# Accurate Sybil Attack Detection Based on Fine-Grained Physical Channel Information
## 6 Dynamic Detection Algorithm
### Density-Based Spatial Clustering of Applications with Noise
If the data length is less than the length of the window, it is considered as unavailable data. The input is:  
\[W=\left\{r_{1},r_{1+ws}\ldots r_{1+n-ws},r_{2},r_{2+ws},\ldots,r_{2+n-ws}, \ldots,r_{m+n-ws}\right\},r\in R^{2} \tag{11}\]  
The output is the cluster number \(C\). The \(\varepsilon\)-neighbourhood is the Euclidean distance between every two samples; the threshold is \(\varepsilon\); and MinPts is the minimum number of pairs in the neighbourhood. If it is greater than this number, the point is the core point. Then, the same cluster can be reached by density-reachable and density-direct means. The algorithm is shown in detail in Algorithm 1. ```
Input:\(W\), \(\varepsilon\)-neighbourhood, MinPts Output:\(C,N\)
1 foreach\(r\) in \(W\)do
2 Mark \(r\) as visited;
3\(NeighborPts=Query\left(r,\varepsilon\right)\);
4 if\(sizeof\left(NeighborPts\right)\ <MinPts\)then
5 Mark \(r\) as NOISE;
6
7 else
8\(C_{i}=newcluster\);
9\(N_{i}=Algorithm2\left(r,NeighborPts,C,\varepsilon,MinPts\right)\);
10\(C=\left\{C_{1},C_{2},C_{3},\cdots,C_{i}\right\},N=\left\{N_{1},N_{2},N_{3}, \cdots,N_{i}\right\}\);
11 return \(C,N\);
```  
**Algorithm 1**Density-based spatial clustering of applications with noise. The function query is to query the number of points in the neighbourhood of \(r\). Algorithm 1 calculates the final result of DBSCAN, which is the clustering cluster and the density-reachable points within each cluster. Algorithm 2 belongs to Algorithm 1, which is the core of DBSCAN. Algorithm 2 calculates all the density-reachable points of all the neighbourhood core points. It is assumed that the AP collects the amplitude characteristics of M clients by receiving CSI. If these movement nodes have different MAC addresses, there is no behaviour such that Sybil nodes copy the real node's MAC address, but it can not prove that there is no Sybil attack. An attacker can randomly forge large numbers of MAC addresses that do not exist in the network. We need further validation, therefore, if the number of clusters calculated by Algorithm 1 is less than M, then the clusters with higher density can be regarded as forged Sybil nodes. If there is a different client with the same MAC address, we can determine that there is a Sybil attack on the network. Sybil nodes in W can also be returned by Algorithm 1. The only difference between the common motion feature and the attack motion feature is that in the same time window, the forged attack nodes are all from the same attacker, so the density within the attack cluster is much higher than that of the common motion nodes. ```
Input:\(r\), \(NeighborPts\), \(C,e\), \(MinPts\) Output: All points within NeighborPts
1 Add \(r\) to cluster \(C\);
2 foreach\(r^{\prime}\) in NeighborPtsdo
3 if\(r^{\prime}\) is not visitedthen
4 Mark \(r^{\prime}\) as visited;
5\(NeighborPts^{\prime}=Query\left(r^{\prime},\varepsilon\right)\) ;
6 elseif\(sizeof\left(NeighborPts^{\prime}\right)>=MinPts\)then
7\(NeighborPts=NeighborPts+NeighborPts^{\prime}\);
8 elseif\(r^{\prime}\) is not yet a member of any cluster \(C_{i}\)then
9 Add \(r^{\prime}\) to cluster \(C_{i}\);
10
11 return all points within NeighborPts;
```  
**Algorithm 2**Calculate all density-reachable points of core points.