1 Introduction

People are ready to access information and services whenever they want and from any location thanks to the fast development of mobile and wireless devices. Thus, there lies a greater tendency to adopt a human-centric perspective, which calls for more effective and prompt communication.

Additionally, in the ensuing decades, an immense number of smart terminals will have access to the internet, and the IoT (Internet of Thing) and other linked and wireless devices will produce additional data. This will result in increased Network congestion and an unequal distribution of resources since the ISM (Industrial, Scientific and Medical Network) band, which is unlicensed and free, would become congested. The static spectrum allocation method won't be able to keep up with the rising demand for spectrum resources as a result. Consequently, a need for the new dynamic spectrum utilization that has more coverage, capacity, and connectivity.

According to the FCC (Federal Communications Commission) survey, a significant number of spectrum resources have varying degrees of idealness in terms of time and space dimensions due to the static spectrum allocation strategy [1].

Traditional methods for utilizing licensed spectrum include multiplexing techniques like FDMA, TDMA, CDMA, and MIMO, which allow additional users but cannot address the issue of spectrum scarcity [2]. (Mitola & Maguire,1999) developed and initially coined the term, "Cognitive Radio" [3], in this context, while later described it as, "an intelligent wireless communication system which is capable to monitor usage of the neighboring spectrum and exploiting the idle spectrum without impacting the ongoing transmission" [4]. According to the FCC, Primary Users are licensed and non-licensed users known as Cognitive\Secondary Users. Additionally, these secondary users have the capacity to sense whether a spectrum is vacant and instantly leave it when a Primary User attempts to access it again. Furthermore, the capacity for reconfiguration aids in adjusting in accordance with the findings of spectrum sensing.

The cross-layer design that Cognitive Radio Network uses also allows them to carry out their primary tasks of Spectrum Sharing & sensing to improve spectrum efficiency. More specifically, the application layer is in charge of handling the application Quality of Service needs, whereas the transport and Network layers are in charge of routing and reconfiguring the Networks, respectively. Furthermore, the Physical and Data Link layers [5, 6] carry out spectrum detection and sharing.

Every tier in the aforementioned TCP/IP protocol stack's functions for Cognitive Radio Network is vulnerable to different kinds of security risks. Due to their dynamic character, which could negatively interfere with regular operations, Cognitive Radio network are more susceptible to cyberattacks [8]. The many vulnerabilities, assaults, and defenses aimed at the various Cognitive radio Network tiers are covered in-depth in this article. Furthermore, some of these assaults are novel because to the peculiar characteristics of Cognitive radio Network, while others have been carried over from conventional wireless Networks. This article provides a comprehensive survey of various attacks encountered on different layers of TCP/IP protocol stacks for Cognitive Radio networks. The classification of attacks is performed on the basis of different layers like Physical layer attacks in CRN include Primary emulation user, Objective function, overlapping secondary user and jamming attacks [9,10,11]. Likewise, the attacks targeted on MAC layers are as control channel saturation, control channel jamming and spectrum sensing data falsification attacks [12]. Similarly, attacks targeted on network layer are host addressing attacks, IP datagram fragmentation attacks and Routing attacks [13, 14].

This article describes numerous risks that fall within the categories of internal and external attacks. Additionally, inside assaults are those that are launched by unauthorized people, who may be trusted or untrusted. Additionally, an intrusive party can break secrecy by making outside attacks. Several researchers have proposed various threat detection algorithms over computer networks in order to improve customer confidentiality and service availability. Below Table 1 shows the relevant abbreviations used.

Table 1 Relevant abbreviations
Full size table

The paper has seven sections. In Section 2, we investigate how assaults in Cognitive radio Network target Physical and Data Link layers, in Section 3, we examine attacks aimed at Cognitive radio Network's Network layers. We examine several assaults detections and their countermeasures in Section 4. In Sections 5 and 6, we contrast a number of currently proposed mechanisms for defending against both Outsider & Insider threats respectively. We conclude with a succinct summary and recommendations for the future. In addition to this organization of this paper with brief description of various attacks encountered in different layers with their counter measures is shown below in Fig. 1.

Fig. 1
figure 1

Organization of this paper

Full size image

2 Attacks on the Physical and MAC Layers

The Physical Layer is in charge of sending bit streams from sender to receiver. The Physical Layer is responsible for modulation, signal detection, and frequency selection. The channel is accessed and controlled above its media access control layer [8, 8]. It includes spectrum detection, spectrum sharing, spectrum access, spectrum decision-making, and spectrum mobility. In the case of CRN, the MAC protocol is designed differently because it must sense the radio environment and configure accordingly. These, like any other layer, are vulnerable easily to variety of attacks. Because the functionalities of the physical and media access control layers overlap, they either directly or indirectly affect each other. As a result, any harmful activity related to the PL has an impact on the functioning of the MAC and vice versa. Due to the sheer dynamic nature of spectrum access, it is vulnerable to eavesdropping, belief manipulation attacks, malicious traffic injection, and attacks on various spectrum e.g., access, sensing, allocation, and sharing functionality [9]. Attacks in each of the preceding categories are further classified as Dynamic Spectrum, Belief Manipulation, Eavesdropping, Spectrum Sensing, Spectrum sharing and Malicious Traffic Injections. Attacks on Physical and MAC Layer is shown in below Fig. 2.

Fig. 2
figure 2

Attacks on Physical and MAC Layer

Full size image

2.1 Physical and Link-Layer attacks

Attacks in each of the preceding categories are further classified as Dynamic Spectrum, Belief Manipulation, Eavesdropping, Spectrum Sensing, Spectrum sharing and Malicious Traffic Injections.

  1. a.

    Spectrum Dynamic Nature Attacks

These attacks are designed to prevent the SU from dynamically accessing available spectrum holes. Primary User Emulation is a well-known example of this type of attack (PUE).

  1. b.

    Primary User Emulation

A primary user attack is a serious threat in which a malicious or selfish user imitates the PU signal in order to prevent SU from gaining access to the free channel. This kind of attack disrupts PU, trying to prevent it from using the PU channel and compelled it to vacate it on a regular basis [11]. These attacks are typically carried out by malicious or self-interested users, and they have a significant impact on spectrum sensing attacks. These types of attacks can be detected using techniques such as spectrum sensing, belief propagation method, data and feature-based, intrusion detection system, learning-based, and compressive sensing. Avoiding PUE attacks requires the use of cryptographic, game theory, or a combination of the two [13,14,15,16,17].

  1. c.

    Belief Manipulation Attack

These attacks are carried out in a cooperative environment in which the malicious user manipulates radio parameters, resulting in incorrect decision making. The most common attacks in this category are spectrum sensing data falsification and objective function manipulation attacks.

  1. d.

    Spectrum Sensing Data Falsification (SSDF)

SSDF is also known as a Byzantine attack. It is similar to cooperative spectrum sensing, in which multiple Sus work together to detect a frequency band. Furthermore, these malicious users provide false spectrum sensing results in order to gain control and degrade network performance. These types of attacks increase the possibility of false signaling [18].

Methods such as user reputation, onion peeling, and data mining can be used to detect SSDF attacks. SSDF attacks can be avoided by employing metrics based on reputation or trust [19].

  1. e.

    Objective Function Manipulation Attack

An objective Function attack is carried out by adjusting the radio parameters required to calculate the objective function, such as bandwidth, modulation type, frame size, coding rate, power, frequency, and so on. These attacks are detected using Optimization, Intrusion Detection Scheme, Alarms, and Voting Based Algorithm [20].

  1. f.

    Eavesdropping

In the wireless scenario, an attacker can fine-tune their receiver to the proper frequency to capture signals disseminated by legitimate users, overhear the information transmission, and inject the unwanted message into the network [21]. These attacks can be carried out on either the network or physical layers [22,23,24].

Eavesdropping attacks are classified as either active or passive. In passive eavesdropping attacks, the intruder overhears sensitive information and reacts or creates a false identity. A Passive eavesdropper, on the other hand, only acts as a spy [25].

Cryptographic solutions are typically used to combat eavesdropping attacks [26]. Furthermore, according to recent research, passive eavesdropping attacks can be detected by a device known as ghostbuster, which can detect leak signals during ongoing transmission and also aid in the detection of hidden presence in the network [27].

Eavesdropping attacks can be avoided by employing relay-based techniques, artificial noise injection, spoofing-based techniques, and multi-antenna-based security-oriented beamforming techniques [28, 29].

  1. g.

    Malicious Traffic Injection

This type of attack involves inserting unwanted messages into the network, causing congestion. A jamming attack is an example of a malicious traffic injection attack. In these attacks, malicious users continuously broadcast high-energy signals to obstruct legitimate users and force them to receive unwanted packets that consume a lot of bandwidth, resulting in network denial of service (DOS) [30, 31].

3 Attacks targeting network layer

Furthermore, the network layer functionalities are the same in traditional and cognitive radio networks. Routing is the fundamental function of the network layer, which is further subdivided into three major processes: path determination, data packet forwarding, and route maintenance [38]. Furthermore, in a Cognitive radio network, nodes involved in data packet forwarding from source to destination must monitor PU activity and vacate the channel as soon as a PU is detected [39]. As a result, these new specifications open the door to new types of security threats. Furthermore, the classification of network layer attacks is linked to its responsibility, such as attacks on routing functions, host addressing attacks, and data packet forwarding attacks. Figure 3 shows the classification of each type of attack.

Fig. 3
figure 3

Network layer attacks

Full size image

3.1 Attacks targeting the routing functions

Routing attacks occur during path determination from source to destination, packet forwarding, or route maintenance.

  1. a.

    Path Selection Attacks

During the path discovery process, the source must determine the best route to the destination. CRN's metric for this differs from that of other wireless networks in that it includes information about spectrum availability and route stability [38].

In this attack, the attacker's goal is to modify the new metric so that it is more likely to be part of the route to the specific destination.

  1. b.

    Wormhole

The attacker records the RREQ packet at any point and sends it to another conspiring attacker at any point in the network in the wormhole attack. Furthermore, the attacker's modified RREQ packet should reach the destination first. As a result, the first receive RREQ packet is accepted and the remaining genuine packets are ignored. The primary goal of the wormhole attack is to have the RREQ packet arrive at the destination faster [40].

  1. c.

    Sinkhole

In this type of attack, the malicious user poses as the finest node to forward the packet to its intended destination. Furthermore, it manipulates the RREQ packet and convinces the source node that the compromised node is the best node to take to the destination [41].

  1. d.

    Hello Flood Attack

In this attack, the attacker broadcasts a high-powered hello packet, misguiding the Sus about the malicious node's position as a neighbor. As a result, nodes begin sending data packets to the attacker, resulting in packet loss [42].

  1. e.

    Network Endo Parasite Attack (NEPA)& Low-Cost Ripple Effect Attack (LORA)

This type of attack causes more interference on a busy high priority channel. Furthermore, in this type of attack, the malicious node misleads its neighbor by indicating that it has switched to a different channel when, in fact, its channel has not changed.

3.2 Data forwarding attacks

Data forwarding attacks, once’s the attacker has gained access to the route to the destination, it can disturb the process of data forwarding by selectively dropping packets or increasing delay in packet transfer.

  1. a.

    Routing towards Primary User Attack

The routing protocol in CRN takes into account the availability of the channel that SU can use. As a result, the RPUA attacker deliberately forwards received packets to the SUs, which is closed to the PU potentially increasing packet transmission delay.

  1. b.

    Selective Forwarding

In this type of attack, the malicious user does not forward all received packets to their intended destination. Furthermore, this type of attack takes two forms: first, the attacker drops the packet coming from a specific node, resulting in denial of service (DOS) [43]. Second, the attacker discards packets from the arbitrary node. This type of selective forwarding attack is known as Neglect & Greed.

  1. c.

    Route Maintenance Attack

Nodes are used to keep track of the active path during route maintenance by sending HELLO and RERR messages. Furthermore, each node broadcasts the HELLO message on a regular basis to notify other nodes of its presence. When the destination is unreachable, RERR is displayed [44].

  1. d.

    Control Message Fabrication Attack

In this type of attack, malicious nodes fabricate the control message, Hello and RERR, to trick the source node into thinking the route to the destination is no longer accessible.

  1. e.

    Replay Attack

Control message fabrication, also known as a replay attack, entails using an old control packet, such as HELLO and RERR, that was previously received at a specific time [45].

  1. f.

    Attack on host addressing function

Each node in the network is given a unique IP address by the host addressing function. In CRN, SU’s cooperate with each other to accomplish tasks, such as determine a path to a specific destination, evaluating trust through collective recommendation from neighboring nodes in cooperative sensing of spectrum [46, 47]. The most common attack is Sybil attack. The Sybil attack can launch some attacks such as Spectrum Sensing Data Falsification (SSDF).

  1. g.

    IP datagram Fragmentation Attack

The fragmentation process allows the IP datagram to be broken down into small fragments for transmission across different types of networks. Furthermore, the sender fragments the IP datagram into tiny fragments, which are gather again at the destination to obtain the original IP datagram. As a result, the attack takes advantage of IP datagram functionality, and CRN, like any other wireless network, is vulnerable to attacks such as denial of service (DOS), which can lead to attacks such as the death ping or teardrop attacks. Furthermore, an attacker can use the IP datagram function to circumvent some node's filtering rules. This is accomplished through the use of either tiny fragment attacks or overlapping fragment attacks [48,49,50,51].

  1. 1.

    Death Ping Attack

  2. 2.

    Teardrop

  3. 3.

    Minor Fragment

  4. 4.

    Overlapping Fragment Attack

4 Detection and counter measure

To counter attacks at various layers, several detection techniques and countermeasures have been proposed in the literature. Furthermore, solutions to various attacks such as dynamic spectrum sensing, belief manipulation, eavesdropping, and jamming attacks were mostly found in the Physical and LINK layers. In addition to this, the routing mechanisms in CRN encounter various attacks that are more specific to a cognitive radio network. Furthermore, in the network layer, solutions for attacks on host addressing and IP fragmentation are proposed in the context of a traditional wireless network. To the best of our knowledge, a solution to the attacks encountered in the physical, MAC, and network layers in the context of CRN has been proposed, but there is still work to be done. Detection and Countermeasures is shown in below Fig. 4.

Fig. 4
figure 4

Detection and Countermeasures

Full size image
  1. a.

    TOOLS AND METHODS FOR DETECTING POTENTIAL THREATS

Due to the exponential increase in internet-connected devices, the search for reliable, effective, and powerful security protection mechanisms has risen to the top of the priority list in academia and industry. This section discusses various tools and methods for identifying and diagnosing potential threats. For example, intrusion detection systems, machine learning-based mechanisms, bio-inspired optimization algorithms, and software-defined radios are all capable of being utilized to improve the overall security of the wireless ecosystem [66]. Tools and methods for detection of potential threats in Wireless Ecosystem is shown in below Fig. 5.

Fig. 5
figure 5

Tools and methods for detection of potential threats in Wireless Ecosystem

Full size image

5 Comparison and discussion

Table 2 in the following section details various proposed work, the majority of which focuses on the security of CRN concerns to outside attacks. Outside attacks are primarily concerned with breaching data confidentiality and authentication. Data confidentiality ensures data protection and security from unauthorized access, and the data is transformed in such a way that it is inaccessible to unapproved malicious entities inside CRNs. Furthermore, authentication ensures that any communication between entities within the CRN architecture is authentic, ensuring that the data received from the assumed entity within CRNs is correct. The third and fourth columns provide a summary of the methodology and approach used to secure the network. The fifth column describes the attack that the proposed methodology protects against. The sixth column specifies whether the scheme is cooperative or non-cooperative. Furthermore, the last column specifies the additional security parameters such as energy consumption and QoS. Author [57] proposes using Random Secrecy Binning to secure communication with an untrusted SU. This technique aids in the defense against eavesdropping attacks. Researchers [58,59,60,61,62,63,64,65] proposed a framework for secure communication based on encryption techniques such as public key RSA, private key AES-128, AES-192, FH-DSA, and symmetric key.

Table 2 Demonstrates various proposed work majorly focuses on the security related to Outside Attacks in CRN
Full size table

Moreover, these framework helps to fight against attacks like Man in the Middle, DOS, SSDF, Byzantine attacks. Some researchers [66,67,68] uses the hybrid techniques based on Artificial Intelligence and Genetic Algorithm that helps to fight against the attacks such as Primary user Emulation, Spectrum sensing Data falsification.

6 Comparison of proposed research work preventing the inside attacks

Several authors proposed different mechanisms to protect against outside attacks in the previous section, including Eavesdropping, Man in the Middle, Primary User Emulation, False Alarming Rate, and many more [54,55,56,57,58,59,60,61,62,63,64,65,66,67,68]. Furthermore, this section focuses on attacks generated by malicious or selfish nodes within the cognitive radio network. Furthermore, cognitive radio networks are open and random-access networks in which unlicensed users can use channels not currently used by Pus. As a result, new security threats such as primary user emulation (PUE), SSDF, and a large number of unlicensed users have emerged, behaving maliciously and causing false alarms. Indeed, many researchers have proposed various methods for trusted communication in CRN, such as reputation-based methods for identifying malicious nodes and game-based methods for identifying malicious nodes. Stackelberg game theory, reinforcement learning trust model that intelligently detects attacks, omnipresent trust model based on recommendation and behavioral model, and other distributed models for evaluating trust by any peers without direct knowledge [59, 69,70,71,72,73,74,75,76,77,78,79,80]. Furthermore, Table 3 describes various proposed schemes for trusted communication, along with their advantages and disadvantages.

Table 3 Demonstrates the proposed schemes for trusted communication
Full size table

7 Challenges and future direction

A variety of detection and protection mechanisms are proposed to improve security across the Physical, MAC, and Network layers of a cognitive radio Network. These methods rely on information available about the users involved, who can be primary, secondary, malicious, or selfish. Despite various efforts to address and mitigate attacker threats, the Physical, MAC, and NW layers continue to present unique challenges. For example, predicting the location of PU in real-time scenarios is difficult and heavily reliant on localization-based techniques. Anti-jamming techniques also necessitate higher energy consumption and design complexities. For example, using cryptographic techniques consumes resources such as power and bandwidth. Furthermore, the same protocol as SU and PU on the same layer authentication is required. As a result, cryptography must be a dependable and secure infrastructure. Furthermore, strategy-based intrusion detection systems require a significant amount of memory to process and analyses traffic, resulting in NW overhead. SS techniques that can differentiate between signals from legitimate PU and signals from malicious users must also be developed. Furthermore, detecting malicious devices is difficult, and software defined radio may be required (SDR). As a result, enforcing security at the PL is critical, as it focuses primarily on the SS phase. Furthermore, the Network layer considers spectrum availability. Indeed, cognitive radio routing should address all spectrum availability and security concerns. There are several protocols available, including the secure efficient Ad hoc distance vector protocol (SEAD) and the secure Ad hoc on demand distance protocol.

8 Conclusion

The Spectrum scarcity has arisen as a result of the exponential growth in mobile and wireless devices over the last decade. As a result, it is critical to address the future spectrum supply and demand imbalance. Hence, Cognitive radio technology is essential as it addresses spectrum scarcity problem by investigating spectrum sharing schemes in four key steps: spectrum sensing, spectrum allocation, spectrum access, and spectrum handoff. However, due to its dynamic nature, it also allows malicious users to launch new attacks by leveraging cognitive radio functionalities at different layers of TCP/IP protocol stacks. This paper focuses on physical, MAC, and network layer attacks. Furthermore, it showed attacks that can occur only in CRN due to their spectrum sharing and reconfigurability features. In addition, we have discussed the threats that the CRN cross layer encounters, as well as the detection mechanism and its countermeasures.

Still many intriguing questions remain to be addressed in future works. As a result, frameworks for detecting and responding to all potential attacks are required. Furthermore, cryptography techniques at different layers can provide this trustworthy information, allowing them to learn and think about their surroundings. Furthermore, to address the cybersecurity challenge in the wireless ecosystem, a combination of a robust intrusion detection system and a machine learning technique that can be applied to wireless technology analysis could be a step forward towards problem resolution.