# Accurate Sybil Attack Detection Based on Fine-Grained Physical Channel Information
## 1 Introduction  
With the widespread deployment of the Internet-of-Things (IoT), its security issues have become increasingly prominent. Due to the broadcast nature of the IoT network, the privacy and security of clients will be severely threatened. Although the WLAN network is equipped with the 802.11i security protocol [1], there are still vulnerabilities in the agreement. Specifically, the Sybil attack is discussed in peer-to-peer systems by [PERSON] [2], which means that a client forges multiple wireless devices. The forged devices may be an existing device in the WLAN network or a virtual attack device. Each fake device can be used as a middleman to steal real clients' private information, and when a large number of forged devices access the networks and send large amounts of data, this will block the communication of other devices in the wireless networks, which is also a kind of association flood Denial of Service (DoS) attack [3]. The previous Sybil attack detection algorithms are almost all based on the Received Signal Strength Indicator (RSSI) [4; 5; 6; 7]. However, if there is no accurate location model, those algorithms only detect the attack by collecting fingerprints, and their detection range and robustness have greatlimitations. Meanwhile, traditional RSSI values will not be stable in a complex indoor environment when a filtering strategy technology is not applied [8]. Because of the complexity of the indoor wireless environment, the difficulty of Sybil attack detection is more serious. Fortunately, Channel State Information (CSI)-based indoor location technology has become more mature in recent years, and this technology can provide more accurate location results. At the same time, it achieves the passive physical layer positioning method without additional positioning equipment. Chronos [9] first achieved decimetre-level positioning in a single commercial WiFi device. Now, SpotFi [10] can achieve a median accuracy of 40 cm by estimating the Time of Flight (ToF) and Angle of Arrival (AoA) for WiFi devices. As a result, we propose a novel Sybil attack detection algorithm based on CSI. The algorithm can detect attackers separately from both static and dynamic aspects. It is different from our previous attack detection method [11]. The biggest difference between the two papers lies in the wider application scenarios and the improved Sybil attack detection system. Although our previous paper can detect some static Sybil nodes in the environment by combining AoA and RSSI, they can only be applied to situations where there is no movement in the WLAN environment, that is the attack nodes will not be detected during the moment of their movements. Based on this, this paper put forward a complete Sybil attack detection system and dynamic attack detection algorithm, which can not only be applied to static attacks, but also to dynamic attacks. At the same time, the problem of RSSI instability in our previous paper is also solved by combining the amplitude in this paper, which makes the detection results more stable and can be more generally applicable to complex WLAN environments. First of all, in this paper, we combine the CSI and RSSI values to remove the DC noise in the static channel state. By eliminating the sampling frequency deviation and sampling time deviation [12], we propose a self-adaptive Multiple Signal Classification (MUSIC) algorithm detection scheme for passive detection. The algorithm can effectively determine the angle of the user in the WLAN environment, and the implementation of the algorithm only needs to be detected by one AP. We distinguish between APs in different locations according to the difference of RSSIs and amplitudes in different locations and AoA technology [13; 14]. This way, we can accurately distinguish between users and attackers in different locations. Secondly, on the dynamic side, it is well known that an attack may move its position within a detection threshold to avoid static detection.