2014 7th International Symposium on Telecommunications (IST'2014)

Local Outlier Factor Based Cooperation Spectrum

Sensing Scheme for Defending Against Attacker
Fatemeh Amini

Mehdi Mahdavi

Department of Electrical and Computer Engineering

Isfahan University of Technology,
Isfahan, Iran
f_amini@ec.iut.ac.ir

Department of Electrical and Computer Engineering

Isfahan University of Technology
Isfahan, Iran
m_mahdavi@cc.iut.ac.ir
of an outlier is an observation that deviates so much from
other observations as to arouse suspicion that it was generated
by a different mechanism [5]. In this work, we use the terms
Local Outlier Factor (LOF) that is density based method for
determining the outliers [6, 7]. The density-based approach
estimate the density distribution of the data and identifies
outlier as those lying in low-density regions [8].

Abstract Cooperative spectrum sensing is proposed as an

efficient way to detect the spectrum holes in cognitive radio
networks (CRNs). This technique, however, opens a window for
malicious users (MUs) and attackers, who send distorted
spectrum sensing data to the FC. In order to defend against such
attacks, it is necessary for the FC to distinguish the trustiness of
the reports from SUs. In this paper, we investigate a scheme to
identify and eliminate the several malicious users based Local
Outlier Factor (LOF). The proposed sensing scheme shows the
better performance than recent research works to deal with
malicious users, while does not required to any other preknowledge about data distribution and network topology. The
performance of the proposed scheme are studied and evaluated
using simulations.

The proposed method in this article, beside is able to detect

and eliminate several malicious user, doesn't require any other
pre-knowledge about data distribution, primary network,
location of primary transmitter and location of secondary
users. Finally, we compare the performance of proposed
scheme with latest work like ESD and ABP. Simulation
results show that our proposed scheme effectively defends
against various attacks.

Keywords cognitive radio; cooperative spectrum sensing;

energy detection; malicious user; outlier

The remainder of this paper is organized as follows.

Section II is related work. Section III describes the system
model and attack model. In Section IV, we propose our
scheme. Section V evaluates the performance of our scheme
under various types of attacks, and Section VI conclusions are
presented.

I. INTRODUCTION
The conducted research by the Federal Communication
Commission (FCC) indicated that some part of radio spectrum
is idle in certain periods of time [1]. One of reasons of this
inefficient usage of spectrum is assigning spectrum to licensed
users, called primary users. Improper usage of spectrum and
increasing application of wireless systems on the other hand,
necessitate development of dynamic access techniques, where
users who have no spectrum licenses, also known as secondary
users, are allowed to use temporarily unused licensed spectrum
[2]. This technology is known as Cognitive Radio (CR). CR is
based on effective spectrum sensing. Through spectrum
sensing and analysis, SUs can obtain awareness about the
spectrum usage and existence of PU.

II. RELATED WORK

In recent years cooperative spectrum sensing is proposed
to improve the performance of spectrum sensing. SUs can
send valid or invalid data to FC. Thus, it is essential to
designing robust cooperative sensing schemes to defend
against malicious users that send invalid data. Much effort has
already been made in recent years, such as [9][19].
An attack detection framework for cooperative spectrum
sensing, called IRIS has been developed in [9]. Authors of [9]
used the system state estimation to determine the
presence/absence of a primary user. IRIS employs the largest
normalized residual method to eliminate abnormal sensing
reports iteratively. In [10] COI algorithm has been proposed to
complement IRIS for cooperative attacks. In [11] AndersonDarling Goodness-of-feet method has been proposed that tests
whether the distribution of the sensing data from each
secondary user fits the expected distribution for a malicious
user. In [12] a cooperative sensing method based on Bayesian
reputation model has been proposed witch the cooperation in
CRNs is viewed as a service-evaluation process and SUs
reputation degree is updated according to its service history.
By using sparsity property of the signals, the concept of

Environmental elements like multi-path fading and

shadowing affect spectrum sensing. Cooperative Spectrum
Sensing (CSS) is suggested to decrease effect of these
elements. In CSS, SUs share their information with each
other cooperatively, and make cooperative decisions which is
surely much accurate than individual decisions. In recent
studies, some strategies are presented to improve the
performance of cooperative spectrum sensing [3, 4]. All of
such methods will be effective only when the CR users are
honest. In fact when there are Malicious Users, who send false
data to the Fusion Center (FC), performance of CSS will
drastically degrade. Some methods are presented to detect and
eliminate the effect of malicious users so that one of their
branches is based on defining outliers. The sensible definition

978-1-4799-5359-2/14/$31.00 2014 IEEE

1144

among the SUs. In fact, with presence malicious users that

send false data to the FC, performance of the cooperative
sensing will be dramatically degraded. Therefore, it is
important to detect and eliminate MUs from cooperation
before the decision making process.

compressive sensing (CS) is presented that reduces the cost of

obtaining data. Using this method, an incomplete matrix is
created at the FC. To defense attacks from malicious users in
this kind of systems, in [13] Adaptive Outlier Pursuit (AOP) is
used to complete the incomplete matrix and identify the
malicious users in CR network. In [14], some Trust Anchor
Detectors are used that evaluate instantaneous trustworthiness
of mobile detectors in combination with their reputation
scores.

Suppose
is energy detector output of ith secondary
th
user at n frame. Typically, local sensing for primary signal
detection can be formulated as a binary hypothesis problem as
follows [16]:

In recent studies, to identify and remove the effect of

malicious users, methods based on outlier have been proposed
[15-19]. In [15] Grub test and in [16] Dixon test have been
used to determine outlier. These approaches are useful when
the number of malicious users is not more than one. But,
increasing the number of malicious user, identification
performance reduce drastically. In [18] to identify more than
one malicious users, ABP and GESD tests have been
proposed. GSED can detect several malicious users if the data
distribution model is log-normal.

L
2

n i (k )
H0

k =1
i [n ] =
L

2
hi (k )s (k ) + ni (k )
H1

k =1
i = 1, 2,, N

is
where is transmitted signal from the primary user,
the channel gain between the primary user and the ith
secondary user, is zero-mean additive white Gaussian noise
is number of samples obtained from energy
(AWGN),
denote the hypothesis of the absence
detector and and
and presence of the PU signal, respectively.

The CSS scheme proposed in this paper has advantages

over previous work. In this work, does not require prior
knowledge about the location of the SUs and the network
topology. Also, it is not necessary to calculate and maintain
the history of the CR users and the proposed scheme does not
depend on the data distribution model. Herein, a powerful
cooperative spectrum sensing scheme is presented which also
presents good resistant against several malicious user while
the number and type of attacker is unknown.

B. Attack Model
There are always users who intentionally or
unintentionally send false data to the FC. SUs who
intentionally send false data called malicious users and
divided into three groups: Always YES, Always NO and
Always Opposite users. The efficiency of CSS is reduced by
the presence of malicious users.

III. SYSTEM MODEL

A. Network Model
We consider a cognitive radio network with a FC and N
secondary users in the presence of a primary user. We assume
the time is framed and the primary user in channel is present
or absent in the desired spectrum for the whole frame. Each
frame is divided to four phase which are: sensing phase,
transmission phase, decision phase and sending data phase, as
fig.1 shows.

In Always No attack, when the primary user is active,

malicious user reports its data in a way that both the energy
sensed from the spectrum and the detection probability are
decreased. In Always YES attack, when the primary user is
inactive, malicious user reports an increased amount of energy
and therefore increases the false alarm probability. In Always
Opposite, when the primary user is active, malicious user
reports less amount of energy and when the primary user is
inactive, malicious user reports high amount of energy. Such
kind of malicious user intends to fool other SUs to believe that
the spectrum is occupied while PU is absence and to cause
interference to the PU when PU is presence. In the following
we assume that malicious users act independently at each
frame.

Frame
1

Sensing Phase

Transmission Phase

Decision Phase

Sending Data Phase

Fig. 1. Frame Structure

In sensing phase, secondary users employ energy detection

to detect the presence or absence of primary user locally. In
transmission phase, each SU sends the data obtained from
spectrum sensing through an ideal control channel to the FC.
Transmission phase is also divided into N sections and each
SU is allowed to send his own data in one of these sections. In
the decision phase in FC is decided that PU is presence or
absence, by using data sent by SUs. We assume soft
combining at the FC, which is known to outperform hard
combining. In sending data phase, if the final decision
indicates the absence of the primary user, FC selects one of
the SUs to send its data. The CSS model presented above is
designed with the assumption that there is no malicious user

(1)

IV. THE PROPOSED SCHEME OF DETECTING MALICIOUS USERS

The secondary users send their sensing data to FC through
control channel. In FC, outlier factor is used to detect and
remove the effect of malicious users. Outlier factor is a
measure of deviation of a data point from the rest of the data.
In this paper, we use LOF and proposed a CSS scheme on LOF
(CSS-LOF based) which determines outlier based density.
,
,
,,
denotes the
Let
received soft decision vector at FC from each SU during nth
sensing iteration. LOF is allocated to each of the data that

1145

reflects the degree of outlier-ness of it, then LOF values were

compared with the threshold value and data that its LOF is
greater than the threshold value are identified as malicious user
data and removed from combination process. In the following,
calculation method of LOF is explained. To explain the
calculation method of LOF, it is necessary to define notions of
the I-distance of object , the I-distance neighborhood of ,
and local reachability
reachability distance of an object
density of an object . Herein, the concept of object is the
spectrum sensing data which is obtained by SUs and are sent to
the FC. Furthermore, by dist( , ) we mean the distance
between and .

V. SIMULATION RESULTS AND ANALYSIS

In this section, we evaluate the performance of the
proposed cooperative spectrum sensing scheme based on LOF
assigned to CR users. We also compare our proposed scheme
with generalized ESD and ABP methods in [18]. We consider a
CR network with N=20 SUs cooperating among each other to
detect a PU. The rural propagation model [21] is considered for
the primary signal. Hatha model [22] is implemented for path
loss that has been proposed in the 802.22 working group [23].
Operating frequency is 300MHz, the primary transmitter
antenna height is 30m and antenna height of CR users is 1.5m.
SUs are randomly located in the range of 20002000. The
standard deviation of log-normal shadowing is 5dB. The
average SNR of each SU is 10dB. SUs employ energy
detection to detect presence or absence of primary user. Next,
SUs send their energy values to the FC through control
channels which are assumed to be perfect. The time-bandwidth
factor is TW=50.

Definition 1: I-distance of an object . For any positive

integer I, the I-distance of object , denoted as I-dist( ), is
and an object
defined as the distance dist( , ) between
((i.e. dist( , )) such that:
There exists at least I object such as
,
,

where

There exists at most (I-1) object such as

,
,

where

It is important pointing out that the value of I has a high

impact on the performance of LOF in our system. To obtain
the optimal value of I, we proposed Algorithm 1 as shown in
fig. 2. In this algorithm, malicious user type is always NO and
Pd is Probability of detection. We assume that if Pd is greater
than 0.95, then the malicious user data is identified and
eliminated.

Definition 2: I-distance neighborhood of an object

.
Given I-dist( ), the I-distance neighborhood of denoted by
contains every object whose distance from is
not greater than I-dist( ) that is:
N I dist (i ) (i ) = {z | z D , dist (i ,z ) I dist (i )}

For optimal choice of I, when malicious type is Always

YES, an algorithm similar to Algorithm 1 is applied except that
for such types of malicious users we assume if Pf is smaller
than 0.05, then the malicious users data is identified and
eliminated.

(2)

Definition 3: Reachability distance of an object with

. The reachability distance of object
respect to object
, denoted by reach-dist( , ) is
with respect to object
defined as follow:

reach dist I (i ,k ) = max{I dist (k ),dist (i ,k )}

Algorithm 1: Optimization of I (Always NO MU)

1: N = 20, Counter(MUj)=0
2: For I = 1 to N
3:
For MUj =1 to N
4:
Sense Channel by SUs and Sending report to FC
5:
Calculate LOF and S_LOF and Delete MU Data
6:
Calculate Pd
7:
If Pd 0.95
8:
Counter(MUj) = Counter(MUj) + 1
9:
Else Break
10:
End If
11: End For
12: End For

(3)

Definition 4: Local reachability density of an object .

The local reachability density of i which is denoted by
is defined as:

lrd I (i ) =

N I (i

1
reach dist I (i , k )

N I ( ) (i )

(4)

Definition 5: Local outlier factor of an object . The local

outlier factor of denoted by
is defined as:

LOFI (i ) =

k N I ( i ) (i )

ldrI ( k )
ldrI (i )

Fig. 2: Suggested algorithm to find optimized value of I

Fig.3.a shows the simulation result of algorithm 1 for

Always NO type of malicious users. As can been see for I=10
the maximum number malicious users can be identified. Fig
3.b shows the simulation result of algorithm 2 for Always YES
malicious users. As you can see, if I=10 the maximum number
of malicious users are identified.

(5)

N I ( ) (i )
i

is the average ratio of local

The LOF of object
reachability density of
and its I-distance neighborhood [8].
It is proved that LOF of the honest user data is approximately
equal to one [7].

1146

Opposite. As can be seen from Figs. 4 and 5, LOF tests

perform better than GESD and ABP tests.

Fig 3.a: The number of detected Always NO MU vs. I

Fig. 5. Pd vs. Average SNR of comparison tests

The performance of the proposed scheme is compared with

two cases. In the first case there is no malicious user in the
network. In the second case there are 8 numbers of malicious
users in the system however, there is no scheme to combat
with attackers. We first consider Always No malicious users.
As shown in this Fig 6, the proposed scheme can well
eliminate the impact of such malicious users.

Fig. 3.b: The number of Detected Always YES MUs vs. I

Fig. 4 shows the performance comparison of the proposed

scheme with other outlier tests namely GESD and ABP tests.
For this simulation, malicious users type are Always Opposite
and the number of such users are M = 4. Furthermore, I = 5 is
considered.

Fig. 6: Comparison of CSS Scheme based LOF with when MU dont

exist (N=20, MU=8, Always NO type)

Fig. 7 presents the detection performance of the proposed

CSS scheme when malicious users type is Always YES. From
Figs. 6 and 7 it can be concluded that the proposed solution is
able to eliminate both types of Always Yes/No malicious user.

Fig. 4: Comparison of different outlier tests with proposed CSS scheme

based test (N=20, MU = 4, Always Opposite)

From Fig. 4, it can be observed that the detection

performance of all three schemes increases along with the
increase of the required false alarm probability. Moreover, the
detection performance of the proposed scheme performs
slightly better than the GESD and ABP based cooperative
scheme. Hence, our proposed cooperative schemes can defend
against the Always Opposite attack effectively and will be able
to remove effect of the multiple malicious users. Fig. 5
presents the comparison of the detection performance of
proposed scheme with GESD and ABP based schemes under
different SNR. For such comparison MU = 4,
I = 5 and Pf = 0.01 and malicious users type is Always

Fig. 7: Comparison of Proposed Scheme with when MU dont exist

(N=20, MU=8, Always YES type)

1147

VI. CONCLUSION
This paper proposed an outlier-based malicious user
detection scheme for cooperative sensing. The proposed
scheme, which is based on Local Outlier Factor, is resistant
against several malicious users while the number and type of
attacker is unknown. Also proposed CSS scheme dont require
pre-knowledge about data distribution, primary network,
location of primary transmitter and location of secondary
users. Finally, LOF tests perform better than recent research
works.

[18]
[19]

[20]

VII. REFERENCES
[1]
[2]
[3]

[4]
[5]
[6]

[7]
[8]
[9]

[10]
[11]
[12]

[13]

[14]
[15]

[16]

[17]

[21]

Spectrum Policy Task Force report, technical report 02-135,

Federal Communications Commission, Nov 2002.
B. Wang and K.J. Ray Liu, Advances in Cognitive Radio
Networks: A Survey, IEEE Journal of selected Topic in signal
processing, VOL. 5, NO. 1, FEBRUARY 2011.
Su-wen, W.J. kang, Z. Ling, Q. Ming, SNR-based weighted
cooperative spectrum sensing in cognitive radio networks,
ELSEVIER, The Journal of China Universities of Posts and
Telecommunications, Vol. 17, Issue 2, April 2010, pp. 1-7.
G. Zhanga, R. Dingb, L. Huangb, Using Trust to Establish
Cooperative Spectrum Sensing Framework ELSEVIER, Perdoica
Engineering 15, 2011, pp. 1361-136.
D. Hawkins, Identification of Outliers, Chapman and Hall,
London, 1980.
M.M. Breunig, H.P. Kriegel, R.T. Ng, J. Sander, LOF: Identifying
Density-Based Local Outliers, In Proceedings of ACMSIGMOD
International Conference on Management of Data, pp. 93-104,
Dallas, Texas, U.S.A., 2000.
L. Chiu, A.W. Fu, Enhancements on Local Outlier Detection,
Proceedings of the Seventh International Database Engineering
and Applications Symposium, July 2003 IEEE.
J. Xi, X. Zhou, J. Su, Outlier Detection Algorithms in Data
Mining, Second International on Intelligent Information
Technology Application, Dec. 2008, IEEE, Vol. 1, pp. 94 97.
A.W. Min, K. Kim, K.G. Shin, Robust Cooperative Sensing via
State Estimation in Cognitive Radio Networks, International
Symposium on Dynamic Spectrum Access Networks (DySPAN),
May 2011, pp. 185 - 196.
Z. Qin, Q. Li, G. Hsieh, Defending Against Cooperative Attacks
in Cooperative Spectrum Sensing, IEEE TRANSACTIONS ON
WIRELESS COMMUNICATIONS, VOL. 12, NO. 6, JUNE 2013.
G. Noh, S. Lim, S. Lee, D. Hong, Goodness-of-Fit-based
Malicious User Detection in Cooperative Spectrum Sensing,
Vehicular Technology Conference (VTC Fall), 2012 IEEE.
M. Zhou, J. Shen, H. Chen, L. Xie, A Cooperative Spectrum
Sensing Scheme Based on the Bayesian Reputation Model in
Cognitive Radio Networks, 2013 IEEE, Wireless Communication
and Networking Conference (WCNC), MAN.
Z. Qin, Y. Gao, M.D. Plumbley, C.G. Parini, L.G. Cuthbert, Lowrank Matrix Completion based Malicious User Detection in
Cooperative Spectrum Sensing, Global Conference on Signal and
Information Processing (GlobalSIP), Dec. 2013 IEEE, pp. 1186
1189.
R. Zhang, J. Zhang, Y. Zhang, C. Zhang, Secure Crowdsourcingbased Cooperative Spectrum Sensing, INFOCOM, April 2013,
Proceedings IEEE, pp. 2526 - 2534.
P. Kaligineedi, M. Khabbazian, V.K. Bhargava, Malicious User
Detection in a Cognitive Radio Cooperative Sensing System
IEEE TRANSACTIONS ON WIRELESS COMMUNICATIONS,
VOL. 9, NO. 8, AUGUST 2010, pp. 2488-2497.
S.S. Kalamkar, A.Banerjee, Malicious User Suppression for
Cooperative Spectrum Sensing in Cognitive Radio Networks using
Dixons Outlier Detection Method, IEEE Communications
(NCC), 2012 National Conference on, 2012, pp. 1 5.
S. Srinu, S.L. Sabat, Cooperative wideband sensing based on
cyclostationary features with multiple malicious user elimination,

[22]
[23]
[24]

1148

ELSEVIER, International Journal of Electronics and

Communications, 24 February 2013, pp. 702 707.
S.Srinu, S.L. Sabat, Cooperative wideband sensing based on
entropy and cyclic features under noise uncertaint, IET Signal
Process, IEEE 2013, Vol. 7, Iss. 8, pp. 655663.
S. Jana, K. Zeng, P. Mohapatra, Trusted Collaborative Spectrum
Sensing for Mobile Cognitive Radio Networks, IEEE, INFOCOM
2012, Information Forensics and Security, IEEE Transactions on,
2013, pp. 1497 1507.
F. Zhang, P. Ren, L. Sun, Q. Du, An Iterative Screening Strategy
Based on Detection Performance for Multi-Channel Cooperative
Spectrum Sensing, Aug. 2013, 8th International Conference on
Communications and Networking in China (CHINACOM), pp.
628 - 632.
N. Shabbir, M.T. Sadiq, H. Kashif, R. Ullah, COMPARISON OF
RADIO PROPAGATION MODELS FOR LONG TERM
EVOLUTION (LTE) NETWORK, International Journal of NextGeneration Networks (IJNGN), Vol. 3, No. 3, Sep, 2011.
M. Hata, Empirical Formula for Propagation Loss in Land Mobile
Radio Services, IEEE TRANSACTIONS ON VEHICULAR
TECHNOLOGY, VOL. VT-29, NO. 3, AUGUST 1980.
G. Chouinard, IEEE P802.22 Wireless RANs: minutes of the
channel model sub-group teleconference, July 2005, available
at: http://www.ieee802.org/22/.
A.G. Fragkiadakis, E.Z. Tragos, I.G. Askoxylakis, A Survey on
Security Threats and Detection Techniques in Cognitive Radio
Networks, IEEE COMMUNICATIONS SURVEYS &
TUTORIALS, 2012.