## 3 Methodology
### Outlier Detection Algorithms  
Three different OD algorithms are used in this study: the main one is the SDO algorithm, while a comparison is carried out with two other well-known algorithms, the Isolation Forest (IF) and the One Class Support Vector Machine (OCSVM) algorithms. All three OD algorithms are of the unsupervised type because they should not be able to use labeled information, which may be poisoned by the label flipping attack. SDO is an unsupervised algorithm that was developed to address the need for fast, highly interpretable, and intuitively parameterizable anomaly detection; it was initially introduced in [26]. The design of SDO is based on the concept of generating a low-density data model formed by observers. In SDO, an observer is a data object (i.e., sample) that is located within the data mass and ideally at an equivalent distance to other observers within the same cluster. The outlierness score of the samples in the data set is estimated using the distance to its observers. Like other OD algorithms, SDO is an eager learner that generates a low-density model of the data set during a training phase and in a subsequent phase compares new samples with the model. Because SDO does not require recalling old data samples again, this algorithm has a less severe computational load than other OD algorithms during the application phase. In fact, the computing complexity of SDO is \(O(nk)|n\rightarrow\inf=O(n)\), where n is the number of samples in the data set and k is the number of observers [26]. The assumption for the application of SDO to mitigate poisoning attacks to ML algorithms is that poisoned samples will be distanced from the main LOS and NLOS clusters. The additional advantage of SDO is the low time complexity, which is an advantage for wireless communication data sets, which are usually composed of many samples (e.g., the eWINE data set used in this study is composed of 6000 \(\times\) 7 scenarios for 42,000 samples). To the best of the author's knowledge, SDO has never been applied to poisoning attacks in ML in general and for LOS/NLOS classification in particular. The IF algorithm was initially introduced in [27] and has been extensively used by the ML research community since its introduction. IF is derived from the random forest algorithm and it generates an ensemble of trees on the data set given as input. The anomalies are those samples that have short average path lengths on the trees in comparison to the majority of samples. The IF algorithm is based on two main parameters: the number of trees used to build the tree and the sub-sampling size. Similar to SDO, IF has a linear time complexity with a low constant and a low memory requirement. In particular, if the sub-sampling size is termed \(\phi\) and the number of trees \(t\) (the input parameters of the IF algorithm), the computing complexity of IF for the training phase is \(O(t\times\phi\times log\phi)\) and it is \(O(n\times t\times log\phi)\) for the testing phase where \(n\) is the size of the testing portion of the data set. The IF algorithm was chosen in this study because it was used in other studies [29; 30] mitigating poisoning attacks in ML but not for LOS/NLOS classification. The OCSVM algorithm is an extension of SVM for one-class problems and its use as an OD algorithm was shown in [28]. One-class SVM is an anomaly detection algorithm that is based on the concept of separating data from the origin in the transformed high-dimensional predictor space using a kernel. This study uses the Gaussian kernel to identify the decision boundary to generate a maximum-margin hyperplane that separates the samples in training data from the origin in the feature space. In OCSVM, the outlierness score is estimated as the solution of the quadratic optimization problem of the related soft-margin SVM formulation.