Hidden camera intelligent detection method and system based on WiFi signal behavior analysis

Abstract

The invention relates to a hidden camera intelligent detection method and system based on WiFi signal behavior analysis, and the method comprises the steps: carrying out the WiFi signal scanning in a power-off state and a power-on state of a target room, and obtaining a first signal set and a second signal set; then, through a differential comparison technology based on unsupervised machine learning, newly added suspicious WiFi access points after power-on are intelligently identified from the second signal set; then, for the suspicious access points, collecting original I / Q signals of wireless communication of the suspicious access points, extracting multi-dimensional radio frequency fingerprints including transient features, I / Q imbalance, carrier frequency offset, high-order statistical moment and spectrum features, and forming feature vectors representing uniqueness of equipment hardware; and finally, performing matching analysis on the feature vector and a pre-stored radio frequency fingerprint database of the security equipment and the secret photographing equipment to realize accurate judgment and risk grading of the equipment type.

Description

Technical Field

[0001] This application relates to the field of signal analysis technology, and in particular to a method and system for intelligent detection of hidden cameras based on WiFi signal behavior analysis. Background Technology

[0002] With the deep integration of miniature camera technology and wireless communication technology, hidden cameras and other voyeuristic devices are becoming increasingly miniaturized, concealed, and intelligent, posing an unprecedented and serious threat to personal privacy and security. Hotels, guesthouses, and other short-term rental accommodations, due to their enclosed spaces and the mobility of people, have become high-risk locations for voyeuristic crimes.

[0003] Currently, the detection methods for wireless spy cameras in the market and existing technical solutions mainly fall into the following categories: The first category is physical scanning technology, which relies on infrared thermal imaging or broadband radio frequency signal detectors for manual inspection. This method is inefficient, highly dependent on the operator's experience, and easily misses detection due to deeply concealed devices or non-heat source / silent designs. The second category is passive WiFi sniffing technology, which detects devices by listening to WiFi signals broadcast in the environment. However, this technology has a fatal flaw: many spy cameras, in order to evade detection, only briefly turn on their WiFi hotspots during initial configuration, or remain in a wireless silent state during standby or recording, rendering passive sniffing completely ineffective. The third category is feature-based identification technology, which compares the MAC address of a newly discovered device with its Organizational Unique Identifier (OUI) or SSID name against a pre-set "spy camera feature database." However, MAC addresses can be easily forged or randomized, and SSIDs can also mimic common, harmless names.

[0004] The aforementioned technology is not suitable for triggering and capturing hidden cameras in deep sleep or disguised states, nor can it penetrate false identifiers at the device software level to identify the true nature of the hardware, which can easily lead to detection errors.

[0005] Based on this, this application provides a method and system for intelligent detection of hidden cameras based on WiFi signal behavior analysis. Summary of the Invention

[0006] To address the issues of inconvenience in triggering and capturing hidden cameras in deep sleep or disguised states, and the inability to penetrate false identifiers at the device software level to identify the true nature of the hardware, which easily leads to detection errors, this application provides a hidden camera intelligent detection method and system based on WiFi signal behavior analysis.

[0007] Firstly, this application provides a hidden camera intelligent detection method based on WiFi signal behavior analysis, which adopts the following technical solution: including: When the target room is in a power-off state, the control and detection equipment performs the first WiFi signal scan, captures and records the first signal set, which contains the first identity information of each WiFi access point in the environment. After detecting that the target room is powered on, within a preset time window, the detection device is controlled to perform a second WiFi signal scan, capture and record a second signal set, which contains the second identity information of each WiFi access point in the current environment; The second signal set is differentially compared with the first signal set to identify newly added WiFi access points after power-on, forming a list of suspicious devices; For newly added WiFi access points in the list of suspicious devices, the wireless communication signals emitted by the corresponding access points are collected. From the collected wireless communication signals, radio frequency fingerprint features that characterize inherent hardware defects of the devices are extracted. The extracted radio frequency fingerprint features are matched and analyzed with a pre-stored device feature database to obtain the matching analysis results. Based on the matching analysis results, the type and risk level of the newly added WiFi access point are determined.

[0008] Preferably, when the target room is in a power-off state, the control and detection device performs a first WiFi signal scan, captures and records a first signal set, the first signal set containing the first identity information of each WiFi access point in the environment, including: The determination of whether a target room is in a power outage state is made by checking whether the room's power switch is not closed or by detecting that there is no mains power supply in the room. In the power-off state, the control detection device continuously scans the target frequency band for a first preset duration for WiFi signals, including the 2.4GHz band and the 5GHz band; All WiFi signal frames scanned within a first preset time period are parsed and recorded to generate the first signal set. The first identity information includes at least the media access control address, service set identifier, and received signal strength indication of the corresponding WiFi access point.

[0009] Preferably, the step of differentially comparing the second signal set with the first signal set to identify newly added WiFi access points after power-on and forming a list of suspicious devices includes: For each WiFi access point in the first signal set, a multi-dimensional first feature vector is generated based on the Media Access Control Address, Service Set Identifier, Received Signal Strength Indicator, and Channel. The set of all first feature vectors constitutes a first feature vector group. Similarly, a second feature vector group is constructed based on the second signal set. Using the first feature vector group as a known normal sample set, each second feature vector in the second feature vector group is used as a test sample and input into a pre-trained anomaly detection model. The anomaly detection model is trained by an unsupervised machine learning algorithm and is used to calculate the degree of deviation between the test sample and the normal sample set in the feature space and output anomaly score. Based on the anomaly detection model, each second feature vector is analyzed. If the anomaly score corresponding to the target second feature vector exceeds the preset judgment threshold, the WiFi access point corresponding to the target second feature vector is determined to be an access point added after power-on. All WiFi access points identified as new additions are compiled to form the list of suspicious devices.

[0010] Preferably, before inputting each second feature vector in the second feature vector group as a test sample into the pre-trained anomaly detection model, using the first feature vector group as a known normal sample set, the method further includes: The first feature vector set is used as a normal sample set to characterize the background of the wireless environment of the target room under power failure. An unsupervised anomaly detection algorithm is selected as the model basis. The unsupervised anomaly detection algorithm includes at least one of the following: Isolation Forest, Single-class Support Vector Machine, and Local Anomaly Factor. The model parameters are initialized. The normal sample set is input into the initialized model, so that the model learns the distribution pattern and density structure of the normal sample set in the feature space; After training is complete, the structure and parameters of the model are saved to obtain the trained anomaly detection model.

[0011] Preferably, the step of inputting the normal sample set into the initialized model, so that the model learns the distribution pattern and density structure of the normal sample set in the feature space, includes: Map each first feature vector in the normal sample set to the feature space defined by the unsupervised anomaly detection algorithm; If the unsupervised anomaly detection algorithm is the Isolation Forest algorithm, then a subset of samples is randomly extracted from the normal sample set; for each subset of samples, feature dimensions and split points are recursively randomly selected to construct multiple isolation trees until each data point is isolated or the tree height limit is reached; the isolation forest model is formed by all the isolation trees, and the isolation forest model characterizes whether a data point is an anomaly by calculating the path length from the root node to the isolated node. If the unsupervised anomaly detection algorithm is a single-class support vector machine algorithm, then in the feature space, a hypersphere or hyperplane decision boundary with the smallest volume that can enclose more than a preset proportion of normal sample points is found; the samples are mapped to a high-dimensional space through a kernel function to handle nonlinear separable cases, and the center and radius or normal vector and bias of the decision boundary are determined. If the unsupervised anomaly detection algorithm is a local anomaly factor algorithm, then for each normal sample point in the feature space, the distance to its k-th nearest neighbor sample point is calculated, and its local reachability density is calculated; by comparing the local reachability density of the sample point with that of its neighbors, the local density distribution pattern of normal samples in the feature space is learned. Based on the training results, the core parameters of the anomaly detection model are determined and solidified; for isolated forests, the core parameter is the structure of all isolated trees in the forest; for single-class support vector machines, the core parameter is the mathematical description of the decision boundary; for local anomaly factors, the core parameters are the distance relationship between normal sample points and the local density distribution. Using the normal sample set as input, the anomaly score of each sample is calculated through the trained anomaly detection model. Based on the statistical distribution of the anomaly scores, the k-th distance threshold, sphere radius threshold, or path length threshold used to determine anomalies in subsequent detection steps are determined.

[0012] Preferably, for newly added WiFi access points in the list of suspicious devices, the wireless communication signals emitted by the corresponding access points are collected. From the collected wireless communication signals, radio frequency fingerprint features characterizing inherent hardware defects of the devices are extracted. The extracted radio frequency fingerprint features are matched and analyzed against a pre-stored device feature database to obtain matching analysis results. Based on the matching analysis results, the type and risk level of the newly added WiFi access point are determined, including: For each new WiFi access point in the list of suspicious devices, the beacon frames or probe response frames periodically sent by the new WiFi access point are monitored through the wireless network card, and probe request frames are actively sent to trigger the response, and the I / Q data of the original wireless communication signal sent by the new WiFi access point are collected. After preprocessing the collected I / Q data, the radio frequency fingerprint features characterizing the inherent defects of the transmitter hardware are extracted to form the feature vector corresponding to the new WiFi access point. The radio frequency fingerprint features include, but are not limited to: transient signal features, modulation domain features, signal statistical features, and spectrum features. The feature vector is input into a pre-stored device feature database for matching analysis, and the feature distance or similarity between the feature vector and each standard feature vector in the device feature database is calculated. The device feature database includes at least a first sub-database and a second sub-database. The first sub-database stores standard radio frequency fingerprint feature vectors of smartphones, laptops, tablets and smart home devices of known brands, and the second sub-database stores radio frequency fingerprint feature vectors of hidden camera modules of known models. If the similarity between the feature vector and any standard feature vector in the second sub-library is higher than the first preset threshold, it is determined to be a hidden camera device and marked as a high-risk level. If the similarity between the feature vector and any standard feature vector in the first sub-library is higher than the second preset threshold, it is determined to be a normal consumer electronic device type and marked as low risk level; If the similarity between the feature vector and both the first and second sub-libraries is below the corresponding threshold, it is determined to be an unknown device type. Analyze the radio frequency fingerprint features of the unknown device type. If the radio frequency fingerprint features of the unknown device type show low complexity or are consistent with the coarse features of common IoT device modules, it is marked as medium risk level; otherwise, it is marked as high risk level.

[0013] Preferably, after preprocessing the collected I / Q data, the radio frequency fingerprint features characterizing inherent defects in the transmitter hardware are extracted to form a feature vector corresponding to the newly added WiFi access point, including: The acquired raw I / Q data is preprocessed, including at least noise reduction filtering, DC component elimination, and signal segment alignment. The transient phase at the initial power-on or packet transmission of the device is located from the preprocessed signal. The transient feature vector of the transient phase signal is extracted. The transient feature vector includes: power ramp-up time constant, transient envelope waveform complexity, and transient energy distribution characteristics obtained based on empirical mode decomposition or wavelet transform. From the steady-state stage of the preprocessed signal, the modulation domain feature vector characterizing the hardware defects of the transmitter modulation process is extracted. The modulation domain feature vector includes: I / Q imbalance parameters: by calculating the amplitude ratio and phase difference of in-phase and quadrature signals, the gain imbalance and quadrature phase error are obtained; carrier frequency offset: by analyzing the rate of change of the signal phase over time, the deviation between the actual carrier frequency of the transmitter and the center frequency of the standard channel is estimated. Statistical analysis is performed on the envelope of the steady-state signal to extract higher-order statistical moments as statistical feature vectors. The statistical feature vectors include at least skewness and kurtosis. Skewness is used to measure the asymmetry of the amplitude distribution of the signal envelope, and kurtosis is used to measure the sharpness or tailing of the amplitude distribution of the signal envelope. The preprocessed signal is subjected to spectral transformation, and spectral feature vectors are extracted from the power spectral density. The spectral feature vectors include: main lobe width, amplitude and distribution characteristics of out-of-band spurious radiation, and spectral symmetry measure. The extracted transient feature vector, modulation domain feature vector, statistical feature vector, and spectral feature vector are concatenated and normalized to form the final feature vector used to characterize the hardware identity of the newly added WiFi access point.

[0014] Secondly, this application discloses a hidden camera intelligent detection device based on WiFi signal behavior analysis, which adopts the following technical solution, including: The power failure detection module is used to control the detection device to perform the first WiFi signal scan when the target room is in a power failure state, capture and record the first signal set, which contains the first identity information of each WiFi access point in the environment; The power-on detection module is used to control the detection device to perform a second WiFi signal scan within a preset time window after detecting that the target room is powered on, to capture and record a second signal set, which contains the second identity information of each WiFi access point in the current environment. The signal analysis module is used to perform differential comparison between the second signal set and the first signal set to identify newly added WiFi access points after power-on and form a list of suspicious devices. The feature detection module is used to collect the wireless communication signals emitted by the newly added WiFi access points in the list of suspicious devices, extract radio frequency fingerprint features that characterize the inherent defects of the device hardware from the collected wireless communication signals, perform matching analysis on the extracted radio frequency fingerprint features with the pre-stored device feature database, obtain the matching analysis results, and determine the type and risk level of the newly added WiFi access point based on the matching analysis results.

[0015] Thirdly, this application also provides a control device, the device comprising: It includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed, such as the above-described intelligent detection method for hidden cameras based on WiFi signal behavior analysis.

[0016] Fourthly, this application also provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described above regarding the intelligent detection method for hidden cameras based on WiFi signal behavior analysis.

[0017] In summary, this application first scans and records all WiFi signals in a hotel room with the power off as an environmental baseline. Then, the room is powered on, forcing the power-dependent hidden camera to start and scan again to obtain the current signal. By differentially comparing the results of the two scans, suspicious WiFi access points newly appearing after power is restored are accurately located. These suspicious points undergo deep physical layer identification: by collecting their raw I / Q data and extracting multiple radio frequency fingerprint features—including the power ramp-up trajectory during device power-on, modulation domain defects such as I / Q imbalance and carrier frequency offset in steady-state signals, higher-order statistical moments (skewness, kurtosis) of the signal envelope, and spectral characteristics—these features are rooted in inherent, difficult-to-forge defects in the device hardware. Finally, the fused multi-dimensional feature vector is matched and analyzed with a pre-built device radio frequency fingerprint database to penetrate surface disguises such as MAC addresses or SSIDs, directly determining whether the device is a common consumer electronics product, a known model hidden camera, or a high-risk unknown device, and issuing tiered warnings accordingly. This effectively solves the pain points of traditional methods, such as the inability to detect hidden devices in standby mode and susceptibility to MAC address spoofing. Through a triple mechanism of active exposure triggering, dynamic differential analysis, and physical feature identification, it achieves efficient and accurate anti-interference detection of hidden cameras. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a method for intelligent detection of hidden cameras based on WiFi signal behavior analysis.

[0019] Figure 2 This is a structural block diagram of a hidden camera intelligent detection device based on WiFi signal behavior analysis. Detailed Implementation

[0020] The following combination Figure 1 - Figure 2 This application will be described in further detail.

[0021] Reference Figure 1 The embodiments of this application include at least steps S10 to S40.

[0022] S10, when the target room is in a power-off state, the control detection device performs the first WiFi signal scan, captures and records the first signal set, which contains the first identity information of each WiFi access point in the environment.

[0023] S20: After detecting that the target room is powered on, within a preset time window, control the detection device to perform a second WiFi signal scan, capture and record a second signal set, which contains the second identity information of each WiFi access point in the current environment.

[0024] S30: Perform differential comparison between the second signal set and the first signal set to identify newly added WiFi access points after power-on and form a list of suspicious devices.

[0025] S40: For newly added WiFi access points in the list of suspicious devices, collect the wireless communication signals emitted by the corresponding access points, extract radio frequency fingerprint features that characterize the inherent defects of the device hardware from the collected wireless communication signals, perform matching analysis with the extracted radio frequency fingerprint features and pre-stored device feature database to obtain matching analysis results, and determine the type and risk level of the newly added WiFi access point based on the matching analysis results.

[0026] Specifically, taking advantage of the fact that most hidden cameras rely on the room's mains power, the system uses a proactive "power off-power-on" operation to forcibly wake up and activate hidden cameras that were originally in deep sleep or hidden mode, causing their WiFi modules to start working and be scanned, thus solving the blind spots of passive sniffing.

[0027] Dynamic differential detection eliminates interference: By comparing signal changes before and after power-on, the system can directly identify "new" devices, effectively eliminating interference from constant WiFi signals from external environments such as neighboring rooms and corridors, greatly improving the targeting and accuracy of detection.

[0028] Dual filtering and intelligent analysis: The system combines a database of known secure devices and a database of known hidden cameras for dual filtering. Legitimate devices are prioritized for exclusion, while unidentifiable devices are handled with a conservative "presumption of guilt" approach, triggering a direct warning to ensure no device is missed. Simultaneously, database matching enhances the accuracy of the analysis.

[0029] High efficiency and easy to operate: The entire detection process is fast and highly automated, requiring little professional skill from operators, making it ideal for hotel cleaning staff or ordinary users to conduct quick privacy and security checks themselves.

[0030] In some embodiments, step S10 specifically includes the following steps: determining whether the target room is in a power outage state by the room power switch not being closed or the detection device detecting that there is no mains power supply in the room; in the power outage state, controlling the detection device to continuously scan the target frequency band for a first preset duration of WiFi signals, the target frequency band including the 2.4GHz band and the 5GHz band; parsing and recording all WiFi signal frames scanned within the first preset duration to generate a first signal set, the first identity information including at least the media access control address, service set identifier, and received signal strength indication of the corresponding WiFi access point. Similarly, a second signal set is generated.

[0031] Specifically, the initial power outage state of the room is accurately determined through physical or electrical means to ensure that the first scan captures a clean background environment free of signals from targeted hidden cameras. Subsequently, continuous scanning is performed on both the 2.4GHz and 5GHz dual-band bands to comprehensively capture all stable internal and external WiFi signal sources in this environment (such as neighboring routers, public access points, and other legitimate devices), recording their MAC addresses, SSIDs, and signal strengths to construct a first signal set representing a normal background. Similarly, this process is repeated after power is restored to obtain a second signal set, including signals from potentially activated hidden cameras. This standardized operation ensures the comparability of the two scans, allowing for the clear and accurate separation of "new signals" appearing after power is restored, thus enabling subsequent differential comparison to pinpoint specific targets.

[0032] In some embodiments, step S30 specifically includes the following steps: For each WiFi access point in the first signal set, a multi-dimensional first feature vector is generated based on the Media Access Control Address, Service Set Identifier, Received Signal Strength Indicator, and the channel it is located on; a first feature vector group is formed based on the set of all first feature vectors; similarly, a second feature vector group is constructed based on the second signal set; using the first feature vector group as a known normal sample set, each second feature vector in the second feature vector group is used as a test sample and input into a pre-trained anomaly detection model. The anomaly detection model is trained by an unsupervised machine learning algorithm and is used to calculate the degree of deviation between the test sample and the normal sample set in the feature space and output an anomaly score; each second feature vector is analyzed based on the anomaly detection model. If the anomaly score corresponding to the target second feature vector exceeds a preset judgment threshold, the WiFi access point corresponding to the target second feature vector is determined to be a newly added access point after power-on; all WiFi access points determined to be newly added are summarized to form a list of suspicious devices.

[0033] Specifically, multiple features (MAC address, signal strength, etc.) of each WiFi access point are combined into a multi-dimensional feature vector to comprehensively characterize its behavioral fingerprint. An unsupervised machine learning model is used to learn the normal pattern distribution of all legitimate devices under power-off conditions. After power is restored, any signal that significantly deviates from this learned pattern in the feature space, even if its MAC address is spoofed, will be identified as a new suspicious device due to its overall abnormal behavior.

[0034] Anti-interference capability: Even if the hidden camera spoofs the MAC address, as long as its signal strength, channel and other behavioral characteristics are different from the historical characteristics in the power outage environment, the model can still identify it as an anomaly (i.e., a new addition), effectively dealing with MAC address spoofing.

[0035] Environmental adaptability: The model is trained and makes decisions based on the first feature vector group collected on site (representing the background environment), without relying on a fixed global feature library. It can adapt to the complex wireless environment of different rooms and exclude fixed interference sources such as neighboring rooms.

[0036] Deepening the identification dimension: The multi-dimensional features (such as signal strength and channel) extracted from the signal are used as model input. Compared with simply comparing identifiers, this is a more fundamental difference analysis from the perspective of device behavior characteristics, which improves the robustness and accuracy of detection.

[0037] Taking the One-Class Support Vector Machine (OCSVM) algorithm as an example, its core is to find a minimum hypersphere that can enclose the vast majority of normal sample points. Its optimization problem can be expressed as: ; ; R: radius of the hypersphere; c: center vector of the hypersphere; The i-th feature vector is composed of MAC address, signal strength, etc. A kernel function that maps feature vectors to a high-dimensional space is used to handle nonlinear patterns. ν represents a slack variable, allowing a small number of normal sample points to be located outside the sphere, increasing the robustness of the model; v represents a parameter that controls the model's tolerance to outliers (0 < ν ≤ 1), and its value is approximately equal to the upper limit of the proportion of samples considered as outliers; N represents the total number of samples in the normal sample set (the first feature vector group).

[0038] In some embodiments, the training and construction of the anomaly detection model specifically includes the following steps: using a first feature vector set as a normal sample set representing the background of the wireless environment of the target room under power failure; selecting an unsupervised anomaly detection algorithm as the model basis, including at least one of isolated forest, single-class support vector machine, and local anomaly factor, and initializing the model parameters; inputting the normal sample set into the initialized model, so that the model learns the distribution pattern and density structure of the normal sample set in the feature space; after training is completed, saving the structure and parameters of the model to obtain the trained anomaly detection model.

[0039] Furthermore, to enable the model to learn the distribution pattern and density structure of the normal sample set in the feature space, the corresponding steps are as follows: Map each first feature vector in the normal sample set to the feature space defined by the unsupervised anomaly detection algorithm; if the unsupervised anomaly detection algorithm is an isolated forest algorithm, randomly extract a subset of samples from the normal sample set; recursively and randomly select feature dimensions and split points for each subset of samples to construct multiple isolated trees until each data point is isolated or the tree height limit is reached; construct an isolated forest model using all isolated trees, and the isolated forest model characterizes whether a data point is an anomaly by calculating the path length from the root node to the isolated node; if the unsupervised anomaly detection algorithm is a single-class support vector machine algorithm, find a hypersphere or hyperplane decision boundary in the feature space that can enclose more than a preset proportion of normal sample points and has the smallest volume; map the samples to a high-dimensional space using a kernel function to handle nonlinear separable cases and determine the decision. The boundary center and radius or normal vector and bias are used; if the unsupervised anomaly detection algorithm is a local anomaly factor algorithm, then for each normal sample point in the feature space, the distance to its k-th nearest neighbor sample point is calculated, and its local reachability density is calculated; by comparing the local reachability density of the sample point with its neighbors, the local density distribution pattern of normal samples in the feature space is learned; based on the training results, the core parameters of the anomaly detection model are determined and solidified; for isolated forests, the core parameter is the structure of all isolated trees in the forest; for single-class support vector machines, the core parameter is the mathematical description of the decision boundary; for local anomaly factors, the core parameters are the distance relationship and local density distribution between normal sample points; using the normal sample set as input, the anomaly score of each sample is calculated through the trained anomaly detection model, and based on the statistical distribution of the anomaly scores, the k-th distance threshold, sphere radius threshold, or path length threshold (k is a constant) used to determine anomalies in subsequent detection steps are determined.

[0040] Specifically, using real data collected in the current detection environment (room under power failure) as the sole training set, a selected unsupervised learning algorithm (such as Isolation Forest or Single-Class Support Vector Machine) allows the model to automatically learn the feature space distribution (such as data cluster structure, boundaries, or density) of all legitimate WiFi devices in this specific environment. Subsequently, based on the model's self-detection of its own training data, a dynamic threshold for defining anomalies is statistically derived. This eliminates the need for pre-collecting massive amounts of general data and manual annotation, enabling the model to quickly adapt to the unique wireless environment of any unfamiliar room and automatically establish a "normal" benchmark matching that environment. This environmental adaptability and real-time threshold calibration capability ensure high sensitivity and low false alarm rate in the subsequent differential comparison step for identifying newly added suspicious signals, which is key to the practical deployment of this solution.

[0041] In some embodiments, step S40 specifically includes the following steps: for each newly added WiFi access point in the list of suspicious devices, the beacon frames or probe response frames periodically sent by the device are monitored through the wireless network card, and a probe request frame is actively sent to trigger the response, and the I / Q data of the original wireless communication signal emitted by the newly added WiFi access point is collected; after preprocessing the collected I / Q data, the radio frequency fingerprint features characterizing the inherent defects of the transmitter hardware are extracted to form the feature vector corresponding to the newly added WiFi access point. The radio frequency fingerprint features include, but are not limited to: transient signal features: the power rise time and trajectory of the signal during the device power-on startup phase; modulation domain features: the gain imbalance between in-phase and quadrature components, phase deviation, and carrier frequency offset; signal statistical features: the higher-order statistical moments of the signal envelope, including skewness and kurtosis; and spectral features: the power spectral density shape and out-of-band radiation features of the signal. The feature vector is input into a pre-stored device feature database for matching analysis. The feature distance or similarity between the feature vector and each standard feature vector in the device feature database is calculated. The device feature database includes at least a first sub-database and a second sub-database. The first sub-database stores standard RF fingerprint feature vectors of smartphones, laptops, tablets, and smart home devices of known brands. The second sub-database stores RF fingerprint feature vectors of hidden camera modules of known models. If the similarity between the feature vector and any standard feature vector in the second sub-database is higher than a first preset threshold, it is determined to be a hidden camera device and marked as high-risk. If the similarity between the feature vector and any standard feature vector in the first sub-database is higher than a second preset threshold, it is determined to be a normal consumer electronic device and marked as low-risk. If the similarity between the feature vector and both the first and second sub-databases is lower than the corresponding threshold, it is determined to be an unknown device type. The RF fingerprint features of the unknown device type are analyzed. If the RF fingerprint features of the unknown device type show low complexity or match the coarse features of common IoT device modules, it is marked as medium-risk; otherwise, it is marked as high-risk.

[0042] Let the acquired steady-state complex baseband signal sequence be... , where n=0,1,...,N−1 are the sampling point indices.

[0043] The I / Q imbalance parameter can be quantified and calculated: Gain imbalance: , where E[] represents the expectation (mean) operation; Orthogonal phase error: can be estimated by calculating the correlation coefficients of the I and Q components. ; Carrier frequency offset It can be estimated using the phase difference method: ; Indicates the sampling interval time; Indicates signal The complex conjugate of; angle represents the phase angle (in radians) of the complex number.

[0044] The above formula describes the process of modulation domain features, clarifying the transformation process from raw I / Q data to specific feature values.

[0045] Specifically, for suspicious devices identified through screening, the approach no longer relies on easily forged network identifiers (such as MAC addresses), but instead delves into the physical layer of their wireless communication to collect raw I / Q signal data. By analyzing this signal, a series of tamper-proof radio frequency fingerprint features determined by inherent defects in the transmitter's hardware circuitry (such as component tolerances and nonlinear distortion) are extracted. These features include I / Q imbalance, spectral spurious signals, and specific statistical distributions of the signal envelope. Together, these features constitute the device's unique "physical identity card."

[0046] By intelligently matching and calculating similarity between the extracted RFID fingerprint and two pre-stored feature databases (security device database and hidden camera device database), the system can effectively identify whether a device is a regular mobile phone or computer, or a specific model of hidden camera module. For unknown devices that cannot be matched, risk inference is made based on the complexity of their fingerprints. This fundamentally solves the problem of traditional solutions failing due to MAC / SSID spoofing, elevating the detection capability from "discovering devices" to "identifying the true nature of devices," thus improving the reliability and accuracy of detection.

[0047] Furthermore, considering the problem of multi-dimensional RF fingerprint feature extraction and fusion, the corresponding processing steps are as follows: Preprocess the acquired raw I / Q data, including at least noise reduction filtering, DC component elimination, and signal segment alignment; locate the transient phase at the initial power-on or packet transmission stage from the preprocessed signal, and extract the transient feature vector of the transient phase signal. The transient feature vector includes: power ramp-up time constant, transient envelope waveform complexity, and transient energy distribution characteristics obtained based on empirical mode decomposition or wavelet transform; extract the modulation domain feature vector characterizing hardware defects in the transmitter modulation process from the steady-state stage of the preprocessed signal. The modulation domain feature vector includes: I / Q imbalance parameters: by calculating the amplitude ratio and phase difference of in-phase and quadrature signals, the gain imbalance and quadrature phase error are obtained; carrier frequency offset: ... By analyzing the rate of change of signal phase over time, the deviation between the actual carrier frequency of the transmitter and the center frequency of the standard channel is estimated. Statistical analysis is performed on the envelope of the steady-state signal to extract higher-order statistical moments as statistical feature vectors. These feature vectors include at least skewness and kurtosis. Skewness measures the asymmetry of the signal envelope amplitude distribution, while kurtosis measures the sharpness or tailing of the signal envelope amplitude distribution. The preprocessed signal undergoes spectral transformation to extract spectral feature vectors from the power spectral density. These spectral feature vectors include the main lobe width, the amplitude and distribution characteristics of out-of-band spurious radiation, and a measure of spectral symmetry. The extracted transient feature vectors, modulation domain feature vectors, statistical feature vectors, and spectral feature vectors are concatenated and normalized to form the final feature vectors used to characterize the hardware identity of newly added WiFi access points.

[0048] Let the signal envelope sequence be Its mean is The standard deviation is .

[0049] Skewness (γ), also known as the third-order normalized moment, is calculated using the following formula: ; It quantifies the degree to which the distribution deviates from symmetry. Indicates a symmetrical distribution. This indicates a rightward shift (long tail on the right). Indicates leftward deviation.

[0050] Kudo That is, the fourth-order normalized moment, calculated by the following formula: ; The kurtosis (3) of the normal distribution is often used as a benchmark to measure the sharpness or flatness of a distribution curve. This indicates that the distribution is more sharp (heavy-tailed) than the normal distribution. It indicates a flatter surface.

[0051] Furthermore, let the sub-feature vectors extracted from the four dimensions be as follows: Transient feature vector: ; Modulation domain eigenvectors: ; Statistical eigenvectors: ; Spectral eigenvectors: ; The concatenation operation generates the original fused feature vector. : ; ; Normalization process generates the final feature vector : ； ; It is the original fused feature vector The i-th dimension component; and These are the mean and standard deviation of the i-th feature, calculated on the training set, respectively.

[0052] The above formula clarifies the steps of feature fusion, bringing features of all dimensions to the same scale, which facilitates subsequent similarity calculation and matching analysis.

[0053] Specifically, this involves systematically mining and quantifying the physical imprints determined by inherent hardware defects in a single wireless signal across different domains (time domain, modulation domain, statistical domain, and frequency domain). Specifically, by analyzing the signal's transient behavior (reflecting power supply and startup circuit characteristics), modulation accuracy (reflecting I / Q modulator defects and frequency source stability), envelope statistical characteristics (reflecting power amplifier nonlinearity, etc.), and spectral morphology (comprehensively reflecting linear and nonlinear distortion), a high-dimensional feature vector comprehensively describing the transmitter's hardware identity is constructed.

[0054] This fused feature vector is virtually impossible to simulate or alter through software because it is rooted in the minute differences and defects inherent in the hardware manufacturing process. By concatenating and normalizing these four dimensions of features to form a unified and comparable digital identity, a data foundation is provided for subsequent accurate matching with equipment feature databases, enabling reliable equipment type identification and risk classification.

[0055] The implementation principle of the hidden camera intelligent detection method based on WiFi signal behavior analysis in this application embodiment is as follows: First, in a hotel room with the power off, all WiFi signals are scanned and recorded as an environmental benchmark. Then, the room is powered on, forcing the hidden camera device, which relies on mains power, to start and scan again to obtain the current signal. By differentially comparing the results of the two scans, suspicious WiFi access points newly appearing after power-on are accurately located. Deep physical layer identification is performed on these suspicious points: by collecting their raw I / Q data of wireless signals, multiple radio frequency fingerprint features are extracted—including the power ramp-up trajectory of the device during power-on transients, modulation domain defects such as I / Q imbalance and carrier frequency offset of steady-state signals, higher-order statistical moments (skewness, kurtosis) of the signal envelope, and spectral features, etc. These features are rooted in the inherent and difficult-to-forge defects of the device hardware. Finally, the fused multi-dimensional feature vector is matched and analyzed with a pre-built device radio frequency fingerprint database, thereby penetrating the surface disguise such as MAC address or SSID, directly determining whether the device is a common consumer electronics product, a known model hidden camera device, or a high-risk unknown device, and issuing graded warnings accordingly. This effectively solves the pain points of traditional methods, such as the inability to detect hidden devices in standby mode and susceptibility to MAC address spoofing. Through a triple mechanism of active exposure triggering, dynamic differential analysis, and physical feature identification, it achieves efficient and accurate anti-interference detection of hidden cameras.

[0056] Figure 1 This is a flowchart illustrating a hidden camera intelligent detection method based on WiFi signal behavior analysis in one embodiment. It should be understood that, although... Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows; unless explicitly stated otherwise, there is no strict order requirement for the execution of these steps, and they can be executed in other orders; and Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0057] Based on the same technical concept, referring to Figure 2 This application also provides a hidden camera intelligent detection device based on WiFi signal behavior analysis, which adopts the following technical solution: The device includes: The power failure detection module is used to control the detection device to perform the first WiFi signal scan when the target room is in a power failure state, capture and record the first signal set, which contains the first identity information of each WiFi access point in the environment; The power-on detection module is used to control the detection device to perform a second WiFi signal scan within a preset time window after detecting that the target room is powered on, to capture and record a second signal set, which contains the second identity information of each WiFi access point in the current environment. The signal analysis module is used to perform differential comparison between the second signal set and the first signal set to identify newly added WiFi access points after power-on and form a list of suspicious devices. The feature detection module is used to collect the wireless communication signals emitted by newly added WiFi access points in the list of suspicious devices. From the collected wireless communication signals, radio frequency fingerprint features that characterize the inherent defects of the device hardware are extracted. The extracted radio frequency fingerprint features are matched and analyzed with the pre-stored device feature database to obtain the matching analysis results. Based on the matching analysis results, the type and risk level of the newly added WiFi access point are determined.

[0058] In some embodiments, the power outage detection module is specifically used to determine whether the target room is in a power outage state by the room power switch not being closed or the detection device detecting that there is no mains power supply in the room. In the power-off state, the control detection device continuously scans the target frequency band for a first preset duration for WiFi signals, including the 2.4GHz band and the 5GHz band; All WiFi signal frames scanned within a first preset time period are parsed and recorded to generate a first signal set. The first identity information includes at least the media access control address, service set identifier, and received signal strength indication of the corresponding WiFi access point.

[0059] In some embodiments, the signal analysis module is specifically used to generate a multi-dimensional first feature vector for each WiFi access point in the first signal set, based on the media access control address, service set identifier, received signal strength indicator and the channel it is located on, and to construct a first feature vector group based on the set of all first feature vectors; similarly, a second feature vector group is constructed based on the second signal set. Using the first feature vector group as the known normal sample set, each second feature vector in the second feature vector group is taken as the test sample and input into the pre-trained anomaly detection model. The anomaly detection model is trained by an unsupervised machine learning algorithm and is used to calculate the degree of deviation between the test sample and the normal sample set in the feature space and output anomaly score. The anomaly detection model is used to analyze each second feature vector. If the anomaly score corresponding to the target second feature vector exceeds the preset judgment threshold, the WiFi access point corresponding to the target second feature vector is determined to be an access point added after power-on. All identified new WiFi access points are compiled into a list of suspicious devices.

[0060] In some embodiments, the signal analysis module is further configured to use the first feature vector set as a normal sample set characterizing the background of the wireless environment of the target room under power failure conditions; An unsupervised anomaly detection algorithm is selected as the model basis. The unsupervised anomaly detection algorithm includes at least one of the following: Isolation Forest, Single-class Support Vector Machine, and Local Anomaly Factor. The model parameters are initialized. Input the normal sample set into the initialized model so that the model learns the distribution pattern and density structure of the normal sample set in the feature space; After training is complete, the model's structure and parameters are saved to obtain the trained anomaly detection model.

[0061] In some embodiments, the signal analysis module is further configured to map each first feature vector in the normal sample set to a feature space defined by the unsupervised anomaly detection algorithm; If the unsupervised anomaly detection algorithm is the Isolation Forest algorithm, then a subset of samples is randomly drawn from the normal sample set; for each subset of samples, feature dimensions and split points are recursively randomly selected to construct multiple isolation trees until each data point is isolated or the tree height limit is reached; the isolation forest model is formed by all the isolation trees, and the isolation forest model characterizes whether a data point is an anomaly by calculating the path length from the root node to the isolated node. If the unsupervised anomaly detection algorithm is a single-class support vector machine algorithm, then in the feature space, a hypersphere or hyperplane decision boundary with the smallest volume that can enclose more than a preset proportion of normal sample points is found; the samples are mapped to a high-dimensional space through a kernel function to handle nonlinear separable cases, and the center and radius or normal vector and bias of the decision boundary are determined. If the unsupervised anomaly detection algorithm is a local anomaly factor algorithm, then for each normal sample point in the feature space, the distance to its k-th nearest neighbor sample point is calculated, and its local reachability density is calculated; by comparing the local reachability density of the sample point with that of its neighbors, the local density distribution pattern of normal samples in the feature space is learned. Based on the training results, the core parameters of the anomaly detection model are determined and solidified; for isolated forests, the core parameter is the structure of all isolated trees in the forest; for single-class support vector machines, the core parameter is the mathematical description of the decision boundary; for local anomaly factors, the core parameters are the distance relationship between normal sample points and the local density distribution. Using a normal sample set as input, the anomaly score for each sample is calculated through the trained anomaly detection model. Based on the statistical distribution of the anomaly scores, the k-th distance threshold, sphere radius threshold, or path length threshold used to determine anomalies in subsequent detection steps are determined.

[0062] In some embodiments, the feature detection module is specifically used to monitor the periodically sent beacon frames or probe response frames of each new WiFi access point in the list of suspicious devices through the wireless network card, and actively send probe request frames to trigger a response, and collect the I / Q data of the original wireless communication signal emitted by the new WiFi access point. After preprocessing the collected I / Q data, radio frequency fingerprint features characterizing the inherent defects of the transmitter hardware are extracted to form the feature vector corresponding to the new WiFi access point. The radio frequency fingerprint features include, but are not limited to: transient signal features, modulation domain features, signal statistical features, and spectrum features. The feature vector is input into a pre-stored device feature database for matching analysis. The feature distance or similarity between the feature vector and each standard feature vector in the device feature database is calculated. The device feature database includes at least a first sub-database and a second sub-database. The first sub-database stores standard radio frequency fingerprint feature vectors of smartphones, laptops, tablets and smart home devices of known brands. The second sub-database stores radio frequency fingerprint feature vectors of hidden camera modules of known models. If the similarity between the feature vector and any standard feature vector in the second sub-library is higher than the first preset threshold, it is determined to be a hidden camera device and marked as a high-risk level. If the similarity between the feature vector and any standard feature vector in the first sub-library is higher than the second preset threshold, it is determined to be a normal consumer electronic device type and marked as low risk level; If the similarity between the feature vector and both the first and second sub-libraries is below the corresponding threshold, it is determined to be an unknown device type. Analyze the radio frequency fingerprint features of the unknown device type. If the radio frequency fingerprint features of the unknown device type show low complexity or are consistent with the coarse features of common IoT device modules, it is marked as medium risk level; otherwise, it is marked as high risk level.

[0063] In some embodiments, the feature detection module is specifically used to preprocess the acquired raw I / Q data, and the preprocessing includes at least noise reduction filtering, DC component elimination, and signal segment alignment; The transient phase at the initial power-on or packet transmission of the device is located from the preprocessed signal. The transient feature vector of the transient phase signal is extracted. The transient feature vector includes: power ramp-up time constant, transient envelope waveform complexity, and transient energy distribution characteristics obtained based on empirical mode decomposition or wavelet transform. From the steady-state stage of the preprocessed signal, the modulation domain feature vector characterizing the hardware defects of the transmitter modulation process is extracted. The modulation domain feature vector includes: I / Q imbalance parameters: by calculating the amplitude ratio and phase difference of in-phase and quadrature signals, the gain imbalance and quadrature phase error are obtained; carrier frequency offset: by analyzing the rate of change of the signal phase over time, the deviation between the actual carrier frequency of the transmitter and the center frequency of the standard channel is estimated. Statistical analysis is performed on the envelope of the steady-state signal to extract higher-order statistical moments as statistical feature vectors. The statistical feature vectors include at least skewness and kurtosis. Skewness is used to measure the asymmetry of the amplitude distribution of the signal envelope, and kurtosis is used to measure the sharpness or tailing of the amplitude distribution of the signal envelope. The preprocessed signal is subjected to spectral transformation, and spectral feature vectors are extracted from the power spectral density. The spectral feature vectors include: main lobe width, amplitude and distribution characteristics of out-of-band spurious radiation, and spectral symmetry measure. The extracted transient feature vector, modulation domain feature vector, statistical feature vector, and spectral feature vector are concatenated and normalized to form the final feature vector used to characterize the hardware identity of the newly added WiFi access point.

[0064] This application also discloses a control device.

[0065] Specifically, the control device includes a memory and a processor. The memory stores a computer program that can be loaded by the processor and executed to perform the aforementioned intelligent detection method for hidden cameras based on WiFi signal behavior analysis.

[0066] This application also discloses a computer-readable storage medium.

[0067] Specifically, the computer-readable storage medium stores a computer program that can be loaded by a processor and executed, such as the aforementioned intelligent detection method for hidden cameras based on WiFi signal behavior analysis. The computer-readable storage medium includes, for example, various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0068] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for intelligent detection of hidden cameras based on WiFi signal behavior analysis, characterized in that, include: When the target room is in a power-off state, the control and detection equipment performs the first WiFi signal scan, captures and records the first signal set, which contains the first identity information of each WiFi access point in the environment. After detecting that the target room is powered on, within a preset time window, the detection device is controlled to perform a second WiFi signal scan, capture and record a second signal set, which contains the second identity information of each WiFi access point in the current environment; The second signal set is differentially compared with the first signal set to identify newly added WiFi access points after power-on, forming a list of suspicious devices; For newly added WiFi access points in the list of suspicious devices, the wireless communication signals emitted by the corresponding access points are collected. From the collected wireless communication signals, radio frequency fingerprint features that characterize inherent hardware defects of the devices are extracted. The extracted radio frequency fingerprint features are matched and analyzed with a pre-stored device feature database to obtain the matching analysis results. Based on the matching analysis results, the type and risk level of the newly added WiFi access point are determined.

2. The intelligent detection method for hidden cameras based on WiFi signal behavior analysis according to claim 1, characterized in that, When the target room is powered off, the control and detection device performs a first WiFi signal scan, capturing and recording a first signal set. This first signal set contains the first identity information of each WiFi access point in the environment, including: The determination of whether a target room is in a power outage state is made by checking whether the room's power switch is not closed or by detecting that there is no mains power supply in the room. In the power-off state, the control detection device continuously scans the target frequency band for a first preset duration for WiFi signals. The target frequency band includes the 2.4GHz band and the 5GHz band. All WiFi signal frames scanned within a first preset time period are parsed and recorded to generate the first signal set. The first identity information includes at least the media access control address, service set identifier, and received signal strength indication of the corresponding WiFi access point.

3. The intelligent detection method for hidden cameras based on WiFi signal behavior analysis according to claim 2, characterized in that, The step of performing a differential comparison between the second signal set and the first signal set to identify newly added WiFi access points after power-on, forming a list of suspicious devices, includes: For each WiFi access point in the first signal set, a multi-dimensional first feature vector is generated based on the Media Access Control Address, Service Set Identifier, Received Signal Strength Indicator, and Channel. The set of all first feature vectors constitutes a first feature vector group. Similarly, a second feature vector group is constructed based on the second signal set. Using the first feature vector group as a known normal sample set, each second feature vector in the second feature vector group is used as a test sample and input into a pre-trained anomaly detection model. The anomaly detection model is trained by an unsupervised machine learning algorithm and is used to calculate the degree of deviation between the test sample and the normal sample set in the feature space and output anomaly score. Based on the anomaly detection model, each second feature vector is analyzed. If the anomaly score corresponding to the target second feature vector exceeds the preset judgment threshold, the WiFi access point corresponding to the target second feature vector is determined to be an access point added after power-on. All WiFi access points identified as new additions are compiled to form the list of suspicious devices.

4. The intelligent detection method for hidden cameras based on WiFi signal behavior analysis according to claim 3, characterized in that, Before inputting each second feature vector in the second feature vector group as a test sample into the pre-trained anomaly detection model, using the first feature vector group as a known normal sample set, the method further includes: The first feature vector set is used as a normal sample set to characterize the background of the wireless environment of the target room under power failure. An unsupervised anomaly detection algorithm is selected as the model basis. The unsupervised anomaly detection algorithm includes at least one of the following: Isolation Forest, Single-class Support Vector Machine, and Local Anomaly Factor. The model parameters are initialized. The normal sample set is input into the initialized model, so that the model learns the distribution pattern and density structure of the normal sample set in the feature space; After training is complete, the structure and parameters of the model are saved to obtain the trained anomaly detection model.

5. The intelligent detection method for hidden cameras based on WiFi signal behavior analysis according to claim 5, characterized in that, The step of inputting the normal sample set into the initialized model, enabling the model to learn the distribution pattern and density structure of the normal sample set in the feature space, includes: Map each first feature vector in the normal sample set to the feature space defined by the unsupervised anomaly detection algorithm; If the unsupervised anomaly detection algorithm is the Isolation Forest algorithm, then a subset of samples is randomly extracted from the normal sample set; for each subset of samples, feature dimensions and split points are recursively randomly selected to construct multiple isolation trees until each data point is isolated or the tree height limit is reached; the isolation forest model is formed by all the isolation trees, and the isolation forest model characterizes whether a data point is an anomaly by calculating the path length from the root node to the isolated node. If the unsupervised anomaly detection algorithm is a single-class support vector machine algorithm, then in the feature space, find a hypersphere or hyperplane decision boundary that can enclose more than a preset proportion of normal sample points and has the smallest volume; use a kernel function to map the samples to a high-dimensional space to handle nonlinear separable cases, and determine the center and radius or normal vector and bias of the decision boundary. If the unsupervised anomaly detection algorithm is a local anomaly factor algorithm, then for each normal sample point in the feature space, the distance to its k-th nearest neighbor sample point is calculated, and its local reachability density is calculated; by comparing the local reachability density of the sample point with that of its neighbors, the local density distribution pattern of normal samples in the feature space is learned. Based on the training results, the core parameters of the anomaly detection model are determined and solidified; for isolated forests, the core parameter is the structure of all isolated trees in the forest; for single-class support vector machines, the core parameter is the mathematical description of the decision boundary; for local anomaly factors, the core parameters are the distance relationship between normal sample points and the local density distribution. Using the normal sample set as input, the anomaly score of each sample is calculated through the trained anomaly detection model. Based on the statistical distribution of the anomaly scores, the k-th distance threshold, sphere radius threshold, or path length threshold used to determine anomalies in subsequent detection steps are determined.

6. The intelligent detection method for hidden cameras based on WiFi signal behavior analysis according to claim 1, characterized in that, For newly added WiFi access points in the list of suspicious devices, the wireless communication signals emitted by the corresponding access points are collected. From the collected wireless communication signals, radio frequency fingerprint features characterizing inherent hardware defects of the devices are extracted. The extracted radio frequency fingerprint features are matched and analyzed against a pre-stored device feature database to obtain the matching analysis results. Based on the matching analysis results, the type and risk level of the newly added WiFi access point are determined, including: For each new WiFi access point in the list of suspicious devices, the beacon frames or probe response frames periodically sent by the new WiFi access point are monitored through the wireless network card, and probe request frames are actively sent to trigger the response, and the I / Q data of the original wireless communication signal sent by the new WiFi access point are collected. After preprocessing the collected I / Q data, the radio frequency fingerprint features characterizing the inherent defects of the transmitter hardware are extracted to form the feature vector corresponding to the new WiFi access point. The radio frequency fingerprint features include, but are not limited to: transient signal features, modulation domain features, signal statistical features, and spectrum features. The feature vector is input into a pre-stored device feature database for matching analysis, and the feature distance or similarity between the feature vector and each standard feature vector in the device feature database is calculated. The device feature database includes at least a first sub-database and a second sub-database. The first sub-database stores standard radio frequency fingerprint feature vectors of smartphones, laptops, tablets and smart home devices of known brands, and the second sub-database stores radio frequency fingerprint feature vectors of hidden camera modules of known models. If the similarity between the feature vector and any standard feature vector in the second sub-library is higher than the first preset threshold, it is determined to be a hidden camera device and marked as a high-risk level. If the similarity between the feature vector and any standard feature vector in the first sub-library is higher than the second preset threshold, it is determined to be a normal consumer electronic device type and marked as low risk level; If the similarity between the feature vector and both the first and second sub-libraries is below the corresponding threshold, it is determined to be an unknown device type. Analyze the radio frequency fingerprint features of the unknown device type. If the radio frequency fingerprint features of the unknown device type show low complexity or are consistent with the coarse features of common IoT device modules, it is marked as medium risk level; otherwise, it is marked as high risk level.

7. The intelligent detection method for hidden cameras based on WiFi signal behavior analysis according to claim 6, characterized in that, After preprocessing the collected I / Q data, the radio frequency fingerprint features characterizing inherent defects in the transmitter hardware are extracted to form a feature vector corresponding to the newly added WiFi access point, including: The acquired raw I / Q data is preprocessed, including at least noise reduction filtering, DC component elimination, and signal segment alignment. The transient phase at the initial power-on or packet transmission stage of the device is located from the preprocessed signal. The transient feature vector of the transient phase signal is extracted. The transient feature vector includes: power ramp-up time constant, transient envelope waveform complexity, and transient energy distribution characteristics obtained based on empirical mode decomposition or wavelet transform. From the steady-state stage of the preprocessed signal, the modulation domain feature vector characterizing the hardware defects of the transmitter modulation process is extracted. The modulation domain feature vector includes: I / Q imbalance parameters: by calculating the amplitude ratio and phase difference of in-phase and quadrature signals, the gain imbalance and quadrature phase error are obtained; carrier frequency offset: by analyzing the rate of change of the signal phase over time, the deviation between the actual carrier frequency of the transmitter and the center frequency of the standard channel is estimated. Statistical analysis is performed on the envelope of the steady-state signal to extract higher-order statistical moments as statistical feature vectors. The statistical feature vectors include at least skewness and kurtosis. Skewness is used to measure the asymmetry of the amplitude distribution of the signal envelope, and kurtosis is used to measure the sharpness or tailing of the amplitude distribution of the signal envelope. The preprocessed signal is subjected to spectral transformation, and spectral feature vectors are extracted from the power spectral density. The spectral feature vectors include: main lobe width, amplitude and distribution characteristics of out-of-band spurious radiation, and spectral symmetry measure. The extracted transient feature vector, modulation domain feature vector, statistical feature vector, and spectral feature vector are concatenated and normalized to form the final feature vector used to characterize the hardware identity of the newly added WiFi access point.

8. A hidden camera intelligent detection device based on WiFi signal behavior analysis, characterized in that, The device includes: The power failure detection module is used to control the detection device to perform the first WiFi signal scan when the target room is in a power failure state, capture and record the first signal set, which contains the first identity information of each WiFi access point in the environment; The power-on detection module is used to control the detection device to perform a second WiFi signal scan within a preset time window after detecting that the target room is powered on, to capture and record a second signal set, which contains the second identity information of each WiFi access point in the current environment. The signal analysis module is used to perform differential comparison between the second signal set and the first signal set to identify newly added WiFi access points after power-on and form a list of suspicious devices. The feature detection module is used to collect the wireless communication signals emitted by the newly added WiFi access points in the list of suspicious devices, extract radio frequency fingerprint features that characterize the inherent defects of the device hardware from the collected wireless communication signals, perform matching analysis on the extracted radio frequency fingerprint features with the pre-stored device feature database, obtain the matching analysis results, and determine the type and risk level of the newly added WiFi access point based on the matching analysis results.

9. A control device, characterized in that, The device includes: A memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1 to 7.

Images