# Accurate Sybil Attack Detection Based on Fine-Grained Physical Channel Information
## 6 Dynamic Detection Algorithm
### Density-Based Spatial Clustering of Applications with Noise  
When the Sybil attack occurs, a large number of attack node amplitude samples is closely distributed. Moreover, the motion characteristics are different from those of normal nodes. However, we are not sure of the number of actual nodes in the environment, and there are nodes that are accessed and offline at any time. According to [45], in the frequency domain, the frequency is about 35-40 Hz, and the wavelength is 5.15 cm when a person equipped with any WiFi device in WLAN is walking. Its frequency range is 40-80 Hz when he or she falls. The frequency is 15-30 Hz when a person carries the WiFi device in WLAN standing up and sitting down. We define these moved WiFi devices for mobile clients. However, the attacks will be repeated periodically and mostly below the normal user behaviour frequency. The frequency is 2-5 Hz. Combined with experiment and feature selection \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multicolumn{1}{c}{} & \multicolumn{6}{c}{**Normal State**} \\ \hline \hline \multicolumn{1}{c}{**SchemesFeatures**} & \multicolumn{1}{c}{**Min**} & \multicolumn{1}{c}{**Max**} & \multicolumn{1}{c}{**Var**} & \multicolumn{1}{c}{**Range**} & \multicolumn{1}{c}{**MCR**} & \multicolumn{1}{c}{**Std**} & \multicolumn{1}{c}{**Area**} & \multicolumn{1}{c}{**NPV**} \\ \hline I & 0.040 & 0.039 & 0.059 & 0.082 & 0.129 & 0.186 & 0.246 & 0.048 \\ IG & 0.019 & 0.021 & 0.042 & 0.045 & 0.085 & 0.106 & 0.190 & 0.039 \\ PCA & 3.350 & \(-1.530\) & 1.712 & 4.880 & 3 & 1.311 & 1.215 & 4 \\ \hline \multicolumn{1}{c}{} & \multicolumn{6}{c}{**Attack State**} \\ \hline I & 0.051 & 0.038 & 0.085 & 0.143 & 0.135 & 0.193 & 0.208 & 0.151 \\ IG & 0.045 & 0.029 & 0.027 & 0.054 & 0.126 & 0.087 & 0.115 & 0.040 \\ PCA & 3.490 & \(-1.340\) & 2.132 & 4.830 & 4 & 1.462 & 0.700 & 4 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Effect of the attack on various feature selection schemes. MCR, number of times the Signal Crosses the Mean value; NPV, the total Number of Peaks and Valleys. results, we find that the time domain can provide richer motion characteristics when the amplitude is effectively filtered. Usually, the attacker is at a low frequency. In fact, if the attacker moves more aggressively or if the mobile device user happens to perform a low-frequency movement, the frequency domain-based attack identification will be confused. However, in fact, there are many forged nodes in the Sybil attack. The main feature is that a large number of those nodes has the same physical layer characteristics. Therefore, based on this feature, we can calculate the attacker cluster of high density and effectively distinguish attackers and normal clients. The features NPV and range are more accurate than frequency and can display distinctly different clusters. However, they do not always stabilize for a particular value. Therefore, not every cluster is a spherical data distribution. We use Density-Based Spatial Clustering of Applications with Noise (DBSCAN) to cluster the Sybil attack nodes. DBSCAN is able to cluster the same movements in closely-spaced density into one cluster and does not need to enter the category number. What is more, it can find any shape of the cluster and noise points while clustering. In detail, the core of DBSCAN is to find the largest set of samples with the highest density connected to each other by density-reachable relations. We cycle through all the packages within multiple time windows. The average of range and NPV is clustered in each time window. Because we use the 5-GHz wireless band, the sampling frequency can be set as 2500 packets/s, which ensures that each motion feature can be richly collected. Features will not change significantly within 1 s; therefore, the rectangular window length \(ws=2500\). The motion features per second of \(m\) clients are \(r_{m+n-ws}\); \(r_{m}\) is client \(m\)'s features of the first second, and \(n\) is the data acquisition time in seconds.