Trojan horse detection apparatus and method

Abstract

The application discloses a Trojan horse virus detection device and method, and belongs to the technical field of information security. The application first finds that the Trojan horse virus may steal information by controlling a computer loudspeaker to emit ultrasonic signals, and proposes the Trojan horse virus detection device and method in light of the finding. The ultrasonic signals emitted by the computer loudspeaker are collected, and then filtered and amplified. The processed ultrasonic signals are decoded to obtain corresponding spectrum information and further analyzed. If the signal peak values all exceed a preset threshold value within a preset sampling period, it is determined that the device to be detected is invaded by the Trojan horse virus. In this way, the application can effectively detect the Trojan horse virus which steals the information stored in the device to be detected by controlling the loudspeaker of the device to be detected to emit ultrasonic signals, and is beneficial to maintaining the information security of the device.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and more particularly, relates to a Trojan virus detection device and method. BACKGROUND

[0002] With the popularity of mobile intelligent terminals, malicious Trojan attacks and malicious Trojan detection technologies on mobile intelligent terminals are also increasingly valued by people. Malicious Trojan programs can steal private information stored on user devices and send them to attackers by hiding and implanting in user devices. Meanwhile, malicious Trojan programs can also maliciously consume resources of user devices, such as CPU, memory, network bandwidth, battery capacity, etc., which brings serious privacy threats and cost consumption to users.

[0003] Under the prior art condition, in order to resist malicious Trojan attack technology, the current mainstream Trojan detection means mainly includes:

[0004] Monitoring system processes and monitoring system registries to identify and determine Trojans, but this method often cannot accurately determine higher-level Trojans. Higher-level Trojan programs can better disguise themselves and do not occupy too many system processes. Therefore, for some places that need strict confidentiality, the network is often cut off and the USB device is disabled to cut off the possible transmission information path of the Trojan virus.

[0005] However, the above paths do not focus on the fact that confidential data or private information may be leaked through the loudspeaker of the device in the form of ultrasonic waves, and no effective detection method has been proposed for such Trojan viruses. SUMMARY

[0006] In view of the defects and improvement needs of the prior art, the present application provides a Trojan virus detection device and method, which can timely discover Trojan viruses that steal information stored in a to-be-detected device by controlling the loudspeaker of the to-be-detected device to emit ultrasonic signals.

[0007] To achieve the above purpose, on the one hand, the present application provides a Trojan virus detection device, the Trojan virus is used for controlling the loudspeaker of the to-be-detected device to emit ultrasonic signals, and the device comprises:

[0008] A signal acquisition module is configured to acquire the ultrasonic signals.

[0009] A signal processing module is configured to perform filtering and amplification processing on the ultrasonic signals.

[0010] A decoding module is configured to decode the processed ultrasonic signals to obtain corresponding frequency spectrum information.

[0011] An analysis module is configured to analyze the frequency spectrum information. If the signal peak values all exceed a preset threshold value within a preset sampling period, it is determined that the to-be-detected device is invaded by the Trojan virus.

[0012] Further, the decoding module comprises:

[0013] a phase-locked loop submodule for extracting frequency band information of the processed ultrasonic signal;

[0014] an envelope detection submodule for extracting amplitude information of the processed ultrasonic signal.

[0015] Further, the phase-locked loop submodule comprises a resistor and a capacitor and two audio phase-locked loops, the resistor and the capacitor are used to configure the center frequency and the bandwidth of the audio phase-locked loops, and the working frequency bands of the two audio phase-locked loops are 16 kHz to 19 kHz and 19 kHz to 22 kHz respectively.

[0016] Further, the signal acquisition module is an electret microphone array composed of a plurality of ultrasonic electret microphones.

[0017] Further, the electret microphone array comprises 7 electret microphones arranged in a hexagonal and central arrangement in a radial symmetry.

[0018] Further, the analysis module is further used to substitute the amplitude information corresponding to the electret microphones on the same straight line into a square inverse ratio formula to obtain a projection position of a sound source on the straight line, and to sum the projection position vectors calculated on a plurality of straight lines and estimate the direction of the sound source according to the sum result.

[0019] On the other hand, the present application provides a Trojan virus detection method, the Trojan virus is used to control the loudspeaker of the to-be-detected device to emit an ultrasonic signal, and the method comprises:

[0020] acquiring the ultrasonic signal and performing filtering and amplification processing on the acquired ultrasonic signal;

[0021] decoding the processed ultrasonic signal to obtain corresponding frequency spectrum information;

[0022] analyzing the frequency spectrum information, and if the signal peak values all exceed a preset threshold value within a preset sampling period, determining that the to-be-detected device is invaded by the Trojan virus.

[0023] Further, after determining that the to-be-detected device is invaded by the Trojan virus, the method further comprises:

[0024] substituting the amplitude information corresponding to the electret microphones on the same straight line into a square inverse ratio formula to obtain a projection position of a sound source on the straight line, and summing the projection position vectors calculated on a plurality of straight lines and estimating the direction of the sound source according to the sum result.

[0025] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0026] (1) The present invention is the first to discover that a Trojan virus may steal information by controlling a computer speaker to emit ultrasonic signals. Based on this discovery, a Trojan virus detection device and method are proposed. The method collects ultrasonic signals emitted by a computer speaker, filters them, and amplifies them. The processed ultrasonic signals are decoded to obtain corresponding spectrum information, which is then further analyzed. If the signal peaks exceed a preset threshold within a preset sampling period, the device to be detected is determined to be invaded by a Trojan virus. Thus, the present invention can effectively detect Trojan viruses that steal information stored in the device to be detected by controlling the speaker of the device to be detected to emit ultrasonic signals, thereby facilitating the maintenance of the device's information security.

[0027] (2) The present invention utilizes an audio phase-locked loop chip to extract the frequency band information of the ultrasonic signal and utilizes an envelope detector to extract the amplitude information of the ultrasonic signal, which can greatly reduce the workload of the processor. Therefore, only a device with slow processing speed and poor computing power, such as a single-chip microcomputer, is needed to complete the detection of Trojan viruses, thereby reducing the detection cost.

[0028] (3) The present invention obtains the amplitude information matrix of the ultrasonic signal after performing envelope detection processing on the ultrasonic information collected by the electret microphone array. By utilizing the attenuation law of the sound signal propagating in the air (the loudness of the sound is inversely proportional to the square of the distance), the amplitude values ​​collected by the electret microphones on the same straight line are combined and substituted into the inverse square formula. The projection position of the sound source on this straight line can be calculated. This result is regarded as a vector. By summing the result vectors calculated on multiple straight lines, the approximate direction of the sound source can be calculated, thereby determining where the data leakage occurred.

[0029] (4) After collecting the ultrasonic signal, the Trojan virus detection device provided by the present invention will determine the location of the leakage after a millisecond delay, and the positioning direction accuracy is about 1 degree in angle.

[0030] (5) The present invention uses an audio phase-locked loop to detect the corresponding band signal, which can achieve data decoding at a higher baud rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A structural block diagram of a Trojan virus detection device provided by an embodiment of the present invention;

[0032] Figure 2 A working principle diagram of a signal acquisition module provided in an embodiment of the present invention;

[0033] Figure 3 A diagram showing the working principle of a signal processing module according to an embodiment of the present invention;

[0034] Figure 4 The working principle diagram of the phase-locked loop sub-module provided for the embodiment of the application is shown in the figure;

[0035] Figure 5 The working principle diagram of the envelope detection sub-module provided for the embodiment of the application is shown in the figure;

[0036] Figure 6 The working principle diagram of the analysis module provided for the embodiment of the application is shown in the figure;

[0037] Figure 7 The working principle diagram of the voltage adaptation module provided for the embodiment of the application is shown in the figure. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the application clearer, the application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the application and do not limit the application. In addition, the technical features involved in each embodiment of the application described below can be combined with each other as long as they do not conflict with each other.

[0039] In the application, the terms "first", "second", etc. (if any) in the application and the drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0040] It should be noted that the ultrasonic wave is beyond the range that can be distinguished by human ears, but it is still within the frequency range of the loudspeaker sound. During the ultrasonic wave emission process, it will not be affected by electromagnetic shielding, so there is a possibility of implanting a Trojan virus that controls the loudspeaker of the terminal device to emit ultrasonic signals to steal information.

[0041] In the application, the Trojan virus specifically refers to a Trojan virus used to control the loudspeaker of the device to be detected to emit ultrasonic signals. The eavesdropper or attacker can make the Trojan virus by reading the host file, generating an audio file, and calling the system loudspeaker to output the audio in the ultrasonic frequency band.

[0042] Figure 1 The structural block diagram of the Trojan virus detection device provided for the embodiment of the application is shown in the figure. Figure 1 The Trojan virus detection device in the embodiment is described in detail. The detection device comprises:

[0043] The signal acquisition module is used to acquire the ultrasonic signal.

[0044] The signal processing module is used to filter and amplify the ultrasonic signal.

[0045] The decoding module is used to decode the processed ultrasonic signal to obtain the corresponding frequency spectrum information.

[0046] The analysis module is used to analyze the spectrum information, and if the signal peak values ​​all exceed a preset threshold value within a preset sampling period, it is determined that the device to be detected is invaded by the Trojan virus.

[0047] Furthermore, the decoding module includes: a phase-locked loop submodule for extracting frequency band information of the processed ultrasonic signal; and an envelope detection submodule for extracting amplitude information of the processed ultrasonic signal.

[0048] The following is a detailed description of the functions of each module.

[0049] See Figure 2 The signal acquisition module is an electret pickup array composed of multiple ultrasonic electret pickups. These pickups are scattered in multiple locations on the hardware board. Their main function is to receive ultrasonic signals. Since sound is attenuated when it propagates in the air, the ultrasonic signal transmitted from a certain direction will have different amplitudes when collected by each pickup. By using the difference in amplitude and performing calculations, we can roughly determine the direction from which the ultrasonic wave is transmitted, and then determine which device has experienced information leakage.

[0050] Specifically, the electret pickup in this embodiment utilizes an ultra-high frequency microphone with a bandwidth of 47MHz. The present invention employs a single-supply input and output rail-to-rail operational amplifier, the OPA343, as a buffer to provide impedance balancing. This design reduces interference between the upstream and downstream circuits. A 10kΩ pull-up resistor ensures a static bias of approximately 2V for the electret, within the buffer power rail. The electret pickup utilizes seven channels of audio capture, arranged in a hexagonal, radially symmetrical pattern with a 5cm spacing between adjacent pickups.

[0051] See Figure 3 In this embodiment, the signal processing module consists of a signal filtering section and a signal amplification section. The signal filtering utilizes a high-pass filter to remove low-frequency human voice interference, preventing ultrasonic distortion caused by human voice interference, and preventing the high-frequency signal from being overwhelmed by the amplified high-frequency signal due to excessive human voice amplitude. A precision operational amplifier is used for signal amplification. Because the ultrasonic waves emitted by computer sound cards are often small in amplitude, directly using the collected ultrasonic waves can lead to large errors and phase-locked loop (PLL) loss of lock. Therefore, after filtering, the signal is amplified by over 200 times, achieving a peak-to-peak value of 200mV.

[0052] Specifically, the passive filter uses an 8th-order LC Butterworth high-pass filter with a cutoff frequency of 10kHz and an attenuation of less than -40dB within the stopband. The filter inductor is 330uH, the capacitor is 220μF, and the input and output impedance is 50Ω. The ramp-down type results in a -3dB attenuation within the passband. The adder uses an OPA343 rail-to-rail input and output op amp, powered by a single 5V supply. A 2.5V DC bias is added to the zero-bias signal from the preceding stage for processing by the subsequent phase-locked loop and envelope detection. The amplifier consists of four cascaded TLV2374 dual-supply input and output rail-to-rail general-purpose operational amplifiers. The single-pole gain is set to 6x, resulting in a total gain of approximately 1300x. Input signals below 5mV can be amplified to approximately 4V. The parameters and amplification factor can be modified based on actual performance.

[0053] See Figure 4 The phase-locked loop (PLL) submodule consists of an audio PLL integrated chip, resistors, and capacitors. The resistors and capacitors are used to configure the center frequency and bandwidth of the audio PLL. When the PLL successfully locks to the phase and captures the ultrasonic signal of the corresponding band, the audio PLL outputs a low level and passes this information to the analysis module. When the PLL loses lock, indicating that the received sound signal does not contain the component of the corresponding band, the audio PLL outputs a high level and similarly passes this information to the analysis module. The PLL submodule is configured with two PLLs with different parameters to decode different ultrasonic bands and thus identify different "0" and "1" information.

[0054] Specifically, the phase-locked loop (PLL) uses an LM567 audio PLL decoder. The center frequencies of the two frequency channels are determined by the RC parameters of the local oscillator, and the bandwidth is determined by the product of the center frequency and the capacitance at pin 2. When the phase is matched, meaning the frequency is within the passband, pin 8 outputs a low level. A 10kΩ pull-up resistor is used for pin 8.

[0055] See Figure 5 The envelope detector module consists of an operational amplifier, resistors, and capacitors. It converts the information amplified by the signal processing module into an envelope signal, ultimately maintaining a relatively stable voltage value. This converts the AC signal into an amplitude signal. After converting the signal into amplitude information, the calculation unit can measure the direction of the signal by comparing the signal amplitude collected by the electret pickup array.

[0056] Specifically, the envelope detector module consists of an OPA2343 and a 1N4148. A low-pass filter with a 100Hz cutoff frequency is added to remove ripple, thereby generating a stable DC level that reflects the signal peak. For a 22kHz, 4V peak-to-peak AC signal envelope, the resulting signal ripple is 800μV peak-to-peak.

[0057] See Figure 6The analysis module is composed of a high-performance master control chip supporting encryption function. The master control chip needs to analyze the amplitude information transmitted by each electret microphone and the frequency band information transmitted by the audio phase-locked loop. On the basis of obtaining these information, the position of the ultrasonic wave can be calculated, and the level sequence transmitted by the audio phase-locked loop can be analyzed to try to decipher the information carried by the ultrasonic wave. At the same time, the analysis module also has the function of communicating with the upper computer to warn the upper computer of the current information leakage situation, and if there is leakage, the direction information of the leakage is also sent.

[0058] Specifically, if the signal peak value exceeds the preset threshold value in a preset number of sampling periods, it is determined that the device to be detected is invaded by a Trojan virus. For example, 8 sampling periods are set as the judgment period, and the preset threshold value is 200mV. If the peak value of the processed signal exceeds 200mV in 8 sampling periods, it is determined that there is a Trojan virus, and the corresponding amplitude frequency information is recorded.

[0059] After determining that the device to be detected is invaded by a Trojan virus, the amplitude information matrix of the ultrasonic signal is obtained by performing envelope detection processing on the ultrasonic information collected by the electret microphone array. By using the attenuation law of sound signal propagation in air (sound loudness is inversely proportional to the square of distance), the amplitude values collected by the electret microphones on the same straight line are substituted into the inverse square law formula, the projection position of the sound source on the straight line can be calculated. This result is regarded as a vector, and the result vectors calculated on multiple straight lines are summed up, so that the approximate direction of the sound source can be calculated, and it can be judged where the data leakage occurs.

[0060] Taking the case that seven audio signals are collected by the electret, the arrangement mode is hexagonal and center arrangement, and the radial symmetry is formed, three longest diagonal lines of the hexagon are taken, each diagonal line contains three electret microphones, and the amplitude information corresponding to the three electret microphones is substituted into the inverse square law formula, so that the position vector in the direction of the three connecting lines can be calculated. The direction information of the sound source can be obtained by adding the three vectors.

[0061] In addition, the Trojan virus detection device provided by the present application also comprises a voltage adaptation module.

[0062] Referring to Figure 7The voltage adapter module consists of a linear regulator, a boost circuit, a buck circuit, a voltage divider resistor, and auxiliary circuits. Each chip in the circuit has a different supply voltage and voltage level standard. The linear regulator stabilizes the 5V USB-powered voltage to 3.3V to power the MCU. The boost circuit and buck circuit provide positive and negative power for the analog circuits. The linear regulator provides a stable power supply for the analog devices. The voltage divider resistor converts the 5V voltage level to a 3.3V level for safe and normal MCU identification. Furthermore, the voltage divider resistor reduces the amplitude information to a voltage range that the MCU's IO interface can tolerate, maintaining a certain level of measurement accuracy while ensuring circuit stability and preventing damage to the MCU's on-chip ADC. The auxiliary circuit includes a reference voltage chip, which pulls up the original signal to bring it within the range that the operational amplifier can handle.

[0063] Specifically, in this embodiment, the boost circuit: The present invention adopts a single USB power supply of 5V, but the power supply differences between different devices and the ripple-coupled power supply will cause strong interference to signal amplification and bootstrap stability. Therefore, the present invention adopts a composite power supply system. The boost is composed of a boost chip sx1308 and an integrally molded inductor and capacitor. It is boosted from 5V to 12V for use by the subsequent buck circuit to step down the voltage. Buck step-down circuit: The power supply in the system adopts ±5V power supply. The Buck circuit steps down 12V to ±7V and is composed of a DCDC chip TPS5450, an integrally molded inductor and a decoupling capacitor. The large Buck output ripple can be improved by adjusting the decoupling capacitor parameters or handed over to the lower-level LDO for processing. LDO voltage regulator module: In order to obtain a stable ±5V power supply, the present invention adopts LDO low-voltage linear voltage regulators TPS7A3001 and TPS7A4901. TTL to USB module: The present invention uses serial port transmission and reception to communicate with the host computer, which requires a TTL to USB module, using CH340G. Auxiliary circuit part: It consists of decoupling capacitors, voltage divider network, and impedance matching network. These auxiliary capacitors are selected according to the data sheet of the integrated circuit. They have fixed parameters and connection methods and are used for analog signal calibration and voltage stabilization functions without affecting the product design.

[0064] To sum up, with the module as the basic unit, the workflow of the Trojan virus detection device in a normal information leakage detection scenario is as follows: the device starts working after power-on. The system is powered by the 5V voltage of USB. First, the power supply generates 3.3V, 2.5V and stable ±5V voltages through the voltage adapter module. The 3.3V voltage is used to power the MCU of the subsequent stage, and the 2.5V voltage is used to add a DC bias to the original sound signal so that the subsequent stage can amplify it normally. Then, the signal is filtered and amplified by the signal processing module. The amplified signal is transmitted to the phase-locked loop sub-module and the envelope detection sub-module respectively. The phase-locked loop sub-module extracts and detects the signal of the corresponding frequency band, and the envelope detection sub-module outputs the amplitude information of the ultrasonic wave. The analysis module receives the information processed by the phase-locked loop sub-module and the envelope detection sub-module, performs calculations and decoding, calculates the approximate direction of the leakage, and realizes the decoding of the ultrasonic signal sequence, and transmits the two information to the host computer. Before normal use, you should ensure that the Trojan virus detection device is successfully connected to the host computer to prevent the host computer from being unable to receive the signal transmitted by the Trojan virus detection device.

[0065] In a preferred embodiment of the present invention, the main control chip IC1 utilizes the STM32F103C8T6, a 48-pin LQFP packaged main control chip. An on-chip ADC is used for the analog-to-digital converter. Seven audio signals are processed and recognized by the on-chip ADC and GPIO, respectively, via a signal processing module and an audio phase-locked loop. The electrical interface between the present invention and the host computer utilizes a TYPE_C interface.

[0066] Type-C connector J1 leads to two pairs of wires, one of which is a differential signal line connected to the high-performance main control chip IC1. The anode of J1's power line is connected to the anode of a diode and to one end of a voltage divider resistor R2, while the cathode is grounded. The anode of the power line provides +5V power to the entire system, stepping down the 3V3 LDO and boosting the boost. The USB differential line of the interface is connected to the CH340G, responsible for TTL level conversion to USB, thus enabling communication with the host computer.

[0067] The main control chip IC1 mainly performs four operations: an ADC sampling part, a GPIO level query part, a sleep wake-up part, and an algorithm fitting part. The ADC sampling part is responsible for controlling the analog-to-digital conversion of the main control chip IC1 and seven audio envelopes. The GPIO level query part is responsible for receiving the decoding output of the audio phase-locked loop and decoding the audio information. The sleep wake-up part is connected to the comparator high-level trigger, and controls the sleep and wake-up of the system according to the level of the signal line detect. If the level is low for several cycles, the system enters sleep mode. If a high level is received, an external interrupt is triggered to wake up. The algorithm fitting part calculates the approximate characteristics of the sound source through mathematical equations and MATLAB fitting based on the high level received by the seven ADCs, and obtains more accurate coordinate values based on the gradient descent algorithm.

[0068] In terms of overall design, an alternative of the above embodiment also includes the use of a Zynq7z020 chip of Xilinx Company and an AD9240 chip of ADI Company. A hardware 1024-point FFT is performed through full-band acquisition of a high-speed clock and a high-speed ADC to obtain full-spectrum information. The speaker signal characteristics of each different PC are directly obtained by analyzing the full-spectrum information, thereby realizing the positioning of the sound color. The FFT can directly obtain the peak value information of 15k to 19kHz and 19k to 22kHz. The digital information represented by the signal is analyzed from the spectral peak value, and the sound source distance is fitted.

[0069] In terms of sound source positioning, the invention selects an electret microphone array as the acquisition module. The electret array can be split into multiple device measurements. A four-point sensor design can be positioned by measuring time difference, or by measuring phase and amplitude, and gradient descent fitting is performed to obtain the sound source coordinates. In addition, the phase measurement can be used to fit the sound source position. The signals processed by different microphones are multiplied by the diagonal microphone, and then a low-pass filter is used to obtain a direct current signal containing the amplitude and phase information of the two sound sources. The cosine value of the phase is calculated by measuring the amplitude of the diagonal signal. The sound source information can be fitted by the phase difference and amplitude signal.

[0070] Those skilled in the art will readily understand that the above description is only the preferred embodiment of the present application, and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A Trojan virus detection device, characterized in that: The Trojan virus is used to control the speaker of the device to be detected to emit an ultrasonic signal. The device includes: A signal acquisition module, comprising an electret pickup array composed of a plurality of ultrasonic electret pickups, for acquiring the ultrasonic signal; A signal processing module, configured to filter and amplify the ultrasonic signal; A decoding module is used to decode the processed ultrasonic signal to obtain corresponding spectrum information; An analysis module is configured to analyze the spectrum information. If signal peaks exceed a preset threshold within a preset sampling period, it is determined that the device to be detected has been invaded by the Trojan virus. The electret pickup array includes seven electret pickups arranged in a hexagonal pattern with the center in radial symmetry. The three longest diagonals of the hexagon are taken, each containing three electret pickups. The amplitude information corresponding to these three electret pickups is substituted into an inverse square formula to obtain the projected position of the sound source on the diagonal. The projected position vectors calculated on the three diagonals are summed, and the direction of the sound source is estimated based on the summed result.

2. The Trojan virus detection device according to claim 1, wherein: The decoding module includes: a phase-locked loop submodule, configured to extract frequency band information of the processed ultrasonic signal; The envelope detection submodule is used to extract amplitude information of the processed ultrasonic signal.

3. The Trojan virus detection device according to claim 2, wherein: The phase-locked loop submodule includes resistors and capacitors and two audio phase-locked loops. The resistors and capacitors are used to configure the center frequency and bandwidth of the audio phase-locked loops. The operating frequency bands of the two audio phase-locked loops are 16kHz to 19kHz and 19kHz to 22kHz respectively.

4. A Trojan virus detection method, characterized in that: The Trojan virus is used to control the speaker of the device to be detected to transmit an ultrasonic signal. The method includes: The ultrasonic signal is collected by an electret pickup array composed of multiple ultrasonic electret pickups, and the collected ultrasonic signal is filtered and amplified; Decoding the processed ultrasonic signal to obtain corresponding spectrum information; The spectrum information is analyzed. If the signal peaks exceed a preset threshold within a preset sampling period, it is determined that the device to be detected has been invaded by the Trojan virus. The electret pickup array includes 7 electret pickups, which are arranged in a hexagonal and radially symmetrical manner. The three longest diagonals of the hexagon are taken, and each diagonal contains three electret pickups. The amplitude information corresponding to these three electret pickups is substituted into an inverse square formula to obtain the projected position of the sound source on the diagonal. The projected position vectors calculated on the three diagonals are summed, and the direction of the sound source is estimated based on the summation result.

Images