presented by Delvaux et al. [39].

On the other hand, due to the nature of propagation in the shared, free-space medium, wireless communications remain vulnerable to different types of attacks. Passive attacks such as eavesdropping or traffic analysis can be performed by anyone in the vicinity of the communicating parties; to ensure confidentiality, data encryption is vital for communication security. The required keys can be agreed at PHY using SKG. In this case, all pilot exchanges need to take place over the coherence time of the channel1 , during which Alice and Bob can observe highly correlated channel states that can be used to generate a shared secret key between them. SKG has been implemented and studied for different applications such as vehicular communications [42,43], underwater communications [44], optical fiber [45], visible light communication [46] and more as summarized in [47]. The key conclusion from these studies is that SKG shows promise as an important alternative to current key agreement schemes.

Widely used sources of shared randomness used for SKG are the received signal strength (RSS) and the full channel state information (CSI) [48]. In either case, it is important to build a suitable pre-processing unit to decorrelate the signals in the time / frequency and space domains. As an example, some recent works have shown that the widely adopted assumption [49] that a distance equal to half of the wavelength (which at 2.4 GHz is approximately 6 cm [50]) is enough for two channels to decorrelate, may not hold in reality [40]. Other works show that the mobility can highly increase the entropy of the generated key [51,52] while an important issue with the RSS-based schemes is that they are open to predictable channel attacks [40,53]. These important issues need to be explicitly accounted for in actual implementations, but fall outside the scope of the present Chapter. We note in passing that pilot randomization can be employed to overcome limitations related to channel predictability [54].

Node Authentication Using PUFs and SKG

In this Section we present a joint physical layer SKG and PUF authentication scheme. To the best of our' knowledge this is the first work that proposes the utilization of the two schemes in conjunction. As discussed in Section 2.3, many PUF authentication protocols have been proposed in the literature, with even a few commercially available [55,56]. We do not look into developing a new PUF architecture or a new PUF authentication protocol, instead, we look at combining existing PUF mechanisms with SKG. In addition, we develop an AE scheme that can prevent tampering attacks. To further develop our hybrid crypto-system we propose a resumption type of authentication protocol, inspired by the 0-RTT authentication mode in the transport layer security (TLS) 1.3 protocol. The resumption protocol is important as it significantly reduces the use of the PUF to the initial authentication, thus, overcoming the limitation of a PUFs' challenge response space [34,[START_REF] Maiti | A robust physical unclonable function with enhanced challenge-response set[END_REF].

Node Authentication Using PUFs

As discussed in Section 3.9.3, for security against MiM attacks, the SKG needs to be protected through authentication. While existing techniques, such as the extensible authentication protocol-transport layer security (EAP-TLS), could be used as the authentication mechanism, these are computationally intensive and can lead to significant latency [START_REF] Akhlaq | Comparative analysis of IEEE 802.1x authentication methods[END_REF][START_REF] Chiornitȃ | A practical analysis of EAP authentication methods[END_REF].

This leads to the motivation to seek lightweight authentication mechanisms that can be used in conjunction with SKG. Such a mechanism that is achieving note within the research community uses a PUF. A typical PUF-based authentication protocol consists of two main phases, namely enrolment phase and authentication phase [START_REF] Chatterjee | A PUF-based secure communication protocol for IoT[END_REF][START_REF] Aman | Two-factor authentication for IoT with location information[END_REF][START_REF] Mahalat | A PUF based light weight protocol for secure WiFi authentication of IoT devices[END_REF][START_REF] Braeken | Puf based authentication protocol for IoT[END_REF][START_REF] Yilmaz | Lightweight PUF-based authentication protocol for IoT devices[END_REF]. During the enrolment phase each node runs a set of challenges on its PUF and characterizes the variance of the measurement noise in order to generate side information. Next, a verifier creates and stores a database of all challenge-response pairs (CRPs) for each node's PUF within its network. A CRP pair in essence consists of an authentication key and related side information. Within the database, each CRP is associated with the ID of the corresponding node.

Later, during the authentication phase a node sends its ID to the verifier requesting to start a communication. Receiving the request, the verifier checks if the received ID exists in its database. If it does, the verifier chooses a random challenge that corresponds to this ID and sends it to the node. The node computes the response by running the challenge on its PUF and sends it to the verifier. However, the PUF measurements at the node are never exactly the same due to measurement noise, therefore, the verifier uses the new PUF measurement and the side information stored during the enrollment to re-generate the authentication key. Finally, the verifier compares the re-generated key to the one in the CRP and if they are identical the authentication of the node is successful. A simple approach to prevent replay attacks consists in deleting a CRP from the verifier database once it is used, but more elaborate schemes can also be built.

In summary, the motivation for using a PUF authentication scheme in conjunction with SKG is to exclude all of the computationally intensive operations required by EAP-TLS, which use modulo arithmetic in large fields. Measurements performed on current public key operations within EAP-TLS on common devices (such as IoT) give average authentication and key generation times of approximately 160 ms in static environments and this can reach up to 336 ms in high mobility conditions [START_REF] Ahmad | Latency evaluation of extensible authentication protocols in WLANs[END_REF].

On the other hand, PUF authentication protocols have very low computational overhead and require overall authentication times that can be less than 10 ms [START_REF] Aman | Two-factor authentication for IoT with location information[END_REF][START_REF] Gope | Lightweight and privacy-preserving two-factor authentication scheme for IoT devices[END_REF]. Furthermore, our key generation scheme, proposed in Section 2.4.2, requires just a hashing operation and (syndrome) decoding. Hashing mechanisms such as SHA256 performed on an IoT device require less than 0.3ms [START_REF] Gope | Lightweight and privacy-preserving two-factor authentication scheme for IoT devices[END_REF][START_REF] Ometov | Feasibility characterization of cryptographic primitives for constrained (wearable) IoT devices[END_REF]. Regarding the decoding, if we assume the usage of standard LDPC or BCH error correcting mechanisms, even in the worst-case scenario with calculations carried out as software operations, the computation is trivial compared to the hashing and requires less computational overhead [START_REF] Cho | Efficient software-based encoding and decoding of BCH codes[END_REF].

SKG Procedure

The SKG system model is shown in Fig. 2.2. This assumes that two legitimate parties, Alice and Bob, wish to establish a symmetric secret key using the wireless fading coefficients as a source of shared randomness. Throughout our work a rich Rayleigh multipath environment is assumed, such that the fading coefficients rapidly decorrelate over short distances [16]. Furthermore, Alice and Bob communicate over a BF-AWGN channel that comprises N orthogonal subcarriers. The fading coefficients h = [h 1 , . . . , h N ], are assumed to be independent and identically distributed (i.i.d), complex circularly symmetric zero-mean Gaussian random variables h j ∼ CN (0, σ 2 ), j = 1, . . . , N . Although in actual multicarrier systems neighbouring subcarriers will typically experience correlated fading, in the present work this effect is neglected as its impact on SKG has been treated in numerous contributions in the past [START_REF] Chen | Secret key establishment using temporally and spatially correlated wireless channel coefficients[END_REF][START_REF] Zhang | Efficient key generation by exploiting randomness from channel responses of individual OFDM subcarriers[END_REF][START_REF] Zhang | On the key generation from correlated wireless channels[END_REF] and will not enhance the problem formulation in the following Sections.

The SKG procedure encompasses three phases: advantage distillation, information reconciliation, and privacy amplification [14], [15] as described below: 1) Advantage distillation: This phase takes place during the coherence time of the channel. The legitimate nodes sequentially exchange constant probe signals with power P on all subcarriers2 , to obtain estimates of their reciprocal CSI. We note in passing that the pilot exchange phase can be made robust with respect to injection type of attacks (that fall in the general category of MiM) as analyzed in [54]. Commonly, the received signal strength (RSS) has been used as the source of shared randomness for generating the shared key, but it is possible to use the full CSI [START_REF] Saiki | A novel physical layer authenticated encryption protocol exploiting shared randomness[END_REF]. At the end of this phase, Alice and Bob obtain observation vectors x A = [x A,1 , . . . , x A,N ], x B = [x B,1 , . . . , x B,N ], respectively, so that:

x A = √ P h + z A , (2.1)
x B = √ P h + z B , (2.2)
where z A and z B denote zero-mean, unit variance circularly symmetric complex AWGN random vectors, such that (z A , z B ) ∼ CN (0, I 2N ). On the other hand, Eve observes x E = [x E,1 , . . . , x E,N ] with:

x E = √ P h E + z E . (2.3)
Due to the rich Rayleigh multipath environment, Eve's channel measurement h E is assumed uncorrelated to h and z E denotes a zero-mean, unit variance circularly symmetric complex AWGN random vector z E ∼ CN (0, I N ).

2) Information reconciliation: At the beginning of this phase the observations x A,j , x B,j are quantized to binary vectors3 r A,j , r B,j j = 1, . . . , N [START_REF] Wang | Fast and scalable secret key generation exploiting channel phase randomness in wireless networks[END_REF][START_REF] Ye | Information-theoretically secret key generation for fading wireless channels[END_REF][START_REF] Huth | Information reconciliation schemes in physical-layer security[END_REF], so that Alice and Bob distill r A = [r A,1 || . . . ||r A,N ] and r B = [r B,1 || . . . ||r B,N ], respectively. Due to the presence of noise, r A and r B will differ. To reconcile discrepancies in the quantizer local outputs, side information needs to be exchanged via a public channel. Using the principles of Slepian Wolf decoding, the distilled binary vectors can be CHAPTER 2. SECURITY PROTOCOLS FOR INTERNET OF THINGS APPLICATIONS expressed as

r A = d + e A , (2.4
)

r B = d + e B , (2.5)
where e A , e B are error vectors that represent the distance from the common observed (codeword) vector d at Alice and Bob, respectively. Numerous practical information reconciliation approaches using standard forward error correction codes (e.g., LDPC, BCH, etc.,) have been proposed [16], [START_REF] Saiki | A novel physical layer authenticated encryption protocol exploiting shared randomness[END_REF]. As an example, if a block encoder is used, then the error vectors can be recovered from the syndromes s A and s B of r A and r B , respectively. Alice transmits her corresponding syndrome to Bob so that he can reconcile r B to r A . It has been shown that the length of the syndrome [15]. This has been numerically evaluated for different scenarios and coding techniques [START_REF] Ye | Information-theoretically secret key generation for fading wireless channels[END_REF][START_REF] Guyue | A hybrid information reconciliation method for physical layer key generation[END_REF][START_REF] Treeviriyanupab | BCH-based Slepian-Wolf coding with feedback syndrome decoding for quantum key reconciliation[END_REF][START_REF] Etesami | LDPC code construction for wireless physical-layer key reconciliation[END_REF]. Following that, the achievable SKG rate is upper bounded by I(x A ; x B |x E ).

|s A | is lower bounded by |s A | ≥ H(x A |x B ) = H(x A , x B ) -H(x B )
3) Privacy amplification: The secret key is generated by passing r A through a one-way collision resistant compression function i.e., by hashing. Note that this final step of privacy amplification, is executed locally without any further information exchange. The need for privacy amplification arises in order to suppress the entropy revealed due to the public transmission of the syndrome s A . Privacy amplification produces a key of length strictly shorter than |r A |, at least by |s A |. At the same time, the goal is for the key to be uniform, i.e., to have maximum entropy. In brief, privacy amplification reduces the overall output entropy while at the same time increases the entropy per bit -compared to the input.

The privacy amplification is typically performed by applying either cryptographic hash functions such as those built using the Merkle-Damgard construction, or universal hash functions and has been proven to be secure, in an information theoretic sense, through the leftover hash lemma [START_REF] Bennett | Generalized privacy amplification[END_REF]. As an example, [40,[START_REF] Zhan | On the using of discrete wavelet transform for physical layer key generation[END_REF] use a 2-universal hash family to achieve privacy amplification. Summarizing, the maximum key size after privacy amplification is:

|k| ≤ H(x A ) -I(x A ; x E ) -H(x A |x B ) -r 0 , (2.6)
where H(x A ) represents the entropy of the measurement, I(x A ; x E ) represents the mutual information between Alice's and Eve's observations, H(x A |x B ) represents the entropy revealed during information reconciliation and r 0 > 0 is an extra security parameter that ensures uncertainty on the key at Eve's side. For details and estimation of these parameters in a practical scenario please see [START_REF] Bloch | Wireless information-theoretic security[END_REF].

As shown in this Section the SKG procedure requires only a few simple operations such as quantization, syndrome calculation and hashing. In future work we will examine the real possibilities of implementing such a mechanism in practical systems.

AE Using SKG

To develop a hybrid cryptosystem that can withstand tampering attacks, SKG can be introduced in standard AE schemes in conjunction with standard block ciphers in counter mode (to reduce latency), e.g., the advanced encryption standard (AES) in Galois counter mode (GCM). As a sketch of such a primitive, let us assume a system with three parties: Alice who wishes to transmit a secret message m with size |m|, to Bob with confidentiality and integrity, and Eve, that can act as a passive and active attacker. The following algorithms are employed:

• The SKG scheme denoted by G : C → K × S, accepting as input the fading coefficients (modelled as complex numbers), and generating as outputs binary vectors k and s A in the key and syndrome spaces, of sizes |k| and |s A |, respectively, where k ∈ K denotes the key obtained from h after privacy amplification and s A is Alice's syndrome.

G(h) = (k, s A ) , (2.7
• A symmetric encryption algorithm, e.g., AES GCM, denoted by Es : K × M → C T where C T denotes the ciphertext space with corresponding decryption Ds : K × C T → M, such that

Es(k, m) = c, (2.8
)

Ds(k, c) = m, (2.9)
for m ∈ M, c ∈ C T .

• A pair of message authentication code (MAC) algorithms, e.g., in hashed-MAC (HMAC) mode, denoted by Sign : K × M → T , with a corresponding verification algorithm Ver : K × M × T → (yes, no), such that

Sign(k, m) = t, (2.10)
Ver(k, m, t) = yes, if integrity verified no, if integrity not verified (2.11)

A hybrid crypto-PLS system for AE SKG can be built as follows:

1. The SKG procedure is launched between Alice and Bob generating a key and a syndrome G(h) = (k, s A ).

2. Alice breaks her key into two parts k = {k e , k i } and uses the first to encrypt the message as c = Es(k e , m). Subsequently, using the second part of the key she signs the ciphertext using the signing algorithm t = Sign(k i , c) and transmits to Bob the extended ciphertext [s A c t], as it is depicted in Fig. 2.3.

3. Bob checks first the integrity of the received ciphertext as follows: from s A and his own observation he evaluates k = {k e , k i } and computes Ver(k i , c, t). The integrity test will fail if any part of the extended ciphertext was modified, including the syndrome (that is sent as plaintext); for example, if the syndrome was modified during the transmission, then Bob would not have evaluated the correct key and the integrity test would have failed.

4. If the integrity test is successful then Bob decrypts m=Ds(k e , c).

Resumption Protocol

In Section 2.4.1 we discussed that using PUF authentication can greatly reduce the computational overhead of a system. Authentication of new keys is required at the start of communication and at each key renegotiation. However, the number of challenges that can be applied to a single PUF is limited.

Due to that we present a solution that is inspired by the 0-RTT authentication mode introduced in the 1.3 version of the TLS [23]. The use of 0-RTT obviates the need of performing a challenge for every re-authentication through the use of a resumption secret r s , thus reducing latency. Another strong motivation for using this mechanism is that it is forward secure in the scenario we are using here [24]. We first briefly describe the TLS 0-RTT mechanism before describing a similarly inspired 0-RTT mechanism applied to the information reconciliation phase of our SKG mechanism. The TLS 1.3 0-RTT handshake works as follows: In the very first connection between client and server a regular TLS handshake is used. During this step the server sends to the client a look-up identifier k l for a corresponding entry in session caches or it sends a session ticket. Then both parties derive a resumption secret r s using their shared key and the parameters of the session. Finally, the client stores the resumption secret r s and uses it when reconnecting to the same server which also retrieves it during the re-connection.

CHAPTER 2. SECURITY PROTOCOLS FOR INTERNET OF THINGS APPLICATIONS

If session tickets are used the server encrypts the resumption secret using long-term symmetric encryption key, called a session ticket encryption key (STEK), resulting in a session ticket. The session ticket is then stored by the client and included in subsequent connections, allowing the server to retrieve the resumption secret. Using this approach the same STEK is used for many sessions and clients. On one hand, this property highly reduces the required storage of the server, however, on the other hand, it makes it vulnerable to replay attacks and not forward secure. Due to these vulnerabilities, in this work we focus on the session cache mechanism described next.

When using session caches the server stores all resumption secrets and issues a unique look-up identifier k l for each client. When a client tries to reconnect to that server it includes its look-up identifier k l in the 0-RTT message, which allows the server to retrieve the resumption secret r s . Storing a unique resumption secret r s for each client requires server storage for each client but it provides forward security and resilience against replay attacks, when combined with a key generation mechanisms such as Diffie Hellman (or the SKG proposed in the present) which are important goals for security protocols [24]. In our physical layer 0-RTT, given that a node identifier state would be required for link-layer purposes, the session cache places little comparative load and thus is the mechanism proposed here for (re-)authentication.

The physical layer resumption protocol modifies the information reconciliation phase of Section 2.4.2 following initial authentication to provide a re-authentication mechanism between Alice and Bob. At the first establishment of communication we assume initial authentication is established, such as the mechanism shown in Section 2.4.1. During that Alice sends to Bob a look-up identifier k l . Then, both derive a resumption secret r s that is identified by k l . Note, r s and the session key have the same length |k|. Then referring to the notation and steps in Section 4.1-4.3:

1. Advantage distillation phase is carried out as before (See section 2.4.2), where both parties obtain channel observations and obtain the vectors r A and r B .

2. During the information reconciliation phase both Alice and Bob exclusive-or the resumption secret r s with their observations r A and r B , obtaining syndromes s A and s B with which both parties can carry out reconciliation to obtain the same shared value which is now r A ⊕ r s .

3. The privacy amplification step in Section 4.2 is carried out as before, but now the hashing takes place on r A ⊕ r s to produce the final shared key k that is a result of both the shared wireless randomness and the resumption secret.

Note that the key k can only be obtained if both the physical layer generated key and the resumption key are valid and this method can be shown to be forward secure [24].

Pipelined SKG and Encrypted Data Transfer

As explained in the previous Section, if Alice and Bob follow the standard sequential SKG process they can exchange encrypted data only after both of them have distilled the key at the end of the privacy amplification step. In this Section, we propose a method to pipeline the SKG and encrypted data transfer. Alice can unilaterally extract the secret key from her observation and use it to encrypt data transmitted in the same "extended" ciphertext that contains the side information (see Fig. 2.3). Subsequently, using the side information, Bob can distill the same key k and decrypt the received data in one single step.

We have discussed in Section 2.4.2 how Alice and Bob can distill secret keys from estimates of the fading coefficients in their wireless link and in Section 2.4.3 how these can be used to develop an AE SKG primitive. At the same time CSI estimates are prerequisite in order to optimally allocate power across the subcarriers and achieve high data rates 4 . As a result, a question that naturally arises is whether the CSI estimates (obtained at the end of the pilot exchange phase), should be used towards the generation of secret keys or towards the reliable data transfer, and, furthermore, whether the SKG and the data transfer can be inter-woven using the AE SKG principle.

In this study, we are interested in answering this question and shed light into whether following the exchange of pilots, Alice should transmit reconciliation information on all subcarriers, so that she and Bob can generate (potentially) a long sequence of key bits, or, alternatively, perform information reconciliation only over a subset of the subcarriers and transmit encrypted data over the rest, exploiting the idea of the AE SKG primitive. Note here that the data can be already encrypted with the key generated at Alice, the sender of the side information, so that the proposed pipelining does not require storing keys for future use. We will call the former approach a sequential scheme, while we will refer to the latter as a parallel scheme. The two will be compared in terms of their efficiency with respect to the achievable data rates.

A simplified version of this problem, where the reconciliation rate is roughly approximated to the SKG rate, was investigated in [START_REF] Mitev | Optimal resource allocation in joint secret key generation and data transfer schemes[END_REF]. In this study it was shown that in order to maximize the data rates in the parallel approach Alice and Bob should use the strongest subcarriers -in terms of SNRfor data transmission and the worst for SKG. Under this simplified formulation, the optimal power allocation for the data transfer has been shown to be a modified waterfilling solution.

Here, we explicitly account for the rate of transmitting reconciliation information and differentiate it from the SKG rate. We confirm whether the policy of using the strongest subcarriers for data transmission and not for reconciliation, is still optimal when the full optimization problem is considered, including the communication cost for reconciliation.

As discussed in Section 2.4.2, our physical layer system model assumes Alice and Bob exchange data over a Rayleigh BF-AWGN channel with N orthogonal subcarriers. Without loss of generality the variance of the AWGN in all links is assumed to be unity. During channel probing, constant pilots are sent across all subcarriers [16,[START_REF] Belmega | Protecting secret key generation systems against jamming: Energy harvesting and channel hopping approaches[END_REF] with power P . Using the observations (2.1), Alice estimates the channel coefficients as ĥj = h j + hj , (2.12)

for j = 1, . . . , N where hj denotes an estimation error that can be assumed to be Gaussian, hj ∼ CN (0, σ 2 e ) [START_REF] Medard | The effect upon channel capacity in wireless communications of perfect and imperfect knowledge of the channel[END_REF]. Under this model, the following rate is achievable on the j-th subcarrier from Alice to Bob when the transmit power during data transmission is p j [START_REF] Medard | The effect upon channel capacity in wireless communications of perfect and imperfect knowledge of the channel[END_REF]:

R j = log 2 1 + g j p j σ 2 e P + 1 = log 2 (1 + ĝj p j ), (2.13)
where we use ĝi = g i σ 2

i,e P +1 , to denote the estimated channel gains. As a result, the channel capacity C = N j=1 R j under the short term power constraint

N j=1 p j ≤ N P, p j ≥ 0, ∀j ∈ {1, . . . , N }, (2.14)
is achieved with the well known waterfilling power allocation policy

p j = 1 λ -1 ĝj +
, where the waterlevel λ is estimated from the constraint (2.14). In the following, the estimated channel gains ĝj arewithout loss of generality -assumed ordered in descending order, so that: ĝ1 ≥ ĝ2 ≥ . . . ≥ ĝN .

(2.15)

As mentioned above, the advantage distillation phase of the SKG process consists of the two-way exchange of pilot signals during the coherence time of the channel to obtain r A,j , r B,j , j = 1, . . . , N .

On the other hand, the CSI estimation phase can be used to estimate the reciprocal channel gains in order to optimize data transmission using the waterfilling algorithm. In the former case, the shared parameter is used for generating symmetric keys, in the latter for deriving the optimal power allocation. In the parallel approach the idea is to inter-weave the two procedures and investigate whether a joint encrypted data transfer and key generation scheme as in the AE SKG in Section 4.3 could bear any advantages with respect to the system efficiency. While in the sequential approach the CSI across all subcarriers will be treated as a source of shared randomness between Alice and Bob, in the parallel approach it plays a dual role.

Parallel Approach

In the parallel approach, after the channel estimation phase, the legitimate users decide on which subcarrier to send the reconciliation information (e.g., the syndromes as discussed in Section 2.4.2) and on which data (i.e., the SKG process here is not performed on all of the subcarriers). The total capacity has now to be distributed between data and reconciliation information bearing subcarriers. As a result, the overall set of orthogonal subcarriers comprises two subsets; a subset D that is used for encrypted data transmission with cardinality |D| = D and a subset D with cardinality | D| = N -D used for reconciliation such that, D ∪ D = {1, . . . , N }. Over D the achievable sum data transfer rate, denoted by C D is given by

C D = j∈D log 2 (1 + ĝj p j ), (2.16)
while on the subset D, Alice and Bob exchange reconciliation information at rate

C R = j∈ D log 2 (1 + ĝj p j ).
(2.17)

As stated in Section 2.4.2 the fading coefficients are assumed to be zero-mean circularly-symmetric complex Gaussian random variables. Using the theory of order statistics, the distribution of the ordered channel gains of the SKG subcarriers, j ∈ D, can be expressed as [START_REF] Yang | Order Statistics in Wireless Communications: Diversity, Adaptation, and Scheduling in MIMO and OFDM Systems[END_REF]:

f (g j ) = N ! σ 2 (N -j)!(j -1)! 1 -e -ĝj σ 2 N -j e -ĝj σ 2 j , (2.18)
where σ 2 is the variance of the channel gains. As a result of ordering the subcarriers, the variance of each of the subcarriers, is now given by:

σ 2 j = σ 2 N q=j 1 q 2 , j ∈ {D + 1, . . . , N }. (2.19)
Thus, we can now write the SKG rate as (note that the noise variances are here normalized to unity for simplicity) [16,[START_REF] Belmega | Protecting secret key generation systems against jamming: Energy harvesting and channel hopping approaches[END_REF]:

C SKG = j∈ D log 2   1 + P σ 2 j 2 + 1 P σ 2 j   . (2.20)
The minimum rate necessary for reconciliation was discussed in Section 4.2. Here, alternatively, we employ a practical design approach in which the rate of the encoder used is explicitly taken into account. Note that in a rate k n block encoder the side information is nk bits long, i.e., the rate of syndrome to output key bits after privacy amplification is n-k k . However, in each key session a 0-RTT look-up identifier of length k is also sent. Therefore, we define the parameter κ = n-k k + 1 = n k , i.e., the inverse of the encoder rate, that reflects the ratio of the reconciliation and 0-RTT transmission CHAPTER 2. SECURITY PROTOCOLS FOR INTERNET OF THINGS APPLICATIONS rate to the SKG rate. For example, for a rate k n = 1 2 encoder, κ = 2, etc. Based on this discussion, we capture the minimum requirement for the reconciliation rate through the following expression:

C R ≥ κC SKG .
(2.21) Furthermore, to identify the necessary key rate, we note that depending on the exact choices of the cryptographic suites to be employed, it is possible to reuse the same key for the encryption of multiple blocks of data, e.g., as in the AES GCM, that is being considered for employment in the security protocols for URLLC systems [4]. In practical systems, a single key of length 128 to 256 bits can be used to encrypt up to gigabytes of data. As a result, we will assume that for a particular application it is possible to identify the ratio of key to data bits, which in the following we will denote by β. Specifically, we assume that the following security constraint should be met

C SKG ≥ βC D , 0 < β ≤ 1, (2.22)
where, depending on the application, the necessary minimum value of β can be identified. We note in passing that the case β = 1 would correspond to a one-time-pad, i.e., the generated keys could be simply x-ored with the data to achieve perfect secrecy without the need of any cryptographic suites.

Accounting for the reconciliation rate and security constraints in (2.21) The optimization problem at hand is a mixed-integer convex optimization problem with unknowns both the sets D, D, as well as the power allocation policy p j , j ∈ {1, . . . , N }. These problems are typically NP hard and addressed with the use of branch and bound algorithms and heuristics.

In this work, we propose a simple heuristic to make the problem more tractable by reducing the number of free variables. In the proposed approach, we assume that the constraint (2.24) is satisfied with equality. The only power allocation that allows this is the waterfilling approach that uniquely determines the power allocation p j and also requires that the constraint (2.14) is also satisfied with equality. Thus, if we follow that approach, we determine the power allocation vector uniquely and can combine the remanining constraints (2.24)

j ← 1, R 0 ← 0, R N +1 ← 0 3: while j ≤ N -1 and N j=1 R j x j ≤ C 1+κβ do 4: N j=1 R j x j ← N j=1 R j-1 x j-1 + R j x j 5:
if N j=1 R j x j ≤ C 1+κβ then 6:

x j ← 1; j ← j + 1 7:

else do x j ← 0; j ← j + 1 8:

end if 9:
end while 10: end procedure

The new optimization problem can be re-written as max

x j ∈{0,1} N j=1 R j x j (2.27) s.t. N j=1 R j x j ≤ C 1 + κβ . (2.28)
The problem in (2.27)-(2.28) is a subset-sum problem from the family of 0 -1 knapsack problems, that is known to be NP hard [START_REF] Martello | Knapsack Problems: Algorithms and Computer Implementations[END_REF]. However, these type of problems are solvable optimally using dynamic programming techniques in pseudo-polynomial time [START_REF] Martello | Knapsack Problems: Algorithms and Computer Implementations[END_REF][START_REF] Kellerer | Knapsack Problems[END_REF]. Furthermore, it is known that greedy heuristic approaches are bounded away from the optimal solution by half [START_REF] Vazirani | Approximation Algorithms[END_REF].

We propose a simple greedy heuristic algorithm of linear complexity, as follows. 5 The data subcarriers are selected starting from the best -in terms of SNR -until (2.28) is not satisfied. Once this situation occurs the last subcarrier added to set D is removed and the next one is added. This continues either to the last index N or until (2.28) is satisfied with equality. The algorithm is described in Algorithm 1.

The efficiency of the proposed parallel method -measured as the ratio of the long-term data rate versus the average capacity -is evaluated as:

η parallel = E j∈D R j E[C] . (2.29)
This efficiency quantifies the expected back-off in terms of data rates when part of the resources (power and frequency) are used to enable the generation of secret keys at the physical layer. In future work, we will compare the efficiency achieved to that of actual approaches currently used in 5G by accounting for the actual delays incurred due to the PKE key agreement operations [20].

Sequential Approach

In the sequential approach encrypted data transfer and secret key generation are two separate events; first, the secret keys are generated over the whole set of subcarriers, leading to a sum SKG rate given as

C SKG = N log 2 1 + P σ 2 2 + 1 P σ 2 .
(2.30)

To estimate the efficiency of the scheme, we further need to identify the necessary resources for the exchange of the reconciliation information. We can obtain an estimate of the number of transmission frames that will be required for the transmission of the syndromes, as the expected value of the reconciliation rate (i.e., it's long-term value) E[C R ]. The average number of frames needed for reconciliation is then computed as:

M = κC SKG E[C R ] , (2.31)
where x denotes the smallest integer that is larger than x.

The average number of the frames that can be sent while respecting the secrecy constraint is:

L = C SKG βE[C] , (2.32)
where x denotes the largest interger that is smaller than x. The efficiency of the sequential method is then calculated as:

η sequential = L L + M .
(2.33)

Effective Data Rate Taking into Account Statistical Delay QoS Requirements

In the previous section, we investigated the optimal power and subcarrier allocations strategy of Alice and Bob in order to maximize their long-term average data rate and proposed a greedy heuristic algorithm of linear complexity. Here, we extend our work from Section 2.5 by taking into account delay requirements. In detail, we investigate the optimal resource allocation for Alice and Bob, when their communication has to satisfy specific delay constraints. To this end, we use the theory of effective capacity [28] which gives a limit for the maximum arrival rate under delay-bounds with a specified violation probability.

We study the effective data rate for the proposed pipelined SKG and encrypted data transfer scheme; the effective rate is a data-link layer metric that captures the impact of statistical delay QoS constraints on the transmission rates. As background, we refer to [START_REF] Chang | Stability, queue length, and delay of deterministic and stochastic queueing networks[END_REF] which showed that the probability of a steady-state queue length process Q(t) exceeding a certain queue-overflow threshold x converges to a random variable Q(∞) as:

lim x→∞ ln(Pr[Q(∞) > x]) x = -θ, (2.34)
where θ indicates the asymptotic exponential decay-rate of the overflow probability. For a large threshold x, (2.34) can be represented as P r[Q(∞) > x] ≈ e -θx . Furthermore, the delay-outage probability can be approximated by [28] :

Pr out delay =Pr[Delay >D max ] ≈ Pr[Q(∞)> 0]e -θζDmax , (2.35)
where D max is the maximum tolerable delay, Pr[Q(∞) > 0] is the probability of a non-empty buffer, which can be estimated from the ratio of the constant arrival rate to the averaged service rate, ζ is the upper bound for the constant arrival rate when the statistical delay metrics are satisfied. Using the delay exponent θ and the probability of non-empty buffer, the effective capacity, that CHAPTER 2. SECURITY PROTOCOLS FOR INTERNET OF THINGS APPLICATIONS denotes the maximum arrival rate, can be formulated as [28]:

E C (θ) = -lim t→∞ 1 θ ln E e -θS[t] , (2.36)
where S[t] = t i=1 s[i] denotes the time-accumulated service process, and s[i], i = 1, 2, ... denotes the discrete-time stationary and ergodic stochastic service process. Therefore, the delay exponent θ indicates how strict the delay requirements are, i.e., θ → 0 corresponds to looser delay requirements, while θ → ∞ implies exceptionally stringent delay constraints. Assuming a Rayleigh block fading system, with frame duration T f and total bandwidth B, we have s[i] = T f B Ri , with Ri representing the instantaneous service rate achieved during the duration of the ith frame. In the context of the investigated data and reconciliation information transfer, Ri , is given by:

Ri = 1 F i∈D log 2 (1 + p i ĝi ), (2.37)
where F is the equivalent frame duration, i.e., the total number of subcarriers used for data transmission, so that for the parallel approach we have F = |D| while for the sequential approach F = N (L + M )L -1 . Under this formulation and assuming that Gärtner-Ellis theorem [START_REF] Gärtner | On large deviation from invariant measure[END_REF][START_REF] Ellis | Large deviations for a general class of random vectors[END_REF] is satisfied, the effective data rate6 E C (θ) is given as:

E C,D (θ) = - 1 θT f B ln E e -θT f B Ri . (2.38) We set α = θT f B ln(2)
. By inserting (2.37) into (2.38) we get:

E C,D (θ) =- 1 ln(2)α ln E e -ln(2)αF -1 i∈D log 2 (1+p i ĝi ) , E C,D (θ) = - 1 α log 2 E i∈D (1 + p i ĝi ) -αF -1 .
(2.39)

Assuming i.i.d. channel gains, by using the distributive property of the mathematical expectation, (2.39) becomes [START_REF] Abrao | Achieving maximum effective capacity in OFDMA networks operating under statistical delay guarantee[END_REF]:

E C,D (θ) = - 1 α log 2 i∈D E (1 + p i ĝi ) -αF -1 . (2.40)
We further manipulate by using the log-product rule to obtain:

E C,D (θ) = - 1 α i∈D log 2 E (1 + p i ĝi ) -αF -1 . (2.41)
Similarly, the effective syndrome rate can be written as:

E C , D (θ) = - 1 α i∈ D log 2 E (1 + p i ĝi ) -α F -1 , ( 2
E C,D (θ) + E C, D(θ) ≤ E opt C (θ), (2.44)
where E opt C (θ) represents the maximum achievable effective capacity for both key and data transmission for a given value of θ over N subcarriers:

E opt C (θ) =max p i ,i=1,2,...N - 1 α log 2 E N i=1 (1 + p i ĝi ) -αN -1 .
(2.45)

In the proposed approach, we assume that the constraint (2.44) is satisfied with equality. Given that, the optimization problem in (2.43) can be evaluated as two sub-optimization problems: i) finding the optimal long term power allocation from (2.14) and (2.45); ii) finding the optimal subcarrier allocation that satisfies (2.25). We solve the first problem that gives the optimal power allocation using convex optimization tools. Next, as in Section 2.5 we use two methods to solve subcarrier allocation problem, i.e., by formulating a subset-sum 0 -1 knapsack optimization problem or through a variation of Algorithm 1. The efficiency of both methods is compared numerically to the sequential method in Section 3.10. Now, following the same steps as in (2.39)-(2.41) and using the fact that maximizing E C (θ) is equivalent to minimizing -E C (θ) (this is due to log(•) being a monotonically increasing concave function for any θ > 0) we formulate the following minimization problem:

min p i ,i=1,2,...N N i=1 E (1 + p i ĝi ) -αN -1 , (2.46)
s.t. (2.14).

where F = N in this case as the full set of subcarriers is concerned. We form the Lagrangian function L as:

L = E (1 + p i ĝi ) -αN -1 + λ N i=1 p i -N P .
(2.47)

By differentiating (2.47) w.r.t. p i and setting the derivative equal to zero [START_REF] Boyd | Convex Optimization[END_REF] we get:

∂L ∂p i = λ - αĝ i N (ĝ i p i + 1) -α N -1 = 0. (2.48)
Solving (2.48) gives the optimal power allocation policy:

p * i = 1 g N α+N 0 ĝ α α+N i - 1 ĝi , (2.49)
where g 0 = N λ α is the cutoff value which can be found from the power constraint. By inserting p * i in E C (θ) we obtain the expression for E opt C (θ):

E opt C (θ) = - 1 α N i=1 log 2 E ĝi g 0 -α α+N (2.50)
When θ → 0 the optimal power allocation is equivalent to water-filling and when θ → ∞ the optimal power allocation transforms to total channel inversion. Now, fixing the power allocation as in (2.49) we can easily find the optimal subcarrier allocation that satisfies (2.25). As in Section 2.5 to do that we first formulate a subset-sum 0 -1 knapsack optimization problem that we solve using the standard dynamic programming approach. Furthermore we evaluate the performance of the heuristic algorithm presented in Algorithm 1.

Results and Discussion

In this Section we provide numerical evaluations of the efficiency that can be achieved with the presented methods (i.e., sequential and parallel) for different values of the main parameters. With respect to the parallel approach, we provide numerical results of the optimal dynamic programming solution of the subset-sum 0 -1 knapsack problem, as well as of the greedy heuristic approach presented in Algorithm 1. For the case of the long term average data rate C D (2.16), we compare the two methods through their efficiencies, i.e. η sequential and η parallel given in (2.33) and (2.29), respectively. Next, to compare the two methods in the case of effective data rate we evaluate E C,D (θ) given in (2.41). For better illustration of each case they are separated into different subsections. 2.4b show the efficiency of the methods for N = 12, and N = 64, respectively, while κ = 2 and P = 10. We note that the proposed heuristic algorithm has a near-optimal performance (almost indistinguishable from the red curves achieved with dynamic programming). Due to this fact (which was tested across all scenarios that follow) only the heuristic approach is shown in subsequent figures for clarity in the graphs.

We see that when there are a small number of subcarriers (N =12, typical for NB-IoT) and small β the efficiency of both the parallel η parallel and the sequential η sequential approaches are very close to unity, a trend that holds for increasing N . With increasing β, due to the fact that more frames are needed for reconciliation in the sequential approach (i.e., M increases), regardless of the total number of subcarriers, the parallel method proves more efficient than the sequential. While the efficiency of the sequential and parallel methods coincide almost until around β = 0.01 for N = 12, for N = 64 the crossing point of the curves moves to the left and the efficiency of the two methods coincide until around β = 0.001. This trend was found to be consistent across many values of N , only two of which are shown here for compactness of presentation. Next, in Fig. 2.5 the efficiency of the parallel η parallel and the sequential η sequential methods are shown for two different values of κ ∈ {2, 3} for SNR = 10 dB and N = 24. It is straightforward to see that they both follow similar trends and when κ increases the efficiency decreases. On the other hand, regardless of the value of κ they both perform identically until around β = 0.001.

Finally, in Fig. 2.6, focusing on the parallel method, the average size of set D is shown for different values of σ 2 e and SNR levels (Fig. 2.6a) and κ (Fig. 2.6b), for N = 24. As expected, in Fig. 2.6a we see when the SNR increases the size of the set increases, too. This is due to the fact that more power is used on any single subcarrier and consequently a higher reconcilliation rate can be sustained. Regarding the estimation error σ 2 e of the CSI, it only slightly affects the performance at high SNR levels. Hence more subcarriers have to be used for reconciliation, and fewer for data. The SNR level in Fig. 2.6b is set to 10 dB. The figure shows that when increasing κ the size of set D decreases. This result can be easily predicted from inequality (2.21), meaning, when κ increases more reconciliation data has to be sent, hence fewer subcarriers can be used for data. In both Fig. 2.6a and Fig. 2.6b when β increases the size of set D decreases; this effect is a consequence of constraint (2.28) as the data rate is decreasing with β.

Numerical Results for the Effective Data Rate

Inspired by the good performance of Algorithm 1, in the case where long-term average rate is the metric of interest, here, we continue our investigation with a variation of Algorithm 1, with the following differences: at lines 3 and 5 instead of (2.26) we use the constraint (2.25), the power allocation is fixed as in (2.49). The performance of our system is again compared with a sequential method and the metric of interest here is the effective data rate. The comparison is performed by taking into account the following parameters: signal to noise ration (SNR); number of subcarriers N ; ratio of the reconciliation and 0-RTT transmission rate to the SKG rate κ; delay exponent θ; and, the ratio of key bits to data bits β.

In Fig. 2.7 we give a three-dimensional plot showing the dependence of the achievable effective data rate E C,D (θ) on β and θ. Figures 2.7a and 2.7b compare the parallel heuristic approach and the sequential approach for high SNR levels, whereas Fig. 2.8a and 2.8b compare their performance at low SNRs. In Fig. 2.7a and 2.8a we have N = 12 while in Fig. 2.7b and 2.8b the total number of subcarriers is N = 64. All graphs compare the performance of the heuristic parallel approach and the sequential approach for κ = 2.

As discussed in Section 2.6, when the delay exponent θ increases, the optimal power allocation transforms from waterfilling to total channel inversion. Consequently, the rate achieved on all subcarriers converges to the same value, hence when we a have small number of subcarriers (such as N = 12) and small values of β then using a single subcarrier for reconciliation data will use more capacity than needed and most of the rate on this subcarrier is wasted. Devoting a whole subcarrier for sending the reconciliation data for the case of N = 12 and β = 0.0001 is almost equivalent of losing 1/12 of the achievable rate.

This can be seen in Fig. 2.7a and 2.8a where N = 12. When the SNR is high (See Fig. 2.7a), as discussed, this effect is mostly noticeable for large values of θ and small values of β7 , whereas for small values of β and θ both algorithms perform nearly identically. A similar trend can be seen at the low SNR regime in Fig. 2.8a. However, at a low SNR the sequential approach has a lower effective data rate. This happens because at high SNR levels each reconciliation frame will contain more information and hence more data frames will follow. Therefore, at the low SNR regime, the reconciliation information received will decrease, hence less data can be sent afterwards. This does not affect the parallel approach. However, in both scenarios high SNR Fig. 2.7a and low SNR Fig. 2.8a, when β increases regardless of the value of θ the parallel approach always achieves higher effective data rate E C,D (θ).

In the next case, when the total number of subcarriers is N = 64, illustrated in Fig. 2.7b and 2.8b, we see that the penalty of devoting a high part of the achievable effective capacity E opt C (θ) to reconciliation disappears and the heuristic parallel approach always achieves higher or identical effective data rate E C,D (θ) compared to the sequential approach. This trend repeats for high and low SNR levels as given in Fig. 2.7b and 2.8b, respectively. Now, we take a closer look and transform some specific cases from the 3D plots to two-dimensional graphs. In Fig. 2.9 we see the achieved effective data rate E C,D (θ) given in (2.41), for different values of N and θ while the SNR=5 dB and κ = 2. Fig. 2.9a gives the achieved effective rate on set D for N = 12 and θ = 0.0001 (relaxed delay constraint). Similarly to the case of long term average value of C D we see that for small values of β the sequential approach achieves slightly higher effective data rate. As before, the increase of β results in more reconciliation frames M required in the sequential case. This effect is not seen in the parallel case and for high values of β it performs better. Fig. 2.9b illustrates the case when N = 12 and θ = 100 (very stringent delay constraint). Similarly to before, we can see that for small values of β the sequential approach performs better than the parallel. As discussed, the efficiency loss is caused by the fact that the devoted part of the total achievable effective capacity E opt C (θ) to reconciliation (syndrome communication) is more than what is required. However, a higher β leads to an increase in the reconciliation information that needs to be sent, and the rate of the subcarriers in set D will be fully or almost fully utilised and the parallel approach shows better performance for these values.

In the next two Fig. : 2.9c and 2.9d we show the performance of the two algorithms for higher value of N = 64. It is easy to see that regardless of the value of θ and β both algorithms perform identical or the parallel is better. In the previous case of N = 12 increasing θ might reduce the effectiveness of the parallel approach, however when N = 64 increasing θ does not incur such a penalty and the parallel is either identical to the sequential or outperforms it.

Another interesting fact from Fig. 2.9 is that looking at the parallel approach, it can easily be seen that in all cases the heuristic approach almost always performs as well as the optimal knapsack solution. The case of small values of θ is similar to the one when we work with long term average rate and choosing the best subcarriers for data transmission works as well as the optimal knapsack solution. Interestingly, Algorithm 1 works well for high values of θ, too. This can be explained by the fact that when θ increases the rate on all of the subcarriers becomes similar and switching the subcarriers in set D does not incur high penalty.

Conclusions

In this work we discussed the possibility of using SKG in conjunction with PUF authentication protocols, illustrating this can greatly reduce the authentication and key generation latency compared to traditional mechanisms. Furthermore, we presented an AE scheme using SKG and a resumption protocol which further contribute to the system's security and latency reduction, respectively.

In addition, we explored the possibility of pipelining encrypted data transfer and SKG in a Rayleigh BF-AWGN environment. We investigated the maximization of the data transfer rate in parallel to performing SKG. We took into account imperfect CSI measurements and the effect of order statistics on the channel variance. Two scenarios were differentiated in our study: i) the optimal data transfer rate was found under power and security constraints, represented by the system parameters β and κ, which represent the minimum ratio of SKG rate to data rate and the maximum ratio of SKG rate to reconciliation rate; ii) by adding a delay constraint, represented by parameter θ, to the security and power constraint we found the optimal effective data rate.

To finalise our study we illustrated through numerical comparisons the efficiency of the proposed parallel method, in which SKG and data transfer are inter-weaved, to a sequential method where the two operations are done separately. The results of the two scenarios showed that in most of the cases the performance of both methods, parallel and sequential, is either equal or the parallel performs better. As the possible advantage of using the sequential is small and only applies in particular scenarios, we recommend the parallel scheme as a universal mechanism for general protocol design, when latency is an issue. Furthermore, a significant result is that although the optimal subcarrier scheduling is an NP hard 0 -1 knapsack problem, it can be solved in linear time using a simple heuristic algorithm with virtually no loss in performance.

Chapter 3

Application of Change Point Analysis in Edge Resource Allocation and Intrusion Detection

Introduction

Edge computing emerges as a critical element in future networks, provisioning storage and computation resources in the proximity of end devices to provide low latency services. The joint allocation and management of communication, computing and storage resources will improve the quality of service (QoS) and user experience, especially for various delay-sensitive applications. At the same time, software-defined networking (SDN) is a technology that can help bridge the gap when combining Edge computing and traditional Clouds. For example, the SDN controller can make decisions on whether tasks should be uploaded and processed in the Cloud or at the Edge. The advancement of Edge computing poses many challenges, e.g., in the deployment and management of distributed resources; in parallel, SDNs are prone to new security threats due to the separation of the control and data planes. In this Chapter, we first focus on content distribution at the Edge using change point (CP) analysis. Next, motivated by the good performance of the developed algorithms, we investigate their application in intrusion detection in software defined wireless sensor networks (SDWSNs), showcasing that the wide range of applications that can be covered.

Beginning with resource allocation at the Edge servers, we propose a novel and flexible approach exploiting popular virtualization technologies, such as unikernels [1] or containers; as a use case we consider video content distribution, which accounts for more than 70% of the global IP traffic. The core idea in our proposal is that virtual servers could hold individual video content and could be "live" for as long as there is corresponding demand; in case of an increase in demand, more replicas of the virtual servers could be put up, or alternatively put down if the demand dies off. We note that bringing up or down a unikernel is typically very fast, with reported numbers for the boot time as little as 20 milliseconds [2].

In this context, due to high volatility in the respective demand, it is important for video content delivery infrastructures to rapidly detect and respond to changes in "content popularity" dynamics. We explore the employment of on-line CP analysis to implement real-time, autonomous and low-complexity video content popularity detection. Our proposal, denoted as real-time change point detector (RCPD), estimates the existence, the number and the direction of changes on the average number of video visits by combining: (i) off-line and on-line CP detection algorithms; (ii) an improved time-series segmentation heuristic for the reliable detection of multiple CPs; and (iii) two algorithms for the identification of the direction of changes. The proposed detector is validated against synthetic data, as well as a large database of real YouTube video visits.

Finally, we note that customarily CP analysis is employed in the detection of anomalies in times ALLOCATION AND INTRUSION DETECTION series. Therefore, as a natural extension of this work, we further consider the application of the RCPD for anomaly detection in SDWSNs. The centralization and the planes' separation turn SDNs vulnerable to new security threats in the general context of distributed denial of service (DDoS) attacks, which carry over to SDWSNs. State-of-the-art approaches to identify DDoS do not always take into consideration restrictions in typical WSNs, e.g., computational complexity and power constraints, while further performance improvement is always a target. Our objective in this study is to propose a lightweight but very efficient DDoS attack detection approach using the RCPD.

Contributions and Chapter Organization

CP Analysis in Resource Allocation

Video content is projected to account for 82% of the global Internet traffic by the end of 2020, significantly increased from 72% in 2016 [3]. In parallel, novel emerging networking, Cloud and Edge computing paradigms with significant elasticity capabilities appeared recently, e.g., SDNs [4], Cloud orchestration proposals [5] and content distribution networks (CDNs) [6]. These advances offer the means to respond quickly to changes in content popularity dynamics with appropriate adaptations, e.g., in terms of efficient server resource allocation schemes, load balancing or content caching. As a result, the early detection of changes in content popularity [7], [8] is proving a highly important topic and can have a significant impact on the network traffic and the utilization of servers. So far, the vast majority of research efforts have focused on the prediction of content popularity dynamics, as opposed to their real time detection, which is the focus of this study. There is a multitude of reasons as to why the precision of even state-of-the-art prediction algorithms can be impaired. A variety of factors -both from the digital and the physical world -can influence the users' Internet surfing behavior, e.g., [7]: (i) the quality, type (e.g., commercial or user-provided) and life-time of content; (ii) its relevance to users and physical events; (iii) the social interactions between users; and (iv) the content promotion strategies involved. Importantly, mid-term and long-term content popularity prediction [9] -and corresponding adaptations in the network or cloud environment -can prove highly inaccurate [10] and thus result in sub-optimal service planning, provisioning, and utilization of resources or violation of service level agreements.

In this work, to address the aforementioned shortcomings of the commonly employed prediction algorithms, we propose a corresponding detector, referred to as the "real-time change point detector" (RCPD). The RCPD is compatible with modern, flexible networking and Cloud approaches, that are highly adaptive and can respond to short-term network dynamics. With accurate, on-line content popularity detection, discrepancies between inaccurate predictions and actual changes can be alleviated. The RCPD is real-time, lightweight, accurate and is parameterized autonomously by analyzing historical data.

In the RCPD, we employ the CP detection theory and algorithms; their suitability is confirmed against a large number of synthetic as well as real YouTube video datasets. In this contribution, the early detection of changes in the average content popularity is addressed with a novel CP detection methodology, consisting of a training phase, using historical data, and, an on-line phase. In the training phase, we employ a modified off-line CP detection scheme to configure the on-line (sequential) algorithm's parameters. This approach is shown to greatly improve the accuracy of the on-line detector, as in essence, the algorithm parameterization is not arbitrary but rather extracted from corresponding historical data. To the best of our knowledge, this was the first proposal in the literature on combining retrospective (off-line) and sequential (on-line) CP detection schemes in a single algorithm operating autonomously (i.e., without manual configuration of parameters).

Besides that, our approach complements the off-line scheme with an improved time-series segmentation heuristic for the detection of multiple CPs. Furthermore, we propose two possible variations for the on-line CP algorithm, the first based on the standard cumulative sum (CUSUM) procedure [11] ALLOCATION AND INTRUSION DETECTION and the second on the ratio-type CUSUM procedure [12] 1 . Additionally, we introduce two alternative indicators to detect the direction of changes: the first one is directly derived from the statistical test of the on-line CP procedure, while the second is based on a modified exponential moving average filter, extensively used in econometrics. As discussed in Sections 3.4 and 3.5, the RCPD combines all the above mentioned algorithmic elements, and is based on sufficiently general and convenient assumptions. Moreover, unlike other approaches e.g., [13], we employ methods that allow dependence between observations (in the form of t-dependence), leading to more realistic assumptions for the statistical structure of the content visits.

We evaluate the proposed detector and its individual algorithmic components (i.e., the off-line / online test statistics, the time-series segmentation algorithm and the trend indicator), over synthetic and real YouTube content views data. Our experiments using synthetic data, generated by an autoregressive moving average (ARMA) filter, demonstrate:

• The superior performance of the proposed time-series segmentation heuristic over the standard approach, improving the true alarm rates by up to 43%.

• The ability of the two proposed trend indicators to identify the direction of estimated changes, with successful identification rates exceeding 99%, in all cases.

• The RCPD performance; the true alarm rates surpass 94% for medium / large changes in the mean number of content views, while the corresponding CP identification lag ranges between 10 to 20 instances, confirming the real-time operation of the detector. On the other hand, the RCPD achieves very small false alarm rates, well within the limits of the statistical error specified by the chosen significance level of the CP algorithms.

Furthermore, our tests on real YouTube content views datasets show that:

• YouTube video views match the underlying assumptions of the RCPD, i.e., the content popularity time-series datasets can be modeled as t-dependent.

• The RCPD can detect CPs in more than 70% of the videos in our dataset, implying a sufficiently high number of content popularity changes and the suitability of the CP theory framework for content popularity detection.

• The successful CP direction identifications exceed 91%, i.e., the proposed trend indicators work for real data.

• The average dynamic time warping (DTW) distance [14], [15] between the identified CPs and a benchmark off-line algorithm was estimated to be 52 time instances on average, showcasing the rapid responsiveness of the RCPD.

• The overall processing cost of the RCPD is very low; notably, it took less than one second to process 882 videos on a typical personal computer (PC).

As a proof-of-concept, we demonstrate the applicability of the proposed algorithm in a real load balancing scenario. We provide a set of measurements showcasing improvements in terms of the clients' connectivity time to download specific content, without a significant impact on the utilization of the content servers. This is achieved due to the deployment of additional content caches, an event triggered by the output of the proposed RCPD detector.

CP Analysis for Anomaly Detection in SDWSNs

Next, we explore the application of the RCPD for anomaly (intrusion) detection in SDWSNs. The SDN paradigm was devised to simplify network management, avoid configuration errors and automate infrastructure sharing in wired networks [16]. The aforementioned benefits motivated the discussion of combining SDN and WSNs as a solution to many WSN challenges, in particular concerning flexibility and resource reuse [17]. This combination is referred to as SDWSN. The SDWSN approach decouples the control plane from the data plane and centralizes the control decisions; its main characteristic is the ability to program the network operation dynamically [18]. Recent results show that SDWSNs can perform as well as the IPv6 routing protocol for low-power and lossy networks (RPL) [19].

On the other hand, the SDN centralization and the planes' separation turn the network vulnerable to new security threats (explained in Section 3.9.1), a property that is inadvertently passed on to SDWSNs. Shielding SDNs from these vulnerabilities has already attracted a lot of attention in the literature with proposals to implement attack detection in IoT networks using SDN. Overall, in the case of SDWSNs, due to the resource constraints of the nodes, most of the security mechanisms designed for non-resource constrained SDNs have to be adapted or redesigned. This is one of the major challenges for SDWSN security.

Considering the limitations of previous works, our main objective is to propose a mechanism for DDoS detection with, i) a high detection rate, and, ii) low complexity, so that it would be suitable for "restricted" networks. To this end, we propose the employment of the RCPD [20] [21]. We study two DDoS attacks: a false data flow forwarding (FDFF) attack, and a false neighbor information (FNI) attack, chosen to illustrate the proposed algorithm's capabilities in the case of specific SDWSN vulnerabilities that exhibit largely different behavior. Both attacks are explained in Section ??. We have tested our approach on the IT-SDN framework2 [19] and our results show that we can detect these attacks with a detection rate close to 100%, improving the state of the art; importantly, it is further possible to gain insight regarding the type of the attack, based on the metric that provides the quickest detection, a feature, that to the best of our knowledge, breaks new ground in the domain of DDoS analysis for SDWSNs.

Chapter Organization

The rest of the Chapter is organized as follows. In Section 3.3 we provide a comprehensive literature review of related topics. In Section 3.4, we present the off-line (training) phase of the RCPD algorithm, while the on-line phase is discussed in Section 3.5. In Section 3.6, we present four experiments over synthetic video content data, providing an extensive validation of the RCPD and its subroutines, while in Section 3.7, we discuss corresponding experiments using a database of real YouTube video views. In Section 3.8, we demonstrate the load balancing gains achieved through the use of the RCPD, in a realistic content provisioning scenario.

Moving to intrusion detection in SDWSNs, Section ?? illustrates the FDFF and FNI attacks and their impact on the network performance. Experimental methods are presented in Section 3.9.3 and results on intrusion detection using the RCPD are presented in Section 3.10.

Finally, Section 3.11 concludes the Chapter.

Related Works

In this Section, we discuss how this work relates to the literature of video content popularity prediction, and, anomaly detection in general and in SDNs and SDWSNs in particular. The topic of content popularity attracted a lot of attention in recent years, because of its importance in a number of applications, such as network dimensioning (e.g., capacity planning or scaling of resources), on-line marketing (e.g., advertising, recommendation systems) or real-world outcome ALLOCATION AND INTRUSION DETECTION prediction (e.g., analysis of economical trends) [7]. The main approaches used for content popularity estimation can be categorized as: (i) cumulative growth studies, estimating the "amount of attention" from the publication instance to the prediction moment [8]; (ii) temporal analysis approaches, i.e., how content visits evolve over time [22]; and (iii) clustering methods of content with similar popularity trends [9]. We note that many content popularity studies consider the aggregate behavior of a particular content, e.g., [8], [22], whereas we study the real-time behavior of video views time-series. In addition, studies using clustering methods [9] are based on content popularity prediction and adopt parametric models, unlike the RCPD algorithm that is non-parametric.

To the best of our knowledge, our conference paper [23] is the first in the literature proposing CP techniques [24] for content popularity detection. The RCPD algorithm falls into the general category of anomaly detection [25]; in essence, we assume that no changes in popularity constitutes the normal behavior of video content and search for deviations from this behavior. Non-parametric anomaly detection has typically been considered for the detection of abnormalities in the network traffic. As an example, in [26] an algorithm was proposed based on the Shiryaev-Roberts procedure for anomaly detection in computer network traffic. In [27] and [28], CUSUM based approaches were introduced for the detection of SYN attacks.

As opposed to previous content popularity prediction works, in this Chapter we introduce a novel CP detection methodology that provides accurate, lightweight, autonomous and on-line CP detection of content popularity. We formulate the detection of a change in the average content popularity as a statistical hypothesis test and employ non-parametric procedures to avoid a particular distribution assumption (such as a specific copula model). This context ensures low convergence time since it avoids estimating a large number of model parameters and restrictive assumptions that may not match the structure of the time-series. Furthermore, we avoid problems of parametric models that require parameters' fitting and selection, which become challenging as new data become available. In the proposed RCPD algorithm, an off-line phase specifies important parameters for the on-line phase; these parameters are re-evaluated dynamically after a detected CP. Our load-balancing experiments, elaborated in [6], demonstrate the RCPD's behavior in a real test-bed deployment.

Up to now there are only a handful of proposals addressing the challenges of new flexible networking and Cloud architectures accounting for content popularity. Exceptions include [29] in which a machine learning approach to content popularity prediction is applied for a Fog radio access network (RAN) environment, and, our recent papers [6] and [23]. In [6], the algorithm -outlined in [23] and presented extensively here -is integrated into an elastic content distribution network (CDN) framework based on lightweight Cloud capabilities using Unikernels. [6] focuses on the platform details rather than on the CP algorithm; it confirms experimentally the suitability of the latter for relevant flexible network and cloud architectures. A detailed description of the proposed CP detection algorithm is presented in the following Sections, along with a rich set of validation results.

Further examples of parametric anomaly detection methods include [30], in which a bivariate sequential generalized likelihood ratio test (LRT) was proposed, accounting for the packet rateassumed to follow a Poisson distribution -and the packet size -assumed to follow a normal distribution. Other parametric anomaly detection approaches assume a particular underlying process for the normal behavior and search for anomalies on the residuals of the process. For example, in [31], Kalman filtering is combined with several CP methods, such as CUSUM and LRT, to detect anomalies in origin-destination flows. In [32], traffic flows (in the form of TCP's finite state machine), are modeled using Markov chains and an anomaly detection mechanism based on the generalized LRT algorithm is developed.

On the other hand, looking at existing literature in SDN anomaly detection, the authors in [33] proposed softhings, an SDN-based IoT framework with security support. The framework was developed for OpenFlow [18], which, however, can be a limiting factor for its use in networks composed of low-end nodes. The use of support vector machines (SVM) was proposed to detect control plane attacks; it was shown that a detection rate of around 96% and 98% could be achieved. The algorithm was tested in Mininet, simulating scenarios with only five nodes and considering one node as attacker. Furthermore ALLOCATION AND INTRUSION DETECTION Yin et al. [34] developed the framework SD-IoT, which included a security system for DDoS attacks detection, based on the difference of packets received by the controller. The difference was calculated using the cosine similarity method. This mechanism was devised for networks where all the nodes had periodic communication with the controller, which could be not optimal for very "restricted" networks with low-end nodes. The authors tested their proposal through simulations using Mininet. The network size was not explicitly specified, but can be inferred to be around 50 to 60 nodes.

Furthermore, Wang et al. [35] proposed an SDWSN trust management and routing mechanism. They compared their proposal to SDN-WISE when both networks were under attack. The focus of the work was on the selective forwarding attacks and new flow requests. The first attack applied to any type of WSNs, while the second was specific to SDNs. The mechanism was tested in simulations with 100 nodes, varying the number of attackers between 5 and 20. Their results showed an attack detection rate between 90% and 96% when 5 nodes were attackers, and between 60% and 79% when 20 nodes were attackers. Compared to these previous works, our proposal for the employment of the RCPD is SDWSN anomaly detection has the advantages of being i) lightweight, ii) fast and iii) highly accurate as will be demonstrated in Sections 3.9 to 3.10.

We begin the description of the RCPD by first elaborating on the off-line and on-line phases in Sections 3.4 and 3.5 respectively, where we also provide the corresponding pseudo-code.

Training (Off-line) Phase

In this Section, the training phase of the algorithm is discussed and the fundamental components of the off-line scheme are presented. We note that standard off-line CP schemes can only detect a single CP. To address the issue of detection of multiple CPs, we modify the basic algorithm with a novel time-series segmentation heuristic, that belongs to the family of binary segmentation algorithms.

Basic Off-line Approach

Let {X n : n ∈ N} be a sequence of r-dimensional random vectors (r.v.). The first dimension represents the number of views for a specific video content within a time period n ∈ {1, . . . , N }, while the other dimensions could be optionally used to represent other content popularity features, such as likes, comments, etc. We assume that X 1 , ..., X N can be written as,

X n = µ n + Y n , 1 n N (3.1)
where {µ n : n ∈ N} is the mean value of video visits,

{Y n : n ∈ N} a random component with zero mean E [Y n ] = 0 and positive definite covariance matrix, E Y n Y T n = Σ, while E[•] denotes expectation. We further assume that the time-series is t-dependent, implying that for t 1 , t 2 , t ∈ N, Y t 1 is independent of Y t 2 if |t 1 -t 2 | > t.
The model in (3.34) and the underlying assumption of t-dependence are in agreement with statistical characterizations of the distribution of visits, which have been shown in numerous analyses to follow either a Zipf [36] or a Zipf-Mandelbrot [37] distribution for both commercial and user-generated content. Furthermore, it is confirmed in the real YouTube datasets used in the present work through the evaluation of the time-series's Hurst exponents, as will be discussed in Section 3.7.1.

The off-line analysis tests the constancy (or not) of the mean values up to the current time N . Hence, we define the following null hypothesis of constant mean,

H 0 : µ 1 = . . . = µ N ,
against the alternative,

H 1 : µ 1 = . . . = µ k * of f = µ k * of f +1 = . . . = µ N , ALLOCATION AND INTRUSION DETECTION
indicating that the mean value changed at the unknown (time) point k * of f ∈ {1, . . . , N }. Considering (3.34) and the corresponding assumptions for the stochastic process X n , we develop a non-parametric CUSUM test statistic following [38]. The test statistic T S of f , can be viewed as a max-type procedure, T S of f = max

1 n N C T n Ω -1 N C n , (3.2)
where the parameter C n is the retrospective CUSUM detector,

C n = 1 √ N n i=1 X i -nX 1,N , (3.3)
while

X 1,N = 1 N N i=1
X i denotes the sample mean. Ω N represents a suitable estimator of the long-run covariance Ω, where

Ω = ∞ i=-∞ Cov (X n X n-i ). (3.4)
The estimator should satisfy,

Ω N P -→Ω (3.5)
where P -→ denotes convergence in probability. Several estimators have been proposed in the literature that satisfy (3.5), including kernel-based [39], bootstrap-based [40], etc. Considering our requirement for real-time detection (low computational time), a kernel-based estimator is more suitable; in this context, we employ the Bartlett estimator, so that

Ω N = Σ 0 + W w=1 k BT w W + 1 Σ w + Σ T w , (3.6)
which satisfies (3.5), while the function k BT (.) corresponds to the Bartlett weight,

k BT (x) = 1 -|x|, for |x| 1 0, otherwise , (3.7)
and Σ w denotes the empirical auto-covariance matrix for lag w,

Σ w = 1 N N n=w+1 X n -X X n-w -X T . (3.8)
Finally, we chose W = log 10 (N ) as in [39]. The long-run covariance is involved in the test statistic to incorporate the dependence structure of the r.v. into the statistical analysis, through the integration of second order statistical properties. This approach is suitable for the targeted context since we avoid a restrictive assumption for the dependence structure of the observations.

Going back to the basic question of rejecting or not H 0 , we need to obtain critical values, denoted by cv of f , for the test statistic. We approach this issue by considering the asymptotic distribution of the test statistic under H 0 ,

T S of f D -→cv of f = sup 0 t 1 r j=1 B 2 j (t) (N → ∞), (3.9)
where

D -→ denotes convergence in distribution, (B j (t) : t ∈ [0, 1]
) , 1 j r, are independent standard Brownian bridges B(t) = W (t) -tW (1), and W (t) denotes the standard Brownian motion with mean ALLOCATION AND INTRUSION DETECTION 0 and variance t. The critical values for several significance levels α can be computed using Monte Carlo simulations that approximate the paths of the Brownian bridge on a fine grid. The last step is to estimate the unknown CP, defined previously as k * of f , under H 1 , given by:

k * of f = 1 N argmax 1 n N T S of f . (3.10)

Extended Off-line Approach

The above hypothesis test identifies the existence of at most one CP and does not ensure that the sample remains statistically stationary in either direction of the detection. In particular, by construction (see (3.2)), the off-line test statistic detects the CP with the highest magnitude. Therefore, for the detection of multiple CPs we need to rephrase the hypothesis test H 1 , as follows:

H 1 : µ 1 = . . . = µ k 1 = µ k 1 +1 = . . . = µ k 2 = . . . • • • = µ k τ -1 +1 = . . . = µ kτ = µ kτ +1 = . . . = µ N .
A greedy technique to identify multiple CPs is the binary segmentation (BS) algorithm. The standard BS algorithm relies on the general concept of binary segmentation and is an extension of the single CP estimator. First, a single CP is searched for in the time-series. In case of no change, the procedure stops and H 0 is accepted. Otherwise, the detected CP is used to divide the timeseries into two segments in which new searches are performed. The procedure is iterated until no more CPs are detected. The BS algorithm is lightweight (computational time O(N logN )), while its conceptual simplicity leads to efficient implementations. On the other hand, it has been shown in the literature [41], [42], that the standard BS algorithm tends to overestimate the number of CPs, as it does not cross-validate them after their detection.

In the extended off-line approach, we propose the modification of the standard BS with a crossvalidation step of the estimated CPs. The cross-validation step is similar to that used in the iterative cumulative sum of squares (ICSS) segmentation algorithm [43], which is used to search for CPs on the marginal variance of independent and identically distributed (i.i.d.) r.vs. In the extended off-line algorithm we consider the CPs estimated from the standard BS in pairs and check if H 0 is rejected in the segment delimited by each pair. If H 0 is not rejected in a particular segment, then no change can be detected in it; as a result, all CPs that fall in the respective segment are eliminated. The improvement, in terms of accuracy, is shown through simulation results in Section IV.

On-line Phase

In this Section, we describe the on-line scheme that includes: (i) two alternative CUSUM-type approaches for the detection of a change in the mean; and (ii) two alternative approaches to estimate the direction of a change.

On-line Analysis

We rewrite equation (1) in the form,

X n = µ + Y n , n = 1, . . . , m + k * -1 µ + Y n + I, n = m + k * , . . . (3.11)
where µ, I ∈ R r represents the mean parameters before and after the unknown time of possible change k * ∈ N * respectively. As a reminder, the first dimension of the time-series represents the video views; the rest could be likes, comments, etc., and {Y n : n ∈ N} is a random component. The term m ∈ N denotes the length of the training period, i.e., an interval of length m over the historical period during ALLOCATION AND INTRUSION DETECTION which the mean is assumed to remain unchanged, so that,

µ 1 = • • • = µ m . (3.12)
To satisfy this assumption, the modified off-line CP test previously presented is run in order to identify a suitable m. With m determined, the on-line procedure can be used to check whether (3.12) holds as new data become available. In the form of a statistical hypothesis test, the on-line problem becomes,

H 0 : I = 0, H 1 : I = 0. (3.13)
The on-line sequential analysis belongs to the category of stopping time stochastic processes. In general, a chosen on-line test statistic T S on (m, l) and a given threshold F (m, l) define the stopping time τ (m):

τ (m) = min{l ∈ N : T S on (m, l) F (m, l)}, ∞, if T S on (m, l)< F (m, l) ∀l ∈ N, (3.14)
implying that T S on (m, l) is calculated on-line for every l in the monitoring period. The procedure stops if the test statistic exceeds the value of the threshold function F (m, l). As soon as this happens, the null hypothesis is rejected and a CP is detected. The following properties should hold for τ (m),

lim m→∞ P r{τ (m) < ∞|H 0 } = α,
ensuring that the probability of false alarm is asymptotically bounded by α ∈ (0, 1), and,

lim m→∞ P r{τ (m) < ∞|H 1 } = 1,
ensuring that under H 1 the asymptotic power of the statistical test is unity. The threshold F (m, l) is given by,

F (m, l) = cv on,a g(m, l), (3.15)
where: (i) the critical value cv on,a is determined from the asymptotic behavior of the stopping time procedure under H 0 by letting m → ∞; and (ii) the weight function,

g(m, l) = √ m 1 + l m l l + m γ (3.16)
depends on the sensitivity parameter γ ∈ [0, 1/2).

We use two different CUSUM approaches; the standard [11], with test statistic denoted by T S ct on , and, the ratio-type [12], with test statistic denoted by T S rt on . Their corresponding critical values are denoted by cv ct on,a and cv rt on,a , respectively, and their stopping rules by τ ct (m) and τ rt (m), correspondingly. Both tests are based on the sequential CUSUM detector, E(m, l),

E(m, l) = X m+1,m+l -X 1,m (3.17)
The standard CUSUM test is expressed as:

T S ct on (m, l) = l Ω -1 2 m E(m, l), (3.18)
where Ω m is the estimated long-run covariance, defined as in (4), that captures the dependence between observations. Then, the stopping rule τ ct (m), is defined as:

τ ct (m) = min{l ∈ N : T S ct on (m, l) 1 ≥ cv ct on,a g(m, l)}, (3.19)
where the 1 norm is involved to modify T S ct on so that it can be compared to a one dimensional threshold function. The critical value, cv ct on,a , is derived from the asymptotic behavior of the stopping rule under H 0 :

lim m→∞ P r{τ (m) < ∞} = lim m→∞ P r sup 1 l ∞ T S ct on (m, l) 1 g(m, l) > cv ct on,α = P r sup t∈[0,1] W (t) 1 t γ > cv ct on,α = α. (3.20)
Unlike standard CUSUM tests, ratio type statistics do not require to estimate the long-run covariance and are also considered for this reason in this analysis. The precise form of the chosen statistic is given in the following quadratic form,

T S rt on (m, l) = l 2 m E T (m, l)    1 m 2 m j=1 j 2 X 1,j -X 1,m X 1,j -X 1,m T    -1 E(m, l), (3.21)
with its equivalent stopping rule,

τ rt (m) = min{l ∈ N : T S rt on ≥ cv rt on,a g 2 (m, l)}. (3.22)
Similarly to the standard CUSUM, the critical value, cv rt on,a , is estimated by,

lim m→∞ P r{τ (m) < ∞} = P r sup t∈[0,∞) ∆ γ (t) > cv rt on,α = α, (3.23)
where,

∆ γ (t) = 1 η 2 γ (t) B T (1 + t) 1 0 B(r)B T (r)dr -1 B(1 + t),η 2 γ (t) = (1 + t) t 1 + t γ , and B(t) is a standard Brownian bridge, t ∈ [0, ∞) .
Similarly to the off-line case, the on-line critical values for both test statistics can be computed using Monte Carlo simulations, considering that,

cv ct on,α = sup t∈[0,1] W (t) t γ , (3.24)
cv rt on,α = sup t∈[0,∞) ∆ γ (t). (3.25)
The estimated on-line CP, k * on , is derived directly from the value of the stopping time τ (m), as,

k * on = m + {τ (m)|τ (m) < ∞}. (3.26)

Trend Indicator

Considering the on-line procedure, the hypothesis H 1 is two-tailed because the test statistics T S rt on and T S ct on are formulated in a quadratic form and a 1 norm, respectively. This means that the stopping time rule τ ct (m) (or τ rt (m)) cannot be an indicator of the direction of a detected change. Thus, to estimate the direction of a change we introduce two indicators: i) based on the CUSUM detector in (3.17), denoted by T I ts ; and ii) based on the moving average convergence divergence (MACD) filter [44], denoted by T I f . ALLOCATION AND INTRUSION DETECTION Focusing on T I ts , the indicator is directly derived from the form of the sequential CUSUM detector E(m, l). The detector compares the mean value of the observations that are collected on-line for a chosen monitoring period l, with the mean value of a subsample of the historical data over the predetermined training sample. Hence, for a detected CP, we have that, E(m, l) > 0, denotes an upward change E(m, l) < 0, denotes a downward change .

(3.27)

However, in certain cases, limiting the window over which the direction of a change is estimated to the immediate neighbourhood of a detected CP can be unreliable due to the continuous variability of the time-series. In such cases, we have to estimate the direction of a change by incorporating more elaborate filters; in this context, we estimate the direction of detected changes by applying the MACD indicator. The MACD is based on an exponential moving average (EMA) filter, of the form,

EM A p (n) = 2 p + 1 X n + p -1 p + 1 EM A p (n -1), (3.28)
with p denoting the lag parameter. The MACD series can be derived from the subtraction from a short p 2 lag EMA (sensitive filter) of a longer p 3 lag EMA (blunt filter), as described below:

M ACD(n) = EM A p 2 -EM A p 3 . (3.29)
The trend indicator T I f is then obtained by the subtraction of a short p 1 lag EMA filter of a MACD series from the raw MACD series, as described below

T I f (n) = M ACD(n) -EM A p 1 (M ACD(n)), p 1 < p 2 < p 3 . (3.30)
In the evaluation of T I f three exponential filters are involved. In essence, T I f is an estimation of the second derivative over an interval around the change (considering that the subtraction of a filtered variable from the variable generates an estimate of its time derivative). In contrast to other works [44], we only adopt T I f to characterize the direction from the specific value of T I f at the estimated time of change. We announce an upward change if

T I f ( k * on ) > 0, otherwise, if T I f ( k * on ) < 0, a downward change.
Finally, we propose a modification of the trend indicator T I f , converting it from a point estimator to an interval estimator; instead of evaluating T I f ( k * on ), we propose to evaluate the trend indicator at a time interval ( k * on , k * on + h), where h is a threshold parameter:

T I f ( k * on , h) = k * on +h l= k * on T I f (l). (3.31)
The proposed T I f ( k * on , h) modification improves the estimator's accuracy; the calculation of the sum of a multitude of observations, after a CP, can smooth out a potential false one-point estimation, especially in the case of small changes.

Overall Algorithm

We outline in Algorithm 1 the RCPD algorithm, as a combination of the off-line and the on-line phase, in the form of pseudo-code. Beginning from the initial value set for the monitoring starting period, denoted by m s , the modified off-line algorithm is applied over the whole historical period; the training period m is then defined as the interval elapsed from the last detected off-line CP (if one exists) to m s . As a second step, the on-line test statistic, T S on (m, l) in (14) is called to reveal the direction of change. 3 At this point the procedure stops and a new starting point for the monitoring window is defined as m s = k * on + d, where d is a constant value specifying a period assuming no change. Otherwise, if no change is detected after a maximum of l instances, the procedure restarts from the last time point, m s = m s + l.

Validation of the RCPD Using Synthetic Data

In this Section, we validate the performance of the overall algorithm by performing a series of four different experiments on synthetic data. The use of synthetic data allows us to regulate the parameters of the time-series in terms of mean changes and thus obtain quantitative metrics for the performance of the proposed algorithms.

The choice of the time-series model for the generation of the synthetic data is based on the fact that several studies have shown that ARMA models capture very well content popularity evolution. For example, in [9] it has been concluded that an ARMA model can efficiently describe the daily access patterns of YouTube content, based on an extensive analysis of 100, 000 videos. Similarly, in [45]

µ 2 =1.5 1 1 1 1 µ 3 =2 1 1 1 1
ARMA model has been proposed for the estimation of the popularity of video content. Motivated by these findings, for the validation of the proposed algorithm we use an ARMA(1, 1) time-series. We generate 1, 000 time-series of length N = 600 samples. Without loss of generality, we assume an initial mean value µ 0 = 0, noting that the performance of the RCPD is independent of the initial mean value and only depends on the magnitude of the variation of the mean value before and after a CP.

In the first experiment, we begin with a comparison of the standard BS to the proposed modified BS algorithms described in Section 3.4. We perform two tests; in the first test we introduce two CPs at the instances k * i = (iN )/3, i = 1, 2, while in second test, we introduce four CPs at k * i = (iN )/5, i = 1, . . . , 4. The two tests are repeated for three different values of the magnitude of a change µ 1 = 1, µ 2 = 1.5, µ 3 = 2, i.e., we randomly increase or decrease the mean value by µ j , j = 1, . . . , 3 at the time of change. Table 3.1 summarizes our findings regarding the true and false alarm rates of the two algorithms.

Both the standard and the modified BS algorithms provide similar true alarm rates, exceeding 94%, in the first test. On the contrary, in the more challenging second test, the superiority of the modified BS over the standard BS algorithm is clear. The modified BS algorithm achieves true alarm rates in excess of 70%, even in the demanding scenario of a relatively small change in the mean µ 1 = 1. On the other hand, the standard BS algorithm has in all cases a true alarm rate of less than 50%, rendering any CP detection highly questionable. The second test confirms that the standard BS algorithm is prone to an overestimation of the number of CPs as shown by the high false alarm rates (in excess of 25% in all cases), an issue that can be effectively addressed by the modified BS algorithm which scores false alarm rates below 10%.

Next, in the second experiment, using the same test sets as above, we measure the success rates achieved by the proposed trend indicators T I ts and T I f for h = 0 (larger thresholds provided the same true identification rates). The results are summarized in Table 3.2. The two trend indicators successfully identify the direction of a change in more than 99% of the cases, which shows that they can be interchangeably employed. In the assessment of the performance using real datasets in Sections 3.6 and 3.7, we solely employ the T I f trend indicator. ALLOCATION AND INTRUSION DETECTION We proceed by assessing the proposed RCPD algorithm using both the standard and the ratio type CUSUM. In this third experiment, we measure the average number of CPs detected, averaged over 1, 000 simulations when a single CP is introduced in the ARMA time-series at the time instance N 2 = 300. We consider different values for the magnitude of change µ ∈ {0, 0.5, 0.7, 1, 1.2, 1.5, 2} and the monitoring window length l ∈ {25, 50, 100}. We note that we included the case µ = 0 -which corresponds to the absence of a change -to evaluate the false alarm rate of the overall algorithm. We omit results with true alarm rates lower than 50% as they are statistically unreliable. In terms of the remaining algorithmic parameters, we have set the minimum distance between two successive CPs to d = 50,4 the sensitivity parameter to γ = 0.25 [46] (we choose a neutral value as the behaviour of γ is well studied), and, the significance level to α = 0.05. In each test of the third experiment we measure the exact number of CPs detected, tabulated as one the following three values: i) 0 when (falsely 5 ) no ALLOCATION AND INTRUSION DETECTION CP is detected; ii) 1 when (correctly) a single CP is detected; and iii) > 1 when (falsely) multiple CPs are detected. Finally, we measure the median of the time instance of the single CP detection, denoted by k * . 6 The results of this experiment are presented in Table 3.3 and are discussed below. Firstly, we observe that both the standard and the ratio type CUSUM achieve very small false alarm rates, inferior to 6% when no CP is inserted, irrespective of the choice of l. On the contrary, the choice of l readily affects the algorithm's success rate for µ > 0; for small changes in the mean value, µ = 0.5, 0.7, a larger monitoring window l increases the algorithm's true alarm rates in identifying correctly the existence of the CP. For medium and high changes in the magnitude of change µ = 1, 1.2, 1.5, 2, it is observed that a high true alarm rate -in excess of 93% for the standard CUSUM -is achieved, while choosing a smaller l can slightly increase the true alarm rates. As a result, depending on the application, a choice of a larger l can be appropriate if the algorithm is to be employed as a universal CP detector. Alternatively, a smaller l can be chosen when the focus is on the identification of large changes in the mean value, i.e., we are interested primarily in detecting CPs of larger magnitude.

Secondly, we observe that overall, the ratio type CUSUM is outperformed by the standard CUSUM in all tests. Consequently, the standard CUSUM based detector can be considered as an efficient universal choice. Finally, we observe that the lag between k * and the actual instance of change at ALLOCATION AND INTRUSION DETECTION the point 300 decreases with increasing µ, ranging from 343 to 307, while it appears less sensitive to changes in l. This demonstrates that, intuitively, larger magnitude changes can be detected faster. This result is important for load balancing applications as it provides us with the means to quickly respond to significant changes in the network traffic.

Subsequently, in Table 3.4 in the previous page, we present the outputs of the fourth experiment in which we assess the performance, averaged over 1, 000 simulations, of the RCPD algorithm when two CPs are inserted in the ARMA time-series. We introduce a change at the time instance k * 1 = N 3 = 200 and a second CP at the time instance k * 2 = 2N 3 = 400. We investigate the true and false alarm rates for µ ∈ {0.5, 0.7, 1, 1.2, 1.5, 2} and l ∈ {25, 50, 100}, while the rest of the parameters retain the values of the third experiment. In each test of the fourth experiment we measure the exact number of CPs detected, tabulated as one the following three values: i) < 2 when (falsely) less than two CPs are detected, ii) 2 when (correctly) two CPs are detected, and iii) > 2 when (falsely) more than two CPs are detected. Finally, we measure the median of the detection instances of the two CPs, denoted by k * 1 and k * 2 , respectively (we omit the results with true detection rate lower than 50%). Similarly to the third experiment, we observe that increasing l increases the true alarm rates for small magnitudes in the mean changes µ = 0.5, 0.7, while this trend is reversed in high magnitudes µ = 1.5, 2. For medium values µ = 1, 1.2 the effect of l on the true alarm rates is less than 2%. Furthermore, in agreement with the outputs of the third experiment, with increasing µ the algorithms achieve increasingly high success rates, over 93% for the standard CUSUM when µ ≥ 1.

In addition, the superior performance of the standard CUSUM is re-confirmed in all the tests of the fourth experiment. Finally, with respect to the lag in the estimation of the time instances of the CPs, we observe that, as in experiment three, larger magnitude changes can be detected faster, e.g., for µ = 2 a lag inferior to 11 instances is observed for both CPs with the standard CUSUM, irrespective of l.

Concluding this Section, we have presented an extensive set of experiments that provide strong evidence for the efficiency of the proposed algorithms. We have explicitly demonstrated the superiority of the modified BS over the standard BS algorithm and confirmed the validity of the proposed trend indicators. Subsequently, we evaluated the performance of the overall algorithm for various values of µ and l. We have shown that the RCPD algorithm achieves extremely high true alarm rates for larger values of µ, while increasing the length of the monitoring window l can significantly impact the performance for small values of µ. Finally, overall, the standard type CUSUM outperforms the ratio type CUSUM and should be preferred.

Performance Evaluation Using Real Data

In this Section we investigate the performance of the proposed algorithms using a real dataset provided within the framework of the CONGAS project [47]; the dataset consists of the number of views of 882 YouTube videos, observed over N = 1, 000 instances.

Statistical Properties of the Real Dataset

First, we evaluate the validity of the most important underlying assumption of this analysis, that the content popularity can be modelled as the sum of a constant mean and a weak-dependent (t-dependent) stochastic process, as given in (3.34). A first intuitive method to test whether the time-series is shortrange dependent (SRD) is through its autocorrelation function (ACF). The ACF for a weakly-stationary process {X t : t ∈ N with mean value µ is given by,

ρ(k) = (X t -µ)(X t+k -µ) σ 2 . Note that if ∞ k=-∞ ρ(k) → ∞ the process has long-range dependence (LRD), while if ∞ k=-∞ |ρ(k)| < ∞ it
exhibits SRD. To distinguish between these two phenomena, we use the following functional form

ρ(k) ∼ C 2H-2 i , as i → ∞,
where C i > 0 and H ∈ (0, 1) is the Hurst exponent characterizing the LRD,i.e., H ∈ (1/2, 1) indicates the presence of LRD. It is challenging to accurately estimate the Hurst exponent out of real data [48] and several methods have been proposed in the literature [49]. In this work, we apply two semi-parametric tests, identified as accurate options among others presented in the survey paper [49]. The first method uses the discrete second order derivative in the time domain while the second uses the discrete second order derivative in the wavelet domain. Both methods estimate an H ≤ 0.5 for 95% of the YouTube time-series, indicating the validity of our assumptions related to the equation (3.34).

Performance of the Off-line Training Phase

First, we test the hypothesis H 0 of no change in the mean structure on our dataset. H 0 is rejected in approximately 70% of the cases, for a significance level of a = 0.05. This outcome indicates that CP algorithms can identify changing content dynamics in real times series. Next, we estimate the number of CPs, by applying the extended off-line algorithm. The corresponding results are illustrated in Fig. 3.1 and indicate a sufficiently high number of content popularity anomalies (i.e., mean changes). Hence, a CP analysis is indeed a suitable tool for content popularity detection.

To evaluate the performance of the proposed trend indicator T I f , we need a baseline independent assessment of the direction of change. We declare that a real increase in the mean value of content visit exists if

E[X( k * i-1,of f ) : X( k * i,of f )] < E[X( k * i,of f ) : X( k * i+1,of f )], (3.32)
or, that a real decrease in the number of visits exists if where i = 2, . . . , N -1 and E[•] denotes the numerical average. We test the modified MACD T I f on two sets of videos. The first set, Video Set 1, comprises the whole dataset, while the second set, Video Set 2, comprises only the videos with a considerable average number of visits (> 10), i.e., for which, E[X(1) : X(1000)] > 10.

E[X( k * i-1,of f ) : X( k * i,of f )] > E[X( k * i,of f ) : X( k * i+1,of f )], ( 3
The percentage of successful T I f identifications are tabulated in Table 3.5 for five values of the parameter h, namely h = 0, 3, 5, 7 and 10, where h denotes the T I f 's calculation threshold. Commenting on the results for Video Set 1, the T I f trend indicator works well, except for h = 0, providing at least 90% correct direction identifications. As expected, as h increases the procedure works better. More specifically, an h ≥ 5 parameter choice yields a success rate of 95%, while if a more agile estimation is needed then an h ≥ 3 still maintains a 91% accuracy. Considering the interim time between consecutive changes, we deduce that an h ≤ 7 is preferable. Regarding Video Set 2, we see that the results are highly improved, indicating that the procedure works even better for the most popular videos. In practice, this represents the more interesting scenario as it will have a greater impact in terms of the applied load balancing mechanism.

Furthermore, in Fig. 3.2, the time instances of upward and downward changes are shown in the form of a boxplot. It is intuitive that upward changes occur earlier than downward changes. Moreover, Fig. 3.2 demonstrates that the multitude of upward changes is greater than the respective of downward changes, indicating that decreases in popularity are sharper than increases. In particular, we estimated that out of the total number of changes, 67% are upward.

Finally, we analyze the interim time between consecutive CPs. The results presented in Fig. 3.3 illustrate the existence of a sufficiently large gap between consecutive potential changes. 90% of the intervals corresponding to consecutive CPs exceed 70 time instances and only 5% of them are shorter than 50 time instances, ensuring that a sufficiently large training window can be applied. The results depicted in Fig. 3.3 allow adjusting parameters of the on-line phase, in particular the minimum time interval between consecutive changes, denoted by the parameter d.

Evaluation of the RCPD Algorithm

In the previous subsection we have evaluated the performance of the off-line algorithm and demonstrated its efficiency as well as how it is employed in determining parameters of the on-line phase, such as the interval assuming no change d and the threshold parameter of T I f h.

We further employ the off-line algorithm as a benchmark against which the performance of the RCPD algorithm will be evaluated. We note that the off-line analysis provides the best possible statistical detection of the actual mean changes, as off-line algorithms operate retrospectively over the entirety of each of the time-series. Thus, in absence of a priori knowledge of the actual CPs in the real data (as opposed to the synthetic data in which the CPs were controlled), we evaluate the performance of the RCPD procedure by measuring the "similarity" of its outputs (detected CPs, instances of detection and trends) to the corresponding outputs of the off-line version.

As the number of detected CPs and / or their exact positions are likely to differ at the output of the retrospective (off-line) and of the RCPD algorithm, in order to obtain a measure of their similarity, we estimate their dynamic time warping (DTW) distance. The DTW is a dynamic programming tool that measures distances between asynchronous sequences and is widely used by the speech processing community [14].

The results are presented in Fig. 3.4, where the estimated DTW distances are depicted for several values of the monitoring window length l ∈ [40,150], to investigate the consistency of parameter l over different values. In the RCPD algorithm we use d = 50 (minimum distance between two changes) and have set the sensitivity parameter to γ = 0.25. The estimated mean DTW distance for the standard CUSUM is 52 and for the ratio-type CUSUM is 73. For comparison purposes, we note that the corresponding DTW distance over the synthetic data is 20 for medium / large changes, while the true CP detections are around 95%. As a result, we can infer, that the outputs of the on-line algorithm, using the standard CUSUM, are "very close" to the outputs of the benchmark off-line algorithm. In agreement with our observations over the synthetic data, the DTW distance using the ratio-type CUSUM is clearly larger. We also study the magnitude of the detected CPs. We define as the CP magnitude the percentagewise change in the mean values before and after the CP. We group the measured magnitudes for all change points using the four percentile threshold values 10%, 15%, 25% and 50%, i.e., reflecting the frequency of magnitudes exceeding the respective thresholds. The results are summarized in Table 3.6. According to our results, both the standard and ratio type CUSUM algorithms detect the most significant changes in the content popularity. Moreover, ratio-type CUSUM detects, in general, CPs with the largest magnitude of change, in agreement with synthetic data results.

Additionally, for illustration purposes, we depict the RCPD algorithm's outputs for four different time-series. We set the beginning of the monitoring period at m s = 200 and monitoring horizon l = 50, the on-line parameter g = 0.25 and the significance level to a = 0.05. The corresponding results are depicted in Fig. 3.5 and 3.6, showing the estimated CPs by applying the standard CUSUM and the ratio type CUSUM procedures, respectively. In both cases, the estimated changes correspond to the real content popularity changes; visual inspection suggests that the performance of the standard CUSUM is more reasonable (e.g., Fig. 3.6d). The RCPD, as it is illustrated in Fig. 3.5b seems to be adaptable to "fast" changes; without getting "confused" by random peaks in the time-series, such as those in Fig. 3.5a or in Fig. 3.6c.

Time Dependencies of Piecewise time-series

We also measure the autocorrelation function of the piecewise -divided by the detected CPs -time-series. Results are tabulated in Table 3.7 and verify the short dependence structure of the dataset; significant lags in time dependencies higher than 30 instances can be found in less than 5% of the time-series. Furthermore, the fact that the ACF of the piecewise time-series drops to zero quickly indicates that ALLOCATION AND INTRUSION DETECTION

Computational Complexity and Scalability

Finally, we present a MATLAB implementation of the overall algorithm with a large number of time-series (882 in this experiment) to quantify its performance in terms of processing cost. The computational time is measured on a Lenovo IdeaPad 510-15IKB laptop, with an Intel Core i7-7500U @ 2.70 GHz processor and 12 GB RAM. In Fig. 3.9, we show the aggregate processing cost per time instance for the two on-line methods and the total number of time-series. For the first 100 time instances, the algorithm collects the initial data, since it bootstraps. The peaks indicate the off-line part of the algorithm, which is more processing demanding mainly due to the segmentation algorithms running in parallel. The on-line part in the standard on-line algorithm indicates a linear complexity, since it is based on (3.18), while the equivalent quantity in (3.21) of the ratio-type is more CPU intensive, justifying the comparatively higher processing cost of the latter algorithm. In both cases, the aggregate processing cost is typically much less than a second, which demonstrates the lightweight nature of the proposed scheme. Such results could be further improved with a distributed deployment

The RCPD Algorithm in a Load Balancing Scenario

In this Section, we demonstrate our proposal in a real content distribution scenario, balancing the traffic between web clients and content caches with a bespoke DNS-based load-balancer. We implement the RCPD algorithm as a client-server MATLAB application. The RCPD engine receives periodic content popularity measurements; if a CP is detected, the corresponding upward or downward changes are signalled to the load balancer. The load balancer: (i) distributes the load between the deployed content caches, in a round-robin fashion; (ii) tracks content visits and communicates them to the RCPD engine; and (iii) deploys or removes content caches based on the RCPD outputs.

We implement the web clients using with the httpperf tool (https://github.com/httperf/httperf). The number of clients at each time instance is based on a real time-series of YouTube content views, illustrated in Fig. 3.10a. In practice, an experimental run without the RCPD mechanisms uses three content caches constantly and a run with the RCPD mechanism enabled uses initially two and then three, four and five content caches, after each of the three detected change points, respectively. As we show in Fig. 3.10b, the web clients improve their connectivity times to download the content, while as demonstrated in Fig. 3.10c the CPU utilization in the servers hosting the content remains almost the same. A relevant experimental platform is presented in [6].

Application of the RCPD for Intrusion Detection in SDWSNs

Considering the limitations of previous works in SDWSN anomaly detection, outlined in Section 3.3, our main objective is to propose in the remainder of this Chapter a mechanism for DDoS detection with, i) a high detection rate, and, ii) low complexity, so that it would be suitable for "restricted" networks. To this end, we propose the employment of the RCPD. As will be explained in detail next, we study two different DDoS attacks: a false data flow forwarding (FDFF) attack, and a false neighbor ALLOCATION AND INTRUSION DETECTION information (FNI) attack, chosen to illustrate the proposed algorithm's capabilities in the case of specific SDWSN vulnerabilities that exhibit largely different behavior. Both attacks are explained in Section 3.9.2, in the following.

SDWSN Security Analysis

The SDN networks security threats are grouped in three sets [50]: application plane attacks, control plane attacks, and data plane attacks. Among the three, the control plane attacks are pointed out as the most high impact and attractive [50] [51], as the control plane is responsible for the overall management of the network [52]. This characteristic turns the control plane prone to distributed denial of service (DDoS) attacks. For example, an intruder may flood the network with flow rule requests, which could lead to an exhaustion of the controller's resources. This attack can be intensified using multiple intruders.

The threats and vulnerabilities explained before also apply to SDWSNs. Moreover, there are specific attacks that can attain SDWSNs due to resources constraints, for example: in SDWSN the forwarding devices have low storage capacity, which limits the memory assigned for flow tables and buffers. These constraints make the forwarding devices prone to saturation attacks. Also, SDWSN networks are characterized for having a limited bandwidth and low processing power. This means that a saturation attack can also result in a DoS attack.

Another vulnerability concerns the gateway between the SDN controller and the WSN. The gateway has a radio module of limited bandwidth, rendering it a weak link even when the controller has enough resources to overcome an attack.

For the reasons outlined above, most of the security mechanisms designed for standard SDN networks have to be adapted or redesigned. This is one of the major challenges for SDWSN security.

Impact of DDoS Attacks on Network Performance

Based on SDWSN specific security vulnerabilities, in a previous work, we studied the impact of three DDoS attacks on SDWSN performance [53]. The attacks investigated were: false flow request (FFR), false data flow forwarding (FDFF), and false neighbor information (FNI).

The FFR attack aimed at increasing the SDWSN controller's processing overhead, as well as the packets' traffic, thus, increasing the number of collisions. Each attacker sent multiple flow rule requests to the controller, while the latter calculated the rule and replied to the request. The impact of the attack was observed to be negligible. The FDFF attack followed the FFR attack main idea of sending false flow rule requests to the controller, however, the execution was based on using each attacker's neighbors (benign nodes). Each attacker sent one data packet to its neighbors tagged with an unknown flow identifier; as the neighbors did not have a rule to apply to the packet, they sent a flow request to the controller asking a rule for the unknown flow identifier. Thus, compared to the FFR, the intensity of the attack was multiplied by the number of neighbors. The FDFF attack tripled the number of control packets in the whole network, but had a minor impact on the delivery rate. For both control and data packets, the delivery rate decreased only between 2% and 4%.

In the FNI attack, each attacker intercepted packets containing neighbor information, modified them with false neighbor information and forwarded them to the controller. The controller updated the network topology graph using the false information, and then reconfigured the network with wrong forwarding rules. Our main results [53] showed that the FNI attack could double the number of control packets in the whole network and had a significant impact on the delivery rate. In the case of the control packets, the delivery rate decreased between 35% and 50%. In the case of the data packets, the delivery rate decreased between 20% and 70%.

RCPD for Intrusion Detection

We employed the RCPD algorithm in SDWSNs under FDFF and FNI attacks. We simulated grid topologies with 36 and 100 nodes, varying the number of attackers in the network (5% and 20%). Each simulation run during 10 hours and each scenario was replicated 30 times. During the first 8 hours the network operated normally, then the attack was triggered. The choice of 8 hours was made because empirically it was seen that we needed at least 250 samples for the training period and we obtained one sample every 2 minutes. The simulations were performed using the COOJA simulator [54] and sky motes. The MAC layer was the IEEE 802.15.4, configured to work without radio duty cycle (nullrdc_driver). The data sink received the application data, while the management sink received performance metrics information. Notice that the SDN controller is a different node from the sink. Table 3.8 depicts the simulation parameters. We analyzed the data packets delivery rate and the control packets overhead. The delivery rate ALLOCATION AND INTRUSION DETECTION was calculated by dividing the total number of packets successfully received by the total number of packets sent. The control packets overhead was quantified as the total amount of control packets sent. Those metrics were updated every two minutes. The metrics measuring the performance of the intrusion detection algorithm were the following: i) the detection rate (DR); ii) the false positive rate (FPR); iii) the false negative rate (FNR); iv) the detection time median (DTM), indicating the median of the time instances elapsed from the launch of the attack to the instance it was identified; and v) the median absolute deviation (MAD). The detection rate is defined as the ratio between the correctly detected attacks and the total number of attacks. The false positive rate is defined as the ratio between the number of attack events classified as attack and the total number of attack events. The false negative rate is defined as the ratio between attack events classified as non-attack event and the number of attack events. The detection time median is defined as the median of the number of samples required to detect the attack. The median absolute deviation measures the variability of the detection times and is calculated as shown in (3.34), where X i is the detection time for replication i, and X is the median of all the detection times, MAD = median(|X i -X|).

(3.34)

The delivery rate and control overhead time series were analyzed for three monitoring windows and three critical values. We used monitoring periods K ∈ {50, 100, 150} samples. This means that the test statistic was run over K samples to extract changes in the mean value. As critical values we used α ∈ {90%, 95%, 99%}. Finally, in this analysis, we discarded the first 15 samples because during this time the network was bootstrapping.

Results and Analysis

In this Section we present and analyze the simulation results. In Section 3.10.1 we compare the FDFF attack detection performance when monitoring the data packets delivery rate and the control overhead. In Section 3.10.2 we repeat this analysis for the FNI attack.

FDFF Attack Detection

Tables 3.9 and 3.10 summarize the FDFF attack detection results when 5% of nodes are attackers. The results show that when monitoring the data packets delivery rate, the DR is between 57% and 73% for 36 nodes, and between 60% and 83% for 100 nodes. The results when monitoring the control packets overhead show two main points: (i) the algorithm has the same detection performance if configured with a monitoring period K of 50 or 150 samples, and (ii) when the monitoring period is configured as K = 100 samples we obtained a DR between 97% and 100%.

Comparing the FPR and the FNR metrics, we observed that the number of cases classified as false negative is higher than the number of cases classified as false positive. This means, it is more common for the algorithm not to detect a change in the metrics when the network is under attack than to detect a suspicious change in a network without attackers. For example, looking at the results when monitoring the control overhead in Table 3.9, only in one out of nine cases the FPR was different than zero. Conversely, the FNR was different than zero in six of nine cases.

The DTM (detection time median) results show that when monitoring the control packets overhead, the attack detection is faster than when monitoring the delivery rate in all the cases. When monitoring the data packets delivery rate, the DTM is between 31 and 37 samples for 36 nodes, and between 20 and 31 samples for 100 nodes. When monitoring the control packets overhead, the DTM is between 9 and 19 samples for 36 nodes, and between 10 and 19 samples for 100 nodes. The fastest detection is obtained monitoring the control packets overhead using a monitoring period of 100 samples, highlighted in red color. The results for 100 nodes showed it is possible to obtain a DR of 100% monitoring any of the ALLOCATION AND INTRUSION DETECTION metrics, but there were significant differences in the detection time. The DTM when monitoring the control overhead is between 3 and 4 samples, while when monitoring the data packets delivery rate the DTM was between 7 and 15 samples. Considering the earliest detection with the highest DR for both monitoring metrics, it occurred when using a monitoring period of 100 samples. For both cases the DR obtained was 97%. In terms of FPR and FNR, the best performance was obtained when monitoring the control overhead and using a monitoring period of 50 and 150 samples. Monitoring the control overhead using a monitoring window of 100 samples provided a FPR between 3% and 10%. Summarizing, the algorithm was able to detect the FDFF attack using either the data packet packets delivery rate or the control packets overhead as inputs. Notably, the algorithm obtained a DR of 100% with both metrics when 20% of nodes behave as attackers. However, aiming for the quickest detection captured through the detection time median, the algorithm achieved far better results when monitoring the control packets overhead in all scenarios. This is a direct consequence of the type of the attack; the attacker creates multiple flow rule request packets to increase the packet traffic and the controller processing overhead. After some time, the flow table of the nodes around the attacker start to saturate, affecting the data packets delivery rate. This means that the change in the delivery will be detected only after the tables saturation; on the contrary, the number of control packets start to change immediately after the attack is triggered.

FNI Attack Detection

Tables 3.13 and 3.14 summarize the FNI attack detection results when 5% of nodes were attackers. Opposite to the FDFF attack results, the algorithm obtained a better performance detecting the FNI attack when monitoring the data packets delivery rate. In the case of 36 nodes, the DR when monitoring the data packets delivery rate was between 80% and 93%, and the DR when monitoring the control packets overhead was between 23% and 33%. In the case of 100 nodes, the DR when monitoring the data packets delivery rate was between 83% and 93%, and the DR when monitoring the control packets overhead was between 30% and 70%. This means, even the best DR when monitoring the control packets overhead was under the worse DR when monitoring the data packets delivery rate. Also, the results showed that using a critical value of 90%, we obtained a negligible FPR (in our simulation calculated zero). With respect to the DTM, the best result was obtained by monitoring the data packets delivery rate and the control packets overhead were 6 and 25 samples, respectively. This means the algorithm detected the attack four times faster when monitoring the data packets delivery rate. For 100 nodes, the best DTM when monitoring the data packets delivery rate remained in 6 samples, but when monitoring the control packets overhead it was 29 samples.

Lastly, Tables 3.15 and 3.16 summarize the FNI attack detection results when 20% of nodes were attackers. For 36 nodes, the results remained similar to the case of 5% of nodes are attackers. In the case of 100 nodes, the DR when monitoring the data packets delivery rate was between 97% and 100%, and the DR when monitoring the control packets delivery rate was between 93% and 97%. About the DTM, the results for the scenarios when monitoring the data packets delivery rate were between 4 and 9 samples. The results for this same metric when monitoring the control packets overhead were between 24 and 26 samples. This means, for grid topologies with 100 nodes where 20% of nodes were attackers, we obtained similar DRs regardless of the monitoring metric, but when monitoring the delivery rate the detection was at least 3 times faster.

Summarizing our findings, the algorithm was able to detect the FNI attack monitoring either the data packet packets delivery rate or the control packets overhead. Then, comparing the detection performance based on the detection rate and the detection time median, the algorithm obtained a far better performance when monitoring the data packets delivery rate in all scenarios. This effect was directly related to the type of the attack; in the FNI attack, the attackers intercept the control packets that contained neighbor information, modify them, and then forward them to the controller. This means this attack could lead to a network misconfiguration using few control packets.

Conclusion

In this Chapter, we proposed the RCPD, a novel algorithm for the real-time detection of changes in the mean value of content popularity. Approaching the problem statistically, we efficiently combined off-line and on-line non-parametric CUSUM procedures to avoid restrictive assumptions for content popularity behavior and to reduce the overall computational cost. We divided the algorithm in two phases. The first phase was an extended retrospective (off-line) procedure with a modified BS algorithm and was used to adjust on-line parameters, based on historical data of the particular video. The second phase integrated one of two alternative trend indicators to the sequential (on-line) procedure, to reveal the direction of a detected change. We provided extensive simulations, using synthetic and real data, that demonstrated the performance of the proposed algorithm for the successful identification of content popularity changes in real-time. We also demonstrated through experimental measurements that the RCPD's processing cost is almost imperceptible. Finally we provided proof-of-concept by applying the algorithm in a load balancing application, highlighting its efficiency in a realistic setting.

Furthermore, we have used the RCPD for intrusion detection in SDWSNs. We performed experiments for two SDWSN DDoS attacks, in topologies of 36 and 100 nodes, and with varying number of attackers. Our results showed that it is feasible to detect different types of attacks by monitoring either the data packets delivery rate or control packets metrics. As the detector's algorithmic complexity is linear to the size of the network and the number of metrics monitored, the proposed approach could scale to include other metrics.

Chapter 4

Uplink Non-Orthogonal Multiple Access (NOMA) Under Statistical QoS Delay Constraints

Introduction

Various verticals in 5G and beyond (B5G) networks require very stringent latency guarantees, while at the same time envisioning massive connectivity. As a result, choosing the optimal multiple access (MA) technique to achieve low latency is a key enabler of B5G. In particular, this issue is more acute in uplink transmissions due to the potentially high number of collisions. On this premise, in the present contribution we discuss the issue of delay-sensitive uplink connectivity; to this end, we perform a comparative analysis of various MA approaches with respect to the achievable effective capacity (EC). As opposed to standard rate (PHY) or throughput (MAC) analyses, we propose the concept of the effective capacity as a suitable metric for characterizing jointly PHY-MAC layer delays. The palette of investigated MA approaches includes standard orthogonal MA (OMA) and power domain non-orthogonal MA (NOMA) in uplink scenarios.

For two-user networks, we propose novel closed-form expressions for the EC of the NOMA users and show that in the high signal to noise ratio (SNR) region, the "strong" NOMA user has a limited EC, assuming the same delay constraint as the "weak" user. We demonstrate that for the weak user, OMA achieves higher EC than NOMA at small values of the transmit SNR, while NOMA outperforms OMA in terms of EC at high SNRs. On the other hand, for the strong user the opposite is true, i.e., NOMA achieves higher EC than OMA at small SNRs, while OMA becomes more beneficial at high SNRs. This result raises the question of introducing "adaptive" OMA / NOMA policies, based jointly on the users' delay constraints as well as on the available transmit power.

Contributions and Chapter Organization

Non-orthogonal multiple access (NOMA) schemes have attracted a lot of attention recently, allowing multiple users to be served simultaneously with enhanced spectral efficiency; it is known that the boundary of achievable rate pairs (in the case of two users) using NOMA is outside the capacity region achievable with orthogonal multiple access (OMA) techniques [1] or other schemes [2]. Superior achievable rates are attainable through the use of superposition coding at the transmitter and of successive interference cancellation (SIC) at the receiver [3,4]. The SIC receiver decodes multi-user signals with descending received signal power and subtracts the decoded signal(s) from the received superimposed signal, so as to improve the signal-to-interference ratio. The process is repeated until the signal of interest is decoded. In uplink NOMA networks, the strongest user's signal is decoded first (as opposed to downlink NOMA networks in which the inverse order is applied). STATISTICAL QOS DELAY CONSTRAINTS Besides, in a number of emerging applications, delay QoS requirements become increasingly important, e.g., for URLLC systems. Furthermore, in future wireless networks, users are expected to necessitate flexible delay guarantees for achieving different service requirements. In order to satisfy diverse delay requirements, a simple and flexible delay QoS model is imperative to be applied and investigated. In this respect, the EC theory can be employed [5], [6] [7], with EC denoting the maximum constant arrival rate which can be served by a given service process, while guaranteeing the required statistical delay provisioning. We studied delay-constrained downlink NOMA networks in [4] and with secrecy constraints [8] in [9]. The present analysis complements [4], focusing on uplink transmissions. In the following Sections, we derive novel closed-form expressions for the ECs of a two user network; we then provide four Lemmas for the asymptotic performance of the network with NOMA and OMA. The conclusions drawn are supported by an extensive set of simulations.

The rest of the Chapter is organized as follows. In Section 4.3 we investigate the EC of a two user uplink NOMA system under statistical delay QoS constraints. Simulation results are given in Section 4.4, followed by conclusions in Section 4.5.

Effective Capacity of Two-user NOMA Uplink Network

P T = 2 i=1 P i = 1.
Here, P i is the power coefficient for the user i [10]. The received superimposed signal can be expressed as [11]

Z = 2 i=1 P i h i S i + w, (4.1)
where w denotes a zero mean circularly symmetric complex Gaussian random variable with variance σ 2 . The receiver will first decode the symbol of the strong user treating the transmission of the weak as interference. After decoding it, the receiver will suppress it from Z and decode the signal of the weak user. Following the SIC principle and denoting by ρ = 1 σ 2 the transmit SNR, the achievable rates, in b/s/Hz, for user U i , i = 1, 2, is expressed as: [12]

R i = log 2 1 + ρP i |h i | 2 1 + ρ i-1 l=1 P l |h l | 2 . ( 4.2)
Introducing statistical delay QoS constraints, let θ i be the statistical delay QoS exponent of the i-th user, and assume that the service process satisfies the Gärtner-Ellis theorem [6]. The delay exponent θ i captures how strict the delay constraint is [6]. A slower decay rate can be represented by a smaller θ i , which indicates that the system is more delay tolerant, while a larger θ i corresponds to a system with more stringent QoS requirements. Applying the EC theory in a uplink NOMA with two users, the i-th user's EC over a block-fading channel, is defined as:

E i c = - 1 θ i T f B ln E e -θ i T f BR i (in b/s/Hz) , (4.3)
where T f is the fading-block length, B is the bandwidth and E [•] denotes expectation over the channel gains. By inserting R i into (4.3), we obtain the following expression for the EC of the i-th user

E i c = 1 β i log 2 E (1 + ρP i |h i | 2 1 + ρ i-1 l=1 P l |h l | 2 ) β i , (4.4)
where

β i = - θ i T f B ln 2 , i = 1, 2
, is the normalized (negative) QoS exponent.

ECs in a Two-user NOMA Uplink Network

For the ordering of the channel gains we make use of the theory of order statistics in the following analysis [13]. Assuming a Rayleigh wireless environment, the channel gains, denoted by x i = |h i | 2 , i = 1, 2, are exponentially distributed with probability density function (PDF) and cumulative density function (CDF) respectively given by f (x i ) = e -x i , F (x i ) = 1e -x i . Then, according to order statistics [13], the ordered channel gains have respective PDFs f i:2 (x i ), i = 1, 2, and joint PDF f (x 1 , x 2 ) that are expressed as

f 1:2 (x 1 ) = 2e -2x 1 , (4.5)
f 2:2 (x 2 ) = 2e -x 2 1 -e -x 2 , (4.6) f (x 1 , x 2 ) = 2e -x 1 e -x 2 . (4.7)
As a result, the EC of User 1, denoted by E 1 c is expressed as

E 1 c = 1 β 1 log 2 (E[(1 + ρP 1 x 1 ) β 1 ]) = 1 β 1 log 2 ∞ 0 (1 + ρP 1 x 1 ) β 1 f 1:2 (x 1 )dx 1 = 1 β 1 log 2 2 P 1 ρ × U 1, 2 + β 1 , 2 ρP 1 . (4.8)
where U (•, •, •) denotes the confluent hypergeometric function [4]. On the other hand, the EC of the User 2 is evaluated as

E 2 c = 1 β 2 log 2 E 1 + ρP 2 x 2 1 + ρP 1 x 1 β 2 = 1 β 2 log 2 ∞ 0 ∞ x 1 1 + ρP 2 x 2 1 + ρP 1 x 1 β 2 f (x 1 , x 2 )dx 2 dx 1 = 1 β 2 log 2 2P 1-β 2 2 (ρP 2 ) β 2 e 1 ρP 2 e - (P 1 -P 2 ) ρP 2 + 1 β 2 log 2 -β 2 j=0 -β 2 j (ρP 1 ) j × ∞ k=0 (-1) k (P 2 -P 1 ) k k!(1 + j + k) × Γ[2 + β 2 + j + k, 1 ρP 2 ] -(ρP 2 ) -1-j-k Γ[1 + β 2 , 1 ρP 2 ] , (4.9)
with Γ(•, •) denoting the incomplete Gamma function [4]. The proof for deriving E 1 c is omitted as it can be verified with standard software (MAPLE or Mathematica) while for E 2 c is provided in Appendix I. In order to perform a comparative performance analysis, here we provide the achievable data rates for a two-user OMA network, denoted by R i , i = 1, 2, given as

R i = 1 2 log 2 1 + ρP T |h i | 2 , i = 1, 2 (4.10)
Note that the coefficient 1 2 is due to the equal allocation of resources to both users. The corresponding expressions are obtained for the ECs of both users in a OMA network, denoted by E i c , given as

Ẽi c = 1 β i log 2 E (1 + ρP T |h i | 2 ) β i 2 so that, (4.11)
Ẽ1 c = 1 β 1 log 2 2 ρ × U 1, 2 + β 1 2 , 2 ρ E 2 c = 1 β 2 log 2 2 ρ 1 k=0 1 k (-1) k × U 1, 2 + β 2 2 , 1 + k ρ
The proof is omitted as it can be verified with software (MAPLE or Mathematica).

Asymptotic Analysis

We first perform an asymptotic analysis with respect to the SNR. Our results are summarized in Lemma 1. Lemma 1: In the low and high SNR regimes, respectively, the following conclusions hold:

1. When ρ → 0, then, E 1 c → 0, E 2 c → 0, E 1 c → 0, E 2 c → 0, E 1 c -E 1 c → 0, E 2 c -E 2 c → 0; 2. When ρ → +∞, then E 1 c → +∞, E 2 c → 1 β 2 log 2 E 1 + P 2 |h 2 | 2 P 1 |h 1 | 2 β 2 , E 1 c → +∞, E 2 c → +∞, E 1 c -E 1 c → +∞, E 2 c -E 2 c → -∞.
Proof : The proof is provided in Appendix II. Lemma 1 indicates that the ECs of both users are vanishingly small at low values of ρ, irrespective of employing NOMA or OMA. On the other hand, at high SNRs, we notice that the EC of the strong user with NOMA is limited to a finite value. On the contrary, for the weaker user, when ρ >> 1, its achievable EC in the NOMA uplink increases without bound. This is the exact opposite of the downlink scenario, where it is the weaker user which is limited in terms of EC, when ρ >> 1 [4]. Now, the question is how the ECs evolve with ρ between the two asymptotic regimes. To answer this question and to further analyze the impact of ρ on the individual EC, we look at the derivatives with respect to ρ [4] in Lemma 2.

Lemma 2: For the EC of User 1, in a two-user uplink network the following hold:

1. ∂E 1 c ∂ρ ≥ 0 and ∂ E 1 c ∂ρ ≥ 0, ∀ρ; 2. When ρ → 0, then lim ρ→0 ( ∂(E 1 c -E 1 c ) ∂ρ ) = P 1 -1 2 ln 2 E[|h 1 | 2 ]; 3. When ρ >> 1, then ∂(E 1 c -E 1 c ) ∂ρ ≈ 1
2ρ ln 2 ≥ 0 and it approaches 0 when ρ → ∞. Proof : The proof is provided in Appendix III. Lemma 2 indicates that for User 1, when the transmit SNR ρ is very small, the EC with OMA increases faster than the EC with NOMA. On the other hand, Lemma 2 shows that when the transmit SNR is very large, the EC with NOMA increases faster than with OMA.

Combining Lemma 2 and Lemma 1, we can conclude that, E 1 c -E 1 c starts at vanishingly small value, first decreases, and subsequently increases to ∞ at a gradually reducing speed. This means that for the weaker user, OMA achieves higher EC than NOMA at small values of the transmit SNR ρ. At high values of ρ, NOMA becomes more beneficial for the weak user. Finally, when ρ → ∞ the performance gain of NOMA over OMA reaches a constant value in the case of User 1.

Lemma 3: For the EC of User 2, in a two-user uplink network the following hold:

1. ∂E 2 c ∂ρ ≥ 0 and ∂ E 2 c ∂ρ ≥ 0, ∀ρ; 2. When ρ → 0, then lim ρ→0 ( ∂(E 2 c -E 2 c ) ∂ρ ) = P 2 2 ln 2 E[|h 2 | 2 ] 3. When ρ >> 1, then ∂(E 2 c -E 2 c ) ∂ρ ≈ -1 2 ln 2 1
ρ < 0 and it approaches 0 when ρ → ∞. Proof : The proof is provided in Appendix IV. Lemma 3 indicates that, for User 2, when the transmit SNR ρ is very small, the uplink EC with NOMA increases faster than that with OMA. On the other hand, when the transmit SNR is very large, the uplink EC with OMA increases faster than that with NOMA. Combining Lemma 3 and Lemma 1, we can conclude that, E 2 c -E 2 c starts at an initial vanishingly small value, first increases, and subsequently decreases to -∞ with a gradually diminishing rate. This means that for the stronger user, NOMA achieves higher EC than OMA at small values of the transmit SNR ρ. At high values of STATISTICAL QOS DELAY CONSTRAINTS ρ, OMA becomes more beneficial for the strong user. Finally, when ρ → ∞ the performance gain of OMA over NOMA reaches a constant value, for the stronger user.

Finally, we investigate the sum ECs when using OMA and NOMA, denoted by V N and V O ,

V N = E 1 c + E 2 c , (4.12
)

V O = Ẽ1 c + Ẽ2 c . (4.13)
Our conclusions are drawn in Lemma 4. Lemma 4: For the sum EC with NOMA, denoted by V N , and with OMA, denoted by V O , in a two-user uplink network, the following hold:

1. ∂V N ∂ρ ≥ 0 and ∂V O ∂ρ ≥ 0, ∀ρ; 2. When ρ → 0, V N → 0, lim ρ→0 ( ∂V N ∂ρ ) = P 1 ln 2 E[|h 1 | 2 ] + P 2 ln 2 E[|h 2 | 2 ] ≥ 0, and V O → 0, lim ρ→0 ( ∂V O ∂ρ ) = P 1 2 ln 2 E[|h 1 | 2 ] + P 2 2 ln 2 E[|h 2 | 2 ] ≥ 0; 3. When ρ >> 1, V N → ∞, lim ρ→∞ ( ∂V N ∂ρ ) = 0, and V O → ∞, lim ρ→∞ ( ∂V O ∂ρ ) = 0.
The proof is provided in Appendix V. Lemma 4 indicates that when NOMA is applied, the sum EC has a constant increasing rate at small value of the transmit SNR ρ that depends on the average of the channel power gains and the allocated power coefficients. A similar conclusion is reached when using OMA. On the other hand, when ρ >> 1, Lemma 4 indicates that the rate at which the sum ECs increase reaches a plateau, both in the case of NOMA and OMA.

Numerical Results

In this Section, the Lemmas presented in Section 4.3 are validated through Monte Carlo simulations. We consider a two user uplink NOMA system, with the following settings: normalized transmission power levels for both users, P 1 = 0.2, P 2 = 0.8, normalized delay exponent β 1 = β 2 = -1 for both users, unless otherwise stated.

In Fig. 4.1 the ECs of the two-user uplink NOMA and OMA networks are depicted versus the transmit SNR. We note that for the weak user, OMA is more advantageous than NOMA for low transmit SNRs, and NOMA is more advantageous than OMA at high transmit SNRs. Reverse conclusions can be drawn for the strong user. We notice also that the EC of the strong user converges at high SNRs. This provides numerical validation for Lemma 1. In Fig. 4.4, the ECs of the strong and weak users are depicted across different SNR values, ρ ∈ {1, 10, 30, 40, 50} dB, as functions of the (negative) normalized delay exponent, for NOMA and OMA scenarios. We notice that the EC of each user is identical for NOMA and OMA, for small and large values of the normalized delay exponent. And with incresing transmit SNR ρ, the EC increases for both users. Fig. 4.5 shows the difference of the EC in NOMA and the EC in OMA of the weak user. This curve starts initially at zero, then decreases to a certain minimum and starts increasing at the high values of transmit SNR. This confirms Lemma 2. When the delay is equal to -1, we see that for ρ ∈ [0, 30] dB, the difference values are negative, indicating that OMA outperforms NOMA in this range. But when ρ > 30 dB, the values are positive, i.e., NOMA offers better link-layer rates. However, the particular ranges depend not only on the delay exponents but also on the power allocation coefficients. By increasing the transmission power of the weak user and reducing the transmission power of the strong user, we notice that the range is reduced. That range expands when we do the inverse. Also, when the delay becomes more stringent, e.g., β 1 =β 2 =-2, the zero crossing moves from 30 to 36 dB. curve starts initially at zero, then increases to a certain maximum and starts decreasing without bound at high values of the transmit SNR. This confirms Lemma 3. We note that the maximum of these curves decreases when the delay becomes more stringent. To investigate the impact of ρ on the performance of the total link-layer rate for the two-user system, in Fig. 4.7 the plots for V N in NOMA and V O in OMA, versus the transmit SNR are depicted for various delay exponents. The curves demonstrate that for both NOMA and OMA, the total EC for the two users starts at the initial value of 0 and then increases with the transmit SNR, as outlined in Lemma 4. When ρ is very small, the total link-layer rate for the two user in NOMA, V N , increases faster than V O in OMA. On the contrary, with the increase of the transmit SNR, V O becomes gradually higher than V N . At very high values of the transmit SNR, the gap between the sum EC with NOMA and OMA increases further. Finally, when the delay becomes more stringent, the sum EC of both NOMA and OMA decreases. Finally, Figs 4.8 and 4.9 depict the sum ECs versus ρ, for several values of the (negative) normalized delay exponent. In Fig. 4.8, the delay of the strong user is fixed, while the delay exponent of the weak user varies. It is shown that in this case, the highest delay QoS (i.e., the smallest negative normalized delay exponent) of the weak user corresponds to the highest gap between the sum ECs V N -V O . On the other hand, when the delay of the weak user is fixed, Fig. 4.9 shows that the smallest delay Qos (i.e., the highest negative normalized delay exponent) for the strong user corresponds to the largest gap in

V N -V O .
The curve of V N -V O starts at zero, increases to a maximum, and returns to negative values. The transition to zero is at ρ = 31, and ρ =36 respectively for the figures 4.8 and 4.9. That means from 0 to 31dB (36dB in the Figure 4.9), the total link-layer rate of NOMA is higher than the OMA one. And when ρ becomes larger than this transition point, the total link-layer rate of OMA outperforms the NOMA one.

Conclusions

The concept of the EC enabled us to study the achievable data-link layer rates when statistical delay QoS guarantees are in place, expressed in the form of delay exponents. We investigated the EC for the uplink of a two-user NOMA network, assuming a Rayleigh block fading channel. We derived novel closed-form expressions for the ECs of the two users and provided a comparison between NOMA and OMA. In NOMA networks, we showed that the ECs of both users decrease as the delay constraints STATISTICAL QOS DELAY CONSTRAINTS become stringent. On the other hand, at high transmit SNRs, the EC of the weak user can surpass the EC of the strong user, as the latter is limited due to interference. This provides the possibility of switching between NOMA and OMA according to the individual users' delay constraints and transmit power levels.

Appendix I

For the second user, we have:

E 2 c = 1 β 2 log 2 2 ∞ 0 ( ρP 2 1 + ρP 1 x 1 ) β 2 e -x 1 ∞ x 1 1 + ρP 1 x 1 ρP 2 + x 2 β 2 e -x 2 dx 2 dx 1 . Set z = 1+ρP 1 x 1 ρP 2 + x 2 , which means we have x 2 = z -1+ρP 1 x 1 ρP 2
and dx 2 = dz. Then,

E 2 c = 1 β 2 log 2 2e 1 ρP 2 ∞ 0 ( ρP 2 1 + ρP 1 x 1 ) β 2 e -x 1 e P 1 x 1 P 2 ∞ 1+ρx 1 ρP 2 z β 2 e -z dzdx 1 = 1 β 2 log 2 2(ρP 2 ) β 2 2 e 1 2ρP 2 ∞ 0 (1 + ρP 1 x 1 ) -β 2 (1 + ρx 1 ) β 2 2 e (2P 1 -2P 2 -1)x 1 2P 2 W β 2 2 , 1+β 2 2 ( 1 + ρx 1 ρP 2 ) dx 1 = 1 β 2 log 2 2P 2 (ρP 2 ) β 2 e 1 ρP 2 e - (P 1 -P 2 ) ρP 2 ∞ 1 ρP 2 P -β 2 2 (1 + ρP 1 y) -β 2 e (P 1 -P 2 )y Γ(1 + β 2 , y)dy ,
where W is the Whittaker W function.

Using the binomial expansion, we have (1

+ ρP 1 y) -β 2 = -β 2 j=0
-β 2 j (ρP 1 y) j and we get the expression given in (4.9). STATISTICAL QOS DELAY CONSTRAINTS Figure 4.9: V N -V O versus ρ for various normalized delay.

The closed-form expression for the EC OMA, of the m-th user with M total users, is determined in [4] as follow.

Ẽm c = 1 β m log 2 E (1 + ρ|h m | 2 ) βm 2 (4.14) = 1 β m log 2 ψ m ρ ∞ 0 (1 + γ m ) βm e - (M -m+1)γm ρ (1 -e -γm ρ ) m-1 dγ m = 1 β m log 2 ψ m ρ m-1 k=0 m -1 k (-1) k ∞ 0 (1 + γ m ) βm e - (M -m+1+k)γm ρ dγ m . Ẽm c = 1 β m log 2 ψ m ρ m-1 k=0 m -1 k (-1) k U 1, 2 + 2 M β m , M -m + 1 + k ρ (4.15)
For the two users case, M = 2, we have:

E 1 c = 1 β 1 log 2 2 ρ × U 1, 2 + β 1 , 2 ρ (4.16)
and,

E 2 c = 1 β 2 log 2 2 ρ 1 k=0 1 k (-1) k × U 1, 2 + β 2 , 1 + k ρ (4.17)
where U (•, •, •) is the confluent hypergeometric function of the second kind, defined as

U (a, b, z) = 1 Γ(a) ∞ 0 e -zt t a-1 (1 + t) b-a-1 dt (4.18)

Appendix II

By inserting ρ → 0 into (4.8) and (4.9), we get 1) of Lemma 1, i.e., lim

ρ→0 (E 1 c -E 1 c ) = 1 β 1 log 2 E[(1 + ρP 1 |h 1 | 2 ) β 2 ] E[(1 + ρ|h 1 | 2 ) β 2 2 ] = 0, lim ρ→0 (E 2 c -E 2 c ) = 1 β 2 log 2   E[(1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 ] E[(1 + ρ|h 2 | 2 ) β 2 2 ]   = 0.
In the same way, by inserting ρ → ∞ into (4.8) and (4.9), we get 2) in Lemma 1, given below.

lim ρ→∞ E 2 c → 1 β 2 log 2 E[(1 + P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 ] , lim ρ→∞ (E 1 c -E 1 c ) = 1 β 1 log 2   ρ β 1 2 E[( 1 ρ + P 1 |h 1 | 2 ) β 2 ] E[( 1 ρ + |h 1 | 2 ) β 2 2 ]   = ∞, lim ρ→∞ (E 2 c -E 2 c ) = 1 β 2 log 2     E[( 1 ρ +P 1 |h 1 | 2 +P 2 |h 2 | 2 1 ρ +P 1 |h 1 | 2 ) β 2 ] ρ β 2 2 E[( 1 ρ + |h 2 | 2 ) β 2 2 ]     =-∞.

Appendix III

To analyze the trends of E 1 c and E 1 c with respect to ρ, we start with

∂E 1 c ∂ρ = 1 β 1 ln 2 E[(1 + ρP 1 |h 1 | 2 ) β 1 ] E[(1 + ρP 1 |h 1 | 2 ) β 1 ] = P 1 ln 2 E[|h 1 | 2 (1 + ρP 1 |h 1 | 2 ) β 1 -1 ] E[(1 + ρP 1 |h 1 | 2 ) β 1 ] ≥ 0.
Similarly, for user 1 in OMA we have

∂ E 1 c ∂ρ = 1 β 1 ln 2 E[(1 + ρ|h 1 | 2 ) β 1 2 ] E[(1 + ρ|h 1 | 2 ) β 1 2 ] = 1 2 ln 2 E[|h 1 | 2 (1 + ρ|h 1 | 2 ) β 1 2 -1 ] E[(1 + ρ|h 1 | 2 ) β 1 2 ] ≥ 0.
Then, we get that

∂(E 1 c -E 1 c ) ∂ρ = P 1 ln 2 E[|h 1 | 2 (1 + ρP 1 |h 1 | 2 ) β 1 -1 ] E[(1 + ρP 1 |h 1 | 2 ) β 1 ] - 1 2 ln 2 E[|h 1 | 2 (1 + ρ|h 1 | 2 ) β 1 2 -1 ] E[(1 + ρ|h 1 | 2 ) β 1 2 ] , (4.19)
and lim ρ→0

( ∂(E 1 c -E 1 c ) ∂ρ ) = (P 1 -1 2 ) ln 2 E[|h 1 | 2 ] ≤ 0. When ρ >> 1, we have ∂(E 1 c -E 1 c ) ∂ρ ) = P 1 ln 2 E[|h 1 | 2 (ρP 1 |h 1 | 2 ) β 1 -1 ] E[(ρP 1 |h 1 | 2 ) β 1 ] - 1 2 ln 2 E[|h 1 | 2 (ρ|h 1 | 2 ) β 1 2 -1 ] E[(ρ|h 1 | 2 ) β 1 2 ] = 1 2ρ ln 2 ≥ 0. (4.20)
When ρ → ∞, this term approaches 0.

Appendix IV

E 2 c = 1 β 2 log 2 (E[(1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 ]
), and

∂E 2 c ∂ρ = 1 β 2 ln 2 E[(1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 ] E[(1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 ] = 1 ln 2 E[ P 2 |h 2 | 2 (1+ρP 1 |h 1 | 2 ) 2 (1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 -1 ] E[(1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 ] ≥ 0. (4.21)
In the same way, for the user 2 in OMA, we have

∂ E 2 c ∂ρ = 1 β 2 ln 2 E[(1 + ρ|h 2 | 2 ) β 2 2 ] E[(1 + ρ|h 2 | 2 ) β 2 2 ] = 1 2 ln 2 E[|h 2 | 2 (1 + ρ|h 2 | 2 ) β 2 2 -1 ] E[(1 + ρ|h 2 | 2 ) β 2 2 ] ≥ 0, (4.22)
and

∂(E 2 c -E 2 c ) ∂ρ = 1 ln 2 E[ P 2 |h 2 | 2 (1+ρP 1 |h 1 | 2 ) 2 (1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 -1 ] E[(1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 ] - 1 2 ln 2 E[|h 2 | 2 (1 + ρ|h 2 | 2 ) β 2 2 -1 ] E[(1 + ρ|h 2 | 2 ) β 2 2 ]
.

(4.23)

When ρ → 0, we have that lim ρ→0

( ∂(E 2 c -E 2 c ) ∂ρ ) = (P 2 -1 2 ) ln 2 E[|h 2 | 2 ]. When ρ is very large, ∂(E 2 c -E 2 c ) ∂ρ = E[ P 2 |h 2 | 2 ρ 2 ( 1 ρ +P 1 |h 1 | 2 ) 2 (1 + ρ ρ (P 2 |h 2 | 2 ) ( 1 ρ +P 1 |h 1 | 2 ) ) β 2 -1 ] ln 2E[(1 + ρ ρ P 2 |h 2 | 2 ( 1 ρ +P 1 |h 1 | 2 ) ) β 2 ] - 1 2 ln 2 1 ρ E[|h 2 | 2 ( 1 ρ + |h 2 | 2 ) β 2 2 -1 ] E[( 1 ρ + |h 2 | 2 ) β 2 2 ] = E[ P 2 |h 2 | 2 ρ 2 (P 1 |h 1 | 2 ) 2 (1 + P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 -1 ] ln 2E[(1 + P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 ] - 1 2 ln 2 1 ρ E[(|h 2 | 2 ) β 2 2 ] E[(|h 2 | 2 ) β 2 2 ] = P 2 ρ 2 P 2 1 E[ |h 2 | 2 (|h 1 | 2 ) 2 (1 + P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 -1 ] ln 2E[(1 + P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 ] - 1 2 ln 2 1 ρ = P 2 P 2 1 ln 2 A -1 2 ln 2 ρ ρ 2 , (4.24)
where

A = E[ |h 2 | 2 (|h 1 | 2 ) 2 (1+ P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 -1 ] E[(1+ P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 ]
, unrelated to ρ. Hence, when ρ is very large, ∂(E 2 c -E 2 c ) ∂ρ can be approximated by -1 2 ln 2 1 ρ , and it gradually approaches 0 when ρ → ∞.

Appendix V

Note that

V N = E 1 c + E 2 c
. By using Lemma 1, we have lim

ρ→0 (V N ) = 0 and lim ρ→∞ (V N ) = ∞.
Then, we get that

∂V N ∂ρ = ∂(E 1 c + E 2 c ) ∂ρ = P 1 ln 2 E[|h 1 | 2 (1 + ρP 1 |h 1 | 2 ) β 1 -1 ] E[(1 + ρP 1 |h 1 | 2 ) β 1 ] + 1 ln 2 E[ P 2 |h 2 | 2 (1+ρP 1 |h 1 | 2 ) 2 (1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 -1 ] E[(1 + ρP 2 |h 2 | 2 1+ρP 1 |h 1 | 2 ) β 2 ] ≥ 0.
( ∂V N ∂ρ ) = P 1 ln 2 E[|h 1 | 2 ] + P 2 ln 2 E[|h 2 | 2 ]. When ρ → ∞, we get that lim ρ→∞ ∂V N ∂ρ = 1 ρ ln 2 + E[ P 2 |h 2 | 2 (P 1 |h 1 | 2 ) 2 (1 + P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 -1 ] ρ 2 ln 2E[(1 + P 2 |h 2 | 2 P 1 |h 1 | 2 ) β 2 ] =0.
For V O in the case of OMA, we note that

V O = E 1 c + E 2 c
. By using Lemma 1, we have lim ρ→0

(V 0 ) = 0 and lim ρ→∞ (V 0 ) = ∞. Then, ∂V 0 ∂ρ = ∂( E 1 c + E 2 c ) ∂ρ = 1 2 ln 2 E[|h 1 | 2 (1 + ρ|h 1 | 2 ) β 1 2 -1 ] E[(1 + ρ|h 1 | 2 ) β 1 2 ] + 1 2 ln 2 E[|h 2 | 2 (1 + ρ|h 2 | 2 ) β 2 2 -1 ] E[(1 + ρ|h 2 | 2 ) β 2 2 ] ≥ 0.
When ρ → 0, we have lim ρ→0

( ∂V O ∂ρ ) = 1 2 ln 2 E[|h 1 | 2 ]+ 1 2 ln 2 E[|h 2 | 2 ]. When ρ → ∞, we have that lim ρ→∞ ( ∂V O ∂ρ ) = lim ρ→∞ ( 1 2ρ ln 2 + 1 2ρ ln 2 ) = lim ρ→∞ ( 1 ρ ln 2
), which equals to 0.

Chapter 5 Perspectives

Introduction

We are currently witnessing a tremendous increase in the volume of Internet of Things (IoT) generated data on one hand, and, the emergence of delay critical use cases on the other. These factors have played a major role towards the processing of the respective data flows close to their sources as opposed to in core Clouds, giving rise to Edge/Fog computing. However, in this context the question of what is the "optimal" point in the end to end (E2E) path for processing to occur, has not yet been systematically addressed. As a rule of thumb, it is conjectured that strict real-time applications require computation to be executed in the vicinity of the data source while tasks such as big data analytics are considered more appropriate to run on the Cloud. A further question down the path, concerns securing connections to Edge nodes while offloading, particularly when heterogeneous systems are to be interconnected. In parallel, proposals for the flexible allocation of the infrastructure resources under the umbrella of network slicing, build on two key technologies, namely software defined networking (SDN) and network function virtualization (NFV) [1]. Due to the complexity of the problem at hand, the new network management layer is typically thought of as machine learning (ML) unit enabling multi-domain orchestration [2], [3]. As we move gradually away from the standard client-server networking paradigm and enter a new era of truly E2E quality of service (QoS), service level agreements (SLAs) in the near future will be expected to include guarantees about the quality of security (QoSec) [4].

Meanwhile, in the radio community a different discussion is currently taking place around the 1949 paper of Warren Weaver [5] on the premise that in sixth generation (6G) systems it will be possible to move towards semantic communications, i.e., conveying reliably the "meaning" of the messages, rather than simply conveying reliably the data that carry the messages. Early approaches in the direction of defining a formal framework for semantic communications have appeared [6], in essence extending the standard Shannon model of reliable communication of binary sequences to reliable communication of semantic messages. Through the use of propositional logic, the concept of semantic entropy was introduced and employed in semantic source and channel coding statements. In other communities, notably in natural language processing, moving from a semantic to a computational representation of meaning was undertaken with artificial intelligence (AI) tools with great success. It therefore only seems natural to invest on AI to interpret semantics in 6G, while the interplay between information theory and machine learning has recently attracted attention [7].

On the other hand, the intelligence of any actual system in the physical world sits on, and depends upon, its physical infrastructure. 1 The author of this manuscripts posits that PHY layer properties, e.g., the direction of arrival of a beam, the location of a node, the time of communication, the ambient temperature, etc., carry important contextual information, directly related to semantics. A consequential question would be then how to incorporate in the definition of context "deeper" properties of what constitutes the "PHY signal / system", for example:

• Deterministic / stochastic aspects of source processes and evolutionary dynamics;

• Nonlinear behavior of sources, sinks, transceivers and media;

• Memory depth of the individual segments of the network and overall memory of the system;

• Scale (size) of the network and interconnectivity properties, e.g., well connected / self similar / scale-free networks;

The list can grow... The implications of the previous discussion are multi-fold and relate to important open research problems, for example: i) the ML orchestration unit emerges as a preferential point of attack in the network slicing era; ii) the standard "on or off" security paradigm in which security protocols provide hard guarantees of authentication, confidentiality, integrity, non-repudiation, etc., for the client-server exchanges might not be well aligned with QoSec; iii) accounting for the context of communication carries important semantic information; iv) to truly enable E2E QoS the E2E latency, comprising both communication and processing delays need to be mutually optimized.

In the following Sections my short and long term research directions, motivated by the previous points, will be presented, starting from wireless security and moving on to 6G wireless.

The Role of of PLS in 6G

In the context of security, unarguably, 5G security enhancements present a big improvement with respect to long term evolution (LTE). However, as the complexity of the application scenarios increases with the introduction of novel use cases, notably ultra-reliable low latency (URLLC) and massive machine type communications (mMTC), novel security challenges arise that might be difficult to address using the standard paradigm of complexity based classical crypto solutions, particularly because of low latency constraints. At the same time, in the longer 10-year horizon novel security concepts based on "trust models" and risk-based, adaptive identity management and access control will come to life, enabled to a large extend by AI. Early elements of these directions are seen in standards used for digital (monetary) transactions, e.g., the Internet engineering task force (IETF) request for comments (RFC) Vectors of Trust [8]. Furthermore, to allow for flexible QoSec in the differentiated services framework, the development and integration of security controls at all layers of the communications system is envisioned [9].

Currently, physical layer security (PLS) is being considered as a possible way to emancipate networks from classical, complexity based, security approaches. Since the wireless channel is reciprocal, time-varying and random in nature, it offers a valid, inherently secure source for key agreement (KA) protocols between two communicating parties. This is pertinent to many forthcoming B5G applications that will require strong, but nevertheless, lightweight KA mechanisms; in this direction, PLS may offer such solutions, or complement existing algorithms, with minimal changes in the control plane. With respect to authentication, physical unclonable functions (PUFs), wireless fingerprinting / localization, combined with more classical approaches, could also enhance authentication and key agreement (AKA) in demanding scenarios, including (but not limited to) device to device (D2D) and Industry 4.0. In parallel, mmWave in the Terahertz range will rely upon setting up invisible radio "wires"; although on their own they cannot ensure confidentiality, they will provide a concrete scenario for the wiretap channel. It is therefore pertinent to discuss advancements in wiretap secrecy encoders.

How Many Secret Bits Are Needed

A core question that needs to be addressed first in all of the above scenarios is "how many secret bits" we need to reach security levels that could be considered acceptable. If we envision hybrid PLS-crypto systems that leverage symmetric block ciphers and the employment of PLS serves primarily for generating and communicating authentication and encryption keys, then the secret bit rates can be made very low. As an example, 256 authentication or encryption key bits suffice for the encryption of at least 1 gigabyte (GB) of data; if the keys are exchanged using secrecy encoders, this would correspond to a required secrecy rate of τ = 3.2 • 10 -8 bits/sec/Hz. For a "fair" comparison we can set the probability of secrecy outage to P out = 2 -80 , which is the practically tolerable value for the "advantage" gained by an adversary in semantic security proofs (chosen plaintext and chosen ciphertext proofs -CPA and CCA security). A quick calculation using these numbers in a basic single input single output (SISO) block fading channel with a single eavesdropper [10] reveals that we would need 44 transmission symbols if causal CSI was available along with a fixed power budget over a time horizon; in 5G this translates to less than 4 consecutive transmission time intervals (TTIs) of a total time duration of less than 2 msec. Further investigations assuming semi-blind scenarios in which only the legitimate users' CSI is available, extension to MIMO, looking at larger values of the probability of secrecy outage, etc., would be needed for a systematic study of the scenarios in which secrecy encoders could be applicable. Our initial conclusion is that hybrid systems show promise and could fit excellently in a framework of flexible QoSec with differing levels of secrecy guarantees.

A further motivation in exploring PLS solutions stems from the fact that a number of vulnerabilities, e.g., in the false base station attack [11] or due to jamming during the beam allocation in mmWave [12] arise during the establishment of the radio link; in this aspect, standard security protocols that build on the premise that the communication link has already been established, cannot offer solutions when this is not the case, whereas, PLS schemes can be seamlessly incorporated (e.g., can be interwoven with channel estimation).

In a nutshell, several advantages can be envisioned by rethinking the security design bottom-up, and in particular: 1) PLS can provide information-theoretic security guarantees with lightweight mechanisms (e.g., using LDPC encoders); 2) hybrid crypto-PLS protocols can provide alternatives in scenarios where classical mechanisms fall short and naturally lend themselves for the design of adaptive QoSec protocols, and, 3) PLS can act as an extra security layer, complementing other approaches.

My proposed research on PLS encompasses research on authentication, data confidentiality and anomaly detection, described below.

Authentication

With respect to authentication, my current research includes multi-factor AKA with PUFs, wireless fingerprinting and localization, while I also work on Slepian Wolf and Wyner Ziv PUF and SKG decoders in the short block-length.

My future research directions include:

-Characterization of the wireless channel from a security (as opposed to reliability) point of view.

The baseline idea boils down to the fact that the predictable element of the wireless coefficient would be useful for authentication (e.g., through localization), while the purely random for extracting secret keys. Developing the mathematical and ML tools to resolve the two is an unchartered area of research so far;

-The proposal of hybrid crypto-PLS systems and the resilience of related systems to active attacks. Unlike in the network security paradigm, active attacks at PHY can be alleviated by PHY remedies, e.g., narrow beamforming, pilot randomization, energy harvesting and band hopping leveraging OFDM transmitters.

Data Confidentiality

Additionally, with respect to data confidentiality achieved in wiretap channels with the use of secrecy encoders, practical designs have so far been presented only for the wiretap-II channel (i.e., noiseless main channel) and the erasure channel. Building secrecy encoders for the standard wiretap-I channel is timely, especially as degradedness of the eavesdropping channel can be substantiated in mmWave technologies enabled by narrow beamforming using multiple antennas. In my proposed research direction in this domain, I intend to seek input from the design of core building blocks of symmetric block ciphers, in particular of reversible S-boxes. While linear encoders purposed for reliability have proved instrumental to reach the Shannon limit for reliable communication in (linear) channel wireless settings, they might not be the optimal choice for secrecy. The study of bent functions [13] can constitute the starting point of the design of non-linear secrecy encoders, purposed to guarantee reliability in the communication and secrecy with respect to an eavesdropper. Finally, the evaluation of the security level achieved with the proposed PLS methods will be sought, scrutinizing the hypothesis that security level 5 (post-quantum) is attainable with PLS in the finite block-length regime. In particular through a systematic analysis of the probability of secrecy outage, I will seek to provide quantitative measures regarding the security level achievable.

Anomaly Detection

In terms of anomaly detection, my focus is on -Identifying attacks on the ML orchestrator; -Proposing novel approaches on identifying hacking at the device level in IoT networks. I will study whether such intrusions can be "inferred" by observing side channels. Side channels have customarily been used for negative security proofs, e.g., showcasing it is possible to compromise symmetric block ciphers with smart power monitoring. The idea of using them to identify intrusions or anomalous events breaks completely new ground. A second important aspect is the development of distributed anomaly detection algorithms. Understanding the trade-off between cluster size and speed of detection would be the primary initial goal in this setting.

Low Latency, Interference-free, Contextual 6G Communications

Three further topics of primary focus for me are articulated around:

-Interference management; -E2E delay constraints; -Context awareness.

With respect to the former two, I am interested in studying the interaction of two key technologies: the combination of random access (RA), e.g., slotted Aloha, with uplink NOMA on one hand and the limits of interference cancellation using the baseline ideas of generalised frequency division multiplexing (GFDM) [14]. With respect to the latter, the employment of advanced ML algorithms will be investigated.

NOMA for Collision Avoidance in mMTC Uplink

With respect to the first aspect, as an alternative to grant free access, it is possible to envision the combination of slotted Aloha with NOMA technologies. Let's us take the narrow-band IoT (NB-IoT) as an example. A contention-based RA procedure is performed for initial uplink grant which includes a four-message handshake between the IoT devices and the gNodeB (gNB). First, the IoT device transmits a preamble to the gNB on the Narrowband Physical RA CHannel (NPRACH). The preamble is composed of four symbol groups, each transmitted on a different subcarrier. If two or more IoT devices randomly choose the same initial subcarrier, the preamble sequence will collide, albeit the gNB will not notice the collision and the corresponding devices will receive the same RA response (RAR) message containing the uplink resource grant and synchronization information. This causes the message transmission collision to take place only in step 3, causing further delays.

It is expected that preamble collision will occur more frequently in mMTC scenarios, causing severe network congestion and long access delay, because of the subsequent backoff. NOMA can be applied to enhance the conventional RA procedure, with early proposals in this direction recently appearing [15]. In these works, a set of pre-determined power levels is set and the NOMA-based RA is employed by allowing the IoT devices to randomly access one channel with a randomly chosen power level. In my future studies I am interested in applying this concept in Rayleigh environments and using the theory of order statistics to allow each device "self-evaluate" it's relative ranking in terms of channel quality and make an informed guess on the power level that should be used. Interesting further extensions would account for the impact of short packet transmissions [16] and MAC sub-layer QoS delay constraints [17].

Interference Cancellation Using Machine Learning

I will build on my previous research on a particular instance of GFDM in the frequency domain, referred to as faster than Nyquist (FTN) signalling [18]. In FTN, the orthogonality of the OFDM subcarriers is intentionally violated through the use of inverse fast fractional Fourier transform at the transmitter and fast fractional Fourier transform at the receiver. Our results so far demonstrate that it is possible to employ ML to detect particular sets of FTN signals. The trade-off between the increase in the number of subcarriers and the compression of the intercarrier spacing is captured in the fact that an increasing number of the system Gram matrice's singular values become vanishingly small. I am interested in transferring the lessons learned from this exercise to building similar detection schemes in the presence of high interference levels. The goal will be to investigate the limits of using ML for interference cancellation in partially overlapped transmissions from different users, e.g., due to collisions in mMTC using standard Aloha.

Towards Context Aware Communications in 6G

Finally, in the general context of 6G, understanding of the semantics is expected to become increasingly important. In this aspect, capturing different aspects of PHY signals' properties related to semantic content, e.g., as discussed in Section 5.1, could be envisioned through the use of ML. As a first approach to incorporate "logarithmic" type of memory (e.g., as exists in human languages), I will explore the use of dilated convolutional neural networks (CNNs) that apply recursively fractional weights to deeper layers. Furthermore, the use of generative adversarial networks (GANs) will be explored in the general context of learning the appropriate ML architecture.

Moreover, the opening up of the THz spectrum will provide new "sensing" capabilities to 6G devices, such as high definition imaging and frequency spectroscopy. In combination with decimeter precision localization, as showcased recently for mmWave systems [19], these enhanced sensing capabilities can prove instrumental in understanding context and could naturally be incorporating in trust building and predicting reliability. Enhancements by aggregating inertial movement unit (IMU) calibration, accelerometer readings with simultaneous localization and mapping (SLAM) as already proposed [20] can enhance substantially the positioning accuracy and reliability.

The combination of the above mentioned enhanced sensing and positioning traits of 6G devices and different types of system memory can pave the way towards semantic communications, not accounting exclusively for the literal meaning of the exchanged information (typically at the application layer), but also, for the context in which it was produced, transported and received.

Protecting Secret Key Generation Systems Against

Jamming: Energy Harvesting and Channel Hopping Approaches E. Veronica Belmega, Member, IEEE, and Arsenia Chorti, Member, IEEE Abstract-Jamming attacks represent a critical vulnerability for wireless secret key generation (SKG) systems. In this paper, two counter-jamming approaches are investigated for SKG systems: first, the employment of energy harvesting (EH) at the legitimate nodes to turn part of the jamming power into useful communication power, and, second, the use of channel hopping or power spreading in block fading channels to reduce the impact of jamming. In both cases, the adversarial interaction between the pair of legitimate nodes and the jammer is formulated as a twoplayer zero-sum game and the Nash and Stackelberg equilibria are characterized analytically and in closed form. In particular, in the case of EH receivers, the existence of a critical transmission power for the legitimate nodes allows the full characterization of the game's equilibria and also enables the complete neutralization of the jammer. In the case of channel hopping versus power spreading techniques, it is shown that the jammer's optimal strategy is always power spreading while the legitimate nodes should only use power spreading in the high signal-to-interference ratio (SIR) regime. In the low SIR regime, when avoiding the jammer's interference becomes critical, channel hopping is optimal for the legitimate nodes. Numerical results demonstrate the efficiency of both counter-jamming measures. Index Terms-Secret key generation, jamming, energy harvesting, channel hopping, zero-sum game.

I. INTRODUCTION

S ECRET key generation (SKG) from shared randomness at two remote locations has been extensively studied [3]- [10] and has recently been extended to unauthenticated channels [11], [12]. SKG techniques have also been incorporated in protocols that are resilient to spoofing, tampering and manin-the-middle active attacks [13]. Still, such key generation techniques are not entirely robust against active adversaries, particularly during the advantage distillation phase. Denial of service attacks in the form of jamming are a known vulnerability of SKG systems; in [14] that when increasing the jamming power, the reconciliation rate normalized to the rate of the SKG increases sharply and the SKG process can in essence be brought to a halt. As SKG techniques are currently being considered for applications such as the Internet of things (IoT) [15], the study of appropriate counter-jamming approaches is timely. Typically, jamming in wireless communication systems has been investigated using game theoretic tools [16]- [23]. Contrary to our work, these earlier studies focus on performance metrics that are either based on the legitimate nodes' signalto-interference-plus-noise ratio (SINR) [16]- [21] and do not incorporate physical-layer security constraints at all, or are based on the secrecy capacity [22], [23]. The secrecy capacity is inherently different than the SKG capacity considered in this work; the former measures the maximum rate at which both confidential and reliable communication is possible, while the latter represents the maximum rate at which a common secret key can be extracted from the observation of correlated sequences at two remote locations [24].

In the past, two main counter-jamming approaches have been commonly considered: direct sequence spread spectrum (DSSS) and frequency hopping spread spectrum (FHSS) [25], [26]. In either approach, the impact of power constrained jammers can be limited because their optimal strategy has been proved to be the spreading of their available power over the entire bandwidth (and thus jam with potentially low power). However, DSSS and FHSS systems require a pre-shared secret to establish the spreading sequence or the hopping pattern at Alice and Bob; as such, they are not directly applicable to SKG systems that on the contrary seek to establish a secret key. Attempting to resolve this contradiction and reconcile DSSS and FHSS with SKG, uncoordinated frequency hopping and spreading techniques have recently been investigated in [27] and [28]. The main idea behind the proposed approaches was the randomization of the selection of the hopping/spreading sequences, at the cost of reducing the achievable rates for secret key establishment.

However, in uncoordinated hopping/spreading techniques there are minimum requirements regarding the length of the pseudorandom sequences employed. As a result, accounting for the strict bandwidth specifications of fourth and fifth generation networks, the use of long pseudorandom sequences can be a limiting factor. Thus, investigating different counterjamming approaches based on the use of channel hopping or power spreading over multiple orthogonal subcarriers, e.g., orthogonal frequency division multiplexing (OFDM) 1556-6013 © 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.

See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

systems [16], [18], is timely and offers an interesting alternative to [27] and [28] as in OFDM systems there is no need for coordination of the remote nodes. Furthermore, although in [27] and [28] the numerical investigations focused on the throughput, a Media Access Control (MAC) layer quantity, when analyzing physical layer security SKG systems the standard approach is to utilize the SKG capacity (a physical layer quantity). On a different note, next generation terminals are likely to be enhanced with many new features that could prove pivotal in protecting against jamming. For example, greater energy autonomy exploiting energy harvesting (EH) approaches [29], [30] is being researched for systems such as wireless sensor networks for IoT applications. Thus, it is interesting to investigate whether EH could be utilized as a counterjamming technique by exploiting the harvested jamming power to enhance the quality of the legitimate communication.

Motivated by the above, in the present work we propose two novel approaches for alleviating the impact of jamming in SKG systems. In both approaches, we model the interaction between the legitimate nodes and the adversarial jammer as a two-player zero-sum game in which the SKG capacity plays the role of the utility function. We investigate two noncooperative solutions: the Nash equilibria (NE), when both players make their decision simultaneously and the Stackelberg equilibria (SE), when the legitimate nodes have an advantage and choose their strategy first while anticipating the jammer's response.

In the first part of this contribution, we study systems in which the legitimate nodes are equipped with EH capabilities and examine whether this added functionality is useful in preempting jamming attacks. We focus on time switching EH protocols [30]: for a fraction of time the legitimate nodes operate in EH mode and switch to the SKG procedure for the rest. To the best of our knowledge, this is among the first works to investigate EH as a counter-jamming approach with the exception of [21]. 1Our analysis reveals the existence of a critical power thres-hold p th for the legitimate nodes and of an associated threshold harvesting duration τ th . When the legitimate nodes employ EH for longer than τ th , the attacker's optimal strategy is not to jam at all, i.e., the jammer is effectively neutralized. However, neutralizing the jammer is not a stable solution to unilateral deviations (if the strategic decisions are taken simultaneously) and is therefore not a Nash equilibrium (NE) of the game. At the NE, it is found that both the legitimate nodes and the jammer transmit with full power and that the EH duration does not correspond always to the above threshold. At low signal to interference ratio (SIR) (e.g., relatively low transmit power or high jamming power), the EH optimal duration equals τ th . Although the attacker jams with full power, the power collected from EH cancels out the impact of the attack and the SKG capacity is equivalent to the case of using EH for the same duration in absence of a jammer. At medium to high SIR, the EH optimal duration becomes lower than τ th and decreases until the legitimate nodes do not harvest energy at all. Furthermore, when moving to a hierarchical game formulation, the SE analysis reveals that the legitimate nodes should play the NE strategy. Whenever the legitimate nodes' harvest energy for a duration τ th (at the NE), the jammer neutralization strategy is also a SE solution. This means that, in a hierarchical game, the jammer can potentially be deterred from launching the attack.

In the second part of this investigation, extending the studies in [19] and [21] to SKG systems, counter-jamming policies are investigated for N block fading additive white Gaussian noise (BF AWGN) channels, e.g., systems with N orthogonal subcarriers. At the NE, the jammer always spreads its power over all subcarriers, while for the legitimate nodes the optimality of channel hopping or power spreading depends on the channel parameters. In the high SIR regime, the legitimate nodes should use power spreading to exploit the entire available spectrum given the relatively low jamming interference. On the other hand, at low SIR, the legitimate nodes should use channel hopping and transmit over a single subcarrier to avoid most of the jammer's interference. Furthermore, in characterizing the game's SE we find that the optimal SE strategies reduce to the NE ones, demonstrating that there is no extra payoff to be earned from the advantage of playing first.

Preliminary results of this work have been presented in [1] and [2]. The major contributions and improvements of this journal paper as compared with [1] and [2] consist in: providing complete proofs of all the results regarding the NE analysis and the jammer neutralization state; relaxing the action set of the jammer, in the energy harvesting case, from the discrete choice between remaining silent and transmitting at full power into the continuous interval of all possible power values, which has brought to light the existence of additional NEs; providing the additional analysis of the Stackelberg equilibrium; providing a comparative discussion between the two counter-jamming methods in Sec. V-C.

The paper is organized as follows. In Sec. II, the SKG baseline system model is introduced. In Sec. III, the adversarial interaction between the EH legitimate nodes and the jammer is formulated and analyzed using a zero-sum non-cooperative game framework, while in Sec. IV this setting is used to study channel hopping vs. power spreading in BF AWGN systems. Numerical illustrations and a detailed discussion of these counter-jamming strategies are provided in Sec. V, while the conclusions are given in Sec. VI.

II. SKG SYSTEM MODEL IN THE PRESENCE OF A JAMMER

The baseline SKG system model with two legitimate nodes, denoted by Alice and Bob and a single adversary, denoted by Eve, is depicted in Fig. 1. Typically, the SKG process consists of three phases [4], [6]. In the first phase, referred to as shared randomness distillation, Alice and Bob observe dependent random variables denoted by Y A , Y B while an eavesdropper, referred to as Eve, observes Y E . In wireless channels, a readily available source of shared randomness is the multipath fading due to the reciprocity of the wireless medium during the channel's coherence time [10]. Here, we focus exclusively on shared randomness extraction from Rayleigh fading coefficients.

In the next two phases, known as information reconciliation and privacy amplification, side information V is exchanged between Alice and Bob, generated by corresponding encoders f A , f B . At the end of the SKG process, a common key K ∈ K is extracted at Alice and Bob such that, for any > 0, the following statements hold [8]:

Pr (K = f A (Y A , V ) = f B (Y B , V )) ≥ 1 -, (1)
I (K ; V ) ≤ , (2)
H (K ) ≥ log |K| -, (3)
where H (K ) denotes the entropy of the key K and I (K ; V ) denotes the mutual information between K and V .

The first inequality demonstrates that the SKG process can be made error free; (2) ensures that the exchange of side information through public discussion does not leak any information to eavesdroppers; while (3) establishes that the generated keys attain maximum entropy (i.e., are uniform). Under the three conditions, an upper bound on the rate for the generation of secret keys is given by min [4]. Assuming rich multipath environments, the decorrelation properties of the wireless channel over short distances can be exploited to ensure that Eve's observation Y E is uncorrelated with Y A and Y B [7], [8], [10]; in this case, the SKG capacity is given by [3, Sec. II]

{I (Y A ; Y B ), I (Y A ; Y B |Y E )} [3],
C = I (Y A ; Y B ). (4)
We assume that this holds true in the rest of this study and consider the SKG capacity above to be the focal performance metric. SKG in Rayleigh fading channels has been extensively analyzed, e.g., [7], [8]. In these works, it was assumed that Alice and Bob exchange unit probe signals to excite the fading channel and obtain respective observations Y A and Y B with

Y A = H 0 + Z A , Y B = H 0 + Z B ,
where H 0 denotes the fading coefficient in the link between the legitimate nodes, modeled as a zero mean Gaussian random variable H 0 ∼ N (0, σ 2 H ), and, Z A and Z B model the effect of AWGN and denote independent and identically distributed (i.i.d.) Gaussian random variables Z A ∼ N (0, N A ), Z B ∼ N (0, N B ). Using this notation, the SKG capacity has been expressed as [8]:

C = I (Y A ; Y B ) = 1 2 log 2 ⎛ ⎝ 1 + σ 2 H N A + N B + N A N B σ 2 H ⎞ ⎠ . (5)
In this work, we assume that Eve is no longer a passive eavesdropper but a malicious jammer. To include jamming attacks in the above model, we consider the following extension:

Y A = √ pH 0 + √ γ G A + Z A , (6)
Y B = √ pH 0 + √ γ G B + Z B , (7)
assuming that Alice and Bob exchange constant probe signals [8] with power p ≤ P and that Eve transmits constant jamming signals [14] with power γ ≤ . The fading coefficient in the link between Eve and Alice is denoted by

G A ∼ N 0, σ 2
A and in the link between Eve and Bob by G B ∼ N 0, σ 2 B . For simplicity and without loss of generality, the noise variables Z A and Z B are assumed to have unit variance, i.e., are modeled as i.i.d. Gaussian random variables Z A , Z B ∼ N (0, 1).

Under these assumptions, a simple calculation reveals that the SKG capacity can be expressed as a function of p and γ :

C( p, γ ) = 1 2 log 2 ⎛ ⎜ ⎝1+ σ 2 H p 2 + (σ 2 A + σ 2 B )γ + (1+σ 2 A γ )(1+σ 2 B γ ) σ 2 H p ⎞ ⎟ ⎠. (8)
By inspecting the first-order derivatives of (8), we conclude that C( p, γ ) is a strictly increasing function of p for any fixed γ , and a strictly decreasing function of γ for any fixed p. This implies that the legitimate nodes will transmit at full power P to maximize the SKG capacity, whereas the jammer will also transmit with full power to minimize the SKG capacity. Also, it is a strictly convex function with respect to (w.r.t.) γ for any fixed p > 0 as its second derivative w.r.t. γ is strictly positive.

III. ENERGY HARVESTING AGAINST JAMMING

In order to study EH as a counter-jamming measure, we focus on a time-switching EH scheme [30], i.e., we assume that each transmission interval of duration T is divided in two parts. In the first period of duration τ T (0 < τ ≤ 1 being the fraction of T dedicated to EH), both Alice and Bob operate in EH mode with efficiency 0 < ζ ≤ 1; in the second period of duration (1 -τ )T , the legitimate nodes operate in SKG mode using the overall available power (including harvested power). For simplicity, we assume that the energy harvested can be stored in a battery without any overflowing issues (unlimited storage) [31].

Furthermore, to ease the mathematical derivation and by ensuring symmetry in the energy harvested at Alice and Bob we assume that σ 2 A = σ 2 B = σ 2 (the Eve-Alice and Eve-Bob links have equal variance). Given the above considerations and assuming that the energy harvested by Alice and Bob is linear in the received RF power [30]:

E = ζ τ T γ σ 2 , (9)
the harvested power for each legitimate node per transmission interval can be expressed as

p E H = E (1 -τ )T = κγ , (10)
where κ = ζ τ σ 2 1-τ is a convex increasing function of τ . Thus, the SKG capacity is given by:

ũ( p, τ, γ ) = 1 -τ 2 log 2 ⎛ ⎜ ⎜ ⎝ 1 + p 1-τ + κγ σ 2 H 2(1 + σ 2 γ ) + (1+σ 2 γ ) 2 p 1-τ +κγ σ 2 H ⎞ ⎟ ⎟ ⎠ , (11)
with power constraints p ≤ P, γ ≤ . A simple inspection of (11) reveals that this scenario is a generalization of the standard SKG setting. Indeed, if the legitimate nodes decide not to harvest energy, i.e., τ = 0, ( 8) is obtained for

σ 2 A = σ 2 B = σ 2 , N A = N B = 1.
In the model with EH, the legitimate nodes can maximize ũ by tuning the additional variable τ . However, it is no longer straightforward that the jammer should transmit with the maximum available power as ũ( p, γ, τ ) is no longer monotonically decreasing in γ .

Non-cooperative game theory provides the natural framework to study the adversarial interaction between the legitimate nodes and the jammer. Although game theory has already been exploited in physical layer security problems, e.g. [22], [23], to the best of our knowledge, this work is among the first to investigate EH as an effective means to counteract on jamming attacks.

A. Jammer Neutralization

Before introducing the game framework, we make two important observations regarding the SKG utility in (11) and discuss their implications.

Remark 1: For any fixed τ and γ , ũ( p, τ, γ ) is monotonically increasing in p and arg max

p∈[0,P] ũ( p, τ, γ ) = P. ( 12
)
Remark 2: For any fixed p and τ , ũ( p, τ, γ ) is monotone in γ . In particular, it is monotonically decreasing in γ if p > p th (τ ) ζ τ , a constant if p = p th (τ ), and monotonically increasing if p < p th (τ ). This implies that:

arg min γ ∈[0, ] ũ ( p, τ, γ ) = 0, if p < p th (τ ) (13)
arg min

γ ∈[0, ] ũ ( p, τ, γ ) ∈ [0, ], if p = p th (τ ) (14) arg min γ ∈[0, ] ũ ( p, τ, γ ) = , if p > p th (τ ). (15)
Remark 1 shows that, to maximize the utility, the legitimate nodes should transmit at maximum power P. On the contrary, Remark 2 shows that the jammer should practically switch in between staying silent, i.e., γ = 0, and jamming at full power, i.e., γ = , depending on the choice ( p, τ ) of the legitimate nodes.

Remark 2 reveals that the legitimate nodes can neutralize the jammer by transmitting at a relatively low power p < p th (τ ). Although this result may seem counter-intuitive at first, this condition is equivalent to τ > τ th ( p) p ζ , which means that the legitimate nodes spend a relatively large proportion of time harvesting the jamming interference before actually transmitting. In other words, the jammer is forced to stay silent since the harm it can cause by interfering in the SKG phase is overcome by the harvested energy in the EH phase. This novel result shows that the jamming interference, which is commonly thought as being harmful to the legitimate communication, can be exploited and transformed into useful power via EH. If Alice and Bob transmit with exactly p th (τ ), the jammer becomes indifferent between all its choices γ ∈ [0, ] and has no interest in actively jamming the transmission.

The necessary conditions for the jammer neutralization are formalized below.

Proposition 1: The optimal strategy for the legitimate nodes that maximizes the SKG utility while ensuring that the jammer has no interest in actively jamming the transmission is given by: p N J = min {P, p th (τ * )} and τ N J = min {τ th (P), τ * }, (16) where τ * ∈ (0, 1) is the unique maximizer of ũ( p th (τ ), τ, 0) w.r.t. τ .

For the detailed proof the reader is referred to Appendix VI-A. Notice that, if the jammer stays silent γ = 0, there is no actual energy harvested during the EH phase of duration τ N J . Rather, the legitimate nodes' choice to use EH for a fraction of time τ N J acts as an effective threat to ensure the jammer has no interest in actively jamming the transmission. However, neutralizing the jammer may not be the overall optimal strategy for the legitimate nodes. A hint for this is that whenever τ N J = τ * < τ th (P), the transmit power is p N J < P, which we know is not optimal from Remark 1.

B. Game Formulation and Nash Equilibria

The interaction between the legitimate nodes and the jammer is formalized as a two-player zero-sum game, defined as the tuple G = { ÃL , ÃJ , ũ ( p, τ, γ )} in which the players are: player L representing the legitimate nodes (Alice and Bob act as a single player) on one side, and player J, the jammer, on the other. The action ( p, τ ) of player L lies in the set ÃL = [0, P] × [0, 1], and the action γ of player J lies in the set ÃJ = [0, ]. The objective of player L is to maximize the SKG utility ũ( p, τ, γ ) given in (11), whereas player J aims at minimizing it.

The two players are adversaries and the optimal strategy of one player depends on the choice of their opponent and cannot be determined unilaterally. In such interactive situations, the NE [32] is the natural solution concept. Intuitively, a profile ( p N E , τ N E , γ N E ) ∈ ÃL × ÃJ is a NE if none of the players can benefit by deviating from this profile knowing that their opponent plays accordingly. Hence, NEs are system states that are stable to unilateral deviations.

We can easily check that the state ( p N J , τ N J , 0) is not a NE since the legitimate nodes gain by deviating from it. Knowing that the jammer stays silent, player L can increase the SKG utility by deviating to τ = 0. Using the whole duration T in SKG mode increases the utility when no energy is harvested in the EH phase. This, in turn, will cause also the jammer to deviate from γ = 0 and actively jam the transmission.

Theorem 1 shows that the game G has at least one NE at which both players transmit with maximum power. This NE may be unique or not, depending on the system parameters.

Theorem 1: The game G has at least one NE. Moreover, the profile (P, τ N E , ) is a NE solution such that the EH strategy is either τ N E = 0 or τ N E = min{τ th (P), τ max } with τ th (P) = P ζ and τ max ∈ (0, 1) representing the critical maximum point of ũ(P, τ, ) w.r.t. τ , depending on the system parameters. If τ N E < τ th (P), then the profile (P, τ N E , ) is the unique NE of the game almost surely.

The proof is detailed in Appendix VI-B. We observe that, at the NE above (P, τ N E , ) and depending on the system parameters, player L may harvest energy for a fraction of time τ N E ≤ τ N J or not at all τ N E = 0. Intuitively, not using the SKG mode for the entire transmission symbol (for example to neutralize the jammer) becomes too costly at high SIR when the jamming interference is relatively low or negligible.

Concerning the uniqueness of the NE, the only case in which the states (P, 0, ) and (P, min{τ max , τ th }, ) can both be NEs is when the provided utilities are identical, i.e., ũ(P, 0, ) = ũ(P, min{τ max , τ th (P)}, ) in addition to the constraint on the system parameters 1 + σ 2 ≥ √ 2σ 2 H P (see Appendix VI-B). However, we argue that such an equality condition on the system parameters can only happen in very special cases, otherwise stated, with zero probability (on a continuous sample space).

Furthermore, whenever player L chooses a strategy of the form (P, τ th (P)) at the NE, the jammer becomes indifferent between all their possible transmit powers in [0, ] (as per Remark 2). Hence, in such cases, the strategy profile (P, τ th (P), ) may not be the unique NE.

Theorem 2: If the legitimate nodes' NE strategy in Theorem 1 is such that τ N E = τ th (P), the game G may have other solutions of the form (P, τ th (P), γ N E ) with γ N E ∈ (0, ). More precisely, any strategy of the form (P, τ th (P), γ N E ) with γ N E ∈ (0, ) meeting the additional condition arg max τ ∈[0,1] ũ(P, τ, γ N E ) = τ th (P) is also a NE of the game. All such NEs provide identical utility to ũ(P, τ th (P), ).

The proof and the detailed system conditions under which the game may have other NEs of the type (P, τ th (P), γ N E ) with γ N E ∈ (0, ) aside from (P, τ th (P), ) is provided in Appendix VI-B. These NEs may exist with non-zero proba-bility since the additional condition depends on the variable γ N E ∈ (0, ) and not only on the system para-meters, as opposed to the condition entailing that (P, 0, ) and (P, min{τ max , τ th }, ) are both NEs. It suffices that arg max τ ∈[0,1] ũ(P, τ, γ N E ) = τ th (P) holds for a single value of γ N E ∈ (0, ) to entail the existence of such NEs.

Apart from providing a complete NE analysis, the existence of the NEs in Theorem 2 is not very relevant in practice. First, whenever they exist, the utility at such NEs is identical to the utility of the NE profile: (P, τ th (P), ) in Theorem 1. Second, given Remark 2, the jammer can be assumed to restrict their strategy space from [0, ] to the discrete choices {0, } with no loss of optimality. Assuming ÃJ = {0, }, the resulting game G has a unique pure-strategy NE (almost surely) which is given in Theorem 1.

As a last result, it turns out that neutralizing the jammer (NJ) in Proposition 1 incurs a non-trivial cost and the obtained utility is lower or equal to the NE utility.

Proposition 2: The SKG utility obtained when neutralizing the jammer (NJ) can never be greater that the utility at the NE. Both utilities are equal, if and only if τ N E = τ th (P).

Proof: Since (P, τ N E ) = arg max p,τ ũ( p, τ, ), from the NE's best-response property, we have that ũ( p N J , τ N J , ) ≤ ũ(P, τ N E , ). From Remark 2, we have that ũ( p N J , τ N J , ) = ũ( p N J , τ N J , 0) (the jammer is indifferent between all its choices) and we obtain that ũ(P, τ N E , ) ≥ ũ( p N J , τ N J , 0). Intuitively, when searching for the NJ state in Proposition 1 the additional condition that the jammer has to be neutralized (i.e., p = p th (τ )) restricts the feasible set of all pairs ( p, τ ) which results in an optimality loss compared to the NE. Notice that max τ ũ( p th (τ ), τ, 0) ≡ max τ ũ( p th (τ ), τ, ). This further implies that, if τ N E = τ th (P), the aforementioned restriction is optimal and ( p N J , τ N J ) = (P, τ N E ) which proves the direct implication of the second claim. The hypothesis of the reverse implication: ũ( p N J , τ N J , 0) = ũ(P, τ N E , ) implies that τ N E = τ th (P) and, thus, ũ( p N J , τ N J , 0) = ũ(P, τ N E , 0). From Appendix VI-A, the function ũ( p th (τ ), τ, 0) has a unique maximizer w.r.t τ ∈ [0, τ th (P)] given by τ N J which results in that ( p N J , τ N J ) = (P, τ N E ).

C. Stackelberg Equilibrium

After investigating the NE solution of the strategic interaction in which the legitimate nodes and the jammer choose their optimal strategies simultaneously, a natural rising issue is whether the solution of the game changes assuming a hierarchy in the players' choices [20], [22], [32]. To tackle this issue, we study the SE and compare it to the NE and the jammer neutralization (NJ) states in Sec. III-B and III-A, respectively. We assume that the leader of the game L is playing first by choosing their best action ( p S E , τ S E ) while anticipating the response of player J. The follower, player J, observes the choice of the leader and reacts optimally (or best-responds) by choosing γ S E .

To be specific, for an arbitrary choice of player L ( p, τ ), the best-response of the jammer is defined as:

γ B R ( p, τ ) = arg min γ ∈[0, ] ũ( p, τ, γ ). ( 17
)
The leader, anticipating the jammer's reaction described above, can choose their optimal strategy as follows

( p S E , τ S E ) = arg max p,τ ũ( p, τ, γ B R ( p, τ )). ( 18
)
The optimal strategy of the jammer is the best response γ S E = γ B R ( p S E , τ S E ) given the optimal leader's strategy above. The solution is described in the next Theorem. Theorem 3: Assuming the hierarchy described above, if τ N E < τ th (P) where τ N E is given in Theorem 1, the SE of the game G is unique (almost surely) and identical to the NE (P, τ N E , ). Otherwise, if τ N E = τ th (P), both the NJ state in Proposition 1 and the NE (P, τ N E , ) are SE solutions providing identical SKG utility.

The proof is included in Appendix VI-C. Notice that in all possible cases τ N E ≤ τ th (P) (see Theorem 1). The above result shows that neutralizing the jammer is a rational solution when the strategic decisions are not taken simultaneously and the legitimate nodes play first. However, since the NJ state cannot provide a strictly better utility than the NE state (see Proposition 2), the hierarchical play does not bring an actual benefit to player L when compared with the NE.

Finally, we note that as opposed to the NE, the SE requires the leader to be able to anticipate precisely the response of the follower. For this reason, the leader cannot actually choose a strategy such that p = p th (τ ) which renders the follower indifferent between all its actions γ ∈ [0, ] (and may choose any jamming power in an unpredictable way). A simple way to overcome this issue is for the leader to transmit at p = p th (τ ) -ε whenever it wants to silence the jammer (at the NJ), and to transmit at p = p th (τ ) + ε whenever it wants the jammer to transmit at full power (at the NE), with ε > 0 and ε 1 chosen arbitrarily small, with little or no practical impact. Furthermore, this also the excludes other SE solutions (e.g., the NEs in Theorem 2 cannot be SEs).

IV. CHANNEL HOPPING VS. POWER SPREADING

IN BF AWGN CHANNELS If the legitimate nodes do not have EH capabilities, we investigate yet another way to defend against jamming by assuming that the legitimate nodes can employ channel hopping or power spreading strategies over multiple orthogonal subcarriers. For this, we generalize the system model ( 6) and ( 7) to an N-BF AWGN channel. Alice's and Bob's observations on the i -th subcarrier -denoted by ŶA,i and ŶB,i respectively -are expressed as:

ŶA,i = √ p i H i + √ γ i G A,i + Z A,i , (19)
ŶB,i = √ p i H i + √ γ i G B,i + Z B,i , (20)
where the fading coefficient in the link between Alice and Bob on the i -th subcarrier is denoted by H i , in the link between Eve and Alice by G A,i and in the link between Eve and Bob by G B,i . We assume that the fading coefficients are i.i.d.

Gaussian random variables with

H i ∼ N 0, σ 2 H , G A,i ∼ N 0, σ 2 A and G B,i ∼ N 0, σ 2 B .
Notice that the fading coefficients are assumed to have the same statistics. This assumption is justified, since, broadly speaking, narrowband fading depends on the bandwidth (which is the same for all subcarriers) and not on the central frequency (unlike wideband fading or large scale fading) [33]. Furthermore, the noise variables Z A,i and Z B,i are assumed to be i.i.d. Gaussian zero mean unit variance random variables. Finally, Alice and Bob exchange constant probe signals [8] with power p i and that Eve transmits constant jamming signals [14] with power γ i on the i -th subcarrier so that the following average power constraints are satisfied2 [16], [18]:

1 N N i=1 p i ≤ P, 1 N N i=1 γ i ≤ . ( 21
)
Given the above model, an easy calculation reveals that the SKG capacity over the i -th subcarrier can be expressed as a function of p i and γ i as:

C( p i , γ i ) = I ( ŶA,i ; ŶB,i ) = 1 2 log 2 ⎛ ⎝ 1 + σ 2 H p i N A,i + N B,i + N A,i N B,i σ 2 H p i ⎞ ⎠ ,
with

N A,i = 1 + σ 2 A γ i , N B,i = 1 + σ 2 B γ i . ( 22
)
In order to evaluate the overall SKG capacity, we formalize the channel hopping vs. power spreading techniques similarly to [16] and [18]. When channel hopping is employed, all of the available power is used to transmit on a single randomly chosen subcarrier i . Therefore, when the legitimate nodes employ channel hopping on subcarrier i , then p i = N P and p k = 0 for k = i , while when the jammer hops on subcarrier i then γ i = N and γ k = 0, k = i . On the other hand, when power spreading is used, the available power is equally distributed across all subcarriers so that p i = P and γ i = ∀i ≤ N.

When transmitting over the entire spectrum, the choice of the uniform power allocation is motivated by the fact that the nodes do not know their actual channel gains and that their statistics are identical across all frequency carriers. Moreover, assuming that player L transmits with uniform power allocation and from the convexity of the SKG function in (22) w.r.t. γ i , it turns out that the uniform power allocation for the jammer is optimal and minimizes the overall SKG utility. More general power allocation policies can be considered in future investigations.

From an implementation point of view for the proposed channel hopping and power spreading strategies, we consider that an OFDM transmitter with a standard inverse fast Fourier transform (IFFT) block is employed. In channel hopping mode, all but a randomly chosen IFFT input are set to zero. No coordination regarding the chosen channel hopping or spreading options is required between transmitting and receiving terminals. This is possible if wideband reception is employed by all parties, allowing transmitting terminals to independently choose their strategies without coordination with the receiving terminals. Such a wideband reception of the N orthogonal subcarriers can be efficiently implemented using a standard FFT based OFDM receiver.

Using this framework in the following, for Alice and Bob the probability of channel hopping on subcarrier i is denoted by α i ∀i ≤ N, while α N+1 denotes the probability of spreading the available power uniformly over the whole spectrum. Similarly, we define β i for the jammer. Since α = [α 1 , . . . , α N+1 ] and β = [β 1 , . . . , β N+1 ] are discrete probability distributions, we have the constraints α j ≥ 0, ∀ j , N+1 i=1 α i = 1, β j ≥ 0, ∀ j , and N+1 i=1 β i = 1. Given the above, the SKG capacity over the N orthogonal subcarriers is given by:

û(α, β) = 1 N N i=1 {α i (1 -β i -β N+1 )C(N P, 0) + α i β i C(N P, N ) + α i β N+1 C(N P, ) + α N+1 β i [(N -1)C(P, 0) + C(P, N )]} + α N+1 β N+1 NC(P, ) , (23)
where the normalization 1 N accounts for measuring the SKG capacity in bits/s/Hz. In (23), the first term corresponds to the case in which Alice (resp. Bob) hops on subcarrier i and the jammer hops on a different subcarrier; the second term to the case in which Alice (resp. Bob) and the jammer both hop on subcarrier i ; the third term to the case in which Alice (resp. Bob) hops on subcarrier i and the jammer spreads; the fourth term to the case in which the Alice (resp. Bob) spreads and the jammer hops on subcarrier i . Finally, the last term corresponds to the case in which they both spread their power.

A. Game Formulation and Nash Equilibria

We model the competitive interaction between player L and J as the following zero-sum game Ĝ = { ÂL , ÂJ , û(α, β)}, where the payoff û(α, β) is given in (23). The action sets of the players are the probabilities of channel hopping and power spreading:

ÂL = α ∈ [0, 1] N+1 N+1 i=1 α i = 1 , ÂJ = β ∈ [0, 1] N+1 N+1 i=1 β i = 1 .
As we have argued in the previous section, the natural solution in such a strategic interaction without cooperation among the opponents is the NE.

To derive the game's NE, let us introduce a finite discrete game Ĝ D = { ÊL , ÊJ , û(α, β)} with action sets defined as ÊL ≡ ÊJ = {e 1 , . . . , e N , e (N+1) }, where e i ∈ {0, 1} N+1 is the canonical vector containing 1 on the i -th position and 0 otherwise. The i -th action e i represents channel hopping on subcarrier i for all i ≤ N and e N+1 represents spreading the power across the spectrum. Such finite discrete games always have at least one NE in mixed strategy (α * , β * ) [32,Sec. 1.3.1]. We observe that our game Ĝ represents the mixed strategy extension of Ĝ D and thus Ĝ has at least one NE.

Corollary 1 [32,Th. 1.1]: Game Ĝ has at least one NE.

To compute the NEs, one possibility is to use the Minimax Theorem of von Neumann and Morgenstern [34] which allows us to compute mixed NEs of any two-player zero-sum game via linear programming (i.e., by solving two dual linear optimization problems). In our case, we show that the NEs can be characterized in an analytical closed-form manner without the need of solving any optimization problem. To this aim, an alternative characterization of the NE (see Definition

û(α * , e i ) < û(α * , e k ), i ∈ I J , then k ∈ N J , if û(e i , β * ) > û(e k , β * ), i ∈ I L , then k ∈ N L ,
where the sets N L , I L ⊆ {1, . . . , N + 1} denote, respectively, the indices of the pure actions that are not played at the NE and those that are played at the NE by player L: N L = {i |α * i = 0}, I L = {1, . . . , N + 1} \ N L ; similarly, the sets N J , I J ⊆ {1, . . . , N + 1} denote, respectively, the set of indices of the pure actions that are not used or are used by player J at the NE: N J = {i |β * i = 0}, and I J = {1, . . . , N + 1} \ N J . At a first glance, Definition 1 provides a simple way to compute the NEs of the game Ĝ by solving a system of linear equations and checking some conditions. Still, in order to use Definition 1, one would have to know in advance the faces of the simplex ÂL × ÂJ on which the NEs lie, i.e., one would have to know I L , I J for all NEs. An exhaustive search has an exponential complexity (the N + 1-simplex has 2 N+1 -1 faces). Nevertheless, the NEs of our game Ĝ have a special structure which allows us to exploit Definition 1 and fully characterize the set of NEs in a simple manner.

To characterize the set of NEs as a function of the system's parameters we begin by examining the matrix structure of the discrete game Ĝ D given in Table I. We notice that there is a symmetry between the channel hopping strategies. In particular, the payoff does not depend on the particular index of the chosen subcarrier but only on whether both players hop on the same subcarrier or not. This symmetry allows us to show that the NE of the game Ĝ have a particular structure specified in the following propositions.

⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ 0 ≤ α i ≤ 1, ∀i ≤ N, N j =1 α j = 1, α i < C(N P, 0) -C(N P, ) C(N P, 0) -C(N P, N ) , ∀i ≤ N.
In particular, the uniform probability over the channels is one of the NE solutions: α * = (1/N, . . . , 1/N, 0). All NEs are equivalent in terms of achieved utility.

If C(N P, ) = NC(P, ), player L employs all

their actions and player J spreads at the NE: α * = (α 1 , . . . , α N , α N+1 ) and β * = e N+1 . The NE strategies of player L are the (infinite number of) solutions to the following linear system of inequalities:

⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ α i ≥ 0, ∀i ≤ N, N j =1 α j = 1, α i [C(N P, N ) -C(N P, 0)] + α N+1 [(N -1)C(P, 0) +C(P, N ) -C(N P, 0) + C(N P, ) -NC(P, )] > C(N P, ) -C(N P, 0), ∀i ≤ N.
In this case, both players spreading (case 1) is an NE. Also, player J spreading and player L hopping strategies (case 2) are all NEs. All NEs are equivalent in terms of achieved utility. The proof is provided in Appendix VI-F. We remark that the NE can be unique and in pure strategies if C(N P, ) < NC (P, ) and the outcome of the game provides a utility equal to û(α * , β * ) = C(P, ). On the contrary, if C(N P, ) ≥ NC (P, ), there are an infinite number of NEs which are generally in mixed strategies. All these NEs are equivalent in terms of achieved utility, which equals û(α * , β * ) = 1 N C(N P, ). Hence, the outcome of the game can be predicted without the need for implementing iterative or learning procedures.

Theorem 4 also shows that the optimal strategy for the jammer is always spreading their power across the entire spectrum. Intuitively, if the jammer were to use channel hopping, player L would exploit this fact and would also hop; this scenario is unfavorable for the jammer as the probability that both players hop on the same subcarrier equals 1 N 2 (due to Proposition 3, when both players hop at the NE, they use uniform probabilities). Thus, the jammer's payoff from hopping cannot exceed that gained from spreading, assuming that the legitimate nodes play their optimal strategy. On the contrary, for player L the best strategy can be either channel hopping or power spreading depending on which option provides higher utility against a spreading jammer.

B. Stackelberg Equilibrium

In Sec. III-C, we have shown that the hierarchy of play among the adversaries does not bring an advantage to the legitimate nodes assuming they have EH capabilities. Here, we investigate whether this remains true in N-BF AWGN systems in which the players choose between channel hopping and power spreading strategies. The leader, player L, is assumed to play first and to choose α S E anticipating the jammer's response. The follower, player J, observes α S E and bestresponds by choosing β S E .

More precisely, the best-response of the jammer for an arbitrary choice of α is defined as: β B R (α) = arg min β û(α, β). Thus, the leader chooses their optimal strategy as follows

α S E = arg max α û(α, β B R (α)) (24)
and the resulting best-response or SE strategy of the jammer is

β S E = β B R (α S E ).
To characterize the SE in closed-form, we use a similar approach as for the NE: we show first that the leader's strategy at the SE has a special form described below. Then, we exploit this structure to provide the SE solution.

Proposition 5: At the SE, the legitimate player uses either all hopping strategies with uniform probability or none of them, i.e., α S E = (a, . . . , a, 1 -Na) for some a ∈ [0, 1/N].

The proof is provided in Appendix VI-G. The above structure of α S E allows us to analyze the optimal response of the jammer β S E and to prove that, in all cases, the jammer's best strategy is to spread: β S E = (0, . . . , 0, 1). On the other hand, depending on the channel parameters, the leader will either channel hop or spread their power, identically to the NE.

Theorem 5: The set of SEs of the game Ĝ is identical to the set of NEs.

The proof is provided in Appendix VI-H. Therefore, the legitimate nodes do not gain in utility by choosing first their strategy as opposed to the NE where both players choose their strategies simultaneously.

V. NUMERICAL ILLUSTRATIONS AND DISCUSSION

In this Section, several representative illustrations are chosen allowing the deduction of generic conclusions that carry over most setups. The benchmark setting is chosen as follows: unit jamming power = 1, unit variance Rayleigh channel coefficients

σ 2 A = σ 2 B = σ 2 = σ 2 H = 1.

A. EH at the Legitimate Nodes

We start by evaluating the SKG capacity at the NJ in Proposition 1 and NE in Theorem 1 as functions of the system parameters for a harvesting efficiency ζ = 0.7. In Fig. 2, the relative gain in utility obtained at the NE (C N E = ũ(P, τ N E , )) compared with the NJ (C N J = ũ( p N J , τ N J , 0)) defined by

E C N E -C N J C N E
, is depicted as a function of the signal to interference ratio (SIR) P/ for different values of σ 2 and σ 2 H . In the investigated settings, the NJ strategy never outperforms the NE in terms of utility, which is consistent with Proposition 2. When the SIR P/ is relatively low, both the NE and the NJ provide identical utilities. In this case, p N J = P and τ N J = τ N E = τ th (P), the jammer is indifferent between {0, } and both states are SE solutions. With increasing SIR P/ , it is no longer optimal for the legitimate nodes to harvest energy for a fraction of time τ th (P) in order to neutralize the jammer. Instead, by limiting the duration of EH to τ N E = τ max < τ th (P) the SKG capacity increases in spite of the full power jamming γ = and only the NE is also a SE solution. Moreover, as the SIR increases, e.g., for P/ 1, the legitimate nodes should not harvest energy at all as the jammer's interference is relatively negligible.

Notice that Fig. 2 also illustrates the SE solution described in Theorem 3. Indeed, at low SIR, when both NE and NJ provide equal SKG capacity, they are both SE solutions. At high SIR, the SE is unique and identical to the NE. Subsequently, we evaluate the impact of the EH capability on the SKG capacity at the NE. The relative gain in utility obtained at the NE compared with the case in which there is no EH capability C NoE H = ũ(P, 0, ) = C(P, ), defined as

F C N E -C NoE H C N E
, is depicted as a function of P/ in Fig. 3. The benchmark setup is considered and the different curves correspond to harvesting efficiencies ζ ∈ {0.1, 0.3, 0.5, 0.7, 0.9}. At low SIR, F decreases with the harvesting efficiency ζ . Although counter-intuitive, this is explained by the fact that, at the NE, the harvesting period τ N E = τ th (P) = P/ζ decreases in ζ in this regime. The peaks represent the transition points to the second regime, in which harvesting energy at the threshold is no longer optimal and τ N E = τ max < τ th (P). Also, as the SIR increases, the curves progressively switch ranks and F becomes increasing in ζ as expected. For P/ = 1 and ζ = 0.3 the gain in using EH is around 30 % while it increases to 40 % for ζ = 0.7. At low SIR P/ the gain observed can reach 90 %, while at the high SIR it is negligible: in the third regime τ N E = 0, as harvesting energy becomes time-consuming and inefficient in terms of SKG capacity. Finally, the relative utility F defined above is depicted in Fig. 4 for ζ = 0.7 and various channel parameters. For low SIR P/ , there is a significant gain in utility when employing EH. This gain becomes significantly large at very low SIR, exceeding 97.5 % when the legitimate nodes experience poor channel conditions as opposed to the jammer. When both parties experience similar channel conditions the gain is in the range of 60 % in the medium SIR. Overall, the numerical results demonstrate that using EH as a counter-jamming technique is of particular interest in the low and medium SIR regimes but, as expected, does not increase the utility in the high SIR. The peaks represent here as well the transition from the τ N E = τ th (P) regime (at low SIR) to the second regime in which τ N E = τ max < τ th (P).

B. Channel Hopping vs. Power Spreading

First, we analyze the NE as function of N and the ratio P/ for the benchmark scenario in Fig. 5. There exist two regions delimited by the curve C(N P, ) = NC(P, ): a region in which the NE is unique and both players spread their power, and a region in which the jammer spreads their power and the legitimate nodes employ channel hopping.

Player L hops at the NE below the curve, when the SIR P/ is relatively small. This is intuitive since, in the low transmit power regime, the legitimate nodes should avoid as much jamming interference as possible by transmitting on a single subcarrier, which also means that their available power is concentrated on a single channel. In Fig. 6, the NE regions are illustrated for different channel parameters. When σ 2 H increases, the region in which player L should employ channel hopping at the NE shrinks down while when σ 2 A , σ 2 B increase, this region expands. In Fig. 7, the relative gain obtained by player L when employing the NE strategy as opposed to a naive hopping strategy is depicted. The relative utility gain D H = (u N Eu Hop,Spread )/u N E , where u Hop,Spread = 1/NC(N P, ) is relatively large (up to 80%) in the high SIR regime, in which case the optimal strategy for player L is to use the entire spectrum in spite of the jammer's interference.

Finally, in Fig. 8, the relative utility gain when using the NE strategy over N subcarriers as opposed to a single subcarrier (u single = C(P, )) is investigated for

= σ 2 H = σ 2 A = σ 2
B = 1 as a function of P/ for N ∈ {2, 4, 8, 16, 32, 64}. At low SIR, when the channel hopping strategy is optimal for the legitimate nodes, the higher the number of subcarriers N, the lower the jammer's interference in each subcarrier, and hence, the higher the SKG capacity. At last, in the high SIR regime, when spreading is optimal the SKG utility becomes C(P, ), which is identical to transmitting over a single channel with powers P and .

Remark that all figures illustrating the NE, in this subsection, also illustrate the SE solution, since the SE is identical to the NE as per Theorem 5.

C. Discussion and Perspectives

We discuss here the differences and similarities between the two approaches: a) EH at the legitimate nodes, and b) employing channel hopping or power spreading techniques.

EH at the legitimate nodes enables them to completely neutralize the jammer. By harvesting the jamming power in a first phase and exploiting it for SKG in a second phase, the jammer's attacks may increase the SKG capacity; in this case, the jammer should not launch the attack, i.e., it is neutralized. However, it is not always optimal for the legitimate nodes to neutralize the jammer. Indeed, using EH can reduce the SKG capacity since, for a non-trivial fraction of time, there is no secret bits generation; when the jammer is neutralized the Fig. 8. Relative utility gain between the NE vs. single channel SKG: 4, 8, 16, 32, 64}. penalty in terms of utility might become too high, depending on the system parameters (e.g., high SIR regime). In such cases, the obtained utility at the NE is strictly higher than the one at the NJ state.

D 1 = (u N E -u single )/u N E as a function of P/ for = σ 2 H = σ 2 A = σ 2 B = 1 and N ∈ {2,
On the other hand, in the case of BF AWGN channels (i.e., in systems with multiple orthogonal subcarriers), the idea is to use channel hopping in a random fashion and avoid most of the jammer's interference as opposed to completely neutralizing it. Since potential jammers cannot predict the subcarrier used by the legitimate nodes, they will always spread their powers over the entire spectrum: the larger the number of subcarriers, the smaller the jammer's interference on each subcarrier. However, channel hopping is not always optimal since only a fraction of the entire spectrum is used for SKG. Depending on the system parameters (high SIR), it can be preferable for the legitimate nodes to spread the available power across the entire spectrum rather than concentrate it on a single subcarrier. In this case, the SKG capacity (measured in bits/s/Hz) is identical to that of single channel with the same average power constraints.

In the critical cases of low and medium SIR regimes (P/ < 1), both approaches turn out to be advantageous in terms of SKG capacity compared to a single channel SKG system without EH capabilities; the gains in SKG capacity depend on the harvesting duration or the number of subcarriers N. On the contrary, in the high SIR regime (P/ 1), the jammer's impact and interference become relatively low or even negligible and the cost of counter-jamming measures might not be justified compared to simply tolerating it. However, the interesting cases are indeed the former ones in which the jamming power is higher or of the same order as the legitimate nodes' transmit powers, in which overcoming the attack becomes critical.

For both approaches it turns out that a hierarchical decision model that in principle could favor the legitimate nodes compared to a simultaneous decision model does not bring an actual benefit. Indeed, the SKG utility obtained at the SE is identical to the SKG utility at the NE (even though the set of SEs is not necessarily identical to the set of NEs as in the EH approach).

Several questions arise for future work. First, an interesting issue would be to study reactive vs. proactive jamming [35] as well as the joint use of EH and multi-carrier transmission against jamming attacks. Second, in the EH case, the study of more realistic models accounting for finite storage capabilities, asymmetries in the legitimate nodes' parameters and EH at the jammer side, are interesting future extensions. Moreover, the study of multi-user and multi-jammer interactions as well as games of incomplete information are challenging open issues.

VI. CONCLUSIONS

In this work, the adversarial interaction between a pair of legitimate nodes and a malicious jammer in a wireless secret key generation (SKG) framework was investigated. Two different counter-jamming approaches were proposed and studied. First, energy harvesting at the legitimate nodes, and, second, channel hopping vs. power spreading in block fading AWGN channels. In either approach, a zero-sum game was introduced as the objectives of the two parties involved were opposed. Complete characterizations of the Nash and Stackelberg equilibria in closed-form were provided in both cases. It was demonstrated that either approach may offer significant gains in utility, particularly in the low signal-tointerference ratio regime, in which counteracting the jamming interference becomes crucial. As a result, viable and low complexity alternatives for defending SKG systems may be developed by exploiting either novel transceiver features or available spectral resources.

APPENDIX

A. Proof of Proposition 1

Let us assume that the legitimate nodes neutralize the jammer by transmitting at power p ∈ [0, min{ p th (τ ), P}]. The jammer observes player L's choice and from Remark 2, decides to stay silent. Notice that player L can force the jammer to remain silent by transmitting at p ∈ [0, min{ p th (τ )ε, P}] for an arbitrarily small ε > 0. For simplicity, ε 0 is assumed in the following.

The remaining question is: how will player L choose τ ∈ [0, 1) and p ∈ [0, min{ p th (τ ), P}] to maximize the resulting SKG utility

ũ( p, τ, 0) = 1 -τ 2 log 2 ⎛ ⎝ 1 + pσ 2 H 2(1 -τ ) + (1-τ ) 2 pσ 2 H ⎞ ⎠ , ( 25
)
while ensuring that the jammer stays silent and cannot decrease the utility by transmitting with non-zero power? Since the feasible set of p depends on τ , we first have to find the maximum of ũ( p, τ, 0) w.r.t. p for any fixed τ . The function ũ( p, τ, 0) is strictly increasing in p and, hence, the optimal power is given by p(τ ) = min{P, p th (τ )}. Now, we need to maximize ũ( p(τ ), τ, 0) w.r.t. τ ∈ [0, 1]:

ũ( p th (τ ), τ, 0) = 1 -τ 2 log 2 ⎛ ⎝ 1 + ζ τ σ 2 H (2 + 1-τ ζ τ σ 2 H )(1 -τ ) ⎞ ⎠ .
At the extremes τ = 0 and τ → 1 the utility goes to zero. By investigating its second order derivatives w.r.t. τ , which amounts to the following quadratic equation:

(1 -τ ) 2 -2σ 4 H ζ 2 τ 2 = 0, (26)
it can be shown that ũ( p th (τ ), τ, 0) always has an inflexion point in between (0, 1) and starts as convex and then becomes concave. Knowing that the the utility is always positive, we can conclude that ũ( p th (τ ), τ, 0) has a unique critical point that is the global maximizer τ * ∈ (0, 1) and which is the solution to d ũ( p th (τ ),τ,0) dτ = 0. This implies that, if p th (τ * ) ≤ P, then the optimal solution that neutralizes the jammer is τ N J = τ * and p N J = p th (τ * ). If p th (τ * ) > P (or equivalently τ * > τ th (P)), then the optimal solution that neutralizes the jammer is p N J = P and τ N J = τ th (P) = P ζ .

B. Proof of Theorem 1 and Theorem 2

From Remark 1, we know that transmitting at maximum power is a strictly dominant strategy for player L and, hence, p N E = P. We first prove that at the NE, player L will not operate in EH mode for longer than the threshold τ th (P). Let's suppose by absurdum that τ N E > τ th (P), then the jammer's best response would be to remain silent γ N E = 0 (as the energy harvested from the jammer in the EH phase is enough to overcome the interference inflicted by the jammer in the SKG phase). Then, the optimal τ N E maximizing the utility ũ(P, τ, 0) (which is decreasing in τ ) would be τ N E → τ th (P) obtaining the utility ũ N E → ũ(P, τ th (P), 0). However, this state cannot be an NE. Indeed, if the jammer stays silent γ N E = 0, no energy is harvested during τ N E and player L gains in utility by deviating to τ = 0. This will also cause the jammer to deviate to γ = .

The above implies that player L can only choose an EH strategy such that τ N E ≤ τ th (P) at the NE. This condition is equivalent to P ≥ p th (τ N E ), which means that the utility is either decreasing or simply a constant in γ (see Remark 2). This further implies that if the jammer uses maximum power γ N E = , then it cannot benefit by deviating unilaterally. Hence, to find the NE of the form (P, τ N E , ), we only need to find the optimal value or values of τ ∈ [0, τ th (P)] that maximizes the function ũ(P, τ, ) given by:

ũ(P, τ, ) = 1 -τ 2 log 2 ⎛ ⎜ ⎜ ⎝ 1
+ P 1-τ + κ σ 2 H 2(1 + σ 2 ) + (1+σ 2 ) 2 P 1-τ +κ σ 2 H ⎞ ⎟ ⎟ ⎠ ,
where κ depends on τ : κ(τ ) = ζ τ σ 2 1-τ . At τ = 0, this function is strictly positive ũ(P, 0, ) > 0 equal to the SKG capacity without EH and, when τ → 1 the function goes to 0. By investigating the second order derivative of ũ(P, τ, ) w.r.t. τ , which amounts to the analysis of the following quadratic equation

(1 -τ ) 2 (1 + σ 2 ) 2 -2σ 4 H (P + σ 2 ζ τ ) 2 = 0, ( 27
)
two different cases arise:

-

Case A: If 1 + σ 2 ≥ √ 2σ 2
H P, this function has a unique inflexion point that lies in (0, 1) and the function starts as convex and then becomes concave. Thus, ũ(P, τ, ) has a critical point that is a local maximum τ max ∈ (0, 1), which is a solution of the equation d ũ( P,τ, ) dτ = 0. Hence, the optimal strategy is given by either the maximal point τ max or by one (or both) of the borders of the interval [0, τ th (P)] depending on the system parameters:

τ N E = arg max τ ∈{0,min{τ th ( P),τ max }} ũ(P, τ, ).

-Case B:

If 1 + σ 2 < √ 2σ 2
H P, then the function is always concave (and it does not have an inflexion point) in (0, 1). If the function has a critical point in (0, 1), then this critical point is a maximum point denoted by τ max and τ N E = min{τ th (P), τ max }. Otherwise, the function is concave decreasing and τ N E = 0.

Remark that, at least in theory, Case A can lead to the existence of two NEs whenever the additional equality condition is met: ũ(P, 0, ) = ũ(P, min{τ th (P), τ max }, ), i.e., when both borders of the interval [0, min{τ max , τ th (P)}] provide equal maximum utility. However, this can happen only in very special cases of the system parameters or with zero probability.

Aside from the zero probability case described above, this profile may not be the unique NE of the game G as there may exist other NEs such that γ N E ∈ [0, ). Such cases can only happen if the strategy of player L at the NE equals (P, τ th (P)) or equivalently if (P, τ th (P), ) is the above NE. Otherwise, whenever τ N E < τ th (P), the utility is strictly decreasing in γ and the only strategy of the jammer at the NE is (case discussed previously). Now, whenever the legitimate user chooses their strategy (P, τ th (P)), the jammer becomes totally indifferent between all their strategies and, in particular, all jamming powers in [0, ) provide the same utility (see Remark 2). Hence, in this case, there may be other NEs aside from (P, τ th (P), ) that provide identical utilities to ũ(P, τ th (P), ). We can disregard the state (P, τ th (P), 0) for the same reasons for which the NJ state is not a NE.

In order to find all NE of the form (P, τ th (P), γ N E ), we need to find all γ N E ∈ (0, ) such that the legitimate user cannot deviate from (P, τ th (P)) or it will lose in terms of utility. Stated otherwise, all γ N E ∈ (0, ) such that τ th (P) = arg max τ ũ(P, τ, γ N E ) provide additional NE profiles of the form (P, τ th (P), γ N E ).

The analysis of the utility ũ(P, τ, γ N E ) as a function of τ is very similar to ũ(P, τ, ) above. There are two cases in function of the system parameters.

-

Case A: If 1 + σ 2 ≥ √ 2σ 2 H P, for all γ N E ∈ √ 2σ 2 H P-1 σ 2
, , the function ũ(P, τ, γ N E ) has a unique inflexion point that lies in (0, 1) and starts as convex and then becomes concave. Thus, ũ(P, τ, γ N E ) has a critical point that is a local maximum τ max (γ N E ) ∈ (0, 1), which is a solution of the equation d ũ( P,τ,γ N E ) dτ = 0. The additional conditions for the strategy (P, τ th (P)) to be optimal for player L are:

τ th (P) ≤ τ max (γ N E ) ũ(P, 0, γ N E ) ≤ ũ(P, τ th (P), γ N E ) (29)
-Case B:

If 1 + σ 2 < √ 2σ 2 H P, for all γ N E ∈ 0, √ 2σ 2 H P-1 σ 2
, the function ũ(P, τ, γ N E ) is always concave in τ ∈ (0, 1). If the function has a critical point in (0, 1), then this critical point is a maximum point denoted by τ max (γ N E ).

The additional condition for the strategy (P, τ th (P)) to be optimal is τ th (P) = τ max (γ N E ). Otherwise, the function is concave decreasing in τ and (P, τ th (P)) cannot be optimal for player L.

C. Proof of Theorem 3

Let us first find the best-response of the jammer defined in (17). Given the second remark, it is easy to see that:

γ B R ( p, τ ) = ⎧ ⎪ ⎨ ⎪ ⎩ 0, if p < p th (τ ) ∈ [0, ], if p = p th (τ ) , if p > p th (τ ), (30)
where p th (τ ) = ζ τ . Notice that whenever p = p th (τ ) the best response of the jammer can be anything and cannot in fact be predicted by player L. However, the obtained payoff is anticipated by player L as it does not depend on the actual choice of the jammer: ũ( p th (τ ), τ, γ ) = ũ( p th (τ ), τ, 0), for all γ .

The SE action of the leader, anticipating that the jammer will best respond to their own choice is given by:

( p S E , τ S E ) = arg max p,τ ũ( p, τ, γ B R ( p, τ )) (31)
From (30), we see that player L can either neutralize the jammer or allow it to transmit, knowing that the jammer will transmit with full power . The situation that proves to be mostly advantageous to the legitimate player will be chosen.

-Case A: Assume the legitimate player neutralizes the jammer by choosing a strategy such that p ≤ p th (τ ). Player L has to find the best pair ( p, τ ) that maximizes ũ( p, τ, 0) knowing that p ∈ [0, min{P, p th (τ )}] and that τ ∈ [0, 1]; the solution equals ( p N J , γ N J ) in Proposition 1.

-Case B: Assume now that the legitimate player does not neutralize the jammer and p ≥ p th (τ ). Player L has to find the best pair ( p, τ ) that maximizes ũ( p, τ, ) knowing that p ∈ [0, P] ∩ [p th (τ ), ∞) and τ ∈ (0, 1). By fixing τ first and optimizing with respect to p, we have that u( p, τ, ) is increasing in p and hence, the optimal power equals P and the value of τ will be constrained by P ≥ p th (τ ) or equivalently τ ≤ τ th (P). This analysis is identical to the analysis of the NE and one possible SE solution is the NE in Theorem 1.

At the SE, the legitimate user will choose one of the two possibilities which provides a higher SKG utility. From Proposition 2, we know that the NJ state cannot provide a strictly higher utility than the NE state. Hence, whenever τ N E < τ th (P), the utility of the unique NE is strictly higher than that of the NJ state. This implies a unique SE that is identical to the NE. If τ N E = τ th (P), this means that ( p N J , τ N J ) = (P, τ N E ) which implies that the utilities at both states NJ and NE are identical. Both the NE (in Theorem 1) and NJ (in Proposition 1) states are SE solutions: (P, τ th (P), ) and (P, τ th (P), 0). The remaining question is whether there exist other solutions when player L chooses the strategy ( p S E , τ S E ) = (P, τ th (P)). In this case, the jammer is rendered indifferent between all of its actions γ ∈ [0, ], which means that it is also rendered unpredictable. As opposed to the NE, the SE requires the legitimate user to be able to anticipate precisely the jammer's response. To avoid this problem, the leader can silence the jammer by transmitting with power p = P -ε or ensures that the jammer transmits with full power by transmitting at power p = P + ε, where ε could be made arbitrarily small and, hence, has no practical impact. None of the other NE in Theorem 2 can be SEs, since the jammer's response cannot be predictable.

In conclusion, if τ N E < τ th (P), then the SE is unique and identical to the NE in Theorem 2. Otherwise, both the NE and the NJ states are SE solutions.

D. Proof of Proposition 3

Assume by absurdum and WLOG that player J has an NE strategy such that the first channel is left unused β * = (0, β 2 , . . . , β N+1 ) while other channels are used β i > 0 for some 2 ≤ i ≤ N. Exploiting this knowledge, player L will only employ channel hopping on channel 1 and maybe spreading with non zero probability at the NE. To see this, we write the expected payoff of player L assuming

β 1 = 0 2N û(α * , β * ) = N i=2 {α i (1 -β i -β N+1 )C(N P, 0) + α i β i C(N P, N ) + α i β N+1 C(N P, )} + α N+1 (1 -β N+1 )[(N -1)C(P, 0) + C(P, N )] + α N+1 β N+1 NC(P, )α 1 (1 -β N+1 )(N -1)C(N P, 0).
Since C(N P, 0) > C(N P, N ) and there exists some β i > 0, we have that:

(1 -β N+1 )(N -1)C(N P, 0) > i =1 [β i C(N P, N )+(1 -β i -β N+1 )C(N P, 0)].
This means that, if the jammer does not use channel 1, the legitimate ndes will only employ this channel and none of the other channel hopping strategies and the NE will be of the form α * = (1 -α N+1 , 0, . . . , 0, α N+1 ). The utility becomes:

2N û(α * , β * ) = (1 -α N+1 )(1 -β N+1 )(N -1)C(N P, 0) + α N+1 (1 -β N+1 )[(N -1)C(P, 0) + C(P, N )] + α N+1 β N+1 NC(P, ).
But now, if the jammer uses all channel hopping probabilities back in channel 1, he can strictly decrease the utility. Assume that the jammer switches from the initial β * to δ = (1-β N+1 , 0, . . . , 0, β N+1 ). The payoff becomes:

2N û(α * , δ) = (1 -α N+1 )(1 -β N+1 )(N -1)C(N P, N ) + α N+1 (1 -β N+1 )[(N -1)C(P, 0) + C(P, N )] + α N+1 β N+1 NC(P, ).
Since û(α * , β * ) > û(α * , δ), the jammer has an incentive to deviate from the NE which is a contradiction. Thus, the jammer uses either all or none of the channel hopping actions. For player L, the proof follows similarly.

E. Proof of Proposition 4

Let us write the linear equations obtained when the players are indifferent among their channel hopping actions. There are four very similar cases depending on whether the players use spread with zero probability at the NE or not. We only detail one case here below. If both players use spread at the NE, the following conditions must be met:

α i C(N P, N ) + (1 -α i -α N+1 )C(N P, 0) + α N+1 [(N -1)C(P, 0) + C(P, N )] = c α , β i C(N P, N ) + (1 -β i -β N+1 )C(N P, 0) + β N+1 C(N P, ) = c β .
The equations in α illustrate that player J becomes indifferent among their pure channel hopping actions at the NE. Similarly, the equations in β make player L indifferent among their pure channel hopping actions at the NE. We remark that all these equations are identical in the sense that their coefficients do not depend on the index i of the α and β variables. This means that their solutions are of the form: α i = a and β i = b for any i ≤ N. Therefore -irrespective of whether the players employ or not spreading at the NE -if both players employ the channel hopping strategy, then the NE takes on the special form α * = (a, . . . , a, (1 -Na)), β * = (b, . . . , b, (1 -Nb)) for some 0 ≤ a ≤ 1/N, 0 ≤ b ≤ 1/N.

F. Proof of Theorem 4

If N = 1, the NE analysis is trivial and both players transmit at full powers (N P, N ). If N > 1 and given the strict convexity of C( p, γ ) in γ , we have the following inequality for all p, γ 1 = γ 2 and λ ∈ (0, 1):

C( p, λγ 1 + (1 -λ)γ 2 ) < λC( p, γ 1 ) + (1 -λ)C( p, γ 2 ).
By taking p = P, γ 1 = 0, γ 2 = N , λ = N-1 N , we obtain:

NC(P, ) < (N -1)C(P, 0) + C(P, N ) (32)
Similarly, by taking p = N P, γ 1 = 0, γ 2 = N , λ = N-1 N , we obtain:

NC(N P, ) < (N -1)C(N P, 0) + C(N P, N ). (33)
From Proposition 3 and Proposition 4, the NE can only take nine forms which are not mutually exclusive. Each case is studied using Definition 1 and for which necessary and sufficient conditions are provided. Then, using (32) and ( 33), we show that only three of the nine cases can occur. The proof is rather long and tedious and only a sketch containing the main ideas is provided below. 1) Both players spread at the NE (i.e., α * = β * = e N+1 ), iff C(N P, ) < NC(P, ) and (N -1)C(P, 0) + C(P, N ) > NC (P, ). The second condition is always true due to (32).

2) Both players use only channel hopping at the NE (i.e., α * = β * = (1/N, . . . , 1/N, 0)), iff C(N P, N ) + (N -1)C(N P, 0) > N(N -1)C(P, 0) + NC(P, N ) and C(N P, N ) + (N -1)C(N P, 0) < NC(N P, ). This case is impossible because of (33).

3) The game has a strictly mixed NE, i.e., all actions are used with non-zero probability, of the form α * = (a, . . . , a, (1 -Na)), β * = (b, . . . , b, (1 -Nb)) iff there exist 0 < a < 1/N and 0 < b < 1/N such that both players are indifferent among all their pure strategies. Let us write the condition for (a, . . . , a, 1 -Na) to be a NE and for which the jammer is indifferent among their pure strategies by Definition 1. This yields the following linear equation:

a[NC(N P, ) -C(N P, N ) -(N -1)C(N P, 0)] = (1 -Na)[(N -1)C(P, 0)+C(P, N ) -NC(P, )],
where the term on the LHS is a strictly negative value from a > 0 and ( 33) and the RHS is a strictly positive value from a < 1/N and (32). Thus, this case can never occur. 4) Player L only channel hops and player J uses both channel hopping and spreading at the NE:

α * = (1/N, . . . , 1/N, 0) and β * = (b, . . . , b, (1 -Nb)), iff C(N P, N ) + (N -1)C(N P, 0) = NC(N P, ), 0 < b < 1/N, and Nb[(N -1)C(P, 0) + C(P, N )] + (1 -Nb)NC(P, ) < bC(N P, N ) + (N -1)bC(N P, 0) + (1 -Nb)C(N P, )
, where b is chosen such that player L is indifferent among their pure strategies. Given (33), the above equality never holds. where the term on the LHS is a strictly negative value from a > 0 and (33) and the RHS is a strictly positive value from a < 1/N and (32). Thus, this case can never occur. 6) Player L spreads and player J channel hops at the NE (i.e., α * = e N+1 and β * = (β 1 , . . . , β N , 0)), iff NC(P, ) > (N -1)C(P, 0)+C(P, N ), NC(N P, 0)-N(N -1)C(P, 0)-NC(P, N ) < C(N P, 0) -C(N P, N ) and β i meet some additional constraints. Because of (32) this case never occurs as the first condition is never satisfied.

7) Player J spreads and player L channel hops at the NE (i.e., β * = e N+1 and α * = (α 1 , . . . , α N , 0)), iff C(N P, ) > NC (P, ) and NC(N P, 0) -NC(N P, ) > C(N P, 0) -C(N P, N ). The NE strategies of player L are given by the (infinite number) of solutions to the following system of linear inequalities:

0 ≤ α i ≤ 0, ∀i, N j =1 α j = 1 α i < C(N P,0)-C(N P, ) C(N P,0)-C(N P,N ) , ∀i ≤ N.
The second condition is always true (33). From (33), the above system of inequality always has the uniform probability over the channels solution α * = (1/N, . . . , 1/N, 0). 8) Player L spreads and player J employs all their actions at the NE (i.e., α * = e N+1 , β * = (β 1 , . . . , β N+1 )), iff (N -1)C(P, 0) + C(P, N ) = NC(P, ) and β i , ∀i meet some additional constraints that are not detailed here. The reason is that, given (32), the equality condition never holds and, hence, this case is impossible. 9) Player J spreads and player L employs all their actions at the NE (i.e., β * = e N+1 and α * = (α 1 , . . . , α N , α N+1 )), iff C(N P, ) = NC(P, ) and the solutions to the following linear system of inequalities are NE strategies for player L:

⎧ ⎪ ⎨ ⎪ ⎩ 0 ≤ α i ≤ 1, ∀i, N j =1 α j = 1 α i [C(N P, N ) -C(N P, 0)] + α N+1 [(N -1)C(P, 0) +C(P, N ) -C(N P, 0) + C(N P, ) -NC(P, )] > C(N P, ) -C(N P, 0), ∀i ≤ N.
Notice that, by taking α N+1 = 0, the above system of linear equations is precisely the one in case 7 which has an infinite number of solutions, and in particular α i = 1/N, ∀i ≤ N. Similarly, α i = 0 for all i ≤ N and α N+1 = 1 (player L spreads) is also a solution, which follows directly from (32).

G. Proof of Proposition 5

The best-response for the jammer is defined as β B R (α) = arg min β û(α, β), where β B R (α) represents the best action the jammer can take knowing that the legitimate player choses α. The payoff is affine in β and can be rewritten it as û(α, β) = N+1 i=1 β i c i (α) + c 0 (α), with the coefficients:

c i (α) = α i [C(N P, N ) -C(N P, 0)] + α N+1 [C(P, N ) -C(P, 0)], i ≤ N, c N+1 (α) = N j =1 α i [C(N P, ) -C(N P, 0)] + Nα N+1 [C(P, ) -C(P, 0)], c 0 (α) = N j =1 α i C(N P, 0) + Nα N+1 C(P, 0). (34)
Thus, we observe that to find the best-response function β B R (α), the jammer has to solve a linear program under the constraints:

β i ≥ 0, ∀ i and N+1 j =1 β j = 1.
The SE action of the leader, anticipating that the jammer will best respond to their own choice is given by:

α S E = arg max α û(α, β B R (α)) = arg max α min j >0 c j (α) + c 0 (α) .
Player L can anticipate the response of the jammer, who seeks to minimize the coefficients c j (α). We remark that:

c N+1 (α) = (1 -α N+1 )[C(N P, ) - C(N P, 0)] + Nα N+1 [C(P, ) -C(P, 0)]
and c 0 (α) = (1 -α N+1 )C(N P, 0) + Nα N+1 do not depend on the way in which the load 1 -α N+1 is spread over the channel hopping actions. Therefore we can only focus on c i (α), 1 ≤ i ≤ N.

If player L uses channel hopping strategies with uniform probability α (1) = (a, . . . , a, 1 -Na), all coefficients will be equal c i (α (1)

) = a[C(N P, N ) -C(N P, 0)] + (1 - Na)[C(P, N ) -C(P, 0)]. This means that the jammer is indifferent between the different channels min 1≤ j ≤N c j (α) = a[C(N P, N )-C(N P, 0)]+(1-Na)[C(P, N )-C(P, 0)].
Now, if player L has a preference for a certain channel, say for channel 1:

α (2) = (a + δ 1 , a -δ 2 , . . . , a -δ N , 1 -Na), with N j =2 δ j = δ 1 > 0, the coefficients will be: c 1 (α (2) ) = (a + δ)[C(N P, N ) - C(N P, 0)] + (1 -Na)[C(P, N ) -C(P, 0)], c i (α (2) ) = (a -δ i )[C(N P, N ) -C(N P, 0)] + (1 -Na)[C(P, N ) - C(P, 0)].
In this case, the jammer will profit from this information and will put all their channel hopping load on channel 1 alone:

β B R 1 (α (2) ) = 1 -β B R N+1 (α (2) ), β i (α (2) ) = 0, ∀2 ≤ N and min 1≤ j ≤N c j (α (2) ) = (a + δ)[C(N P, N ) - C(N P, 0)] + (1 -Na)[C(P, N ) -C(P, 0)].
But this means that min 1≤ j ≤N c j (α (2) ) < min 1≤ j ≤N c j (α (1) ), which further implies that û(α (1) , β B R (α (1) )) < û(α (2) , β B R (α (2) )). This means that player L will lose in utility by not assigning uniform probability to the channel hopping strategies.

H. Proof of Theorem 5

Proposition 1 tells us that the SE strategy of player L is of the form: α S E = (a, . . . , a, (1 -Na)) for some a ∈ [0, 1/N], which is to be determined. The coefficients in (34) become:

c i (α S E ) = a[C(N P, N ) -C(N P, 0)] + (1 -Na)[C(P, N ) -C(P, 0)], i ≤ N c N+1 (α S E ) = Na[C(N P, ) -C(N P, 0)] + N(1 -Na)[C(P, ) -C(P, 0)].
Using the fact that C( p, γ ) is convex w.r.t. γ for a fixed p, we have the following inequalities: NC(P, ) < (N -1)C(P, 0) + C(P, N ) and NC(N P, ) < (N -1)C(N P, 0) + C(N P, N ) which imply that c i (α S E ) < c N+1 (α S E ). This means that the jammer's strategy is to spread always: β S E = (0, . . . , 0, 1). The SE utility becomes:

û(α S E , β S E ) = aC(N P, ) + (1 -Na)C(P, ). (35)
This implies that, if C(N P, ) > NC(P, ) player L will only channel hop with uniform probability a = 1/N. If C(N P, ) < NC(P, ) player L will only spread a = 0. If C(N P, ) = NC(P, ) then the legitimate user is indifferent between spreading and channel hopping and all a ∈ [0, 1/N] are solutions.

Mitigating Jamming Attacks Using Energy Harvesting

Gada Rezgui, E. Veronica Belmega , Member, IEEE, and Arsenia Chorti , Member, IEEE Abstract-The use of energy harvesting as a counter-jamming measure is investigated on the premise that part of the harmful interference can be harvested to increase the transmit power. We formulate the strategic interaction between a pair of legitimate nodes and a malicious jammer as a zero-sum game. Our analysis demonstrates that the legitimate nodes are able to neutralize the jammer. However, this policy is not necessarily a Nash equilibrium and hence is sub-optimal. Instead, harvesting the jamming interference can lead to relative gains of up to 95%, on average, in terms of Shannon capacity, when the jamming interference is high.

Index Terms-Energy harvesting, jamming, game theory.

I. INTRODUCTION

I N RECENT years, the simultaneous wireless information and power transfer has gained momentum in the realm of energy harvesting (EH) technologies. In this contribution, we focus on systems employing a time-splitting EH approach [1]- [4], i.e., during a first phase the receiver collects energy from RF microwave radiation and in a second phase it uses the harvested energy for data transfer.

An interesting application of such EH approaches arises for wireless systems under jamming attacks. In the past, two main counter-jamming approaches have been commonly considered: direct sequence spread spectrum (DSSS) and frequency hopping spread spectrum (FHSS), [5], [6]. More recently, the use of multiple antennas has been exploited in [7] against both jamming and eavesdropping. In the first two approaches, the impact of power constrained jammers can be limited by increasing the spectral resources because the optimal jamming strategy is to spread the jamming power over the entire bandwidth; whereas the former requires an increased number of antennas. In this letter, we alternatively explore the possibility of mitigating jamming attacks by using EH without increasing the spectral or the spatial resources. So far, there has only been a limited number of contributions in this area [8]- [11].

In [8], the jamming interference is harvested and exploited in a two-way channel assuming that the jammer's policy is fixed (i.e., the jammer is not strategic). Furthermore, in [9] a cooperative relay wiretap channel is studied, in which the helping nodes harvest energy from the legitimate link and then The authors are with ETIS, ENSEA, CNRS, Université Paris Seine, Université Cergy-Pontoise, 95014 Cergy-Pontoise, France (e-mail: gada.rezgui@ensea.fr; belmega@ensea.fr; arsenia.chorti@ensea.fr).

Digital Object Identifier 10.1109/LWC.2018.2871152 generate interference to the eavesdropper. On the other hand, in [11], it is shown that EH can be exploited to mitigate jamming attacks in wireless secret key generation (SKG) systems and that it is possible to neutralize the jammer, i.e., to fully compensate its impact on the SKG rate. Building on this idea, the objective of this letter is to investigate whether EH at the legitimate transmitter can be an efficient measure against jamming attacks. We investigate the strategic interaction between a pair of legitimate nodes and a jammer employing as utility function the Shannon capacity.

The main contributions of this letter can be summarized as follows. First, we demonstrate that the jamming attack can be prevented entirely by adjusting the EH duration, i.e., the jammer can be neutralized (or forced to remain silent). This is only possible when the quality of the channel in the harvesting link is higher than in the jamming link. Nevertheless, neutralizing the jammer imposes too stringent restrictions on the EH duration and on the legitimate transmit power and hence is not optimal.

Second, we formulate a zero-sum game between the legitimate users and the jammer and derive the Nash equilibrium (NE) analytically. At the NE, both players transmit at full power, while, the optimal EH duration depends on the system parameters. Interestingly, we show that the NE always outperforms neutralizing the jammer. At the NE, the jamming interference is not fully cancelled but rather exploited, particularly efficient in the high jamming interference regime.

This letter represents a proof of concept of the potential use of EH against jamming attacks, relying on widely used system model assumptions [1]- [3], [5], [6], [10], [11]. Demonstration of the proposed EH policy in a real testbed is left as future work, in which the effect of imperfect channel estimation, type I and II jamming detection errors, implementation aspects of EH, etc., will also be considered.

II. SYSTEM MODEL

The system model, depicted in Fig. 1, comprises three nodes: a legitimate transmitter, Alice, its intended receiver, Bob, and a malicious jammer, Jay. The channel coefficients in the links Alice-Bob, Jay-Alice and Jay-Bob are denoted by H, G A and G B , respectively and model fading; they are assumed to remain constant during each EH and transmission cycle and to change independently from one cycle to the next. We assume that full channel state information is available at all nodes.

When Alice sends a message X A to Bob, Jay can jam the transmission. Bob's observation Y B can be expressed as:

Y B = HX A + G B X J + Z B , (1)
2162-2345 c 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. where the message X A ∼ N (0, p) is drawn from a Gaussian codebook under a short-term power constraint 0≤ p≤ P.

Finally, Z B ∼ N(0, N B ) models the effect of the additive white Gaussian noise (AWGN) in the Alice-Bob link.

We consider that Jay transmits Gaussian jamming signals X J ∼ N (0, γ) and 0≤ γ ≤ Γ represents the jamming power. This letter studies whether EH can be exploited to harvest the jamming interference and boost the transmit power. We assume a time sharing scheme with two phases: the first phase of duration τ T, where T is the symbol period, is dedicated to EH. The second phase of duration (1-τ )T is dedicated to information transmission.

Alice's observation during the EH phase is then given by:

Y A = G A X J + Z A , (2)
where Z A ∼ N (0, N A ) models the effect of AWGN noise in the link Jay-Alice. As commonly assumed [2], the harvested energy is proportional to the energy of the received signal:

E = τ T ζE |Y A | 2 = τ T ζ γ|G A | 2 + N A , (3)
where ζ ∈ [0, 1] is the harvesting efficiency parameter. The average power harvested during the EH phase is used in the information transmission phase and is given as follows:

p EH = τ 1 -τ ζ γ|G A | 2 + N A . (4)
The multiplicative term1 1-τ in the above expression stems from keeping the energy constant during each transmission phase of duration (1-τ ) T [11]. The initially available transmit power (aside from the harvested one) is also enhanced to p 1-τ for the same reason. Under the above assumptions and using standard time sharing arguments [12], the Shannon capacity of the Alice-Bob link is given by

C EH (p, τ, γ) = (1 -τ ) 2 log ⎛ ⎝ 1 + p 1-τ + p EH |H | 2 γ|G B | 2 + N B ⎞ ⎠ . (5)
Note that the multiplicative term (1-τ ) in front of the logarithm represents the reduction of the Shannon capacity due to time sharing.

III. JAMMER NEUTRALIZATION

In this Section, we first investigate whether it is possible to neutralize the jammer. We note that C EH is increasing with the transmit power p for fixed τ and γ. On the other hand, C EH is not necessarily decreasing with the jamming power: since the interference is harvested and p EH increases with γ, the Shannon capacity may even increase with the interfering power γ for specific system parameters. Although this may seem counter-intuitive, consider the case in which the interfering link is very poor |G B | 2 << 1 (e.g., Jay is very far from Bob). In this case, the interference at Bob is negligible:

γ|G B | 2 + N B
N B and, hence, C EH increases with γ due to p EH . We prove this result rigorously by investigating the first-order derivatives of C EH .

Proposition 1: For fixed p and τ , if

|G A | 2 N A > |G B | 2 N B , then C EH (p, τ, γ) is monotonically increasing w.r.t. γ if p ≤ p th (τ ) τ K , with K ( |G A | 2 N B |G B | 2 -N A )ζ
, and it is monotonically decreasing w.r.t. γ if p > p th (τ ). This implies:

arg max γ∈[0,Γ] C EH (p, τ, γ) = 0, if p ≤ p th (τ ), (6)
arg max

γ∈[0,Γ] C EH (p, τ, γ) = Γ, if p > p th (τ ). (7)
Otherwise, C EH (p, τ, γ) is always monotonically decreasing w.r.t. γ for any fixed p and τ and

arg max γ∈[0,Γ] C EH (p, τ, γ) = Γ. (8)
Intuitively, if the quality of the harvesting link is higher than that of the jamming link

|G A | 2 N A > |G B | 2
N B , then the legitimate users can neutralize the jammer by tuning the transmit power p and the EH policy τ such that p ≤ p th (τ ). This highlights the existence of a power threshold p th (τ ) below which, harvesting the jamming interference in the first phase overcomes the harmful jamming in the second phase. The optimal strategy (p, τ ) that neutralizes the jammer (NJ) is given below.

Theorem 1:

If |G A | 2 N A > |G B | 2
N B , the strategy that maximizes the capacity while neutralizing the jammer (p NJ , τ NJ ) is given as follows: a) If p -1 th (P ) > 1, then (p NJ , τ NJ ) = (p th (τ ), τ ), where p -1 th (p) = p K is the inverse function of p th (τ ). b) Otherwise, the optimal strategy is

(p NJ , τ NJ ) = arg max (p,τ )∈{(p 1 ,τ 1 ),(p 2 ,τ 2 )} C EH (p, τ , 0), (p 1
, τ 1 ) = (min{p th (τ ), P }, min{τ , p -1 th (P )}), (p 2 , τ 2 ) = (P , max{τ , p -1 th (P )}), where τ ∈ (0, 1) and τ ∈ (0, 1) are the unique solutions of the equations

∂C EH (p th (τ ), τ, 0) ∂τ = 0 and ∂C EH (P , τ, 0) ∂τ = 0
respectively, which can be easily computed numerically. 1 Fig. 2 illustrates the Shannon capacity obtained while neutralizing the jammer, C EH (p NJ , τ NJ , 0), as a function of the signal to interference power ratio (SIR) defined as SIR = P /Γ in the range P/Γ = -30 dB to P/Γ = 10 dB, for various settings w.r.t. the channels gains for N A = -10 dBm, N B = -7 dBm, Γ = 10 dBm, ζ = 0.8. These parameters Fig. 2. Shannon capacity while neutralizing the jammer as a function of SIR. The jammer cannot be neutralized if the harvesting link is poor. Transmitting at full power P is not always optimal.

were chosen to showcase the different regimes in terms of the optimal strategies at the NJ and NE states. Nevertheless, all our remarks and observations are general and remain valid irrespective of the specific choice of the system parameters.

The capacity

C EH (p NJ , τ NJ , 0) is zero for |H | 2 = 0.2, |G A | 2 = 0.2, |G B | 2 =
1 since the minimum condition on the harvesting link quality is not met and the jammer cannot be neutralized. In the other settings, we can identify two regimes depending on whether p -1 th (P ) ≤ 1 or not. When the SIR is low, the system is in case b) of Theorem 1 and increasing P increases the feasible set of the optimization problem and, hence, the optimal value of the capacity. At higher SIR, the system shifts to case a), in which the optimal solution that neutralizes the jammer no longer depends on P. The dashed black curve depicts the average C EH (p NJ , τ NJ , 0) over 10,000 random realizations of the channel gains drawn from a standard Gaussian distribution.

We remark that to neutralize the jammer a non-zero EH duration is required, i.e., τ NJ > 0, during which little energy can actually be harvested (as the jammer is silent). Also, the transmit power may be required to be below the maximum available power. In light of this, we next investigate the optimal strategies of both parties in this competitive interaction.

IV. OPTIMAL STRATEGIES: GAME THEORETIC ANALYSIS

In this Section, we study the adversarial interaction between the legitimate users and the jammer using a non-cooperative game [13]. More specifically, we formulate a two-player zerosum game defined as the triplet:

G = {{L, J }, {A L , A J }, C EH (a L , a J )}
, where L and J denote the opposing players; A L = [0, P ] × [0, 1] and A J = [0, Γ] denote the possible actions the two players can take; and C EH (a L , a J ) is both the utility of L and the cost of J. The strategy of legitimate users is denoted by a L = (p, τ) and that of the jammer by a J = γ.

A natural solution of the game is the NE, denoted by (a NE L , a NE J ), which is stable to unilateral deviations:

C EH (a NE L , a NE J ) ≥ C EH (a L , a NE J ), ∀a L = a NE L , C EH (a NE L , a NE J ) ≤ C EH (a NE L , a J ), ∀a J = a NE J .
Neither the legitimate player nor the jammer have any interest in deviating from the NE state knowing that their opponent is playing the NE strategy. Proposition 2: The NJ state, (p NJ , τ NJ , 0) in Theorem 1, is not a NE of the game G.

Proof: If p -1 th (P ) > 1 then (p NJ , τ NJ ) = (p th (τ ), τ ), from Theorem 1. This cannot be a NE, because it implies that p th (τ ) < P , and since C EH is increasing in p then player L should transmit at maximum power at the NE: p NE = P . Otherwise, we have two cases: (p NJ , τ NJ ) = (P , max{τ , p -1 th (P )}) and (p NJ , τ NJ ) = (P , p -1 th (P )). Neither can be NE: since the jammer is silent (γ NJ = 0) and only the noise N A is harvested, the legitimate user will deviate from τ NJ > 0 to τ = 0. EH operates as a threat to neutralize the jammer, which results in an inefficient time sharing policy.

The game's NE is given in the following theorem.

Theorem 2: The NE of the game G is (p NE , τ NE , γ NE ) = (P , τ NE , Γ), where τ NE ∈ {0, τ * } with τ * ∈ (0, 1) the unique solution of

∂C EH (P , τ, Γ) ∂τ = 0 (9)
(which can be easily computed numerically), depending on the system parameters. Moreover, the NE always outperforms the NJ state. Proof: The transmit power is maximum p NE = P since C EH is increasing in the transmit power p. Then, we prove by reductio ad absurdum that at the NE we have: p th (τ NE ) ≤ p NE , implying that γ NE = Γ from Proposition 1. Finding τ NE reduces to solving the optimization problem:

τ NE = arg max τ ∈[0,1] C EH (P , τ, Γ). (10)
Based on the first and second order derivatives, C EH (P , τ, Γ) is concave and either decreases (τ NE = 0) or it has a unique critical point (τ NE = τ * ), depending on the parameters. To prove that the NE always outperforms the NJ state, we use two ingredients. From Proposition 1, whenever p = p th (τ ), the Shannon capacity is constant w.r.t. γ and, hence, C EH (p NJ , τ NJ , 0) = C EH (p NJ , τ NJ , Γ). From the NE definition and knowing that p NE = P and γ NE = Γ:

(P , τ NE ) = arg max p,τ C EH (p, τ, Γ). (11)
These two facts yield that the NE outperforms the NJ state:

C EH (p NJ , τ NJ , 0) ≤ C EH (P , τ NE , Γ).
In Fig. 3, we compare the capacity at the NE, C EH (P , τ NE , Γ), with the capacity when neutralizing the jammer, C EH (p NJ , τ NJ , 0), normalized to the former by illustrating

F NJ C EH (P , τ NE , Γ) -C EH (p NJ , τ NJ , 0) C EH (P , τ NE , Γ) . (12)
The simulation setting is identical to Fig. 2. We remark that the NE always outperforms the NJ policy, which is consistent to our analysis. The intuition is that, when neutralizing the jammer, Alice does not necessarily transmit at maximum power P and has to spend a minimum proportion of time τ NJ > 0 for EH, as a threat to force the jammer to remain silent, even though no energy can actually be harvested during this time.

Only in two of the four specific channel settings, the capacity at the NJ state equals the NE capacity and only at specific SIR values (the 0% minimum points). Surprisingly, using EH to neutralize the jammer is not beneficial in most cases. Instead, the legitimate users should harvest the jamming interference and use it for information transmission. The 100% relative gain curve corresponds to the case in which the jammer cannot be neutralized because of the poor quality of the harvesting link. The dashed black curve represents the average efficiency of the NE w.r.t. the NJ state and shows a relative gain between 64%-75%.

In the same setting, in Fig. 4 we evaluate the efficiency of EH as a measure against a strategic jammer and compare the capacity at the NE, C EH (P , τ NE , Γ), with C EH (P , 0, Γ), the capacity in absence of EH capability normalized to the former, by analyzing

F C EH (P , τ NE , Γ) -C EH (P , 0, Γ) C EH (P , τ NE , Γ) . (13)
At low SIR, the relative EH gain in terms of capacity is very high, approaching 100% when the gain of the harvesting link is high. The jamming interference is dominant and exploiting it for useful communication is very beneficial. At high SIR, the gain from EH decreases progressively towards zero since the jamming interference that can be harvested becomes negligible. The potential of using EH as an anti-jamming measure is demonstrated by the substantial relative gains in terms of Shannon capacity that can on average reach 95% in the low SIR regime.

V. CONCLUSION

In this letter, we showed that EH can be exploited to efficiently mitigate jamming attacks. We proved that a jammer can be completely neutralized by appropriately tuning the transmit power and the EH duration. However, this restricts the transmit power of the legitimate user and requires a minimum harvesting duration, during which little energy can actually be harvested (as the jammer is forced to remain silent). Therefore, neutralizing the jammer is not necessarily optimal. Employing a zero-sum game formulation, we showed that at the NE both players should transmit at full power and the optimal EH duration depends on the system parameters. Our simulation results show that EH can offer substantial gains in terms of capacity. At low SIR, the average gains can reach 95%, showcasing the high potential of EH as an efficient counter-jamming measure. W. Yu is with the 5G Innovation Centre, Institute for Communication Systems, University of Surrey, Guildford GU2 7XH, U.K. (e-mail: w.yu@surrey.ac.uk).

Effective Secrecy

A. Chorti is with ETIS, UMR 8051, Université Paris Seine, Université Cergy-Pontoise, ENSEA, CNRS, 95000 Cergy, France (e-mail: arsenia.chorti@ensea.fr).

L. Musavian is with the School of Computer Science and Electronic Engineering, University of Essex, Colchester CO4 3SQ, U.K. (e-mail: leila.musavian@essex.ac.uk).

H. V. Poor is with the Department of Electrical Engineering, Princeton University, Princeton, NJ 08544 USA (e-mail: poor@princeton.edu).

Q. Ni is with the InfoLab21, School of Computing and Communications, Lancaster University, Lancaster LA1 4WA, U.K. (e-mail: q.ni@lancaster.ac.uk).

Color versions of one or more of the figures in this article are available online at http://ieeexplore.ieee.org.

Digital Object Identifier 10.1109/TWC.2019.2938515

I. INTRODUCTION

N ON-ORTHOGONAL multiple access (NOMA) is considered to be a promising multiple access (MA) technique for fifth generation (5G) and beyond (B5G) networks, because of its advantages over conventional orthogonal multiple access (OMA) schemes, in terms of spectral efficiency [1], cell-edge throughput [2], and energy efficiency [3]. Power-domain NOMA1 allows multiple users to transmit with different transmission power levels, but using the same radio resources, such as subcarrier channels, codes and time slots [4], [5]. Specifically, superposition coding is applied at the transmitter to enable user-multiplexing, while multiuser separation techniques such as successive interference cancellation (SIC) are applied at the receiver to eliminate the co-channel interference and decode the superimposed messages [6], [7]. The users with higher channel gains can obtain the prior information of weaker users in accordance with the NOMA principle. On one hand, the obtained prior information can be utilized to help the weaker users to decode their messages [2], but as mentioned in [8], this can also cause security issues.

Providing secure communication has always been an important issue in wireless networks. Traditionally, security is carried out at upper layers of the protocol stack, relying on encryption algorithms which are agnostic to the wireless channels' physical properties [9], [10]. However, in 5G and Internet of things (IoT) networks, with the explosive growth in the number of low-complexity, power and computationally constrained devices, the concept of physical layer security (PLS) is attracting considerable attention. PLS exploits the randomness of wireless channels to ensure that the transmitted information cannot be decoded by a malicious eavesdropper [10], [11]. Based on the concept of perfect secrecy proposed by Shannon [12], Wyner introduced the wiretap channel model, in which two legitimate users can communicate reliably through a main channel while keeping the exchanged messages confidential from an eavesdropper. Considering Gaussian wiretap channels, the secrecy capacity, i.e., the maximum achievable rate which guarantees reliable communication while the eavesdropper cannot decode any confidential message, is equal to the difference between the main channel's Shannon capacity and the adversary channel's Shannon capacity [9], [13]. Consequently, confidential transmission in Gaussian wiretap channels requires that the legitimate user's channel has a higher signal-to-noise ratio (SNR) than the wiretap channel [11]. On the other hand, the ergodic secrecy capacity for wireless fading channels can be positive even when the adversary has a higher average SNR than the legitimate user's channel, which indicates that fading can be beneficial for secrecy [11]. This is because whenever the legitimate user experiences a higher channel gain than the eavesdropper, this fading realization can be exploited for secure transmission [9].

Focusing on large-scale networks utilizing the NOMA protocol, PLS was investigated in [14] and [15] by invoking stochastic geometry. By adopting a user pairing technique which allows two mobile users to share one orthogonal radio resource, the exact analytical expressions for the secrecy outage probability were derived and analyzed for single-antenna and multiple-antenna scenarios [15]. In [16], the feasible transmit power region was first identified to maximize the sum of secrecy rates for a single-input single-output NOMA system, which satisfies all users' required quality-of-service (QoS) values. Then, a closed-form expression was derived for the proposed optimal power allocation strategy. In [17], a network in which the source and an untrusted relay simultaneously transmit signals through non-orthogonal channels was considered. It was concluded that the proposed non-orthogonal relaying scheme provides an improved ergodic secrecy rate, compared to the conventional orthogonal relaying schemes.

Although investigating the secrecy capacity in different wireless networks with the NOMA protocol applied, the aforementioned literature adopts the physical layer channel model, i.e., Shannon theory, without placing emphasis on the legitimate users' delay requirements. On the other hand, for the emerging delay-sensitive wireless communication networks and applications [18], such as vehicular communications, e-health communication and Tactile Internet, delay QoS guarantees will play a critical role in 5G and beyond 5G networks. Furthermore, in future wireless networks, users are expected to necessitate flexible delay guarantees for achieving different service requirements. Henceforth, in order to satisfy diverse delay requirements, a simple and flexible delay QoS model is imperative to be applied and investigated. In this respect, the effective capacity (EC) theory was proposed in [19], with EC denoting the maximum constant arrival rate which can be served by a given service process, while guaranteeing the required statistical delay provisioning. By considering the secrecy rate as the given service rate, we propose in turn the novel concept of the effective secrecy rate (ESR); ESR represents the maximum constant arrival rate that can be securely served, on the condition that the required delay constraint can be statistically satisfied.

In this paper, focusing on a downlink NOMA network with one base station (BS), multiple single-antenna mobile users and an eavesdropper, we aim to propose and thoroughly analyze the ESR for delay-sensitive NOMA users. Different from the user paring design in [14] and [15], we assume that all legitimate NOMA users can transmit using the same resource slot. To provide a comprehensive study, two different eavesdropping scenarios are considered in this paper. Firstly, a purely antagonistic network is studied, in which every NOMA user can act as a passive eavesdropper intercepting confidential messages intended for other users. A practical scenario for this case would be ad-hoc networks with confidential information broadcasted with existing untrusted peers [10]. Secondly, when all NOMA users are trustworthy, there may exist an external eavesdropper that has an interest in compromising the network's security. Hence, with an external eavesdropper intending to decode the NOMA users' messages, the ESR of an arbitrary legitimate user is proposed and investigated, while satisfying their corresponding statistical delay requirement.

Considering the above eavesdropping scenarios, this paper has the following main contributions:

• After proposing the concept of ESR, we theoretically analyze the impact of delay exponent θ on ESR and provide Theorem 1. It is proved that the ESR monotonically decreases with θ. Specifically, we prove that when θ → 0, the ESR converges to the traditional ergodic secrecy rate, while when θ → ∞, it represents the delay-limited case and simulation results show that the value of ESR reduces to zero, for Rayleigh fading channels. • In the presence of an unknown internal eavesdropper, the only legitimate receiver which can achieve a nonzero secrecy rate is the user with the highest channel gains. 2 For the strongest user, we derive the closedform expressions for the ESR and the traditional ergodic secrecy rate, at high SNRs. Furthermore, we show that the strongest user can achieve higher ESR if it has a distinctive advantage in terms of channel gain with respect to the second strongest user. Also, it is proved that the ESR in the high SNR regime approaches a constant value irrespective of the power coefficients. • In the presence of a malicious external eavesdropper, a lower bound and an upper bound are respectively analyzed for the ESR and the traditional ergodic secrecy rate. 3 For the lower bound, the closed-form expressions are derived for the high SNR regime. For the upper bound, the analysis shows that if the external eavesdropper cannot attain any channel state information (CSI), the legitimate NOMA user in the high SNR regime can always achieve positive delay-guaranteed secrecy rate, and the value of it depends on the power coefficients. • Simulation results verify the accuracy of the derived closed-form expressions and confirm the tightness of the proposed bounds. The impact of the delay requirements, the size of the NOMA set and the power coefficient settings is also investigated. Specifically, it is shown that when there is an external eavesdropper, a legitimate NOMA user with stronger channel gains will be more impacted in terms of its achievable ESR, in order to guarantee a required statistical delay QoS. Further, numerical results also reveal that a larger user set leads to smaller ESR values for the legitimate users in both eavesdropping scenarios.

The rest of the paper is organised as following: the system model is discussed in Section II. The theory of EC is briefly reviewed in Section III, followed by analytical expressions of the ESR for the scenarios of an internal and an external eavesdropper, respectively. Section IV includes simulation results and discussions, followed by conclusions summarized in Section V.

II. SYSTEM MODEL

A classical cellular downlink transmission is considered, where one BS transmits public and confidential messages to M single-antenna NOMA users in the presence of a malicious eavesdropper. The wireless channels from the BS to legitimate NOMA users and the eavesdropper are all assumed to be block fading, i.e., the channel gains remain constant within each fading-block, but independently change from one block to the next. Each fading-block duration T f is equal to the frame size, which is an integer multiple of the symbol period.

The channel gains from the BS to the m th user and the eavesdropper are assumed to be Rayleigh distributed and denoted by h m , m ∈ {1 . . . , , M} 4 and h e ,5 respectively. Without loss of generality, all NOMA users and the malicious adversary's channel gains are assumed to be ordered as

0 < |h 1 | 2 ≤ |h 2 | 2 . . . ≤ |h ME | 2 ≤ |h e | 2 ≤ |h ME+1 | 2 . . . ≤ |h M | 2 ,
in which M E indicates the number of NOMA users that have smaller or equal channel gains with respect to the eavesdropper. The BS transmits the signal M i=1 √ γ i P s i to all legitimate users in accordance with NOMA principle. Here, γ i is the i th user's power coefficient, P is the total transmission power, and s i is the message for the i th user with E |s i | 2 = 1. By following the NOMA protocol [20], the power coefficients6 are ordered as γ 1 ≥ • • • ≥ γ M , and

M i=1 γ i = 1.
The received signals y m at the m th legitimate user, 1 ≤ m ≤ M , and y e at the eavesdropper are respectively given as [21]:

y m = h m M i=1 √ γ i P s i + n m , (1)
y e = h e M i=1 √ γ i P s i + n e , (2)
where n m , n e denote zero-mean additive white Gaussian noise (AWGN) at the m th user and at the eavesdropper, respectively, i.e., n m , n e ∼ N (0, σ 2 ). 7Based on the NOMA principle, the m th user applies the SIC technique to detect its own messages, by successively decoding the weaker users' messages, i.e., the i th user with |h i | 2 < |h m | 2 , and then eliminating the message from the SNR received signals [22]. On the other hand, the messages for the user with stronger channel gains, i.e., the i th user with

|h i | 2 > |h m | 2 ,
will be considered as noise at the m th user. To ensure that SIC is successfully applied at the m th user, it is assumed that R i→m ≥ Ri [23], where R i→m denotes the m th user's data rate to decode the i th user's message and Ri is the target data rate for the i th user. Therefore, when it decodes its own message, the m th legitimate NOMA user's achievable rate, in b/s/Hz, is given by [14]

R m = log 2 1+ ρ|h m | 2 γ m ρ|h m | 2 M i=m+1 γ i +1 , 1 ≤ m ≤ M, ( 3
)
where ρ is the transmit SNR, i.e., ρ = P σ 2 . Regarding the eavesdropper, it employs SIC to detect the m th legitimate user's messages with an achievable decoding rate denoted by R (m) e . Considering that the eavesdropper can be within the set of NOMA users or distinct from them, the corresponding mathematical expressions of R (m) e can be different and we will study them respectively in the following Section. The m th NOMA user's secrecy rate is achievable when an encoding scheme exists that simultaneously ensures reliable communication and perfect secrecy with respect to the eavesdropper. In the following, the m-th user's achievable secrecy rate is denoted by R m s and expressed as [9]

R m s = R m -R (m) e + , 1 ≤ m ≤ M, (4)
where R m is given in (3) and [x] + = max{0, x}.

III. EFFECTIVE SECRECY RATE

In order to support the emerging delay-sensitive wireless communication services and applications, in the following, we first introduce the theory of EC. Then, we introduce the concept of the ESR as an achievable arrival rate that can be securely served, while statistically satisfying the required delay QoS constraints. Let us take the m th user as an example. Assume a first-in-first-out (FIFO) buffer for the m th user at the BS. 8 Define D m (t) as the delay experienced by a packet arriving at time t. From [19], the probability of the delay D m (t) exceeding a maximum delay limit D m max can be estimated as

P out delay = Pr{D m (t) > D m max } ≈ Pr{Q(t) > 0}e -θmμD m max , (5)
where P out delay denotes the delay violation probability limit for the m th user, Pr{Q(t) > 0} is the probability of a non-empty buffer at time t, D m max is the given delay bound in the unit of symbol duration, and θ m (θ m > 0) represents the exponential decay rate. The authors in [19] proved that the constant arrival rate needs to be limited to the value of μ, which equals to EC, so that a target delay violation probability limit can be met. Let {R m s (t), t = 1, 2, . . . } be a series of non-negative random variables, representing the service process of the m th user. Assume that the service process satisfies Gärtner-Ellis theorem [24]. Then, the EC for the m th user on a block-fading channel is defined as

E m s = - 1 θ m T f B ln E e -θmTfBR m s , (b/s/Hz) , (6)
where E [•] is the expectation over its channel gains. When the focus is on the rate that can be securely transmitted, we can obtain the ESR for the m th user, by inserting the achievable secrecy rate R m s , given in (4), into (6). From (5), it can be noted that θ m denotes the exponential decay rate of delay violation probability, for the m th user. A smaller value of θ m indicates that the user has a relatively loose delay QoS requirement, while a larger value of θ m means that a more stringent delay QoS is required. In particular, when θ m → 0, the probability of the experienced delay exceeding a given bound approaches one. When θ m → ∞, it indicates that the user cannot tolerate any delay outage. To clarify, we summarize in the following theorem.

Theorem 1: The ESR for the m th user, i.e., E m s in (6), is a monotonically decreasing function in θ m . When θ m → 0, E m s converges to the ergodic secrecy rate, i.e., E[R m s ]. When θ m → ∞, this represents the delay-limited scenario and the value of E m s reduces to zero. Proof: See Appendix A. Theorem 1 shows that the proposed ESR, describing the delay-guaranteed secrecy rate, 9 contains a delay exponent θ m indicating the stringency of delay requirement. Specifically, this theorem reveals that the ESR is a more general performance metric, which includes the traditional ergodic secrecy rate at an extreme case. For delay-limited scenarios, i.e., when θ m → ∞, the value of E m s reduces to zero for Rayliegh fading channels, which will be shown in Section IV.

A. Effective Secrecy Rate With an Internal Eavesdropper

In this section, we first consider a purely antagonistic network in which every user can be a potential eavesdropper intercepting the confidential messages of the other users. Assume that the knowledge of CSI for all legitimate users is perfectly known at the BS, which implies that the internal eavesdropper's CSI is available. Note that by applying SIC, the user with the strongest channel gains can successfully decode the information of other NOMA users which have weaker channel gains. Hence, when there is an untrusted internal adversary, the only legitimate receiver which can achieve a non-zero secrecy rate is the M th user which has the strongest channel gains. Specifically, the worst case scenario is that the (M -1)

th user acts as the eavesdropper and intends to detect the M th user's messages. Then, the secrecy rate for all legitimate users can be expressed as

R m s = ⎧ ⎪ ⎨ ⎪ ⎩ log 2 1 + ρ|h M | 2 γ M -log 2 1 + ρ|h M-1 | 2 γ M , m = M, 0, otherwise. (7)
For ease and compactness, in the following we introduce the notation:

q m = ργ m , Q m = ρ M i=m γ i , and
β m = - θmT f B ln 2
, where m ∈ {1, 2 . . . , M}. 9 Here, we are talking about the amount of arrival rate that can be securely served and delay statistically guaranteed.

Then, the M th user's ESR can be provided by inserting (7) into (6), which yields

E M s = 1 β M log 2 E 1 + q M |h M | 2 1 + q M |h M-1 | 2 βM . (8)
By setting y = |h M | 2 , and x = |h M-1 | 2 , (8) can be expanded as

E M s = 1 β M log 2 0<x<∞ y≥x 1 + q M y 1 + q M x βM × f (M-1,M) (x, y) dx dy , (9)
where

f (M-1,M) (x,
f (M-1,M) (x, y) = M (M -1) f (x) (F (x)) M-2 f (y). (10)
Finally, by inserting the joint PDF f (M-1,M) (x, y) into ( 9), we provide the following theorem. Theorem 2: Suppose that there is an internal eavesdropper among all NOMA users. Considering the worst case scenario, the M th user's achievable ESR can be written as

E M sc = B M + 1 β M log 2 M-2 ν=0 M -2 ν (-1) ν e ν q M × ∞ k=0 (-1) k k! (ν + 1) k k -β M + 1 Γ k + 2, 1 q M - 1 q M k-βM +1 × Γ 1 + β M , 1 q M , (11)
where

B M = ln(M(M-1))+2q -1 M βM ln 2
and Γ(•, •) is the incomplete Γ function.

Proof: See Appendix B. Note that it is difficult to directly analyze (11) and to obtain intuition of the impact of the various parameters on the ESR. To obtain a tractable expression, in the following, we derive the closed-form expression for E M s at high SNRs. Firstly, at high SNRs, i.e., ρ 1, R M s can be simplified to

lim ρ→∞ R M s = log 2 |h M | 2 |h M-1 | 2 . ( 12
)
The ergodic secrecy rate at high SNRs, i.e., lim

ρ→∞ E[R M s ], equals to E log 2 |hM | 2 |hM-1| 2
. This shows that at high SNRs, the M th user's ergodic secrecy rate depends only on the (ratio of) channel gains between the M th user and the internal eavesdropper.

Then, the ESR at high SNRs for the M th user, denoted as lim ρ→∞ E M s , can be expressed as

lim ρ→∞ E M s = 1 β M log 2 E |h M | 2 |h M-1 | 2 βM . (13a)
Comparing to the case of the ergodic capacity, we can clearly see the impact of the exponential delay decay exponent captuted in β M . From (13a), we can note that for a fixed value of delay factor β M , the ESR value at high SNRs increases with the ratio of channel gains. This demonstrates that the M th user can achieve higher delay-guaranteed secrecy rate if it has a distinctive advantage in terms of channel gain with respect to second in rank user. By setting y = |h M | 2 , and x = |h M-1 | 2 , (13a) can be expanded as

lim ρ→∞ E M s = 1 β M log 2 ⎛ ⎜ ⎜ ⎝ 0<x<∞ y≥x y x βM f (M-1,M) (x, y) dx dy ⎞ ⎟ ⎟ ⎠ . (14)
After applying the joint PDF f (M-1,M) (x, y), we derive the closed-form expressions for lim Theorem 3: Suppose that there is an unknown internal eavesdropper among all NOMA users. Considering the worst case scenario, the closed-form expression for the M th user's ESR at high SNRs, i.e., lim ρ→∞ E M s , is given by

lim ρ→∞ E M s = 1 β M log 2 M (M -1)Γ(1 -β M ) × M-2 s=0 M -2 s (-1) s 2 F 1 1 -β M , 2 2 -β M ; -1 -s , (15)
where Γ(•) is gamma function and 2 F 1 a, b c ; z is the generalized hypergeometric function [26]. Furthermore, for comparison purposes, the ergodic secrecy rate for the M th user at high SNRs, i.e., lim ρ→∞ E R M s , can be expressed in closedform, given in (16).

lim ρ→∞ E[R M s ] = M (M -1) M-2 s=0 M -2 s ×(-1) s 1 s + 1 log 2 (s + 2) . ( 16
)
Proof: See Appendix C. From (15), we can notice that when the transmit SNR asymptotically approaches infinity, the M th user's ESR approaches a constant value, irrespective of the transmit SNR and the power coefficients. Furthermore, from ( 15) and ( 16), one can note that when the M th user's delay requirement changes (when β M varies), lim ρ→∞ E R M s will not change but the value of ESR, i.e., lim ρ→∞ E M s , will be influenced. This is due to the fact that the delay violation probability is not taken into account in traditional secrecy rate, but is considered in the proposed ESR. This demonstrates the gains in considering the delay-guaranteed ESR in low-latency communications.

The validity of the above derived closed-form expressions, given in ( 15) and ( 16), will be verified in Section IV, by comparing with Monte Carlo results. Moreover, simulation results will also show that lim

B. Effective Secrecy Rate With an External Eavesdropper

Here, we assume that all NOMA users are trustworthy and there exists an external eavesdropper which is distinct from the set of legitimate users and intends to decode as many NOMA users' confidential messages as possible. Then, by employing SIC, the adversary's achievable rate for detecting the m th user's message, namely R (m) e , can be given in ( 17) [21], shown at the top of the next page.

By inserting ( 3) and ( 17) into (4) and applying the

defined notations q m = ργ m , Q m = ρ M i=m γ i
, where m = {1, 2, . . . , M}, the secrecy rate for the m th user can be then given in (18) and Q m+1 ≤ Q ME +1q m . This means that R m s ≥ 0, when M E + 1 ≤ m ≤ M . Hence, the secrecy rate R m s can be simplified to (19), shown at the top of the next page.

Assume that the relative order of all NOMA users and the eavesdropper's channel gains is known, i.e., 0

< |h 1 | 2 ≤ |h 2 | 2 . . . ≤ |h ME | 2 ≤ |h e | 2 ≤ |h ME+1 | 2 . . . ≤ |h M | 2 .
E m cs = 1 β m log 2 E Q m |h m | 2 + 1 Q m+1 |h m | 2 + 1 × (Q ME +1 -q m ) |h e | 2 + 1 Q ME +1 |h e | 2 + 1 βm . (20)
At this point, a short note on the circumstances under which the ESR can be evaluated is in place. The design of secrecy encoders utilizes so the called (double) binning techniques and relies on full CSI knowledge, i.e., both the legitimate

R (m) e = ⎧ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎩ log 2 1 + ρ|h e | 2 γ m ρ|h e | 2 M i=m+1 γ i + 1 , 1 ≤ m ≤ M e , log 2 1 + ρ|h e | 2 γ m ρ|h e | 2 M i=ME +1,i =m γ i + 1 , M E + 1 ≤ m ≤ M, (17)
R m s = ⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ log 2 1 + q m |h m | 2 Q m+1 |h m | 2 + 1 -log 2 1 + q m |h e | 2 Q m+1 |h e | 2 + 1 + , 1 ≤ m ≤ M E , log 2 1 + q m |h m | 2 Q m+1 |h m | 2 + 1 -log 2 1 + q m |h e | 2 (Q ME +1 -q m ) |h e | 2 + 1 + , M E + 1 ≤ m ≤ M, (18)
R m s = ⎧ ⎨ ⎩ 0, 1 ≤ m ≤ M E , log 2 1 + q m |h m | 2 Q m+1 |h m | 2 + 1 -log 2 1 + q m |h e | 2 (Q ME +1 -q m ) |h e | 2 + 1 , M E + 1 ≤ m ≤ M, (19)
and the eavesdropper's CSI need to be readily available. This assumption is reasonable in the internal eavesdropper scenario, as the in the NOMA network the source (BS) needs the full CSI to perform the power allocation among the users; indeed, the scenario of a NOMA network with internal eavesdroppers provides an excellent example of how an eavesdropper's CSI can be known to the legitimate transmitter.

On the other hand, in the external eavesdropper case, this assumption is no longer viable; an external passive attacker would indeed have every incentive to conceal themselves and not leak information regarding their actual CSI. However, there is a fundamental difference between a network's secrecy rate and effective secrecy rate. Inspecting the expression in (19) for the ESR, it is clear that it involves an expectation over the distribution of the attacker's channel gains when the legitimate receiver is stronger than the attacker. What is notably different with respect to the evaluation of the secrecy rate, is the fact that in essence only the order -in terms of received SNR -of the eavesdropper among the set of M NOMA users comes into play, as opposed to the case of the secrecy rate in which the exact eavesdropper's SNR needs to be known for the evaluation.

This in turn, is consistent with the way the CSI is fedback to the BS in the uplink of actual systems, such as LTE and NB-IoT, in which instead of the exact CSI and SNR values, an SNR range is determined in the form of a "channel quality indicator" (CQI) [27]. In a realistic setting, it is therefore conceivable that with the aid of artificial noise techniques [28] it is possible to control the range of SNRs that are attainable by the attacker and provide the legitimate users the opportunity to feedback to the BS relevant information regarding the CQI of a potential eavesdropper, therefore removing ambiguities in the evaluation of the ESR.

In terms of the actual design of the secrecy encoders, although it is beyond the scope of the present work, it can be argued that in dense NOMA networks with multiple CQI levels, this information can be taken into account in the design, accounting for the worst case scenario in which the SNR of the eavesdropper is assumed to be in the upper limit of the respective CQI range. Such an approach would of course need to be taken into account in the evaluation of the ESR, but at this point is left as future work.

To calculate E m cs , we define

z 1 = |h m | 2 , z 2 = |h e | 2
, and note that the joint PDF f (z 1 , z 2 ) = f (m) (z 1 )f (z 2 ). 10 Here, f (m) (z 1 ) is the PDF of the ordered m th user's channel gains following order statistics and f (z 2 ) is the PDF of the external adversary's channel gains, which is Rayleigh distributed with unit variance. From the theory of order statistics, we have that

f (m) (z 1 ) = ψ m f (z 1 ) (1 -F (z 1 )) M-m F (z 1 ) m-1 . (21)
Here, ψ m = 1 B(m,M-m+1) and B(μ, w) is the beta function, i.e., B(μ, w) = Γ(μ)Γ(w) Γ(μ + w) -1 , where Γ(μ) = μ!, when μ is a positive integer. By inserting the joint PDF f (z 1 , z 2 ) into (20), we provide the following theorem. Theorem 4: Suppose that there is an external eavesdropper. Assume that the order of the eavesdropper's channel gains among the set of NOMA users is known. For the m th user with m ≥ M E + 1, its conditional ESR, i.e., E m cs , can be simplified to (22) .

E m cs ≈ 1 β m log 2 ψ m Q m+1 Q m -βm m-1 s=0 m -1 s (-1) s 1 a + β m q m Q m+1 Q m m-1 s=0 m -1 s (-1) s e a Qm E i - a Q m × Q ME +1 -q m Q ME +1 βm 1 - β m q m e 1 Q M E +1 (Q ME +1 -q m ) Q ME +1 ×E i - 1 Q ME+1 . ( 22
)
Proof: See Appendix D.

Ȓm s = ⎧ ⎨ ⎩ log 2 1 + q m |h m | 2 Q m+1 |h m | 2 + 1 -log 2 1 + q m |h e | 2 Q m+1 |h e | 2 + 1 , |h m | 2 ≥ |h e | 2 , 0, otherwise. (25)
Note that when there exists an external eavesdropper, obtaining the conditional ESR, i.e., E m cs , requires the relative order of the eavesdropper, in terms of the received SNR, among the set of M NOMA users. If this information is not available, the exact value of E m cs cannot be obtained. Hence, in the following sections, we study and analyze a lower bound and an upper bound for the ESR, which do not require any prior information of the adversary's relative order.

1) Lower Bound on the ESR With an External Eavesdropper: From [21, ch. 15], it is noted that before the adversary detects the m th user's message, if we assume that the first m-1 NOMA users' information has already been successfully decoded, then, we overestimate the malicious adversary's decoding capability. This can happen if the external eavesdropper attains the prior information of the first m -1 users' CSI. Therefore, an upper bound on R (m) e can be given by

R(m) e = log 2 1 + q m |h e | 2 Q m+1 |h e | 2 + 1 , 1 ≤ m ≤ M. (23)
The lower bound on the m th user's achievable secrecy rate can then be expressed as

Ȓm s = R m -R(m) e + , (24)
which can be extended to (25), shown at the top of this page.

In practice, the external eavesdropper is independent from NOMA users, which means its channel gains can be higher or lower than the m th user. Hence, we aim to provide a lower bound on the ESR for the m th user, which represents an average delay-guaranteed rate that can be at least obtained, no matter whether the eavesdropper has a better channel condition or not. By inserting Ȓm s into (6), the lower bound on the ESR for the m th user, i.e., Ȇm s , in the presence of an external eavesdropper, can be expressed as

Ȇm s = - 1 θ m T f B ln ⎛ ⎝ D1 Q m z 1 + 1 Q m+1 z 1 + 1 Q m+1 z 2 + 1 Q m z 2 + 1 βm ×f (z 1 , z 2 ) dz 1 dz 2 + D2 f (z 1 , z 2 ) dz 1 dz 2 ⎞ ⎠ , (26)
where

D 1 = {(z 1 , z 2 ), z 1 ≥ z 2 }, and D 2 = {(z 1 , z 2 ), z 1 < z 2 }.
Then, after applying the joint PDF f (z 1 , z 2 ), Ȇm s in (26) can be expanded as

Ȇm s = - 1 θ m T f B ln ψ m D1 Q m z 1 + 1 Q m+1 z 1 +1 Q m+1 z 2 + 1 Q m z 2 +1 βm × e -(M-m+1)z1-z2 (1 -e -z1 ) 1-m dz 1 dz 2 + ψ m D2 e -(M-m+1)z1 × 1 -e -z1 m-1 e -z2 dz 1 dz 2 . ( 27
)
To bring more insights, we approximate Ȇm s at high SNRs and provide the following theorem.

Theorem 5: Suppose that there is an external eavesdropper. The lower bound on the ESR for the m th user, i.e., Ȇm s , can be approximated at high SNRs and given in (28), based on the condition that γ m ≤ M i=m+1 γ i , where m = {M -1, M}.

Ȇm s ≈ 1 β m log 2 ψ m Q m+1 Q m -βm A 1 + β m q m Q m Q m+1 A 2 +ψ m m-1 s=0 m -1 s (-1) s 1 a + 1 , (28)
where A 1 and A 2 are given by x s s! , Δ ≥ 50, 11 and E 1 (•) is the exponential integral function [26]. For comparison purposes, the closed-form expression for the lower bound on ergodic secrecy rate, i.e., E[ Ȓm s ], is given in (31).

A 1 ≈ Q m+1 Q m βm m-1 s=0 m -1 s (-1) s a 1 a + 1 - β m q m Q m Q m+1 e a+1 Qm E i - a + 1 Q m , (29)
A 2 ≈ Q m+1 Q m βm m-1 s=0 m-1 s (-1) s e a Qm e 1 Qm × E 1 a + 1 Q m -e -1 Qm E 1 a Q m - β m q m Q m Q m+1 e 1 Qm × r -ln (Q m ) + E 1 1 Q m E 1 a Q m + 1 2 ζ(2)+ r+ln a Q m 2 +e -a Qm Δ δ=0 e δ a Qm (δ + 1) 2 × - 1 a δ+1 - a Q m 3 F 3 1, 1, 1 2, 2, 2 ; - a Q m . (30
E[ Ȓm s ] = ψ m ln 2 m s=0 m s (-1) s 1 a -e a Qm E i - a Q m +e a Q m+1 E i - a Q m+1 + m-1 s=0 m -1 s (-1) s 1 a(a + 1) × -e a+1 Q m+1 E i - a + 1 Q m+1 +e a+1 Qm E i - a + 1 Q m . (31)
Proof: See Appendix E.

We will demonstrate the validity of the derived analytical closed-forms in Section IV. Furthermore, in the following lemma, we explore the impact of ρ on the proposed lower bounds on the ergodic secrecy rate and the ESR, i.e., E[ Ȓm s ] and Ȇm s , given in ( 24) and ( 28). Proof: See Appendix F. Lemma 1 reveals that if the external eavesdropper has the prior information of the first m-1 users' CSI, the m th user's achievable secrecy rate at high SNRs, no matter delay-guaranteed or delay-unguaranteed, becomes zero. Note that the above analysis is for a constant delay exponent. In simulation results, we will show more results for various delay requirements.

2) Upper Bound on the ESR With an External Eavesdropper: If none of the first m -1 users' information can be decoded when the eavesdropper intends to decode the m th user's message, then we underestimate the decoding ability of the malicious adversary with SIC employed. This may happen if the eavesdropper cannot attain any prior information of the first m -1 users' CSI. Therefore, a lower bound on R (m) e is given by

Ȓ(m) e = log 2 1 + q m |h e | 2 Q 1 |h e | 2 + 1 , 1 ≤ m ≤ M. (32)
Hence, an upper bound on the secrecy rate, i.e., Rm s , can be written as

Rm s = R m -Ȓ(m) e + = log 2 1 + q m |h m | 2 Q m+1 |h m | 2 +1 -log 2 1+ q m |h e | 2 Q 1 |h e | 2 + 1 + = log 2 1+ q m Q m+1 + 1 |hm| 2 -log 2 1 + q m Q 1 + 1 |he| 2 + . (33)
From (33), we can note that log 2 1 +

q m Q m+1 + 1 |hm| 2 ≥ log 2 1 + q m Q 1 + 1 |he| 2 , when |h e | 2 ≤ |h m | 2 . However, when |h e | 2 ≥ |h m | 2 ,
the sign cannot be distinguished. Hence, the upper bound on the ESR for the m th user with an external eavesdropper, i.e., Êm s , can only be obtained numerically, by inserting Rm s into (6). Although the exact analytical closed-form for the proposed upper bound on the ESR is not available, the following lemma is provided to explore the impact of ρ on the upper bounds on the ergodic secrecy rate and the ESR, i.e., E[ Rm s ] and Êm s .

Lemma 2: When ρ → 0, lim ρ→0 E[ Rm s ] = 0, lim ρ→0 Êm s = 0. When ρ → ∞, lim ρ→∞ E[ Rm s ] = lim ρ→∞ Êm s = log 2 Q m Q m+1 Q 1 Q 1 + q m .
Proof: See Appendix G. Lemma 2 reveals that if the malicious adversary cannot decode any of the first m -1 users' information, the m th user can always achieve constant positive secrecy rates at high SNRs, for both delay-guaranteed and delay-unguaranteed, and the values depend on power coefficients. This result is in agreement with previous analyses in [10] which demonstrated that the secrecy rate in wireless multiuser networks reduces to finite asymptotic value at high SNRs.

IV. NUMERICAL RESULTS

The accuracy of the derived analytical closed-forms and the theoretical analysis given in Section III will be numerically validated in this section. Further, the impact of the delay requirements, the size of the NOMA set and the transmit SNR on the secrecy rate and the ESR will be examined as well, by assuming that a passive internal eavesdropper or an external eavesdropper exists. It is assumed that the bandwidth B = 100 kHz, the fading-block length T f = 0.01 ms, the power coefficients are given as γ i = M-i+1 μ and μ is to ensure M i=1 γ i = 1 [23], unless otherwise indicated. Note that a fixed power coefficient setting is adopted in this paper. This is because the main aim of this paper is to provide analytical results and reveal some insights about the delay-guaranteed secrecy rate. In future work, we will consider applying optimal power allocation to improve the system performance through optimally allocating available resources.

Suppose that there is an internal eavesdropper among all NOMA users. To validate the correctness of the analytical closed-form for lim To plot this figure, it is assumed that the power coefficient is set to γ M = 0.1 and the delay QoS exponent to θ M = 0.01. Specifically, the solid lines in Fig. 1 are obtained using Monte Carlo simulations, and the dashed lines are plotted using the closed-form expression, given in (15). From this figure, one can first notice that the proposed closed-form expression is accurate, because the Monte Carlo results at high SNRs converge to the analytical closed-form. Furthermore, at high SNRs, the value of E M s achieved with a larger M is smaller than those obtained with smaller values of M . This indicates that for a larger set of NOMA users, the delay-guaranteed maximum arrival rate that can be served by the strongest user decreases, in the presence of an internal eavesdropper. The reason is that in this case, the second best NOMA user, i.e., the internal eavesdropper, has a high probability of having similar channel conditions with the M th user. Since our analysis in Section III-A show that the M th user's ESR at high SNRs depends on the ratio of channel gains between the M th user and the internal eavesdropper. Hence, we can expect that when the number of NOMA users increases, the M th user will achieve smaller E M s values in the high SNR regime. Note that Fig. 1 is plotted by setting a fixed power coefficient for the strongest user, i.e., γ M = 0.1. What if the power coefficient γ M is a value which depends on M ? To explore the influence of power coefficients, Fig. 2 is depicted which include the curves of E M s versus the transmit SNR, with two different power coefficient settings considered. The solid lines show the curves by applying a fixed power coefficient setting, while the dashed lines are plotted for the varied power coefficient setting given in [23]. This figure first indicates that for fixed values of ρ and M , the E M s obtained with γ M = 0.1 is larger than the one obtained with a varied power setting. Further, for a larger value of M , the gap between the solid line and the dashed line is larger. This is due to the fact that by adopting the varied power coefficient setting in [23], γ M reduces with M , which results in a smaller E M s . Fig. 2 also indicates that for a fixed M , both of the two E M s curves, obtained with different power coefficient settings, converge to the same maximum limit at high SNRs. This numerically validates Theorem 3 in Section III-A, which proves that lim ρ→∞ E M s approaches a constant value, irrespective of the power coefficients.

Recall that for the adopted link-layer channel model, i.e., the theory of EC, the delay exponent θ M represents the exponential decay rate of the M th user's delay violation probability. With a smaller θ M , it indicates a slower decay rate, which allows a looser delay guarantee. Meanwhile, a more stringent delay provisioning can be represented by a larger θ M [6]. Hence, we depict Fig. 3 which plots E M s and E[R M s ] versus θ M , for different values of ρ, so that the impact of θ M can be investigated. The solid lines are plotted for E M s , while the dash-dotted lines are plotted for E[R M s ]. All solid lines and the dash-dotted lines are simulated using Monte Carlo method. Furthermore, the dashed line in this figure is plotted using the analytical closed-form for lim ρ→∞ E M s , given in (15). Firstly, Fig. 3 shows that for a fixed ρ, the value of E M s decreases with θ M , and approaches 0 when the value of θ M becomes very large. This confirms the monotonicity proof given in Theorem 1, which indicates that, a user with a stringent delay requirement will have to settle for a smaller delay-guaranteed secrecy rate, compared to one with a loose delay constraint. To the best of our knowledge, it is the first time that a delay-constrained secrecy rate analysis has been performed and the trade-off between them is discussed for a NOMA network. Furthermore, Fig. 3 also shows that when θ M → 0, the E M s value matches with the ergodic secrecy rate E[R M s ]. This validates the theoretical conclusion proposed in Theorem 1, which proves that the ESR converges to the ergodic secrecy rate, when there is no delay constraint. Finally, from Fig. 3, we can also notice that when the transmit SNR ρ becomes larger, E M s gradually increases and approaches the analytical limit, i.e., the dashed line.

Suppose that there is an external eavesdropper distinct from the set of NOMA users. Fig. 4 plots the ESR for the m th user, i.e., E m s , versus ρ, for different values of M . This figure aims to investigate the influence of the size of the NOMA user set on the m th user's ESR. To plot this figure, we assume that the eavesdropper intends to decode the 4 th user's messages, i.e., m = 4. From Fig. 4, it is noted that when ρ increases, the value of E m s first increases, then becomes stable at high SNRs. Further, when M becomes larger, E m s reduces, which shows the same trend with Fig. 1. This indicates that when the size of the NOMA user set increases, the delay-guaranteed maximum arrival rate that can be securely served decreases, when there exists an external eavesdropper. Contrary to previous work [10] with multiple users in which only the best user can be served by the BS, in a NOMA network with power settings given in [23], increasing M will reduce the power available to each NOMA user, thus causing a decrease on the secrecy rate and the ESR.

To investigate the ESR for different users with various delay requirements, Fig. 5 plots the curves of E m s versus the transmit SNR, for various settings of m and θ m . This figure first shows that for a larger value of m, the E m s value is larger. This indicates that when there is an external eavesdropper, the user with stronger channel conditions can achieve a higher delayguaranteed rate. Furthermore, Fig. 5 also shows that for a specific user, the E m s obtained with θ m → 0 is larger than the one achieved with θ m = 1. This is because the scenario of θ m → 0 represents a no-delay-guaranteed situation, in which the delay violation probability approaches 1. Fig. 5 further shows that the gap of the E m s values between θ m = 1 and θ m → 0 is larger for a larger value of m. This implies that a user with higher channel gains will have to make more sacrifices on its ESR value, so that the required statistical delay constraint can be satisfied.

In Section III-B.1, we proposed and analyzed a lower bound on the ESR for the m th user, denoted as Ȇm s , by overestimating the decoding capability of the external eavesdropper. Here, we include Fig. 6 which plots the curves of E m s (in solid lines) and the lower bound Ȇm s (in dashed lines) versus θ m , for different values of ρ. To plot this figure, it is assumed that there are 8 NOMA users in total, i.e., M = 8, and the external eavesdropper intends to decode the 6 th user's messages, i.e., m = 6. All curves shown in this figure are obtained using Monte Carlo simulation results. From Fig. 6, we first notice that both E m s and Ȇm s decrease with θ m , which indicates that with an external eavesdropper existing, the achievable delay-guaranteed secrecy rate becomes smaller, when the user's delay requirement becomes more stringent. This numerically confirms the theoretical analysis given in Theorem 1. Furthermore, Fig. 6 shows that the proposed lower bound Ȇm s serves as a good lower bound for small SNR regime, and with the decrease of ρ, the gap between E m s and Ȇm s reduces. To validate the accuracy of the closed-form expression for Ȇm s , we include Fig. 7 which shows Ȇm s versus ρ, for various values of θ m . The solid lines are plotted using the Monte Carlo results, while the dashed lines are shown using the γ i is satisfied. Fig. 7 first shows that when the transmit SNR gradually increases, the analytical closed-form results match with the Monte Carlo results, which confirms the validity of the derived closed-form at high SNRs. Furthermore, both the analytical and simulation results approach 0, at high SNRs. This confirms Lemma 1 in Section III-B.1.

In Section III-B.2, by underestimating the external eavesdropper's decoding capability, we proposed an upper bound on the ESR for the m th user, denoted as Êm s . To confirm the validity of the upper bound and to further investigate, Fig. 8 is plotted which includes the simulated E m s values (in solid lines) and the upper bound Êm s (in dashed lines) versus θ m , for different values of ρ. Similar to Fig. 6, Fig. 8 also shows that both the E m s and the upper bound Êm s decrease with θ m . This is due to the fact that with a larger θ m indicating a more stringent statistical delay guarantee, the maximum achievable arrival rate which can be securely supported becomes smaller [6]. Furthermore, Fig. 8 also shows that the proposed Êm s can serve as a good upper bound, for relatively small transmit SNR values.

V. CONCLUSION

The delay-guaranteed secrecy rate, namely, ESR, has been introduced and investigated for a downlink NOMA network; ESR represents the maximum constant arrival rate which can be securely served by a legitimate user, while guaranteeing the required statistical delay constraints. Two eavesdropping scenarios have been considered: a purely antagonistic network with an unknown internal eavesdropper and a trustworthy NOMA network with an external eavesdropper. Assuming an internal eavesdropper exists, a closed-form expression for the ESR at high SNRs has been derived for the strongest user, which is the only user guaranteed to have a positive ESR in this case. Assuming that an external eavesdropper exists and has interest in jeopardizing the security of the network, a lower bound and an upper bound on the ESR have been proposed, respectively, and have been shown to be tight in the low SNR regime. Simulation results have shown that for both eavesdropping scenarios, a user with a stringent delay requirement serves a smaller amount of ESR, comparing to those with relatively loose delay constraints. Further, it has been shown that a legitimate NOMA user with higher channel gains will make greater sacrifices on its ESR value, so that a required statistical delay guarantee can be satisfied.

APPENDIX A PROOF FOR THEOREM 1

Recall that the ESR for the m th user, i.e., E m s , is calculated by inserting the achievable secrecy rate R m s into (6), which is then given by

E m s = - 1 θ m T f B ln E e -θmTfBR m s . (34)
Note that e -θmTfBR m s is a log-convex function in θ m because ln e -θmTfBR m s = -θ m T f BR m s is a convex function in θ m [29]. Since the log-convexity still holds under summations, therefore we could conclude that E e -θmTfBR m s is also a log-convex function in θ m . Hence, it is clear that ln E e -θmTfBR m s is convex, which means ln E e -θmTfBR m s is a concave function in θ m .

We rewrite E m s as f (θm) g(θm) , where f (θ m ) = ln E e -θmTfBR m s and g(θ m ) = θ m T f B. In order to prove that E m s is a monotonically decreasing function in θ m , we take the first derivative of E m s , which gives

∂E m s ∂θ m = f (θ m ) g(θ m ) = f (θ m )g(θ m ) -g (θ m )f (θ m ) (g(θ m )) 2 . (35)
Apparently, the denominator is a non-negative value. Let us consider the numerator only. We take the first derivative of the denominator and it gives

(f (θ m )g(θ m ) -g (θ m )f (θ m )) = f (θ m )g(θ m ) -g (θ m )f (θ m ), (36)
which can be simplified as f (θ m )g(θ m ) because g (θ m ) = 0. Since we have proved that f (θ m ) is a concave function, i.e., f (θ m ) ≤ 0, and also g(θ m ) ≥ 0, therefore it can be concluded that the numerator in ( 35) is a nonincreasing function. Furthermore, it is easy to see that the numerator in (35) equals to 0 when θ m = 0, i.e., f (θ m )g(θ m )g (θ m )f (θ m )| θm=0 = 0. Finally, we can conclude that ∂E m s ∂θ m ≤ 0, which implies that E m s monotonically decreases with θ m . 12When θ m → 0, we can obtain that

lim θm→0 E m s = lim θm→0 - E e -θmTfBR m s T f BE [e -θmTfBR m s ] (37) = lim θm→0 - E e -θmTfBR m s (-T f BR m s ) T f BE [e -θmTfBR m s ] (38) = E [R m s ] . (39)
Hence, this proves that when θ m → 0, E m s converges to the ergodic secrecy rate E [R m s ]. When θ m → ∞, from (5), one can note that the probability of the delay exceeding a given delay bound approaches zero. It means that the user cannot tolerate any delay outage, which refers to the delay-limited scenario. According to [30], it shows that Rayleigh channel cannot support very stringent delay QoS requirement (when θ is extremely large), even using the optimal power policy. Our simulation results also confirm that the ESR becomes zero in this case.

APPENDIX B PROOF FOR THEOREM 2

According to the theory of order statistics and by inserting (10) into ( 9), E M s can be written as

E M s = 1 β M log 2 M (M -1) ∞ 0 ∞ x 1 + q M y 1 + q M x βM ×f (x) (F (x)) M-2 f (y) dy dx = 1 β M log 2 M (M -1) ∞ 0 1 1 + q M x βM e -x × 1 -e -x M-2 ∞ x (1 + q M y)
βM e -y dy dx . ( 40)

Consider E 1 sc = ∞ x (1 + q M y) βM e -y dy first. By setting z 1 = 1 qM + y, E 1 sc can be transformed into E 1 sc = q βM M e 1 q M ∞ 1 q M +x z βM 1 e -z1 dz 1 . Then, from (3.381.6) in [31], we note that ∞ u e -x x v dx = u -v 2 e -u 2 W -v 2 , 1-v 2 (u) [u > 0], (41)
where W k,μ (z) is the Whittaker W function [26]. By applying ( 41), E 1 sc can be given as

E 1 sc = q βM M e 1 q M 1 q M +x β M 2 e -1 2q M -x 2 W β M 2 , 1+β M 2 1 q M +x . (42)
Finally, by inserting E 1 sc into ( 40), E M s can be given as

E M s = 1 β M log 2 M (M -1)q β M 2 M e 1 2q M ∞ 0 (1 + q M x) -β M 2 × e -3 2 x 1 -e -x M-2 W β M 2 , 1+β M 2 1 q M + x dx = A M + 1 β M log 2 ∞ 0 (1 + q M x) -βM e -x × 1 -e -x M-2 Γ 1 + β M , 1 q M + x dx , (43)
where

A M = 1 βM log 2 M (M -1)q βM M e 1 q M
, and Γ(•, •) is the incomplete Γ function. Making use of the Binomial theorem we have that

(1 -e -x ) M-2 = M-2 ν=0 M -2 ν (-1) ν e -νx , (44)
so that the following integral appears

∞ 0 (1 + q M x) -βM e -(ν+1)x Γ 1 + β M , 1 q M + x dx = ∞ 1/qM (q M z) -βM e -(ν+1)(z-1 q M ) Γ(1 + β M , z) dz (45a) = q -βM M e ν+1 q M ∞ 1/qM z -βM e -(ν+1)z Γ(1 + β M , z) dz, (45b) by change of variable z = x + 1 qM . We set I ν = ∞ 1/qM z -βM e -(ν+1)z Γ(1 + β M , z) dz, so that E M sc = B M + 1 β M log 2 M-2 ν=0 M -2 ν (-1) ν e ν q M I ν , (46)
where

B M = log 2 (M(M-1))+2q -1 M βM .
To evaluate I ν we will use the following property

x b Γ(s, x) dx = 1 b+1
x b+1 Γ(s, x)-Γ(s + b + 1, x) , (47) and note that the limit of the right-hand side (RHS) for x → ∞ is 0. To have only powers of z in I ν , we resort in using the Taylor series expansion for the exponential function e

-(ν+1)z = ∞ k=0 (-1) k (ν+1) k z k k!
. Hence, I ν becomes

I ν = ∞ k=0 (-1) k (ν + 1) k k! ∞ 1 q M z k-βM Γ (1 + β M , z) dx = - ∞ k=0 (-1) k k! (ν + 1) k k -β M + 1 1 q M k-βM +1 ×Γ 1+β M , 1 q M -Γ 1+β M +k-β M +1, 1 q M = ∞ k=0 (-1) k k! (ν + 1) k k -β M + 1 Γ k + 2, 1 q M - 1 q M k-βM +1 Γ 1 + β M , 1 q M , (48)
and finally

E M sc = B M + 1 β M log 2 M-2 ν=0 M -2 ν (-1) ν e ν q M × ∞ k=0 (-1) k k! (ν + 1) k k -β M + 1 Γ k + 2, 1 q M - 1 q M k-βM +1 Γ 1 + β M , 1 q M . (49)
APPENDIX C

PROOF FOR THEOREM 3

By applying the theory of order statistics and inserting (10) into ( 14), the M th user's ESR at high SNRs can be given by

lim ρ→∞ E M s = 1 β M log 2 M (M -1) ∞ 0 ∞ x y x βM ×f (x) (F (x)) M-2 f (y) dy dx (50a) = 1 β M log 2 M (M -1) ∞ 0 1 x βM e -x 1 -e -x M-2 × ∞ x
y βM e -y dy dx .

Then, by applying ( 41) to (50b), one can get that

lim ρ→∞ E M s = 1 β M log 2 M (M -1) ∞ 0 1 x βM e -x × 1 -e -x M-2 x β M 2 e -x 2 W β M 2 , 1+β M 2 (x) dx . (51)
Further, by using the binomial expansion and expanding

(1 -e -x ) M-2 as M-2 s=0 M-2 s
(-1) s e -xs , (51) can be transformed into

lim ρ→∞ E M s = 1 β M log 2 M (M -1) M-2 s=0 M -2 s (-1) s × ∞ 0 x -β M 2 e -( 3 2 +s)x W β M 2 , 1+β M 2 (x) dx . (52)
From (13.23.4) in [26], we note that

∞ 0 e -zt t w-1 W k,μ (t) dt = Γ 1 2 + μ + w Γ 1 2 -μ + w × 2 F 1 1 2 -μ + w, 1 2 + μ + w w -k + 1 ; 1 2 -z × Re w + 1 2 > |Re(μ)|, Re(z) > - 1 2 , (53)
where 2 F 1 a, b c ; z is the generalized hypergeometric function, and Γ(•) is the gamma function. By applying (53) to (52), the closed-form expression for lim ρ→∞ E M s can be finally expressed as

lim ρ→∞ E M s = 1 β M log 2 M (M -1)Γ(1 -β M ) × M-2 s=0 M -2 s (-1) s 2 F 1 1 -β M , 2 2 -β M ; -1 -s .
Then, for comparison purposes, here we derive the closedform expression for the ergodic secrecy rate for the M th user at high SNRs, i.e., lim

ρ→∞ E[R M s ]
. Firstly, we note that

lim ρ→∞ E[R M s ] = E log 2 |hM | 2 |hM-1| 2
, which can be expanded as follows, after inserting the joint PDF (10).

lim ρ→∞ E[R M s ] = M (M -1) ∞ 0 ∞ x log 2 y x e -x
×(1e -x ) M-2 e -y dy dx.

By defining z 0 = y x and 1 ≤ z 0 ≤ ∞, (54) can be rewritten as

lim ρ→∞ E[R M s ] = M (M -1) ∞ 0 xe -x (1 -e -x ) M-2 × ∞ 1 log 2 (z 0 )e -xz0 dz 0 dx (55)
= M (M -1) ln 2 ∞ 0 xe -x (1 -e -x ) M-2 × ∞ 1 ln(z 0 )e -xz0 dz 0 dx. (56)
From (4.331.2) in [31], we have that

∞ 1 e -μx ln x dx = - 1 μ E i (-μ), Re μ > 0. (57)
By applying (57), we get that

lim ρ→∞ E[R M s ] = M (M -1) ln 2 M-2 s=0 M -2 s (-1) s × ∞ 0 e -(s+1)x E 1 (x) dx, (58)
obtained after using

(1 -e -x ) M-2 = M-2 s=0 M-2 s (-1) s e -xs and E i (-x) = -E 1 (x), for x > 0. From (4.2.3) in [32], we have that ∞ 0 e -ax E 1 (bx) dx = 1 a ln 1 + a b . (59)
Hence, by applying (59), we finally obtain the close-form expression for the ergodic secrecy rate at high SNRs, given as

lim ρ→∞ E[R M s ] = M (M -1) × M-2 s=0 M -2 s (-1) s 1 s + 1 log 2 (s + 2) . (60)
APPENDIX D PROOF FOR THEOREM 4

By inserting the joint PDF f (z 1 , z 2 ) into ( 20), E m cs is given by

E m cs = 1 β m log 2 ∞ 0 ∞ 0 Q m z 1 + 1 Q m+1 z 1 + 1 × (Q ME +1 -q m ) z 2 + 1 Q ME +1 z 2 + 1 βm f (z 1 , z 2 ) dz 1 dz 2 . (61)
Here

, f (z 1 , z 2 ) = f (m) (z 1 )f (z 2 ), where f (m) (z 1 ) = ψ m f (z 1 )F (z 1 ) m-1 (1 -F (z 1 )) M-m , f (z 1 ) = e -z1 , F (z 1 ) = 1 -e -z1
, and f (z 2 ) = e -z2 . Then, E m cs can be extended as we can get that

E m cs = 1 β m log 2 ψ m ∞ 0 (Q ME +1 -q m ) z 2 + 1 Q ME +1 z 2 + 1 βm e -z2 × ∞ 0 Q m z 1 + 1 Q m+1 z 1 + 1 βm e -(M-m+1)z1 × 1 -e -z1 m-1 dz 1 dz 2 . ( 62
E m cs = 1 β m log 2 ψ m ∞ 0 (Q ME +1 -q m ) z 2 + 1 Q ME +1 z 2 + 1 βm e -z2 × m-1 s=0 m -1 s (-1) s ∞ 0 Q m z 1 + 1 Q m+1 z 1 + 1 βm ×e -az1 dz 1 dz 2 . (63)
To simplify the above equation, we define A D1 and A D2 as follows and E m cs can be written as

E m cs = 1 β m log 2 (ψ m A D1 A D2 ) , (64a)
A D1 = m-1 s=0 m-1 s (-1) s ∞ 0 Q m z 1 +1 Q m+1 z 1 +1 βm e -az1 dz 1 , (64b)
A D2 = ∞ 0 (Q ME +1 -q m ) z 2 + 1 Q ME +1 z 2 + 1 βm e -z2 dz 2 . ( 64c
)
Let us focus on A D1 first. It can be further expressed as

A D1 = Q m+1 Q m -βm ∞ 0 m-1 s=0 m -1 s (-1) s × 1 + qm Qm+1 Q m z 1 + 1 -βm e -az1 dz 1 . (65a)
By assuming that q m ≤ Q m+1 , where m = {M -1, M},

1 + qm Q m+1

Qmz1+1

-βm can be approximated using the first two terms of generalized binomial expansion. Then, (65a) can be approximated as:

A D1 ≈ Q m+1 Q m -βm ∞ 0 m-1 s=0 m -1 s (-1) s e -az1 dz 1 - β m q m Q m+1 m-1 s=0 m -1 s (-1) s ∞ 0 e -az1 Q m z 1 + 1 dz 1 . (66)
From (3.352.4) in [31], we have that

∞ 0 e -μx x+β dx = -e βμ E i (-μβ), |argβ| < π, Re μ> 0. (67)
Then, by applying (67), A D1 becomes

A D1 ≈ Q m+1 Q m -βm m-1 s=0 m -1 s (-1) s 1 a + β m q m Q m+1 Q m × m-1 s=0 m -1 s (-1) s e a Qm E i - a Q m . (68)
Then, we can start to consider A D2 , which can be expressed as

A D2 = Q ME +1 -q m Q ME +1 βm ∞ 0 1 + qm QM E +1-qm Q ME +1 z 2 + 1 βm ×e -z2 dz 2 (69)
≈ Q ME+1 -q m Q ME+1 βm ∞ 0 e -z2 dz 2 + β m q m Q ME +1 -q m × ∞ 0 e -z2 Q ME +1 z 2 + 1 dz 2 (70)
≈ Q ME +1 -q m Q ME +1 βm 1 - β m q m (Q ME +1 -q m ) Q ME +1 ×e 1 Q M E +1 E i - 1 Q ME+1 . (71)
Finally, by inserting A D1 and A D2 into (64a), the E m cs for the m th user is given by (22).

At high SNRs, for the m th user with m ≥ M E +1, lim ρ→∞ E m cs is given by

lim ρ→∞ E m cs = 1 β m log 2 E Q m Q m+1 Q ME +1 -q m Q ME +1 βm = log 2 Q m Q m+1 Q ME +1 -q m Q ME +1 . (72)
APPENDIX E PROOF FOR THEOREM 5

Recall that Ȇm s can be expressed as

Ȇm s = 1 β m log 2 (B D1 + B D2 ) , (73)
where

B D1 = ψ m D1 Q m z 1 + 1 Q m+1 z 1 + 1 Q m+1 z 2 + 1 Q m z 2 + 1 βm × e -(M-m+1)z1-z2 (1 -e -z1 ) 1-m dz 1 dz 2 , (74a)
B D2 = ψ m D2
e -(M-m+1)z1 1e -z1 m-1 e -z2 dz 1 dz 2 . (-1) s e -z1s , we get that

B D2 = ψ m ∞ 0 e -z2 z2 0 m-1 s=0 m -1 s (-1) s e -az1 dz 1 dz 2 (75a) = ψ m m-1 s=0 m-1 s (-1) s - 1 a ∞ 0 e -z2 e -az2 -1 dz 2 (75b) = ψ m m-1 s=0 m -1 s (-1) s 1 a + 1 . (75c)
Then, we can consider B D1 . Let us define BB D1 (z 2 ) and rewrite B D1 as follows:

B D1 = ψ m ∞ 0 Q m+1 z 2 +1 Q m z 2 +1 βm e -z2 BB D1 (z 2 ) dz 2 , (76a) BB D1 (z 2 ) = ∞ z2 Q m z 1 + 1 Q m+1 z 1 + 1 βm e -(M-m+1)z1 × 1 -e -z1 m-1 dz 1 , (76b)
where BB D1 (z 2 ) can be written as

BB D1 (z 2 ) = Q m+1 Q m -βm m-1 s=0 m -1 s (-1) s × ∞ z2 1 + qm Qm+1 Q m z 1 + 1 -βm e -az1 dz 1 . (77) By assuming that q m ≤ Q m+1 , where m = {M -1, M}, 1 + qm Qm+1 Q m z 1 + 1 -βm
can be approximated using the first two terms of generalized binomial expansion. Then, (77) can be approximated as

BB D1 (z 2 ) ≈ Q m+1 Q m -βm m-1 s=0 m -1 s (-1) s × ∞ z2 e -az1 dz 1 - β m q m Q m+1 ∞ z2 e -az1 Q m z 1 + 1 dz 1 . (78)
From (3.352.2) in [31], we have that

∞ u e -μx x + β dx = -e βμ E i (-μu -μβ), u ≥ 0, |arg(u + β)| < π, Re μ > 0. (79)
Then, BB D1 (z 2 ) can be finally approximated as

BB D1 (z 2 ) ≈ Q m+1 Q m -βm m-1 s=0 m -1 s (-1) s × e -az2 a + β m q m Q m Q m+1 e a Qm E i -az 2 - a Q m . (80)
By inserting BB D1 (z 2 ) back into B D1 , we get ( 81), shown at the top of the next page. To simplify, (81) can be rewritten as

B D1 = ψ m Q m+1 Q m -βm A 1 + β m q m Q m Q m+1 A 2 . ( 82
)
Let us consider A 1 first.

A 1 = Q m+1 Q m βm m-1 s=0 m -1 s (-1) s a × ∞ 0 1 + qm Qm+1 Q m z 2 + 1 βm e -(a+1)z2 dz 2 , ≈ Q m+1 Q m βm m-1 s=0 m -1 s (-1) s a × ∞ 0 e -(a+1)z2 dz 2 + β m q m Q m+1 ∞ 0 e -(a+1)z2 Q m z 2 + 1 dz 2 , (83)
which is approximated by applying the first two terms of the generalized binomial expansion. By applying (3.352.4) in [31], given in (67), we can get that

A 1 ≈ Q m+1 Q m βm m-1 s=0 m -1 s (-1) s a × 1 a + 1 - β m q m Q m Q m+1 e a+1 Qm E i - a + 1 Q m . (84)
Now we can start to work on A 2 . Recall that

A 2 = Q m+1 Q m βm m-1 s=0 m -1 s (-1) s e a Qm × ∞ 0 1+ qm Qm+1 Q m z 2 + 1 βm e -z2 E i -az 2 - a Q m dz 2 . ( 85
) in which 1 + qm Qm+1 Q m z 2 + 1
βm can be approximated using the first two terms of the generalized binomial expansion. Then, A 2 can be transformed into

A 2 ≈ Q m+1 Q m βm m-1 s=0 m -1 s (-1) s e a Qm × ∞ 0 e -z2 E i -az 2 - a Q m dz 2 + β m q m Q m+1 ∞ 0 1 Q m z 2 +1 e -z2 E i -az 2 - a Q m dz 2 . (86)
B D1 = ψ m Q m+1 Q m -βm ⎛ ⎜ ⎜ ⎜ ⎜ ⎝ m-1 s=0 m -1 s (-1) s a ∞ 0 Q m+1 z 2 + 1 Q m z 2 + 1 βm e -(a+1)z2 dz 2 A1 + β m q m Q m Q m+1 × m-1 s=0 m -1 s (-1) s e a Qm ∞ 0 Q m+1 z 2 + 1 Q m z 2 + 1 βm e -z2 E i -az 2 - a Q m dz 2 A2 ⎞ ⎟ ⎟ ⎟ ⎟ ⎠ , (81)
By setting y = az 2 + a Qm and a Qm ≤ y ≤ ∞, A 2 can be rewritten as

A 2 ≈ Q m+1 Q m βm m-1 s=0 m -1 s (-1) s e a Qm × - 1 a e 1 Qm ∞ a Qm e -1 a y E 1 (y) dy - β m q m Q m Q m+1 e 1 Qm ∞ a Qm e -1 a y E 1 (y) 1 y dy . (87)
From (4.2.1) in [32], we have that

e -ux E 1 (vx) dx = 1 u E 1 ((u+v)x)-e -ux E 1 (vx) . (88)
By applying (88), we get that

∞ a Qm e -1 a y E 1 (y) dy = -a E 1 a + 1 Q m -e -1 Qm E 1 a Q m . (89)
Further, from (4.2.29) in [32], we have that

∞ c e -ux E 1 (vx) 1 x dx = (r + ln(uc) + E 1 (uc)) E 1 (vc) + 1 2 ζ(2)+(r+ln(vc)) 2 +e -vc ∞ δ=0 e δ (vc) (δ + 1) 2 - u v δ+1 + ∞ δ=1 (-vc) δ δ!δ 2 . ( 90
)
By applying (90), we get that

∞ a Qm e -1 a y E 1 (y) 1 y dy = r -ln (Q m ) + E 1 1 Q m ×E 1 a Q m + 1 2 ζ(2) + r + ln a Q m 2 +e -a Qm ∞ δ=0 e δ a Qm (δ + 1) 2 - 1 a δ+1 + ∞ δ=1 -a Qm δ δ!δ 2 . ( 91
)
For simplicity, we define two notations, i.e.,

Ψ 1 = ∞ δ=0 e δ a Qm (δ + 1) 2 - 1 a δ+1 and Ψ 2 = ∞ δ=1 -a Qm δ δ!δ 2 .
In the following, we will show that both infinite summations, i.e., Ψ . One can easily show that Ψ 1 can be approximated using a finite summation, which converges for any values as long as Δ ≥ 50. Furthermore, by applying the definition of generalized hypergeometric function [26], we can replace

Ψ 2 with - a Q m 3 F 3 1, 1, 1 2, 2, 2 ; - a Q m .
Henceforth, A 2 can be finally expressed as

A 2 ≈ Q m+1 Q m βm m-1 s=0 m-1 s (-1) s e a Qm e 1 Qm × E 1 a + 1 Q m -e -1 Qm E 1 a Q m - β m q m Q m Q m+1 e 1 Qm × r-ln(Q m ) + E 1 1 Q m E 1 a Q m + 1 2 ζ(2) + r + ln a Q m 2 + e -a Qm ∞ δ=0 e δ a Qm (δ + 1) 2 × - 1 a δ+1 - a Q m 3 F 3 1, 1, 1 2, 2, 2 ;- a Q m . (92)
By inserting A 1 , A 2 , and B D2 into (73), Ȇm s can be finally given in ( 28)- (30).

Then, we can start to derive the closed-form expression for E[ Ȓm s ], given in ( 93), shown at the top of the next page. Since B 1 -B 4 have similar structures, here we only show the steps of deriving B 1 for simplicity.

B 1 = ψ m ∞ 0 log 2 (Q m z 1 + 1) e -(M-m+1)z1 1 -e -z1 m-1 × z1 0 e -z2 dz 2 dz 1 (94a) = ψ m ∞ 0 log 2 (Q m z 1 +1) e -(M-m+1)z1 1 -e -z1 m dz 1 (94b) = ψ m m s=0 m s (-1) s ∞ 0 log 2 (Q m z 1 + 1) e -az1 dz 1 . (94c) E[ Ȓm s ] = D1 log 2 1 + q m z 1 Q m+1 z 1 + 1 -log 2 1 + q m z 2 Q m+1 z 2 + 1 f (z 1 , z 2 ) dz 1 dz 2 = D1 log 2 (Q m z 1 + 1) f (z 1 , z 2 ) dz 1 dz 2 B1 - D1 log 2 (Q m+1 z 1 + 1)f (z 1 , z 2 ) dz 1 dz 2 B2 - D1 log 2 (Q m z 2 + 1)f (z 1 , z 2 ) dz 1 dz 2 B3 + D1 log 2 (Q m+1 z 2 + 1)f (z 1 , z 2 ) dz 1 dz 2 B4 . (93)
By defining Q m z 1 = x, B 1 can be transformed to

B 1 = ψ m 1 Q m m s=0 m s (-1) s ∞ 0 log 2 (x + 1) e -a Qm x dx. (95)
From (4.337.2) in [31], we have that

∞ 0 e -ux ln(1 + vx) dx = - 1 u e u v E i - u v , |arg v| < π, Re u > 0. (96)
By applying (96), B 1 can be finally written as

B 1 = - ψ m ln 2 m s=0 m s (-1) s 1 a e a Qm E i (- a Q m ). (97)
By following similar methods, B 2 -B 4 can also be expressed in closed-form and finally, E[ Ȓm s ] is given in (31).

APPENDIX F PROOF FOR LEMMA 1

Note that the lower bound on the ergodic secrecy rate, i.e., E[ Ȓm s ], is given by

E[ Ȓm s ] = E log 2 1 + q m |h m | 2 Q m+1 |h m | 2 + 1 -log 2 1 + q m |h e | 2 Q m+1 |h e | 2 + 1 . (98)
By inserting ρ → 0 (which means q m = 0 and Q m+1 = 0) into (98), one can get that E[ Ȓm s ] = 0. Also, by inserting ρ → 0 into (26), we can get that lim

ρ→0 Ȇm s = 0. When ρ → ∞, E[ Ȓm s ] can be approximated as E[ Ȓm s ] = E log 2 1 + q m |h m | 2 Q m+1 |h m | 2 -log 2 1 + q m |h e | 2 Q m+1 |h e | 2 , (99)

Rm

s can be written as

lim ρ→∞ Rm s = log 2 1+ q m Q m+1 -log 2 1+ q m Q 1 + , (100)
which is a positive value. Then, we can get that lim

I. INTRODUCTION

Understanding the popularity characteristics of online content and predicting the future popularity of individual videos are of great importance. They have direct implications in various contexts [1], such as service design, advertisement planning, network management [2], and so on. As an example, an efficient content caching scheme should be popularity-driven [3], meaning that it should incorporate the future popularity of content into the caching decision making. In this framework, novel cache replacement methods that are ''popularity-driven'' have recently

The associate editor coordinating the review of this manuscript and approving it for publication was Jose Saldana .

appeared, e.g., the algorithms proposed in [4], based on learning the popularity of content and using it to determine which content should be retained and which should be evicted from the cache. Other important applications include content delivery networks (CDNs) in which ''analytics-as-a-service'' approaches are employed and information centric networks (ICNs) with emphasis on the Internet of things (IoT) [5].

Higher order moments of the underlying random process are unarguably important for the efficient statistical characterization of content popularity; in particular, ''volatility'' plays a central role in capturing the underlying dynamics of content views. As an example, in caching applications, it has been established in [6] that a major factor greatly impacting efficiency is related to demand volatility; this reflects the fact that files might not be constantly requested following a stationary model, but rather, only be requested once or twice and subsequently exhibit vanishing demand in time (e.g., volatility in YouTube content). Based on these findings, an efficient strategy for resource provisioning should in principle consider not only conditional mean demands but also demand fluctuations, thus avoiding under-provisioning or over-provisioning.

To analyze the underlying statistics of content views data, the latter are typically represented as a time series. Time series data are sequences of measurements over time, describing the behavior of systems. The behavior can change over time due to external events and/or internal systematic changes in dynamics/distribution. Success in revealing such patterns can be translated to the ability to respond rapidly to these changes. In this direction, there has recently been a surge of research in the area of content popularity prediction using artificial intelligence (AI) [7]. In this context, machine learning based methods (e.g., deep learning) need effective feature mining and a huge mass of labeled examples to provide successful performance [8], [9]. In applications in which real time content popularity monitoring is required this might become a challenge. As an example, in [10] the authors propose an off-line deep learning approach to detect popularity that is subsequently integrated into the on-line caching policy in fog radio applications; however, whenever there is an important change in the underlying dynamics of content popularity, it follows that a new off-line training might be required to run the algorithm properly.

In this work, we alternatively turn our attention to lightweight statistical procedures that fall in the general context of AI (instead of deep learning specifically), in order to operate in an on-line manner (real-time) and to keep the size of the required set of historical data as small as possible. Our proposed algorithm is autonomous, in the sense that all its parameters are determined without manual intervention during a training period; furthermore, the training period is limited to only a few hundred data points (instead of thousands or millions as is typical in deep learning).

Importantly, instead of attempting to predict the evolution of content popularity, in this work we rather focus on detecting changes in its underlying statistics, and doing so in real-time. To this end, we propose the use of on-line change point (CP) analysis; to complement our work [11], [12] that focused on the identification of changes in the mean of a time series, here, we alternatively investigate the performance of corresponding on-line algorithms to identify changes in the variance of a time series using CP analysis.

In general, CP methods are either off-line or on-line. Off-line algorithms operate retrospectively and identify CPs in a historical dataset, a thorough study can be found in [13]. On-line algorithms [14] monitor in real time a data sequence and aim to detect CPs as soon as they occur. In this work, we propose an efficient combination of an off-line and various on-line procedures for the detection of changes in the second order statistics of video content popularity, as soon as they occur (real-time). The proposed detector is built upon our earlier proposal for a real-time CP detector of mean changes in data series, that we applied to monitor the average number of video content [11], [12]. Albeit, the monitoring of changes in the variance of a time series is much more challenging.

To further illustrate our motivation behind this work, we note that an overall approach considering both mean and variance changes allows for a more efficient handling of content popularity changes as highlighted in Fig. 1. For example, Fig. 1(a) depicts that a crucial popularity change may affect only the variance parameter, in the specific example at the third segment of the time series. On the other hand, Fig. 1(b), depicts that in the case of a simultaneous change in the mean and the variance, e.g., in the second segment of the time series, the latter is critical to estimate the actual impact of this change. Monitoring the variance may also be used as a measure of uncertainty, determining the degree of fluctuation of popularity around its expectation; for instance, compare the behaviour of the time series in Fig. 1(b) after the first and the second CP (second and third segments of the data series, respectively).

To identify changes in the variance, a more elaborate test statistic is employed in the present study. With respect to [11], [12], we further introduce novel on-line tracking mechanisms based on autoregressive moving average (ARMA) and generalized autoregressive conditional heteroskedasticity (GARCH) models. The most important novel aspects of this paper are listed below:

• We show that variance CP detection is important in the context of content popularity.

• We introduce a relevant on-line detection algorithm, enhanced by the following two mechanisms: (a) an offline CP detection over training data for the estimation of the on-line test parameters; and (b) identification of the change magnitude in the pro-and post-change variance structure.

• Our algorithm supports three alternative on-line tests for content popularity detection -based on ARMA and GARCH models as well as a non-parametric approachcovering a wide-range of time series characteristics.

• We performed experiments both on synthetic and real time series datasets. Our results show that:

(i) the GARCH and the non-parametric approaches perform better when the time series does not follow a linear model; (ii) overall, these approaches can generalize better with respect to the true alarm rates; and (iii) the non parametric approach can identify CPs more rapidly. In future work we intend to expand the algorithm to include additional dimensions that can be volatility indicators, such as the number of likes, viewer comments, content size, as well as network parameters such as the utilization of servers, in order to enhance the agility of the volatility estimation of the so called ''content workload'' as a whole. We will also investigate the algorithm's scalability properties, theoretically and experimentally, i.e., identify the number of videos that can be analyzed in parallel.

The rest of this contribution is structured as follows: In Section II, background concepts and high level properties of the proposed integrated algorithm are discussed. In Section III, the offline training is presented in detail, while Section IV presents three different approaches for the construction of the online test statistic. The integrated algorithms are assessed on synthetic data in Section V and applied to real YouTube content view data in Section VI. Conclusions and discussion on future enhancements are included in Section VII.

II. BACKGROUND CONCEPTS AND INTEGRATED ALGORITHM A. CHANGE POINT ANALYSIS

Change point (CP) detection refers to the problem of identifying data structures that do not correspond to the anticipated ''normal'' behavior. We note that, to the best of our knowledge, this is the first work in the literature proposing an automated mechanism for the detection of volatility changes in a time series in the context of content popularity detection.

The theory of CP analysis is typically pertinent to anomaly detection. In the domain of networking in particular, the theory of CP detection has played an instrumental role in the modelling of network traffic monitoring represented through time series [15] and network anomaly/intrusion detection [16]; for a comprehensive review the interested reader may refer to [17]. In this framework, CP detection techniques [18] are used for the identification of: (i) point anomalies and outliers, i.e., data points deviating distinctively from the bulk of collected data; (ii) pattern anomalies, i.e., groups of data points that are collectively anomalous with respect to historical data; and, (iii) CP anomalies due to changes in the time series's statistical structure (in the mean/variance and in general in the underlying distribution). In this work, we focus on the detection of CP anomalies and consider the other two categories as disturbances. The reasoning behind this choice is that, on one hand, a resource allocation scheduler should be insensitive to instantaneous/very short-term changes in resource demand (e.g., represented as outliers in the content demand), but, on the other hand, should be highly responsive to changes in the underlying statistics of the demand.

Statistical based approaches are categorized as parametric [19] and non-parametric [14]. Non-parametric methods do not make use of a particular time series model fit and apply directly the observed data to the monitoring procedures. In this context, CUSUM based methods are non-parametric by design. For example, the authors in [20] provide a CUSUM stopping rule with application in computer vision problems. A CUSUM approach for CP detection on observations with an unknown distribution before and after a change, has been recently developed in [21]. Furthermore, an algorithm based on the Shiryaev-Roberts procedure was proposed in [22], to detect anomalies in computer network traffic.

On the other hand, parametric methods utilize as inputs values obtained from a specific model that has been fit to the original data (instead of using the original data set directly). As an example, Kalman filtering is combined with several CP methods in [23]. In [24], traffic flows are modeled using Markov chains and an anomaly detection mechanism based on the generalized likelihood ratio test (LRT) algorithm. Further examples assuming specific distribution for the data include [25], in which a bivariate sequential generalized LRT algorithm was proposed, assuming that the packet rate and the packet size follow a Poisson and a normal distribution, respectively. Other, non residual methods, include estimates' detectors based on the differences between the estimated model parameters (see [13], [26]), or based on the quasi-likelihood scores estimators of the parameters of a GARCH process [27].

C. VIDEO CONTENT POPULARITY PREDICTION VS DETECTION

The prediction of video content popularity characteristics and dynamics [28], as well as models to predict popularity evolution, e.g., [29] and [30], is a well studied topic in the literature. Among others, in [31], the authors perform a detailed analysis to characterize the YouTube traffic within a campus network and conclude that in this scenario the content popularity can be well approximated by the Zipf distribution. A comprehensive survey on video traffic models can be found in [32]. Overall, several methods have been proposed in this context, including time series models, regression models [33]- [35] and machine learning (deep neural networks) techniques [36], [37].

Focusing on time series modelling in particular, linear, non linear and hybrid models have invariably been proposed. In early works, linear time series models have been used, e.g., the authors in [38] introduce an ARMA(7, 7) model to describe and predict the daily views of individual videos. Alternatively, in [39], by taking into consideration seasonality, an autoregressive integrated moving average (ARIMA) model is used to forecast the popularity of online content. Other approaches include fractional ARIMA (FARIMA) models, that capture both short-range dependence (SRD) and long-range dependence (LRD) statistical properties [40].

Recently, non linear models have further been proposed to take into account the conditional heteroskedasticity and the conditional volatility of the data series (seen as a stochastic process). In these cases, GARCH models are involved. For example, in the comparative study [41], the authors showed that a hybrid ARIMA/GARCH model was superior to FARIMA and wavelet neural network models, while in [42], a similar hybrid FARIMA/GARCH approach was also introduced. In essence, the existing hybrid models consider the second order characteristics of a time series as a supplementary element to further improve the forecasting or estimation of the content popularity. More precisely, these solutions assume conditional heteroskedasticity for the errors of the ARMA or FARIMA model. An exception can be found in [43], where a video demand predictor forecasts the volatility and correlation of the streaming traffic associated with different videos, based on multivariate GARCH models.

On the other hand, the problem of detecting (i.e., estimating), non-parametrically and in real time, CPs on content popularity sequences, has not been adequately investigated yet. Among of only a handful of related studies, in our previous works [11], [12], [44] we proposed and implemented a real-time, non-parametric and low-complexity video content popularity CP detector (as opposed to predictor) for changes in the mean value of video content popularity. In the present contribution, in contrast to [11], [12], we introduce an innovative online algorithm for the detection of CPs in the second order statistics of content popularity data. We also present an enlarged statistical framework, that includes parametric as well as non-parametric detectors.

Our algorithm can be used as a ''stand alone'' mechanism, but may also be a helpful complementary tool for prediction approaches. With respect to the latter, it can be employed in validating whether assumptions made by a prediction model are still reasonably satisfied, or, whether the prediction model/procedure needs adjustment. Since, data are often influenced by a multitude of external factors, stationarity assumptions cannot be guaranteed over the whole monitoring period, especially for long time ranges.

D. OVERVIEW OF THE PROPOSED INTEGRATED ALGORITHM

We summarize in Fig. 2 the overall algorithm as a flow diagram that links an off-line (training) and an on-line phase, as well as their individual components. Without loss of generality we assume an arbitrary time instance m s as the starting point of a monitoring period. Then, the off-line analysis is applied to the historical (training) data until t = m s , resulting in the division of the data sequence in stable subsequences. The last subsequence is the training sample representing the initial sample of the on-line phase. During the training stage, if a parametric approach is chosen, we estimate the model parameters (e.g., ARMA or GARCH) and any other necessary statistical characteristics that describe the last stable subsequence's (time series) behavior. We note that without having first obtained a statistically robust division of the training sample into stable subsequences, the estimation of a model's parameters could be seriously impacted.

Next, an on-line detector is implemented for a monitoring period t = m s+1 , . . . , m s+l . If a CP is detected at cp * on , the CP magnitude on the data structure is evaluated. The new starting point for the subsequent monitoring window is then set to m s = cp * on +d, where d is a constant specifying a period assuming no change. Alternatively, if no change is detected after l instances, the procedure restarts automatically from the time point m s = m s+l . The reasons behind this choice are twofold. First, to keep the algorithm running over a window of size at most l, in order to keep the computational complexity low (lightweight), as opposed to allowing increasing window sizes. Second, to facilitate the fast responsiveness of the algorithm, as will be demonstrated through numerical examples in Section V. We develop a CP detector that only requires very general sufficient assumptions to be satisfied by the time series of content views. More specifically, we followed the work in [45] in which the authors introduce a non-parametric test statistic that requires only that the time series {X n : n ∈ N} can be approximated, with a distance measure, by an s-dependent r.v. This assumption assures that time series needs not be s-dependent itself. We also note that several popular weak dependent time series models for the description of video views satisfy the above assumption, e.g., ARMA or GARCH models. The exact form of the procedure is given in the quadratic scheme,

TS off N = 1 N S T n ˆ -1 N S n , (3)
with (•) T denoting transposition, and, it converges in distribution asymptotically to,

1 0 B 2 (n)dn, (N → ∞), (4)
where (B(n) : n ∈ [0, 1]) are independent standard Brownian bridges. ( 4) can be used to derive the critical values (cv off ) of the test statistic TS off N by Monte Carlo simulations that approximate the paths of the Brownian bridge on a fine grid. As an example, using this approach, the crossing boundaries of (4) for alarm rates of 5% and 1% can be found to be 1.8 and 2.6, respectively.

The detector S n is a variation of the squared CUSUM method,

S n = 1 √ N n i=1 vech[ Xi X T i ] - n N N i=1 vech[ Xi X T i ] , (5)
where the vech(.) operator denotes the half-vectorization of a matrix (as the covariance matrix is symmetric, half-vectorization contains all the strictly necessary information) and Xi = X i -X N , with X N = 1 N N j=1 X j the sample average.

Since the procedure (3) is non-parametric, the dependence between the observations enters only in the form of the long-run covariance N , expressed as

N = N i=1 Cov(vech[X 0 X T 0 ], vech[X i X T i ]) (6)
To build a consistent estimator of N , denoted by ˆ N , various different approaches exist. This estimation problem is well studied and we focus on the kernel based approach through the use of Newey-West estimator (see [46]),

N = 0 + W w=1 k BT w W + 1 w + T w , (7)
where k BT (.) corresponds to the Bartlett weight, k BT (x) = 1 -|x|, for |x| 1 0, otherwise, (8) and w denotes the empirical auto-covariance matrix for lag w,

w = 1 N N n=w+1 X n -X X n-w -X T . (9)
Following common practice in literature we chose W = log 10 (N ). To summarize, the existence of a CP is announced if TS off N > cv off V and the estimated time of change is,

cp * off = 1 N argmax 1 n N TS off N . (10)
Finally, to face the potential of detecting multiple CPs on the historical data set, we have integrated an extended version of the binary segmentation (BS) algorithm, proposed in [11], to the original test TS off N . The algorithm combines the standard BS and the iterative cumulative sum of squares (ICSS) [47] methods and operates briefly as follows: First, a single CP is searched in the historical sample. In case of no change, the procedure stops and H 0 is accepted. Otherwise, the detected CP is used to divide the time series into two time VOLUME 8, 2020 series in which new searches are performed. The procedure is iterated, until no more CPs are detected. In the last step, we consider the CPs estimated previously in pairs and check if H 0 is still rejected in the segment delimited by each pair. If not, the CPs that fall in the particular segment are eliminated.

IV. ON-LINE METHODS

In this Section we present three alternative on-line approaches and discuss jointly for each one the preparation stage and the corresponding on-line CP detector. The on-line phase is based on the assumption of an homogeneous data sequence of length m ∈ N + , determined by the off-line phase, for which,

σ 2 1 = • • • = σ 2 m . ( 11
)
Our aim is to test if (11) holds as new observations become available in a time real framework. Hence, the statistical problem is formulated as the following hypothesis test,

H 0 : σ 2 1 = • • • = σ 2 m = σ 2 m+1 = • • • , H 1 : σ 2 m+1 = • • • = σ 2 m+l-1 = σ 2 m+l = σ 2 m+l+1 • • • , m, l ∈ N + . (12)
In general, any on-line CP method can be described as a stopping time procedure with stopping time τ (m), τ (m) = min{l ∈ N : TS on (m, l) ≥ b}.

(

) 13
The value of the test statistic TS on (m, l) is calculated online for every l in the monitoring period. The rule stops, and a change is announced, if the test statistic exceeds the boundary function b = cv on g. The critical value cv on is derived from the asymptotic behavior of the detector TS on /g under the null hypothesis, for which Pr (τ (m) < ∞) = α, α ∈ (0, 1) the significance level. We note that γ , γ ∈ (0, 1 2 ] is a sensitivity parameter; the larger the value of γ , the smaller the value of b, which leads to a quicker detection of a potential CP, at the cost of an increase in the false alarm rate.

Below, we consider three on-line CP approaches, based on the general assumptions for the underlying process: i) a non-parametric approach based on [48], denoted by NP; ii) a linear time series (ARMA) approach as in [49], denoted by L; and, iii) a nonlinear time series (GARCH) approach like in [50], denoted by NL. The quantities {TS on , b, cv on , g} will be indexed accordingly.

A. NON-PARAMETRIC (NP) APPROACH

Non-parametric approaches work directly with the observed data and are ideal for datasets with a high degree of model fitting ambiguity. In this framework, in the preparation phase we only compute a particular form of the long-run estimator, avoiding the difficulties related to the estimation of a parametric model. The proposed procedure is applied under the assumption that the observations {X n : n ∈ Z} satisfy the generalized dependence concept of L-2 near epoch dependence (see [51]). Since the test is model-independent, the dependence between observations is captured through the long-run function D n , expressed as

D n := lim n→∞ E 1 n A i A T i , (14)
where A i = i t=1 X 2 t -E X 2 t . We also assume that D n is finite under the H 0 hypothesis, which is necessary for the convergence of the asymptotic null behaviour.

As explained above, the long-run factor is computed in the preparation phase, considering the training sample. For its evaluation we choose the kernel estimation method, as in [52]. More specifically,

Dm = u i=1 u j=1 k BT i -j r Vi V T j , (15)
is an estimator of D m , Vt = 1 √ m X 2 t -1 m m i=1 X 2 i and k BT (•) is the Bartlett kernel, already mentioned in (7).

The test statistic is expressed as

TS on NP (m, l) = l √ m D-1 2 m m+l i=m X 2 i - 1 m m i=1 X 2 i . (16)
The

H 1 + H 1 2 -γ |W (n)| n γ = α. (17)

B. LINEAR (L) PARAMETRIC APPROACH USING AN AUTOREGRESSIVE MOVING AVERAGE (ARMA) MODEL

Parametric approaches, monitor the estimated values obtained from a specific model fit to the observed timeseries. This is very efficient whenever a parametric model sufficiently describes the dependence structure of the real data. We present two residual based parametric schemes, constructed from the residuals of the model fit to the data, starting with an ARMA model. In the preparation stage, the model residuals are estimated, under the assumption of a homogeneous underlying process. Under H 0 , the residuals before and after the beginning of the monitoring should behave similarly. On the other hand, if a CP exists in the monitoring period, the residuals are expected to deviate from those in the training period. ARMA processes provide linear and parsimonious descriptions of (weakly) stationary processes. A time series {X n : n ∈ N} is called an ARMA(p, q) process of orders p and q, if it satisfies the stochastic equation,

φ n (B)(X n -µ n ) = θ n (B) n , n ∈ Z, (18)
where µ n are mean parameters (usually non stationary), φ n (z) = 1-φ 1n z-• • •-φ pn z p and θ n (z) = 1-θ 1n z-• • •-θ qn z q are the autoregressive and moving average polynomials of the model respectively, and B the backshift operator. It is also assumed that the ARMA process is causal and invertible, i.e.,

φ n (z) = 0 and θ n (z) = 0, for all |z| ≤ 1.

The error terms { n : n ∈ Z} are a sequence of independent and identically distributed (i.i.d) r.v. with zero mean, E( 1 ) = 0 and constant variance, E( 2 1 ) = σ 2 . The ARMA model in (18) depends on p+q+2 parameters, represented by the vector β n = (µ n , φ n , θ n , σ 2 n ), where φ n = (φ 1n , • • • , φ pn ) and θ n = (θ 1n , • • • , θ qn ). In the defined training period of size m the parameters of the ARMA model are not time dependent, i.e., they are the same for the observations X 1 , • • • , X m , denoted by β 0 in the following,

β 0 = (µ 0 , φ 0 , θ 0 , σ 2 0 ). (20)
The preparation stage is applied to the training sample for two reasons. Firstly, in order to specify the order (p, q) of the corresponding ARMA model, by selecting the combination that provides the lower value for the Bayes information criterion (BIC), BIC = -2 ln( L) + k ln(n), (21) where L is the maximum value of the likelihood function of the model, k is the number of the estimated parameters and n is the sample size. Secondly, in order to estimate the parameters β 0 of the ARMA model through the estimators β0 = ( μ0 , φ0 , θ0 , σ 2 0 ), computed, for example, by the method of maximum likelihood estimation or least squares.

Then, the model residuals are given by

ˆ n = Xn - p i=1 φi0 Xn-i - q i=1 θi0 ˆ n-i , (22)
where Xn = X n -μ0 . The detector is built from the (squared) residuals ˆ n , as:

1 √ m TS on L (m, l) = 1 √ m ηm m+l n=m+1 ˆ 2 n - m n=1 ˆ 2 n , (23)
where η2 m is a weakly consistent estimator of the moment η 2 m = E

C. NONLINEAR (NL) PARAMETRIC APPROACH USING A GENERALIZED AUTOREGRESSIVE CONDITIONAL HETEROSKEDASTICITY (GARCH) MODEL

A time series {X n : n ∈ Z} follows the GARCH(p, q) process, if,

X n = σ n n , σ 2 n = ω n + q i=1 α in X 2 n-i + p j=1 β jn σ 2 n-j ,
where ω n > 0, α in , β jn 0 and { n : n ∈ Z} is a sequence of i.i.d r.v. with E( 1 ) = 0 and E( 2 1 ) = 1. We estimate the set of parameters θ m during the initial training period, denoted in the following by θ 0 = (ω 0 , α 10, , • • • , α q0 , β 10 , • • • , β p0 ); the estimation is performed by applying the Gaussian maximum-likelihood estimator (GMLE) θ0 of θ 0 on the last m observations, as proposed in [53]. The GMLE function is given by

F m (θ ; X 1 , • • • , X m ) = m n=1 1 2π σ 2 n exp - X 2 n 2 σ 2 n , (25)
where σ 2 n are constructed recursively, as,

σ 2 n = ω n + q i=1 α in X 2 n-i + p j=1 β jn X 2 n-j . (26)
Then, the GMLE of θ m is,

θm = argmax θ ∈ F m (θ ; X 1 , • • • , X m ) = arg min θ ∈ 1 m m n=1 X 2 n σ 2 n + ln( σ 2 n ) . ( 27
)
The residuals of the GARCH process are subsequently obtained from the GMLE as

ˆ n = X n σn ( θm ) . ( 28
)
Based on the (squared) residuals, the test statistic is described as in [54], transformation from the β 0 to the β 1 model, a higher value of γ is needed (intuitively, for smaller changes a larger sensitivity is required). Therefore, depending on whether smaller or larger deviations need to be rapidly detected we can fine-tune the value of γ . For the sake of simplicity, in the following we focus on γ = 0 (larger deviations).

TS
According to Table 1, the three approaches provide appropriate empirical sizes, and the false alarm rates are in all cases close to the significance level α = 0.01. Overall the L procedure outperforms the NP and the NL, both in terms of the true alarm rates as well as in terms of the detection time; this is intuitive as in this first experiment the underlying process is generated by a linear ARMA(1,1) model and therefore a linear parametric model is excellently suited to capture the underlying dynamics. Furthermore, comparing the NP and the NL approaches, Table 1 illustrates that the NP is more sensitive than the NL approach, leading to more accurate detection for small changes at the cost of increased false positive rates in the case of larger changes. The opposite is true for the NL approach that appears to be more ''conservative''. Moreover, the fact that the NP procedure is statistically more sensitive leads to a quicker detection of a CP as captured through ĉp * .

We proceed to the more challenging case of a GARCH(1,1) generating model, with parameter vector θ i = (ω i , α i , β i ) that fully describes the model and unconditional variance,

Var(X n ) = ω i (1 -α i -β i )
.

To examine the alarm rates we assume the following models,

• Model 0: θ 0 = (ω 0 , α 0 , β 0 ) = (0.05, 0.4, 0.3),

• Model 1: θ 1 = (0.5, 0.2, 0.1),

• Model 2: θ 2 = (0.5, 0.3, 0.2),

• Model 3: θ 3 = (1, 0.3, 0.2). GARCH is a varying volatility model, allowing volatility changes over time. Being more elaborate and complex in terms of the dependence of the variance on the model parameters, the higher false alarm and the lower true alarm rates in Table 2 are reasonable. In this case, the L procedure seems fully inappropriate irrespective of the choice of γ = 0 or γ = 0.25, suffering from very high false positive rates, since constant variance is assumed. The NL procedure, as expected, surpasses both the L and the NP procedures, as it is excellently suited to capture the GARCH process. More specifically, the true alarm rate estimation is stable for the different magnitudes of changes, with a detection time lag ranging from 50 instances for small changes to 31 instances for larger changes. On the other hand, the NP procedure appears to capture well the actual changes for γ = 0, with success rates relatively close to the those of the NL procedure, especially for medium/large changes. However, for γ = 0.25, the approach leads to ineligible false positive rates, despite the fact that it can identify small changes more efficiently. The NP method also achieves faster detection of changes, with ĉp * ranging from 5 to 28 time instances.

Based on the analysis of the Monte Carlo results for the three procedures under the two different time series generating models, we can synthesize our overall conclusions in the following two points:

1) The NL and the NP approaches adapt better to a wider range of models and underlying assumptions; if there are indications of a highly nonlinear underlying procedure the NP approach could render better results; 2) The L approach is strongly related to the ARMA model assumptions and therefore it is advisable to be applied only if these can be readily shown to hold.

VI. ILLUSTRATION OF THE INTEGRATED ALGORITHM USING REAL DATA

Finally, we study the performance of the proposed algorithms on monitoring real YouTube video traces provided within the framework of the CONGAS project [55]; the dataset consists of 882 videos traces and the observation period is of N = 1000 time instances.

In this Section, we only adopt the non parametric (NP) and the GARCH (NL) approaches. We exclude the ARMA (L) approach from the evaluation, based on the conclusions of the previous Section. We work with the centered simple returns of the content popularity time series, In order to clarify some general characteristics of the dataset, in terms of changing content dynamics, we first apply the off-line algorithm to the video traces. In Fig. 3, we consider three video sets; Video Set 1 contains the whole dataset, Video Set 2 contains the videos with average number of visits E ((Y (1) : Y (1000)) ≥ 10 and Video Set 3 contains the videos with average number of visits greater or equal to 20. Fig. 3, depicts a high percentage of rejecting the H 0 hypothesis, for a significance level of α = 0.05. Especially for the Video Sets 1 and 2, the rejection of the assumption of normal behavior exceeds 60% and 65% of the time series, respectively. This result confirms that a sufficiently high number of time series provide content popularity anomalies, for example in Video Set 3, in 10% of the cases there are over than four CPs per time series. This small analysis confirms the suitability of change point analysis as a viable approach for the detection of changes in video content popularity dynamics.

Y n = (X n+1 -X n ) -
Subsequently, in Fig. 4, we analyze the interim time between consecutive CPs. The respective boxplot diagrams illustrate the existence of sufficiently large intervals between consecutive changes; this fact supports our subtle assumption in Section III regarding the existence of a sufficient gap between two consecutive CPs (e.g., > 80 instances). In particular, 90% and 95% of the intervals correspond to consecutive CPs exceeding 100 and 80 time instances, respectively. This outcome assures that a sufficiently large training window after a detected change can be applied, denoted by the parameter d.

Additionally, Fig. 5, illustrates the time instances of upward (increase in volatility) and downward changes (decrease in volatility) in the form of a boxplot. It is shown that upward changes occur earlier in time than downward changes.

We consider now the performance of the on-line approach, by illustrating the estimated CPs in the second order characteristics of different time series. We choose the beginning of the monitoring period at m s = 200, the sensitivity parameter 2162-2337 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Abstract-A new multiple access (MA) strategy, referred to as non orthogonal multiple access -Relevant (NOMA-R), allows selecting NOMA when this increases all individual rates, i.e., it is beneficial for both strong(er) and weak(er) individual users. This letter provides a performance analysis of the NOMA-R strategy in uplink networks with statistical delay constraints. Closed-form expressions of the effective capacity (EC) are provided in twousers networks, showing that the strong user always achieves a higher EC with NOMA-R. Regarding the network's sum EC, there are distinctive gains with NOMA-R, particularly under stringent delay constraints.

Index Terms: NOMA, effective capacity, QoS delay constraint.

I. INTRODUCTION

Due to the strict delay requirements of many emerging ultra reliable low latency communication (URLLC) applications in beyond fifth generation (B5G) networks, the investigation of the interplay between statistical delay quality of service (QoS) constraints and wireless propagation conditions is highly timely. In this context, employing the link layer metric of the effective capacity (EC) [1], [2] -which indicates the maximum achievable rate under a target delay-outage probability threshold -emerges as a natural choice.

In parallel, non-orthogonal multiple access (NOMA) [3] has been consistently shown to achieve higher sum spectral efficiencies when compared to OMA or other schemes [4]. Moreover, NOMA may be required in B5G networks for very large users densities. Up to now, EC analyses in NOMA networks have focused primarily on the downlink [5]- [7]. With respect to the uplink, in [8] it was shown that in two-user networks NOMA is more efficient than OMA at low signal to noise ratios (SNRs), whereas the opposite conclusion holds at large SNRs, due to the interference experienced by the strong user. Adaptive multiple access (MA) strategies could therefore enhance the performance; to the best of our knowledge, [9] is the first attempt to propose an adaptive MA strategy, called NOMA-Relevant (NOMA-R). In NOMA-R, clusters of users employ NOMA only when it is beneficial for all of them in terms of their individual rates.

This letter is the first EC performance analysis of adaptive MA strategies. Its contributions are the following: (i) we evaluate the probability of using NOMA when NOMA-R is Mylene Pischella is with CNAM CEDRIC, France and is a visiting researcher at ETIS, UMR 8051 (contact: mylene.pischella@cnam.fr); Arsenia Chorti and Inbar Fijalkow are with ETIS UMR 8051 CY Cergy Paris Université, ENSEA, CNRS, France. employed; (ii) we use the EC as the performance metric 1 , provide new analytic expressions of the EC with NOMA-R and compare them to those derived in the two-users case for NOMA and OMA in [8]; (iii) we prove that NOMA-R is the strategy that maximizes the EC of the strong user, whereas it always outperforms OMA but not NOMA for the weak user; (iv) with respect to this latter aspect, this loss in EC for the weak user becomes negligible under stringent delay constraints; (v) numerical results also show that this conclusion holds for a larger number of users. This letter consequently proves that NOMA-R is a very efficient strategy for delay constrained applications.

II. PROBABILITY OF USING NOMA WITH NOMA-R

A. System model

Let us consider a network with K users employing either OMA, NOMA or NOMA-R in the uplink. The achievable rate of user k ∈ S K = {1, ..., K} is denoted in the following by R k , Rk and Rk for NOMA, OMA and NOMA-R, respectively. We assume that the independent and identically distributed (i.i.d.) fading channel coefficients in the links to the base station (BS), denoted by h k , follow unit variance Rayleigh distributions. The channel gains x k = |h k | 2 are assumed ordered in decreasing order, so that x k ≤ x k+1 ∀k ∈ {1, ..., K -1}, and, their distributions can be found by using the theory of order statistics [10]. We denote by ρ = 1 N the transmit SNR with N the additive white Gaussian noise power in each link (assumed the same for all links for simplicity). The transmit power used by user k is denoted by P k so that its received SNR is ρP k , k ∈ S K . Let us assume that a cluster S of users in S K with cardinality |S| is chosen for NOMA. The achievable rates (in bits/s/Hz) of the kth user in S, assuming perfect successive interference cancellation (SIC) decoding, can be expressed as:

R k = |S| K log 2   1 + ρP k x k 1 + j∈S j<k ρP j x j   , ∀k ∈ S. (1)
On the other hand, for the kth user in S K \ S the achievable rates with OMA are given as

Rk = 1 K log 2 (1 + ρP k x k ) , ∀k ∈ S K \ S. (2)
The coefficients |S|/K and 1/K account for fair division of the resources between the users employing NOMA and OMA, 1 We note that [9] focused on proportional fairness.

Users in S K \ S employ OMA. Consequently, the data rate in NOMA-R is Rk = R k ∀k ∈ S and Rk = Rk ∀k / ∈ S. In terms of implementation, the BS identifies the subsets S using its knowledge of the network's full channel state information (CSI). It then transmits to each user a one-bit feedback indicating whether they should use OMA or NOMA and either the user's index in the OMA subset or the NOMA cluster index if several disjoint NOMA clusters are selected. Therefore, NOMA-R imposes at most one-bit signalling overhead with respect to OMA.

The EC in bits/s/Hz of user k ∈ S K is defined as [1]:

E k c = - 1 θ k T f B ln E[e -θ k T f Br k ] = 1 β k log 2 E[e β k ln(2)r k ]
where r k is the achievable rate of user k (equal to R k , Rk , or Rk if the user employs NOMA, OMA or NOMA-R, respectively), T f is the symbol period and B is the occupied bandwidth. θ k , known as the QoS exponent [1], is the exponent of the exponential decay of the buffer overflow probability. Under a constant packet arrival rate assumption, the EC is defined as the maximum achievable rate such that a target delay-bound violation probability is met. The more stringent the delay requirement, the larger the delay exponent θ k . To simplify the notation, we define β k = -

θ k T f B
ln(2) as the negative QoS exponent. Closed form expressions of the EC when OMA and NOMA are employed were derived in [8] for K = 2 and are not repeated in the present for compactness.

B. Probability of using NOMA while in NOMA-R for K ≥ 2 When NOMA-R selects NOMA for k ∈ S, the sum rate can easily be shown to be equal to |S| K log 2 1 + k∈S ρP k x k . Consequently, the subset S of S K that maximizes the sum rate while satisfying (3) is selected by NOMA-R. Several disjoint clusters may also be selected if they independently verify (3).

The probability of using NOMA when NOMA-R is employed, denoted by τ K in the following, is the union of the probabilities to verify (3) for any subset S ⊆ S K with |S| ≥ 2 and its analytical derivation is very evolved. As an illustrative example, let us assume S = {1, ..., k} with k ≤ K. Let y k = ρP k x k be the weighted kth order statistics and z k = k-1 j=1 ρP j x j the weighted sum of the lowest (k -1)th order statistics. Then τ k is equal to:

τ k = P r i=2:k (1 + y i ) -(1 + y i ) 1 k (1 + y i ) 1 k -1 ≥ z i . (4)
For the specific case k = K, the joint probability density function (pdf) of (y K , z K ) can be derived by using the moment generating function (MGF) of the weighted sum of the lowest order statistics, denoted as M zK , as in [10]. The pdf of z k can be obtained by using the following properties:

M zK = K-1
j=1 M xj (ρP j x j ) and L -1 M xj (ρP j x j ) (t) = 1 ρPj f xj t ρPj , where L -1 is the inverse Lagrange transform. Consequently, the joint pdf f zK ,yK =ȳ can be derived from that of z k and y K in [10, eq. (3.41)]. However, a closedform expression of P r (1+yK )-(1+yK )

1 K (1+yK ) 1 K -1
≥ z K cannot be obtained, and similarly to the conclusion in [11, Section V.D], it should be calculated with a mathematical software. Moreover when k < K, to the best of our knowledge, the joint pdf of (y K , z K ) is yet unknown. Consequently, when K > 2, (4) cannot be evaluated analytically with reasonable effort. For all these reasons, our analytical study is limited to K = 2 while we provide numerical results for K > 2.

Finally, examining the case non i.i.d. channel coefficients, we note that the case of non-identical exponential distributions can be treated as in [12], while the case of non independent coefficients as in [13]. If full CSI is not available at the BS, CSI uncertainties can be inserted in users' distributions to derive an MA selection strategy [13], and, when K = 2, (3) can be formulated as a binary hypothesis testing problem [14].

C. Probability of using NOMA while in NOMA-R for K = 2

In the following, we consider the two-users case and call user 2 the strong user, and user 1 the weak user. As R 1 ≥ R1 is always fulfilled, the NOMA-R strategy is used whenever R 2 ≥ R2 . The NOMA-R condition consequently simplifies to x 2 ≥ ρ 2 x 2 1 P 2 1 -1 ρP2 and τ 2 = τ (ρ) = P r x 2 ≥ ρ 2 x 2 1 P 2 1 -1 ρP2

. Using the theory of order statistics, the pdf of x 1 is 2e -2x1 , the pdf of x 2 is 2e -x2 (1e -x2 ) and the joint pdf of (x 1 , x 2 ) is 2e -x1 e -x2 . Then τ (ρ) is equal to: Proof. When ρ → 0, f (ρ) → 1. Moreover, erf(x) ≈ 1e -x 2 /(x √ π) when x >> 1, which implies that g(ρ) ≈ ae -b/ρ with (a, b) two strictly positive constants. Therefore, g(ρ) → 0 when ρ → 0. Furthermore, when ρ >> 1, f (ρ) → 0. As erf(x) ≈ 2 √ π xe -x 2 when x → 0, g(ρ) ≈ a 1 A. NOMA-R EC of user 1

τ = P 2 + √ P 2 2
We hereafter derive closed-form expressions of the EC with NOMA-R. As τ corresponds to the proportion of time spent in NOMA and (1τ ) is the proportion of time spent in OMA, the EC of user k ∈ {1, 2} when the NOMA-R strategy is employed is given as:

E k c,R = 1 β k log 2 E e β k τ R k +β k (1-τ ) Rk . (8)
For user 1, the EC achieved with the NOMA-R strategy is:

E 1 c,R = 1 β 1 log 2 E[(1 + ρP 1 x 1 ) β 1 (τ +1) 2 ] = 1 β 1 log 2 2 ρP 1 U 1, 2 + β 1 (τ + 1) 2 , 2 ρP 1 (9)
where U (a, b, z) = 1 Γ(a) ∞ 0 e -zt t a-1 (1+t) (b-a-1) dt denotes the confluent hypergeometric function. . Then from [8, eq.(11)] and ( 9), E 1 c,R (β 1 , ρ 1 ) = E 1 c,N (β 1,a , ρ 1 ) and E 1 c,R (β 1 , ρ 2 ) = E 1 c,N (β 1,b , ρ 2 ). As τ (ρ) is a decreasing function with respect to ρ, and β are negative, β 1,a ≤ β 1,b . Moreover, E 1 c,R (β, ρ) is increasing both with respect to β and to ρ according to [8]. Consequently, E 1 c,N (β 1,a , ρ 1 ) ≤ E 1 c,N (β 1,a , ρ 2 ) ≤ E 1 c,N (β 1,b , ρ 2 ) and:

E 1 c,R (β 1 , ρ 1 ) ≤ E 1 c,R (β 1 , ρ 2 ) ∀ρ 1 < ρ 2 (10)
B. NOMA-R EC of user 2 For user 2, the NOMA-R EC is given by

E 2 c,R = 1 β 2 log 2 E 1 + ρP 2 x 2 1 + ρP 1 x 1 β2τ (1 + ρP 2 x 2 ) β 2 (1-τ ) 2 (11)
Lemma 3. When ρ tends to 0, the EC with the NOMA-R strategy becomes equivalent to that of NOMA given in [8].

Proof. When ρ → 0, τ (ρ) → 1 and therefore (1 + ρP 2 x 2 )

β 2 (1-τ ) 2 → 1.
Consequently, E 2 c,R tends to E 2 c,N . Lemma 4. When ρ >> 1, the EC with the NOMA-R strategy becomes equivalent to that of OMA and its closed-form expression is given by:

E 2 c,R ≈ 1 β 2 log 2 Γ β 2 + 1 (ρP 2 ) β 2 (2 -2 -β 2 ) . (12)
Proof. When ρ >> 1, 1 + ρP2x2 1+ρP1x1 β2τ → 1 because τ → 0. Then using (1 + x) α ≈ x α , the EC of user 2 becomes: The integral's closed-form expression leads to (12).

Theorem 1. The EC of user 1 is always larger with NOMA than with NOMA-R, while OMA is the worst strategy in terms of EC. Moreover, the EC of user 2 is always larger with the NOMA-R strategy than with NOMA or OMA.

Proof. The NOMA-R instantaneous rate of user 1 is equal to R1 = (1+τ ) 2 log 2 (1 + ρP 1 x 1 ), according to (9). Therefore R1 ≤ R1 ≤ R 1 Then as β 1 is negative, e β1R1 ≤ e β1 R1 ≤ e β1 R1 , and E e β1R1 ≤ E e β1 R1 ≤ E e β1 R1 , so that

E 1 c,N ≥ E 1 c,R ≥ E 1 c,O (13)
The NOMA-R rate of user 2 is R2 = max{R 2 , R2 }. Following the same steps as for user 1, we conclude that

E 2 c,R ≥ E 2 c,N and E 2 c,R ≥ E 2 c,O (14)
Remark: E 2 c,R asymptotically tends to either E 2 c,N or E 2 c,O , both of which are monotonically increasing with ρ. Moreover, contrary to the NOMA strategy, the NOMA-R strategy does not lead to a saturation of the EC of the strong user because of (14)

IV. NUMERICAL RESULTS

Performance comparisons with respect to EC with the NOMA-R strategy are provided for P = [0.2, 0.8], P = [0.05, 0.15, 0.8] and P = [0.01, 0.04, 0.15, 0.8] when K = 2, 3 and 4, respectively. Unless otherwise stated, β k = -2, ∀k. Fig. 2 validates the results of Theorem 1. Fig. 3 shows that the largest sum EC is always achieved with NOMA-R whatever the value of K. Moreover, the sum EC with NOMA-R coincides with that of NOMA when the SNR is lower than a minimum value ρ min that increases with K, because constraint (3) becomes less stringent when K increases. Fig. 4 shows the dependency of the EC on to β 1 when the SNR is equal to 35 dB, β K = -2 and β j = β 1 , ∀j < K. The sum EC is larger with NOMA-R, except when β 1 approaches 0. The NOMA-R strategy is consequently more favorable when the target delay-bound violation probabilities are more stringent, especially for weak users.

V. CONCLUSIONS

In this letter the EC performance of an adaptive MA strategy, NOMA-R, was studied both analytically for K = 2 users and numerically for larger values of K. It was shown that NOMA-R is an advantageous strategy for delay constrained applications in B5G, e.g., URLLC, particularly as the users' delay-outage probability constraints become more stringent.

3. 1

 1 Percentage of the successful CP detections for the standard and modified BS algorithm 3.2 Success rates of trend indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Results of the RCPDs' algorithm CPs detection for one change in the mean value. . . 3.4 Results of the RCPDs' algorithm CPs detection for two mean changes. . . . . . . . . . 3.5 Success rates of T I f trend indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 Empirical percentiles of mean values change rate. . . . . . . . . . . . . . . . . . .

1. 1 1 Activity Review 1 . 1

 1111 Recent research areas and topics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1 Roadmap of contributions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Secret key generation between Alice and Bob. . . . . . . . . . . . . . . . . . . . . . . 2.3 Pipelined SKG and encrypted data transfer between Alice and Bob. . . . . . . . . . . 2.4 a) Efficiency comparison for N = 12, SNR=10 dB and κ = 2. . . . . . . . . . . . . . . 2.4 b) Efficiency comparison for N = 64, SNR=10 dB and κ = 2. . . . . . . . . . . . . . . 2.5 Efficiency vs κ, for N = 24, SNR=10 dB. . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 a) Size of set D for different SNR levels and σ 2 e when N = 24. . . . . . . . . . . . . . . 2.6 b) Size of set D for different values of κ when N = 24. . . . . . . . . . . . . . . . . . . 2.7 a) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 12, SNR= 10 dB and κ = 2. . . . . . . . . . . . . . . . . . . . . . 2.7 b) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 64, SNR= 10 dB and κ = 2. . . . . . . . . . . . . . . . . . . . . . 2.8 a) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 12, SNR= 0.2 dB and κ = 2. . . . . . . . . . . . . . . . . . . . . . 2.8 b) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 64, SNR= 0.2 dB and κ = 2. . . . . . . . . . . . . . . . . . . . . . 2.9 a) Effective data rate achieved by parallel and sequential approaches when N = 12, SNR= 5dB, θ = 0.0001, κ = 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.9 b) Effective data rate achieved by parallel and sequential approaches when N = 12, SNR= 5dB, θ = 100, κ = 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.9 c) Effective data rate achieved by parallel and sequential approaches when N = 64, SNR= 5dB, θ = 0.0001, κ = 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.9 d) Effective data rate achieved by parallel and sequential approaches when N = 64, SNR= 5dB, θ = 100, κ = 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 Estimated a) frequency and b) cumulative frequency of the number of CPs per time-series. 3.2 Frequency values of the number of upward and downward CPs, per time-series. . . . . 3.3 a) Boxplot including the interval (5% -95%) (dashed line) and (10% -90%) interval (dotted line), b) Cumulative frequency for the interim time of consecutive CPs. . . . . 3.4 DTW distances for the two on-line detection schemes. . . . . . . . . . . . . . . . . . . 3.5 Outputs of the RCPD algorithm using standard CUSUM for different time-series. Solid and dashed lines depict an upward and a downward change, respectively. . . . . . . . . 3.6 Outputs of the RCPD algorithm using standard type CUSUM for different time-series. Solid and dashed lines depict an upward and a downward change, respectively. . . . . 3.7 Outputs of the RCPD algorithm using ratio type CUSUM for different time-series. Solid and dashed lines depict an upward and a downward change, respectively. . . . . . . . . 3.8 Outputs of the RCPD algorithm; using ratio type CUSUM for different time-series. Solid and dashed lines depict an upward and a downward change, respectively. . . . . wireless sensor network SIR Signal to interference ratio SKG Secret key generation SLA Service level agreement SNR Signal-to-noise ratio STEK Session ticket encryption key TLS Transport layer security URLLC Ultra reliable low latency communication V2X Vehicle-to-everything communication WSN Wireless sensor network Chapter Motivation for Application for the HdR Diploma With this thesis, I wish to submit my application for the Habilitation to Direct Research at CY -Cergy Paris Université. Currently, I am a Maître de Conférences at the Ecole Nationale Supérieure de l'Electronique et de ses Applications (ENSEA) in Cergy and in parallel I have a Visiting Research Fellow status at the Department of Electrical and Electronic Engineering of Princeton University in the USA and at the School of Computer Science and Electronic Engineering of the University of Essex in the UK.

Figure 1 . 1 :

 11 Figure 1.1: Recent research areas and topics

1 . 2 . 6

 126 Project proposals currently under review: o Principal Investigator (PI) of ANR PRCE project HERCULES (enhancement measures in the security of beyond fifth generation networks) 2 nd round AAPG 2020, with the SME Montimage, K. Salamatian (LISTIC), I. Andriyanova (ETIS), A. Histace (ETIS) and F. Ghaffari (ETIS) o External collaborator of project LEON (Intelligent Network Softwarization for the Internet of Things), ELIDEK, GR, with Dr. L. Mamatas o PI project PROCOPE PHC (travel grant) to visit the Barkhausen Institute, DE in 2021-2022 Ongoing projects: o Co-investigator (co-I) project PHEBE (Physical layer security for beyond fifth generation communications) with L. Wang (PI), L. Luzzi, M. Chafii, M. Le Treust, Paris-Seine Excellence Initiative, 2020-2024, 400,000€ o PI project SAFEST with F. Jardel (NOKIA Bell Labs) (Physical layer security for future generations wireless systems), DIM RFSI, 2019-2021, 27,500€ o PI project eNiGMA (Non-orthogonal multiple access techniques under security and delay constraints), with I. Fijalkow, Paris-Seine Excellence Initiative, 2019-2021, 110,000€ o Co-I project ELIOT (Enabling technologies for IoT), ANR PRCI with Univ. Sao Paolo, Brazil, with V. Belmega (PI), I. Andriyanova, I. Fijalkow, J. Lorandel, Role: Leader of WP on IoT security, 2019-2023, ETIS: 390,420€ (total of 740 k€) Past projects: o PI SRV-ENSEA de l'Institut des Etudes Avancées Université Paris Seine, 2018-2019: 3,000€ o PI SRV-ENSEA Institut des Etudes Avancées Université Paris Seine: 2017-2018 : 2,850€ o PI project PHOTINO, University of Essex, Research and Innovation Fund: 2014-2015: £13,000 o Co-I FP7 PEOPLE Marie Curie IOF, project APLOE with H.V. Poor (Princeton University), 245,448€, 2010-2013 o PG Scholarship from the State Scholarships Foundation of Greece-I.K.Y. 2000-2004: £41,820 Teaching and Related Responsibilities at ENSEA (since 2017) o 2019-present: Responsible of student international mobility to the UK, 2 nd year MEng, 3 rd year MEng, Erasmus programme with the UK o 2019-present Instructor in the MSc (M2R) module "Cryptography and Network Security", University Cergy Pontoise, Master 2 Informatique et Ingénierie des Systèmes Complexes (IISC), specilization SIC (Signal, Information, Communications), o 2018-present: Responsible of the module "Network security" 3 rd year MEng, ENSEA o 2018-present: Responsible of module "Interconnexion réseaux" 3 rd year Cycle par Alternance, ENSEA o 2017-present: Responsible of the Option Internet of Things "Option IoT", 2 nd year MEng, ENSEA o 2017-present: Instructor "IoT Security", 2 nd year MEng, ENSEA o 2017-present: Responsible of the module "Internetworking", 3 rd year MEng, ENSEA o 2017-present: Instructor "Wireless Communications", 3 rd year MEng, ENSEA o 2017-present: Lab instructor in various courses, including Digital Communications, Internetworking, Signals and Systems, etc.

Figure 2 . 1 :

 21 Figure 2.1: Roadmap of contributions.

CHAPTER 2 .Figure 2 . 2 :

 222 Figure 2.2: Secret key generation between Alice and Bob.

Figure 2 . 3 :

 23 Figure 2.3: Pipelined SKG and encrypted data transfer between Alice and Bob.

CHAPTER 2 .Figure 2 . 4 :

 224 Figure 2.4: a) Efficiency comparison for N = 12, SNR=10 dB and κ = 2.

Figure 2 . 4 :

 24 Figure 2.4: b) Efficiency comparison for N = 64, SNR=10 dB and κ = 2.

2. 7 . 1

 71 Numerical results for the Long Term Average C D

Figures 2 .

 2 Figures 2.4a and 2.4b show the efficiency of the methods for N = 12, and N = 64, respectively, while κ = 2 and P = 10. We note that the proposed heuristic algorithm has a near-optimal performance (almost indistinguishable from the red curves achieved with dynamic programming). Due to this fact (which was tested across all scenarios that follow) only the heuristic approach is shown in subsequent figures for clarity in the graphs.We see that when there are a small number of subcarriers (N =12, typical for NB-IoT) and small β the efficiency of both the parallel η parallel and the sequential η sequential approaches are very close to

  Figures 2.4a and 2.4b show the efficiency of the methods for N = 12, and N = 64, respectively, while κ = 2 and P = 10. We note that the proposed heuristic algorithm has a near-optimal performance (almost indistinguishable from the red curves achieved with dynamic programming). Due to this fact (which was tested across all scenarios that follow) only the heuristic approach is shown in subsequent figures for clarity in the graphs.We see that when there are a small number of subcarriers (N =12, typical for NB-IoT) and small β the efficiency of both the parallel η parallel and the sequential η sequential approaches are very close to

Figure 2 . 5 :

 25 Figure 2.5: Efficiency vs κ, for N = 24, SNR=10 dB.

Figure 2 . 6 :Figure 2 . 6 :

 2626 Figure 2.6: a) Size of set D for different SNR levels and σ 2 e when N = 24.

CHAPTER 2 .

 2 Figure 2.7: a) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 12, SNR= 10 dB and κ = 2.

Figure 2 . 7 :

 27 Figure 2.7: b) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 64, SNR= 10 dB and κ = 2.

Figure 2 . 8 :

 28 Figure 2.8: a) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 12, SNR= 0.2 dB and κ = 2.

Figure 2 . 8 :

 28 Figure 2.8: b) Effective data rate achieved by the parallel heuristic approach and the sequential approach when N = 64, SNR= 0.2 dB and κ = 2.

Figure 2 . 9 :

 29 Figure 2.9: d) Effective data rate achieved by parallel and sequential approaches when N = 64, SNR= 5dB, θ = 100, κ = 2.

CHAPTER 2 .

 2 SECURITY PROTOCOLS FOR INTERNET OF THINGS APPLICATIONS

Figure 3 . 1 :

 31 Figure 3.1: Estimated a) frequency and b) cumulative frequency of the number of CPs per time-series.

Figure 3 . 2 :

 32 Figure 3.2: Frequency values of the number of upward and downward CPs, per time-series.

Figure 3

 3 Figure 3.3: a) Boxplot including the interval (5% -95%) (dashed line) and (10% -90%) interval (dotted line), b) Cumulative frequency for the interim time of consecutive CPs.

Figure 3 . 4 :

 34 Figure 3.4: DTW distances for the two on-line detection schemes.

CHAPTER 3 .

 3 APPLICATION OF CHANGE POINT ANALYSIS IN EDGE RESOURCE ALLOCATION AND INTRUSION DETECTION

Figure 3 . 5 :

 35 Figure 3.5: Outputs of the RCPD algorithm using standard CUSUM for different time-series. Solid and dashed lines depict an upward and a downward change, respectively.

Figure 3 . 6 :Figure 3 . 7 :

 3637 Figure 3.6: Outputs of the RCPD algorithm using standard type CUSUM for different time-series. Solid and dashed lines depict an upward and a downward change, respectively.

CHAPTER 3 .Figure 3 . 8 :

 338 Figure 3.8: Outputs of the RCPD algorithm; using ratio type CUSUM for different time-series. Solid and dashed lines depict an upward and a downward change, respectively.

Figure 3 . 9 :Figure 3 .

 393 Figure 3.9: The aggregated overall processing cost, per time-instance, of the RCPD algorithm over 882 time-series.

CHAPTER 3 .

 3 APPLICATION OF CHANGE POINT ANALYSIS IN EDGE RESOURCE ALLOCATION AND INTRUSION DETECTION

  between 87% and 100% when monitoring the control packets overhead. In terms of detection time, the best DTM when monitoring the data packets delivery rate was 24 samples and the DTM CHAPTER 3. APPLICATION OF CHANGE POINT ANALYSIS IN EDGE RESOURCE ALLOCATION AND INTRUSION DETECTION

Figs. 4 .2 and 4 . 3 ,

 443 show respectively the EC of User 1 and User 2, versus the transmit SNR, for different values of β 1 = β 2 = β. When the delay constraints become more stringent, i.e., β decreases (equivalently, θ increases), the individual link-layer rates in NOMA decrease, for both users.

Figure 4 .

 4 Figure 4.1: E 1 c , E 2 c in a two-user NOMA uplink network compared to Ecs of two users OMA, versus ρ

Figure 4 . 2 :

 42 Figure 4.2: E 1 c versus the transmit SNR, for several delays.

Figure 4 .

 4 6 shows the difference of the EC in NOMA and the EC in OMA for the strong user. This

Figure 4 . 3 :

 43 Figure 4.3: E 2 c versus the transmit SNR ρ for several delays.

Figure 4 . 4 :

 44 Figure 4.4: E 1 c and E 2 c in a two-user NOMA compared to ECs of two users OMA, versus normalized delay β, for different values of ρ.

Figure 4 .

 4 Figure 4.5: E 1 c -Ẽ1 c versus ρ, for several values of the normalized delay exponent.

Figure 4 . 6 :

 46 Figure 4.6: E 2 c -Ẽ2 c versus ρ, for various normalized delay exponent.

Figure 4 . 7 :

 47 Figure 4.7: V N and V O versus ρ, for several values of normalized delay exponent.

Figure 4 . 8 :

 48 Figure 4.8: V N -V O versus ρ for various normalized delay.

(4. 25 )CHAPTER 4 .

 254 UPLINK NON-ORTHOGONAL MULTIPLE ACCESS (NOMA) UNDER STATISTICAL QOS DELAY CONSTRAINTS When ρ → 0, we have lim ρ→0

Fig. 1 .

 1 Fig. 1. SKG system model with two legitimate nodes and a single adversary.

Proposition 3 :

 3 At the NE (α * , β * ), a player uses either all channel hopping actions with non-zero probability or none of them: either α * i = 0, ∀i ≤ N or α * i = 0, ∀i ≤ N, and similarly, eitherβ * i = 0, ∀i ≤ N or β * i = 0, ∀i ≤ N.Proposition 4: If both players employ channel hopping with non-zero probability at the NE, i.e., α * i > 0 and β * i > 0 ∀i ≤ N, then the players will hop uniformly across all channels and the NE will have the following structure: α * = (a, . . . , a, (1 -Na)), β * = (b, . . . , b, (1 -Nb)) for some 0 ≤ a ≤ 1/N, 0 ≤ b ≤ 1/N. Propositions 3 and 4 are proven in Appendices VI-D and VI-E. These results shape the special structure of the NEs of Ĝ, which, alongside Definition 1 and the strict convexity of C( p, γ ) w.r.t. γ , allows us to fully

Fig. 2 .

 2 Fig. 2. Relative utility gain at the NE vs. NJ E = (C N E -C N J )/C N E as a function of P/ ≥ 0 for ζ = 0.7.

Fig. 3 .

 3 Fig. 3. Relative utility gain at the NE vs. no EH: F = (C N E -C noE H )/C N E as a function of P/ ≥ 0.

Fig. 4 .

 4 Fig. 4. Relative utility gain at the NE vs. no EH: F = (C N E -C noE H )/C N E as a function of P/ ≥ 0 for ζ = 0.7 and different channel parameters.

Fig. 5 .= σ 2 B = σ 2 H

 522 Fig. 5. NE regions as a function of P/ ≥ 0 and N ≥ 2 for = σ 2 A = σ 2 B = σ 2 H = 1.

Fig. 6 .

 6 Fig. 6. NE regions as a function of P/ ≥ 0 and N ≥ 2 for = 1 and different channel parameters.

Fig. 7 .

 7 Fig. 7. Relative utility gain between the NE vs. always hopping: D H = (u N Eu H op,Spread )/u N E as a function of P/ for N = 32, = 1 and different channel parameters.

5 )

 5 Player J only channel hops and player L uses both channel hopping and spreading at the NE (i.e., α * = (a, . . . , a, (1 -Na)) and β * = (1/N, . . . , 1/N, 0)), iff C(N P, N ) + (N -1)C(N P, 0) = N(N -1)C(P, 0) + C(P, N ), 0 < a < 1/N, and MaC(N P, ) + (1 -Na)NC(P, ) > aC(N P, N ) + (N -1)aC(N P, 0) + (1 -Na)[(N -1)C(P, 0) + C(P, N )] where a is chosen such that player J is indifferent among their pure strategies. The last inequality condition becomes: a[NC(N P, ) -C(N P, N ) -(N -1)C(N P, 0)] > (1 -Na)[(N -1)C(P, 0) + C(P, N ) -NC(P, )]

Fig. 1 .

 1 Fig. 1. System model and time sharing scheme at Alice's side.

Fig. 3 .Fig. 4 .

 34 Fig. 3. NE vs. NJ efficiency: F NJ in (12) as a function of SIR. The NE always outperforms the NJ state. At low SIR, exploiting the dominant jamming interference is more beneficial than silencing the jammer. At high SIR, neutralizing the jammer via EH is inefficient.

  Rate for a Downlink NOMA Network Wenjuan Yu , Member, IEEE, Arsenia Chorti , Member, IEEE, Leila Musavian , Member, IEEE, H. Vincent Poor , Fellow, IEEE, and Qiang Ni , Senior Member, IEEE Abstract-In this paper, a novel approach is introduced to study the achievable delay-guaranteed secrecy rate, by introducing the concept of the effective secrecy rate (ESR). This study focuses on the downlink of a non-orthogonal multiple access (NOMA) network with one base station, multiple single-antenna NOMA users and an eavesdropper. Two possible eavesdropping scenarios are considered: 1) an internal, unknown, eavesdropper in a purely antagonistic network; and 2) an external eavesdropper in a network with trustworthy peers. For a purely antagonistic network with an internal eavesdropper, the only receiver with a guaranteed positive ESR is the one with the highest channel gain. A closed-form expression is obtained for the ESR at high signal-to-noise ratio (SNR) values, showing that the strongest user's ESR in the high SNR regime approaches a constant value irrespective of the power coefficients. Furthermore, it is shown the strongest user can achieve higher ESR if it has a distinctive advantage in terms of channel gain with respect to the second strongest user. For a trustworthy NOMA network with an external eavesdropper, a lower bound and an upper bound on the ESR are proposed and investigated for an arbitrary legitimate user. For the lower bound, a closed-form expression is derived in the high SNR regime. For the upper bound, the analysis shows that if the external eavesdropper cannot attain any channel state information (CSI), the legitimate NOMA user at high SNRs can always achieve positive ESR, and the value of it depends on the power coefficients. Simulation results numerically validate the accuracy of the derived closed-form expressions and verify the analytical results given in the theorems and lemmas. Index Terms-Effective capacity, secrecy rate, NOMA, delayoutage probability.Manuscript received June 13, 2018; revised March 29, 2019; accepted August 14, 2019. Date of publication September 6, 2019; date of current version December 10, 2019. This work was supported in part by the U.K. Engineering and Physical Sciences Research Council (EPSRC) under Grant EP/N032268/1 and Grant EP/K011693/1, in part by the EU Seventh Framework Programme (FP7) under Grant PIRSES-GA-2013-610524, in part by the Royal Society Project under Grant IEC170324, and in part by the U.S. National Science Foundation under Grant ECCS-1647198 and Grant CNS-1702808. The associate editor coordinating the review of this article and approving it for publication was Prof. S. Yang. (Corresponding author: Wenjuan Yu.)

  θ M → 0 (or β M → 0). In other words, we can get that lim verifies Theorem 1 and confirms that the proposed ESR is a more flexible metric, with the traditional ergodic secrecy rate emerging as a special case.

  , while assuming γ m ≤ M i=m+1 γ i , where m = {M -1, M}, and a = Mm + 1 + s. At high SNRs, its conditional ESR, i.e., lim ρ→∞

  ) and a = Mm + s + 1. Furthermore, ζ(•) is the Riemann zeta function, r is the Euler's constant, e m (x) = m s=0

Lemma 1 :

 1 When ρ → 0, lim ρ→0

Fig. 1 .

 1 Fig. 1. E M s , vs. the transmit SNR ρ, with an internal eavesdropper.

  in (15), we depict in Fig. 1 E M s versus the transmit SNR ρ, for different values of M .

Fig. 2 .

 2 Fig. 2. E M s vs. the transmit SNR ρ, for two different power coefficient settings, with an internal eavesdropper.

Fig. 3 .

 3 Fig. 3. E M s and E[R M s ] vs. θ M , for different values of ρ, with an internal eavesdropper.

Fig. 4 .Fig. 5 .

 45 Fig. 4. E m s vs. the transmit SNR ρ, in the presence of an external eavesdropper.

Fig. 6 .

 6 Fig. 6. E m s and Ȇm s vs. the delay exponent θm, for different values of ρ, with an external eavesdropper.

Fig. 7 .

 7 Fig. 7. Ȇm s vs. the transmit SNR ρ, for different θm values, with an external eavesdropper.

Fig. 8 .

 8 Fig. 8. E m s and Êm s vs. the delay exponent θm, for different values of ρ, with an external eavesdropper.

)(- 1 )

 1 By replacing (1e -z1 ) m-1 with binominal expansion s e -z1s and defining a = Mm + s + 1,

  us consider B D2 . By replacing (1e -z1 )

  1 and Ψ 2 , can be calculated easily. Let us rewrite Ψ 1

  Rm s ], which completes the proof.

FIGURE 1 .

 1 FIGURE 1. Simulated time series with CPs in the mean (solid line) and the variance (dashed line) for (a) separated and (b) simultaneous changes in the mean/variance. Horizontal lines illustrate the mean value.

FIGURE 2 .

 2 FIGURE 2. Flow diagram of the real-time variance CP detector for content views data.

  boundary function b NP = cv on NP g NP is strictly aligned with the chosen size of the monitoring period l normalized to the length of the training period, denoted by H = l/m. Then the weight function is expressed as g NP = 1 + l m l m+l γ , γ ∈ [0, 1/2) and the critical value is derived from the asymptotic behavior of the stopping rule, lim m→∞ Pr{τ (m) < ∞} = lim m→∞ Pr TS on NP ≥ b NP (α)

2 m -σ 2 m 2 .

 22 Finally, the boundary function is expressed as b L = cv on L g L , where g L = 1 + l m l m+l γ , γ ∈ [0, 1/2) and the critical value is obtained according to [49] as lim m→∞ Pr{τ (m) < ∞} = lim n γ ≥ cv on L (α) = α.

2 n

 2 on NL (m, l) ,(29) where Var(ˆ 2 n ) denotes the variance of the squared residuals of the training period, i.e., Var(ˆ2 m ) = E(ˆ 4 m ) -E ˆ 2 m 2 .

FIGURE 3 .

 3 FIGURE 3. Estimated a) frequency and b) cumulative frequency of the number of CPs per time series, for three different Video Sets.

  -X n ), n = 1, . . . , 900and then apply the methods on Y n .

FIGURE 4 .

 4 FIGURE 4. Interim time between consecutive CPs: a) Boxplot including the interval (5% -95%) (dashed line) and (10% -90%) interval (dotted line), b) Cumulative frequency for the interim time of consecutive CPs.

FIGURE 5 .

 5 FIGURE 5. Boxplot of the number of upward and downward CPs, per time series.

Fig. 1 .

 1 Fig. 1. Validation of the closed-form expression of τ

e a 2 /ρ ρ + b 1 e b 2

 212 /ρ ρ where (a 1 , a 2 , b 1 , b 2 ) are constants and g(ρ) → 0 III. NOMA-R EFFECTIVE RATES The ECs of user k = 1, 2 when employing NOMA, OMA or NOMA-R are denoted by E k c,N , E k c,O and E k c,R , respectively.

Lemma 2 .

 2 E 1 c,R is monotonically increasing with ρ. Proof. Let us consider ρ 1 and ρ 2 such that ρ 1 < ρ 2 . For any value of β 1 , let us define: β 1,a = β1(1+τ (ρ1)) 2 and β 1,b = β1(1+τ (ρ2)) 2

2 2

 2 e -x2 (1e -x2 )dx 2 .

Fig. 2 .

 2 Fig. 2. EC per user versus SNR ρ when K = 2

Fig. 3 .

 3 Fig. 3. Sum EC versus SNR ρ

Fig. 4 .

 4 Fig. 4. Sum EC versus β 1

  . . . 3.7 Percentages of time-series with Time Dependencies Exceeding t Samples . . . . . . . . 3.8 Simulation Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.9 FDFF Attack Detection, 36 Nodes, 5% Attackers . . . . . . . . . . . . . . . . . . . . . 3.10 FDFF Attack Detection, 100 nodes, 5% Attackers . . . . . . . . . . . . . . . . . . . . 3.11 FDFF Attack Detection, 36 nodes, 20% Attackers . . . . . . . . . . . . . . . . . . . . 3.12 FDFF Attack Detection, 100 nodes, 20% Attackers . . . . . . . . . . . . . . . . . . . . 3.13 FNI Attack Detection, 36 nodes, 5% Attackers . . . . . . . . . . . . . . . . . . . . . . 3.14 FNI Attack Detection, 100 nodes, 5% Attackers . . . . . . . . . . . . . . . . . . . . . . 3.15 FNI Attack Detection, 36 nodes, 20% Attackers . . . . . . . . . . . . . . . . . . . . . . 3.16 FNI Attack Detection, 100 nodes, 20% Attackers . . . . . . . . . . . . . . . . . . . . .

student Mr. Gustavo Alonso Nunez Segura: supervision @35%,

Current supervision

o PhD Student Mr. Miroslav Mitev: supervision @60%,

25

/4/2017-9/2020, "Physical layer security for the Internet of things", co-supervised with Dr. M. Reed, University of Essex, UK, Thesis VIVA (defence) scheduled for September 2020, publications: [J21], [C37], [C36], [C33], [P1], [U1] o PhD student Mr. Sotiris Skaperas: supervision @40%, 1/9/2017-9/2020, "Data analysis and forecasting models for flexible resource management in 5th generation networks", cosupervised with Dr. L. Mamatas, University of Macedonia in Thessaloniki, GR, Thesis defence scheduled for September 2020, publications: [J20], [J17], [C32], [U5] o PhD 1/2/2019-projected to finish in 1/2022 (4-year thesis programme in Brazil), "Cooperative Intrusion Detection System for Software Defined Wireless Sensor Networks", co-supervised with Prof. Cintia Borges Margi, University of Sao Paolo, Brazil, publications: [J18], [C39], [C35], [S1], [U2] o PhD

student Mr. Mouktar Bello: supervision @70%, 1

	/11/2020-projected to finish in
	10/2023, "Meeting delay and security constraints in 6G wireless networks", co-supervised with
	Prof. I. Fijalkow, ETIS/ENSEA, FR, publications: [C38], [U3, U4]
	o Postdoc Dr. Mahdi Shakiba Herfeh: supervision @100%, 21/11/2019-20/5/2021 (fixed term
	1.5 years), "Physical layer security for IoT applications", project ELIOT ANR PRCI, ETIS/ENSEA
	FR, publications: [BC3], [U1]
	o Postdoc Dr. Nasim Ferdosian: supervision @90%, 1/1/2020-31/12/2021 (fixed term 2 years),
	"Non-orthogonal multiple access techniques under security and delay constraints", with Prof.
	I. Fijalkow, ETIS/ENSEA, FR, publications: [U5]
	Past supervision
	o MSD (

Master by Thesis -full year research project) student Cornelius Saiki: supervision

@84%, 1/9/2014-31/8/2015, "A Novel Physical Layer Key Generation and Authenticated Encryption Protocol Exploiting Shared Randomness", co-supervised with Prof. S. Walker, University of Essex, publications: [C27] o MSc (

M2R) SIC student Gada Rezgui: supervision @50%

  , 1/3/2017-31-8-2017, "Energy Harvesting as a Means to Mitigate Jamming Attacks; a Game Theoretic Analysis", cosupervised with V. Belmega, ETIS/University of Cergy Pontoise, publications: [J16] o MSc

(M2R) SIC student Rihem Nasfi: supervision @100%,

  1/11/2018-15/3/2019, Projet d'Initiation à la Recherche (PIR), "Non-orthogonal multiple access networks under QoS delay MSc and 9 BSc dissertations at the University of Essex and more than 10 MSc and BSc dissertations at Middlesex University

	constraints", publications : [C34]
	o MSc (M2R) SIC student Gada Rezgui, supervision @50%, 1/11/2016-15/3/2017, Projet
	d'Initiation à la Recherche (PIR), "Secret Key Generation systems under Jamming Attacks via
	Game Theoretic Tools"
	o MSc (M2R) IMD student Amani Gran, supervision @100%, 1/11/2018-15/3/2019, Projet
	d'Initiation à la Recherche (PIR), "IoT lightweight security"
	o MSc (M2R) SIC student Fatiha Ait Larbi, supervision @100%, 1/11/2018-15/3/2019, Projet
	d'Initiation à la Recherche (PIR), "Cross-layer security protocol design"
	o MSc (M2R) SIC student Mouad Nahri, supervision @100%, 1/11/2019-15/3/2020, Projet
	d'Initiation à la Recherche (PIR), "Flexible numerology for B5G"
	o Other MSc/BSc supervision: 5

1.2.8 Recruitment (Selection) Committees / Thesis Examiner o May 2020: Recruitment Committee (Comité de sélection) for a MCF post at CY Cergy University on Networks and Security o Sep. 2019: Recruitment Committee (Comité de sélection) for a MCF post at EISTI on Cybersecurity o Jun. 2020: Thesis Examiner (rapporteur), A. Ben Hadj Fredj, Télécom ParisTech, supervisors Prof. G. Rekaya and Prof. J-C Belfiore, "Computations for Multiple Access Channels in Wireless Networks" o Jan. 2019: Thesis Reviewer, L. Senigagliesi, Univ. Polytechnica delle Marche, supervisors Prof. L. Spalazzi and Prof. M. Baldi, "Information-theoretic security techniques for data communications and storage" o Aug. 2014: Thesis Examiner, I. K. Musa, CSEE University of Essex UK, supervisor Prof. S. Walker, "Optimized Self-Service Resource Containers for Next Generation Cloud Delivery" 1.

2.9 Workshop Organization / Keynotes / Tutorials

o Tutorial on "What Physical Layer Security Can Do for 6G", IEEE Global Communications (GLOBECOM) 2020, A. Chorti and V.H. Poor, December 2020, Taipei TW. o Tutorial on "Statistical methods in physical layer security",

IEEE Statistical Signal Processing (SSP) Workshop,

  July 2020, Rio de Janeiro, BR (rescheduled to July 2021 due to COVID-19) o Special Session Organizer, "Selected topics on 6G security", IEEE ISWCS, Sep. 2020, Berlin, Germany (rescheduled to Sep. 2021 due to COVID-19) o Special Session Organizer, "Statistical Methods for IoT", IEEE SSP 2020, Jul. 2020, Rio de Janeiro, Brazil (postponed to July 2021 due to COVID-19) Chair of the workshop ACCESS -Cutting edge topics in physical layer security, communications and distributed storage workshop, 11 May 2014, Aalborg, Denmark o Co-chair of "2nd Women's Workshop on Communications and Signal Processing", 16-18 July 2014, Princeton NJ, US o Track

	o Training School Co-organizer (with M. Chafii, S. Stanczak and R. Cavalcante), "Machine
	Learning for Communications", 3-4 Sep. 2020, Berlin (co-located with ISWCS, rescheduled to
	Sep. 2021 due to Covid-19)
	o Chair of the GdR ISIS Workshop "Women in Communications, Information Theory and Signal
	Processing", May 19 2020 (rescheduled to May 2021 due to Covid-19)

o Chair of the GdR ISIS Workshop "Enabling ultra-reliability, low latency and massive connectivity", June 18 2020 (virtual event due to Covid-19) o Keynote IEEE PIMRC Workshop Security Public RATs: "Practical examples of physical layer security", 4 Sep. 2016, Valencia, Spain o

chair of the IEEE Global Wireless Summit 2014, 11

  -14 May 2014, Aaborg, Denmark o Chair of the "Second International Conference on Communications, Connectivity, Convergence, Content and Cooperation", 11-14 May 2014, Aalborg, Denmark o Chair of the "WirelessVITAE, 10-13 May 2014, Aalborg, Denmark

1.2.10 Editor / Reviewer / Selected TPCs o

  2020-present: Associate Editor of the IEEE Open Journal on Signal Processing (OJSP) o Sep. 2019-present: Lead Guest Editor, EURASIP JWCN Special Issue "Physical layer security solutions for 5G-and-beyond", Editors: S. Tomasin, H.V. Poor, M. Baldi, S. El Ruayheb, X. Wang, to appear in 2020 o 2018-2019: Executive Editor Transactions on Emerging Telecommunications Technologies (ETT), Wiley o 2017-2019: Executive Editor of Internet Technology Letters (ITL), Wiley o Reviewer: IEEE Transactions (Trans.) on Information (Inf.) Forensics and Security, Elsevier Computers and Security, IEEE Trans. on Wireless Communications (Commun.)., IEEE Trans. Signal Processing, IEEE Trans. Vehicular Technologies, IEEE JSAC, IEEE Wireless Commun. Letters (L.), IEEE Commun. L., Trans. on Emerging Telecom Tech. (ETT), Eurasip JWCN, IEEE Trans on Commun., … o TPCs: more than 30 TPCs, indicatively IEEE GLOBECOM 2015, 2016, 2017, 2018, 2019, 2020, IEEE ICC 2014, 2015, 2016, 2018, 2019, 2020, IEEE WCNC 2016, 2019 (executive member), …

1.2.11 Selected Invited Talks (after 2016) o July 2019, "Physical layer security in delay constrained applications", NOKIA Bell Labs, FR o May 2019, "Physical layer security in delay constrained applications", Barkhausen Institute, Dresden DE o May 2019, "Physical layer security in delay constrained applications", ICS FORTH, GR o October 2017, "Emerging security paradigms", Thales, FR o March 2017, "Physical layer security for future networks", British Telecom, Adastral Park, UK o June 2016, "Practical examples of physical layer security",

Summer Research Institute, EPFL, CH 1.2.12 Past Administrative Responsibilities and Outreach Activities

  President of the Committee for Gender Equality and Diversity Athena Swan, Univ. Essex, UK o 2016-2017: Vice-president "Research Student Progress and Management Committee", Univ.

	CHAPTER 1. ACTIVITY REVIEW
	1.4 Recent Research Results
	1.4.1 Motivation on Studying Physical Layer Security and Resource Allocation
	for 5G Systems
	Physical Layer Security
	Essex, UK
	o 2015-present: Fellow of the Higher Education Academy, UK (professional title in pedagogical
	training)
	o 2014-2015: Organizer of student recruitment activities "Visit Days", Univ. Essex, UK

o 2016-2017:

  Mitev is registered at the Ecole Doctorale of CY University. I acted as his sole thesis director at the Doctoral School of CSEE between April-August 2017, before joining ENSEA.

	PhD Student Mr. Miroslav Mitev
	Supervision @60% for the period 25/4/2017-9/2020
	Thesis title: "Physical layer security for the Internet of things".
	Student co-supervised with Dr. M. Reed, Senior Lecturer at University of Essex, UK.
	Thesis VIVA (defence) scheduled for September 2020.
	Publications from thesis: [J21], [C37], [C36], [C33], [P1], [U1].
	M. PhD student Mr. Sotiris Skaperas
	Supervision @40% for the period 1/9/2017-9/2020
	Thesis title: "Data analysis and forecasting models for flexible resource management in 5th
	generation networks".

Co-supervised with Dr. L. Mamatas, Assistant professor at the University of Macedonia, GR. Thesis defence scheduled for September 2020. Publications from thesis: [J20], [J17], [C32], [U5].

  content popularity is discussed, reflecting [J17] and [C32] with Sotiris Skaperas and Lefteris Mamatas. Additionally, the application of the same detector for intrusion detection in a software defined network is demonstrated, showcasing part of our results with Gustavo Nunez and Cintia Borges Magri in [J18] and [C35]. Chapter 4 includes some of our early results with Mouktar Bello, Wenjuan Wu and Leila Musavian on the performance analysis of NOMA uplink networks under statistical delay constraints, published in [C38].

• Postdoc Dr. Mahdi Shakiba Herfeh: supervision @100%, 21/11/2019-20/5/2021 (fixed term 1.5 years), "Physical layer security for IoT applications", project ELIOT ANR PRCI, ETIS/ENSEA FR, publications: [BC3], [U1]. • Postdoc Dr. Nasim Ferdosian: supervision @90%, 1/1/2020-31/12/2021 (fixed term 2 years), "Non-orthogonal multiple access techniques under security and delay constraints", with Prof. I. Fijalkow, ETIS/ENSEA, FR, publications: [U5]. 1.7 Structure of the Rest of the Thesis This thesis is structured around my most recent publications (dating within the last two years) with the PhD students I supervise. In Chapter 2, novel authentication protocols using PUFs and SKG proposed by Miroslav Mitev, myself and Martin Reed are presented. This Chapter focuses on works presented in [J21], [C33] and [C37] and includes contributions by Leila Musavian. Next, in Chapter 3 a novel, real-time and non-parametric detector for changes in the mean value of

  and (2.25) into a single one as:

	CHAPTER 2. SECURITY PROTOCOLS FOR INTERNET OF THINGS APPLICATIONS
	Algorithm 1: Heuristic Greedy Algorithm for (2.27)-(2.28)
	1: procedure Heuristic(start, end, R j )
	j∈D	R j ≤	C κβ + 1	.	(2.26)

2:

  : the estimated on-line CP (eq. 3.26) ; TI: trend indicator (T I ts or T I f ) for n in X n do if n = m s then s=MBS(1,m

	end if
	end for
	end procedure

, is applied for a specified monitoring time frame l. If a content popularity change is detected at time instance k * on , the trend indicator subroutine ALLOCATION AND INTRUSION DETECTION Algorithm 1: The Real-time CP Detector (RCPD) procedure RCPD(X n ,m s ,k) ; X n : time-series of video views ; m s : running end of training period ; m: training period ; l: monitoring time frame ; d: period assuming no change ; T S on : on-line test statistic (eq. 3.18 or 3.21) ; cv on : critical value (eq. 3.24 or 3.25) ; k * on s ,1) ; calculate off-line CPs if array length(s) > 0 then m={max(s), m s } ; max(s) is the latest CP else m={max(1, m su), m s } ; u a large value end if else if m s < n < m s + l then calculate TS on (m,l) if TS on (m,l)>cv on then calculate TI signal CP and estimated direction m s = cp on + d ; keep a distance from cp on end if else if n = m s + l then m s = m s + l ; start a new training period

Table 3 . 1 :

 31 an CHAPTER 3. APPLICATION OF CHANGE POINT ANALYSIS IN EDGE RESOURCE ALLOCATION AND INTRUSION DETECTION Percentage of the successful CP detections for the standard and modified BS algorithm

		Test 1: two CPs	Test 2: four CPs
	µ	BS		modified BS	BS	modified BS
		True (false) alarm rate	True (false) alarm rate
	µ 1 =1	0.94 (0.06) 0.95 (0.05) 0.5 (0.258)	0.7 (0.05)
	µ 2 =1.5 0.95 (0.05) 0.95 (0.05) 0.5 (0.258)	0.9 (0.08)
	µ 3 =2	0.95 (0.05) 0.95 (0.05) 0.47 (0.53)	0.9 (0.1)
		Table 3.2: Success rates of trend indicators
			Test 1: two CPs Test 2: four CPs
		µ	T I ts	T I f	T I ts	T I f
			Success rate	Success rate
		µ 1 =1	0.99	0.99	0.99	0.99

Table 3 . 3 :

 33 Results of the RCPDs' algorithm CPs detection for one change in the mean value.

	ARMA(1,1)

Table 3 . 4 :

 34 Results of the RCPDs' algorithm CPs detection for two mean changes.

	ARMA(1,1)

Table 3 .

 3 5: Success rates of T I f trend indicator

	h	0	3	5	7	10
	Video Set 1 0.69 0.91 0.95 0.97 0.98
	Video Set 2 0.90 0.99 0.99 0.99 0.99
	of the ACF,

Table 3 .

 3 6: Empirical percentiles of mean values change rate.

										Percentiles Threshold
								10%	15%	25%	50%
				Standard		9%	13.1%	20.8%	42.21%
				Ratio type		9.5%	14.82%	28.22%	67.40%
	100	200	300	400	500	600	700	800	900 1000

Table 3 .

 3 7: Percentages of time-series with Time Dependencies Exceeding t Samples

	t piecewise	≥ 1 0.93	≥ 5 0.57	≥ 15 0.23	≥ 30 0.05	≥ 50 0.04

of scheme replicas since each of the time-series could be processed independently.

Table 3 .

 3

	8: Simulation Parameters
	Simulation parameters
	Topology	Square grid
	Number of nodes	36 and 100
	Simulation duration	36000 s
	Node boot interval	[0, 1] s
	Number of sinks	2
	Sinks position	Middle of the grid edge
	Data traffic rate	1 packet every 30 seconds
	Management traffic rate	1 packet every two minutes
	Data payload size	10 bytes
	Management payload size	10 bytes
	Data traffic start time	[2, 3] min
	Radio module power	0 dB
	Distance between neighbors	50 m
	Attacks begins after	28800 s
	IT-SDN parameters
	Controller position	center
	ND protocol	Collect-based
	Link metric	ETX
	CD protocol	none
	Flow setup	source routed
	Route calculation algorithm	Dijkstra
	Route recalculation threshold 10%
	Flow setup types	regular or source routed
	Flow table size	10 entries

Table 3 .

 3 9: FDFF Attack Detection, 36 Nodes, 5% Attackers

			Data packets delivery rate
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 31 33 31 31 37 33 31 31 31
	MAD 4	6	4	8	9	10	4	4
	DR	63 67 67 57 70 63 67 73 70
	FPR	7	10	7	0	0	0	0	0
	FNR	30 23 27 43 30 37 33 27 30
				Control overhead
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 19 16 18 12	9	11 19 16 18
	MAD 3	3	3	3	2	2	3	3
	DR	67 73 67 100 97 100 67 73 67
	FPR	0	0	0	0	3	0	0	0
	FNR	33 27 33	0	0	0	33 27 33

Table 3 .

 3 In the case of 36 nodes, the DR was between 73% and 83% when monitoring the data packets delivery CHAPTER 3. APPLICATION OF CHANGE POINT ANALYSIS IN EDGE RESOURCE ALLOCATION AND INTRUSION DETECTION

			Data packets delivery rate
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 24 26 27 22	20	21 29 31
	MAD 7	6	13	9	10	11 13	9
	DR	60 67 67 77	83	73 63 67
	FPR	23 20 20 10	7	13	0	3	7
	FNR	17 13 13 13	1	13 37 30
				Control overhead
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 19 17 19 13	10	12 19 17
	MAD 3	3	3	3	2	3	3	3	3
	DR	60 73 63 100 100 100 60 73
	FPR	0	0	0	0	0	0	0	0	0
	FNR	40 27 37	0	0	0	40 27

10: FDFF Attack Detection, 100 nodes, 5% Attackers Tables 3.11 and 3.12 summarize the FDFF attack detection results when 20% of nodes are attackers.

Table 3 .

 3 11: FDFF Attack Detection, 36 nodes, 20% Attackers

			Data packets delivery rate
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 28	28	28 30 24 28 29	28	28
	MAD	5	8	6	11	7	8	6	5	8
	DR	77	80	73 73 83 73 77	80	77
	FPR	3	07	7	0	3	0	0	3	0
	FNR	20	13	20 27 13 27 23	17	23
				Control overhead
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	M	8	7	7	5	5	5	8	7	7
	MAD	2	2	2	1	1	1	2	2	2
	DR	100 100 100 97 87 97 100 100 100
	FPR	0	0	0	3	13	3	0	0	0
	FNR	0	0	0	0	0	0	0	0	0

Table 3 .

 3 12: FDFF Attack Detection, 100 nodes, 20% Attackers

		Data packets delivery rate
	K	50		100		150
	α	90 95 99 90 95 99 90 95 99
	DTM 15 13 14	8	7	7	15 14 14

Table 3 .

 3 13: FNI Attack Detection, 36 nodes, 5% Attackers

			Data packets delivery rate
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM	7	6	7	8	7	6	7	6	6
	MAD 3	4	3	4	3	3	2	4	4
	DR	93 83 93 93 80 93 93 83 87
	FPR	0	10	0	0	13	0	0	10	7
	FNR	7	7	7	7	7	7	7	7	6
			Control overhead
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 28 25 27 35 26 33 28 25 27
	MAD 6	7	9	4	3	5	6	7	9
	DR	27 33 27 20 27 23 27 33 27
	FPR	3	3	3	0	0	0	0	0	0
	FNR	70 63 70 80 73 77 73 67 73

Table 3 .

 3 14: FNI Attack Detection, 100 nodes, 5% Attackers

			Data packets delivery rate
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM	6	6	6	6	6	6	6	6	6
	MAD 4	4	3	3	3	2	4	4	4
	DR	87 93 83 83 83 83 83 90 87
	FPR	13	7	17 17 17 17 13 10 13
	FNR	0	0	0	0	0	0	3	0	0
			Control overhead
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 34 29 33 35 37 37 34 29 33
	MAD 7	7	7	10	7	8	7	8	8
	DR	63 70 67 30 47 37 63 70 67
	FPR	0	0	0	0	0	0	0	0	0
	FNR	37 30 33 70 53 63 37 30 33

when monitoring the control packets overhead was 5 samples. Configuring the monitoring period in 100 we obtain the best DTM, but there was a drop in the DR if compared with the cases when using CHAPTER 3. APPLICATION OF CHANGE POINT ANALYSIS IN EDGE RESOURCE ALLOCATION AND INTRUSION DETECTION

Table 3 .

 3 15: FNI Attack Detection, 36 nodes, 20% Attackers

			Data packets delivery rate
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM	7	7	7	7	7	7	8	7
	MAD	2	2	2	3	4	3	2	2
	DR	100 100 100 100 100 100 100 100 100
	FPR	0	0	0	0	0	0	0	0
	FNR	0	0	0	0	0	0	0	0
				Control overhead
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 26	24	26	26	24	27	26	24	26
	MAD	8	7	7	17	11	13	8	7
	DR	57	70	60	43	63	57	57	70	60
	FPR	0	0	0	0	0	0	0	0
	FNR	43	30	40	57	37	43	43	30	40

Table 3 .

 3 16: FNI Attack Detection, 100 nodes, 20% Attackers

			Data packets delivery rate
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM	9	10	10	8	9	8	10	12 11
	MAD	5	8	7	4	6	4	5	9
	DR	100 100 100 100 100 100 100 100 97
	FPR	0	0	0	0	0	0	0	0
	FNR	0	0	0	0	0	0	0	0
				Control overhead
	K		50			100			150
	α	90 95 99 90 95 99 90 95 99
	DTM 27	24	26	26	25	25	27	24 26
	MAD	6	3	6	6	6	6	6	3
	DR	93	97	97	93	97	93	93	97 97
	FPR	0	0	0	0	0	0	0	0
	FNR	7	3	3	7	3	7	7	3
	monitoring periods of 50 and 150 samples.

  Assume a two-user NOMA uplink network with users U 1 and U 2 in a Rayleigh block fading propagation channel, with respective channel gains during a transmission block denoted by |h 1 | 2 < |h 2 | 2 . The users transmit corresponding symbols S 1 , S 2 respectively, with power E[|S i | 2 ] = P i , i = 1, 2 and total power

  , it was demonstrated Manuscript received November 16, 2016; revised March 17, 2017 and April 24, 2017; accepted May 19, 2017. Date of publication June 7, 2017; date of current version July 26, 2017. This work was supported in part by ENSEA, Cergy-Pontoise, France, and in part by LABEX MME-DII. This paper was presented at the Proceedings IEEE International Conference on Communications 2017[1],[2]. The associate editor coordinating the review of this manuscript and approving it for publication was Prof. Qian Wang.

	(Corresponding author: E. Veronica Belmega.)
	E. V. Belmega is with ETIS, UMR 8051, Université Paris Seine, Univer-
	sité Cergy-Pointoise, ENSEA, CNRS, France, and also with Inria (e-mail:
	belmega@ensea.fr).
	A. Chorti is with the School of Computer Science and Electronic
	Engineering, University of Essex, Colchester CO4 3SQ, U.K. (e-mail:
	achorti@essex.ac.uk).

Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org. Digital Object Identifier 10.1109/TIFS.2017.2713342

  , e k ), ∀i, k, ∈ I J , û(e i , β * ) = û(e k , β * ), ∀i, k, ∈ I L ,

	1.2 in
	[32, Sec.1.2.1]) is used:
	Definition 1: A strategy profile (α * , β * ) ∈ ÂL × ÂJ is a NE of the game Ĝ if the following hold:
	i) both players are indifferent among the pure actions that
	are played with positive probability at the NE
	û(α ii) the pure actions that result in strictly smaller payoffs are
	played with zero probability at the NE
	if

* , e i ) = û(α *

TABLE I TWO

 I PLAYER ZERO-SUM DESCRIPTION OF Ĝd characterize the set of NEs in a very simple and explicit manner as function of the system parameters.

	Theorem 4: The set of NEs of the game Ĝ is characterized
	as follows:
	1. If C(N P, ) < NC(P, ), then the game has a unique
	pure-strategy NE: both players spread their powers,
	α * = β * = e N+1 .
	2. If C(N P, ) > NC(P, ), then player L hops and
	player J spreads at the NE: α

* = (α 1 , . . . , α N , 0) and β * = e N+1 . The NE strategies of player L are given by the (infinite number of) solutions to the following system of linear inequalities:

  Manuscript received July 17, 2018; revised August 23, 2018 and September 11, 2018; accepted September 13, 2018. Date of publication September 19, 2018; date of current version February 19, 2019. The associate editor coordinating the review of this paper and approving it for publication was X. Zhou. (Corresponding author: E. Veronica Belmega.)

  y) denotes the joint probability density function (PDF) of the ordered channel gains |h M-1 | 2 and |hM | 2 , with |h M-1 | 2 ≤ |h M | 2 .For M unordered independent channel gains which are Rayleigh distributed with a unitvariance, we define the PDFs of the unordered |h M-1 | 2 and |h M | 2 as f (x) and f (y), respectively. Then, the cumulative distribution functions (CDF) of the unordered channel gains are given as F (x) and F (y). When all users' channel gains are ordered, the statistical features follow the theory of order statistics[25]. Hence, the joint PDF of the ordered |h M-1 | 2 and |h M | 2 , with |h M-1 | 2 ≤ |h M | 2 , is given by[25]

  , shown at the top of the next page. Firstly, when 1 ≤ m ≤ M E , i.e., |h m | 2 ≤ |h e | 2 , we have that log 2 1 + qm|hm| 2 Qm+1|hm| 2 +1 is smaller than or equal to log 2 1 + qm|he| 2 Qm+1|he| 2 +1 , which means that R m s = 0. On the other hand, when M E + 1 ≤ m ≤ M , we have 1 |hm| 2 ≤ 1

	|he| 2

  Case 1: for the m th user with 1 ≤ m ≤ M E In this case, it is known that the m th user has weaker channel gains compared to the eavesdropper, i.e., |h m | 2 ≤ |h e | 2 . Under this condition, by inserting (19) into (6), we have that E m cs = 0. Case 2: for the m th user with M E + 1 ≤ m ≤ M In this case, it is known that the m th user has stronger channel gains compared to the eavesdropper, i.e., |h m | 2 ≥ |h e | 2 . Under this condition, we can get that

	Then,
	by inserting (19) into (6), we have the conditional ESR,
	namely E m cs , given below.

TABLE 1 .

 1 Results from an ARMA generating process and for one change in the variance.

TABLE 2 .

 2 Results from a GARCH generating process and for one change in the variance.

  Citation information: DOI 10.1109/LWC.2020.2990563, IEEE Wireless Communications Letters 1 Performance Analysis of Uplink NOMA-Relevant Strategy Under Statistical Delay QoS Constraints Mylene Pischella, Senior Member, IEEE, Arsenia Chorti, Member, IEEE and Inbar Fijalkow, Senior Member, IEEE

  This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/LWC.2020.2990563, IEEE Wireless Communications Letters 2 respectively. Although in a standard NOMA network all users will employ NOMA, i.e., S and S K coincide, in NOMA-R, S is a subset of S K . The formalization of the NOMA-R criterion stems from the requirement that S includes all users whose achievable rates are greater with NOMA than with OMA, i.e.,

	1 +	ρP k x k 1 + j∈S ρP j x j	≥ (1 + ρP k x k )
		j<k

Authorized licensed use limited to: Princeton University. Downloaded on July 09,2020 at 18:43:09 UTC from IEEE Xplore. Restrictions apply.

2162-2337 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. 1 |S| .

  -t 2 dt. The boundary in both integrals in(5) is due to the fact that x 2 should always be such thatx 2 ≥ x 1 , butThis article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/LWC.2020.2990563, IEEE Wireless Communications Letters

		+4P 2 1 2ρP 2 1		+∞	2e -x1 e -x2 dx 2 dx 1
		x1=0			x2=x1
	+	+∞ x1= P 2 +	√ P 2 2 +4P 2 1 2ρP 2 1	+∞ x2= ρ 2 x 2 1 P 2 ρP 2 1 -1	2e -x1 e -x2 dx 2 dx 1
	= f (ρ) + g(ρ)			(5)
	where f (ρ) = 1 -e -g(ρ) = √ πe 4P 2 P 2 + 1 +P 2 √ P 2 2 +4P 2 1 ρP 2 1 2 4ρP 2 P 2 1 1 -erf P 1	2P2+ 2 √ √ P 2 2 +4P 2 1 P2ρP1 √ ρ	√ P 2	(6) (7)
	and erf(x) = 2 √ π 0 e ρ 2 x 2 x 1 P 2 1 -1 ρP2	is lower than x 1 if x 1 ≤	P2+ √ P 2 2 +4P 2 1 2ρP 2 1	.

τ (ρ) is a monotonically decreasing function with respect to ρ.

(5) is validated with Monte-Carlo simulations, shown in Fig.

1

, assuming that P 1 + P 2 = 1.

Authorized licensed use limited to: Princeton University. Downloaded on July 09,2020 at 18:43:09 UTC from IEEE Xplore. Restrictions apply.

2162-2337 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

  and because E 2 c,O increases without bound with ρ [8].This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/LWC.2020.2990563, IEEE Wireless Communications Letters

Authorized licensed use limited to: Princeton University. Downloaded on July 09,2020 at 18:43:09 UTC from IEEE Xplore. Restrictions apply.

2162-2337 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

Dans mon rôle de co-encadrent de thèse, je me suis efforcé de donner à mes étudiants l'occasion de travailler sur des sujets de recherche prometteurs et fondamentaux dans le cadre général de communications sans fil de cinquième génération (5G). Les oeuvres présentées dans cette thèse reflètent nos études dans deux domaines d'importance centrale pour la réalisation de la 5G : la sécurité et l'allocation des ressources.En ce qui concerne la sécurité, de nouveaux défis sont apparus en 5G avec le paradigme de l'Internet des objets (IoT) et les communications device to device (D2D) à faible latence. Les nouvelles verticales, telles que l'haptique et les communications véhiculaires (V2X), nécessitent une faible complexité et des mécanismes de sécurité à faible latence, en particulier dans le contexte de l'authentification. Dans cette thèse, des solutions d'authentification de légère complexité en utilisant des fonctions physiques inclonables (PUF) et des générations de clés secrètes (SKG) à la couche physique sont présentées.En outre, comme le contenu vidéo est responsable de plus de 70% du trafic IP mondial, il est important que les infrastructures de diffusion de contenu détectent et répondent rapidement aux changements de la dynamique de popularité du contenu. Dans cette thèse, nous proposons une approche flexible d'allocation des ressources qui tire parti des technologies unikernel et containers. L'allocation des ressources est entraînée par un détecteur de popularité de contenu en temps réel et à faible complexité, mis en oeuvre à l'aide des analyses hors ligne et en ligne des points de changement. Des variantes de ces algorithmes ont des applications dans la détection d'intrusion dans les réseaux définis par les logiciels de capteurs sans fil, qui sont discutés ensuite.Enfin, l'utilisation potentielle d'un accès multiple non orthogonal (NOMA) dans le lien ascendant sans fil est envisagée. Les premiers résultats de la comparaison des systèmes d'allocation NOMA par rapport aux schémas orthogonaux dans les régimes asymptotiques, montrent que les gains dans l'utilisation de NOMA se poursuivent dans le scénario des communications sous des contraintes statistiques de délai de qualité de service (QoS).

We note in passing that spreading / hopping can be directly implemented with a standard inverse fast Fourier

The coherence time corresponds to the interval during which the multipath properties of wireless channels (channel gains, signal phase, delay) remain stable[40][41][42]. It is inversely proportional to the Doppler spread, which on the other hand, is a dispersion metric that accounts for the spectral broadening caused by the user's mobility (for more details and derivation please see[41]).

An explanation of the optimality of this choice under different attack scenarios is discussed in[22].

Note that each observation can generate a multi-bit vector at the output of the quantizer.

As an example, despite the extra overhead, in URLLC systems advanced CSI estimation techniques are employed in order to be able to satisfy the strict reliability requirements.

Without loss of generality, the algorithm assumes that the channel gains are ordered in decreasing order as in (2.15), and, consequently, the rates Rj are also ordered in descending order. The ordering is a O(N log N ) operation and required in common power allocation schemes such as the waterfilling, and, therefore does not come at any additional cost.

Since part of the transmission rate is used for reconciliation information, and part for data transmission the terms "effective syndrome rate" and "effective data rate" are introduced instead of the term "effective capacity", for rigour. We note that we assume the information data and reconciliation information are accumulated in separate independent buffers within the transmitter.

i.e., that the ratio of reconciliation information to data is small as seen from (2.25))

The advantage of ratio-type CUSUM is that it does not require the estimation of long-run covariance (variance) matrices, which is the case for the standard CUSUM method.

http://www.larc.usp.br/users/cbmargi/www/it-sdn/

In the load balancing scenario discussed in Section VII, in the case of an increase in the content popularity a new content cache is being deployed, while conversely a decrease leads to the removal of an existing cache.

This choice is justified by our observations of the minimum distance between successive CPs in real data sets, presented in Section VI.

Except for the µ = 0 case.

We omit the results with true detection rate lower than 50%.

An ancient Greek proverb states that "a healthy mind (lives) in a healthy body".

The recent work[21] proposes to harvest energy from the jamming interference in a multi-user interference channel in which the jammer is not a strategic decision maker. In terms of formulation, a global optimization problem is investigated (as opposed to an adversarial game). Furthermore, the global performance metric in[21] does not incorporate security constraints and the harvested energy is not directly exploited in the communication phase, appearing only as an additional term in the utility function.

Authorized licensed use limited to: Princeton University. Downloaded on July 09,2020 at 18:41:56 UTC from IEEE Xplore. Restrictions apply.

Using constant probe signals preserves the Gaussianity of the inputs√ p i H i , √ γ i G A,i and √ γ i G B,i, which is optimal for the legitimate nodes and the jammer in our AWGN setting.

Authorized licensed use limited to: Princeton University. Downloaded on July 09,2020 at 18:41:56 UTC from IEEE Xplore. Restrictions apply. IEEE WIRELESS COMMUNICATIONS LETTERS, VOL. 8, NO. 1, FEBRUARY 2019

Finding explicit expressions for τ and τ is non trivial and involves solving nonlinear equations containing both logarithmic and fractional terms. Instead, we can exploit numerical methods based on iterative one-dimensional search (e.g., fzero in MATLAB) or methods relying on trust region or Levenberg-Marquardt techniques (e.g., fsolve in MATLAB).Authorized licensed use limited to: Princeton University. Downloaded on July 09,2020 at 18:41:39 UTC from IEEE Xplore. Restrictions apply.

In the following sections, the power-domain NOMA is simply referred to as NOMA. This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see http://creativecommons.org/licenses/by/4.0/

Hereafter, the user with the highest channel gain is referred to as the strongest user.

We note that in this case, these results are not limited to the strongest user.

The time index t is omitted hereafter.

The instantaneous channel gain he is unknown, if the eavesdropper is an external adversary.

Adaptive power allocation can influence the exact values of ESR, but this is beyond the scope of this paper and optimal power allocation to maximize the network's sum ESR is considered to be a future research topic.

For simplicity, the noise variances at all users and the eavesdropper are assumed to be identical and equal to σ 2 .

It is assumed that for every served user, there is one virtual buffer at the BS.

The legitimate NOMA users and the external adversary are independent, so the joint PDF is the product of two marginal PDFs.

Here, Δ is used in a finite sum, which approximates an infinite sum. The complete information is given in Appendix E.

The conclusion of monotonicity is obtained by excluding the possibility of E m s being a constant value, with respect to θm.

VOLUME 8, 2020

 VOLUME 8, 2020

 VOLUME 8, 2020

Authorized licensed use limited to: Princeton University. Downloaded on July 09,2020 at 18:43:09 UTC from IEEE Xplore. Restrictions apply.

Acknowledgements

I would like to take this opportunity to thank wholeheartedly the Telecom girls, Inbar Fijalkow, Iryna Andriyanova, Veronica Belmega, Marwa Chafii, Laura Luzzi, and, also Mylène Pischella, Marine Moguen and Aymeric Histace for all their support during the last three years.

5. We numerically compare the efficiency of our parallel approach with a sequential approach where SKG and data transfer are performed sequentially. This comparison is performed in two delay

the IEEE P1940 Standardization Workgroup on "Standard profiles for ISO 8583 authentication services" April 2020-present: Head of the Information, Communications and Imaging (ICI) Group of ETIS UMR 8051 (Award of CNRS delegation (half year travel sabbatical) to visit Prof. H.V. Foundation for Research and Technology Hellas (FORTH), Institute of Computer Science, International Outgoing Fellow (IOF) Marie Curie Research This work was supported in part by the EU's Horizon 2020 Research and Innovation Programme through the 4th open call scheme of the FED4FIRE+ under Grant 732638, in part by the EU-BRA Horizon 2020 NECOS Project under Grant 777067, in part by the Initiative d'Excellence Paris//Seine project eNiGMA, and in part by the ELIOT project under Grant ANR-18-CE40-0030/FAPESP 2018/12579-7.

Appendix A

Selected Recent Publications

This Appendix contains five recent publications, that have not been discussed in this thesis, on the following topics:

• Active attacks on SKG [J15];

• The use of energy harvesting to overcome jamming attacks [J16];

• Effective secrecy capacity in NOMA downlink networks [J19];

• Detection of changes in the variance of time series with application to resource allocation [J20];

• NOMA-relevant in uplink networks [J22].

III. OFF-LINE PHASE

In this Section, the training phase of the algorithm is discussed and the fundamental components of the off-line scheme are presented. We choose a retrospective CP scheme to ascertain that the on-line phase is indeed carried out on homogeneous data. We note that standard off-line CP schemes can only detect a single CP. To address the issue of detection of multiple CPs, we modify the basic scheme with a novel time series segmentation heuristic, that belongs to the family of binary segmentation algorithms, similarly to [11], [12].

Let {X n : n ∈ N} be a time series representing the content views, for a specific video. Since we are interested only in the variance fluctuation of the underlying random value (r.v.), we assume a constant, over time, expected value E(X i ), where E(•) denotes expectation. The stability of the mean value can be ensured by a data transformation, such as taking the first differences , n = X n -X n-1 , thus rendering E(X i ) = 0.

Considering the training phase, we have to check if the variance structure remains stable over the whole training period N . Consequently we study the null hypothesis,

where

, given that we have modified the time series so that E(X n ) = 0. The (general) alternative hypothesis is designed to allow the existence of multiple changes l i ∈ {1, . . . , N }, i = 1, . . . , r, where r is the multitude of changes,

Considering the boundary function b NL = cv on NL g NL , we choose to work with g NL = 1 as in [50]; consequently, the critical value is given by lim

D. EVALUATION OF THE CRITICAL VALUES FOR THE CPS TESTS

The on-line critical values for the three procedures are estimated using Monte Carlo simulations, similarly to the off-line case, considering that

With respect to the estimation of the magnitude of a detected CP denoted by cp * on , in the NP scenario, we estimate the deviation of the variance in pre-CP and post-CP data by comparing the variance of a pre-determined historical subsample, Var(X m s : X cp * on -h ) to the variance ''in the range'' of the detected CP as Var(X cp * on -h : X cp * on +h ), accounting for the fact that a time lag ±h is required to establish the presence of an actual change.

We finally propose an alternative scheme to predict the post CP behavior in the case of a parametric model. We apply the parametric model (ARMA or GARCH) on the time horizon t cp * on -h , . . . , t cp * on , in which we assume that the actual change has already occurred. Thus, a well defined subsample is provided to fit the model parameters and predict the next values using this adaptive model.

V. PERFORMANCE EVALUATION OF THE VARIANCE CP DETECTION APPROACHES ON SYNTHETIC DATA

In this Section, we evaluate the performance of the integrated algorithm with the three aforementioned variations of the on-line phase -NP, L and NL, -on two sets of synthetic data. In further detail, we report the results of Monte Carlo simulations using either an ARMA(1,1) or a GARCH(1,1) process to generate the time series; as a reminder, both ARMA and GARCH are well known models that have been shown to fit well video content popularity dynamics (see section II).

The synthetic sample size under consideration is N = 1000 while we introduce a variance CP at cp * = 500; this is achieved by transforming the initial parameters vector of the chosen model. Evaluations are conducted based on 1000 repetitions for a significance level α = 0.01. In all tests we set the beginning of the monitoring period at m s = 200, the monitoring window length at l = 100 and the minimum interval between two successive CPs at d = 80 (this latter choice is justified by experiments with real data that will be presented in Section V). We experiment with two values for the sensitivity parameter γ ∈ {0, 0.25} (as a reminder, γ only affects cv on NP and cv on L , see ( 31) and ( 32)). We first evaluate the performance of the three alternative on-line procedures in the integrated algorithm, for a wide range of ARMA(1,1) models. We recall that the variance of an ARMA(1,1) model depends on the model parameters φ i , θ i and the variance of the error terms σ 2 i , i.e.,

Var(X

We consider a change by transforming the time series model defined by the parameter vector β 0 to one of the vectors β i , i = 1, 2, 3, 4.

• Model 0: β 0 = (φ 0 , θ 0 , σ 0 ) = (0.4, 0.2, 0.5),

• Model 1:

• Model 3: β 3 = (0.5, 0.3, 1.5),

• Model 4:

We use Model 0 as the baseline. In Model 1 a small change in the error variance is introduced, which increases the uncertainty. Models 2 and 3 lead to medium changes in the variance and also transform the dependence structure between the r.v. On the other hand in Model 4 a large change is introduced by increasing the uncertainty.

In Table 1 we report the results of the simulation study. We depict the aggregate percentage of the CPs over the multitude of the simulations. For every test and each iteration we calculate the exact number of CPs detected:

• 0 when no CPs are detected, denoting the percentage of false negatives in all cases but the first (in which β 0 does not change); in this latter case it corresponds to the true success rate;

• 1 when a single CP is detected, denoting the true success rate in all cases but the first, in which it corresponds to a false positive rate;

• > 1 when more than one CPs are detected, denoting the percentage of false positives, in all cases other than the first. To obtain the overall false positive percentage, this value needs to be added to the false positive percentage above. Furthermore, we denote by ĉp * the median of the time instance of the identification of the true CP, evaluated in all cases but the first. The closest this number to the true point of the CP at 500, the quicker the detection and the better the responsiveness of the integrated algorithm.

Initially, we discuss the impact of the choice of the sensitivity parameter γ in the L and NP approaches. Studying Table 1, we conclude that γ = 0 is the most reasonable choice in the case of medium or more significant changes in the variance, since it leads to significantly lower false positive rates. On the other hand, in the case of only small changes in the variance, captured in our study in the γ = 0 and the significance level α = 0.05. To fit a GARCH(p, q) model we consider all the possible combinations of the p, q = 1, • • • , 4 and choose the orders p, q that minimize the Akaike information criterion (AIC).

The corresponding results are depicted in Fig. 6 at the top of the next page. The first row of results represent the detected changes in the mean value by using the RCPD algorithm presented in [11]. In the second and third row the estimated CPs in the variance are depicted, for the same time series, by applying on the first order differences Y n the non parametric (NP) approach and the GARCH (NL) approach, respectively. Solid lines represent upwards changes while dashed lines represent downward changes.

Firstly, we observe that the variance changes are closely connected to a corresponding mean change. In particular, variance changes are less in multitude and seem to be related to the most significant mean changes, which can be intuitively explained by considering that if the average number of views changes significantly, the variance in the number of views at the respective interval will follow a similar trend. The importance of jointly studying the changes in the mean and the variance value is also depicted in Fig. 6. For instance, in Fig. 6a, to describe or handle the content popularity dynamics it is crucial to estimate quickly the''explosion'' in variance after time instances 500 or 700, that leads to a high instability of the values from the mean. On the other hand, variance ''reduction'' detection is also important, as it implies that values remain relatively constant, like in Fig. 6a between time instances 600 and 700.

Both the NP and the NL approaches provide similar results in terms of the number of CPs and the detection time of the estimated CPs. More precisely, in Fig. 6a, both procedures detect the same number of changes, while the NP method gives a slightly quicker detection.

Focusing on the capability of the proposed algorithm to estimate the magnitude of a detected CP, we use the GARCH model. We estimate the parameters of the model considering 10 time instances before the detected change and forecast the variance for 10 time instances after the CP. For the time series in Fig. 6b, the actual variance after each change is 7.92, 12.51 and 38.66, while the predicted variance values are 7.39, 13.52 and 39.24, respectively. As we observe, in this case the NL algorithm can efficiently describe the post change variance behavior.

In the future, we will develop a joint approach identifying CPs simultaneously in the first and the second order characteristics, providing an aggregated and compact view of content popularity dynamics.

VII. CONCLUSION AND FUTURE WORK

In this paper, we presented an integrated algorithm for the detection of changes in the variance of a time series. We proposed to combine an off-line approach during which algorithmic and model parameters are learned. Subsequently, during the on-line part of the algorithm, changes in the variance of the time series are identified using a stopping time procedure. Whenever the value of a test statistic surpasses a predefined critical value, a change is declared.

To develop the test statistic we proposed three different approaches: i) a non-parametric approach, ii) a parametric approach using an ARMA model, and, iii) a parametric approach using a nonlinear GARCH model. Our studies using synthetic data indicated that the ARMA parametric approach does not generalize well. Due to this fact, we only performed experiments on real data using the non-parametric and the GARCH approaches. We concluded that both can equally well identify large deviations in the variance and that in the general case the non-parametric approach can provide quicker detection of CPs in the datasets studied in this work. In the future, we will develop joint detectors for the mean and the variance of video content popularity.