This paper focuses on Byzantine attack detection for Gaussian two-hop one-way relay network, where an amplify-and-forward relay may conduct Byzantine attacks by forwarding altered symbols to the destination. For facilitating attack detection, we utilize the openness of wireless medium to make the destination observe some secured signals that are not attacked. Then, a detection scheme is developed for the destination by using its secured observations to statistically check other observations from the relay.On the other hand, notice the Gaussian channel is continuous, which allows the possible Byzantine attacks to be conducted within continuous alphabet(s). The existing work on discrete channel is not applicable for investigating the performance of the proposed scheme. The main contribution of this paper is to prove that if and only if the wireless relay network satisfies a nonmanipulable channel condition, the proposed detection scheme achieves asymptotic errorless performance against arbitrary attacks that allow the stochastic distributions of altered symbols to vary arbitrarily and depend on each other. No pre-shared secret or secret transmission is needed for the detection. Furthermore, we also prove that the relay network is non-manipulable as long as all channel coefficients are non-zero, which is not essential restrict for many practical systems.
I. INTRODUCTIONRelay nodes are widely employed in modern communication networks to enhance coverage and connectivity of the networks.This dependence on the relaying infrastructure may increase the risk on security as malicious relays may forward false information in order to deceive the intended participants into accepting counterfeit information. These attacks, referred to as Byzantine attacks, impose significant ramifications on the design of network protocols [1][2]. With the presence of Byzantine attacks, the attack detection technique, which determines whether Byzantine attacks are conducted or not, is one of the key steps supporting secure communication. R. Cao is with the the 2The work on attack detection starts above physical-layer, where each link is treated as a unit-capacity bit-pipe, while specific physical-layer characteristics are shielded. Based on this setting, cryptography keys are often used to make attacks detectable [3], [4], while requiring the cryptographic keys, to which the relays are not privy, to be shared between the source and destination before the communication takes place. Without using cryptography keys, information theoretic detection schemes are proposed for multicast system or Caterpillar Network [5], [6]. These schemes are able to achieve errorless performance in probability, yet assuming that at least one relay or link is absolutely trustworthy.Besides these schemes treating channels as noiseless bit-pipes, there are also many other attack detection schemes designed according to specific characteristics of physical-layer channels for varying application scenarios. These schemes are mainly enabled by utilizing tracing symbols, or ...