Wireless device monitoring system and wireless device monitoring method

Abstract

The wireless device monitoring system includes a plurality of wireless signal receivers and a processing server. The plurality of wireless signal receivers are configured in the area and are used to collect a plurality of probe requests sent by the plurality of wireless devices during the period. In response to determining that the media access control address of each of the plurality of first probe requests among the plurality of probe requests is virtual, the processing server is further used to establish a flow network corresponding to the plurality of first probe requests based on the first information corresponding to the plurality of first probe requests and an associated calculation model, wherein the processing server is further used to group the plurality of first probe requests into a plurality of first probe request sequences corresponding to the plurality of wireless devices based on the flow network through a minimum cost maximum flow method, thereby effectively monitoring the total number and trajectory of the plurality of wireless devices in the area and improving the efficiency of security management and monitoring work.

Description

Technical Field

[0001] The present invention generally relates to a device monitoring system, and more specifically, to a wireless device monitoring system and a wireless device monitoring method for monitoring the total number and movement tracks of multiple wireless devices in a region. Background Art

[0002] Generally speaking, before establishing a wireless network, a wireless device (e.g., a device that uses Wi-Fi technology to access the Internet wirelessly, hereinafter referred to as a Wi-Fi device) will broadcast a probe request frame (hereinafter referred to as a probe request) so that other devices using Wi-Fi technology near the Wi-Fi device (e.g., relay stations, routers, or other wireless devices) can receive the broadcasted probe request and perform the operation of establishing a connection. The broadcasted probe request will at least carry information about the Media Access Control (MAC) address so that other devices that receive the probe request can identify the wireless device that sent the probe request by identifying the MAC address as the corresponding unique identifier. In this way, the wireless device can also be monitored / tracked because of the probe request it sends.

[0003] In recent years, as privacy has gradually gained attention, wireless device manufacturers or software / firmware service providers have provided media access control address randomization technology, so that wireless devices can randomly generate different virtual media access control addresses over time to replace the original physical media access control addresses (also known as real media access control addresses), thereby making the media access control addresses carried by the probe request confidential. Since the media access control addresses carried by the probe request are randomly generated over time after the media access control address randomization, other devices that receive the probe request can no longer directly track / confirm the wireless device by identifying the media access control address in the probe request, thereby protecting the privacy of the wireless device that sends the probe request.

[0004] However, for security management and other needs, it is often necessary to monitor the total number of wireless devices in an area and / or their movement trajectories / paths. Therefore, how to effectively monitor / track wireless devices using MAC address randomization technology while protecting privacy has become a goal that researchers in this field are committed to studying. Summary of the invention

[0005] One aspect of the present invention provides a wireless device monitoring system for monitoring different wireless devices in an area. The wireless device monitoring system includes a plurality of wireless signal receivers and a processing server. The plurality of wireless signal receivers are configured in the area and are used to collect a plurality of probe requests sent by the plurality of wireless devices during the period. In addition, the plurality of wireless signal receivers are connected to the processing server via a network connection. The processing server is used to receive the plurality of probe requests from the plurality of wireless signal receivers via the network connection, wherein the processing server is further used to determine whether the media access control address of each of the plurality of probe requests is virtual. In response to determining that the media access control addresses of each of the plurality of first probe requests among the plurality of probe requests are virtual, the processing server is further configured to establish a flow network corresponding to the plurality of first probe requests according to the first information corresponding to the plurality of first probe requests and an associated calculation model, wherein the processing server is further configured to group the plurality of first probe requests into a plurality of first probe request sequences according to the flow network through a minimum cost maximum flow method, wherein the plurality of first probe request sequences are determined to correspond to a plurality of first wireless devices among the plurality of wireless devices, respectively, and all first probe requests included in each of the plurality of first probe request sequences are determined to be sent by the same corresponding first wireless device during the period. On the other hand, in response to determining that the media access control addresses of each of the plurality of second probe requests among the plurality of probe requests are not virtual, the processing server is further configured to identify a plurality of second wireless devices among the plurality of wireless devices corresponding to the plurality of second probe requests, wherein the processing server is further configured to train the associated calculation model according to the plurality of second probe requests.

[0006] In an embodiment of the present invention, the first information includes: a media access control address; an information element; a sequence number; a signal strength; and a transmission time.

[0007] In one embodiment of the present invention, in the operation of determining whether the media access control address of each of the multiple probe requests is virtual, the processing server determines whether the media access control address of each probe request is virtual by identifying an identification bit value of the media access control address of each probe request, wherein when the identification bit value is identified as 0, the processing server determines that the media access control address of the corresponding probe request is not virtual, and when the identification bit value is identified as 1, the processing server determines that the media access control address of the corresponding probe request is virtual.

[0008] In one embodiment of the present invention, the processing server includes: a communication circuit unit, a storage unit and a processor. The communication circuit unit is used to establish the network connection connected to the multiple wireless signal receivers. The storage unit stores multiple program modules. The multiple program modules include an association calculation module and a contact decision module. The processor is used to access and execute the association calculation module and the contact decision module, wherein in the operation of the processing server to establish the flow network corresponding to the multiple first detection requests according to the first information corresponding to the multiple first detection requests and the association calculation model, the association calculation module inputs the first information to the association calculation model to calculate the multiple association probabilities of each of the multiple pairs of first detection requests in the multiple first detection requests, wherein the contact decision module maps the multiple first detection requests to multiple nodes in the flow network and sets multiple paths between multiple pairs of nodes corresponding to the multiple pairs of first detection requests respectively, so as to establish the flow network, wherein the flow cost of each of the multiple paths is set by the multiple association probabilities of each of the corresponding multiple pairs of first detection requests. In addition, in the operation in which the processing server is further used to group the multiple first probe requests into the multiple first probe request sequences according to the flow network via the minimum cost maximum flow method, the connection decision module determines the multiple flows within the flow network and one or more flow paths passed by the multiple flows via the minimum cost maximum flow method, wherein the connection decision module groups the multiple first probe requests corresponding to the multiple nodes included in each of the one or more flow paths into a corresponding first probe request sequence.

[0009] In one embodiment of the present invention, in an operation in which the processing server is further used to identify the multiple second wireless devices corresponding to the multiple second probe requests among the multiple wireless devices, the processing server identifies the media access control address of each of the multiple second probe requests as a real media access control address, and identifies each of the different multiple real media access control addresses of the multiple second probe requests as a unique identifier of one of the multiple second wireless devices among the multiple wireless devices, thereby identifying the multiple second wireless devices that respond to the multiple second probe requests. In addition, in the operation in which the processing server is further used to train the association calculation model according to the multiple second probe requests, the processing server groups the multiple second probe requests into multiple second probe request sequences corresponding to the multiple second wireless devices respectively according to the different multiple real media access control addresses, wherein the multiple real media access control addresses of the multiple second probe requests included in each second probe request sequence in the multiple second probe request sequences are the same, wherein the processing server determines that the multiple second probe requests included in each second probe request sequence in the multiple second probe request sequences are sequentially associated over time and are sent by the corresponding second wireless device within the period, wherein the second association probabilities of each of the multiple pairs of second probe requests in the multiple second probe requests have been determined by the processing server according to the multiple second probe request sequences, wherein the processing server inputs the second information corresponding to the multiple second probe requests, the second association probabilities of each of the multiple pairs of second probe requests in the multiple second probe requests, and the multiple second probe request sequences into the association calculation model to train the association calculation model.

[0010] In one embodiment of the present invention, the processing server monitors the total number of the first wireless devices in the area during the period by calculating the sum of the multiple first wireless devices, wherein the processing server identifies the movement trajectories of each of the multiple first wireless devices in the area during the period based on the multiple first probe request sequences.

[0011] One aspect of the present invention provides a wireless device monitoring method for monitoring multiple different wireless devices in a monitoring area. The method includes: receiving multiple probe requests sent by the multiple wireless devices during a period; determining whether the media access control address of each of the multiple probe requests is virtual; in response to determining that the media access control address of each of the multiple first probe requests in the multiple probe requests is virtual, establishing a flow network corresponding to the multiple first probe requests according to first information corresponding to the multiple first probe requests and an associated calculation model; and according to the flow network, grouping the multiple first probe requests into multiple first probe request sequences through a minimum cost maximum flow method, wherein the multiple first probe request sequences are determined to correspond to multiple first wireless devices in the multiple wireless devices, respectively, and all first probe requests included in each of the multiple first probe request sequences are determined to be sent by the same corresponding first wireless device during the period. In addition, in response to determining that the media access control address of each of the multiple second probe requests in the multiple probe requests is not virtual, identifying multiple second wireless devices in the multiple wireless devices corresponding to the multiple second probe requests; and training the associated calculation model according to the multiple second probe requests.

[0012] In one embodiment of the present invention, the step of determining whether the media access control address of each of the multiple probe requests is virtual includes: determining whether the media access control address of each probe request is virtual by identifying an identification bit value of the media access control address of each probe request, wherein when the identification bit value is identified as 0, it is determined that the media access control address of the corresponding probe request is not virtual, and when the identification bit value is identified as 1, it is determined that the media access control address of the corresponding probe request is virtual.

[0013] In one embodiment of the present invention, the step of establishing the flow network corresponding to the plurality of first probe requests according to the first information corresponding to the plurality of first probe requests and the association calculation model includes: inputting the first information to the association calculation model to calculate the various first association probabilities of each of the plurality of pairs of first probe requests in the plurality of first probe requests; and establishing the flow network by mapping the plurality of first probe requests to the plurality of nodes in the flow network and setting the plurality of paths between the plurality of pairs of nodes corresponding to the plurality of pairs of first probe requests, wherein the flow costs of the plurality of paths are set by the various association probabilities of each of the plurality of pairs of first probe requests. In addition, according to the flow network, the step of grouping the plurality of first probe requests into the plurality of first probe request sequences by the minimum cost maximum flow method includes: determining the plurality of flows in the flow network and one or more flow paths passed by the plurality of flows by the minimum cost maximum flow method; and grouping the plurality of first probe requests corresponding to the plurality of nodes contained in each of the one or more flow paths into a corresponding first probe request sequence.

[0014] In one embodiment of the present invention, the step of identifying the multiple second wireless devices corresponding to the multiple second probe requests among the multiple wireless devices includes: identifying the media access control address of each of the multiple second probe requests as a real media access control address, and identifying each of the different multiple real media access control addresses of the multiple second probe requests as a unique identifier of one of the multiple second wireless devices among the multiple wireless devices, thereby identifying the multiple second wireless devices responding to the multiple second probe requests. In addition, the step of training the association calculation model according to the multiple second probe requests includes: grouping the multiple second probe requests into multiple second probe request sequences corresponding to the multiple second wireless devices respectively according to the different multiple real media access control addresses, wherein the multiple real media access control addresses of the multiple second probe requests included in each second probe request sequence in the multiple second probe request sequences are the same; determining that the multiple second probe requests included in each second probe request sequence in the multiple second probe request sequences are sequentially associated over time and are sent by the corresponding second wireless device during the period, wherein the multiple second association probabilities of each of the multiple pairs of second probe requests in the multiple second probe requests have been determined according to the multiple second probe request sequences; and inputting the second information corresponding to the multiple second probe requests, the multiple second association probabilities of each of the multiple pairs of second probe requests in the multiple second probe requests, and the multiple second probe request sequences into the association calculation model to train the association calculation model.

[0015] In one embodiment of the present invention, the method further includes: monitoring the total number of the first wireless devices in the area during the period by calculating the sum of the multiple first wireless devices; and identifying the movement trajectories of each of the multiple first wireless devices in the area during the period based on the multiple first probe request sequences.

[0016] Based on the above, the wireless device monitoring system and the wireless device monitoring method provided by the embodiments of the present invention can utilize existing wireless base stations, relay stations, and routers as wireless signal receivers for collecting probe requests without additionally configuring auxiliary devices of special specifications, thereby saving the construction cost of the monitoring system. In addition, the provided wireless device monitoring system and the wireless device monitoring method can establish a corresponding flow network model based on the information of the received multiple probe requests while protecting privacy without pushing back the real media access control address, and optimize the established flow network model with the minimum cost and maximum flow, so as to group the multiple probe requests into the probe request sequence corresponding to the multiple wireless devices, thereby effectively monitoring the total number and trajectory of the multiple wireless devices in the area, and improving the efficiency of security management and monitoring work.

[0017] In order to make the above features and advantages of the present invention more clearly understood, embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] When read in conjunction with the accompanying drawings, various aspects of the present disclosure can be easily understood from the following detailed description. It should be noted that the various features may not be drawn to scale. In fact, the size of the various features may be arbitrarily increased or decreased for ease of discussion.

[0019] The following drawings are used to describe the embodiments of the present invention in more detail, wherein:

[0020] Figure 1 A schematic diagram of a media access control address being changed via a media access control address randomization technique.

[0021] Figure 2A and Figure 2B Randomizing the MAC address may result in an erroneous schematic diagram when the operation of simply using the MAC address carried in the probe request to monitor the movement trajectory of the wireless device is performed.

[0022] Figure 3 It is a schematic diagram of a wireless signal receiver receiving a probe request broadcasted by a wireless device according to an embodiment of the present invention.

[0023] Figure 4FIG. 4 is a block diagram of a wireless device monitoring system according to an embodiment of the present invention.

[0024] Figure 5 FIG. 4 is a flow chart of a wireless device monitoring method according to an embodiment of the present invention.

[0025] Fig. 6A According to an embodiment of the present invention, Figure 5 Flow chart of step S530.

[0026] Figure 6B According to an embodiment of the present invention, Figure 5 Flow chart of step S540.

[0027] Figure 7 FIG. 4 is a schematic diagram of different media access control addresses carried by multiple probe requests in multiple probe request rounds according to an embodiment of the present invention.

[0028] Figure 8A to Figure 8F FIG. 1 is a schematic diagram of a flow network established in response to a plurality of received probe requests according to an embodiment of the present invention.

[0029] Figure 8G It is a schematic diagram illustrating determining multiple flows and corresponding flow paths in a flow network through a minimum cost maximum flow method according to an embodiment of the present invention so as to group multiple probe requests into a probe request sequence.

[0030] Figure 8H It is a schematic diagram illustrating identifying a corresponding wireless device and its moving trajectory according to a flow path determined in a flow network and a corresponding probe request sequence according to an embodiment of the present invention.

[0031] Fig.9A It is a schematic diagram illustrating determining multiple flows and corresponding flow paths in a flow network through a minimum cost maximum flow method according to another embodiment of the present invention so as to group multiple probe requests into a probe request sequence.

[0032] Fig. 9B It is a schematic diagram illustrating identifying a corresponding wireless device and its moving trajectory according to a flow path determined in a flow network and a corresponding probe request sequence according to another embodiment of the present invention.

[0033] Fig.10 FIG. 1 is a performance comparison diagram of the present embodiment and a plurality of prior arts according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In the following description, the methods and apparatus used in the wireless device monitoring system and the wireless device monitoring method and the like are described as preferred examples. It will be apparent to those skilled in the art that modifications, including additions and / or substitutions, may be made without departing from the scope and spirit of the invention. In order to avoid obscuring the invention, some specific details are omitted. However, the present disclosure is written to enable those skilled in the art to practice the teachings of the present disclosure herein without undue experimentation.

[0035] Media Access Control (MAC) address (also called, media access control address). Other names include local area network address, Ethernet address or physical address. This media access control address is divided into two parts. The first three groups of numbers are the manufacturer ID; the last three groups of numbers are the card number of the network card of the network device. In theory, no two network cards in the world have the same MAC address. Because of this feature, the physical / real media access control address can often be used as a unique identifier (Unique Identifier, UID) of a network device. The so-called media access control address randomization technology will generate a set of random virtual media access control addresses at irregular time intervals, so that the wireless device can use the generated virtual media access control address instead of the original physical / real media access control address when communicating with the outside world (such as broadcasting a probe request or making a network connection). In this way, the real media access control address of the wireless device itself can be prevented from being known to the outside world, so that the outside world cannot identify the real identity of the wireless device, thereby protecting the privacy of the wireless device itself.

[0036] Figure 1 This is a diagram showing how the media access control address is changed through the media access control address randomization technique. Figure 1 , assuming that user U1 carries wireless device WD1, and user U2 carries wireless device WD2. The wireless device WD1 uses the media access control address randomization technology, and the wireless device WD2 does not use the media access control address randomization technology. Figure 1As shown, when user U1 moves, at different time points T1, T2, T3, and T4, the media access control addresses monitored by the wireless device WD1 are virtual media access control addresses VMAC1, VMAC2, VMAC3, and VMAC4 (e.g., by parsing the sent probe request); when user U2 moves, at different time points T1, T2, T3, and T4, the media access control addresses monitored by the wireless device WD2 are all real media access control addresses RMAC1. In other words, by using the media access control address randomization technology, in addition to the real media access control address of the wireless device WD1 itself not being monitored, the movement trajectory of the wireless device WD1 (user U1) is also difficult to obtain from the monitored virtual media access control addresses VMAC1, VMAC2, VMAC3, and VMAC4. On the contrary, for the wireless device WD2 that does not use the media access control address randomization technology, its own real media access control address can be monitored, and the movement trajectory of the wireless device WD2 (user U2) can be confirmed by identifying the moving position of the real media access control address. For a monitoring system used to monitor wireless devices in an area, since it is impossible to identify whether the multiple media access control addresses obtained correspond to different wireless devices or the same wireless device, the monitoring system cannot simply confirm the actual total number and (movement) trajectory of multiple wireless devices in the area through the media access control addresses, which makes security management and monitoring difficult. Figure 3 To illustrate how to obtain the media access control address.

[0037] Figure 3 The figure is a schematic diagram of a wireless signal receiver receiving a probe request broadcasted by a wireless device according to an embodiment of the present invention. More specifically, a wireless device (e.g., an electronic device using Wi-Fi to access the Internet) will explore wireless networks around the wireless device by using active scanning. During the active scanning stage, the wireless device will initiate a network search by periodically broadcasting a management frame (ManagementFrame) also known as a probe request. The wireless signal receiver that manages the wireless device can receive the probe request to perform further network connection interaction functions. Figure 3As shown, a wireless signal receiver WR (such as a router, a relay station, etc.) can receive a probe request PR1 sent by a wireless device WD1 that uses a media access control address randomization technique (the information IF1 carried by the probe request PR1 includes information such as a virtual media access control address VMAC), and the wireless signal receiver can learn the virtual media access control address VMAC of the corresponding wireless device WD1. In addition, the wireless signal receiver WR can also receive a probe request PR2 sent by a wireless device WD2 that does not use a media access control address randomization technique (the information IF2 carried by the probe request PR2 includes information such as a real media access control address RMAC), and the wireless signal receiver can learn the real media access control address RMAC of the corresponding wireless device WD2.

[0038] Figure 2A and Figure 2B A schematic diagram showing that randomizing the MAC address will cause errors in the operation of monitoring the movement trajectory of wireless devices by simply using the MAC address carried in the probe request. Figure 2A In area R1, multiple wireless signal receivers are configured. The multiple wireless signal receivers are, for example, relay stations (Access Point), routers (Router), devices with wireless base station functions or other devices that can receive wireless signals. When the wireless devices in area R1 establish a wireless network (such as using Wi-Fi to access the Internet), they will broadcast a probe request frame (Probe Request Frame). Multiple wireless signal receivers can receive the probe request frame (hereinafter referred to as the probe request) and transmit the received probe request to the server to parse the media access control address information carried by the probe request. Assume that the three wireless devices WD2.1, WD2.2, and WD2.3 in area R1 do not use the media access control address randomization technology (that is, the media access control addresses of the multiple wireless devices are all real), and the positions of the multiple wireless devices in area R1 change over time and each forms a moving path TJ2.1, TJ2.2, and TJ2.3.

[0039] In this example, the server can confirm that there are three wireless devices WD2.1, WD2.2, and WD2.3 in area R1 through the three real media access control addresses in the multiple probe requests received, and can further confirm the locations of the three wireless devices WD2.1, WD2.2, and WD2.3 at different time points (e.g., multiple locations of the wireless device WD2.1 corresponding to one media access control address are marked with a triangle symbol, multiple locations of the wireless device WD2.2 corresponding to another media access control address are marked with a meter symbol, and multiple locations of the wireless device WD2.3 corresponding to yet another media access control address are marked with a hollow rectangle symbol). In other words, the server can easily determine the total number of corresponding wireless devices in area R1 through the real media access control addresses carried by the multiple probe requests received, and confirm multiple trajectories TJ2.1, TJ2.2, and TJ2.3 of different wireless devices through the determined multiple locations of different wireless devices, so as to efficiently monitor multiple wireless devices in area R1.

[0040] Please refer to Figure 2B However, when the multiple wireless devices WD2.1, WD2.2, and WD2.3 use the media access control address randomization technology, the server cannot effectively monitor the multiple wireless devices in area R1. Assume that area R1 still has three wireless devices and the movement paths of the three wireless devices are different from each other. Figure 2AThe same, but the three wireless devices all use media access control address randomization technology (that is, the media access control addresses of the three wireless devices are virtual and will change randomly over time). In addition, it is also assumed that the server still directly uses the media access control addresses carried by the received multiple probe requests to identify the corresponding wireless device. In this example, the server identifies that there are eight media access control addresses carried by the received multiple probe requests, and accordingly determines that eight wireless devices WD1.1~WD1.8 are located in area R1. In addition, by marking different positions of different media access control addresses at different time points (e.g., using a triangle symbol to mark multiple positions of the wireless device WD1.1 corresponding to one media access control address, using a meter symbol to mark multiple positions of the wireless device WD1.2 corresponding to another media access control address, using a diamond symbol to mark multiple positions of the wireless device WD1.3 corresponding to yet another media access control address, using a star symbol to mark multiple positions of the wireless device WD1.4 corresponding to yet another media access control address, and using a hollow rectangle symbol to mark the corresponding to yet another media access control address The server also identifies the multiple locations of the wireless device WD1.5 corresponding to another media access control address with a square symbol, the multiple locations of the wireless device WD1.6 corresponding to another media access control address with a solid rectangle symbol, and the location of the wireless device WD1.8 corresponding to another media access control address with a cross symbol). The server also identifies the movement paths of the eight wireless devices WD1.1 to WD1.8 (e.g., tracks TJ1.1 to TJ1.7, where the wireless device WD1.8 remains in place and has no track). Figure 2A By comparison, it is obvious that Figure 2B The monitoring result of the server in is completely wrong, that is, the media access control address randomization technology causes the server monitoring failure.

[0041] Figure 4 FIG. 1 is a block diagram of a wireless device monitoring system according to an embodiment of the present invention. Figure 4 In this embodiment, the wireless device monitoring system 1 includes a plurality of wireless signal receivers WR1-WRN and a processing server 100. The processing server 100 includes a processor 110, a storage unit 120 and a communication circuit unit 130, wherein the storage unit 120 and the communication circuit unit 130 are electrically connected to the processor 110.

[0042] The plurality of wireless signal receivers WR1-WRN are arranged at a plurality of positions in an area. The area is, for example, an area monitored by the processing server 100. The plurality of wireless signal receivers are, for example, an access point, a router, a device having a wireless base station function, or other devices capable of receiving wireless signals. In the present embodiment, the plurality of wireless signal receivers WR1-WRN are used to collect a plurality of probe requests PR(1), PR(2), ..., PR(N) sent by the plurality of wireless devices in the area during a period. In addition, the plurality of wireless signal receivers WR1-WRN further record the time of receiving each probe request as transmission time information, and then transmit the transmission time information and the corresponding probe request to the processing server 100. On the other hand, in the present embodiment, the plurality of wireless signal receivers WR1-WRN further record the signal strength of each probe request received as received signal strength (RSS) information, and then transmit the received signal strength information and the corresponding probe request to the processing server 100. In other words, after receiving the detection request, the processing server 100 can identify the information carried by the detection request and the corresponding transmission time information and the received signal strength (hereinafter also referred to as signal strength) information. In one embodiment, the information carried by the detection request, the corresponding transmission time information, and the corresponding signal strength information are collectively referred to as information corresponding to the detection request.

[0043] The processor 110 is hardware with computing capabilities, and is used to manage the overall operation of the wireless device monitoring system 100. In this embodiment, the processor 110 is, for example, a single-core or multi-core central processing unit (CPU), a microprocessor, or other programmable processing units, a digital signal processor (DSP), a programmable controller, an application specific integrated circuit (ASIC), a programmable logic device (PLD), or other similar devices. In one embodiment, the processor 110 itself can be configured with a memory for temporarily storing data. In this embodiment, the operations performed by the processor 110 and the operations generated by executing the association calculation module 121 and the association decision module 122 can also be regarded as the operations performed by the processing server 100.

[0044] The storage unit 120 (also referred to as a storage circuit unit) can temporarily store data via the instruction of the processor 110, and the data includes data used to manage the wireless device monitoring system 1, data received from the wireless signal receivers WR1~WRN, or other types of data, but the present invention is not limited thereto. In addition, the storage unit 120 can also record some data that needs to be stored for a long time via the instruction of the processor 110, for example, firmware or software used to manage the processing server 100 and the wireless signal receivers WR1~WRN, multiple program code modules, and databases. The program code modules include: a correlation calculation module 121 and an association decision module 122. The database includes a correlation calculation model 123. In this embodiment, the storage unit 120 can be any type of hard disk drive (HDD) or non-volatile memory storage device (such as a solid state drive). In one embodiment, the correlation calculation model 123 can be included in the correlation calculation module. The processor 110 can access and execute the association calculation module 121 and the association decision module 122 to implement the wireless device monitoring method provided in this embodiment. The association calculation module 121 is used to calculate the association (e.g., multiple association probabilities) between a pair of probe requests. The association decision module 122 is used to establish a flow network according to multiple pairs of probe requests and the associations between the multiple pairs of probe requests, thereby determining the associations between the multiple pairs of probe requests.

[0045] The communication circuit unit 130 is used to establish a network connection NC with the plurality of wireless signal receivers WR1-WRN via a wireless or wired manner to transmit data. For example, the wireless signal receivers WR1-WRN each transmit the received probe requests PR(1)-PR(N) to the processing server 100 (through the communication circuit unit 130) via the network connection NC, so that the processing server 100 can parse the probe requests PR(1)-PR(N). In another embodiment, the communication circuit unit 130 can also establish a network connection with other electronic devices, or connect the processing server 100 to the Internet. In this embodiment, the communication circuit unit 130 has a wireless communication circuit module and supports a Wireless Fidelity (Wi-Fi) system. In another embodiment, the communication circuit unit 130 can further support other communication technologies, such as the Global System for Mobile Communication (GSM) system, the Personal Handy-phone System (PHS), the Code Division Multiple Access (CDMA) system, the Wireless Fidelity (Wi-Fi) system, the Worldwide Interoperability for Microwave Access (WiMAX) system, the third generation wireless communication technology (3G), the fourth generation wireless communication technology (4G), the fifth generation wireless communication technology (5G), the Long Term Evolution (LTE), infrared transmission, bluetooth, ultra-wideband (UWB) communication technology, one or a combination thereof, and is not limited thereto. In addition, the communication circuit unit 130 can also have a wired communication module (such as a network adapter), and establish a connection with a telecommunications service provider through wired communication to connect to the Internet. It should be noted that the present invention is not limited to the form of wired communication.

[0046] Figure 5 FIG. 1 is a flow chart of a wireless device monitoring method according to an embodiment of the present invention. Figure 5In step S510, the processing server 100 receives multiple probe requests sent by the multiple wireless devices during a period. Specifically, the processing server 100 is used to receive multiple probe requests collected by the multiple wireless signal receivers WR1~WRN during a period from the multiple wireless signal receivers WR1~WRN via the network connection NC. In addition, the processor 110 can parse information corresponding to the multiple probe requests, wherein the information at least includes: Media Access Control (Media Access Control, MAC) address; Information Element (Information Element, IE); Sequence Number (Sequence Number); Received Signal Strength (RSS); and Transmission Time (Transmission Time).

[0047] In more detail, the Media Access Control (MAC) address (also called the media access control address, is 48 bits (6 bytes) long, composed of hexadecimal numbers, and is divided into the first three bytes and the last three bytes. The first three bytes are the Organizationally Unique Identifier (OUI), which is a code assigned to different manufacturers by the IEEE registration authority to distinguish different manufacturers. The last three bytes are assigned by the manufacturer itself and are called the extended identifier. The last three bytes of the media access control address in the network card produced by the same manufacturer are all different.

[0048] The information element carries the specification information and configuration information of the wireless device corresponding to the probe request. In one embodiment, the information element of each probe request can be simplified in the form of a feature vector to facilitate subsequent comparative analysis. In short, the processing server 100 can compare the differences between the information elements of two probe requests to determine the relevance / similarity between the two probe requests.

[0049] The sequence number is used to record the order in which the probe request to which it belongs is sent. More specifically, the sequence numbers recorded in multiple probe requests sent sequentially over time will gradually increase, and after reaching the maximum value of the specification (e.g., 4095), they will be reset to zero to perform the next sequence number accumulation cycle. In other words, the "difference" (also called sequence number difference) between the sequence numbers of two probe requests sent by the same wireless device within a very small time interval should be a very small number (theoretically, the sequence number difference between two probe requests sent consecutively by the same wireless device should be 1). Based on this principle, the processing server 100 can compare the difference in sequence numbers between two probe requests with similar transmission times to determine the correlation / similarity between the two probe requests.

[0050] Generally speaking, the multiple wireless signal receivers WR1-WRN are configured at different locations in the area. When the same detection request is received by the multiple wireless signal receivers WR1-WRN, the multiple wireless signal receivers WR1-WRN measure different signal strengths because the distance between the wireless device sending the detection request and the multiple wireless signal receivers WR1-WRN and obstacles and other factors affecting the signal strength are different. That is, when the processing server 100 receives the same detection request from different wireless signal receivers WR1-WRN, the processing server 100 identifies the multiple signal strengths corresponding to the same detection request to the multiple wireless signal receivers WR1-WRN from the signal strength information contained in the detection request, and forms the multiple signal strengths into a signal strength vector. Since the factors affecting the signal strength (such as distance, obstacles) are not easy to change dramatically in a short time, the multiple signal strength vectors corresponding to the multiple detection requests sent by the same wireless device in a small time interval should be similar. In addition, since the signal strength vectors corresponding to multiple wireless receivers have the characteristics of location guidance, in one embodiment, the processing server 100 can also use the signal strength vector of each received probe request to allocate each probe request to different separated blocks in the area, so as to use the characteristics that the wireless device can only be transferred in multiple blocks to analyze the correlation / similarity between a pair of probe requests. For example, when the number of probe requests moved out of block A is equal to the number of probe requests moved from block A to block B, the processing server 100 can determine that the probe request corresponding to block B is related to the probe request of block A.

[0051] Next, in step S520, the processing server 100 is used to determine whether the media access control address of each of the multiple probe requests is virtual. Specifically, in the operation of determining whether the media access control address of each of the multiple probe requests is virtual, the processing server determines whether the media access control address of each of the multiple probe requests is virtual by identifying the identification bit value of the media access control address of each of the probe requests. In more detail, the identification bit is pre-set to the seventh bit of the media access control address. When the identification bit value is identified as 0, the processing server 100 determines that the media access control address of the corresponding probe request is not virtual; when the identification bit value is identified as 1, the processing server 100 determines that the media access control address of the corresponding probe request is virtual.

[0052] In this embodiment, in response to determining that a plurality of probe requests have virtual media access control addresses among the plurality of probe requests (also referred to as first probe requests), the processing server 100 executes steps S530 and S540 to further determine the association and connection between the plurality of first probe requests, thereby determining the corresponding plurality of first wireless devices and their trajectories. In addition, in response to determining that a plurality of probe requests do not have virtual media access control addresses among the plurality of probe requests (also referred to as second probe requests), the processing server 100 executes steps S550 and S560 to directly use the plurality of physical media access control addresses of the plurality of second probe requests to identify the corresponding plurality of second wireless devices, and further use the plurality of second probe requests to train the association calculation model.

[0053] In step S530, the processing server 100 is used to establish a flow network corresponding to the multiple first probe requests according to the first information corresponding to the multiple first probe requests and the associated calculation model. As mentioned above, the first information corresponding to the first probe request at least includes: a media access control address carried by the first probe request, an information element of the first probe request, a sequence number of the first probe request, a signal strength vector corresponding to the first probe request, and a transmission time corresponding to the first probe request.

[0054] Next, in step S540, the processing server 100 is used to group the multiple first probe requests into multiple first probe request sequences according to the flow network through the minimum cost maximum flow method, wherein the multiple first probe request sequences are determined to correspond to multiple first wireless devices in the multiple wireless devices respectively. In addition, the processing server 100 further determines that all the first probe requests included in each of the multiple first probe request sequences are sent by the corresponding same first wireless device during the period. That is, after establishing the flow network corresponding to the multiple first probe requests, the processing server 100 will obtain multiple flows flowing in the flow network by using the minimum cost maximum flow method on the flow network (that is, this flow network corresponds to the optimal solution of the minimum cost maximum flow method). The processing server 100 can obtain multiple first probe request sequences including the multiple first probe requests through the flow paths of the multiple flows. Next, the processing server 100 determines that each of the multiple first probe request sequences corresponds to a different first wireless device (the total number of first probe request sequences is equal to the total number of first wireless devices), and the multiple first probe requests sent by each of the multiple first wireless devices have been grouped into corresponding first probe request sequences.

[0055] The following use Fig. 6A , Figure 6B To further explain the details of step S530 and step S540.

[0056] Fig. 6A According to an embodiment of the present invention, Figure 5 Please refer to the flowchart of step S530. Fig. 6A In step S531, the processing server 100 (or the association calculation module 121) inputs the first information into the association calculation model to calculate the multiple association probabilities of each of the multiple pairs of first detection requests in the multiple first detection requests. Then, in step S532, the processing server 100 (or the contact decision module 122) maps the multiple first detection requests to multiple nodes in the flow network and sets multiple paths between multiple pairs of nodes corresponding to the multiple pairs of first detection requests to establish the flow network, wherein the flow cost of each of the multiple paths is set by the multiple association probabilities of each of the corresponding multiple pairs of first detection requests.

[0057] The multiple association probabilities include: (1) information element likelihood; (2) sequence number likelihood; (3) signal strength likelihood; (4) transmission time interval correlation probability; and (5) association correlation probability, wherein the association correlation probability is proportional to the product of the information element correlation, sequence number correlation, signal strength correlation and transmission time interval correlation probability, and the association correlation probability between a pair of probe requests is used to indicate whether there is a connection between the pair of probe requests. Assume that a pair of probe requests is probe request P i With the probe request P j , where the probe request P j The transmission time t j Later than the probe request P i The transmission time t i When the probe request P i With the probe request P j When the contact association probability is 1, it means that the detection request P j With the probe request P i More specifically, when the probe request P i With probe request P When the probability of association of j is 1, the processing server 100 determines that the probe request P j With the probe request P i are all sent from the same wireless device, and the probe request P j The wireless device sends a probe request P i The subsequent probe request (i.e., the wireless device sends the probe request P j The probe request sent previously is the probe request P i ). In this case, the probe request Pj may be referred to as the successor of the probe request Pi, or the probe request Pi may be referred to as the predecessor of the probe request Pj.

[0058] On the contrary, when the probe request P i With the probe request P j When the contact association probability is 0, it means that the detection request P j With the probe request P i More specifically, when the probe request P i With the probe request P jWhen the probability of association is 0, the processing server 100 determines that the probe request P j With the probe request P i are not sent from the same wireless device. On the other hand, when the probe request P i With the probe request P j The closer the probability of association is to 1, the more likely the processing server 100 is to determine that the probe request P j The more likely it is to be a probe request P i The successor of (this pair of probe request P i With the probe request P j The higher the probability of being connected to each other).

[0059] In this embodiment, the association calculation model includes: a logistic regression model for calculating the association of information elements, a Gaussian mixture model for calculating the association of sequence numbers, a transition matrix for calculating the association of signal strengths, and an exponential decay distribution model for calculating the probability of association of transmission time intervals.

[0060] Specifically, the contact association probability can be expressed by the following mathematical formula (1):

[0061] p(Φ ij |P i , P j ) (1)

[0062] Among them, Φ ij Used to indicate the probe request P j With the probe request P i It should be noted that when the contact value is 1, the probe request P j Determined to be linked to the probe request P i And it is a probe request P i The successor of; when the contact value is not 1, the probe request P j Determined not to be a probe request P i 's successor.

[0063] The information element relevance can be expressed, for example, using the following mathematical formula (2):

[0064] p(I j |I i , Δt ij , Φ ij ) (2)

[0065] Among them, Ij Indicates the probe request P j Information element vector of I i Indicates the probe request P i The information element vector of Δt ij =t j -t i , is the probe request P j With the probe request P i The time interval between transmissions.

[0066] The serial number association can be expressed, for example, by the following mathematical formula (3):

[0067] p(s j |s i , Δt ij , Φ ij ) (3)

[0068] Among them, s j Indicates the probe request P j Serial number;s i Indicates the probe request P i The serial number of the

[0069] The signal strength correlation can be expressed, for example, by the following mathematical formula (4):

[0070] p(R j |R i , Δt ij , Φ ij ) (4)

[0071] Among them, R j Indicates the probe request P j The signal strength vector of R i Indicates the probe request P i The signal strength vector.

[0072] The transmission time interval association probability can be expressed, for example, by the following mathematical formula (5):

[0073] p(Φ ij |Δt ij )=exp(-λΔt ij ) (5)

[0074] Among them, exp(-λΔt ij ) is an exponential decay distribution, λ is the decay rate, and Δt is preset ij > 0. In addition, the transmission time interval probability can also be referred to as the probability of the transmission time interval Δt ij The relevant prior probability (PriorProbability).

[0075] In more detail, as mentioned above, the association probability is proportional to the product of the information element association, the sequence number association, the signal strength association and the transmission time interval association probability. Therefore, the association probability can be expressed, for example, by the following mathematical formula (6):

[0076] p(Φ ij |P i , P j )∝p(I j |I i , Δt ij , Φ ij )p(s j |s i , Δt ij , Φ ij )p(R j |R i , Δt ij , Φ ij )p(Φ ij |Δt ij ) (6)

[0077] In addition, since the information element relevance can be assumed to be independent of the time interval, the information element relevance can be further expressed by the following formula (7):

[0078] p(I j |I i , Δt ij , Φ ij )=p(Δ ij |Φ ij )∝p(Φ ij |Δ ij ) (7)

[0079] Among them, p(Φ ij |Δ ij ) can be calculated via a logistic regression model.

[0080] On the other hand, since the sequence number difference is not dependent on the sequence number corresponding to the current probe request, the sequence number correlation can be further expressed by the following formula (8):

[0081] p(s j |s i , Δt ij , Φ ij )=p(Δs ij |Δt ij , Φ ij ) (8)

[0082] Among them, Δs ij The distribution of can be presented by a Gaussian mixture model.

[0083] On the other hand, since the signal strength vector has position directivity, the signal strength correlation can be further expressed by the following formula (9):

[0084]

[0085] Among them, Γ i Used to indicate the index of the block to which Ri belongs (points to); Γ j To represent R j The index of the block to which it belongs; N trans (Γ i , Γ j ) is used to indicate the period from block Γ i Transfer to block Γ j The number of trans (Γ i ) is used to indicate the period from block Γ i The amount transferred out.

[0086] It should be noted that, in this embodiment, the capacity of the plurality of paths within the flow network is set to 1, the flow supply of each flow is 1, and the flow demand of each flow is 1. In addition, in one embodiment, step S532 may be performed before step S531, or in parallel with step S531.

[0087] In one embodiment, the flow costs of each of the plurality of paths are set by the association probabilities of the corresponding plurality of pairs of first probe requests. More specifically, the flow cost can be set according to the following mathematical formula (10):

[0088] -log(p(Φ ij |P i , P j , Δt ij )) (10)

[0089] After constructing the flow network, the processing server 100 (or the contact decision module 122 ) may further optimize the flow network using the minimum cost maximum flow method to maximize the joint probability of all frame associations.

[0090] Figure 6B According to an embodiment of the present invention, Figure 5 Please refer to the flowchart of step S540. Figure 6B In step S541, the connection decision module determines multiple flows in the flow network and one or more flow paths passed by the multiple flows through the minimum cost maximum flow method.

[0091] Next, in step S542, the contact decision module groups the multiple first probe requests corresponding to the multiple nodes included in each flow path of the one or more flow paths into a corresponding first probe request sequence.

[0092] The following will use FIG. 8A to FIG. 8G The following example illustrates the process in which the processing server 100 establishes a flow network corresponding to the received multiple probe requests and determines the multiple flows and corresponding flow paths in the flow network by the minimum cost maximum flow method to group the multiple probe requests into a probe request sequence. However, before this, it is necessary to use Figure 7 To illustrate a simplified mechanism used in this embodiment (also called a detection request filtering mechanism).

[0093] Figure 7 The figure is a schematic diagram of different media access control addresses carried by multiple probe requests in multiple probe request rounds according to an embodiment of the present invention. Generally speaking, a wireless device will quickly scan multiple wireless channels during active scanning to find connectable wireless channels and corresponding wireless network providers. During each active scanning period initiated, the wireless device will broadcast multiple probe requests for scanning multiple channels, wherein the media access control addresses of the multiple probe requests in each active scanning period initiated are the same, and the multiple probe requests can be collectively referred to as a probe round. In addition, since the time interval for executing media access control address randomization is uncertain, when media access control address randomization is used, the virtual media access control addresses of all probe requests in two different probe rounds may be the same or different, but the virtual media access control addresses of multiple probe requests in the same probe round will still be the same. For example, it is assumed that the wireless device WD1 initiates 4 active scans (i.e., there are 4 probe rounds P1-P4 in total), and the wireless device WD1 uses the media access control address randomization technology. In this case, the media access control addresses carried by the multiple probe requests PR1.1~PR1.N in the probe round P1 are all the same virtual media access control address VMAC1; the media access control addresses carried by the multiple probe requests PR2.1~PR2.N in the probe round P2 are also all the virtual media access control address VMAC1; but the media access control addresses carried by the multiple probe requests PR3.1~PR3.N in the probe round P3 have been changed to the virtual media access control address VMAC2 by media access control address randomization; and the media access control addresses carried by the multiple probe requests PR4.1~PR4.N in the probe round P4 have been changed to the virtual media access control address VMAC3 by media access control address randomization.

[0094] It should be noted that the time interval between multiple probe requests in each probe round is much smaller than the time interval between different probe requests in different probe rounds. For example, the time interval between time T1.1 and time T1.2 is much smaller than the time interval between time T1.N and time T2.1. In addition, since each active scanning / probe round sends multiple almost identical probe requests (the only difference is that the scanned channels are different) in a very short time, the processing server 100 selects only one probe request from each round of probe round to represent the corresponding probe round for further analysis.

[0095] For example, in Figure 7 In the example, when the processing server 100 receives multiple probe requests PR1.1~PR1.N, probe requests PR2.1~PR2.N, probe requests PR3.1~PR3.N, and probe requests PR4.1~PR4.N, the processing server 100 identifies the corresponding 4 probe rounds PR1~PR4 (for example, by determining the time interval), and selects each probe request from the probe rounds PR1~PR4 to calculate the association probability and construct the flow network (as shown by the bottom line). For example, the processing server 100 may fixedly select the first probe request of each probe round (such as probe requests PR1.1, PR2.1, PR3.1, PR4.1) or randomly select one of the probe requests in each probe round, but the present invention is not limited to this. It is worth mentioning that, using this simplified mechanism, in this example, the number of probe requests that the processing server 100 needs to process can be reduced from 4N to 4 (the computing resource consumption is reduced to one-Nth). That is to say, by using this simplified mechanism, the processing server 100 can greatly reduce the total number of probe requests that need to be analyzed, thereby improving the analysis speed and reducing resource consumption without affecting the accuracy (because this embodiment does not use information related to the channel to be scanned to calculate the association between a pair of probe requests).

[0096] Figure 8A to Figure 8F FIG. 1 is a schematic diagram of a flow network established according to a plurality of received probe requests according to an embodiment of the present invention. Fig. 8A Assume that the processing server 100 receives multiple probe requests PR (also called first probe requests) each carrying a virtual media access control address from the area via the wireless receivers WR1-WRN. Figure 8BAs shown, the processing server 100 can group the multiple probe requests PR into multiple probe rounds P1, P2, and P3 by identifying the information carried by the multiple probe requests PR, and select one probe request PR1, PR2, and PR3 from the multiple probe rounds P1, P2, and P3 for subsequent processing. In one embodiment, the processing server 100 can identify multiple probe requests grouped into one probe round according to the transmission time and the media access control address. In other words, the multiple probe requests determined to be in the same probe round have similar transmission times and have the same media access control address. For example, the transmission time of multiple probe requests (such as probe request PR1) in the probe round P1 is close to time T1; the transmission time of multiple probe requests (such as probe request PR2) in the probe round P2 is close to time T2; the transmission time of multiple probe requests (such as probe request PR3) in the probe round P3 is close to time T3. In the example of FIG. 8 , the processing server 100 selects probe requests PR1 , PR2 , PR3 from the probe rounds P1 , P2 , P3 , respectively, for subsequent processing.

[0097] like Figure 8C As shown, the processing server 100 (or the contact decision module 122) begins to map the probe requests PR1, PR2, and PR3 to multiple nodes NS1, NR1, NS2, NR2, NS3, and NR3 in the flow network FN to be established. In more detail, each probe request PR1, PR2, and PR3 will be mapped to the corresponding pair of nodes L1, L2, and L3, wherein each pair of nodes includes a sending node (Sender Node) and a receiving node (Receiver Node). For example, the probe request PR1 is mapped to the sending node NS1 and the receiving node NR1; the probe request PR2 is mapped to the sending node NS2 and the receiving node NR2; and the probe request PR3 is mapped to the sending node NS3 and the receiving node NR3. In addition, as shown by the arrows, the flow supply of each sending node is pre-set to 1 (because it is expected that there is at most one successor (Successor)); the flow demand of each receiving node is pre-set to 1 (because it is expected that there is at most one predecessor (Predecessor)). In this embodiment, in the flow network FN (also called flow network model), each sending node expects to output a flow, and each receiving node expects to receive an input flow.

[0098] Then, if Fig.8D As shown, the processing server 100 establishes paths (flow paths) between different pairs of nodes. Fig.8D In the example of , the processing server 100 (or the contact decision module 122) will establish a path from a sending node of a pair of nodes to a receiving node of another pair of nodes. Fig.8DIn the example, the processing server 100 establishes a path E12 to connect the shipping node NS1 to the receiving node NR2; establishes a path E13 to connect the shipping node NS1 to the receiving node NR3; establishes a path E21 to connect the shipping node NS2 to the receiving node NR1; establishes a path E23 to connect the shipping node NS2 to the receiving node NR3; establishes a path E31 to connect the shipping node NS3 to the receiving node NR1; and establishes a path E32 to connect the shipping node NS3 to the receiving node NR2. In addition, for two nodes (i.e., pairs of nodes) connected via different paths, the processing server 100 identifies multiple pairs of connectable probe requests, and identifies the connectable directions via the corresponding path directions (e.g., according to the path E12, it is identified that the probe request PR1 can be connected to the probe request PR2; according to the path E21, it is identified that the probe request PR2 can be connected to the probe request PR1).

[0099] In addition, the processing server 100 (or the association calculation module 121) inputs the information corresponding to the probe requests PR1, PR2, and PR3 (e.g., media access control addresses, information elements, sequence numbers, signal strengths, transmission time) to the association calculation model 123 to calculate multiple association probabilities for each of the multiple pairs of probe requests (step S531). For example, for the pair of nodes NS1 and NR2 connected via the path E12, the association calculation model 123 can calculate multiple association probabilities between the pair of nodes NS1 and NR2 (i.e., calculate the association probability of the probe request PR1 being associated with the probe request PR2).

[0100] Please refer to Fig. 8E , the processing server 100 (or the contact decision module 122) sets the flow costs of all paths according to the calculated association probability through a negative algorithm (the larger the association probability, the lower the flow cost), and identifies that: among the multiple paths E12 and E13 related to the shipping node NS1, the flow cost of path E12 is the lowest (i.e., the contact association probability between nodes NS1 and NR2 is higher than the contact association probability between nodes NS1 and NR3); among the multiple paths E21 and E23 related to the shipping node N2, the flow cost of path E23 is the lowest (i.e., the contact association probability between nodes NS2 and NR3 is higher than the contact association probability between nodes NS2 and NR1). Through the minimum cost maximum flow method, the processing server 100 can predict that a flow will flow from the shipping node NS1 to the receiving node NR2 (due to the lower flow cost), and predict that a flow will flow from the shipping node NS2 to the receiving node NR3 (due to the lower flow cost). At this time, the processing server 100 can predict that the flow supply of the sending nodes NS1 and NS2 has been met (eg, one flow can be sent / output), and predict that the flow demand of the receiving nodes NR2 and NR3 has been met (eg, one flow can be received / input).

[0101] In this embodiment, the processing server 100 (or the contact decision module 122) may further determine the successor indicator value (Successor Indicator) and the predecessor indicator value (Predecessor Indicator) of each probe request based on the multiple pairs of lowest flow costs. When the successor indicator value is 1, it indicates that the corresponding probe request has no successor (that is, this probe request is the end point of the corresponding trajectory); when the successor indicator value is 0, it indicates that the corresponding probe request has a successor (that is, this probe request is not the end point of the corresponding trajectory). On the other hand, when the predecessor indicator value is 1, it indicates that the corresponding probe request has no predecessor (that is, this probe request is the starting point of the corresponding trajectory); when the predecessor indicator value is 0, it indicates that the corresponding probe request has a predecessor (that is, this probe request is not the starting point of the corresponding trajectory).

[0102] It should be noted that in Fig. 8E In the example, the flow supply of the shipping node NS3 is not met (i.e., the shipping node NS3 has not yet output a flow), and the flow demand of the receiving node NR1 is not met (i.e., the shipping node NR1 has not yet been input with a flow). In order to solve such problems, the processing server 100 (or the contact decision module 122) sets a virtual auxiliary node AUX and assumes that each node is connected to the auxiliary node AUX through a virtual path (i.e., virtual paths EW1, EW2, and EW3 are established to connect the auxiliary node AUX to the receiving node NR2; virtual paths E1W, E2W, and E3W are established to connect the shipping nodes NS1, NS2, and NS3 to the auxiliary node AUX). The flow cost of the virtual path is also set according to the succession parameter γ of each node. For example, in one embodiment, the flow cost of the virtual path connected to the auxiliary node AUX can be set to -log(γ / 2).

[0103] exist Figure 8F In the example, among the paths E21, E31, and EW1 leading to the receiving node NR1, the processing server 100 determines that the flow cost of the path EW1 is the lowest, and predicts that a flow (also called a virtual flow or auxiliary flow) flows from the auxiliary node AUX to the receiving node NR1, so that the flow demand of the receiving node NR1 is met (e.g., a flow can be input). In addition, among the paths E31, E32, and E3W starting from the shipping node NS3, the processing server 100 determines that the flow cost of the path E3W is the lowest, and predicts that a flow (also called a virtual flow or auxiliary flow) flows from the shipping node NS3 to the auxiliary node AUX, so that the flow supply of the receiving node NS3 is also met (e.g., a flow can be output).

[0104] In this way, if Figure 8F As shown, the processing server 100 has determined the flow paths of multiple flows between multiple pairs of nodes by the minimum cost maximum flow method (eg, Figure 8F The thicker path shown), and the flow supply and flow demand of multiple sending nodes NS1, NS2, NS3 and multiple receiving nodes NR1, NR2, NR3 are all met, thereby completing an optimal flow cycle with minimum cost and maximum flow. In addition, in this embodiment, the processing server 100 determines that the detection request PR1 corresponding to the receiving node NR1 connected via the path EW1 starting from the auxiliary node AUX is the starting point of the trajectory, and sets the predecessor indication value of the starting point (such as the detection request PR1) to 1 (sets the successor indication value to 0). In addition, the detection request PR3 corresponding to the sending node NS3 connected to the auxiliary node AUX is determined to be the end point of the trajectory, and the successor indication value of the end point (such as the detection request PR3) is set to 1 (sets the predecessor indication value to 0). In addition, since there is no flow between the nodes NS2, NR2 of the detection request PR2 and the auxiliary node AUX, the processing server 100 sets the successor indication value of the detection node PR2 to 0 and the predecessor indication value to 0.

[0105] Figure 8G FIG. 1 is a schematic diagram of determining multiple flows and corresponding flow paths in a flow network by using a minimum cost maximum flow method according to an embodiment of the present invention to group multiple probe requests into a probe request sequence. Figure 8G , the processing server 100 further identifies the flow Flow1 (flow Flow1 can be used to indicate that the detection request PR1 is connected to the detection request PR2) from the detection request PR1 according to the flow path E12 from the sending node NS1 to the receiving node NR2; and identifies the flow Flow2 from the detection request PR2 to the detection request PR3 according to the flow path E23 from the sending node NS2 to the receiving node NR3. Then, the processing server 100 groups the corresponding detection requests PR1, PR2, PR3 into a detection request sequence PS1 according to the flows Flow1 and Flow2. That is, the processing server 100 can group the detection requests PR1, PR2, PR3 corresponding to the multiple nodes NS1, NR2, NS2, NR3 included in the flow paths E12 and E23 of the flows Flow1 and Flow2 into a detection request sequence PS1. It should be noted that the multiple probe requests PR1, PR2, and PR3 in the probe request sequence PS1 can be regarded as arranged in chronological order, wherein the probe request PR1 is the starting point of the trajectory and is also the first probe request in the probe request sequence PS1; the probe request PR3 is the end point of the trajectory and is also the last probe request in the probe request sequence PS1.

[0106] Figure 8H FIG. 1 is a schematic diagram illustrating identifying a plurality of corresponding wireless devices and their movement trajectories according to a flow path determined in a flow network and a plurality of corresponding probe request sequences according to an embodiment of the present invention. In this embodiment, the processing server 100 may monitor the total number of the first wireless devices in the area during the period by calculating the sum of the plurality of first wireless devices. For example, Figures 8A to 8H In the example of , the processing server 100 determines that the total number of wireless devices in the area R2 is 1.

[0107] In addition, the processing server 100 may identify the movement tracks of each of the plurality of first wireless devices in the area during the period according to the plurality of first probe request sequences. Figure 8H As shown by arrow A3, for the probe request sequence PS1, the processing server 100 can calculate the position of the wireless device WD1 at time points t1, t2, and t3 according to the signal strength vectors R1, R2, and R3 of the probe requests PR1, PR2, and PR3 in the probe request sequence PS1, thereby obtaining the moving trajectory TJ1 of the wireless device WD1 in the area R2. However, in the above operation, the processing server 100 still does not know the real media access control address and the real device personal information of the wireless device WD1. In other words, the wireless device monitoring system and method provided in this embodiment can determine the number and corresponding trajectory of wireless devices corresponding to multiple probe requests without infringing privacy, thereby completing the security monitoring management operation in the area R2.

[0108] The following is more through Fig.9A , 9B To illustrate other connection patterns obtained through the constructed flow network.

[0109] Fig.9A FIG. 1 is a schematic diagram of determining multiple flows and corresponding flow paths in a flow network through a minimum cost maximum flow method according to another embodiment of the present invention to group multiple probe requests into a probe request sequence. In this example, it is assumed that the processing server 100 selects multiple probe requests PR4, PR5, and PR6 in area 2, and establishes a corresponding flow network FN1 according to the corresponding pairs of nodes L4, L5, and L6. In addition, as Fig.9AAs shown, the processing server 100 identifies multiple paths E46, E5W, E6W, EW4, and EW5 with lower flow costs from the flow network FN1. As shown by arrow A4, the processing server 100 identifies the corresponding flow Flow3 based on the flow path E46 from the shipping node NS4 to the receiving node NR6, thereby determining that the detection request PR4 is connected to the detection request PR6. In addition, the processing server 100 determines that the predecessor indicator value of the detection request PR4 is 1 based on the flow path EW4 from the auxiliary node AUX to the receiving node NR4; determines that the predecessor indicator value of the detection request PR5 is 1 based on the flow path EW5 from the auxiliary node AUX to the receiving node NR5; determines that the successor indicator value of the detection request PR6 is 1 based on the flow path E6W from the shipping node NS6 to the auxiliary node AUX; and determines that the successor indicator value of the detection request PR5 is 1 based on the flow path E5W from the shipping node NS5 to the auxiliary node AUX. Under the above conditions, the processing server 100 groups the probe requests PR4 and PR5 into a probe request sequence PS2, wherein the probe request PR4 is identified as the starting point of the corresponding trajectory and the probe request PR6 is identified as the end point of the corresponding trajectory. In addition, the probe request PR5 is grouped into the probe request sequence PS3 and is the starting point and end point of the corresponding trajectory (in this example, the probe request PR5 is determined to be not linked to any other probe request).

[0110] Fig. 9B FIG. 1 is a schematic diagram illustrating identifying a corresponding wireless device and its movement trajectory according to a flow path determined in a flow network and a corresponding detection request sequence according to another embodiment of the present invention. Fig. 9B As shown, the processing server 100 determines that the total number of wireless devices in area R2 is 2. In addition, as shown by arrow A5, for the probe request sequence PS2, the processing server 100 can calculate the position of the wireless device WD1.1 at time points t4 and t6 according to the signal strength vectors R4 and R6 of the probe requests PR4 and PR6 in the probe request sequence PS1, thereby obtaining the movement trajectory TJ2 of the wireless device WD1.1 in area R2; the processing server 100 can calculate the position of the wireless device WD1.2 at time point t5 according to the signal strength vector R5 of the probe request PR5 in the probe request sequence PS3, and determine that the wireless device WD1.2 has not moved in area R2.

[0111] On the other hand, please return to Figure 5In step S550, in response to determining that the media access control addresses of the plurality of second probe requests among the plurality of probe requests are not virtual (in order to distinguish from the first probe request having the virtual probe address, the probe request having the real media access address is also referred to as the second probe request), the processing server 100 is further configured to identify the plurality of second wireless devices among the plurality of wireless devices corresponding to the plurality of second probe requests.

[0112] More specifically, the processing server 100 identifies the media access control addresses of each of the plurality of second probe requests as real media access control addresses, and identifies each of the different real media access control addresses of the plurality of second probe requests as a unique identifier (UID) of one of the plurality of second wireless devices in the plurality of wireless devices, thereby identifying the plurality of second wireless devices that respond to the plurality of second probe requests. That is, since the plurality of second probe requests carry real media access control addresses, the processing server 100 can use the real media access control addresses as unique identifiers of the second wireless devices to count the total number of different unique identifiers as the total number of the plurality of second wireless devices. In addition, the plurality of second probe requests belonging to the same real media access control address will be directly grouped into the same second probe request sequence, and will be determined to belong to the same second wireless device.

[0113] Next, in step S560, the processing server 100 is further configured to train the association calculation model according to the plurality of second detection requests.

[0114] More specifically, the processing server groups the multiple second probe requests into multiple second probe request sequences corresponding to the multiple second wireless devices respectively according to the different multiple real media access control addresses. As described above, the real media access control addresses of the multiple second probe requests included in each of the multiple second probe request sequences are the same (corresponding to the same second wireless device). The processing server 100 can sort and group the multiple second probe requests corresponding to the same real media access control address into the same second probe request sequence according to the order of transmission time, and the processing server 100 can directly determine that the multiple second probe requests are sequentially connected. In other words, the processing server 100 can determine that the multiple second probe requests included in each of the multiple second probe request sequences are sequentially associated / connected over time and are sent by the corresponding second wireless device within the period.

[0115] It should be noted that the multiple second association probabilities of each of the multiple pairs of second probe requests in the multiple second probe requests have been determined by the processing server according to the multiple second probe request sequences. Specifically, since the processing server 100 has confirmed the second wireless devices and the second probe request sequences to which all the second probe requests belong, the processing server 100 can determine the order of contact between all the second probe requests included in each second probe request sequence according to the transmission time of each second probe request, and thereby directly obtain the contact association probability between each pair of second probe requests (also referred to as the second association probability corresponding to the second probe request). In other words, the processing server 100 can directly know the contact relationship between each second probe request. For example, assuming that a second probe request sequence has two second probe requests, the second association probability between this pair of second probe requests can be directly determined to be 1 (i.e., 100%).

[0116] Next, the processing server 100 inputs the second information corresponding to the multiple second probe requests, the second association probabilities of the multiple pairs of second probe requests in the multiple second probe requests, and the multiple second probe request sequences into the association calculation model to train the association calculation model. Specifically, the processing server 100 uses the multiple second probe requests with real media access control addresses as training materials, and inputs the information element vectors, sequence numbers, signal strength vectors, and transmission times in the second information of the multiple second probe requests into the logistic regression model, Gaussian mixture model, transfer matrix, and exponential decay distribution model in the association calculation model, and at the same time, uses the known contact association probability (second association probability) as the correct result to correct the parameters and coefficients in the above multiple models / matrices, so that the second association probability output by the association calculation model according to the input second information can approach the known second association probability, thereby improving the accuracy of the association calculation model.

[0117] Fig.10The performance comparison diagram of this embodiment and multiple prior arts drawn according to an embodiment of the present invention. This embodiment groups the received probe requests to determine the corresponding wireless devices based on the multiple groups obtained. Generally speaking, the performance of grouping can be evaluated by analyzing the homogeneity (also known as homogeneity), completeness and V-measure of multiple groups. Homogeneity is used to indicate that the characteristics of all members in a group are the same (e.g., all probe requests in a probe request sequence belong to the same wireless device). Completeness is used to indicate that all members of a characteristic are grouped into the same group (e.g., all probe requests sent by the same wireless device are grouped into the same probe request sequence). V-measure is the harmonic mean of homogeneity and completeness, which can more completely represent the overall performance of grouping (the higher the value of V-measure, the better the corresponding grouping performance). Please refer to Fig.10 , the grouping results obtained by the flow network and the minimum cost maximum flow method provided by this embodiment have a corresponding V-measurement value that is significantly higher than other previous technologies A to C. Among them, the information element fingerprint method only uses the information element vector of each probe request as the corresponding device fingerprint for grouping; the sequence number method first uses the information element to cluster, and then links multiple probe requests in each cluster through the sequence number difference to obtain the final grouping; the time signature method uses the time interval characteristics between multiple probe requests in each probe round to find the signature characteristics of the device, so as to perform grouping according to similar signature characteristics.

[0118] It should be noted that in the above embodiment, the association calculation module 121 and the association decision module 122 are implemented in the form of software, but the present invention is not limited thereto. For example, in another embodiment, the association calculation module 121 and the association decision module 122 can be implemented in the form of hardware circuits to become an association calculation circuit unit and an association decision circuit unit, respectively.

[0119] Based on the above, the wireless device monitoring system and the wireless device monitoring method provided by the multiple embodiments of the present invention can utilize the existing wireless base stations, relay stations, and routers as wireless signal receivers for collecting probe requests without additionally configuring auxiliary devices of special specifications, thereby saving the construction cost of the monitoring system. In addition, the provided wireless device monitoring system and the wireless device monitoring method can establish a corresponding flow network model based on the information of the received multiple probe requests while protecting privacy without pushing back the real media access control address, and optimize the established flow network model with the minimum cost and maximum flow, so as to group the multiple probe requests into the probe request sequence corresponding to the multiple wireless devices, thereby effectively monitoring the total number and trajectory of the multiple wireless devices in the area, and improving the efficiency of security management and monitoring work.

[0120] The electronic-related embodiments disclosed herein can be implemented using general or special computing devices, computer processors or electronic circuits, including but not limited to application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), and other programmable logic devices configured or programmed according to the teachings of the present disclosure. Computer instructions or software codes running in general or special computing devices, computer processors or programmable logic devices can be easily written by technicians in the field of software or electronic technology based on the teachings of the present disclosure.

[0121] All or part of the electronic related embodiments may be executed in one or more computing devices, including server computers, personal computers, notebook computers, and mobile computing devices such as smart phones and tablet computers.

[0122] Electronic embodiments include computer storage media having computer instructions or software codes stored therein.

[0123] The storage medium may include, but is not limited to, floppy disks, optical disks, Blu-ray disks, DVDs, CD-ROMs and magneto-optical disks, ROMs, RAMs, flash memory devices, or any type of medium or device suitable for storing instructions, code and / or data.

[0124] Multiple embodiments of the present invention may also be implemented in a distributed computing environment and / or a cloud computing environment, wherein the whole or part of the machine instructions may be executed in a distributed manner by one or more processing devices interconnected by a communication network (e.g., an intranet, a wide area network (WAN), a local area network (LAN), the Internet, or other forms of data transmission media.

[0125] The foregoing description of the invention has been provided for purposes of illustration and description and is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations thereof will be apparent to those skilled in the art.

[0126] The embodiments of the present application are selected and described in order to best explain the principles of the invention and its practical applications, so that other technicians in the field can understand the various embodiments of the invention and have various modifications suitable for the intended specific use.

Claims

1. A wireless device monitoring system for monitoring multiple wireless devices in a monitoring area, characterized in that: include: A plurality of wireless signal receivers are arranged in the area, wherein the plurality of wireless signal receivers are used to collect a plurality of probe requests sent by the plurality of wireless devices during the period; and a processing server, wherein the plurality of wireless signal receivers are connected to the processing server via a network connection, wherein the processing server is used to receive the plurality of detection requests from the plurality of wireless signal receivers via the network connection, The processing server is further configured to determine whether the media access control address of each of the plurality of probe requests is virtual. In response to determining that the media access control addresses of the plurality of first probe requests among the plurality of probe requests are virtual, the processing server is further configured to establish a flow network corresponding to the plurality of first probe requests according to the first information corresponding to the plurality of first probe requests and an associated computing model, The processing server is further configured to group the plurality of first probe requests into a plurality of first probe request sequences according to the flow network by a minimum cost maximum flow method, wherein the plurality of first probe request sequences are determined to correspond to a plurality of first wireless devices among the plurality of wireless devices, respectively, and all first probe requests included in each of the plurality of first probe request sequences are determined to be sent by the same corresponding first wireless device within the period, wherein in response to determining that the media access control addresses of the plurality of second probe requests in the plurality of probe requests are not virtual, the processing server is further configured to identify the plurality of second wireless devices in the plurality of wireless devices corresponding to the plurality of second probe requests, The processing server is further configured to train the association calculation model according to the plurality of second detection requests.

2. The wireless device monitoring system according to claim 1, wherein: The first information includes: Media Access Control Address; Information elements; Serial number; Signal strength; and Transfer time.

3. The wireless device monitoring system as claimed in claim 2, wherein: In the operation of the processing server determining whether the media access control address of each of the plurality of probe requests is virtual, The processing server determines whether the media access control address of each probe request is virtual by identifying the identification bit value of the media access control address of each probe request, When the identification bit value is identified as 0, the processing server determines that the media access control address of the corresponding probe request is not virtual. When the identification bit value is identified as 1, the processing server determines that the media access control address of the corresponding probe request is virtual.

4. The wireless device monitoring system as claimed in claim 3, wherein: Wherein the processing server comprises: A communication circuit unit, used to establish the network connection connected to the plurality of wireless signal receivers; A storage unit, wherein the storage unit stores a plurality of program modules, including: A correlation calculation module; and Contact decision module; and a processor, wherein the processor is used to access and execute the association calculation module and the association decision module, In the operation of the processing server to establish the flow network corresponding to the plurality of first detection requests according to the first information corresponding to the plurality of first detection requests and the associated calculation model, The association calculation module inputs the first information into the association calculation model to calculate multiple association probabilities of each of multiple pairs of first detection requests in the multiple first detection requests. The association decision module establishes the flow network by mapping the plurality of first detection requests to a plurality of nodes in the flow network and setting a plurality of paths between a plurality of pairs of nodes corresponding to the plurality of pairs of first detection requests, wherein the flow costs of the plurality of paths are set by the plurality of association probabilities of the plurality of pairs of first detection requests, wherein the processing server is further configured to group the plurality of first probe requests into the plurality of first probe request sequences according to the flow network via the minimum cost maximum flow method, The connection decision module determines a plurality of flows in the flow network and one or more flow paths passed by the plurality of flows through the plurality of flows via the minimum cost maximum flow method. The contact decision module groups a plurality of first probe requests corresponding to a plurality of nodes included in each flow path of the one or more flow paths into a corresponding first probe request sequence.

5. The wireless device monitoring system as claimed in claim 4, wherein: wherein in the operation of the processing server further for identifying the plurality of second wireless devices corresponding to the plurality of second probe requests among the plurality of wireless devices, the processing server identifies the media access control addresses of the plurality of second probe requests as real media access control addresses, and identifies each of the different plurality of real media access control addresses of the plurality of second probe requests as a unique identifier of one of the plurality of second wireless devices among the plurality of wireless devices, thereby identifying the plurality of second wireless devices corresponding to the plurality of second probe requests, wherein the processing server is further used to train the association calculation model according to the plurality of second detection requests, The processing server groups the plurality of second probe requests into a plurality of second probe request sequences respectively corresponding to the plurality of second wireless devices according to the different plurality of real media access control addresses, wherein the plurality of real media access control addresses of the plurality of second probe requests included in each of the plurality of second probe request sequences are the same, wherein the processing server determines that the plurality of second probe requests included in each of the plurality of second probe request sequences are sequentially associated with each other over time and are sent by the corresponding second wireless device during the period, wherein the second association probabilities of the plurality of pairs of second probe requests in the plurality of second probe requests have been determined by the processing server according to the plurality of second probe request sequences, The processing server inputs the second information corresponding to the multiple second detection requests, the second association probabilities of the multiple pairs of second detection requests in the multiple second detection requests, and the multiple second detection request sequences into the association calculation model to train the association calculation model.

6. The wireless device monitoring system as claimed in claim 4, wherein: wherein the processing server monitors the total number of the first wireless devices in the area during the period by calculating the sum of the plurality of first wireless devices, The processing server identifies the movement tracks of each of the plurality of first wireless devices in the area during the period according to the plurality of first probe request sequences.

7. A wireless device monitoring method for monitoring multiple wireless devices in a monitoring area, characterized in that: include: receiving a plurality of probe requests sent by the plurality of wireless devices during a period; Determining whether a media access control address of each of the plurality of probe requests is virtual; In response to determining that the media access control address of each of the plurality of first probe requests among the plurality of probe requests is virtual, establishing a flow network corresponding to the plurality of first probe requests according to first information corresponding to the plurality of first probe requests and an associated computing model; as well as According to the flow network, the plurality of first probe requests are grouped into a plurality of first probe request sequences by a minimum cost maximum flow method, wherein the plurality of first probe request sequences are determined to correspond to a plurality of first wireless devices among the plurality of wireless devices, respectively, and all the first probe requests included in each of the plurality of first probe request sequences are determined to be sent by the same corresponding first wireless device within the period; and In response to determining that the media access control addresses of respective ones of the plurality of second probe requests in the plurality of probe requests are not virtual, identifying a plurality of second wireless devices in the plurality of wireless devices corresponding to the plurality of second probe requests; as well as The association calculation model is trained according to the plurality of second detection requests.

8. The wireless device monitoring method according to claim 7, wherein: The first information includes: Media Access Control Address; Information elements; Serial number; Signal strength; and Transfer time.

9. The wireless device monitoring method according to claim 8, wherein: The step of determining whether the media access control address of each of the plurality of probe requests is virtual comprises: determining whether the media access control address of each probe request is virtual by identifying an identification bit value of the media access control address of each probe request, When the identification bit value is identified as 0, it is determined that the media access control address of the corresponding probe request is not virtual. When the identification bit value is identified as 1, it is determined that the media access control address of the corresponding probe request is virtual.

10. The wireless device monitoring method according to claim 9, wherein: The step of establishing the flow network corresponding to the plurality of first detection requests according to the first information corresponding to the plurality of first detection requests and the associated calculation model comprises: Inputting the first information into the association calculation model to calculate a plurality of first association probabilities of each of a plurality of pairs of first detection requests in the plurality of first detection requests; as well as The flow network is established by mapping the plurality of first probe requests to a plurality of nodes in the flow network and setting a plurality of paths between a plurality of pairs of nodes corresponding to the plurality of pairs of first probe requests, wherein the flow costs of the plurality of paths are set by the plurality of association probabilities of the plurality of pairs of first probe requests, Wherein, according to the flow network, the step of grouping the plurality of first probe requests into the plurality of first probe request sequences via the minimum cost maximum flow method comprises: determining, via the minimum cost maximum flow method, a plurality of flows within the flow network and one or more flow paths traversed by the plurality of flows; as well as The plurality of first probe requests corresponding to the plurality of nodes included in each flow path of the one or more flow paths are grouped into a corresponding first probe request sequence.

11. The wireless device monitoring method according to claim 10, wherein: The step of identifying the plurality of second wireless devices corresponding to the plurality of second probe requests among the plurality of wireless devices comprises: identifying the media access control addresses of each of the plurality of second probe requests as a real media access control address, and identifying each of the different plurality of real media access control addresses of the plurality of second probe requests as a unique identifier of one of the plurality of second wireless devices in the plurality of wireless devices, thereby identifying the plurality of second wireless devices that respond to the plurality of second probe requests, The step of training the association calculation model according to the plurality of second detection requests comprises: According to the different multiple real media access control addresses, grouping the multiple second probe requests into multiple second probe request sequences respectively corresponding to the multiple second wireless devices, wherein the multiple real media access control addresses of the multiple second probe requests included in each second probe request sequence in the multiple second probe request sequences are the same; determining that the plurality of second probe requests included in each of the plurality of second probe request sequences are sequentially associated with each other over time and are sent by the corresponding second wireless device during the period, wherein second association probabilities of respective pairs of second probe requests in the plurality of second probe request sequences have been determined based on the plurality of second probe request sequences; as well as The second information corresponding to the plurality of second detection requests, the second association probabilities of the plurality of pairs of second detection requests in the plurality of second detection requests, and the plurality of second detection request sequences are input into the association calculation model to train the association calculation model.

12. The wireless device monitoring method according to claim 10, wherein: Also includes: monitoring the total number of the first wireless devices in the area during the period by calculating the sum of the plurality of first wireless devices; as well as According to the plurality of first probe request sequences, movement trajectories of the plurality of first wireless devices in the area during the period are identified.

Images