Rapid intrusion monitoring method based on WiFi channel state information differential energy field and pruning filtering

Abstract

The invention discloses a rapid intrusion monitoring method based on a WiFi channel state information differential energy field and trimming filtering, and belongs to the technical field of wireless communication perception and Internet of Things monitoring. The invention provides a lightweight intrusion sensing strategy for solving the problem that an existing sensing method based on WiFi channel state information is large in computing power demand. Firstly, channel state information is obtained; then amplitude difference square operation is carried out on adjacent frames, a difference energy field is constructed, multiple subcarriers in a single frame are aggregated, and a single-frame energy sequence is obtained; secondly, a pruning average filtering method is adopted, maximum and minimum values of an energy sequence in a sliding window are removed, only the middle part is reserved, averaging is carried out, and the robustness of the system is enhanced; and finally, the first effective energy value is multiplied by a fixed value and locked as a threshold value, and instant-on and instant-use intrusion detection is realized. Experimental results show that the method is simple in calculation, quick in response and suitable for edge calculation and low-power-consumption real-time monitoring of the gateway of the Internet of Things.

Description

Technical Field

[0001] This invention belongs to the field of wireless communication sensing and Internet of Things monitoring technology, specifically relating to a fast intrusion detection method based on WiFi channel state information differential energy field and pruning filtering. Background Technology

[0002] With the increasing demand for indoor security and intelligent monitoring, sensing technologies based on WiFi Channel State Information (CSI) have become an important research direction in the field of wireless sensing due to their characteristics such as no need for wearable devices, ability to sense across walls, and non-intrusive privacy. In complex indoor multipath electromagnetic environments, CSI can capture subtle disturbances in the spatial electromagnetic field caused by human activity, providing a physical basis for achieving low-cost, highly covert environmental intrusion detection.

[0003] Existing channel state information-based sensing schemes mostly rely on phase calibration or high-dimensional time-frequency analysis methods such as short-time Fourier transform and continuous wavelet transform. While these methods perform well in laboratory environments, they still face significant challenges in practical engineering applications. On the one hand, high-dimensional feature extraction involves complex complex number operations and large-scale transformations, consuming enormous computing resources from edge hardware such as embedded gateways, making it difficult to achieve low-latency real-time monitoring. On the other hand, traditional smoothing algorithms such as moving averages often struggle to effectively eliminate extreme value interference when faced with impulsive burst noise or signal jumps generated by WiFi hardware, resulting in poor system detection robustness. Furthermore, most existing algorithms typically require a long environmental adaptive learning period to establish a static benchmark, leading to excessively long listening preparation time after system startup, failing to meet the demand for rapid, ready-to-use responses.

[0004] Therefore, how to design a sensing method that can simplify processing logic, efficiently construct differential energy fields using only amplitude characteristics with higher computational stability, and achieve instantaneous reference locking while filtering out sudden interference, so as to realize lightweight, robust and fast-responding real-time intrusion detection on a low-power hardware platform, is a key problem that needs to be solved in the field of radio frequency sensing and IoT monitoring. Summary of the Invention

[0005] To address the problems mentioned in the background, this invention proposes a fast intrusion detection method based on WiFi channel state information differential energy field and pruning filtering. The core of this invention lies in constructing a time-domain energy field from the channel state information of the original radio frequency signal by performing amplitude difference square operations on adjacent frames, and combining this with a pruning average filtering strategy that eliminates extreme proportions to achieve highly sensitive capture of environmental disturbances. This method does not require complex complex transformations or deep learning models; it can achieve instantaneous reference locking and highly robust intrusion triggering solely based on amplitude features. The specific technical solution is as follows:

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A fast sensing strategy based on hardware-level drivers and differential energy characteristics:

[0008] Step 1: Obtain channel state information for a specific MAC address within a specific channel using the wireless network card. This process only extracts the complex matrix of channel state information reflecting the characteristics of the spatial electromagnetic environment at the physical layer. The algorithm logic does not involve decrypting, reading, or storing the content of the original communication data packets, thus ensuring the security of sensitive information and data privacy of legitimate communication users from the underlying mechanism while sensing the environment.

[0009] Step 2: Constructing the energy field based on the difference between adjacent frames. The acquired complex channel state information data is decoupled into amplitude information. The amplitude vectors of the channel state information at adjacent time points are subtracted, and the difference values ​​are squared and scaled. The formula is as follows: ,in The energy value in the time domain. and These are the CSI amplitude vectors at adjacent time points, and Scale is a scaling factor used to map channel fluctuations to a preset numerical range. This step effectively eliminates static multipath interference and hardware DC offset in the environment through differential operations, converting the original signal into a differential energy field characterizing spatial dynamic changes.

[0010] Step 3: Multi-carrier energy feature aggregation. For the constructed differential energy field, the differential energy values ​​of all subcarriers are summed within a single frame time to obtain the original energy scalar sequence characterizing the intensity of indoor electromagnetic disturbance at that moment.

[0011] Step 4: Trimmed average filtering based on extreme ratio rejection. The length is set to... A sliding window is used to sort the energy sequences within the window in ascending order. The maximum value set accounting for no less than 30% and the minimum value set accounting for no less than 30% are strictly removed. The average of the remaining middle stable energy sequences is then calculated to obtain the smoothed environmental energy characterization value.

[0012] Step 5: Instantaneous Reference Locking and Dynamic Threshold Setting. The system skips the hardware instability period during initial device startup and directly locks the first effective smoothed energy value generated after filtering as the static environmental reference; a fixed ratio is set as the detection threshold based on this reference. This step achieves "out-of-the-box" rapid self-calibration without the need for lengthy environmental learning.

[0013] Step 6: Real-time Intrusion Detection and Early Warning. The subsequently generated real-time smoothed energy value is compared with the locked detection threshold. If the current energy value exceeds the threshold, it is determined that an intrusion has occurred in the indoor environment, triggering a system early warning.

[0014] Compared with the prior art, the beneficial effects of the present invention are:

[0015] First, this invention provides a sensing scheme with extremely high privacy protection characteristics. Compared with traditional camera surveillance or microphone eavesdropping, this invention utilizes physical layer amplitude perturbations of radio frequency signals during spatial propagation to construct an energy field, without recording sensitive biometric information such as images, videos, or voice. Since the algorithm only processes channel response statistics rather than communication load data, it achieves high-sensitivity intrusion detection while maintaining "zero intrusion" on user privacy and "zero leakage" of communication content, greatly reducing the legal and ethical compliance risks of security systems.

[0016] Secondly, this invention achieves extremely simple and efficient feature representation and anti-interference performance. By constructing a differential energy field, complex radio signal characteristics are transformed into intuitive spatial disturbance intensity, avoiding costly complex number transformation operations. Combined with a high-ratio trimming filter logic of "30%-40%-30%", this invention can directly eliminate the inherent pulse spike noise of WiFi hardware at the algorithm level, giving the detector extremely strong anti-interference capability and robustness against environmental disturbances.

[0017] Finally, this invention boasts significant real-time performance and hardware friendliness. Leveraging the algorithm's immediate threshold locking, the system eliminates the need for lengthy environmental adaptive learning, achieving a "plug-and-play" millisecond-level response speed. This lightweight logic allows the algorithm to be seamlessly deployed on computationally limited embedded IoT gateways or edge computing nodes, providing an innovative approach to large-scale, low-power real-time indoor security monitoring that balances privacy protection and detection efficiency. Attached Figure Description

[0018] Figure 1 This is a flowchart of the fast intrusion detection process based on WiFi channel state information differential energy field and trimming filter in this application;

[0019] Figure 2 These are the amplitude waterfall plot and phase waterfall plot of the intrusion detection of this invention;

[0020] Figure 3 This invention provides a differential amplitude waterfall chart for intrusion detection and an intrusion detection threshold determination chart. Detailed Implementation

[0021] To facilitate understanding of the technical content of this invention by those skilled in the art, the invention will be further described in detail below with reference to the accompanying drawings and specific examples. It should be understood that the specific examples described herein are merely illustrative and not intended to limit the scope of the invention.

[0022] Implementation Examples

[0023] This embodiment provides a fast intrusion detection method based on WiFi channel state information differential energy field and pruning filtering. The specific implementation steps are shown in Figure 1, and the main process includes:

[0024] 1. Construction of radio frequency eavesdropping environment and collection of channel state information for privacy and security

[0025] By collaborating with the hardware platform and the underlying driver, a non-intrusive sensing environment is established. This process only extracts the complex matrix of channel state information at the physical layer, without involving the decryption and reading of user communication payload data. This hardware mechanism ensures that the sensing process does not leak any user communication data, thus protecting privacy and security.

[0026] 2. Construction and aggregation of differential squared feature fields of channel state information

[0027] For the acquired complex channel state information sequence (Where t is the frame index and k is the subcarrier index), the energy features are constructed through the following steps:

[0028] Amplitude decoupling: Extracting the instantaneous amplitude of each subcarrier .

[0029] Differential squaring operation: Calculates the amplitude difference between adjacent frames and performs square scaling to construct the differential energy field.

[0030]

[0031] Where Scale is the scaling factor. The instantaneous amplitude for each subcarrier, This is differential energy. This method is used to map weak channel fluctuations to a more manageable numerical range.

[0032] Feature aggregation: The differential energy of all subcarriers within a single frame is summed to obtain the environmental energy feature value at the current moment. This effectively reduces the multidimensional channel characteristics to a one-dimensional energy index that reflects spatial disturbances.

[0033] 3. Robust trimming filter based on two-terminal extremum suppression logic

[0034] To eliminate the impulse noise interference inherent in WiFi hardware, this embodiment employs a trimmed averaging algorithm that eliminates extreme proportions:

[0035] Sliding window construction: Set a sliding window of length L to cache continuous energy feature values. .

[0036] Extreme value elimination strategy: Sort the data in the window in ascending order, strictly eliminate the largest 30% of observations (to deal with sudden impulse interference) and the smallest 30% of observations (to deal with deep signal fading), and retain only the middle 40% of the most stable sampling points.

[0037] Smoothing representation: Calculate the arithmetic mean of the remaining 40% of points as the smoothed energy output at the current time. This step greatly enhances the system's robustness to non-environmental disturbance noise.

[0038] 4. Instantaneous reference locking and real-time intrusion detection

[0039] To meet the requirement of "ready to use immediately", this embodiment designs a triggering mechanism with zero learning cycle:

[0040] Start-up protection period: The system skips the hardware gain adjustment period and waits for the filter to generate the first effective smooth point.

[0041] Reference instantaneous locking: The first smoothed energy value generated by filtering is directly defined as the static environment reference B.

[0042] Fixed threshold setting: Set the threshold (The multiplier can be adjusted according to sensitivity requirements).

[0043] Real-time alert: If the smoothing value generated in each subsequent frame continuously exceeds T, an intrusion is determined to have occurred in real time. As shown in the figure, the red threshold line is locked at the moment of system startup and no longer drifts slowly with the environment, ensuring the determinism of detection. The intrusion detection results are shown in Figures 2 and 3.

[0044] 5. Experimental Results and Energy Efficiency Analysis

[0045] Lightweight and Edge Computing Adaptability: This method eliminates the reliance on STFT time-frequency maps or deep residual networks found in traditional solutions. The entire processing flow involves only basic addition, subtraction, multiplication, division, and sorting operations, without complex floating-point matrix transformations. Experiments show that the algorithm's single-frame processing latency is less than 1ms, with extremely low CPU utilization, significantly reducing the hardware cost and power consumption of security gateways.

[0046] Anti-interference robustness verification: In complex electromagnetic environments with Bluetooth coexistence interference and device thermal drift, the traditional moving average algorithm has a large baseline variance, which easily triggers false alarms. However, the dual-end extremum suppression pruning strategy and the algorithm that amplifies difference points adopted in this embodiment make the environmental baseline exhibit extremely high stability, only producing significant energy peaks when a real human body intrudes, verifying the superiority of the algorithm in non-stationary noise environments.

[0047] Privacy Compliance Assessment: The privacy security of this method stems from its unique channel detection mechanism. The system proactively initiates link interaction requests to the access point, utilizing channel state information generated by its own communication link for environmental awareness. During this process, the sensing object is limited to the physical layer link characteristics between this device and the router, without intercepting or sniffing the communication traffic of other legitimate users in the space. Since this scheme lacks the physical basis for parsing third-party communication packets, the possibility of illegally eavesdropping on others' data is eliminated at the source. This "self-initiated and self-received" sensing mode not only ensures absolute isolation of communication privacy but also provides solid technical support for compliant, unobtrusive monitoring in complex electromagnetic environments.

Claims

1. A fast intrusion detection method based on WiFi channel state information differential energy field and pruning filter, characterized in that, Includes the following steps: Step S1: Passively listen to the target device via network interface card (NIC) or other means to obtain the complex matrix of physical layer channel state information (CSI) in real time; Step S2: Decouple the complex matrix of the channel state information, extract the instantaneous amplitude features of each subcarrier, and construct a time-domain differential energy field based on the differential operation of adjacent frames; Step S3: Perform multi-carrier feature aggregation on the differential energy field to generate an original energy scalar sequence characterizing the intensity of indoor electromagnetic environment disturbance; Step S4: Use dual-ended extremum suppression logic to perform trimming and averaging filtering on the original energy scalar sequence to remove interference from maxima and minima, and output the smoothed environmental energy characterization value. Step S5: Execute the instantaneous reference locking mechanism to lock the first effective smoothed energy value of the filtered output as the static environmental reference, and set the dynamic monitoring threshold accordingly; Step S6: Compare the subsequent smoothed energy value with the monitoring threshold in real time, and determine whether an intrusion has occurred in the indoor environment based on the comparison result and trigger an early warning.

2. The method according to claim 1, characterized in that, The mathematical expression for constructing the differential energy field in step S2 is as follows: in, The energy value in the time domain. and These are the CSI amplitude vectors at adjacent time points, and Scale is the scaling factor used to map channel fluctuations to a preset numerical range.

3. The method according to claim 1, characterized in that, The specific process of the trimmed average filtering based on the two-terminal extremum suppression logic in step S4 includes: S4-1: Set a sliding window of length L to cache continuous raw energy feature values ​​in real time; S4-2: Sort the data in the window in ascending order, and remove the set of maximum values ​​that accounts for no less than 30% and the set of minimum values ​​that accounts for no less than 30% respectively. S4-3: Calculate the arithmetic mean of the remaining stable energy sequence in the middle after removing extreme values, and use it as the smoothed energy output at the current moment.

4. The method according to claim 1, characterized in that: In step S4, the sliding window length is L frames; The maximum set in step S4 contains the largest 30%*L observations within the window, which are used to suppress sudden impulse interference. The minimum set in step S4 contains the smallest 30%*L observations within the window, which are used to suppress abnormal fluctuations caused by deep signal fading.

5. The method according to claim 1, characterized in that, The specific process of instantaneous reference locking in step S5 is as follows: The system skips the unstable period of initial hardware startup and directly defines the first smooth point as the static environment baseline B after the filter generates the first smooth point. The formula for setting the monitoring threshold T is as follows: Where N is the sensitivity adjustment factor, and in this embodiment, N is taken as 1.8 to 2.

0.

6. The method according to claim 1, characterized in that: The method achieves lightweight processing through basic arithmetic operations and linear sorting logic, with a single-frame processing latency of less than 1ms, and supports real-time deployment on embedded IoT gateways or edge computing nodes.

Images