Trust based Fusion over Noisy Channels through Anomaly∗
Detection in Cognitive Radio Networks
Shameek Bhattacharjee

Department of EECSUniversity of Central Florida
Orlando, Florida-32816, USA

shameek@eecs.ucf.edu

Saptarshi Debroy

Department of EECSUniversity of Central Florida
Orlando, Florida-32816, USA

saptarsh@eecs.ucf.edu
Kevin Kwait

Mainak Chatterjee

Department of EECSUniversity of Central Florida
Orlando, Florida-32816, USA

mainak@eecs.ucf.edu

Air Force Research Laboratory
Information Directorate
Rome, NY-13441, USA

kevin.kwiat@rl.af.mil

ABSTRACTbution to the overall gain in cooperation is more than thedamage done. We observe that above a critical value forprobability of attack of 0.40, the overall gain in cooperationis compromised if the malicious nodes are considered in fusion. We also discover that an honest node’s beneﬁt due tocooperation depends on its relative position with respect tothe spatial orientation of malicious nodes.

Byzantine attacks have been identiﬁed as one of the key
vulnerabilities in cognitive radio networks, where malicious
nodes advertise false spectrum occupancy data in a cooperative environment. In such cases, the resultant fused data isvery diﬀerent from the actual scenario. Thus, there is a need
to identify the malicious nodes or at least ﬁnd the trustworthiness of nodes such that the data sent by malicious nodes
could be ﬁltered out. The process is complicated by presenceof noise in the channel which makes it harder to distinguishanomalies caused by malicious activity and those caused due
to unreliable noisy channels.
This paper proposes a scheme for trust based fusion bymonitoring anomalies in spectrum usage reports advertisedover unreliable channels by secondary nodes which leads toevaluation of trust of a node by its neighbors. The calculated trust is then used to determine if a neighboring node’s
advertised data could be used for fusion or not. We provide
a heuristic trust threshold for nodes to disregard malicious
nodes while fusing the data, which holds good for any probability of attack. A trust coeﬃcient is calculated based on interactions with peers in a distributed manner. Results showthat even at higher probabilities of attack (0.8 and above),
95% of the nodes generate fused data with accuracy as highas 84%. We compare our results of trust based fusion withblind fusion scheme and observe improvement in accuracyof fusion from individual nodes’ as well as overall network’s
perspective. We also analyze an alternative weighted trust
fusion technique and evaluate its performance. We ﬁnd thatat lower probabilities of attack a malicious node’s contri-

Categories and Subject Descriptors
C.2.0 [Computer Communication Networks]: GeneralSecurity and Protection; C.2.1 Network Architecture and
Design - Distributed Networks, Wireless communication; C.4[Performance of Systems]: Fault Tolerance

General Terms
Algorithms, Performance, Security, Theory

Keywords
Cognitive radio networks, attacks, anomaly detection, trust
coeﬃcient, fusion

1. INTRODUCTION
In cognitive radio (CR) paradigm, unlicensed (secondary)users opportunistically operate on parts of spectrum in absence of primary (licensed) users [10]. The primary regulatory aspect of this paradigm is that unlicensed CR nodes
should relinquish their allocated channels and move to another available channel as soon as they are able to learn or
sense the presence of licensed user on that channel. To reduce uncertainty in true spectrum map caused due to wireless characteristics like multi-path fading, shadowing, etc,
these nodes engage in cooperative or collaborative spectrum
sensing [3, 13], where nodes share their locally sensed reports, and the ﬁnal inference on spectral occupancy is a fusion of multiple locally sensed spectrum reports. However,this feature introduces a vulnerability where the utility of cooperative sensing is crippled due to Byzantine attacks [1, 8],
where malicious nodes advertise altered local sensing results.
The motive behind such behavior may be selﬁsh (gaining
more spectrum resources) or malicious (crippling the operation of other nodes). Also locally sensed reports when send∗This research was supported by National Science Foundation, under award no. CCF-0950342, Air Force Oﬃce of
Scientiﬁc Research (AFOSR), and National Research Council. Approved for Public Release; Distribution Unlimited:
88ABW-20113832, 11JUL11.
Copyright 2011 Association for Computing Machinery. ACM acknowledges that this contribution was authored or co-authored by an employee,
contractor or affiliate of the U.S. Government. As such, the Government retains a nonexclusive, royalty-free right to publish or reproduce this article,
or to allow others to do so, for Government purposes only.
SIN’11, November 14–19, 2011, Sydney, Australia.
Copyright 2011 ACM 978-1-4503-1020-8/11/11 ...$10.00.

73Form Approved
OMB No. 0704-0188

Report Documentation Page

Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering andmaintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information,
including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington
VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if it
does not display a currently valid OMB control number.

1. REPORT DATE

2. REPORT TYPENOV 2011

N/A

3. DATES COVERED-

4. TITLE AND SUBTITLE

5a. CONTRACT NUMBER

Trust based Fusion over Noisy Channels through Anomaly Detection in
Cognitive Radio Networks

5b. GRANT NUMBER
5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S)5d. PROJECT NUMBER
5e. TASK NUMBER
5f. WORK UNIT NUMBER

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)8. PERFORMING ORGANIZATIONREPORT NUMBER

Department of EECS University of Central Florida Orlando,
Florida-32816, USA
9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)10. SPONSOR/MONITOR’S ACRONYM(S)
11. SPONSOR/MONITOR’S REPORTNUMBER(S)12. DISTRIBUTION/AVAILABILITY STATEMENT

Approved for public release, distribution unlimited
13. SUPPLEMENTARY NOTES

See also ADA553912. International Conference on Security of Information and Networks (4th) (SIN 2011)
Held in Sydney, Australia on November 14-19, 2011. Approved for public release; U.S. Government orFederal Purpose Rights License., The original document contains color images.
14. ABSTRACT

Byzantine attacks have been identified as one of the key vulnerabilities in cognitive radio networks, wheremalicious nodes advertise false spectrum occupancy data in a cooperative environment. In such cases, theresultant fused data is very different from the actual scenario. Thus, there is a need to identify themalicious nodes or at least find the trustworthiness of nodes such that the data sent by malicious nodes
could be filtered out. The process is complicated by presence of noise in the channel which makes it harder
to distinguish anomalies caused by malicious activity and those caused due to unreliable noisy channels.
15. SUBJECT TERMS
16. SECURITY CLASSIFICATION OF:
a. REPORT

b. ABSTRACT

c. THIS PAGE

unclassified

unclassified

unclassified

17. LIMITATION OF
ABSTRACT

18. NUMBER
OF PAGES

SAR

819a. NAME OFRESPONSIBLE PERSONStandard Form 298 (Rev. 8-98)
Prescribed by ANSI Std Z39-18

of honest nodes is not penalized. Furthermore, we provide
a trust based fusion scheme that allows individual nodes
to disregard malicious nodes data from fusion thus making
it robust. It may be noted that the goal is not to isolate
malicious nodes but to provide a robust and fair fusion inpresence of malicious nodes.
To validate our proposed model, we perform simulation experiments on a customized simulator. We ﬁnd that our proposed framework ensures that malicious nodes have trust
values lesser than those of honest nodes which is independent on the intensity/severity of attack launched by malicious nodes. We provide a heuristic trust threshold forselective trust based fusion, below which a neighbors advertised report may be disregarded. We compare the results ofthe trust based fusion with blind fusion to establish the eﬀectiveness of the proposed fusion scheme. We ﬁnd that spatial
distribution of malicious nodes may play a role which may
cause exceptions for a few nodes. To validate the exceptions
we analyze the performance both from individual node as
well as overall network perspective, and show that most of
the discrepancies are caused by certain spatial distributionof malicious nodes. We also ﬁnd that at lower probabilities of attack the contribution of a malicious node to theentire network in cooperative sensing is more than the damage done. Thus, including them for fusion does more goodthan harm to the network overall. We also observe that beyond a critical probability of attack (0.40), the overall gain
in cooperation decreases if malicious nodes are included infusion.
The rest of the paper is organized as follows. Section 2
describes the system model and the assumptions. Section 3
discusses the proposed framework for monitoring cooperation behavior, calculation of trust coeﬃcient and subsequently proposes a trust based fusion scheme. Simulation
model and results are discussed in Section 4. Conclusions
are drawn in the last section.

to neighbors (in ad-hoc CR network) or to a central fusion
center (in infra-structured CR network) may be altered due
to channel noise regardless of malicious behavior. One way
to track the occurrence of such attacks is to monitor anomalies in received spectrum reports, but this process is complicated by the fact that they are garbled by channel noise.
Since such actions are hard to detect, either the malicious
nodes remain in the network undetected, or honest nodes
get penalized.
As far as countering Byzantine attacks are concerned, there
are two approaches: isolating malicious nodes [7] or robust
fusion [1]. The current literature mostly focusses on infrastructured CR network where a central fusion center fuses
advertised local reports from individual nodes of the network. Anomaly detection is a feature that may be used
for tracking possible malicious misbehavior. For example,
anomalies in packet forwarding to unravel routing misbehavior [9]. Detected anomalies against a node can be used
as an evidence that decides the trustworthiness of that node.
The authors in [12], discuss a concept of moulding successand failure counts in packet forwarding into trust evidence
from which trustworthiness in relation to routing is calculated. Presence or absence of packet forwarding anomalies
provide success and failure counts which are used to build
and manage trust in a traditional ad-hoc network. For trust
management in CRN paradigm, authors in [2, 11], provide aframework that builds and maintains trust metrics basedon beta distribution in a centralized CR network. Bothof these works assume that success and failure counts are
known, and do not provide a way to decide for success orfailed cooperation which is utilized to calculate and maintain trust. The question on how to build a concrete trust evidence in cooperative CR networks is an unsolved problem.
This motivates us to provide a comprehensive framework
which gathers trust evidence based on monitoring anomalies in advertised local spectrum reports in an ad-hoc CR
network, subsequently leading to calculation of a fair trust
coeﬃcient associated with each node. The trust is used asa metric that decides whether a particular node’s advertisement is used in the fusion or not.
In this paper, we propose a trust based fusion model ensuring robust fusion for individual nodes in coexistence withmalicious Byzantine nodes in an ad-hoc CR network. The
nodes need not know the locations of other nodes which
also eliminates the possibility of nodes advertising false location. All nodes share their individual sensing reports
with their neighbors, and in the absence of a fusion center, each node is expected to fuse the reports advertisedby its neighbors. Each node evaluates a trust coeﬃcient
for all its neighbors based on anomalies detected in sensing
reports. This method provides upper and lower limits on
possible received power levels on the channels of the operating spectrum. Then normalization criteria is used to build apredicted spectrum occupancy report for a particular node.
This is then compared with that node’s actually advertisedbinary spectrum report for mismatches which are termed
as anomalies. The mismatches and matches form the trust
evidence based on which fair trust coeﬃcient is calculated.
Higher trust value signiﬁes more trustworthiness. To provide
fairness due to anomalies caused by unreliable wireless channel properties, we deﬁne two models: an instantaneous fairtrust model and a cumulative trust model. These provide
two possible ways to provide fairness so that trustworthiness

2. SYSTEM MODEL
We assume all secondary nodes continuously undergo spectrum sensing to decide whether a channel is occupied by primaries or not. Let us assume secondary node i constructsi
its observed occupancy vector as: Bact
= [d1 , d2 , · · · , dn ],where dk is 1 or 0 depending on whether the channel is occupied or unoccupied, and n is the number of channels being
monitored. Once this binary vector is created, a secondary
node would broadcast this information to its neighboring
nodes. Similarly, a secondary node would also hear broadcast messages (binary occupancy vectors) from its neighbors.
Based on the vectors a node receives, the node will employ afusion technique to obtain a better estimate about the spectrum usage that can signiﬁcantly improve the performance ofspectrum sensing [1, 4]. Such cooperative sensing has otherbeneﬁts such as mitigating the shadowing and multi-patheﬀects.
We consider that the malicious nodes do not report theiroccupancy vectors truthfully; rather they inject errors intheir occupancy vectors by ﬂipping the bits in the vector.
Flipping 0 to 1 implies that the channel is occupied when in
reality it is unoccupied. Flipping 1 to 0 implies that an occupied channel is reported as unoccupied. We denote probability of attack Pattack , as the percentage of channels thata malicious node changes from its actual observed vector.

74

2.1 Assumptions

Table 1: Notations

1. We consider an ad-hoc secondary network with N nodes
with γmal fraction of nodes being malicious; H is the set ofhonest nodes and M malicious/dishonest nodes. We assume
η(M ) < η(H), since in a realistic network, the number ofmalicious nodes is less than number of regular honest nodes.
The secondary network has no dedicated central fusion center or allocation authority, and each individual node fuses
the spectral sensing data it receives from other nodes fromwhich it can hear from and forms its opinion on the availability of spectrum.
2. The nodes are not aware of the geographical coordinates of other nodes involved in cooperation. We assume
the transmit power level of all secondary nodes are same.
Knowledge of the transmitter output power, channel losses,
and antenna gains with the appropriate path loss model allows us to ﬁnd the distance between the two nodes using
Received Signal Strength through localization or lateration.
The location or identity awareness is not required. It prevents the nodes lying about location, and also reduces maintenance overhead.
3. Unlike in [7], which discusses a more restrictive fusion
model (AND fusion rule), we use majority voting fusion
rule, which gives more ﬂexibility towards errors committed
by nodes and/or malfunctioning nodes.
4. Each primary transmitter whether it chooses to transmit
or not, transmits only on one channel; so the channel associated with a primary transmitter is known. The primarytransmitter that transmits on channel k, is referred as Tk ,and since it is ﬁxed, its coordinates (xTk , yTk ) are known to
the nodes.
5. We assume nodes use some interference aware channel
access framework, so that they do not interfere with othersecondary nodes who are using the same channels sensed asunoccupied. Interference awareness is outside the scope of
this paper.
6. We consider that reporting of spectrum sensing data, takeplace over noisy links, hence the observation and monitoringprocesses under imperfect conditions.
7. We consider independent attacks and do not consider
collaborative Byzantine attacks. We do not delve into rationale of attacks. No matter what the motive is, we call themmalicious nodes.
8. The outcome of local sensing is raw energy values which
are converted into a binary vector of 0’s and 1’s, where 0 represents absence of primary and 1 represent primary’s presence.
9. The probability of false alarm is the probability thata channel which is actually empty (H0 ) is erroneously detected by a node to be occupied, and is denoted by Pf or
P (H1 |H0 ). Similarly, the probability of missed detection is
the probability that a channel which is occupied (H1 ) is notdetected by a node and is denoted by Pm or P (H0 |H1 ). It is
traditionally the channel between the primary and the CR
node. There is body work that deals with calculation of suchprobabilities [5].

3.

Symbol
Ni
H
M
γth
sTik
dk
j
Pi
i
Bact
i
Badv
ij
PpredictDij
djk |predict(α, β, X)jj
Etrusti
i
BFblindi
T BF

Meaning
Neighbor set of node i
Set of honest nodes
Set of malicious nodes
Common threshold used to normalize power vectors
Dist. between node i and tower Tk for channel k
Binary Decision on a channel k, dk ∈ 0, 1
Set of all neighbors of i, j ∈ Ni
Measured power vector on n channels at node iActual binary occupancy vector formed at i
Advertised binary occupancy vector by node i
Vector of power ranges for neighbor j predicted by i
Binary occupancy of node j, predicted by i
Predicted decision on any channel k, for Dpj
Three tuple trust evidence
Reputation or trust of neighbor j calculated by node i
Fusion result at node i, when all j are included
Fusion result due to trust based selective inclusion of jcriterion to predict occupancy vector, which is then compared with advertised vectors sent by neighbors j of node i.
This comparison is recorded as the trust evidence which isthen modeled into a numerical trust coeﬃcient, reﬂecting thetrustworthiness of a neighbor. However observations might
be erroneous due to noise, and to certain extent anomalies
may be caused by unreliable channel conditions like noise
rather than malicious behavior. We provide two approachesof computing fair trust coeﬃcient to counter noise. Subsequently we propose a trust based ﬁltered fusion scheme forrobust and secure cooperative spectrum sensing.

3.1 Bounds on Power Levels and Anomaly Detection
Suppose node i measures the power vector
P i = {γ1i , γ2i , · · · , γni },where γki is the power received on channel k and n is theinumberof channels.
 Each node i forms its binary vector Bact= di1 , di2 , ....din from it’s power vector P i by comparing
γki with threshold γth , where= 1 when γki ≥ γthi(1)dk= 0 when γki < γthi.
Each node i, advertises a public binary vector Badv
i
= Bact if node i ∈ H
iBadv
i
if node i ∈ M
= Bact(2)

Just the way node i advertises its binary vector, it also hears
similar advertisement from its neighbors. For a neighboringnode j ∈ Ni , node i estimates its possible power vector using their mutual distance and received signal strength (RSS)
localization [14]. Though it is diﬃcult for node i to accurately predict the power vector of node j, nevertheless it
can always estimate the lower and upper bounds using RSS
models. Let us describe how node i estimates the upper andijlower bounds of power vector as Ppredict.
Assuming transmit power of all nodes are same, node i
calculates the distance between the node j and itself whenever it receives a signal (vector) from it as sij . Based on
the distance sij , node j may be anywhere on the circle with
node i at the center. We draw a straight line from the center of the circle to the primary transmitter Tk located at(xTk , yTk ) as shown in Fig. 1. Under ideal conditions, the

TRUST BASED FUSION MODELSIn this section we discuss gathering of trust evidence basedon unraveling anomalies in spectrum sensing data reported
by neighbors of a node in an ad hoc CR network. We predict the bounds of received power and use a normalization75

Locus of Node j
T
k

j
(Y

)

k high

P

R
(x

y )
Tk, T kj
( Yk )

s

min

s

low

Q

O

ik

A match occurs when on channel k, djk |inf er = djk . A
mismatch occurs if djk |inf er = djk . If djk |inf er = X no inference can be drawn. For each neighbor j, node i computes thejnumber of matches, mismatches, and no inference with Badv
as αj , βj , Xj respectively. This forms the trust evidence.

(x ,y)i ikj

3.2 Instantaneous Fair Trust Modelsmax

The logic behind the trust evidence is out of all inferences(0,1) advertised on all channels how many have achieved
trustworthiness (α), how many inferences have not succeededto achieve trust (β), and how many inferences are undecided.
To account for the X channels where no inference could be
drawn, we consider them in the ratio of α : β. Thus the
Xjjproportion of matches is updated as αj + αj +β
j × α . But
this does not account for the proportion that may be lost
due to mismatches caused due to channel noise. Thus weprovide a fair instantaneous trust coeﬃcient.
To account for channel noise, shadowing and fading, wedeﬁne probability of false alarm as Pf = P (H1 |H0 ), probability of missed detection as Pm = P (H0 |H1 ), and channel
error probability due to noise as Pe .
Pf and Pm probabilities due to sensing inaccuracies whennodes are not able to detect the presence or absence of primary transmission. Thus, local sensed reports are modiﬁed.
Moreover, when local sensed reports are advertised to theneighbors, they may be altered due to noise between therelevant CR nodes. Considering the channel error probability we deﬁne modiﬁed false alarm probability for node jvector at the node i askjFigure 1: Calculation of Max and Min RSS range
on channel k of neighbor node j

RSS due to Tk will be maximum on the circle that is closest to Tk , i.e., on point P and minimum at a point Q thatis farthest from Tk . We denote the power levels at these
two locations as [γkj ]high and [γkj ]low at distances smink andjsmaxk , respectively. For all locations on the circle, the RSS
j

on channel k varies between [γkj ]high and [γkj ]low .
Using commonly used model for RSS [6], we get
γki = Pk ×

A2
;
sα
ik

(3)

where A = frequency constant, α is path loss factor, sik isthe distance between Tk and node i, and Pk is the transmit
power of Tk . We get the bounds as:[γkj ]high = Pk ×



Pf e = (1 − Pf ).Pe + Pf .(1 − Pe )and modiﬁed missed detection probability, as

A2
sα
mink

;

(4)



Pme = (1 − Pm ).Pe + Pm .(1 − Pe )j[γkj ]high = Pk ×

A2
sα
maxk

;

Pf e is the probability that a 0 in node j  s advertised vector
will reach as 1 at node i, irrespective of malicious behaviorof node j. Similarly, Pme is the probability that a 1 in nodej  s advertised vector will reach as 0 at node i, in spite of any
malicious behavior. We need to discount these mismatchescaused by Pm , Pf and Pe to achieve a fair trust coeﬃcient.
Let the actual number of 0 s and 1 s in ideal case for any reideal
ideal
ceived vector is x0 j and x1 j respectively. Let the num
ber of 0 s and 1 s in received vector from j be H(0)received
and H(1)received , which are known. Therefore,(5)j

Now we divide Eqn. 3 with Eqn. 4 and Eqn. 5. Since sik ,smink and γki are known to node i, it is easy to ﬁnd [γkj ]highjand [γkj ]low . Node j is somewhere on the circular locus. Now
the predicted power vector of node j is a 2-tuple vector
ij
Ppredict= ([γ1j ]low , [γ1j ]high ), · · · , ([γnj ]low , [γnj ]high ) .
With the estimated power vector being known, the inference
drawn by a node j on channel k is,⎧jj⎨ 0 if both [γk ]low and [γk ]high ≤ γth ;jjdk |inf er =(6)
1 if both [γk ]low and [γkj ]high ≥ γth ;⎩X otherwiseidealj= H(0)received(7)



idealj= H(1)received

(8)

x0

idealj− Pf e × x0

idealj− Pme × x1

x1

ideal
we ﬁnd x0 j

ideal
and x1 j ,theFrom Eqn. 7 and Eqn. 8,other parameters being known. The total mismatch from
ideal scenario caused due to channel uncertainty is

Eqn. 6 is the normalization criterion. When both the lowerand higher predicted power levels on a channel are less thanγth , it implies that channel i is not being used by any primary transmitter, i.e., channel is unoccupied. So in thiscase djk |inf er is inferred as 0. Similarly, if both the lower andhigher predicted power levels are greater than γth , djk |inf er isinferred as 1. Such inference can be drawn for the above two
scenarios. However, no inference can be drawn when one of[γkj ]low and [γkj ]high is above γth and the other is below γth .
We denote such cases as X. Now node i compares Dij =j= [dj1 , ....djn ] on
[dj1 |inf er , ......, djn |inf er ] with received Badv
corresponding channels k for matches and mismatches.



idealjPf e × x 0

idealj+ Pme × x1

= αjnoise(9)

where αjnoise accounts for the mismatches that occur due tounreliable channels conditions. Thus we need to add it to
the matches to account for fairness. So the modiﬁed instantaneous fair trust coeﬃcient isX

EFj airT rusti =jjj
αj + ( αj +β
j × α ) + αnoise

where 0 < EFj airT rusti < 1.

76

αj + βj + Xj

(10)

3.3 Cumulative Fair Trust Modelon what at least half the neighboring nodes advertise withall the nodes treated equally. ⊕ is the operator for combination.

The instantaneous trust model considers only one observation, i.e., α and β are computed based on transmission ona single time slot while taking care of mismatches caused bynoise. Another approach is a continuous trust model where
it is possible to make multiple observations of neighbors before concluding a trust. To minimize such eﬀects of channel
noise that may prevail over multiple slots, we deﬁne cumulative trust model where the computation of the trust is done
over multiple time slots. Doing so, allows to discount (butnot eliminate) some errors that occur randomly on certain
slots. We observe the transmissions over a decision windowof l time slots and do an averaging of the parameters. Thus,
αj , βj , and Xj computed over l time slots are given as:
1
αlj =

l


αkj

(11)

1 k
βj
l

(12)

1 k
Xj
l

(13)

l k=1

3.4.2 Trust-Based Fusion (TBF)
We propose a fusion scheme whereby we only considerjneighboring nodes whose Etrustis higher than some trusti
threshold, Γopt . (Later in Section 4, we show how to ﬁnd the
optimal threshold). Thus, for trust-based fusion, node i onlyjconsiders those neighbors whose Etrust≥ Γopt . In eﬀect,i
the fusion is done with information from trusted nodes only.
≥ Γopt Node j is trusted ;j
If Etrust(16)i< Γopt Node j is not trustedi],
We deﬁne Trust based Fusion as T BF i = ∇[T F Si ⊕ Bactwhere T F Si is the trusted fusion set of binary vectors acj
ofcumulated by node i using Eqn. 16, which includes Badv
trusted nodes only.
Although the nodes are not aware of the ideal scenario, we
are aware of what would have been the ideal fusion result,jjwhich is the case when for all node j ∈ Ni , Bact
= Badv
, so
j
i
i
].
we deﬁne Ideal Fusion for node i, BFideal = ∇[Bact ⊕ Bact
This is later used for comparing the performance of various
fusion schemes by measuring deviation from ideal result.

l

βjl =

k=1
l

Xjl =

k=1

where αkj , βjk , Xjk are the observed value at the kth timeslot of a particular window. Using these at the end of l slots
the trust at a particular decision window u is given bylu
Ewindowj =iαlj × (1 +Xjl
αlj +βjl

3.4.3 Weighted Trust Based Fusion (WTBF)
We consider another possible alternative fusion scheme
where the ﬁnal decision on a channel is based on the binary
decision’s trusts associated with it. Here we consider all
broadcasts, but weigh their binary vectors in proportion totheir trust values. Unlike traditional voting, this fusion considers weights of the nodes that broadcast 1 for a channel andthose broadcast that broadcast 0 for the same channel. As
the weighing factor we simply consider their trust values. On
channel k, for all nodes that have advertised 1 on channel k,jtheir trusts are added. Let this be Etrust(dk = 1), and simij
larly for those who advertised 0 be Etrust (dk = 0). Thus, thejj
WTBF result is 1 if
Etrust(dk = 1) >Etrust(dk = 0)jj
and 0 if
Etrust(dk = 1) <Etrust(dk = 0), ∀k = (1, n).
This scheme unlike TBF is not exclusionary but gives weightto the most trusted decision. However our performance evaluation shows that trust based fusion (TBF) is the more robust, reliable and eﬀective scheme than weighted trust fusion. Weighted trust fusion may work well but not under all
conditions. We justify this in Section 4.

)(14)

αlj + βjl + Xjl

where u, is the current window number. Though the trust
is computed over l time slots, it is necessary to consider alonger history of a node to truly capture its trustworthiness.
To do so, we propose an exponential weighted moving average. If is the trust value computed in the current decisionwindow, u, then the moving average is updated as:
u

u−1

u

l
EFl airT rustj ← k1 (EFl airT rustj ) + k2 (Ewindow
j)
i

i

(15)

i

where 0 < k1 , k2 < 1 and k1 + k2 = 1. Such moving averages
takes into consideration longer histories but with exponentially decaying weights for old observations. To illustrate,
let us consider a node that experienced bad channel conditions during an entire decision window, and it’s trust may
be reduced. However, when the channel conditions change
it gets a chance to redeem its trust. Similarly, a malicious
node that gathers trust by being honest at the beginningwill loose its trust quickly when it decides to launch attacks.

4. SIMULATION MODEL AND
PERFORMANCE ANALYSIS
In this section, we study the performance of our proposed
technique and its eﬀectiveness in capturing cooperation misbehavior. First, we provide results for the average trust values of diﬀerent nodes, which reﬂect that our scheme is successful in capturing cooperation misbehavior through trust
coeﬃcients. Results show that the malicious nodes have atrust distribution signiﬁcantly lower than honest nodes. Secondly, we show how we use the trust based fusion scheme
to ﬁlter out advertised data from malicious nodes. We show
trust based fusion is robust than blind fusion. We also showthat Weighted Trust based Fusion is not a stable alternative
for robust fusion.
In the simulation, we evaluate performance metrics, bya parameter ‘Mismatch’. For a particular case of fusion

3.4 Trust based Fusion Scheme
Using the computed trust coeﬃcients, we study the performance of two fusion schemes: blind fusion and trust-based
ﬁltered fusion. We justify the eﬀectiveness of the trust based
fusion in Section 4.

3.4.1 Blind Fusion
For blind fusion, node i considers all its neighbors tojbe honest and includes Badv
from all its neighbors alongiwith its own Bact . We formally deﬁne Blind Fusion asjii
BFblind= ∇[Badv⊕ Bact], j ∈ Ni where ∇ is the operator for majority voting rule. Majority voting is a popularfusion rule where ﬁnal fused inference on a channel is based77

ischeme, Mismatch is the diﬀerence between BFideal
andthe corresponding fusion schemes TBF and WTBF. Mismatch reﬂects deviation of Cooperative sensing accuracy ofnodes in coexistence with malicious nodes. We compare the‘Mismatch’ for each fusion scheme to show that trust based
fusion works better than blind fusion, and also show the
impact of the spatial orientation of nodes hampering cooperation gain. We compare average mismatch of blind fusion
and trust based fusion from individual node’s perspective
and overall network’s perspective.

1
Node 1
Node 11
Node 12
Node 13
Node 14
Node 18
Node 19
Node 21
Node 25

0.9
0.8

Trust Value

0.7
0.6
Threshold = 0.52
0.5

Threshold = 0.45

0.4
0.3

4.1 Simulation Set up

0.2

For simulation, we consider a network of 60x60m grid,with 30 randomly scattered nodes out of which 9 nodes areprogrammed to be malicious. All nodes continuously scan 50
channels, record the signal power on each of them, and create
the binary occupancy vector which they then advertise. The
malicious nodes attack (i.e., change the bits in the channel
occupancy vector) with a probability between 0.2 and 0.8. It
is to be noted that high probability of attack facilitates easy
detection and at the same time very low attack probability
do not signiﬁcantly eﬀect the network. The probabilities Pf ,Pm and Pe are assumed as 0.03,0.002 and 0.01 respectively.
Transmission range of all nodes is considered to be 20m,
thus a node hears broadcasts from all the nodes that are in
a 20m radius.

0.1
0.3

0.35

0.4

0.45

0.5

0.55

0.6

0.65

0.7

0.75

0.8

Probability of Attack

Figure 3: Trusts of malicious nodes at various probability of attack

tially weighted moving average trust coeﬃcient. We observethat as the noise and bad channel conditions may eﬀect the
instantaneous sample values, the cumulative model is able
to redeem its trust value after a certain length of time. For
simulation we used weight factors k1 = 0.8 and k2 = 0.2.
We consider a length of 240 windows.

4.2 Trust Measurement
0.67

In Fig. 2, we see the diﬀerence in trust distribution between honest and malicious nodes for both low intensity andhigh intensity of attack. We measure the average trust ofeach node as evaluated by all its other neighboring nodes.
We observe that malicious nodes have signiﬁcantly low trust
values than the honest nodes for both the low attack probability in Fig. 2(a) and high attack probability in Fig. 2(b).
In Fig. 3, we plot all malicious node’s trust against various
probabilities of attack and observe that the node’s trust islowered as it becomes more aggressive in attacks i.e., themore it attacks the more damage it does to its trustworthiness. We observe that the average trust for set of honest
nodes does not change given all other Pf , Pe , and Pm remain
constant, but average trust for malicious nodes decreases
with increase in probability of attack.

1

Trust Value

0.64
0.63
0.62
0.61
0.6
0.59
0.58

0

50

100

150

200

Time Window

Figure 4: Trust distribution of node 2: Instantaneous and cumulative values

Honest Node
Malicious Node

0.9

Average Trust calculated by others

Average Trust calculated by others

0.65

1
Honest Nodes
Malicious Nodes

0.9
0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0

Instantaneous trust
Cumulative trust

0.66

0.8

4.4 Heuristic Trust Threshold for Trust-based
Fusion

0.7
0.6
0.5
0.4

From Fig. 5, we obtain value of trust threshold Γopt fortrust based fusion. We perform a trust based fusion with Γranging from 0.2 to 0.8 and compare how ‘mismatch’ varies
from ideal results. Fig. 5, shows that for very low values ofthreshold there are more mismatches since most of the malicious nodes are included for the purpose of fusion. However,as we increase the threshold, malicious nodes start getting
discarded and mismatch decreases. When the threshold isvery high (above 0.6), the mismatch again increases as highthreshold means we are also discarding the honest nodes
along with the malicious nodes. Since our goal is to minimize the total average mismatch from ideal scenario, we
notice a range of threshold values from 0.45 to 0.52, where
the average mismatch is the least for diﬀerent probabilities

0.3
0.2
0.1

0

5

10

15

Node ID

(a)

20

25

30

0

0

5

10

15

20

25

30

Node ID(b)

Figure 2: Trust distribution at: (a) Probability of
attack = 0.3; (b) Probability of attack = 0.7

4.3 Cumulative Trust Measurement
From Fig. 4, we observe the distribution of trust values forcumulative trust model for particular node (Node 2). The
sample values are plotted alongside the cumulative exponen-78

of attack. From individual node’s perspective, the idea is to
exclude maximum number of malicious nodes from fusion.
We choose Γopt as 0.52, because we can exclude malicious
nodes even at lower probabilities of attack. This is evident
from Fig. 3 containing average trusts for malicious nodes fordiﬀerent probabilities of attack. Now observe the horizontal
lines for the two possible candidates of trust threshold. If
Γopt was 0.45, the nodes are successful in excluding majority of malicious nodes from fusion for higher probabilities
of attack but not for lower probabilities of attack because
malicious nodes have lower trust values when they attack
less aggressively. If we take 0.52 as threshold, then more
malicious nodes are excluded even for lower probability of
attack. However, if we take Γopt = 0.45, we allow a few
malicious nodes in fusion for lower probability of attack.

35
Trust Threshold based fusion
Blindly fused data
Weighted Trust based fusion

30

Mismatch from Ideal

25

20

15

10

Average mismatch for all nodes

14
12
10

5

Prob. of attack=0.2
Prob. of attack=0.4
Prob. of attack=0.6
Prob. of attack=0.8

0
0

5

10

15

20

25

30

35

Node ID

Figure 6: Comparison for selective fusion schemes
at Probability of attack = 0.5

8
6
4

0.2

0.3

0.4

0.5
0.6
Trust threshold

0.7

0.8
200

Figure 5: Choosing threshold for trust based fusion

180
160

Total Mismatch Count140

4.5 Performance of Trust based Fusion andWeighted Trust Fusion
Using Γopt = 0.52, we compare the trust-based fusion
with blind fusion and weighted trust fusion for ‘mismatch’ asshown in Fig 6. The graph clearly shows that for most nodes,
mismatches are far less when trust based fusion is used.
However there are a few nodes which are exceptions, e.g.,
node numbers 7, 27 and 28. This reveals an interesting eﬀectof spatial orientations which explains why these nodes are
exceptions (discussed in the next subsection). Since Fig. 6
can be misleading for a few nodes we provide Fig. 7 for total
number of mismatches for all nodes that shows the eﬃciencyof trust based fusion. Also from Fig. 8(a) and Fig. 8(b), it isevident that by using trust based fusion the nodes 10 and 23
have mismatches signiﬁcantly less than if they had blindly
fused occupancy data without trust ﬁltration. To measure
what percentage of nodes are beneﬁted using our frameworkof T BF , even at high probabilities of attack of 0.8, 90%of the nodes have average mismatches less than 8 shown in
Fig. 9(a). The results reﬂect the eﬀectiveness of trust based
fusion over blind fusion.
We also notice that weighted trust based fusion(WTBF), although works well for a fraction of individual nodes is not astable for other nodes and the network overall. This is because, often malicious nodes with same false advertisement,
their trusts add up and vote out the true advertisement.
Hence we do not compare WTBF in other graphs. We are
better oﬀ using TBF which follows a selective ﬁlter based
policy.

120
100
80
60
40
20
0

Trust Based Fusion

Blind Fusion

Weighted Fusion

Figure 7: Total mismatch count at probability of
attack = 0.53025Blind Fusion
Trust Based Fusion

20
Mismatch from Ideal

Mismatch from Ideal

25
20
15
10
5

0.4

Blind Fusion
Trust Based Fusion

15
10
5
0

0.45

0.5

0.55 0.6 0.65
Probability of attack

(a)

0.7

0.75

0.8

0.4

0.5

0.6
Probability of attack

0.7

0.8

(b)

Figure 8: Blind fusion vs. trust based fusion: (a)Performance of node 10; (b) Performance of node23

79

4.6 Effect of Spatial Orientation on Cooperation Gain

5. CONCLUSIONSWe proposed a framework for evaluating trust throughmonitoring false advertisements of neighboring nodes, and atrust based fusion schema to address the problem of coexistence with malicious nodes in an ad-hoc CR network. We
provided an optimal trust threshold that may be used byeach node to disregard advertisements of possible malicious
node from the fusion. We are able to identify malicious
nodes even at lower probabilities of attack. We also observed that for lower probability of attack, malicious nodes
may also contribute to cooperation. So from malicious nodes
perspective in order to signiﬁcantly harm the network, it has
to employ a probability of attack higher than critical probability of attack 0.40.

The relative position of an honest node with respect tomalicious nodes plays an important role in determining theoutcome of the fusion process. If an honest node has many
malicious nodes in its neighborhood, then trust based fusion
scheme will not yield good estimates for the channel occupancy; as a matter of fact no fusion scheme will be eﬀective.
However this does not mean that these nodes will not obtain a channel to use, but the gain from cooperative sensing
is diminished and such nodes are better oﬀ using their own
binary vector. In such cases ﬁltering out neighbors will not
help to reach anywhere close to ideal result. For e.g., node
7 had only 2 neighbors both being malicious. Similarly for
Node 27, two out of three neighbors were malicious. So being
in close proximity of many malicious nodes negates the beneﬁt from cooperation. Recall that diﬀerence between ideal
result and result of applied fusion scheme is an indirect measure of cooperation gain in spectrum sensing accuracy. Outof the 125 mismatches in Fig. 7 for Trust Based Fusion, morethan half the mismatches are due to nodes 7 and 27. So, in
particular we see when the number of honest neighbors is
less than or equal to malicious neighbors, there is a rapid
loss in cooperation gain for any fusion scheme. This is thereason for the few exceptions in Fig. 6.

1[1] R. Chen, Jung-Min Park, K. Bian ,“Robust Distributed
Spectrum Sensing in Cognitive Radio Networks”, Proc. IEEE
INFOCOM, 2008.
[2] K. Chen, P. Chen, N. Prasad, Y. Liang and S. Sun,“Trusted
Cognitive Radio Networking”, Journal WirelessCommunications and Mobile Computing, Vol. 10 Issue 4,
April 2010.
[3] G. Ganesan and Y. Li,“Cooperative spectrum sensing in
cognitive radio, Part II: Multiuser networks,” IEEE Trans.
Wireless Commun., Vol. 6, pp.2214-2233, 2007.
[4] A. Ghasemi and E. S. Sousa, Collaborative spectrum sensing
for opportunistic access in fading environments, The 1st IEEE
International Symposium on New Frontiers in Dynamic
Spectrum Access Networks, DySPAN, Nov. 2005.
[5] Jorg Hillenbrand, Timo A. Weiss, and Friedrich K. Jondral,“Calculation of Detection and False Alarm Probabilities inSpectrum Pooling Systems”, IEEE Communications Letters,
VOL. 9, NO. 4, April 2005.
[6] S.-W. Jeon, N. Devroye, M. Vu, S.-Y. Chung and V. Tarokh,“Cognitive networks achieve throughput scaling of ahomogeneous network”, in IEEE Trans. Inform. Theory,
March 2008.
[7] H. Li and Z. Han, “Catching attacker(s) for Collaborative
Spectrum Sensing in Cognitive Radio Systems: An
Abnormality Detection Approach”, Proc of IEEE DySpan,
2010[8] S. Marano, V. Matta and Lang Tong, “Distributed Detection in
Presence of of Byzantine Attacks in Large Wireless Sensor
Networks”, In proc. of MilCom, 2006.
[9] S. Marti, T.J. Giuli, K. Lai, and M. Baker, “Mitigating
Routing Misbehavior in Mobile Ad Hoc Networks”, inProc. of
ACM/1EEE International Conference on Mobile Computing
and Networking (MOBICOM), 2000.
[10] J. Mitola, “Cognitive Radio: An integrated Agent Architecture
for Software Defined Radio”, Ph.D. Thesis, KTH, Stockholm
2000.
[11] S. Parvin, S. Han, L.Gao, F.Hussain and E.Chang, “Towards
Trust Establishment for Spectrum Selection in Cognitive Radio
Networks”, In Proc. of IEEE International Conference on
advanced Information networking and Applications, 2010.
[12] Y. Sun, Z. Han, and K. J. Ray Liu, “Defense of TrustManagement Vulnerabilities in Distributed Networks”, IEEE
Communications Magazine, Special Issue, Security in Mobile
Ad Hoc and Sensor Networks, Vol. 46, Issue 2, pp.112-119,
Feb 2008.
[13] J. Unnikrishnan and V. V. Veeravalli, “Cooperative Sensing forPrimary Detection in Cognitive Radio,” IEEE Journal of
selected topics in signal processing, Vol. 2, no. 1, pp. 18-27,
February, 2008.
[14] http://www.cisco.com/en/US/docs/solutions/Enterprise/
Mobility/wifich2.html#wp1049544.

6.5
Average mismatch for entire network

0.9
0.8
Blind Fusion
Trust Based Fusion

0.7
0.6
CDF

6. REFERENCES

0.5
0.4
0.3
0.2
0.1
5

10

15
20
25
30
Number of mismatches

(a)

35

40

6

Blind Fusion
Trust Based Fusion

5.5
5
4.5
4
3.5
3
2.5
0.2

0.3

0.4
0.5
Probability of attack

0.6

0.7

(b)

Figure 9: (a) The CDF at probability of attack =0.8 (b) Average mismatch for the entire network vs.
probability of attack

4.7 Blind and Trust based Fusion: Overall network perspective
An interesting comparison for average mismatch for all
nodes in the network, reveal how overall cooperative sensing
accuracies are eﬀected. We see that for very lower probabilities of attack, if all nodes still allow advertisement fromthose malicious nodes in the fusion, the average mismatch isslightly less than trust based ﬁltered fusion although the difference is not much as shown in Fig. 9(b). This is because,
lower attack probability means malicious nodes choose toattack less channels and cooperate on more channels. That
is why the damage done to the network is less if those nodes
are considered in fusion. However as the malicious nodes
increase their attack probability, we see marked increase inmismatch for blindly fused data, while the mismatch fortrust based fusion scheme is much less. In our simulation(Fig 9(b)) we see for Pattack > 0.40, the trust based fusion
has very low overall mismatch from ideal, while for blind fusion the mismatches continually increases. So from malicious
nodes perspective, they will have to employ a probability of
attack to cause signiﬁcant harm to the entire network.

80