WiFi pinhole camera detection method based on wireless signal feature analysis

Abstract

The application provides a WiFi pinhole camera detection method based on wireless signal feature analysis, relates to the technical field of wireless signal analysis, and comprises the following steps: collecting wireless signals to obtain a data packet sequence and energy change data, extracting a data packet time sequence feature and an energy feature chain, performing feature fusion analysis through a deep neural network, simultaneously constructing a feature verification network to evaluate credibility, and confirming that a pinhole camera is detected when a device identification coefficient and a feature credibility score both meet preset conditions. The application can effectively identify a hidden WiFi pinhole camera, improve detection accuracy, and reduce the false alarm rate.

Description

Technical Field

[0001] This invention relates to wireless signal analysis technology, and more particularly to a WiFi pinhole camera detection method based on wireless signal feature analysis. Background Technology

[0002] Existing WiFi pinhole camera detection technology has the following defects and shortcomings:

[0003] Existing technologies mainly rely on simple signal strength or traffic analysis, which cannot effectively distinguish the network behavior of pinhole cameras from that of ordinary WiFi devices. Especially in complex network environments, the false positive rate is high and the detection accuracy is insufficient.

[0004] Existing technologies lack in-depth analysis of video data transmission characteristics and fail to fully utilize the periodic features of key frames and non-key frames in video coding, resulting in insufficient feature extraction for pinhole camera identification and difficulty in dealing with various pinhole camera devices.

[0005] Existing technologies generally lack reliable verification mechanisms and cannot assess the credibility of features. In complex and ever-changing wireless channel environments, they are easily affected by environmental interference and signals from other devices, leading to false alarms or missed alarms, making it difficult to meet the reliability requirements in practical applications. Summary of the Invention

[0006] This invention provides a WiFi pinhole camera detection method based on wireless signal feature analysis, which can solve the problems in the prior art.

[0007] A first aspect of the present invention provides a WiFi pinhole camera detection method based on wireless signal feature analysis, comprising:

[0008] Collect wireless signals within the target area and obtain the data packet sequence and energy change data of the wireless signals;

[0009] Based on the data characteristics of video encoding, the data packet sequence is divided into key frame data packets and non-key frame data packets according to the transmission period and size distribution. The occurrence period of the key frame data packets, the duration of the non-key frame data packets, and the size ratio of the key frame data packets to the non-key frame data packets are extracted to establish data packet temporal features that characterize the video data transmission characteristics.

[0010] Extract abrupt change points, gradual change intervals, and periodic fluctuation intervals from the energy change data, and establish an energy feature chain characterizing the working state of the equipment based on the power ramp-up curves of the abrupt change points and the gradual change intervals and the time-series evolution law of the periodic fluctuation intervals.

[0011] The timing features of the data packets and the energy feature chain are fused to generate feature matching coefficients for the device; a deep neural network is used to perform timing analysis on the feature matching coefficients, and the output layer of the deep neural network generates device identification coefficients.

[0012] A feature verification network is constructed, which evaluates the continuous stability of the timing features of the data packets and the channel interference level in the target area, respectively, and generates a feature credibility score.

[0013] When both the device recognition coefficient and the feature credibility score meet the preset conditions, it is confirmed that a pinhole camera has been detected.

[0014] In one alternative implementation,

[0015] Based on the data characteristics of video encoding, the data packet sequence is divided into keyframe data packets and non-keyframe data packets according to the transmission period and size distribution. The steps of extracting the occurrence period of the keyframe data packets, the duration of the non-keyframe data packets, and the size ratio of the keyframe data packets to the non-keyframe data packets to establish the data packet temporal characteristics characterizing the video data transmission characteristics include:

[0016] Extract the transmission time interval of adjacent data packets in the data packet sequence, and determine the transmission period level of the data packets according to the clustering result of the transmission time interval;

[0017] The data packets in the data packet sequence are adaptively classified according to the relationship between the data packet size and the mean and standard deviation of the data packet size. Data packets that are larger than the product of the mean and standard deviation of the data packet size and belong to the same transmission period level are classified as candidate keyframe data packets.

[0018] Calculate the time interval sequence between the candidate keyframe data packets, verify the candidate keyframe data packets based on the consistency of the time interval sequence, determine the candidate keyframe data packets that pass the verification as keyframe data packets, and determine the remaining data packets as non-keyframe data packets;

[0019] Extract the periodic features of the keyframe data packets, including the occurrence period of the keyframe data packets, the coefficient of variation of the occurrence period, and the average size of the keyframe data packets; count the duration and data packet density of non-keyframe data packets located between adjacent keyframe data packets, where the data packet density is the number of non-keyframe data packets within a unit time window;

[0020] An initial time-series feature vector is constructed based on the periodic characteristics, the duration of the non-critical frame data packets, and the data packet density. Multiple initial time-series feature vectors are calculated within a sliding time window, and the mean vector of the multiple initial time-series feature vectors is calculated. The initial time-series feature vectors are weighted according to the degree of deviation between the initial time-series feature vectors and the mean vector to generate the final time-series feature vector, wherein the weight coefficient is inversely proportional to the degree of deviation.

[0021] In one alternative implementation,

[0022] The steps for establishing an energy characteristic chain characterizing the operating state of the equipment based on the abrupt change point, the power ramp-up curve of the gradual change interval, and the time-series evolution law of the periodic fluctuation interval include:

[0023] The energy change data is smoothed, and the smoothed signal is segmented to obtain abrupt change points, gradual change intervals, and periodic fluctuation intervals.

[0024] Extract the energy characteristics of the mutation point, including the mutation amplitude and the mutation duration, and calculate the mutation response characteristics by calculating the ratio of the mutation amplitude to the mutation duration;

[0025] Extract the power ramp-up characteristics of the gradual interval, calculate the first time constant and the first amplitude coefficient characterizing the initial power supply characteristics, and calculate the second time constant and the second amplitude coefficient characterizing the activation characteristics of the image acquisition module.

[0026] The power change sequence of the periodic fluctuation range is obtained, the amplitude distribution characteristics of the power change sequence are calculated, the power change sequence is segmented based on the amplitude distribution characteristics, the time-series change characteristics of each segment are extracted, time-frequency analysis is performed on the power change sequence to obtain a time-frequency feature map, the dominant frequency component and phase evolution law of the periodic fluctuation are extracted based on the time-frequency feature map, the energy concentration degree of the dominant frequency component and the stability index of the phase evolution law are calculated, and the correspondence between environmental load and power response is established according to the time-series change characteristics, the energy concentration degree and the stability index, and the basic power value and power response coefficient are calculated.

[0027] Based on the mutation response characteristics, the first time constant, the first amplitude coefficient, the second time constant, the second amplitude coefficient, the base power value, and the power response coefficient, an energy characteristic chain is established, which characterizes the energy change process of the device from the initial state to the stable operating state.

[0028] In one alternative implementation,

[0029] The steps of fusing the timing features of the data packets and the energy feature chain to generate feature matching coefficients for the device include:

[0030] Normalized time-series features are obtained by preprocessing the temporal features of data packets;

[0031] Calculate the time-dimensional coupling coefficient, frequency-dimensional coupling coefficient, and phase-dimensional coupling coefficient of the normalized time-series features and energy feature chain. The time-dimensional coupling coefficient characterizes the consistency of the feature change rate, the frequency-dimensional coupling coefficient characterizes the correlation of the spectral density, and the phase-dimensional coupling coefficient characterizes the stability of the phase difference. Construct a feature correlation matrix based on the time-dimensional coupling coefficient, frequency-dimensional coupling coefficient, and phase-dimensional coupling coefficient.

[0032] A dual-stream feature extraction network is constructed to extract features from the normalized temporal features and the energy feature chain, generating a temporal feature mapping matrix and an energy feature mapping matrix;

[0033] The temporal feature mapping matrix and the energy feature mapping matrix are cross-calculated and weighted with the feature association matrix to obtain cross-attention weights; the temporal feature mapping matrix and the energy feature mapping matrix are enhanced according to the cross-attention weights, and the enhanced features are aligned and fused to obtain fused features;

[0034] The dynamic confidence level is calculated based on the gradient change of the fused feature, and the feature matching coefficient is generated based on the similarity between the fused feature and the reference feature and the dynamic confidence level.

[0035] In one alternative implementation,

[0036] The step of using a deep neural network to perform time-series analysis on the feature matching coefficients, and generating device recognition coefficients from the output layer of the deep neural network, includes:

[0037] Temporal statistical features are generated based on the temporal sequence of the feature matching coefficient; based on the temporal statistical features, the feature stability score is calculated, a multi-scale memory pool is constructed to store feature patterns at different time scales, and the update weight of the memory pool is determined according to the feature stability score, wherein the update weight is inversely proportional to the feature stability score.

[0038] The time series is processed by a deep neural network to extract time series features to obtain a time series feature vector. The similarity between the time series feature vector and the feature patterns stored in the multi-scale memory pool is calculated, and the optimal memory feature is selected based on the similarity.

[0039] The anomaly score is obtained by calculating the Mahalanobis distance between the temporal feature vector and its mean. The anomaly score is then mapped to a suppression weight. The suppression weight is multiplied by the temporal feature vector to obtain a suppressed feature vector. Attention is then performed on the suppressed feature vector to obtain device operating mode features. Steady-state weights are calculated based on the gradient values ​​of the temporal feature vector. Finally, the steady-state weights are multiplied by the device operating mode features to obtain enhanced device features.

[0040] Evaluation indicators are constructed based on historical identification results, and the update amount is calculated based on the gradient of the evaluation indicators to adaptively adjust the decision threshold.

[0041] The optimal memory features, the enhanced device features, and the steady-state weights are concatenated and nonlinearly transformed. The device recognition score is calculated using a multilayer perceptron. The device recognition coefficient is generated based on the decision threshold and the device recognition score.

[0042] In one alternative implementation,

[0043] The steps for constructing a multi-scale memory pool and dynamically storing and updating feature patterns include:

[0044] The time scale is divided into three levels: short-term, medium-term, and long-term. The sampling period of each level is dynamically adjusted based on the feature change rate, and time-series statistical features of each level are collected. Feature patterns are extracted from the time-series statistical features, and the temporal consistency and frequency domain correlation of the feature patterns are calculated. Based on the temporal consistency and frequency domain correlation, a feature stability score is generated.

[0045] The information entropy of the feature stability score is calculated, and the capacity of each level of memory pool is determined based on the information entropy. When the information entropy increases, the memory pool capacity is expanded, and when the information entropy decreases, the memory pool capacity is compressed.

[0046] The update weight is calculated based on the feature stability score. The update weight is inversely proportional to the feature stability score. At the same time, the similarity between the feature pattern and the pattern already stored in the memory pool is calculated to obtain the difference score. The similarity between the feature pattern and the current working state feature is calculated to obtain the representativeness score. The difference score and the representativeness score are used as adjustment factors for the update weight.

[0047] Record the access time and usage frequency of the feature pattern, calculate the timeliness score based on the access time and usage frequency, and release the memory pool storage space when the timeliness score is lower than a preset score threshold.

[0048] In one alternative implementation,

[0049] The steps of constructing a feature verification network, which evaluates the sustained stability of the data packet temporal features and the channel interference level in the target area, and generating a feature confidence score include:

[0050] The temporal features of the data packets are input into a multi-scale feature extraction layer, which contains convolutional kernels with different receptive fields. Multi-scale features are obtained by extracting features from the temporal features of the data packets. The coefficient of variation and autocorrelation coefficient of the multi-scale features are calculated to construct a stability matrix. A weighted stability score is calculated based on the stability matrix.

[0051] A WiFi channel interference feature library is established, which includes channel overlap feature templates, multipath interference feature templates, and concurrent transmission feature templates. Channel state information of the target area is extracted, and a first matching degree between the channel state information and the channel overlap feature template, a second matching degree between the channel state information and the multipath interference feature template, and a third matching degree between the channel state information and the concurrent transmission feature template are calculated. Based on the first matching degree, the second matching degree, and the third matching degree, a channel interference degree score is calculated.

[0052] A dual-branch feature verification network is constructed to extract the temporal feature vector of the data packet temporal feature and the energy feature vector of the channel state information, respectively. The mutual information of the temporal feature vector and the energy feature vector is calculated, an attention matrix is ​​constructed, and a feature consistency score is calculated based on the mutual information and the attention matrix.

[0053] The weighted stability score, the channel interference score, and the feature consistency score are weighted and fused to obtain the feature credibility score.

[0054] When both the device recognition coefficient and the feature confidence score meet preset conditions, the step of confirming the detection of a pinhole camera includes:

[0055] When the device identification coefficient is greater than the adaptive threshold calculated based on historical detection accuracy, and the feature credibility score meets the minimum credibility requirement, a pinhole camera is confirmed to have been detected, and a threat level score is calculated based on the device identification coefficient and the feature credibility score.

[0056] A second aspect of the present invention provides an electronic device, comprising:

[0057] processor;

[0058] Memory used to store processor-executable instructions;

[0059] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0060] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0061] This invention achieves effective detection of WiFi pinhole cameras by analyzing wireless signal characteristics, and has the following beneficial effects:

[0062] This invention extracts temporal features such as keyframe period, non-keyframe duration, and their ratio from data packet sequences. It then constructs an energy feature chain by combining abrupt changes, gradual transitions, and periodic fluctuations in energy change data. This enables precise characterization of video transmission characteristics and effectively improves the recognition accuracy of pinhole cameras.

[0063] This invention employs a deep neural network to perform time-series analysis on the fused feature matching coefficients, and evaluates the stability of the data packet timing features and the degree of channel interference through a feature verification network, thus constructing a dual verification mechanism that significantly reduces the false alarm rate and improves the reliability of the detection system.

[0064] This invention does not rely on specific protocols or hardware devices; it can achieve non-contact detection of pinhole cameras based solely on wireless signal analysis. It is characterized by its ease of operation and wide applicability, and provides an effective technical means to protect personal information security. Attached Figure Description

[0065] Figure 1 This is a flowchart illustrating the WiFi pinhole camera detection method based on wireless signal feature analysis according to an embodiment of the present invention.

[0066] Figure 2 This is a diagram of the architecture for timing analysis of WiFi pinhole cameras based on deep neural networks. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0069] Figure 1This is a flowchart illustrating the WiFi pinhole camera detection method based on wireless signal feature analysis, as described in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0070] Collect wireless signals within the target area and obtain the data packet sequence and energy change data of the wireless signals;

[0071] Based on the data characteristics of video encoding, the data packet sequence is divided into key frame data packets and non-key frame data packets according to the transmission period and size distribution. The occurrence period of the key frame data packets, the duration of the non-key frame data packets, and the size ratio of the key frame data packets to the non-key frame data packets are extracted to establish data packet temporal features that characterize the video data transmission characteristics.

[0072] Extract abrupt change points, gradual change intervals, and periodic fluctuation intervals from the energy change data, and establish an energy feature chain characterizing the working state of the equipment based on the power ramp-up curves of the abrupt change points and the gradual change intervals and the time-series evolution law of the periodic fluctuation intervals.

[0073] The timing features of the data packets and the energy feature chain are fused to generate feature matching coefficients for the device; a deep neural network is used to perform timing analysis on the feature matching coefficients, and the output layer of the deep neural network generates device identification coefficients.

[0074] A feature verification network is constructed, which evaluates the continuous stability of the timing features of the data packets and the channel interference level in the target area, respectively, and generates a feature credibility score.

[0075] When both the device recognition coefficient and the feature credibility score meet the preset conditions, it is confirmed that a pinhole camera has been detected.

[0076] In an optional implementation, based on the data characteristics of video encoding, the data packet sequence is divided into keyframe data packets and non-keyframe data packets according to the transmission period and size distribution. The steps of extracting the occurrence period of the keyframe data packets, the duration of the non-keyframe data packets, and the size ratio of the keyframe data packets to the non-keyframe data packets to establish data packet temporal characteristics characterizing video data transmission include:

[0077] Extract the transmission time interval of adjacent data packets in the data packet sequence, and determine the transmission period level of the data packets according to the clustering result of the transmission time interval;

[0078] The data packets in the data packet sequence are adaptively classified according to the relationship between the data packet size and the mean and standard deviation of the data packet size. Data packets that are larger than the product of the mean and standard deviation of the data packet size and belong to the same transmission period level are classified as candidate keyframe data packets.

[0079] Calculate the time interval sequence between the candidate keyframe data packets, verify the candidate keyframe data packets based on the consistency of the time interval sequence, determine the candidate keyframe data packets that pass the verification as keyframe data packets, and determine the remaining data packets as non-keyframe data packets;

[0080] Extract the periodic features of the keyframe data packets, including the occurrence period of the keyframe data packets, the coefficient of variation of the occurrence period, and the average size of the keyframe data packets; count the duration and data packet density of non-keyframe data packets located between adjacent keyframe data packets, where the data packet density is the number of non-keyframe data packets within a unit time window;

[0081] An initial time-series feature vector is constructed based on the periodic characteristics, the duration of the non-critical frame data packets, and the data packet density. Multiple initial time-series feature vectors are calculated within a sliding time window, and the mean vector of the multiple initial time-series feature vectors is calculated. The initial time-series feature vectors are weighted according to the degree of deviation between the initial time-series feature vectors and the mean vector to generate the final time-series feature vector, wherein the weight coefficient is inversely proportional to the degree of deviation.

[0082] For example, in the data transmission process of video encoding, key frame and non-key frame data packets have obvious temporal and size characteristics. This embodiment provides a method for adaptively identifying these characteristics and constructing a temporal feature vector.

[0083] For the acquired video data packet sequence, the time difference between every two adjacent data packets is calculated to obtain the transmission time interval sequence. For example, for a sequence containing 1000 data packets, 999 time interval values ​​can be obtained. These time interval values ​​are then subjected to K-means clustering with a cluster size of 3, resulting in three transmission cycle levels: high, medium, and low. Assuming the clustering results show that the time intervals are concentrated around 5ms, 20ms, and 40ms, the transmission cycle levels can be classified into three categories: high frequency (5ms), medium frequency (20ms), and low frequency (40ms).

[0084] Adaptive classification of data packet size is based on statistical characteristics. The mean and standard deviation of the entire data packet sequence are calculated; for example, the mean is 800 bytes and the standard deviation is 300 bytes. A threshold is set as the product of the mean and standard deviation, i.e., 800 × 300 = 240,000. Each data packet is evaluated; if its size exceeds the threshold and it belongs to the same transmission cycle level (e.g., low-frequency class), it is classified as a candidate keyframe data packet. In this way, a preliminary set of possible keyframe data packets can be selected; for example, 25 candidate keyframe data packets can be selected from 1000 data packets.

[0085] Calculate the time interval sequence between all candidate keyframe data packets, for example, obtaining the interval sequence [1200ms, 1205ms, 1195ms, 1210ms...]. Calculate the mean and standard deviation of this sequence; for example, the mean is 1200ms and the standard deviation is 10ms. Define the coefficient of variation as the ratio of the standard deviation to the mean; in this example, it is 10 / 1200 = 0.0083. Set a threshold of 0.1; when the coefficient of variation is less than this threshold, the time intervals are considered consistent. Candidate keyframe data packets that do not conform to time consistency are eliminated; for example, 3 abnormal packets are eliminated from the previously screened 25 candidate packets, ultimately determining 22 data packets as keyframe data packets, and the remaining 978 as non-keyframe data packets.

[0086] The periodic feature extraction of keyframe data packets includes calculating the occurrence period, coefficient of variation, and mean size. The occurrence period is the average time interval between adjacent keyframe data packets, such as 1200ms; the coefficient of variation of the occurrence period is the ratio of the standard deviation of the time interval to the mean, such as 0.0083; the mean size of the keyframe data packets is the average size of all keyframe data packets, such as 1500 bytes.

[0087] Non-critical frame data packet characteristics include duration and packet density. Duration refers to the time required for the transmission of non-critical frame data packets between two adjacent critical frame data packets, which can be calculated from the time difference between the last and first non-critical frames, such as 950ms. Packet density refers to the number of non-critical frame data packets per unit time, such as an average of 4.5 packets per 100ms.

[0088] An initial feature vector [1200, 0.0083, 1500, 950, 4.5] is constructed using the keyframe occurrence period (1200ms), coefficient of variation (0.0083), average keyframe size (1500 bytes), duration of non-keyframes (950ms), and packet density (4.5). Multiple initial temporal feature vectors are calculated using a sliding time window. The window size is set to 10 seconds, and the sliding step is 1 second. The window slides across the entire packet sequence, calculating one initial feature vector at each window position. Assume a total of 20 initial feature vectors are calculated. The mean vector of the 20 initial feature vectors is calculated, such as [1210, 0.0085, 1520, 960, 4.6]. For each initial feature vector, its Euclidean distance from the mean vector is calculated as the degree of deviation. For example, if the deviation of the first initial feature vector is 15.2, its weight coefficient is set to 1 / 15.2 = 0.0658. All initial feature vectors are weighted and averaged according to their weight coefficients to obtain the final time series feature vector [1215, 0.0084, 1510, 955, 4.55].

[0089] This invention determines the transmission cycle level by introducing clustering analysis based on transmission time intervals, and achieves accurate keyframe identification by combining adaptive classification based on data packet size. Simultaneously, it effectively improves the robustness of data packet temporal features by utilizing a weighted fusion mechanism of multiple feature vectors within a sliding time window. This method not only accurately captures the periodic characteristics of video data transmission but also adapts to changes in data packet transmission temporalities caused by network environment fluctuations, providing reliable basic features for subsequent feature analysis.

[0090] In one optional implementation, the step of establishing an energy characteristic chain characterizing the device's operating state based on the abrupt change point, the power ramp-up curve of the gradual change interval, and the time-series evolution law of the periodic fluctuation interval includes:

[0091] The energy change data is smoothed, and the smoothed signal is segmented to obtain abrupt change points, gradual change intervals, and periodic fluctuation intervals.

[0092] Extract the energy characteristics of the mutation point, including the mutation amplitude and the mutation duration, and calculate the mutation response characteristics by calculating the ratio of the mutation amplitude to the mutation duration;

[0093] Extract the power ramp-up characteristics of the gradual interval, calculate the first time constant and the first amplitude coefficient characterizing the initial power supply characteristics, and calculate the second time constant and the second amplitude coefficient characterizing the activation characteristics of the image acquisition module.

[0094] The power change sequence of the periodic fluctuation range is obtained, the amplitude distribution characteristics of the power change sequence are calculated, the power change sequence is segmented based on the amplitude distribution characteristics, the time-series change characteristics of each segment are extracted, time-frequency analysis is performed on the power change sequence to obtain a time-frequency feature map, the dominant frequency component and phase evolution law of the periodic fluctuation are extracted based on the time-frequency feature map, the energy concentration degree of the dominant frequency component and the stability index of the phase evolution law are calculated, and the correspondence between environmental load and power response is established according to the time-series change characteristics, the energy concentration degree and the stability index, and the basic power value and power response coefficient are calculated.

[0095] Based on the mutation response characteristics, the first time constant, the first amplitude coefficient, the second time constant, the second amplitude coefficient, the base power value, and the power response coefficient, an energy characteristic chain is established, which characterizes the energy change process of the device from the initial state to the stable operating state.

[0096] For example, signal smoothing is performed on the collected energy change data. A moving average filter is used to process the raw energy data, with the filter window size set to 10 data points. For instance, for power data with a sampling rate of 100Hz, moving average filtering can effectively eliminate high-frequency noise and retain the main trend of energy change. After smoothing, a slope change detection algorithm is used to segment the signal, identifying points where the power change exceeds a threshold (e.g., 20W / s) as abrupt change points, intervals where the power rises or falls slowly as gradual change intervals, and intervals where the power exhibits periodic fluctuations as periodic fluctuation intervals. For example, during the camera's power-on process, three abrupt change points, two gradual change intervals, and one periodic fluctuation interval may be detected.

[0097] For detected abrupt changes, their energy characteristics are extracted, including the magnitude and duration of the change. The magnitude of the change is calculated as the power difference before and after the change; for example, a change from 50W to 120W results in a magnitude of 70W. The duration of the change is the time required for the power to stabilize after the initial change, such as 0.5 seconds. By calculating the ratio of the magnitude to the duration of the change, the abrupt response characteristic is obtained, which reflects the device's response speed to power changes. For example, a device with a abrupt response characteristic of 140W / s indicates a fast power response.

[0098] For power ramp-up characteristic analysis in the gradual transition range, the power data in the gradual transition range needs to be segmented. During the device startup phase, two distinct gradual transition processes can be observed: the initial power supply phase and the image acquisition module activation phase. For the initial power supply phase, power data from 0-2 seconds after power-on is selected, and a sliding window is used for data smoothing, with the window size set to 50ms. The smoothed power data is arranged according to time series, and the power rise curve is analyzed using an exponential fitting method. Specifically, the time required for the power to rise from 10% to 90% is selected as the first time constant, which is typically between 0.5 and 1.2 seconds; the ratio of the final stable power value to the theoretical maximum power value is used as the first amplitude coefficient, which is typically between 0.6 and 0.8. For example, for a certain model of pinhole camera, the first time constant in the initial power supply phase is 0.8 seconds, and the first amplitude coefficient is 0.75. For the image acquisition module activation phase, power data from 2-5 seconds is selected for analysis. First, the power data is denoised using a median filter to eliminate abnormal fluctuations, with the filter window size set to 100ms. Then, the rise characteristics of the power curve are analyzed. The time from power startup to stabilization is used as the second time constant, which is typically between 1.0 and 1.5 seconds. The ratio of the stable power value to the expected power value is used as the second amplitude coefficient, which is typically between 0.6 and 0.7. For example, the second time constant for the activation phase of the image acquisition module is 1.2 seconds, and the second amplitude coefficient is 0.65.

[0099] In the analysis of periodic fluctuation intervals, the power change sequence under stable operating conditions of the equipment is obtained. Statistical analysis is performed on the power data, calculating statistical characteristics such as mean, standard deviation, skewness, and kurtosis over a 10-second period. For example, the mean power fluctuation of a certain equipment under stable operating conditions is 150W, the standard deviation is 5W, the skewness is 0.2, and the kurtosis is 2.8. Based on these statistical characteristics, a density-based clustering algorithm is used to segment the power sequence, classifying the power level into high, medium, and low levels. Temporal features are extracted from the power data at each level, including the power rise time duration, steady-state duration, and fall time duration. For example, in the high-load segment, the rise time duration is 0.3 seconds, the steady-state duration is 2.5 seconds, and the fall time duration is 0.4 seconds. Short-time Fourier transform is used to perform time-frequency analysis on the power change sequence, with a window length of 1 second and an overlap rate of 50%. The generated time-frequency feature map reflects the frequency characteristics of the power change, from which the main frequency components can be identified. Pinhole cameras typically exhibit characteristic frequencies, such as a 2Hz primary frequency component corresponding to the image processing cycle and a 5Hz secondary frequency component corresponding to autofocus. The energy percentage of the primary frequency component is calculated as an energy concentration index; for example, 0.85 indicates that 85% of the energy is concentrated on the primary frequency component. The variance of the phase sequence is calculated as a stability index; a smaller variance (e.g., 0.12) indicates stable phase changes.

[0100] Based on the above analysis, a mapping relationship between environmental load and power response is established. The base power value is defined as the power consumption of the equipment when it is running under no-load, such as 120W. The power response coefficient represents the power increment caused by a unit increase in load, such as 0.25W / unit load.

[0101] Finally, the sudden change response characteristics (140W / s), time constants (0.8 seconds and 1.2 seconds), amplitude coefficients (0.75 and 0.65), base power value (120W), and power response coefficient (0.25W / unit load) are combined in chronological order to form an energy characteristic chain. That is, these characteristics are constructed into a feature vector according to the time sequence of sudden change characteristics, initial power supply characteristics, image acquisition module activation characteristics, and stable operation characteristics during the device startup phase. The complete working state of the device is reflected through the chronological relationship between the characteristics.

[0102] Existing WiFi device detection technologies primarily rely on static information such as MAC addresses, RSSI signal strength, and packet header features for identification, or employ simple power threshold detection methods. These technologies are easily interfered with in complex electromagnetic environments and struggle to distinguish between ordinary WiFi devices and pinhole cameras. This application does not rely on the static characteristics of the device but instead establishes a dynamic feature model by analyzing the complete energy change process of the device from startup to stable operation. A dual time constant model is introduced to characterize the initial power supply characteristics and the activation characteristics of the image acquisition module, respectively, and the dominant frequency component and phase evolution law of the periodic fluctuation range are extracted through time-frequency analysis. This method can capture the unique energy change patterns of pinhole cameras, especially the energy characteristics of the image sensor and video processing module, achieving accurate identification of pinhole cameras at the energy level. This invention significantly improves the accuracy and robustness of pinhole camera detection. Through energy feature chain analysis, the system can effectively distinguish between ordinary WiFi devices and pinhole cameras, achieving accurate identification even when the device employs camouflage techniques. The method's resistance to environmental interference is greatly enhanced, maintaining stable performance even in complex electromagnetic environments.

[0103] In one optional implementation, the step of fusing the data packet timing features and the energy feature chain to generate the device feature matching coefficients includes:

[0104] Normalized time-series features are obtained by preprocessing the temporal features of data packets;

[0105] Calculate the time-dimensional coupling coefficient, frequency-dimensional coupling coefficient, and phase-dimensional coupling coefficient of the normalized time-series features and energy feature chain. The time-dimensional coupling coefficient characterizes the consistency of the feature change rate, the frequency-dimensional coupling coefficient characterizes the correlation of the spectral density, and the phase-dimensional coupling coefficient characterizes the stability of the phase difference. Construct a feature correlation matrix based on the time-dimensional coupling coefficient, frequency-dimensional coupling coefficient, and phase-dimensional coupling coefficient.

[0106] A dual-stream feature extraction network is constructed to extract features from the normalized temporal features and the energy feature chain, generating a temporal feature mapping matrix and an energy feature mapping matrix;

[0107] The temporal feature mapping matrix and the energy feature mapping matrix are cross-calculated and weighted with the feature association matrix to obtain cross-attention weights; the temporal feature mapping matrix and the energy feature mapping matrix are enhanced according to the cross-attention weights, and the enhanced features are aligned and fused to obtain fused features;

[0108] The dynamic confidence level is calculated based on the gradient change of the fused feature, and the feature matching coefficient is generated based on the similarity between the fused feature and the reference feature and the dynamic confidence level.

[0109] For example, when preprocessing the temporal features of data packets, a min-max normalization method is used to map the original temporal features to the interval [0, 1]. Specifically, for each element in the original temporal features, the minimum value in the feature sequence is subtracted, and then divided by the difference between the maximum and minimum values ​​in the feature sequence. For example, if the original temporal features are [120, 85, 260, 180, 310], with a minimum value of 85 and a maximum value of 310, then the normalized temporal features are [0.156, 0, 0.778, 0.422, 1]. This normalization process can eliminate the influence of different feature dimensions, making subsequent feature fusion more accurate.

[0110] The coupling coefficient between normalized time-series features and the energy feature chain is calculated from three dimensions: time, frequency, and phase. The time-dimensional coupling coefficient characterizes the consistency of the feature change rate, obtained by calculating the similarity of the change trends of the two types of features within a time window. For example, setting the time window size to 100ms, the difference sequences of the normalized time-series features and the energy feature chain within the window are calculated. If the dot product of the two difference sequences is positive and large, it indicates that the change trends are consistent, and the coupling coefficient is close to 1; if the dot product is negative and the absolute value is large, it indicates that the change trends are opposite, and the coupling coefficient is close to -1. The frequency-dimensional coupling coefficient characterizes the correlation of spectral density, obtained by calculating the correlation of the spectral density distribution after performing a frequency domain transformation on the two types of features. For example, applying a fast Fourier transform to the normalized time-series features and the energy feature chain, obtaining the frequency components, and then calculating the cross-correlation coefficient between the two, this coefficient ranges between [-1, 1], with a larger value indicating a higher spectral correlation. The phase-dimensional coupling coefficient characterizes the stability of the phase difference, obtained by calculating the variance of the phase difference between the two types of features at different times. For example, extract the phase information of two types of features and calculate the standard deviation of the phase difference sequence. If the standard deviation is small (e.g., less than 0.2), it indicates that the phase difference is stable and the coupling coefficient is close to 1; if the standard deviation is large (e.g., greater than 0.8), it indicates that the phase difference is unstable and the coupling coefficient is close to 0.

[0111] A feature correlation matrix is ​​constructed based on the coupling coefficients of the three dimensions mentioned above. This matrix is ​​a three-dimensional tensor with dimensions of time length × number of features × 3, where 3 represents the coupling coefficients of the three dimensions. For example, for a time series sequence and an energy feature chain of length 1000, with 10 features per sequence, the constructed feature correlation matrix would have dimensions of 1000 × 10 × 3.

[0112] The dual-stream feature extraction network comprises two parallel feature extraction branches, processing temporal and energy features respectively. Each branch consists of multiple convolutional and pooling layers to extract multi-scale features. For example, the temporal feature branch contains three convolutional layers with kernel sizes of 3×3, 5×5, and 7×7, each followed by a max-pooling layer. The energy feature branch also contains three convolutional layers with the same kernel size, but the weights are not shared. These two branches generate temporal feature mapping matrices and energy feature mapping matrices, respectively. Both matrices have the same dimension, such as 128×64, where 128 represents the number of feature channels and 64 represents the sequence length.

[0113] Cross-attention weights are obtained by cross-calculating the temporal feature mapping matrix and the energy feature mapping matrix and then weighting them with the feature association matrix. Cross-calculation involves calculating the similarity between each channel of one matrix and each channel of the other matrix to obtain an attention score between channels. For example, calculating the cosine similarity between the i-th channel of the temporal feature mapping matrix and the j-th channel of the energy feature mapping matrix yields a value of 0.85, indicating a high correlation between the two channels. These attention scores are then weighted and averaged with the coupling coefficients at corresponding positions in the feature association matrix to generate the final cross-attention weights.

[0114] Feature enhancement is performed on the matrix based on cross-attention weights. The attention weights are multiplied by the original feature mapping matrix to enhance the representation of important feature channels and suppress the influence of unimportant channels. For example, for a channel with a weight of 0.9, 90% of the original feature values ​​are retained; for a channel with a weight of 0.2, only 20% of the original feature values ​​are retained. The enhanced features are then aligned and fused, using a channel cascading approach to combine the two types of features into a fused feature. For example, the enhanced temporal feature mapping matrix and energy feature mapping matrix both have a dimension of 128×64, while the fused feature has a dimension of 256×64.

[0115] Dynamic confidence is calculated based on the gradient changes of the fused features. Gradient change refers to the distribution of the rate of change of the fused features over time. When the gradient change is stable and there are no abrupt changes, it indicates that the feature extraction and fusion process is stable, and the confidence is high. When there are abrupt gradient changes, it indicates that there may be anomalies or interference, and the confidence decreases. For example, when calculating the gradient sequence of the fused features over time, if the standard deviation of the gradient sequence is less than a preset threshold of 0.1, the dynamic confidence is 0.95; if the standard deviation is greater than 0.5, the dynamic confidence decreases to 0.6.

[0116] A reference feature library is constructed, containing feature templates of known pinhole camera devices under different operating conditions. Specifically, data from multiple known pinhole cameras in typical scenarios is collected, and standard feature templates are generated and stored in the reference feature library through the same feature extraction and fusion process. For example, the feature library contains feature templates of 100 different models of pinhole cameras under 5 typical operating conditions. The cosine similarity between the current fused feature and all reference feature templates in the feature library is calculated, and the value with the highest similarity is selected as the initial matching score, such as 0.88. This initial matching score is multiplied by a dynamic confidence level (such as 0.95) to obtain the final feature matching coefficient, such as 0.88 × 0.95 = 0.836. The closer the feature matching coefficient is to 1, the higher the feature matching degree between the current device and the known pinhole cameras in the feature library.

[0117] This invention employs a dual-stream feature extraction network and a cross-attention mechanism to achieve deep fusion of packet temporal features and energy feature chains. By calculating the coupling coefficients in the time, frequency, and phase dimensions, a feature correlation matrix is ​​constructed, ensuring the preservation of important information and suppression of noise during feature fusion. This method can fully exploit the correlation between the two types of features, improving the accuracy and reliability of feature matching.

[0118] In one optional implementation, a deep neural network is used to perform time-series analysis on the feature matching coefficients, and the step of generating device recognition coefficients from the output layer of the deep neural network includes:

[0119] Temporal statistical features are generated based on the temporal sequence of the feature matching coefficient; based on the temporal statistical features, the feature stability score is calculated, a multi-scale memory pool is constructed to store feature patterns at different time scales, and the update weight of the memory pool is determined according to the feature stability score, wherein the update weight is inversely proportional to the feature stability score.

[0120] The time series is processed by a deep neural network to extract time series features to obtain a time series feature vector. The similarity between the time series feature vector and the feature patterns stored in the multi-scale memory pool is calculated, and the optimal memory feature is selected based on the similarity.

[0121] The anomaly score is obtained by calculating the Mahalanobis distance between the temporal feature vector and its mean. The anomaly score is then mapped to a suppression weight. The suppression weight is multiplied by the temporal feature vector to obtain a suppressed feature vector. Attention is then performed on the suppressed feature vector to obtain device operating mode features. Steady-state weights are calculated based on the gradient values ​​of the temporal feature vector. Finally, the steady-state weights are multiplied by the device operating mode features to obtain enhanced device features.

[0122] Evaluation indicators are constructed based on historical identification results, and the update amount is calculated based on the gradient of the evaluation indicators to adaptively adjust the decision threshold.

[0123] The optimal memory features, the enhanced device features, and the steady-state weights are concatenated and nonlinearly transformed. The device recognition score is calculated using a multilayer perceptron. The device recognition coefficient is generated based on the decision threshold and the device recognition score.

[0124] Figure 2This is an architecture diagram of a WiFi pinhole camera temporal analysis system based on a deep neural network. For example, a temporal sequence of feature matching coefficients is collected, and the mean, standard deviation, and skewness of this sequence are calculated to generate temporal statistical features. Taking the detection of a WiFi pinhole camera as an example, a 30-second temporal sequence of feature matching coefficients is collected, with data points [0.72, 0.75, 0.73, 0.71, 0.74, 0.76, 0.75, 0.77, 0.76, 0.78], etc. The calculated mean is 0.75, the standard deviation is 0.021, and the skewness is 0.15. Based on the above temporal statistical features, a feature stability score is calculated. Specifically, the coefficient of variation is calculated, i.e., the standard deviation divided by the mean, resulting in 0.028. The smaller the coefficient of variation, the higher the feature stability. Next, a multi-scale memory pool is constructed to store feature patterns at different time scales. This memory pool includes short-term memory units, medium-term memory units, and long-term memory units. The update weights of the memory pool are determined based on the feature stability score, and the update weights are inversely proportional to the feature stability score. In the actual implementation, when the feature stability score is 0.028, the corresponding update weights are 0.9 for short-term memory units, 0.6 for medium-term memory units, and 0.3 for long-term memory units.

[0125] The time-series sequence is input into a deep neural network for feature extraction. This deep neural network contains convolutional layers and recurrent layers. The convolutional layers consist of 16 3×1 convolutional kernels to extract local temporal features; the recurrent layers consist of 64 LSTM units to capture long-term dependencies. After network processing, a 128-dimensional temporal feature vector is obtained.

[0126] The similarity calculation between the temporal feature vector and the feature patterns stored in the multi-scale memory pool uses the cosine similarity method. For each feature pattern in the memory unit, the similarity with the current temporal feature vector is calculated. For example, the similarity with the feature pattern in the short-term memory unit is 0.92, the similarity with the feature pattern in the medium-term memory unit is 0.85, and the similarity with the feature pattern in the long-term memory unit is 0.78. Based on the similarity, the optimal memory feature is selected. In this example, the feature pattern in the short-term memory unit is selected as the optimal memory feature.

[0127] Subsequently, the Mahalanobis distance between the temporal feature vector and its mean is calculated to obtain the anomaly score. Specifically, the mean vector of the feature vector is first calculated, and then the Mahalanobis distance between the current feature vector and the mean vector is calculated, resulting in an anomaly score of 0.35. The anomaly score is converted into a suppression weight using a mapping function, which involves subtracting the anomaly score from 1, resulting in a suppression weight of 0.65. The suppression weight is multiplied by the temporal feature vector to obtain the suppressed feature vector. This step aims to reduce the influence of anomalous features and enhance the expression of stable features. The specific implementation of attention calculation on the suppressed feature vector includes three steps: First, the autocorrelation score of each element in the feature vector is calculated by performing a dot product operation between the feature vector and itself to obtain the correlation matrix between elements; second, the correlation matrix is ​​normalized to obtain the attention weight matrix; finally, the attention weight matrix is ​​used to weight the feature vector. For WiFi pinhole cameras, higher weights are preset for the data packet periodicity index (0.4), the transmission volume mutation index (0.3), and the duration index (0.3). The weighted result forms a feature vector representing the device's operating mode. The gradient value of the time-series feature vector is calculated along the time dimension; a smaller gradient value indicates a more stable device operating state. The gradient value is then converted into steady-state weights using a mapping function; in this example, the steady-state weights are 0.82. These steady-state weights are multiplied by the device operating mode features to obtain the enhanced device features. The purpose of this step is to enhance the feature representation under stable operating conditions, thereby improving the accuracy of recognition.

[0128] The results of the past 100 identifications are recorded, and precision and recall are calculated. The current precision is 0.95, and recall is 0.92. The update amount is calculated based on the gradient of the evaluation metrics. When precision decreases, the decision threshold is increased; when recall decreases, the decision threshold is decreased. In this way, the decision threshold is adaptively adjusted, and the current decision threshold is adjusted to 0.78.

[0129] The optimal memory features, enhanced device features, and steady-state weights are concatenated and nonlinearly transformed. Feature concatenation connects the three feature vectors dimensionally to form a longer feature vector. The nonlinear transformation uses the ReLU activation function to enhance the expressive power of the features. A device recognition score is calculated using a multilayer perceptron, which contains three hidden layers with 256, 128, and 64 nodes respectively. The input is the concatenated feature vector, and the output is a recognition score between 0 and 1; the current recognition score is 0.86. Based on a decision threshold of 0.78 and a device recognition score of 0.86, a device recognition coefficient is generated. When the recognition score is greater than the decision threshold, the device recognition coefficient is 1, indicating that a target device has been detected; otherwise, it is 0.

[0130] Traditional equipment identification methods mainly rely on static features or simple statistical features, such as mean and standard deviation, lacking in-depth analysis of the temporal variation patterns of these features. This invention proposes a deep temporal analysis method based on a multi-scale memory pool and adaptive feature enhancement. The core innovation lies in constructing a three-layer memory structure (short-term, medium-term, and long-term) to achieve multi-scale storage and dynamic updating of feature patterns; introducing an anomaly suppression mechanism based on Mahalanobis distance and a steady-state enhancement mechanism based on gradient values, significantly improving the robustness of feature extraction; and designing an adaptive decision threshold adjustment strategy, enabling the system to automatically optimize the judgment criteria based on historical identification results. This method not only focuses on the features themselves but also emphasizes the temporal evolution patterns of the features. Through the analysis of feature stability, anomalies, and consistency, it achieves accurate identification of equipment operating modes.

[0131] In one alternative implementation, the steps of constructing a multi-scale memory pool and dynamically storing and updating feature patterns include:

[0132] The time scale is divided into three levels: short-term, medium-term, and long-term. The sampling period of each level is dynamically adjusted based on the feature change rate, and time-series statistical features of each level are collected. Feature patterns are extracted from the time-series statistical features, and the temporal consistency and frequency domain correlation of the feature patterns are calculated. Based on the temporal consistency and frequency domain correlation, a feature stability score is generated.

[0133] The information entropy of the feature stability score is calculated, and the capacity of each level of memory pool is determined based on the information entropy. When the information entropy increases, the memory pool capacity is expanded, and when the information entropy decreases, the memory pool capacity is compressed.

[0134] The update weight is calculated based on the feature stability score. The update weight is inversely proportional to the feature stability score. At the same time, the similarity between the feature pattern and the pattern already stored in the memory pool is calculated to obtain the difference score. The similarity between the feature pattern and the current working state feature is calculated to obtain the representativeness score. The difference score and the representativeness score are used as adjustment factors for the update weight.

[0135] Record the access time and usage frequency of the feature pattern, calculate the timeliness score based on the access time and usage frequency, and release the memory pool storage space when the timeliness score is lower than a preset score threshold.

[0136] For example, the time scale is divided into three levels: short-term, medium-term, and long-term. The short-term level corresponds to data within the most recent 5 minutes, the medium-term level corresponds to data from 5 minutes to 2 hours, and the long-term level corresponds to data from 2 hours to 24 hours. The feature change rate is obtained by calculating the difference between feature vectors within adjacent time windows. When the feature change rate is high, the sampling frequency is increased; when the feature change rate is low, the sampling frequency is decreased. For example, when detecting WiFi pinhole cameras, if the feature change rate in the short term is 0.15 (rapid change), the sampling period for the short-term level is set to 10 seconds; if the feature change rate in the medium term is 0.08 (moderate change), the sampling period for the medium-term level is set to 30 seconds; and if the feature change rate in the long term is 0.03 (slow change), the sampling period for the long-term level is set to 2 minutes.

[0137] At each sampling point, temporal statistical features are collected, including mean, standard deviation, skewness, and kurtosis. Taking the energy characteristics of a WiFi pinhole camera as an example, the temporal statistical features of a certain sampling point are: mean 0.72, standard deviation 0.08, skewness 0.25, and kurtosis 2.86. Feature extraction is performed on these temporal statistical features to obtain feature patterns. Feature extraction uses dimensionality reduction techniques to transform high-dimensional temporal statistical features into low-dimensional feature patterns. Temporal consistency is obtained by calculating the average similarity between the current feature pattern and the feature patterns within the past N time windows. Frequency domain correlation is obtained by calculating the autocorrelation function of the feature pattern in the frequency domain. For the pinhole camera, the temporal consistency at a certain moment is 0.85 (relatively high, indicating relatively stable temporal domain), and the frequency domain correlation is 0.78 (relatively high, indicating relatively stable frequency domain). The weighted average of temporal consistency and frequency domain correlation, with weights of 0.6 and 0.4 respectively, yields a feature stability score of 0.82.

[0138] The feature stability scores are discretized by uniformly dividing the [0, 1] interval into 10 sub-intervals, and the probability distribution of feature stability scores falling into each sub-interval is statistically analyzed. Information entropy is calculated based on the probability distribution. Higher information entropy indicates a more uniform distribution of feature stability scores, while lower information entropy indicates a more concentrated distribution. For example, if the feature stability score distribution over a certain period is [0.05, 0.08, 0.12, 0.15, 0.18, 0.20, 0.12, 0.06, 0.03, 0.01], the corresponding information entropy is 2.15. Increased information entropy indicates greater feature fluctuation, requiring an expansion of the memory pool to store more feature patterns; decreased information entropy indicates more stable features, requiring a reduction in the memory pool capacity to save storage resources. In the specific implementation, the basic capacity of the short-term memory pool is 100 feature patterns, the basic capacity of the medium-term memory pool is 200 feature patterns, and the basic capacity of the long-term memory pool is 500 feature patterns. When the information entropy is 2.15 (high), the capacity of the memory pool at each level is expanded to 120, 240 and 600 feature patterns, respectively.

[0139] The update weight is calculated based on the feature stability score, which is inversely proportional to the feature stability score. It is obtained by subtracting the feature stability score from 1 and then normalizing the result. For example, when the feature stability score is 0.82, the initial update weight is 0.18. Simultaneously, the similarity between the feature pattern and the patterns already stored in the memory pool is calculated to obtain a difference score. A higher difference score indicates that the current feature pattern contains more new information. In a specific implementation, for a certain feature pattern, if the similarity with the most similar pattern in the memory pool is 0.65, then the difference score is 0.35. The similarity between the feature pattern and the current working state features is calculated to obtain a representativeness score. A higher representativeness score indicates that the feature pattern is more representative of the current working state. For example, if the similarity between a certain feature pattern and the current working state features is 0.88, then the representativeness score is 0.88. The initial update weight is multiplied by the difference score and the representativeness score, with weights of 0.3 and 0.7 respectively, resulting in a final update weight of 0.18×(0.3×0.35+0.7×0.88)=0.124.

[0140] The system records the access time and usage frequency of feature patterns. Access time refers to the timestamp of the most recent access to the feature pattern, and usage frequency refers to the number of times the feature pattern has been accessed within a certain period. A timeliness score is calculated based on access time and usage frequency. The timeliness score calculation considers a time decay factor; as time goes on, the timeliness score of a feature pattern gradually decreases; the higher the usage frequency, the higher the timeliness score. For example, if a feature pattern was last accessed 2 hours ago and has a usage frequency of 10 times / day, the calculated timeliness score is 0.45. When the timeliness score falls below a preset score threshold (e.g., 0.3), the memory pool storage space is released, and the feature pattern is deleted.

[0141] This invention effectively solves the temporal scale adaptability problem in device identification by constructing a multi-scale memory pool and realizing dynamic storage and updating of feature patterns. Multi-level time division enables the simultaneous capture of short-term, medium-term, and long-term feature changes, while dynamically adjusted sampling periods improve adaptability to different rates of change. A memory management mechanism based on feature stability, variability, representativeness, and timeliness achieves efficient utilization of memory resources, improving identification performance and adaptability in complex and changing environments, and providing reliable technical support for device identification based on temporal features.

[0142] In one optional implementation, a feature verification network is constructed, which evaluates the sustained stability of the data packet timing features and the channel interference level in the target area, respectively, and the step of generating a feature credibility score includes:

[0143] The temporal features of the data packets are input into a multi-scale feature extraction layer, which contains convolutional kernels with different receptive fields. Multi-scale features are obtained by extracting features from the temporal features of the data packets. The coefficient of variation and autocorrelation coefficient of the multi-scale features are calculated to construct a stability matrix. A weighted stability score is calculated based on the stability matrix.

[0144] A WiFi channel interference feature library is established, which includes channel overlap feature templates, multipath interference feature templates, and concurrent transmission feature templates. Channel state information of the target area is extracted, and a first matching degree between the channel state information and the channel overlap feature template, a second matching degree between the channel state information and the multipath interference feature template, and a third matching degree between the channel state information and the concurrent transmission feature template are calculated. Based on the first matching degree, the second matching degree, and the third matching degree, a channel interference degree score is calculated.

[0145] A dual-branch feature verification network is constructed to extract the temporal feature vector of the data packet temporal feature and the energy feature vector of the channel state information, respectively. The mutual information of the temporal feature vector and the energy feature vector is calculated, an attention matrix is ​​constructed, and a feature consistency score is calculated based on the mutual information and the attention matrix.

[0146] The weighted stability score, the channel interference score, and the feature consistency score are weighted and fused to obtain the feature credibility score.

[0147] For example, in constructing a feature verification network, a multi-scale feature extraction layer is first designed. This layer contains multiple convolutional kernels with different receptive fields, such as 3×3, 5×5, and 7×7 kernels. After the temporal features of the data packets are input into this layer, each convolutional kernel performs a convolution operation on the input features to obtain feature maps at different scales. In a specific implementation, 16 3×3 convolutional kernels, 8 5×5 convolutional kernels, and 4 7×7 convolutional kernels can be designed, with the ReLU function chosen as the activation function. For the extracted multi-scale features, their coefficient of variation is calculated, which is the standard deviation divided by the mean. For example, for the temporal features of a certain data packet, the extracted feature vector is [0.32, 0.35, 0.31, 0.33, 0.34], with a mean of 0.33, a standard deviation of 0.015, and a coefficient of variation of 0.045. Simultaneously, the autocorrelation coefficient is calculated to reflect the correlation of features at different time points. Based on the calculation results, a stability matrix is ​​constructed, where each element of the matrix represents the stability score of a specific feature at a specific scale. For the above case, a 3×5 stability matrix can be constructed, where rows represent different convolution kernel sizes and columns represent different feature dimensions. After obtaining the stability matrix, weights are set according to the importance of features at different scales. For example, features extracted by 3×3, 5×5, and 7×7 convolution kernels are assigned weights of 0.5, 0.3, and 0.2, respectively, and the weighted stability score is calculated.

[0148] The WiFi channel interference feature library contains three types of feature templates: channel overlap feature templates, multipath interference feature templates, and concurrent transmission feature templates. The channel overlap feature template contains a spectral overlap feature vector, such as [0.8, 0.6, 0.4, 0.2, 0.1], representing the degree of overlap in different frequency bands. The multipath interference feature template contains delay and energy attenuation features, such as a delay feature vector of [2.5, 3.1, 4.2, 5.0] nanoseconds and an energy attenuation feature vector of [0.7, 0.5, 0.3, 0.2]. The concurrent transmission feature template contains a collision probability feature vector, such as [0.1, 0.3, 0.5, 0.7, 0.9], representing the collision probability under different loads. Channel state information of the target area is obtained using a spectrum analyzer, and its spectral features, delay features, and collision features are extracted. The matching degree between the extracted channel state information and each template in the feature library is calculated. For example, if the spectral feature vector of the target region is [0.75, 0.55, 0.45, 0.25, 0.15], its cosine similarity with the channel overlap feature template is calculated to be 0.98, yielding the first matching degree. Similarly, the matching degrees of delay features and collision features with their corresponding templates are calculated, yielding the second matching degree of 0.85 and the third matching degree of 0.76. Based on the three matching degrees, the channel interference level score is calculated. A weighted average method can be used, assigning weights of 0.4, 0.3, and 0.3 to the three matching degrees respectively, resulting in a comprehensive channel interference level score of 0.872.

[0149] When constructing a dual-branch feature verification network, one branch processes the temporal features of data packets, while the other branch processes channel state information. In the temporal feature branch, a one-dimensional convolutional network is used to extract temporal feature vectors. The network contains three convolutional layers: the first layer has 16 kernels, the second layer has 32 kernels, and the third layer has 64 kernels, ultimately yielding a 128-dimensional temporal feature vector. In the channel state information branch, an energy detector is used to extract energy features, including spectral energy distribution and temporal energy variation, resulting in a 128-dimensional energy feature vector. Mutual information between the two feature vectors is calculated to reflect the correlation between the two features. The mutual information value is obtained by calculating the joint probability distribution and marginal probability distribution of the feature vectors. For example, a mutual information value of 0.65 indicates a strong correlation between the two features. An attention matrix is ​​constructed to emphasize important features. The attention matrix is ​​128×128, and each element represents the attention weight of the corresponding dimension of the temporal feature vector and the energy feature vector. Based on the mutual information and the attention matrix, a feature consistency score is calculated, ranging from 0 to 1, with a higher value indicating higher consistency.

[0150] Finally, the weighted stability score, channel interference score, and feature consistency score are weighted and fused to generate a feature reliability score. The weights for the three scores are set to 0.35, 0.35, and 0.3, respectively. For the above case, assuming a weighted stability score of 0.92, a channel interference score of 0.872, and a feature consistency score of 0.78, the feature reliability score is 0.92 × 0.35 + 0.872 × 0.35 + 0.78 × 0.3 = 0.863. This score is used to evaluate the reliability of the feature and provides a reliability reference for subsequent perception tasks.

[0151] Existing technologies typically employ a single statistical indicator (such as analysis of variance) to assess feature stability, or simply use signal-to-noise ratio (SNR) to evaluate channel quality. These methods are inadequate for handling complex interference factors in WiFi environments, such as channel overlap, multipath effects, and concurrent transmission. This invention proposes a multi-dimensional feature verification network, designing a multi-scale feature extraction layer. It captures feature stability at different time scales using convolutional kernels with different receptive fields, forming a stability matrix for comprehensive evaluation. A WiFi channel interference feature library containing three templates—channel overlap, multipath interference, and concurrent transmission—is established, enabling refined identification of interference factors in complex wireless environments. A dual-branch feature verification network is constructed, calculating the mutual information between temporal feature vectors and energy feature vectors to assess feature consistency. This multi-dimensional, multi-level feature verification mechanism comprehensively evaluates feature reliability and effectively distinguishes between inherent device feature fluctuations and feature changes caused by environmental interference. This invention significantly improves the reliability of WiFi pinhole camera detection, maintaining high accuracy under various interference environments and effectively reducing false alarm and false negative rates, especially performing exceptionally well in densely populated WiFi device areas and complex building environments.

[0152] In an optional implementation, when both the device identification coefficient and the feature confidence score meet preset conditions, the step of confirming the detection of a pinhole camera includes:

[0153] When the device identification coefficient is greater than the adaptive threshold calculated based on historical detection accuracy, and the feature credibility score meets the minimum credibility requirement, a pinhole camera is confirmed to have been detected, and a threat level score is calculated based on the device identification coefficient and the feature credibility score.

[0154] For example, it is determined whether the device recognition coefficient is greater than an adaptive threshold calculated based on historical detection accuracy. The calculation of the adaptive threshold takes into account the accuracy of historical detection results and dynamically adjusts the judgment criteria through the accuracy index. In specific implementation, the accuracy of the most recent 100 tests is recorded, including the number of true positives, false positives, true negatives, and false negatives, and the detection accuracy is calculated.

[0155] For example, in the most recent 100 tests, 45 real pinhole cameras were successfully identified (true positives), 5 false positives were detected, 48 non-pinhole camera devices were correctly excluded (true negatives), and 2 false negatives were missed. Based on this data, the accuracy was calculated to be 0.9, the precision to be 0.9, and the recall to be 0.96. An adaptive threshold was calculated based on these metrics. When the accuracy is high, the threshold is appropriately lowered to improve detection sensitivity; when the accuracy is low, the threshold is increased to reduce false positives. In this example, the adaptive threshold was calculated to be 0.75.

[0156] In the current detection, the device recognition coefficient is 0.83, which is greater than the adaptive threshold of 0.75, thus satisfying the first judgment condition. Next, it is checked whether the feature confidence score meets the minimum confidence requirement. The minimum confidence requirement is preset according to the security level of the application scenario. Higher security level scenarios have higher minimum confidence requirements, while general scenarios have lower minimum confidence requirements. In this example, the application scenario is a hotel room, and the preset minimum confidence requirement is 0.7.

[0157] The current feature confidence score is 0.78, which is greater than the minimum confidence requirement of 0.7, thus meeting the second criterion. Therefore, the detection of a pinhole camera has been confirmed, and the threat level assessment phase has commenced.

[0158] The threat level score is calculated using a weighted average, taking into account both the device identification coefficient and the feature credibility score. The device identification coefficient has a weight of 0.6, and the feature credibility score has a weight of 0.4. In this example, the threat level score is calculated as 0.83 × 0.6 + 0.78 × 0.4 = 0.81.

[0159] Threat levels are categorized into five levels: very low risk (0-0.2), low risk (0.2-0.4), medium risk (0.4-0.6), high risk (0.6-0.8), and very high risk (0.8-1.0). The current threat level score is 0.81, which falls under the very high risk category. This will trigger the highest level alert and provide a preliminary estimate of the device's likely location.

[0160] In practical applications, the current detection results will also be recorded, including device recognition coefficient, feature confidence score, threat level score, and detection time. This information will be used for subsequent adaptive threshold updates and performance evaluation.

[0161] This invention effectively solves the accuracy and reliability problems in pinhole camera detection by introducing dual judgment criteria and an adaptive threshold mechanism. The combined judgment of device recognition coefficient and feature credibility score ensures both accurate matching of target device features and the credibility of the detection results.

[0162] A second aspect of the present invention provides an electronic device, comprising:

[0163] processor;

[0164] Memory used to store processor-executable instructions;

[0165] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0166] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0167] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0168] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A WiFi pinhole camera detection method based on wireless signal feature analysis, characterized in that, include: Collect wireless signals within the target area and obtain the data packet sequence and energy change data of the wireless signals; Based on the data characteristics of video encoding, the data packet sequence is divided into key frame data packets and non-key frame data packets according to the transmission period and size distribution. The occurrence period of the key frame data packets, the duration of the non-key frame data packets, and the size ratio of the key frame data packets to the non-key frame data packets are extracted to establish data packet temporal features that characterize the video data transmission characteristics. Extract abrupt change points, gradual change intervals, and periodic fluctuation intervals from the energy change data, and establish an energy feature chain characterizing the working state of the equipment based on the power ramp-up curves of the abrupt change points and the gradual change intervals and the time-series evolution law of the periodic fluctuation intervals. The process of fusing the data packet timing features and the energy feature chain to generate feature matching coefficients for the device includes: preprocessing the data packet timing features to obtain normalized timing features; calculating the time dimension coupling coefficient, frequency dimension coupling coefficient, and phase dimension coupling coefficient between the normalized timing features and the energy feature chain to construct a feature association matrix; constructing a dual-stream feature extraction network to extract features from the normalized timing features and the energy feature chain to generate a timing feature mapping matrix and an energy feature mapping matrix; and performing cross-calculation between the timing feature mapping matrix and the energy feature mapping matrix and adding them to the feature association matrix. The system calculates cross-attention weights; it then enhances the temporal feature mapping matrix and the energy feature mapping matrix based on these weights, aligns and fuses the enhanced features to obtain fused features; it calculates dynamic confidence based on the gradient changes of the fused features, and generates feature matching coefficients based on the similarity between the fused features and reference features and the dynamic confidence; it performs temporal analysis on the feature matching coefficients using a deep neural network, and the output layer of the deep neural network generates device recognition coefficients, including: generating temporal statistical features based on the temporal sequence of the feature matching coefficients; and calculating based on the temporal statistical features. A feature stability score is obtained, and a multi-scale memory pool is constructed to store feature patterns at different time scales. The update weight of the memory pool is determined based on the feature stability score, and the update weight is inversely proportional to the feature stability score. Temporal features are extracted from the time-series sequence using a deep neural network to obtain a temporal feature vector. The similarity between the temporal feature vector and the feature patterns stored in the multi-scale memory pool is calculated, and the optimal memory feature is selected based on the similarity. The Mahalanobis distance between the temporal feature vector and its mean is calculated to obtain an anomaly score, which is then mapped to a suppression weight. The suppression weight is multiplied by the temporal feature vector to obtain the suppressed feature. Feature vector; attention calculation is performed on the suppressed feature vector to obtain device operating mode features, and steady-state weights are calculated based on the gradient values ​​of the temporal feature vectors; the steady-state weights are multiplied by the device operating mode features to obtain enhanced device features; an evaluation index is constructed based on historical recognition results, and the update amount is calculated based on the gradient of the evaluation index to adaptively adjust the decision threshold; the optimal memory features, the enhanced device features, and the steady-state weights are concatenated and nonlinearly transformed, and the device recognition score is calculated through a multilayer perceptron; the device recognition coefficient is generated based on the decision threshold and the device recognition score. A feature verification network is constructed, which evaluates the continuous stability of the timing features of the data packets and the channel interference level in the target area, respectively, and generates a feature credibility score. When both the device recognition coefficient and the feature credibility score meet the preset conditions, it is confirmed that a pinhole camera has been detected.

2. The method according to claim 1, characterized in that, Based on the data characteristics of video encoding, the data packet sequence is divided into keyframe data packets and non-keyframe data packets according to the transmission period and size distribution. The steps of extracting the occurrence period of the keyframe data packets, the duration of the non-keyframe data packets, and the size ratio of the keyframe data packets to the non-keyframe data packets to establish the data packet temporal characteristics characterizing the video data transmission characteristics include: Extract the transmission time interval of adjacent data packets in the data packet sequence, and determine the transmission period level of the data packets according to the clustering result of the transmission time interval; The data packets in the data packet sequence are adaptively classified according to the relationship between the data packet size and the mean and standard deviation of the data packet size. Data packets that are larger than the product of the mean and standard deviation of the data packet size and belong to the same transmission period level are classified as candidate keyframe data packets. Calculate the time interval sequence between the candidate keyframe data packets, verify the candidate keyframe data packets based on the consistency of the time interval sequence, determine the candidate keyframe data packets that pass the verification as keyframe data packets, and determine the remaining data packets as non-keyframe data packets; Extract the periodic features of the keyframe data packets, which include the occurrence period of the keyframe data packets, the coefficient of variation of the occurrence period, and the mean size of the keyframe data packets, wherein the coefficient of variation of the occurrence period is the ratio of the standard deviation of the time interval to the mean; count the duration and data packet density of non-keyframe data packets located between adjacent keyframe data packets, wherein the data packet density is the number of non-keyframe data packets within a unit time window. An initial time-series feature vector is constructed based on the periodic characteristics, the duration of the non-critical frame data packets, and the data packet density. Multiple initial time-series feature vectors are calculated within a sliding time window, and the mean vector of the multiple initial time-series feature vectors is calculated. The initial time-series feature vectors are weighted according to the degree of deviation between the initial time-series feature vectors and the mean vector to generate the final time-series feature vector, wherein the weight coefficient of each initial time-series feature vector is inversely proportional to the degree of deviation.

3. The method according to claim 1, characterized in that, The steps for establishing an energy characteristic chain characterizing the operating state of the equipment based on the abrupt change point, the power ramp-up curve of the gradual change interval, and the time-series evolution law of the periodic fluctuation interval include: Extract the energy characteristics of the mutation point, including the mutation amplitude and the mutation duration, and calculate the mutation response characteristics by calculating the ratio of the mutation amplitude to the mutation duration; Extract the power ramp-up characteristics of the gradual interval, calculate the first time constant and the first amplitude coefficient characterizing the initial power supply characteristics, and calculate the second time constant and the second amplitude coefficient characterizing the activation characteristics of the image acquisition module. The power change sequence of the periodic fluctuation range is obtained, the amplitude distribution characteristics of the power change sequence are calculated, the power change sequence is segmented based on the amplitude distribution characteristics, the time-series change characteristics of each segment are extracted, time-frequency analysis is performed on the power change sequence to obtain a time-frequency feature map, the dominant frequency component and phase evolution law of the periodic fluctuation are extracted based on the time-frequency feature map, the energy concentration degree of the dominant frequency component and the stability index of the phase evolution law are calculated, and the basic power value and power response coefficient characterizing the power consumption of the equipment during no-load operation are calculated based on the time-series change characteristics, the energy concentration degree and the stability index. Based on the mutation response characteristics, the first time constant, the first amplitude coefficient, the second time constant, the second amplitude coefficient, the base power value, and the power response coefficient, an energy characteristic chain is established, which characterizes the energy change process of the device from the initial state to the stable operating state.

4. The method according to claim 1, characterized in that, The steps of fusing the timing features of the data packets and the energy feature chain to generate feature matching coefficients for the device include: The time-dimensional coupling coefficient characterizes the consistency of the characteristic change rate, the frequency-dimensional coupling coefficient characterizes the correlation of the spectral density, and the phase-dimensional coupling coefficient characterizes the stability of the phase difference.

5. The method according to claim 1, characterized in that, The steps for constructing a multi-scale memory pool and dynamically storing and updating feature patterns include: The time scale is divided into three levels: short-term, medium-term, and long-term. The feature change rate of the feature matching coefficients within adjacent time windows is calculated. The feature change rate is obtained by calculating the difference between the time-series statistical feature vectors within adjacent time windows. The sampling period of each level is dynamically adjusted based on the feature change rate, and time-series statistical features of each level are collected. Feature patterns are extracted from the time-series statistical features. The temporal consistency and frequency-domain correlation of the feature patterns are calculated. A feature stability score is generated based on the temporal consistency and frequency-domain correlation. The information entropy of the feature stability score is calculated, and the capacity of each level of memory pool is determined based on the information entropy. When the information entropy increases, the memory pool capacity is expanded, and when the information entropy decreases, the memory pool capacity is compressed. The update weight is calculated based on the feature stability score. The update weight is inversely proportional to the feature stability score. At the same time, the similarity between the feature pattern and the pattern already stored in the memory pool is calculated to obtain the difference score. The similarity between the feature pattern and the current working state feature is calculated to obtain the representativeness score. The difference score and the representativeness score are used as adjustment factors for the update weight. Record the access time and usage frequency of the feature pattern, calculate the timeliness score based on the access time and usage frequency, and release the memory pool storage space when the timeliness score is lower than a preset score threshold.

6. The method according to claim 1, characterized in that, The steps of constructing a feature verification network, which evaluates the sustained stability of the data packet temporal features and the channel interference level in the target area, and generating a feature confidence score include: The temporal features of the data packets are input into a multi-scale feature extraction layer, which contains convolutional kernels with different receptive fields. Multi-scale features are obtained by extracting features from the temporal features of the data packets. The coefficient of variation and autocorrelation coefficient of the multi-scale features are calculated to construct a stability matrix. A weighted stability score is calculated based on the stability matrix. A WiFi channel interference feature library is established, which includes channel overlap feature templates, multipath interference feature templates, and concurrent transmission feature templates. Channel state information of the target area is extracted, and a first matching degree between the channel state information and the channel overlap feature template, a second matching degree between the channel state information and the multipath interference feature template, and a third matching degree between the channel state information and the concurrent transmission feature template are calculated. Based on the first matching degree, the second matching degree, and the third matching degree, a channel interference degree score is calculated. A dual-branch feature verification network is constructed to extract the temporal feature vector of the data packet temporal feature and the energy feature vector of the channel state information, respectively. The mutual information of the temporal feature vector and the energy feature vector is calculated, an attention matrix is ​​constructed, and a feature consistency score is calculated based on the mutual information and the attention matrix. The weighted stability score, the channel interference score, and the feature consistency score are weighted and fused to obtain the feature credibility score.

7. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

8. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images