# Accurate Sybil Attack Detection Based on Fine-Grained Physical Channel Information
## 6 Dynamic Detection Algorithm
### Feature Extraction  
We know that attackers' movements have a specific behavioural trait. In fact, they launched such acts in order to avoid the static detection algorithm. It is a feature that attackers move their positions slightly to change the CSI phases. This is different from the actual client's movements. The motion detection algorithm can detect the starting and ending moments of any client's motion. What we need to do is to collect the datasets at each node attack and in the absence of an attack, according to different node characteristics.  
Let \(X=\left\{x_{1},x_{2},x_{3},\,\cdots,x_{\text{j}}\right\}\), \(j=200\). \(x_{j}\) is the different client amplitude data within 2 s from start to end when there is no Sybil attack. \(x_{i}\) is zero if there is no movement or no client access. We simulated the attack so that one of the nodes became a Sybil client, forging 50 attack nodes. Repeat the same action and the same kind of action in 2 s to get the dataset \(Y=\left\{y_{1},y_{2},y_{3},\,\cdots,y_{j}\right\},j=200\). We calculate the eight statistical features in each of \(x_{i}\) and \(y_{i}\) from \(X\) and \(Y\), which are the Maximum (Max), Minimum (Min), Variance (Var), Range, number of times the Signal Crosses the Mean value (MCR), the Standard deviation (Std), the Area under the signal curve (Area) and the total Number of Peaks and Valleys  
Figure 8: Different activities in the environment.  
(NPV). We assume that each node has the same probability of moving. Let \(z=\left|x_{j}-x_{j+1}\right|\), then \(P(z)\) can be expressed as:  
\[P(z)=\frac{count(z>k)}{count(\text{g}=1)}\cdot\frac{\text{g}}{200},\text{g}= \left\{\begin{array}{l}\text{g}=1,if\ x\
eq 0.\\ \text{g}=0,if\ x=0.\end{array}\right. \tag{9}\]  
The probability of other cases is \(1-P(z)\), so the entropy H(z) of different features is expressed as:  
\[H\left(z\right)=-\left[p\left(z\right)logp\left(z\right)+\left(1-p\left(z \right)\right)log(1-p\left(z\right))\right] \tag{10}\]  
The entropy of x and y is equally valid. Therefore, the information gain after launching the Sybil attack is \(IG\left(z_{y}|z_{x}\right)=H\left(z_{y}\right)-H\left(z_{y}|z_{x}\right)\). IGfor normal situations can be calculated by \(IG\left(z_{x+1}|z_{x}\right)=H\left(z_{x+1}\right)-H\left(z_{x+1}|z_{x}\right)\), and \(z_{x+1}\) is the data increment that changes only one normal client to one attack node. At the same time, we also perform PCA processing on the data of 30 subcarriers after normalizing the data and select the first major feature and calculate its eight features. The results are shown in Table 1.  
Because each node has the same probability of moving, the Sybil attack will generate a large number of attack nodes. Therefore, the probability of Sybil nodes occurring is higher than that of other nodes, and the information entropy increases as the attack nodes increase. As for the information gain, attack nodes faked by Sybil attacks belong to the same physical layer nodes. Therefore, once the attack exists, IG will remain almost unchanged. On the other hand, the dimensions of the 30 subcarriers are too redundant, and most of the motion-sensitive carriers are mostly fixed. The PCA-based method does not change the amplitude characteristics of the physical layer in the environment because of the Sybil attack. Therefore, in summary, it can be seen from Table 1 that the range and the total value of packs and valleys are consistent with the Sybil attack characteristic, so the two eigenvalues are selected as the input features. In fact, this is because attacks are less frequent, making the number of NPV per attack nodes be far less than the normal activity node, and the range is relatively large.