# A Correlation-Based Sensing Scheme for Outlier Detection in Cognitive Radio Networks
## 1 Introduction
The authors of [20] proposed a neighbor detection-based spectrum sensing algorithm in distributed CRNs, which detects attackers with the help of neighbors during spectrum sensing to improve the decision-making accuracy. In this algorithm, the extreme outliers are isolated in the cognitive radio and hoc network via the modified \(Z\)-test, and then the q-out-of-m rule is implemented to mitigate the SSDF attack [21]. Similarly, the authors integrated the reputation and q-out-of-m rule mechanism to mitigate the effect of the SSDF attack [22; 23]. The authors of [24] utilized a k-medoids clustering algorithm to mine the collection of sensing reports at the FC to determine the attacker's presence; additionally, the proposed scheme can be utilized on streaming data (sensing reports), and thereby detects and isolates the attackers existing in the networks. The intelligent MUs were accurately detected by the authors of [25], who used a physical-layer network coding scheme based on a novel scheme friend or foe (FOF) detection. A cross-layered approach was presented to make the SU able to differentiate between the PU and MU through the hidden Markov model at the medium access control (MAC) layer [26]. The authors of [27] took advantage of the compressive sensing to detect the attack and defensive behavior and proposed a density-based MU detection with the trusted user to distinguish the MU precisely. A robust defense strategy against the MUs via double-sided neighbor distance-based genetic algorithm was presented in order to filter out the MU sensing reports in CSS [28]. The authors of [29] proposed a novel attacker identification algorithm that is able to skillfully detect attackers and reject their reported results. Moreover, a novel attacker punishment algorithm was provided with the aim of punishing attackers by lowering their individual energy efficiency, motivating them to quit sending false results. A comparative analysis of different outlier techniques was proposed by the authors of [30]. Similarly, a comparative analysis of the various outlier method for the MUs was discussed by the authors of [31]. The authors of [32] assigned a reputation value to the SU, while ignoring the SUs having a reputation below a threshold value. An extended sequential CSS scheme was proposed based on the value of each SU [33]. A critical analysis of the MU attack, i.e., always yes, always no, and random attack, was studied by the authors of [34]. An onion peeling approach based on the calculation of suspicious levels was proposed by the authors of [35], which used belief propagation as the detection method. Protection of the CSS method, mentioned by the authors of [32], was reduced in the case of a large number of MUs. In this paper, we propose a correlation-based scheme at the FC to detect the outlier and its behavior. In the proposed scheme, the FC first collects sensing information from all individual SUs, and then applies the correlation tool in the difference of the result of each SU, with the collective sensing results of all the SUs. The proposed scheme at the FC detects the results of the normal SUs, which are dissimilar from those of the MUs. In the proposed scheme, the box-whisker plot is utilized to classify the outlier and normal SUs. The box-whisker plot defines the upper and lower quartile limits of the normal SUs. Through the proposed scheme, the outlier and normal SUs are classified. The proposed scheme is tested for the existence of opposite malicious users (OMUs) and random opposite malicious users (ROMUs). The OMUs always send a high-energy signal when the PU is absent and a low-energy signal when PU is present. The ROMU is more dangerous and difficult to cope with. The ROMU's behavior is unpredictable, it behaves as a normal SU, while appearing as MU with opposite behavior at random intervals of time. Unlike always yes and always no, both the OMU and ROMU increase the probability of a false alarm and misdetection, which both degrades the bandwidth utilization and increases the interference to the PU network.