I. INTRODUCTION
THE next generation wireless communications systems will serve a variety of applications, from vehicle networks to the automation of the electric grid, everything is to be connected. The requirements and constraints vary according to the objectives of communication, and traditional metrics as delay and throughput no longer suffice to describe the performance of a communication system. In many cases, the communication should deliver time-sensitive and private information on time, possibly in a hostile environment. This work analyzes important trade-offs in wireless communications involving reliability, timeliness, and stealthiness, under the presence of channel fading, noise, and interference.
When a message carries information to guide any decision happening immediately upon receipt, it is crucial to analyze the system with respect to metrics related to information timeliness. Age of Information (AoI) defined as the time elapsed since the last received update was generated [1] provides the framework to quantify timeliness of messages transmitted through a communication network. Applications where timeliness is of utmost importance include networked control systems, industrial automation, vehicular networks, online gaming, and healthcare.
Many applications concerned with timeliness are also concerned with privacy or resilience to adversary activity. This is certainly the case in military applications, but it may also hold in civilian applications, for example when data transmission includes personal identifiable information. Due to the open and shared nature of wireless communications, information privacy is a fundamental challenge. In a hostile environment, wireless communication involves a transmitter and a receiver, as well as an eavesdropper who attempts to gather information about the communication between the two parties. The eavesdropper can have different objectives, such as decoding the transmissions or simply detecting whether communication is taking place. Ideally, communication in a hostile environment requires a coding scheme that is resilient to every jamming strategy. Classical security mechanisms seek to protect the content so that an adversary is unable to decode it. Unauthorized decoding has been the subject of extensive study, with research exploring encryption-based security and information-theoretical approaches [2].
In this work, we consider the problem of transmitting time-sensitive information in a hostile environment under the presence of noise and adversarial interference. We focus on the signal detection task performed by the adversary and investigate the performance trade-offs between AoI and transmission power under different channel conditions. While increasing the transmission power increases the signal-to-noise ratio (SNR) in the channel between source and destination, it also increases SNR in the channel to the adversary, increasing the probability of detection and interference. To the best of our knowledge, no previous work has discussed in detail the coupling of transmission power and the detection task performed by the adversary under time-sensitivity requirements. We elicit the trade-offs involved in the selection of transmission power to attempt stealthy communication with low probability of detection and low probability of interception (LPD/LPI). Since a low power transmission can be jammed with low power interference, the stealthy transmission may save power for the adversary. On the other hand, the detection errors may cause the adversary to waste power when a false alarm occurs. In this paper, we seek to better understand such trade-offs.
The remainder of this paper is organized as follows. Section II presents related work in the literature related to AoI, covert communication, and jamming in wireless communications. In Section III we present the models and assumptions for the communication system and adversary. Section IV presents the tools and metrics used in our analysis, including the outage and AoI formulations, as well as the deep learning models used for signal detection by the adversary. Section V presents numerical results. Section VI provides concluding remarks.
II. RELATED WORK
The pioneer work in [1] introduced the concept of AoI. The initial work on AoI [1], [3], [4] focused on queuing models to establish the need for new performance metrics for timeliness. Work by Ephremides et al. contributed to those initial steps, helping to sparkle interest from the wireless network research community [5]–[7]. The topic received a great deal of attention in the last decade. The literature is vast, and the applications that require such timeliness metrics are numerous; refer to [8] for an introduction and survey. This shift to consider information timeliness also led to a new paradigm of communications accounting for quality of information, as opposed to quantity in the traditional approach, such as envisioned for semanticand goal-oriented communications [9], [10]. To that end, AoI was analyzed for task-oriented communications with the goal of completing (potentially machine learning) tasks at the receiver rather than reconstructing messages [11],
The impact of hostile interference on AoI was addressed in [12], where the interaction is formulated as a non-zero-sum two player game to determine the transmission and interference power levels. A dynamic game was proposed in [13] to study the selection of transmission times, focusing on medium access for the definition of utilities. The work in [14] extended [12] for the case with background noise, presenting the Nash equilibrium strategies as function of updating rate, and a Stackelberg equilibrium with the transmitter as a leader. Channel access and scheduling for AoI-focused transmissions in adversarial environments have also been considered in [15] and [16].
Covert communication attempts to hide the fact that any content is being transmitted. Stealthy communication is a similar concept, where the symbols may be drawn from an innocent distribution when no communication happens, as opposed to the zero symbols required in covert communication. Previous research has investigated covert (stealth) communications, where the aim is to hide information in noise by reducing the SNR at the eavesdropper [17]–[20]. The combination of covertness and timeliness requirements has also been considered. In [21], time uncertainty was introduced to confuse the adversary and enable covert communication. A covertness maximization problem under the AoI constraint to optimize the transmit probability was considered in [22]. Covertness and timeliness trade-offs were also investigated in [23], seeking the optimal block-length and prior transmission probability.
when the transmission is not covert, it can be interfered with brute-force jamming using a fixed signal (such as Gaussian noise). Alternatively, an adversarial machine learning (AML) approach can be applied to generate signals for covert communications. Previous research in [24] has explored the privacy of wireless communications when an eavesdropper uses a deep learning classifier to detect transmissions of interest. In this setting, a single transmitter communicates with its receiver while an eavesdropper is present. To counter the eavesdropper, a cooperative jammer (CJ) (potentially with multiple antennas [25]) transmits carefully crafted adversarial perturbations to deceive the eavesdropper into classifying the received signal as noise. This constitutes an evasion or adversarial attack within the realm of AML. Another approach is for the transmitter itself to add perturbations to its own signals and deceive the eavesdropper [26] into misclassifying the perturbed signals as noise.
There are different levels of uncertainty for a jammer to overcome in a wireless network in order to launch a successful jamming attack. For example, the jammer may not know the role of a transmitter, e.g., a legitimate transmitter to jam or another jammer. To that end, concealing the role of a transmitter can create uncertainty for the jammer [27], [28] so that the jammer is potentially fooled into missing jamming opportunities. Also, the dynamic packet traffic makes the time instants of transmission uncertain for the jammer so that the jammer may waste jamming power as it is fooled into jamming idle slots when there is no transmission [29], [30]. In this paper, we consider traffic uncertainty as well as potential errors in identifying jamming opportunities (such as classifying received signals as idle channel by the eavesdropper). Subject to these uncertainty effects, we analyze AoI in the presence of an adversary with eavesdropping and jamming objectives.
III. SYSTEM MODEL
A. Communication Model
We consider a transmitter (Tx) sending time-sensitive information to a receiver (Rx) in a hostile environment where an active adversary (J) can potentially eavesdrop and interfere with the attempted communication. We assume that transmissions are subject to Rayleigh fading plus Gaussian noise. The signal transmitted by Tx will reach Rx through a fading channel with average power coefficient [TeX:] $$h_1$$, and it will reach the eavesdropper through another channel with average power coefficient [TeX:] $$h_2$$. When the adversary chooses to jam the signal, it will send an interference signal to Rx through another independent channel with average power coefficient [TeX:] $$h_3$$. We assume that a packet transmission takes place within the channel coherence time, so fading coefficients remain the same throughout the packet duration. The transmission power is denoted with [TeX:] $$P_T,$$ the jamming power (if any) is denoted with [TeX:] $$P_J.$$ All transmissions through channel [TeX:] $$h_i$$ are subjected to noise [TeX:] $$n_i$$ and noise power is denoted with [TeX:] $$\sigma_i^2$$, for [TeX:] $$i \in\{1,2,3\}$$ We illustrate the network model in Fig. 1.
We assume that communication takes place using fixed and independent resource blocks. The signal is modulated using phase shift keying (PSK), and we show results for binary (BPSK) and quadrature (QPSK) modulation. Unless otherwise stated, we assume a packet consists of 32 I/Q symbols. We also discuss the effect of the number of symbols in Section IV, where we show results for 16, 32, 64, and 128 I/Q symbols.
An outage occurs when the selected transmission rate is not supported by the channel. At the receiver, the interference caused by jamming activity may result in an outage, which we regard as a packet loss for the purposes of calculating the age of the information available at Rx. For each of the channels, we denote the SNR (SINR) with [TeX:] $$\gamma_i, \text { for } i \in\{1,2,3\}$$ with the understanding that [TeX:] $$\gamma_2 \text { and } \gamma_3$$ represent the SNR in channels connecting Tx and eavesdropper, and eavesdropper and Rx, where we do not assume any interference. In the direct channel between Tx and Rx, we have
where [TeX:] $$\mathbb{I}_J$$ represents an indicator function which takes the value [TeX:] $$\mathbb{I}_J=1$$ if the adversary decides to cause interference. We assume that an outage event occurs if the SINR falls below a certain threshold [TeX:] $$\gamma_{\min }$$,
By conditioning on the jamming activity, we write the probability of a packet loss as
B. Adversary Model
We assume a machine learning based adversary eavesdropper (J) listening to the communication channel and using a deep learning classifier to decide about the presence of a signal to interfere with. The output of the classifier is imperfect, so the adversary makes Type 1 (false positive) and Type 2 (false negative) errors. The accuracy of the classification task depends on the transmission power used by Tx and the channel quality between Tx and J.
When a signal is detected, the adversary may not only passively eavesdrop, but actively jam the signal, increasing the interference level to disrupt the communication between Tx and Rx. Let hypothesis [TeX:] $$\mathcal{H}_0$$ represent the absence of signal and [TeX:] $$\mathcal{H}_1$$ represent the presence of signal. That is, the signal at J, [TeX:] $$y_J(t),$$ under each hypothesis is
where X(t) is the received signal and [TeX:] $$n_2(t)$$ is the additive white Gaussian noise of power [TeX:] $$\sigma_2^2.$$ The decision about the presence of a signal is a binary hypothesis test. According to Neyman-Pearson criterion, the optimal decision rule for a given transmission power is the likelihood ratio test (LRT). With a threshold [TeX:] $$Y_{t h}$$ and average power received at the eavesdropper given by [TeX:] $$\bar{y}_J,$$ we write the decisions, [TeX:] $$D_0 \text { for } \mathcal{H}_0$$ or [TeX:] $$D_1 \text { for } \mathcal{H}_1$$ as
We assume that the adversary never transmits an interfering signal when it believes [TeX:] $$\mathcal{H}_0$$ is the true hypothesis. Let [TeX:] $$p_f=\mathbb{P}\left[\mathcal{D}_1 \mid \mathcal{H}_0\right]$$ denote the probability of a false alarm (false positive), and [TeX:] $$p_m=\mathbb{P}\left[\mathcal{D}_0 \mid \mathcal{H}_1\right]$$ denote the probability of misdetection (false negative). Under the LRT, the detection error probability is defined as
The well-known square root law established the information theoretic limits for covert communication for AWGN channels [31], if the minimum detection error satisfies
where δ is a tolerance level for the covert communication. A positive rate for covert communication can be obtained with the introduction of uncertainty in the channel to the adversary, including cooperative jamming and uncertainty in time of transmissions. For a machine learning based adversary, detection errors may also be introduced by the classifier or by an evasion attack.
The decision to jam the detected signal is subject to an average jamming power constraint [TeX:] $$\bar{P}_{\max }$$ that represents the concerns of an adversary with limited power budget. The average power [TeX:] $$\bar{P}_J$$ satisfies [TeX:] $$\bar{P}_J \leq \bar{P}_{\max },$$ with
C. Status Updating Model
We consider two options for the status updates: a buffer model (M1) and a bufferless just-in-time model (M2). We assume that Tx will not hold packets if they are ready to be transmitted, meaning that the only times Tx is silent is when it has no packets to transmit. A packet transmission has fixed duration as determined by the system’s resource block size.
(M1): A random arrival model where the packets are generated according to a Poisson process, placed in a buffer with unlimited capacity, and transmitted in a first-come-firstserved fashion. In this case, the system is modeled as a M/G/1 queue. With a service time S, where [TeX:] $$\mathbb{E}[S]=1 / \mu$$ and utilization factor [TeX:] $$\rho=\min \{1, \lambda / \mu\}$$, the expected sojourn time is calculated as the sum of service and waiting times as [32]
For a network with fixed resource blocks, we assume a deterministic service time of duration S = D and use the M/D/1 queue model, so [TeX:] $$\mu=1 / D \text { and } \rho=\lambda D \text {. }$$
(M2): A bufferless just-in-time updating model where the packet is generated and transmitted within one time slot. In this case, there is no queuing of packets waiting for transmission. We assume that Tx decides to send an update or not at a given slot according to a Bernoulli process, so updates are generated with rate λ as in M1. We assume that the time to generate the update is negligible, so service time is also assumed to have deterministic duration D, and system utilization is also [TeX:] $$\rho=\lambda D \text {. }$$
IV. PERFORMANCE ANALYSIS
A. Outage Probabilities
To evaluate the probability of losing a packet, we need to determine the probability distributions of the SNR, [TeX:] $$F_{\gamma(\cdot)}$$ and that of the SINR, [TeX:] $$F_{\gamma_I}(\cdot)$$. Under the assumption of Rayleigh fading with fixed transmission power and constant noise power during one resource block, the SNR is exponentially distributed,
where [TeX:] $$h_i$$ represents the average signal gain in the channel.
For the case of transmission between Tx and Rx under interference, we have the denominator of SINR [TeX:] $$I=\sigma^2+h_3 P_J$$ representing the total amount of interfering power. This random variable depends on the noise and the channel gain between the jammer and Rx. Assuming a constant noise power, the distribution function is
where [TeX:] $$h_3$$ represents the average signal gain in the channel between the jammer and Rx. Using standard tools to calculate the distributions of transformations of random variables, we obtain the distribution of the SINR as [33]
B. Signal Detection at Adversary
For both status updating models, (M1) with Poisson arrivals, or (M2) with just-in-time updates, we assume that the system is idle for a fraction of time given by [TeX:] $$1-\rho \text {, where } \rho$$ is the system utilization. With a fixed service time of duration D, so [TeX:] $$\rho=\lambda D$$. As we assume that Tx always transmits if there is packet waiting, [TeX:] $$\mathbb{P}\left[\mathcal{H}_0\right]=1-\rho=1-\mathbb{P}\left[\mathcal{H}_1\right].$$
Since the transmissions occur at random resource blocks, the adversary does not know when a signal is present, and needs to sense the channel every time slot. The scenario where the adversary has knowledge of transmission power, resource block length, and prior probability ρ represents the worst case.
The signal detection activity is implemented using a deep learning classifier. It is well-known that deep neural networks can effectively capture the spectrum data characteristics and provide higher accuracy in wireless signal classification compared to simpler machine learning models or other statistical methods such as energy detection [34]–[36]. We experimented with two types of networks, a feedforward neural network (FNN), and a convolutional neural network (CNN), with Glorot uniform initializer, Adam optimizer, and categorical cross entropy loss function, to implement a binary classifier with labels ‘Signal’ vs. ‘No signal’.
The FNN classifier used by the adversary to decide about the presence of a signal consists of three dense layers of sizes 64, 16, and 4, respectively, all with ReLU activation, and a dense layer of size 2 with SoftMax activation as the final layer for the two classes.
The CNN classifier consists of a Convolution2D layer with kernel size (1, 3) and ReLU activation function, followed by a Flatten layer, a Dense layer with size 32 and ReLU activation function, a Dropout layer with dropout rate 0.1, a Dense layer with size 8 and ReLU activation function, a Dropout layer with dropout rate 0.1, and finally an output Dense layer with size 2 and SoftMax activation function. FNN has a smaller memory footprint, making it more amenable for embedded implementation on edge devices with limited memory. On the other hand, CNN achieves higher classification accuracy at the expense of higher memory requirement (due to the dense connections introduced by the flatten later and the subsequent dense layers). We summarize the two architectures in Table I.
DEEP NEURAL NETWORK ARCHITECTURES FOR THE ADVERSARY CLASSIFIER.
The classification accuracy depends on the SNR in the channel between the transmitter and the adversary, as well as the number of symbols to be detected. The detection accuracy is better with CNN in comparison to FNN and, for both models, the accuracy increases when we increase the packet size. We illustrate this effect with packet sizes of 16, 32, 64, and128 I/Q samples, as shown in Fig. 2.
Classifier accuracy versus SNR between transmitter and adversary and effect of number of I/Q symbols per packet.
The increased accuracy for larger number of symbols comes at the expense of large number of parameters for the classifier. In Table II, we summarize the number of trainable parameters for each classifier versus packet size.
NUMBER OF TRAINABLE PARAMETERS VERSUS NUMBER OF I/Q SYMBOLS PER PACKET.
C. Communication Timeliness
For the status update model (M1), we consider a M/D/1 queue with packet errors and follow steps analogous to those taken in [37] to obtain the expected peak AoI (PAoI) [38]. We assume Poisson arrivals of rate λ and deterministic service time D. The service rate is [TeX:] $$\mu=1 / D$$ and the utilization factor is [TeX:] $$\rho=\lambda / \mu \text {. }$$ Packets are dropped with probability p (which depends on SNR, or SINR under potential jamming).
Let [TeX:] $$\mathcal{I}$$ denote the set of informative packets at the receiver. That is, the set of packets that are received successfully and contribute to reducing the AoI. Denote with [TeX:] $$t_k$$ the generation time of packet k, while [TeX:] $$t_k^{\prime}$$ denotes its departure time. Let [TeX:] $$t_k^{\prime \prime}$$ denote the time packet k begins to be served. We define the interarrival time, waiting time, service time, and sojourn time, respectively, as
We illustrate (14)–(17) and the evolution of AoI with a sample path in Fig. 3, where we denote with [TeX:] $$\Delta_0$$ the initial value of AoI and with [TeX:] $$A_k$$ the peak values reached immediately before receiving the packet update k.
Sawtooth curve - A sample path for AoI.
The PAoI is given by the interarrival time between two informative packets plus the time a packet spends in the system (sojourn time). Let m(k) be the first informative packet that arrives no earlier than packet k, defined as [37]
The interarrival is
and the service time is
If [TeX:] $$k \in \mathcal{I},$$ then [TeX:] $$m(k)=k, \hat{X}_k=0 \text {, and } \hat{S}_k=S_k \text {. }$$ Now consider an informative packet [TeX:] $$k_i$$. The next packet to arrive is [TeX:] $$k_i+1$$, and the next informative packet is [TeX:] $$k_{i+1}$$. The expected PAoI in this case is
where
Using [TeX:] $$\mathbb{E}\left[\hat{X}_{k_i+1}\right]=\mathbb{E}\left[\hat{X}_{k_i+2}\right],$$. we write
Substitute (23) in (21), together with [TeX:] $$\mathbb{E}\left[X_{k_i}\right]=1 / \lambda,$$ and using the expected sojourn time for M/D/1 queue [32], we obtain for updating model (M1) the average PAoI as
while for just-in-time (JIT) updates we eliminate the waiting time and
We could say that from a timeliness perspective, the cost of queuing is [TeX:] $$C=\mathbb{E}[W]=d \rho / 2(1-\rho) \text {. }$$ Clearly, the probability that a packet is dropped has a negative impact on PAoI. We highlight that under our model this probability p carries the intricate relationships between several parameters involved in the communication between Tx and Rx, and the decisions of an active adversary, subject to classification results and an average jamming power budget. In this paper, we investigate those relationships and trade-offs.
For updating model (M1), under a fixed probability of loss p, we calculate the arrival rate that minimizes the PAoI in (24), noting that [TeX:] $$\rho=\lambda D$$ and D is a deterministic service time. We calculate the derivative
and we select the root that satisfied the stability condition [TeX:] $$\lambda D \leq 1,$$ hence
For updating model (M2), since packets are not ‘aging’ in a queue, the PAoI is minimized with [TeX:] $$\lambda^*=1 / D,$$ so Tx would generate and transmit a packet in every resource block.
In the adversarial environment, some uncertainty with respect to the time of transmission works to the advantage of Tx. Also, the loss probability p depends on the system utilization (hence on λ) through the expected jamming power given by the constraint (9). We discuss this effect in Section V.
V. NUMERICAL RESULTS
We implemented a deep learning binary classifier to decide between ‘Signal’ or ‘No signal.’ Data is sent as packets, each one representing a data sample of size (2,32) corresponding to 32 I/Q (wireless signal) samples. We consider both BPSK and QPSK modulations, but our experiments indicate that the classifier performance is very similar for the two modulation schemes. We used 5000 samples – 80% for training and 20% for testing, and averaged our results over 20 simulations. Accuracy results are presented in Fig. 4, where we show in Fig. 4(a) the average accuracy as the average SNR in the channel between Tx and the adversary increases, and we show the detection and false alarm probabilities for BPSK in Fig. 4(b). As expected, accuracy and detection probability increase with SNR, while false alarm probability decreases with SNR.
Classifier performance for FNN and CNN architectures with BPSK and QPSK signals.
An interesting behavior is observed for the selection of jamming power. We assume the adversary satisfies the constraint in (9) with equality. If the channel under observation is very busy (Tx transmits often and [TeX:] $$\rho\gt 0.6$$), then the adversary with more accurate classifier (namely, CNN) would interfere more often but with less power than its counterpart with a weaker classifier (namely, FNN), which has higher probability of missing the signal but when it causes interference it does so with higher power. In the case of smaller channel utilization, with [TeX:] $$\rho\lt 0.4$$, the jamming power is smaller for the FNN adversary, because it wastes more power in the false alarm events. We illustrate the jamming power selection in Fig. 5, where we consider a fixed SNR in the channel between Tx and the adversary, [TeX:] $$\gamma_2=0 \mathrm{~dB}$$, and use the performance of each classifier corresponding to this SNR value. This result points to the need of adaptive power control for the adversary. From the perspective of the transmitter, those errors are beneficial and necessary for covert communication.
Jamming power versus channel utilization with fixed SNR between Tx and jammer [TeX:] $$\gamma_2=0 \mathrm{~dB}$$.
We illustrate the total detection error in comparison to the threshold for covert communication as in (8). We include two curves for the threshold to indicate the behavior with the variable δ which indicates the covertness tolerance. We plot the total error for the CNN and FNN classifiers and compare to the threshold depending on system utilization. In Fig. 6(a) we assume [TeX:] $$\gamma_2=0 \mathrm{~dB}$$ and use the corresponding performance for the FNN and CNN classifiers. We show that the total error can be above the threshold for very small or very large system utilization. In Fig. 6(b) we fix the system utilization to [TeX:] $$\rho= 0.4$$ and vary the transmission power (hence the SNR in the channel to the jammer). The total detection error decreases with increasing [TeX:] $$P_T,$$ and the comparison to the threshold lines indicate the need to keep transmit power very low if the objective is covert communication. As we discuss next, this objective of covertness may be conflicting with one for timeliness.
Detection error [TeX:] $$\epsilon$$ and threshold for covertness.
If the signal is successfully detected at the eavesdropper, then the transmitter may have to endure some level of adversary interference. Moving forward, we present results related to the communication between Tx and Rx in the presence of the adversary. Unless otherwise stated, we assume the noise power [TeX:] $$\sigma_i^2=1, \quad \forall i \in\{1,2,3\},$$ the required SNR threshold [TeX:] $$\gamma_{\min }=1$$, and the average jamming power constraint [TeX:] $$\bar{P}_{\max }=1.$$ When varying transmit power, we assume [TeX:] $$\gamma_2 \in[-5,10] \mathrm{~dB},$$ and investigate different conditions among channel coefficients. When varying system utilization, we fix [TeX:] $$\gamma_2=0 \mathrm{~dB}.$$ We assume that the adversary will interfere if the signal is correctly detected by the classifier, and the jamming power is the average power satisfying the power constraint (9).
We calculate the average PAoI as in (24) and plot versus system utilization with and without packet loss. Packets are lost with probability p depending on the SNR or SINR under jamming activity. The SNR to adversary is kept constant [TeX:] $$\gamma_2=0,$$ and transmission power is fixed to [TeX:] $$P_T=30 \mathrm{~dBm}.$$ We assume that average channel gains satisfy [TeX:] $$h_2=1$$ and [TeX:] $$h_1=h_2 / \alpha$$ where [TeX:] $$\alpha \in(0,1],$$ hence channel to adversary is assumed to be weaker than channel to intended receiver. We increase the system utilization by increasing the arrival rate, while D = 1. The Average PAoI is shown in Fig. 7(a) in four cases: A lower bound with loss probability equal to zero, a scenario with noise only, a scenario with (M1) updating model and adversary using FNN, and one scenario with (M1) model and adversary using CNN classifier to decide about the presence of a signal. The PAoI takes the traditionally seen U-shape form, but we highlight that in a highly congested system the effect of jamming becomes less significant. While the increase in average PAoI due to adversarial activity may surpass 47% for system utilization around [TeX:] $$\rho= 0.5$$, for a very congested system the difference falls below 20%, reaching 14% when [TeX:] $$\rho= 0.96$$ (comparing the CNN adversary with the noise-only case). Comparing the FNN and CNN adversaries, the CNN (a more efficient adversary) resulted in average PAoI increasing more than 5% for small system utilization, but for a more congested system the difference is below 0.1% reaching as low as 0.086% for [TeX:] $$\rho= 0.96$$.
From the adversary point of view, investing in a more accurate classifier is justified if the transmissions to be detected are sparser. Fig. 7(b) shows the average PAoI comparing the two status update models, (M1) representing the scenario where messages arrive according to a Poisson process and may wait in queue, and (M2) representing the scenario where updates can be generated just in time for transmission. We already expected that a system without queuing results in smaller AoI, but we also understand that it is not always feasible to generate the updates on demand with such a short latency, so the JIT assumption provides a lower bound. For small system utilization, the cost of waiting is small. For [TeX:] $$\rho= 0.3$$, we observe an improvement of 3% when using JIT updates as opposed to letting the updates in a buffer. If the updating rates are high, then JIT offers significant advantages, with a reduction of 20% at [TeX:] $$\rho= 0.75$$ and 41% at [TeX:] $$\rho= 0.9$$. Similar gains are observed for both the CNN and FNN adversaries.
Average PAoI [TeX:] $$A_p$$ versus system utilization ρ with [TeX:] $$h_2=h_3=1$$ and [TeX:] $$h_1=h_2 / \alpha$$.
With the same scenario of average channel gains [TeX:] $$h_2=1$$ and [TeX:] $$h_1=h_2 / \alpha$$, we now vary the transmission power [TeX:] $$P_T$$ between 25−40 dBm. The SNR in the channel to the adversary increases accordingly and the results present a clear trade-off between the potential improvement of communication between Tx and Rx as a result of higher power, and the improvement in classification performance that benefits an efficient operation of the adversary. We present the Average PAoI versus the transmission power in Fig. 8(a), and complement this example with the loss probabilities in this scenario, as shown in Fig. 8(b), where the packet loss considers the system utilization, the classification performance and jamming activity, and the outage probabilities with or without interference. The outage probability under noise calculated as (12), [TeX:] $$F_\gamma\left(\gamma_{\min }\right),$$ is maximized with the tuple [TeX:] $$\left(\alpha, P_T\right)^*=\arg \max _{\left(\alpha, P_T\right)} \frac{\alpha}{P_T}$$ and that is also the point that results in maximum packet loss and maximum average PAoI.
Average PAoI and loss probabilities with [TeX:] $$h_2=\alpha h_1 \text {. }$$
Next, we remove the condition that the average channel gains are related by the fraction α so that channel quality is worse in the channel between Tx and the adversary in comparison to the channel between Tx and Rx. Instead, we assume [TeX:] $$h_1=1$$ and [TeX:] $$\gamma_2 \in[-5,10] \mathrm{~dB}.$$ In this case, we observe that outage and loss probabilities are strictly decreasing with transmission power as shown in Fig. 9(b), and the same is observed for the average PAoI, as depicted in Fig. 9(a). It is interesting to note that the outage probability remains very high for transmission power below 22 dBm. The decay in outage probability under adversarial interference is slower, as the increased power also results in higher detection probability more interference from the jammer.
Average PAoI and loss probabilities versus transmission passivelyower with [TeX:] $$h_1=1 \text {. }$$
VI. CONCLUSIONS AND FUTURE WORK
This paper discussed the trade-offs involving communication reliability, timeliness, and stealthiness, characterizing the AoI in a hostile RF environment with an active adversary that can eavesdrop and jam the communication between a transmitter and a receiver. This adversary uses a deep learning classifier to identify the transmissions. We analyzed the effect of classification performance on the selection of jamming power for an adversary with limited resources, comparing the use of different deep neural network models. We show that the conditions for covert communication, with very low or very high system utilization, as well as low transmit power, may conflict with the timeliness objective. We analyze the AoI when the active adversary may cause packet loss in the system, and show that a proper trade-off between AoI and transmit power may exist, depending on the channel conditions between the nodes. Given the importance of analyzing new performance metrics that quantify quality and relevance of information, and the increasing concerns with secure communication in hostile environments, we envision that this analysis shall be extended in future work. Regarding the transmission of status updates, we have considered first-come-first-served policies, with arrivals modeled as a Poisson distribution. The analysis of other queuing models, including last-come-firstserved policy and more general distributions for arrival and service times are important extensions to consider. Modeling bursty arrivals, e.g., using compound Poisson processes is also of interest. Physical layer techniques may also be included in the analysis, including the use of coding. Regarding the adversarial environment, potential directions for future work include considering countermeasures to confuse the adversary, as friendly jamming and evasion attacks, and their effect in AoI and other metrics for information relevance.