## 3 A Proposed Online Detection Algorithm  
The symptoms of selfish tethering resembles those of the well-known hidden node problem--they both result in excessive frame loss of nearby legitimate APs. Thus, the successful detection of selfish misbehavior depends largely on a AP's ability to identify the root cause of its frame losses. Note that in 802.11 Wi-Fi, there are four main causes of frame losses: (i) PHY-layer link quality degradation, (ii) MAC-layer collision, (iii) hidden nodes, and (iv) selfish misbehavior (e.g., manipulation of the CCA thresholds). Fortunately, selfish tethering exhibits unique features that can facilitate distinguishing the selfish carrier sensing of a tethering host from other causes of frame losses, especially from the hidden node problem. The main difference is that the frame losses at legitimate nodes that are caused by selfish tethering cannot be easily resolved by the RTS/CTS mechanism. This is because the selfish nodes may not recognize the RTS/CTS frames, owing to their manipulated CCA thresholds (i.e., their short sensing ranges) or RTS/CTS frames can be intentionally ignored by the selfish nodes. Based on this observation, we propose a simple, yet efficient online detection algorithm, called CUBIA (_CUsum-Based Interference inference with Adaptive RTS/CTS_) that can accurately distinguish selfish behavior with CCA manipulation from other types of network problems, such as severe network congestion (i.e., collisions) and the hidden node problem. CUBIA operates at each AP and diagnoses the network condition by passively monitoring the ongoing traffic with its client nodes. Specifically, if CUBIA detects severe and persistent frame transmission failures, then it employs the RTS/CTS exchange before each data transmission to eliminate the possibility of the hidden node problem. For this, CUBIA employs the CUSUM (CUmulative SUM) algorithm [19] to quantify the duration of the frame losses. CUSUM algorithm suits our needs, because it is simple and light-weight and has been widely used for the detection of state changes. In the following, we describe the detailed procedure of the detection mechanism while using the CUSUM algorithm. CUBIA monitors the frame error rate (FER) for every \(m\) transmissions to detect any abrupt changes in network condition, which could indicate the possibility of selfish tethering nodes. Let \(p_{k}\) denote the frame error rate for the \(k\)-th measurement period at the AP, given by \(p_{k}=e_{k}/m\), where \(e_{k}\) denotes the number of transmission failures. Subsequently, we calculate the average error probability \(E[p]\) by a moving average to reflect the network dynamics as:  
\[E[p]=\lambda\cdot E[p]+(1-\lambda)\cdot p_{k}. \tag{1}\]  
We define the CUSUM change detection filter \(c_{k}^{i}\) of the AP, as:  
\[c_{k}=\max( 0, c_{k-1}+p_{k}-v), \tag{2}\] \[c_{0}=0,\]  
Figure 8: Throughput gain of selfish carrier sensing over various cellular backhaul link capacities and AP densities. where \(v\) is a drift parameter, which is a filter design parameter. \(v\) is configured differently, according to the value of \(c_{k}\), as:  
\[v= \begin{cases}E[p]+\mathcal{T}_{FER},&\text{if }c_{k}<\theta_{AS}\\ \mathcal{T}_{FER},&\text{if }\theta_{AS}\leq c_{k}\leq\theta_{S},\end{cases}  \tag{3}\]  
where \(\theta_{AS}\) and \(\theta_{S}\) denote the first alarm threshold for asymmetric carrier sensing and the detection (second) alarm threshold for inferring selfish carrier sensing, respectively. CUBIA issues the first alarm to the AP when \(c_{k}>\theta_{AS}\). Subsequently, CUBIA adaptively activates the RTS/CTS exchange mechanism and continues to track the change detection with \(v=\mathcal{T}_{FER}\) in Equations (2) and (3). Note that the first alarm can be caused by a sudden severe MAC layer congestion or a hidden node problem. However, in such a case, the magnitude of \(c_{k}\) tends to decrease with RTC/CTS frames, because the collisions are filtered out [20] and the hidden terminal problem are mitigated with RTS/CTS exchange.