## 5 Results
### Radar Data Set
#### 5.2.2 Performance of LOS/NLOS Classification  
Figure 13c and the related subfigures show the accuracy obtained with different OD algorithms and the random forest classifier for the different attacks with \(S_{P}=16\) and the Radar data set for the FSP and TFP attacks (for the LF attacks, \(S_{P}\) does not apply) with \(P_{San}=80\%\). The results are consistent with what was obtained with the eWINE data set: the accuracy is quite similar for different values of \(T_{P}\) across the three algorithms. While SDO has generally a strong performance, the IF algorithm manages to achieve the best accuracy in most of the values, even if the differences in accuracy are quite small in relative values (less or around \(1\%\)). Figure 12: Comparison of the OD algorithms for the detection rate of poisoned samples with \(S_{P}=16\) and the Radar data set. The y-axis provides the percentage of poisoned samples correctly identified as such by the OD algorithm. On the y-axis, the value of percentage \(T_{P}\) of poisoned samples on the overall samples is given. As for the eWINE data set, Figure 13(c) shows the difference in accuracy for the Radar data set obtained with the RaF algorithm on the sanitized data set and the poisoned data set using the SDO algorithm. This is one of the main goals of the study: to evaluate how OD algorithms and SDO in particular can be used to sanitize a poisoned data set for three different attacks. As in the case of the eWINE data set, the results shown in Figure 13(c) support well the stated goal. Figure 13(a) shows a positive increase in classification accuracy for the large majority of the values of \(T_{P}\) and \(P_{San}\) with the most significant improvements obtained with low values of \(P_{San}\) as in the case of the eWINE data set. This is due to the consideration that with a small value of \(P_{SAN}\), the OD algorithm is able to retrieve the majority of the legitimate samples. When the value of \(P_{SAN}\) is larger, the OD algorithm also includes poisoned samples, thus lowering the classification accuracy. For the LF and TFP attacks, a decreasing trend is noted in Figure 13(a),c for the increasing values of \(T_{P}\): the classification accuracy tends to decrease with a higher presence of poisoned samples while this trend was not significantly present in the eWINE data set. This trend gets to the point that for \(T_{P}=0.5\), the improvement in accuracy is minimal or even negative, which seems to point out that the OD algorithms are not able to distinguish the legitimate from the poisoned samples for such a large value of \(T_{P}\). A possible reason is due to the impact of the poisoning attack on the shape of the signals in the data set, which is more severe in the Radar data set than for the eWINE data, and the OD algorithm is more challenged in identifying the legitimate samples (i.e., lower score obtained by the OD algorithm). On the other hand, this trend is less relevant for the FSP attack in Figure 13(b). Figure 13: Accuracy obtained with the different OD algorithms and the random forest classifier for the different attacks with \(S_{P}=16\) and the Radar data set for the FSP and TFP attacks (for the LF attacks, \(S_{P}\) does not apply) with \(P_{San}=80\%\). To complement the previous results for the accuracy improvement shown in Figure 14, this study also presents the results for the precision and recall metrics in the Radar data set in Figures 15 and 16, respectively. It can be seen that the values and trends of precision and recall are coherent with the accuracy ones presented before. Figure 14: Improvement of the accuracy \(Accuracy_{1}\) for the Radar data set with the SDO algorithm and the random forest classifier for the different attacks within scenario 1 (Office 1); \(S_{P}=16\) for the FSP and TFP attacks (for the LF attack, \(S_{P}\) does not apply) and different values of \(P_{San}\).