2011 IEEE 22nd International Symposium on Personal, Indoor and Mobile Radio Communications

Trust Computation Through Anomaly Monitoring inDistributed Cognitive Radio Networks
Shameek Bhattacharjee, Saptarshi Debroy and Mainak Chatterjee
Department of Electrical Engineering & Computer Science
University of Central Florida
Orlando, FL 32816
Email: {shameek, saptarsh, mainak}@eecs.ucf.edu.

1
Abstract—The open philosophy of cognitive radio networks
makes them vulnerable to various types of attacks which compromises the efficiency of these networks. One such attack is
the Spectrum Sensing Data Falsification (SSDF) attack wheremalicious nodes report false spectrum occupancy data to others
which when used leads to inference that is far from the true
spectrum occupancy. Thus, there is a need to identify themalicious nodes or at least find the trustworthiness of nodes
such that the data sent by malicious nodes could be filtered out.
This paper proposes a scheme for trust based fusion bymonitoring anomalies in advertised spectrum usage reports bysecondary nodes. Such monitoring leads to evaluation of trustof a node by its neighbors. The calculated trust is then used todetermine if a neighbor node’s advertised data could be used forfusion or not. We provide a heuristic trust threshold for nodes
to disregard malicious nodes while fusing the data, which holds
good for any probability of attack. To validate our model we
conduct extensive simulation experiments. Our results show thatmajority of the nodes are able to fuse data with greater accuracy
for various probabilities or intensities of attack. We also compare
our results with blind fusion scheme and observe improvementin accuracy of fusion from individual nodes’ as well as overall
network’s perspective. We also report a very counter-intuitive
observation: at lower probabilities of attack, a malicious node’scontribution to the overall gain in cooperation is more than thedamage done.

I. I NTRODUCTION
In cognitive radio networks (CRN), the unlicensed secondary nodes continuously sense for available bands and use
them in an opportunistic manner [7]. Due to typical channel
impairments like shadowing and multi-path fading, localized
spectrum sensing by individual nodes is often erroneous. Thus
participation of secondary nodes in cooperative or collaborative spectrum sensing leads to more accurate inferenceof primary occupancy [3]. The negative side of cooperative
sensing is that it may be impaired by Spectrum Sensing Data
Falsification (SSDF) or Byzantine attacks, where participating
nodes lie about their local sensing result [1], [5]. The intensityof malicious behavior can be an all out attack (binary vector
inversion) or a more intelligent strategy of injecting false information on a varying fraction of the total number of channels.
Such false information adversely affects the cooperative fusion
results compromising system efficiency.
Most of the existing work on SSDF attacks that deals withmalicious node detection methods [5] or robust fusion of
1 This research was partially supported by the National Science Foundation,
under award no. CCF-0950342.

978-1-4577-1348-4/11/$26.00 ©2011 IEEE

advertised data [1] consider centralized CRN where there isa central entity to fuse advertised spectrum data. For ad-hoc
networks, monitoring packet forwarding anomalies was introduced in [6] to track routing misbehavior. In ad hoc networks,
packet forwarding anomalies decide the success and failurecounts which are then used to build and manage trust. As
far as trust management in CRN is concerned, authors in [2]provide a methodology for building and maintaining trust
metrics based on beta distribution model; however, successand failure are assumed to be known. In [8], authors provide
yet another trust establishment scheme for centralized CRN
based on success and failure counts. Although these works
introduce the concept of trust management in cognitive radio
networks, they only deal with mapping success and failurecounts to trust metrics without providing a framework that
actually measures and deciphers the number of successful
and failed interactions which is the basis of trust calculation.
Identifying such interactions as success or failure is an important issue in cooperative cognitive communication which still
remains unanswered. The hurdles discussed above motivatesthe investigation to understand successful interactions withrespect to cooperative spectrum sensing in an ad-hoc CRN
where each node must carefully assess the trustworthiness ofother nodes before using their advertised data.
In this paper, we propose an intelligent trust based fusion
model for robust fusion in the presence of Byzantine attacker
nodes. The trust is evaluated by capturing anomalies in spectrum sensing data advertisements without the nodes needing
to know the locations of others. All nodes, including themalicious ones, share their local spectrum occupancy reports
with the neighbors. In the absence of a centralized fusion
center, each node performs its own fusion based on received
spectrum information. Each node evaluates a trust coefficientfor every neighboring node, and consults the coefficient todecide whether it is advisable to include a neighbor’s advertised information for fusion. The cognitive nodes do not
require any prior information except the location of fixedprimary transmitters which are already known. Our method
enables a secondary node to predict the bounds on the received
power levels of its neighbors. A normalization criterion isthen used to predict binary occupancy vectors from thosebounds. The results of comparison between the predicted andthe advertised vectors of a neighbor is logged as ‘matches’and ‘mismatches’ (a cooperation misbehavior) and these form

593

TABLE I
N OTATIONS

the basis of the trust that secondary nodes constructs for all its
neighbors. Mismatches indicate presence of anomalies. Higher
trust value signifies more trustworthiness. To test and validate
the proposed models, we conduct extensive simulation experiments. We find that our proposed model ensures that malicious
nodes have significantly less trust coefficients than honest
nodes irrespective of their attack probabilities. We identify anheuristic threshold range for the trust coefficients (0.45 to 0.50)
below which a neighbor’s advertised occupancy vector canbe disregarded. We also compare our proposed trusted fusion
method with blind fusion technique for validating the benefitsof our fusion scheme. We also find that at lower probabilities
of attack the contribution of a malicious node to the entire
network in cooperative sensing is more than the damage it
does. Thus, including them for fusion does more good thanharm to the network overall.
II. S YSTEM M ODELWe assume all secondary nodes continuously undergo spectrum sensing to determine whether a channel is occupied ornot. Let us assume secondary node 𝑖 constructs its observed𝑖= [𝑑1 , 𝑑2 , ⋅ ⋅ ⋅ , 𝑑𝑛 ], where 𝑑𝑘 is
occupancy vector as: 𝐵𝑎𝑐𝑡
1 or 0 depending on whether the channel is occupied orunoccupied, and 𝑛 is the number of channels being monitored.
Once this binary vector is created, a secondary node would
broadcast this information to its neighboring nodes. Similarly,
a secondary node would also hear broadcast messages (binary
occupancy vectors) from its neighbors. Based on the vectors
a node receives, the node will employ a fusion technique toobtain a better estimate about the spectrum usage that cansignificantly improve the performance of spectrum sensing [1],[3]. Such cooperative sensing has other benefits such as
mitigating shadowing and multi-path effects.
We consider that the malicious nodes do not report theiroccupancy vectors truthfully; rather they inject errors in theiroccupancy vectors by flipping the bits in the vector. Flipping
0 to 1 implies that the channel is occupied when in reality it isunoccupied. Flipping 1 to 0 implies that an occupied channel
is reported as unoccupied. We denote probability of attack
𝑃𝑎𝑡𝑡𝑎𝑐𝑘 , as the percentage of channels that a malicious nodechanges from its actual observed vector.
A. Assumptions
1. We consider an ad-hoc secondary network with 𝑁 nodes;
𝐻 is the set of honest nodes and 𝑀 malicious/dishonest
nodes. The malicious nodes launch independent attacks without collaboration. We assume 𝜂(𝑀 ) < 𝜂(𝐻), since in arealistic network, the number of malicious nodes is less thannumber of regular honest nodes. The secondary network has
no dedicated central fusion center or allocation authority, andeach individual node fuses the spectral sensing data it hears
from other nodes. A node fuses the information it gathers andforms its opinion on the availability of spectrum.
2. The nodes need not know geographical coordinates ofother nodes involved in cooperation. We assume the transmit
power level of all secondary nodes are same. Knowledgeof the transmitter output power, channel losses, and antenna
gains with the appropriate path loss model allows us to findSymbol
𝑁𝑖
𝐻
𝑀
𝛾𝑡ℎ
𝑠𝑇𝑖𝑘
𝑑𝑘
𝑗
𝑃𝑖
𝑖
𝐵𝑎𝑐𝑡
𝑖
𝐵𝑎𝑑𝑣
𝑖𝑗
𝑃𝑝𝑟𝑒𝑑𝑖𝑐𝑡𝐷𝑖𝑗
𝑑𝑗𝑘 ∣𝑝𝑟𝑒𝑑𝑖𝑐𝑡(𝛼, 𝛽, 𝑋)𝑗𝑗
𝐸𝑡𝑟𝑢𝑠𝑡𝑖
𝑖
𝐵𝐹𝑏𝑙𝑖𝑛𝑑𝑖
𝑇 𝐵𝐹

Meaning
Neighbor set of node 𝑖
Set of honest nodes
Set of malicious nodes
Common threshold used to normalize power vectors
Distance between node 𝑖 and primary tower 𝑇𝑘 for channel 𝑘
Binary Decision on a channel 𝑘, 𝑑𝑘 ∈ 0, 1
Set of all neighbors of 𝑖, 𝑗 ∈ 𝑁𝑖
Measured power vector on 𝑛 channels at node 𝑖Actual binary occupancy vector formed at 𝑖
Advertised binary occupancy vector by node 𝑖
Vector of power ranges for neighbor 𝑗 predicted by 𝑖
Binary occupancy of node 𝑗, predicted by 𝑖
Predicted decision on any channel 𝑘, for 𝐷𝑝𝑗
Three tuple trust evidence
Reputation or trust of neighbor 𝑗 calculated by node 𝑖
Fusion result at node 𝑖, when all 𝑗 are included in fusion.
Fusion result Based on selective inclusion of 𝑗 based on trust

distance between the two nodes using R.S.S. (Received Signal
Strength) through localization or lateration [10].
3. Unlike in [5], which discusses a more restrictive fusion
model (AND fusion rule), we use majority voting fusion rule,
which gives more flexibility towards errors committed bynodes and/or malfunctioning nodes.
4. Each primary transmitter whether it chooses to transmit ornot, transmits only on one channel; so the channel associatedwith a primary transmitter is known. The primary transmitterthat transmits on channel 𝑘, is referred as 𝑇𝑘 , and since it isfixed, its coordinates (𝑥𝑇𝑘 , 𝑦𝑇𝑘 ) are known to the nodes.
5. We assume nodes use some interference aware channel
access framework, so that the secondary nodes do not interferewith others who might use the same channels. Interferenceawareness is outside the scope of this paper.
6. We assume that the data sent by a node is not corrupted by
the channel itself.
III. M ONITORING O BSERVATIONSIn the context of cooperative spectrum sensing in cognitive
radio networks, if we need to monitor for SSDF attack, weneed to monitor anomalies in spectrum sensing data reported
among the nodes participating in cooperation. In this section,
we deduce successful and failed interactions (anomalies) basedon which trust is calculated. We do this by predicting bounds
on received power of a neighbor and apply a normalization
criterion to obtain predicted binary vector, which is comparedwith advertised binary vector to unravel possible anomalies.
Subsequently, we propose a trust based filtered fusion scheme
which uses evidence based trust to decide whether to consider
the node’s advertised vector in fusion or not.
A. Predicting Power Vector
Suppose node 𝑖 measures the power vector 𝑃 𝑖 ={𝛾1𝑖 , 𝛾2𝑖 , ....𝛾𝑛𝑖 }, where 𝛾𝑘𝑖 is the power received on channel𝑘 and 𝑛 is the number[ of channels.] Each node 𝑖 forms its𝑖= 𝑑𝑖1 , 𝑑𝑖2 , ....𝑑𝑖𝑛 from it’s power vector
binary vector 𝐵𝑎𝑐𝑡𝑃 𝑖 by comparing 𝛾𝑘𝑖 with threshold 𝛾𝑡ℎ , where{= 1 when 𝛾𝑘𝑖 ≥ 𝛾𝑡ℎ𝑖
𝑑𝑘(1)= 0 when 𝛾𝑘𝑖 < 𝛾𝑡ℎ594

𝑖Each node 𝑖, advertises a public binary vector 𝐵𝑎𝑑𝑣.
{
𝑖
= 𝐵𝑎𝑐𝑡if node 𝑖 ∈ 𝐻
𝑖𝐵𝑎𝑑𝑣
𝑖
if node 𝑖 ∈ 𝑀∕= 𝐵𝑎𝑐𝑡(2)

Just the way node 𝑖 advertises its binary vector, it also hears
similar advertisement from its neighbors. For a neighboringnode 𝑗 ∈ 𝑁𝑖 , node 𝑖 estimates its possible power vector
using their mutual distance deciphered through received signal
strength (RSS) localization [10]. Though it is difficult for node
𝑖 to accurately predict the power vector of node 𝑗, neverthelessit can always estimate the lower and upper bounds using RSS
models. Let us describe how node 𝑖 estimates the upper and𝑖𝑗.
lower bounds of power vector as 𝑃𝑝𝑟𝑒𝑑𝑖𝑐𝑡
Locus of node j

T
j
(Yk )

j
(Y )
k low

high
(x

s
ij
s

Q

k

P
s

ik

(x , y )
i i

min

y )
T , T
k k

k
j

o

180

s
k
max
j

Fig. 1.

Max. and Min. RSS range on channel 𝑘 of neighbor node 𝑗

Assuming transmit power of all nodes are same, node 𝑖
calculates the distance between the node 𝑗 and itself wheneverit receives a signal (vector) from it as 𝑠𝑖𝑗 . Based on the
distance 𝑠𝑖𝑗 , node 𝑗 may be anywhere on the circle with node𝑖 at the center. We draw a straight line from the center of thecircle to the primary transmitter 𝑇𝑘 located at (𝑥𝑇𝑘 , 𝑦𝑇𝑘 ) as
shown in Fig 1. Under ideal conditions, the RSS due to 𝑇𝑘
will be maximum on the circle that is closest to 𝑇𝑘 , i.e., on
point 𝑃 and minimum at a point 𝑄 that is farthest from 𝑇𝑘 .
We denote the power levels at these two locations as [𝛾𝑘𝑗 ]ℎ𝑖𝑔ℎand [𝛾𝑘𝑗 ]𝑙𝑜𝑤 at distances 𝑠𝑚𝑖𝑛𝑘𝑗 and 𝑠𝑚𝑎𝑥𝑘𝑗 , respectively. For all
locations on the circle, the RSS on channel 𝑘 varies between[𝛾𝑘𝑗 ]ℎ𝑖𝑔ℎ and [𝛾𝑘𝑗 ]𝑙𝑜𝑤 .
Using commonly used model for RSS [4], we get
𝐴2
𝛾𝑘𝑖 = 𝑃𝑘 × 𝛼 ;𝑠𝑖𝑘With the estimated power vector being known, the inference
drawn by a node 𝑗 on channel 𝑘 is,⎧𝑗𝑗⎨ 0 if both [𝛾𝑘 ]𝑙𝑜𝑤 and [𝛾𝑘 ]ℎ𝑖𝑔ℎ ≤ 𝛾𝑡ℎ ;𝑗𝑗𝑑𝑘 ∣𝑖𝑛𝑓 𝑒𝑟 =(6)
1 if both [𝛾𝑘 ]𝑙𝑜𝑤 and [𝛾𝑘𝑗 ]ℎ𝑖𝑔ℎ ≥ 𝛾𝑡ℎ ;⎩𝑋 otherwise
Eqn. 6 is the normalization criterion. When both the lowerand higher predicted power levels on a channel are lessthan 𝛾𝑡ℎ , it implies that channel 𝑖 is not being used byany primary transmitter, i.e., channel is unoccupied. So in
this case 𝑑𝑗𝑘 ∣𝑖𝑛𝑓 𝑒𝑟 is inferred as 0. Similarly, if both thelower and higher predicted power levels are greater than𝛾𝑡ℎ , 𝑑𝑗𝑘 ∣𝑖𝑛𝑓 𝑒𝑟 is inferred as 1. Such inference can be drawn
for the above two scenarios. However, no inference can be
drawn when one of [𝛾𝑘𝑗 ]𝑙𝑜𝑤 and [𝛾𝑘𝑗 ]ℎ𝑖𝑔ℎ is above 𝛾𝑡ℎ andthe other is below 𝛾𝑡ℎ . We denote such cases as 𝑋. Now
node 𝑖 compares 𝐷𝑖𝑗 = [𝑑𝑗1 ∣𝑖𝑛𝑓 𝑒𝑟 , ......, 𝑑𝑗𝑛 ∣𝑖𝑛𝑓 𝑒𝑟 ] with received𝑗
𝐵𝑎𝑑𝑣= [𝑑𝑗1 , ....𝑑𝑗𝑛 ] on corresponding channels 𝑘 for matches
and mismatches.
A match occurs when on channel 𝑘, 𝑑𝑗𝑘 ∣𝑖𝑛𝑓 𝑒𝑟 = 𝑑𝑗𝑘 . A
mismatch occurs if 𝑑𝑗𝑘 ∣𝑖𝑛𝑓 𝑒𝑟 ∕= 𝑑𝑗𝑘 . If 𝑑𝑗𝑘 ∣𝑖𝑛𝑓 𝑒𝑟 = 𝑋 no
inference can be drawn. For each neighbor 𝑗, node 𝑖 computes
the number of matches, mismatches, and no inference with𝑗as (𝛼, 𝛽, 𝑋)𝑗 respectively.
𝐵𝑎𝑑𝑣
B. Trust Model
The logic behind the trust evidence is to evaluate how many
have achieved trustworthiness (𝛼), how many inferences havenot succeeded to achieve trust (𝛽), and how many inferences
are uncertain. To account for the 𝑋 channels where no inference could be drawn, we consider them in the ratio of 𝛼 : 𝛽.
𝑋𝑗𝑗Thus the number of matches is updated as 𝛼𝑗 + 𝛼𝑗 +𝛽
𝑗 × 𝛼 .
Based on the proportion of matches, the instantaneous trust
coefficient that node 𝑖 computes for node 𝑗 is given by𝑗𝑗=
𝐸𝑡𝑟𝑢𝑠𝑡𝑖𝛼𝑗 × (1 + 𝛼𝑗𝑋+𝛽 𝑗 )𝛼𝑗 + 𝛽 𝑗 + 𝑋 𝑗(7)𝑗where 0 < 𝐸𝑡𝑟𝑢𝑠𝑡< 1.
𝑖

C. Trust based Selective Fusion

Using the computed trust coefficients, we study the performance of two fusion schemes: blind fusion and proposed
where 𝐴 = frequency constant, 𝛼 is path loss factor, 𝑠𝑖𝑘 is trust-based fusion.
1) Blind Fusion: For blind fusion, node 𝑖 considers all
the distance between 𝑇𝑘 and node 𝑖, and 𝑃𝑘 is the transmit
𝑗from all its
its
neighbors to be honest and includes 𝐵𝑎𝑑𝑣
power of 𝑇𝑘 .
𝑖.
Weformally
defineBlindneighbors
along
with
its
own
𝐵
2
𝑎𝑐𝑡
𝐴
𝑗
𝑖
𝑖
[𝛾𝑘𝑗 ]ℎ𝑖𝑔ℎ = 𝑃𝑘 × 𝑘 𝛼 ;(4) Fusion as 𝐵𝐹𝑏𝑙𝑖𝑛𝑑= ∇[𝐵𝑎𝑑𝑣⊕ 𝐵𝑎𝑐𝑡], 𝑗 ∈ 𝑁𝑖 where ∇ is the𝑠𝑚𝑖𝑛𝑗
operator for majority voting rule. Majority voting is a popularfusion rule where final fused inference on a channel is based
𝐴2𝑗(5) on what at least half the neighboring nodes advertise with all[𝛾𝑘 ]𝑙𝑜𝑤 = 𝑃𝑘 × 𝑘𝛼;𝑠𝑚𝑎𝑥𝑗
the nodes treated equally. ⊕ is the operator for combination.
2) Trust-Based Fusion (TBF): We propose a fusion scheme
We divide Eqn. 3 with Eqn. 4 and Eqn. 5. Since whereby we only consider neighboring nodes whose 𝐸 𝑗𝑡𝑟𝑢𝑠𝑡𝑖𝑠𝑖𝑘 , 𝑠𝑚𝑖𝑛𝑘𝑗 and 𝛾𝑘𝑖 are known to node 𝑖, it is easy to is higher than some trust threshold, Γ . (Later in SectionIV,
𝑜𝑝𝑡find [𝛾𝑘𝑗 ]ℎ𝑖𝑔ℎ and [𝛾𝑘𝑗 ]𝑙𝑜𝑤 , respectively. Node 𝑗 may we show how to find the heuristic threshold). Thus, for trustbe anywhere on the circular locus. Now the predicted based fusion, node 𝑖 only considers those neighbors whose𝑖𝑗𝑗= 𝐸𝑡𝑟𝑢𝑠𝑡
power vector of node 𝑗 is a 2-tuple vector 𝑃𝑝𝑟𝑒𝑑𝑖𝑐𝑡≥ Γ𝑜𝑝𝑡 . In effect, the fusion is done with information
𝑖
[ 𝑗
]
𝑗
𝑗
𝑗
𝑗
𝑗
([𝛾1 ]𝑙𝑜𝑤 , [𝛾1 ]ℎ𝑖𝑔ℎ ), ([𝛾2 ]𝑙𝑜𝑤 , [𝛾2 ]ℎ𝑖𝑔ℎ ), ......, ([𝛾𝑛 ]𝑙𝑜𝑤 , [𝛾𝑛 ]ℎ𝑖𝑔ℎ ) . from trusted nodes only.
(3)

595

{

≥ Γ𝑜𝑝𝑡< Γ𝑜𝑝𝑡Node 𝑗 trusted ;Node 𝑗 is not trusted(8)1
Honest nodes

0.9

A. Simulation set up
We simulate a network of square 60x60m grid, with 30
randomly scattered nodes out of which 9 nodes are programmed to be malicious. All nodes continuously scan 50
channels, record the signal power on each of them, and create
the binary occupancy vector which they then advertise. The
malicious nodes attack (i.e., change the bits in the channel
occupancy vector) with a probability between 0.2 to 0.8. It
is to be noted that high probability of attack facilitates easy
detection and at the same time very low attack probability do
not significantly effect the network. Transmission range of allnodes is considered to be 20m, thus a node hears broadcasts
from all the nodes that are in a 20m radius.
B. Trust Measurement
In Fig. 2, we see the difference in trust distribution between
honest and malicious nodes when malicious nodes attack withprobability 0.5. We measure average trust of each node as
evaluated by all other neighboring nodes. We observe malicious nodes have significantly low trust values than the honest
nodes. In Fig 3(a), we plot a particular malicious node 14’strust against various probabilities of attack and observe thatthe node’s trust is lowered as it becomes more aggressive inattacks, i.e., the more it attacks the more damage it does to its
trustworthiness. This is in general true for all malicious nodes
which is shown in Fig 3(b). We observe that the average trust
for set of honest nodes does not change, but average trust formalicious nodes decreases with increased attack probability.

Average trust value

We define Trust based selective fusion result as𝑖
𝑇 𝐵𝐹 𝑖 = ∇[𝑇 𝐹 𝑆𝑖 ⊕ 𝐵𝑎𝑐𝑡], where 𝑇 𝐹 𝑆𝑖 is the trusted fusion
set of binary vectors accumulated by node 𝑖 using equation 8,𝑗of trusted nodes only.
which includes 𝐵𝑎𝑑𝑣
Although the nodes are not aware of the ideal scenario, we areaware of what would have been the ideal fusion result, which is𝑗𝑗= 𝐵𝑎𝑑𝑣, so we define
the case when for all node 𝑗 ∈ 𝑁𝑖 , 𝐵𝑎𝑐𝑡𝑗𝑗𝑖
⊕ 𝐵𝑎𝑐𝑡].
Ideal Fusion result for node 𝑖, 𝐵𝐹𝑖𝑑𝑒𝑎𝑙 = ∇[𝐵𝑎𝑐𝑡

0.7
0.6
0.5
0.4
0.3
0.2
0.1
0

Fig. 2.

51015Node ID

20

25

30

Trust of honest and dishonest nodes for Probability of attack=0.5
0.8

0.5
Average trust as seen by all other nodes

IV. S IMULATION M ODEL AND P ERFORMANCE A NALYSIS
In this section, we study the performance of our proposed
technique and its effectiveness in capturing cooperation misbehavior. First, we provide results for the average trust values ofdifferent nodes, which reflect that our scheme is successful incapturing cooperation misbehavior through trust coefficientson a customized simulator. Results show that the malicious
nodes have a trust distribution significantly lower than honest
nodes. Secondly, we show how we use the TBF scheme
to filter out advertised data from malicious nodes. We also
show TBF is robust than blind fusion. In the simulation, we
evaluate performance metrics, by a parameter ‘Mismatch’. For
a particular case of fusion scheme, mismatch is the difference𝑖and the corresponding 𝑇 𝐵𝐹 scheme. Misbetween 𝐵𝐹𝑖𝑑𝑒𝑎𝑙
match reflects deviation of Cooperative sensing accuracy ofnodes in coexistence with malicious nodes. We compare the‘Mismatch’ for each fusion scheme to show that TBF works
better than blind fusion. We compare average mismatch ofblind fusion and TBF from overall network’s perspective.

Dishonest nodes

0.8

0.7

Trust value

0.45
0.4

Average trust value𝑗
𝐼𝑓 𝐸𝑡𝑟𝑢𝑠𝑡
𝑖

0.35
0.3
0.25
0.2

Dishonest nodes
Honest nodes

0.6
0.5
0.4
0.3

0.15
0.2

0.1
0.05
0.3

0.4

0.5
0.6
Probability of attack

0.7

0.8

0.1

0.2

0.3
0.4
0.5
Probability of attack

0.6

0.7

(a)
(b)
Fig. 3. Scenario:(a) Node 14 (malicious node) trust decrease with increased
probability of attack (b) All malicious nodes trust decrease

C. Threshold for trust-based fusion
From Fig 4, we obtain the heuristic value of trust thresholdΓ𝑜𝑝𝑡 for trust based fusion. We perform a TBF with Γ ranging
from 0.2 to 0.8 and compare how ‘mismatch’ varies from ideal
results. Fig. 4 shows that for very low values of threshold there
are more mismatches since most of the malicious nodes areincluded for the purpose of fusion. However, as we increase
the threshold, malicious nodes start getting discarded andmismatch decreases. When the threshold is very high (above
0.6), the mismatch again increases as high threshold meansthat we are also discarding the honest nodes along with themalicious nodes. Since our goal is to minimize the total
average mismatch from ideal scenario, we notice a rangeof threshold values from 0.45 to 0.51, where the average
mismatch is least for different probabilities of attack. Fromindividual node’s perspective, the idea is to exclude maximum
number of malicious nodes from fusion. We choose Γ𝑜𝑝𝑡
as 0.51, because we can exclude malicious nodes even atlower probabilities of attack. This is evident from Table IV-C
containing average trusts for malicious nodes for different
probabilities of attack. Now if Γ𝑜𝑝𝑡 was 0.45, the nodes are
successful in excluding majority of malicious nodes fromfusion for higher probabilities of attack but not for lower
probabilities of attack because malicious nodes have lower
trust values when they attack more aggressively. If we take
0.51 as threshold, then more malicious nodes are excluded forlower probability of attack. However if we take Γ𝑜𝑝𝑡 = 0.45,
we allow a few malicious nodes in fusion for lower probabilityof attack.
D. Performance of trust based selective fusion
Using Γ𝑜𝑝𝑡 = 0.50, we compare the trust-based fusion withblind fusion fusion for ‘mismatch’ shown in Fig 5. We see thatthe total mismatches are far more in Blind Fusion, than thetrusted and selective fusion. We also provide the performanceof TBF from individual node’s perspective in Fig 6(a) and596

Trust Value for
𝑃𝑎𝑡𝑡𝑎𝑐𝑘 = 0.5
0.36667
0.38125
0.39167
0.47143
0.21500
0.442860.36563
0.291670.35000

Trust Value for
𝑃𝑎𝑡𝑡𝑎𝑐𝑘 = 0.7
0.241670.260940.15000
0.307140.112500.246870.232140.17500
0.16111

1

0.8

0.6

0.3
0.2
0.1
5

Average mismatch for all nodes

12
10
8
6
4

0.3

0.4

0.5
0.6
Trust threshold

0.7

0.8

180

Total Mismatch Count

160
140
120
100
80
60
40
20
Trust Based Fusion

Blind Fusion

Total mismatch count at 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 0.5: Overall Network Perspective
30

Mismatch from Ideal

Mismatch from Ideal

20

20
15
10
5

40

4
3.5
3
2.5
0.2

0.55 0.6 0.65
Probability of attack

(a)

0.7

0.75

0.8

0.3

0.4
0.5
Probability of attack

0.6

0.7

(b)

V. C ONCLUSIONSWe proposed a framework for evaluating trust throughmonitoring false advertisements of neighboring nodes, and atrust based filtered fusion scheme for cognitive radio networks.
We provided a thrust threshold that may be used by each node
to disregard advertisements of possible malicious node fromthe fusion. We are able to identify malicious nodes even atlower probabilities of attack. We also observed that for lower
probability of attack, malicious nodes may also contribute tocooperation. So from malicious nodes perspective in order tosignificantly harm the network, it has to employ a probabilityof attack higher than critical probability of attack 0.40.
R EFERENCES

Blind Fusion
Trust Based Fusion

15
10
5
0

0.5

35

5

is not much as shown in Fig 7(b). This is because lower attack
probability means malicious nodes chooses to attack on lesser
and cooperate on more channels. That is why the damage
done to the network is less if we consider those nodes infusion. However as the malicious nodes increases their attack
probability, we see marked increase in mismatch for blindly
fused data, while the mismatch for Trust Based Filter Scheme
is much less. From simulation results (Fig 7(b)), we see thatfor 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 > 0.40, TBF has very low overall mismatch from
ideal, while for blind fusion the mismatches increases. So frommalicious nodes perspective, they will have to intelligently
choose a probability of attack to cause significant harm to theentire network.

25
Blind Fusion
Trust Based Fusion

0.45

15
20
25
30
Number of mismatches

Blind Fusion
Trust Based Fusion

4.5

(a)

Fig 6(b). To measure what percentage of nodes are benefitedusing our framework, even at high probabilities of attack of
0.8, 90% of the nodes have average mismatches less than 8
as shown in Fig. 7(a). The results reflect the effectiveness ofproposed TBF over blind fusion.

0.4

10

6
5.5

Fig. 7. (a) The CDF for probability of attack = 0.8; (b) Average mismatchfor the entire network vs. probability of attack

Choosing threshold for trusted fusion

25

0.5
0.4

Prob. of attack=0.2
Prob. of attack=0.4
Prob. of attack=0.6
Prob. of attack=0.8

0.2

Fig. 5.

Blind Fusion
Trust Based Fusion

0.7

14

Fig. 4.

6.5

0.9

Average mismatch for entire network

Trust Value for
𝑃𝑎𝑡𝑡𝑎𝑐𝑘 = 0.3
0.56667
0.55625
0.48333
0.567860.47750
0.59643
0.528120.46667
0.51667

CDF

Malicious
Node ID
1
11
12
13
14
18
19
21
25

0.4

0.5

0.6
Probability of attack

0.7

0.8

(b)

Fig. 6. Individual node perspective: Blind Fusion vs. Trust Based Fusion:(a)Performance of Node 10 (b) Performance of Node 23

E. Blind and Trust based filtered fusion: Overall network
perspective
An interesting comparison for average mismatch for all
nodes in the network, reveal how overall cooperative sensing
accuracies are effected. We see that for very lower probabilities
of attack, although nodes are aware of the possibility of a node
being malicious, if all nodes still allow advertisement fromthose nodes in the fusion the average mismatch is slightly
lesser than trust based filtered fusion although the difference[1] R. Chen, Jung-Min Park, K. Bian ,“Robust Distributed Spectrum Sensing in
Cognitive Radio Networks”, Proc. of IEEE INFOCOM, pp. 1876-1884, Apr. 2008.
[2] K. Chen, P. Chen, N. Prasad, Y. Liang and S. Sun,“Trusted Cognitive Radio
Networking”, J. of Wirel. Commun. and Mob. Comput., Vol. 10, Issue 4, pp. 467485, Apr. 2010.
[3] A. Ghasemi and E. S. Sousa, “Collaborative spectrum sensing for opportunistic access in fading environments”, in IEEE International Symposium on New Frontiers
in Dynamic Spectrum Access Networks, DySPAN, pp. 131-136, Nov. 2005.
[4] S.-W. Jeon, N. Devroye, M. Vu, S.-Y. Chung and V. Tarokh, “Cognitive networks
achieve throughput scaling of a homogeneous network”, Intl. Symposium ofModeling and Optimization in Mobile, Adhoc, and Wireless Networks (WiOPT),
pp. 1-5, June 2009[5] H. Li and Z. Han, “Catching attacker(s) for Collaborative Spectrum Sensing in
Cognitive Radio Systems: An Abnormality Detection Approach”, In Proc. of IEEE
DySpan, pp. 1-12, Apr. 2010[6] S. Marti, T.J. Giuli, K. Lai, and M. Baker, “Mitigating Routing Misbehavior in
Mobile Ad Hoc Networks”, in Proc. of ACM MOBICOM, pp. 255-265, 2000.
[7] J. Mitola, “Cognitive Radio: An integrated Agent Architecture for Software
Defined Radio”, Ph.D. Thesis, KTH, Stockholm, 2000.
[8] S. Parvin, S. Han, L.Gao, F.Hussain and E.Chang, “Towards Trust Establishment
for Spectrum Selection in Cognitive Radio Networks”, in Proc. of IEEE International Conference on Advanced Information Networking and Applications, pp.
579-583, Apr. 2010.
[9] Y. Sun, Z. Han, and K. J. Ray Liu, “Defense of Trust Management Vulnerabilities
in Distributed Networks”, in IEEE Communications Magazine, Special Issue,
Security in Mobile Ad Hoc and Sensor Networks, Vol. 46, Issue 2, pp.112-119,
Feb 2008.
[10] http://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/wifich2.html#wp1049544.

597