# Accurate Sybil Attack Detection Based on Fine-Grained Physical Channel Information
## 5 Static Detection Algorithm
### Static Sybil Attack Detection  
The self-adaptive MUSIC algorithm can accurately calculate the AoA of each client when they are in a static state. However, different clients cannot be distinguished only by their AoAs if they are in the same angle, but not in the same position. Fortunately, CSI packets contain not only distance-related RSSI of different channels, but also stable amplitude information at the physical layer. Suppose node \(i\) receives a radio signal from Node 0, then the RSSI is \(R_{i}=\frac{P_{0}K}{\alpha\cdot d_{i}}\) where \(P_{0}\) represents transmitter power, \(R_{i}\) is RSSI and \(K\) is the constant of the impulse response of the Rayleigh channel model. \(d_{i}\) is the Euclidean distance, and \(\alpha\) is the distance-power gradient. Hence, at the same transmit power, the RSSI is inversely proportional to the distance \(d\). As we can prove in Figure 7a, we compare different angles' total RSSI of the 30 subcarriers in the same radius of \(2\,\mathrm{m}\) with that in radius of \(3\,\mathrm{m}\). We can see clearly the gap between the RSSI of different degrees. The average difference is \(1.33\) dB. In addition to the \(15^{\circ}\) gap being relatively small, the other degrees of RSSI differences are more than \(2.6\) dB. Therefore, we can distinguish between nodes in different angles at different locations effectively. Some unstable RSSIs may result in completely different values for different time periods. However, on the other hand, CSI energy does not change with time; the CSI energy decreases with the increase of distance, that is the amplitude of the client decays with distance. Figure 7b shows the average amplitude of Subcarrier 1 with a time window of 0.2 s. It can be seen that the magnitude of CSI is approximately inversely proportional to the distance, as the distance increases from 0.5-4 m by 1-m steps. Moreover, the energy at the receiving antenna decays drastically at a location of 4.5 m, which is caused by the increase of the NLoS path reflection. Experiments show that the CSI amplitude values decrease by more than 1.4 per meter. Therefore, we set this value as the amplitude threshold for different positions. At this point, we can accurately distinguish the client in different locations and degrees. It also avoids the instability of RSSI by combining CSI amplitude information. For a further explanation, we will describe in detail the specific Sybil attack model in Figure 7b to see if our algorithm can effectively detect the attacker. For the case of Figure 1a, Client A falsifies the identity of Client B as node \(B^{\prime}\) and sends a request message to steal the returned data sent from AP 1. Since AP 1 receives the CSI phase information sent by node \(B^{\prime}\), AP 1 can locate the client for the actual sending data by combining our improved MUSIC algorithm. That is, Client A is located in the direction of \(30^{\circ}\). We can be sure that client B'should be identified as a Sybil node. Figure 1b and Figure 1a are similar, the only difference is that Client A and Client D are at the same angle, but have different radii. Thus, while our MUSIC algorithm can determine that \(D^{\prime}\) and D have the same angle, they have different RSSI values. Node \(D^{\prime}\) can also be determined as a Sybil node. In the attack model of Figure 1c, when A falsifies a large number of Sybil nodes, AP 1 does not care about the contents of the packet sent by the virtual node and only determines the angle of the client based on the CSI by our algorithm. If the number of nodes does not affect Client B's, Client C's and Client D's access to the network, we can determine that there are only four angles in the network sending the data, and they are at [\(30^{\circ}\), \(150^{\circ}\), \(60^{\circ}\), \(120^{\circ}\)].