# Accurate Sybil Attack Detection Based on Fine-Grained Physical Channel Information
## 3 Preliminaries
### Angle of Arrival Measurement  
The main idea of the MUSIC algorithm is to calculate the covariance matrix of the received signal to separate the signal subspace and the noise subspace. Then, the orthogonality of the two subspaces is used to search for the largest orthogonal spectrum to detect the true signal angle. However, there are multiple propagation paths in the indoor WLAN environment. Because the small obstacles in space will cause the signal reflection multipath effect, the path with the shortest propagation path is considered as the Line-of-Sight (LoS) path, and the other is the Non-Line-of-Sight (NLoS) path. In a certain distance, we think the signal arrives at the receiving end with parallel waves. Therefore, the same signal will have the same phase offset \(\Delta\phi\) between adjacent antennas, \(\Delta\phi\leavevmode\
obreak\ =\leavevmode\
obreak\ -\leavevmode\
obreak\ 2\pi \frac{dcos(\theta)}{\lambda}\); where \(\theta\) is the true angle of each path, and \(d\) is the distance between two antennas. Through the signal frequency \(f\), we can get the signal wavelength \(\lambda\), so the wave angle \(\theta\) can be easily calculated as \(\theta=\arccos\left(\frac{\Delta\phi\cdot\lambda}{-2\pi d}\right)\). Assuming that the antenna array is \(M\) and the number of signals is \(D\), the received signal \(X\) can be expressed as \(X=A\cdot S+N\), where \(A\) is the steering vector and \(S\) is the signal vector. This represents the perspective of different propagation paths of the environment. Specifically:  
\[A=\left[\text{a}\left(\theta_{1}\right);\text{a}\left(\theta_{2}\right);\cdots; \text{a}\left(\theta_{D}\right)\right]\text{, a}\left(\theta_{i}\right)=\left[1,e^{-j\Delta\varphi_{i}},\cdots,e^{-j \left(M-1\right)\Delta\varphi_{i}}\right] \tag{3}\]  
\(\text{a}\left(\theta_{i}\right)\) is a column vector, and \(N\) is an additive Gaussian white noise with a mean of zero; the variance of \(\sigma^{2}\). Therefore, the autocorrelation function of the received signal can be expressed as \(R_{X}=E\left(\pi x^{H}\right)=AR_{ss}A^{H}+\sigma^{2}I\); where \(R_{ss}\) corresponds to our signal subspace and \(\sigma^{2}I\) corresponds to the noise subspace. We know that the eigenvectors corresponding to the noise eigenvalues are orthogonal to the column vectors of matrix A. The columns of A correspond to the direction of the signal. Therefore, the noise feature vector \(E=\left[v_{D+1},v_{D+2},\cdots,v_{M}\right]\). Define the spatial spectral function:  
\[\text{P}_{MUL}\left(\theta\right)=\frac{1}{a^{H}\left(\theta\right)EE^{H}a \left(\theta\right)} \tag{4}\]  
In Equation (4), the denominator is the inner product of the signal vector and the noise matrix. When the \(a\left(\theta\right)\) is orthogonal to the E columns, the denominator is zero, and the minimum value is actually taken due to the presence of noise. \(\text{P}_{MUL}\left(\theta\right)\) has a spike. By traversing different angles \(\theta\), we perform the spectral search, and we can find the AoA. Three antennas can detect the angle of two propagation paths. We only need to detect the LoS path, so the receiver uses three antennas, that is \(M=3\). Since the CSI contains 30 subcarriers, we use the covariance mean \(R_{xx}\) of 30 to make it accurate. If the received signal has a component of the LoS path, the LoS path has the strongest signal strength value, then the peak of the signal's pseudo-spectrum is the AoA of the signal on the LoS path. However, we find that the traditional MUSIC algorithm may have a big error. As we can see in Figure 1(a), we test on a client that is located in \(90^{\circ}\) by the traditional MUSIC algorithm. The result is an LoS angle of \(69^{\circ}\), while there is an NLoS angle of \(129^{\circ}\). Obviously, this is different from the \(90^{\circ}\) of the tested LoS path. The reason may be that the radio frequency link connects to the RF oscillator, which will bring phase offset in CSI.