An abnormal risk identification positioning method, system, device and medium for wireless communication

Abstract

This application relates to a method, system, device, and medium for identifying and locating abnormal risks in wireless communication. The method includes: generating a joint record of parsed signals based on multiple wireless data packets; constructing a spatiotemporal protocol joint trajectory and topology network based on this record; generating a labeled trajectory by calculating behavioral anomaly and consistency anomaly based on a dual-model approach; screening targets to be induced based on risk labels in the labeled trajectory, directionally transmitting induced detection frames, reinjecting response data packets, and iteratively optimizing the trajectory; extracting the temporal and spatial variation features of the received signal strength indication value of the target to be induced based on the optimized spatiotemporal protocol joint trajectory; performing anomaly analysis based on the temporal and spatial variation features to obtain identification results and location information. This method further improves the accuracy of identifying and locating abnormal wireless devices through multi-protocol parsing, dual-model anomaly determination, active directional induction, and spatiotemporal feature refinement.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and in particular relates to a method, system, device and medium for identifying and locating abnormal risks in wireless communication. Background Technology

[0002] With the rapid popularization of wireless communication technology, Wi-Fi and Bluetooth have been widely used in core scenarios such as classified locations and security control areas. However, while improving communication convenience, illegal access points, disguised hotspots, and concealed wireless terminals have also continued to proliferate, easily leading to information leakage, network interference, and other security problems, posing a serious threat to the wireless communication security of classified environments. Specifically, current wireless device detection and positioning technologies have many limitations: First, insufficient protocol coverage, incompatible with next-generation wireless communication protocols such as Wi-Fi 7 and Bluetooth 5.4, making it difficult to achieve full protocol depth detection and resulting in obvious detection blind spots; second, reliance on passive listening modes, lacking active triggering mechanisms, failing to trigger concealed illegal terminals to actively send packets, making it difficult to quickly discover concealed devices, resulting in low detection efficiency and completeness; third, positioning algorithms only use single signal feature analysis, without combining signal temporal changes and spatial distribution characteristics for joint calculation, resulting in limited positioning accuracy and failing to meet the control requirements for precise positioning in classified scenarios; fourth, lack of link association topology reconstruction capabilities between terminals and access points, resulting in insufficient network structure support for abnormal risk identification and inadequate identification accuracy. Summary of the Invention

[0003] Based on this, it is necessary to provide a method, system, device, and medium for identifying and locating abnormal risks in wireless communication to address the above-mentioned technical problems, aiming to improve the efficiency of detecting concealed devices and enhance the accuracy of positioning and identification of abnormal risks.

[0004] Firstly, this application provides a method for identifying and locating abnormal risks in wireless communication, including:

[0005] S1: Perform multi-protocol parsing on multiple wireless data packets to obtain the protocol fields. Bind the protocol fields, arrival timestamps, received signal strength indicators, and corresponding monitoring point identifiers of each wireless data packet to generate a joint parsing record.

[0006] S2: Aggregate the joint records of the parsed signals, generate a corresponding joint feature tuple for each device, arrange the joint feature tuples of the same device in a continuous time window in chronological order, construct the spatiotemporal protocol joint trajectory, and establish the link association between the terminal and the access point based on the protocol field content of each device to obtain the topology network structure.

[0007] S3: Based on the topological network structure, protocol feature vectors and received signal strength indication (RSI) observation vector sequences are extracted from the spatiotemporal protocol joint trajectory. Anomalies are calculated on the protocol feature vectors and RSI observation vector sequences using the protocol behavior baseline model and the signal space consistency model, respectively, to obtain behavior anomalies and consistency anomalies. Based on behavior anomalies and consistency anomalies, the joint feature tuples are labeled to generate labeled joint feature tuples. The spatiotemporal protocol joint trajectory is updated using the labeled joint feature tuples to obtain the labeled trajectory.

[0008] S4: Select targets to be induced based on the risk labels in the marked trajectory, perform coarse positioning based on the received signal strength indication value observation vector of the target to be induced, and obtain coarse coordinates, azimuth interval and distance estimate; construct induced detection frames based on the protocol feature vector of the target to be induced, set transmission parameters based on azimuth interval and distance estimate, and transmit induced detection frames in a directional manner; obtain the response data packets of the target to be induced, process the response data packets in the manner of S1, generate a joint record of response signals, merge the joint record of response signals and the joint record of analytical signals to obtain an updated joint record of analytical signals, repeat S2 and S3 to obtain the optimized spatiotemporal protocol joint trajectory;

[0009] S5: Based on the optimized spatiotemporal protocol joint trajectory, extract the temporal and spatial variation characteristics of the received signal strength indication value of the target to be induced, perform anomaly analysis based on the temporal and spatial variation characteristics, and obtain the identification results and positioning information.

[0010] In one embodiment, multiple wireless data packets are parsed using multiple protocols to obtain protocol fields. The protocol fields, arrival timestamps, received signal strength indicators, and corresponding monitoring point identifiers of each wireless data packet are then bound together to generate a joint parsed signal record, including:

[0011] Collect wireless signals within the target area to obtain multiple wireless data packets;

[0012] By using a global clock synchronization reference, the arrival time of each wireless data packet is marked, and the arrival timestamp of each wireless data packet is obtained.

[0013] Perform protocol type identification processing on each wireless data packet to obtain the type identification result. Based on the type identification result, perform Wi-Fi protocol parsing and Bluetooth protocol parsing respectively to obtain the corresponding protocol fields.

[0014] Collect the received signal strength indication value of each wireless data packet at the corresponding monitoring point, and determine the monitoring point identifier corresponding to each wireless data packet;

[0015] The protocol fields, arrival timestamps, received signal strength indicators, and monitoring point identifiers of each wireless data packet are bound together to generate a joint record of the parsed signal.

[0016] In one embodiment, the joint records of the parsed signals are aggregated to generate a corresponding joint feature tuple for each device. The joint feature tuples of the same device within a continuous time window are arranged in chronological order to construct a spatiotemporal protocol joint trajectory. Furthermore, the link association between the terminal and the access point is established based on the protocol field content of each device, resulting in a topology network structure, including:

[0017] The continuous time axis is divided into multiple equal-length and non-overlapping time windows. Based on the arrival timestamps of the joint records of each analytical signal, the joint records of the analytical signals are divided into the corresponding time windows.

[0018] For the joint records of analytical signals within the same time window, perform device identity classification processing, collect the corresponding joint records of analytical signals for each device, and obtain the collected joint records of analytical signals.

[0019] Extract the protocol fields corresponding to each device from the aggregated analytical signal joint record to obtain the protocol field content of each device;

[0020] Identify the access point identifier and device type information from the protocol fields of each device to distinguish between terminal devices and access point devices;

[0021] Based on the aggregated joint record of the analytical signals, calculate the statistical characteristics of the received signal strength indication value and the quantitative characteristics of the protocol behavior of each device, and generate the joint feature tuple corresponding to each device.

[0022] The joint feature tuples of the same device within a continuous time window are processed in chronological order to construct a spatiotemporal protocol joint trajectory.

[0023] Based on the protocol field content and access point identifier of each device, the communication association between the terminal device and the access point device is matched, the link correspondence between the terminal and the access point is established, and the topology network structure is generated.

[0024] In one embodiment, based on the topological network structure, protocol feature vectors and received signal strength indication (RSI) observation vector sequences are extracted from the spatiotemporal protocol joint trajectory. Anomalies are calculated on the protocol feature vectors and RSI observation vector sequences using both a protocol behavior baseline model and a signal spatial consistency model, yielding behavior anomalies and consistency anomalies. Based on these behavior anomalies and consistency anomalies, the joint feature tuples are labeled to generate labeled joint feature tuples, including:

[0025] The spatiotemporal protocol joint trajectories of multiple historical normally operating equipment were collected, and the protocol feature vectors of each historical normally operating equipment were extracted. Based on the protocol feature vectors of each historical normally operating equipment, unsupervised clustering was used to determine the cluster center and feature distribution interval of normal protocol behavior, and a baseline model of protocol behavior was constructed.

[0026] Based on the temporal variation data and spatial distribution data of the received signal strength indication values ​​of historically operating equipment within the topological network structure, the signal propagation characteristics of historically operating equipment are extracted, and a signal spatial consistency model is established.

[0027] Based on the topological network structure, the communication association range between each device is determined, and the protocol feature vector and the observed vector sequence of received signal strength indication value of each device are extracted from the spatiotemporal protocol joint trajectory.

[0028] The protocol feature vector is input into the protocol behavior baseline model to calculate the behavior anomaly degree used to characterize the device behavior deviating from the normal mode;

[0029] The sequence of received signal strength indication observation vectors is input into the signal spatial consistency model to calculate the consistency anomaly degree, which characterizes the signal spatial distribution as not conforming to physical laws.

[0030] Based on the magnitude of the behavioral anomaly degree and the consistency anomaly degree, a risk level determination is performed to obtain the risk level corresponding to each device. Risk labels corresponding to the risk level are added to the joint feature tuples of each device to generate labeled joint feature tuples.

[0031] In one embodiment, targets to be induced are screened based on risk labels in the marked trajectory; coarse positioning is performed based on the received signal strength indication value observation vector of the target to be induced, obtaining coarse coordinates, azimuth interval, and distance estimate; an induced detection frame is constructed based on the protocol feature vector of the target to be induced; transmission parameters are set based on the azimuth interval and distance estimate; and the induced detection frame is directionally transmitted, including:

[0032] Traverse the risk labels in the marked trajectory and filter out devices whose risk level is higher than the preset level standard as targets to be induced;

[0033] Based on the observation vector sequence of the received signal strength indication value of the target to be induced, the observation vector of the received signal strength indication value of the target to be induced is extracted. The received signal strength indication value corresponding to each monitoring point is obtained from the observation vector of the received signal strength indication value of the target to be induced. The received signal strength indication value corresponding to each monitoring point is used as the weight of coordinate estimation. Combined with the coordinates of each monitoring point, coordinate estimation processing is performed to obtain the coarse coordinates, azimuth interval and distance estimate of the target to be induced.

[0034] Determine the target azimuth for directional launch based on the azimuth angle range;

[0035] The device type is determined based on the protocol feature vector of the target to be induced, and the corresponding frame structure rules are matched according to the device type to construct the corresponding induced detection frame;

[0036] The beam pointing parameters are set according to the azimuth angle range, and the transmit power parameters are set according to the distance estimation.

[0037] Based on beam pointing parameters and transmit power parameters, induced detection frames are transmitted directionally to the target location using a directional antenna array.

[0038] In one embodiment, based on the optimized spatiotemporal protocol joint trajectory, the temporal and spatial variation characteristics of the received signal strength indication value of the target to be induced are extracted. Anomaly analysis is performed based on the temporal and spatial variation characteristics to obtain identification results and positioning information, including:

[0039] Extract the received signal strength indication data of the target to be induced within a continuous preset time window from the optimized spatiotemporal protocol joint trajectory;

[0040] Based on the time series distribution of the received signal strength indication data, the temporal variation characteristics of the target to be induced are obtained;

[0041] Based on the distribution differences of received signal strength indication data among multiple monitoring points, and combined with preset signal propagation attenuation characteristics, a correlation analysis is performed to obtain the spatial variation characteristics of the target to be induced.

[0042] Based on the temporal change characteristics, the continuity of equipment behavior is determined to obtain a first determination result; based on the spatial change characteristics, the rationality of equipment location is determined, and a second determination result is obtained by matching a preset physical space propagation model; combining the first determination result and the second determination result, a multi-dimensional anomaly review analysis is performed to obtain anomaly review results.

[0043] Based on the anomaly review results, the identity type of the target to be induced is confirmed. The risk assessment criteria corresponding to the identity type are matched to determine the final risk level of the target to be induced. The identity type and the final risk level are integrated to generate the corresponding identification result.

[0044] Based on the spatial variation characteristics of the received signal strength indication data, directional analysis is performed on the signal strength differences at each monitoring point to obtain the azimuth trend of the target to be induced; based on the temporal variation characteristics of the received signal strength indication data, fitting analysis is performed on the signal strength changes over a continuous preset time window to obtain the distance variation trend of the target to be induced.

[0045] By combining the orientation trend and the distance change trend, the rough coordinates of the target to be induced are refined to obtain the positioning information.

[0046] Secondly, this application also provides a wireless communication-based anomaly risk identification and positioning system, comprising:

[0047] The protocol parsing and record generation module is used to execute S1. S1 includes: performing multi-protocol parsing on multiple wireless data packets to obtain protocol fields, binding the protocol fields, arrival timestamps, received signal strength indication values ​​and corresponding monitoring point identifiers of each wireless data packet, and generating a joint record of parsed signals.

[0048] The trajectory construction and topology association module is used to execute S2. S2 includes: aggregating the joint records of the parsed signals, generating a corresponding joint feature tuple for each device, arranging the joint feature tuples of the same device in a continuous time window in chronological order, constructing a spatiotemporal protocol joint trajectory, and establishing the link association relationship between the terminal and the access point based on the protocol field content of each device to obtain the topology network structure.

[0049] The anomaly detection and trajectory labeling module is used to execute S3. S3 includes: extracting protocol feature vectors and received signal strength indication (RSI) observation vector sequences from the spatiotemporal protocol joint trajectory based on the topology network structure; calculating the anomaly degree of the protocol feature vectors and RSI observation vector sequences using the protocol behavior baseline model and the signal space consistency model, respectively, to obtain the behavior anomaly degree and the consistency anomaly degree; labeling the joint feature tuples based on the behavior anomaly degree and the consistency anomaly degree to generate labeled joint feature tuples; and updating the spatiotemporal protocol joint trajectory using the labeled joint feature tuples to obtain the labeled trajectory.

[0050] The induced detection and trajectory optimization module is used to execute S4. S4 includes: screening targets to be induced based on risk labels in the labeled trajectory; performing coarse positioning based on the received signal strength indication value observation vector of the target to be induced to obtain coarse coordinates, azimuth interval, and distance estimate; constructing induced detection frames based on the protocol feature vector of the target to be induced; setting transmission parameters based on the azimuth interval and distance estimate; and directionally transmitting the induced detection frames; acquiring the response data packets of the target to be induced; processing the response data packets according to the method of S1 to generate a joint record of response signals; merging the joint record of response signals and the joint record of analytical signals to obtain an updated joint record of analytical signals; and repeating S2 and S3 to obtain the optimized spatiotemporal protocol joint trajectory.

[0051] The feature analysis and risk location module is used to execute S5. S5 includes: extracting the temporal and spatial variation features of the received signal strength indication value of the target to be induced based on the optimized spatiotemporal protocol joint trajectory; performing anomaly analysis based on the temporal and spatial variation features to obtain the identification results and location information.

[0052] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the first aspect.

[0053] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the first aspect.

[0054] The aforementioned method, system, device, and medium for identifying and locating anomalies in wireless communication firstly constructs a joint spatiotemporal protocol trajectory and topology network structure for devices by generating multi-protocol parsing and joint signal recording, laying a data foundation for subsequent anomaly analysis. Secondly, based on dual-model anomaly degree calculation and labeled trajectory updates, it overcomes the shortcomings of traditional single-feature detection, such as high false alarm rates and difficulty in detecting concealed devices, achieving joint analysis of behavioral and signal anomalies. Furthermore, it actively triggers concealed terminals through induced detection and response feedback mechanisms, avoiding the limitations of silent evasion of concealed devices in passive monitoring mode and improving the efficiency of concealed threat detection. Further, it achieves precise location based on optimized trajectory extraction of temporal-spatial joint features, solving the problem of insufficient accuracy in traditional single-point location. Finally, it integrates topology correlation analysis and multi-dimensional anomaly identification to form a risk location closed loop, effectively compensating for the lack of network structure support and active induction capabilities in existing anomaly identification methods. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 A flowchart of an abnormal risk identification and location method for wireless communication is provided as an exemplary embodiment of the present invention;

[0057] Figure 2 A flowchart illustrating a method for constructing and transmitting induced detection frames is provided as an exemplary embodiment of the present invention.

[0058] Figure 3 This is a schematic diagram of an abnormal risk identification and positioning system for wireless communication, provided as an exemplary embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] In one embodiment, such as Figure 1 As shown, a method for identifying and locating abnormal risks in wireless communication is provided. This embodiment illustrates the application of this method to a terminal. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0061] S1: Perform multi-protocol parsing on multiple wireless data packets to obtain the protocol fields. Bind the protocol fields, arrival timestamps, received signal strength indicators, and corresponding monitoring point identifiers of each wireless data packet to generate a joint parsing signal record.

[0062] Specifically, multi-channel wireless signal acquisition devices deployed within the target area can capture multiple wireless data packets propagating within the target area in real time, covering signals corresponding to wireless communication protocols such as Wi-Fi and Bluetooth. These devices can also acquire the arrival timestamps of the data packets, the Received Signal Strength Indicator (RSSI) values ​​at the corresponding monitoring points, and the corresponding monitoring point identifiers. Subsequently, protocol type identification algorithms, such as those based on packet frame header feature matching, can determine the protocol type of each wireless data packet. Furthermore, protocol parsing can be performed separately for protocols such as Wi-Fi and Bluetooth, extracting key protocol fields including device identifier (MAC address), frame type, communication parameters, and access point association information. Finally, the protocol fields, arrival timestamps, RSSI values, and monitoring point identifiers of each wireless data packet are bound together to generate a joint analytical signal record containing multi-dimensional key information. This record ensures the integrity of individual data packet information and provides a correlation basis for subsequent data aggregation across monitoring points and time dimensions, effectively solving the problems of discretized and uncorrelated raw data.

[0063] S2: Aggregate the joint records of the analytical signals, generate a corresponding joint feature tuple for each device, arrange the joint feature tuples of the same device in a continuous time window in chronological order, construct the spatiotemporal protocol joint trajectory, and establish the link association between the terminal and the access point based on the protocol field content of each device to obtain the topology network structure.

[0064] Specifically, based on the arrival timestamps of each joint record of parsed signals, data can be allocated to corresponding time windows to ensure the rationality of data temporal partitioning. Then, based on the device identifier in the protocol field, device identity classification processing can be performed on the joint records of parsed signals within the same time window, aggregating all records belonging to the same device to achieve single-device data aggregation. Based on the aggregated joint records of parsed signals, the RSSI statistical characteristics (such as mean, variance, and peak value) and protocol behavior quantitative characteristics (such as communication frequency, frame type proportion, and data transmission rate) of each device within the corresponding time window can be calculated and integrated to form the joint feature tuple of that device within that time window. Furthermore, since data from a single moment cannot reflect the dynamic behavior and network affiliation of a device, the joint feature tuples of the same device within consecutive time windows can be arranged sequentially by time to construct a spatiotemporal protocol joint trajectory that reflects the temporal changes and spatial distribution characteristics of device communication behavior. This trajectory fully preserves the communication behavior patterns of the device in both time and space dimensions. In addition, the link association between the terminal and the access point can be restored by relying on the protocol fields, and the topology network structure of wireless communication in the target area can be generated. This structure clearly presents the communication connection status between devices, providing a scenario basis for subsequent anomaly analysis based on topology association.

[0065] S3: Based on the topological network structure, extract the protocol feature vector and the received signal strength indicator observation vector sequence from the spatiotemporal protocol joint trajectory. Calculate the anomaly degree of the protocol feature vector and the received signal strength indicator observation vector sequence using the protocol behavior baseline model and the signal space consistency model, respectively, to obtain the behavior anomaly degree and the consistency anomaly degree. Based on the behavior anomaly degree and the consistency anomaly degree, label the joint feature tuple to generate labeled joint feature tuples. Update the spatiotemporal protocol joint trajectory using the labeled joint feature tuples to obtain the labeled trajectory.

[0066] Specifically, based on the topological network structure, the communication association range of each device can be clearly defined. Protocol feature vectors (composed of protocol behavior features) and RSSI observation vector sequences (composed of RSSI statistical features for each time window) for each device can be extracted from the spatiotemporal protocol joint trajectory. The protocol behavior baseline model can be constructed by collecting a large number of historically operating devices' spatiotemporal protocol joint trajectories, extracting their protocol feature vectors, and performing unsupervised clustering such as K-means clustering. The signal spatial consistency model can be constructed by extracting signal propagation features (such as path loss patterns and signal strength correlation patterns among multiple monitoring points) based on the RSSI time-series variation data and spatial distribution data of historically operating devices within the topological network structure. Therefore, by inputting the device's protocol feature vector into the protocol behavior baseline model, the distance deviation between this vector and the center of the normal cluster can be calculated, outputting the behavior anomaly degree representing the deviation of device behavior from the normal pattern. Inputting the RSSI observation vector sequence into the signal spatial consistency model can output the consistency anomaly degree representing the rationality of the signal spatial distribution. By combining the numerical values ​​of behavioral anomaly and consistency anomaly, risk level determinations such as low risk, medium risk, and high risk can be performed. Corresponding risk labels are added to the joint feature tuples of each device to generate labeled joint feature tuples. These labeled joint feature tuples are then used to update the original spatiotemporal protocol joint trajectory to obtain the labeled trajectory. This trajectory retains the spatiotemporal behavioral information of the devices and clarifies the risk status at each stage, providing a direct basis for the subsequent screening of targets to be induced.

[0067] S4: Select targets to be induced based on the risk labels in the marked trajectory, perform coarse positioning based on the received signal strength indication value observation vector of the target to be induced, and obtain coarse coordinates, azimuth interval and distance estimate; construct induced detection frames based on the protocol feature vector of the target to be induced, set transmission parameters based on azimuth interval and distance estimate, and transmit induced detection frames in a directional manner; obtain the response data packets of the target to be induced, process the response data packets in the manner of S1, generate a joint record of response signals, merge the joint record of response signals and the joint record of analytical signals to obtain an updated joint record of analytical signals, repeat S2 and S3 to obtain the optimized spatiotemporal protocol joint trajectory.

[0068] Specifically, concealed illegal devices are usually in a silent state, but can be triggered to actively respond through directional induction, supplementing effective observation data. Therefore, risk labels in the marked trajectory can be traversed first to filter out targets to be induced, ensuring the resource focus of induced detection. Subsequently, a rough location can be performed by observing the received signal strength indicator value to obtain rough coordinates, azimuth intervals, and distance estimates. Based on the protocol feature vector of the target to be induced, its device type can be determined. According to the frame structure rules of the corresponding protocol, an induced detection frame containing specific detection commands can be constructed to ensure that the induced signal can be recognized and responded to by the target device. After setting the beam pointing parameters of the directional antenna array based on the azimuth interval and the transmission power parameters based on the distance estimate, the induced detection frame can be transmitted through the directional antenna array to reduce invalid interference. After obtaining the response data packet of the target to be induced, the response data packet can be processed according to the processing method in step S1, performing multi-protocol parsing, timestamp marking, RSSI acquisition and monitoring point identification binding to generate a joint record of response signals with induced response markers. After merging the joint record of the response signal with the joint record of the original analytical signal, the aggregation processing and topology construction of S2 and the anomaly calculation and labeling update of S3 are repeatedly executed. This can continuously supplement the equipment observation features and obtain the optimized spatiotemporal protocol joint trajectory, which contains more comprehensive and accurate equipment behavior information.

[0069] S5: Based on the optimized spatiotemporal protocol joint trajectory, extract the temporal and spatial variation characteristics of the received signal strength indication value of the target to be induced, perform anomaly analysis based on the temporal and spatial variation characteristics, and obtain the identification results and positioning information.

[0070] Specifically, the optimized spatiotemporal protocol joint trajectory includes the continuous temporal and spatial characteristics of the device, which can comprehensively reflect the device's behavioral patterns and spatial distribution. By combining the two types of characteristics for anomaly verification analysis, the final confirmation of anomaly risks can be completed. Furthermore, based on these characteristics, precise location calculations can be performed simultaneously, and finally, the final identification results and positioning information are output, enabling efficient identification and accurate positioning of abnormal wireless devices.

[0071] The aforementioned method first generates a joint record of parsed signals through multi-protocol parsing and data binding. This record is then aggregated to construct a spatiotemporal protocol joint trajectory and reconstruct the topological network structure, addressing the issues of fragmented wireless detection data and lack of network connectivity, thus providing a data foundation for subsequent anomaly identification. Secondly, it calculates dual-dimensional anomaly scores based on a dual-model approach and generates labeled trajectories, resolving the problems of low accuracy and ambiguous risk assessment in single-dimensional identification, thereby improving the precision of anomaly device identification. Furthermore, it iteratively optimizes trajectories through active induced detection and data feedback, addressing the difficulties of passive detection in discovering concealed devices and insufficient positioning accuracy, achieving continuous refinement of device trajectories. Finally, it combines temporal and spatial variation characteristics to complete anomaly analysis and output results, resolving the issues of a lack of closed-loop identification and inaccurate results in wireless anomaly risk identification and positioning, achieving efficient identification and accurate positioning of illegal wireless devices.

[0072] In one embodiment, multiple wireless data packets are parsed using multiple protocols to obtain protocol fields. The protocol fields, arrival timestamps, received signal strength indicators, and corresponding monitoring point identifiers of each wireless data packet are then bound together to generate a joint parsed signal record, including:

[0073] Collect wireless signals within the target area to obtain multiple wireless data packets;

[0074] By using a global clock synchronization reference, the arrival time of each wireless data packet is marked, and the arrival timestamp of each wireless data packet is obtained.

[0075] Perform protocol type identification processing on each wireless data packet to obtain the type identification result. Based on the type identification result, perform Wi-Fi protocol parsing and Bluetooth protocol parsing respectively to obtain the corresponding protocol fields.

[0076] Collect the received signal strength indication value of each wireless data packet at the corresponding monitoring point, and determine the monitoring point identifier corresponding to each wireless data packet;

[0077] The protocol fields, arrival timestamps, received signal strength indicators, and monitoring point identifiers of each wireless data packet are bound together to generate a joint record of the parsed signal.

[0078] Specifically, a broadband wireless signal monitoring operation can be conducted first using a radio frequency signal acquisition module deployed in the target area. This module supports full-band signal acquisition for Wi-Fi 7 and Bluetooth 5.4, enabling real-time capture of wireless communication signals emitted by various wireless terminals, access points, and concealed devices within the target area. After signal conditioning and analog-to-digital conversion, it can output discrete wireless data packets, covering all types of communication frames, including Wi-Fi Beacon frames, Probe frames, Association frames, and Bluetooth broadcast frames. After wireless data packet acquisition, a global clock synchronization reference can be used to mark the precise arrival time of each wireless data packet. This reference can be achieved through a unified clock calibration mechanism across multiple monitoring points, thereby eliminating clock offset errors between different monitoring points and assigning each wireless data packet a unique and comparable arrival timestamp. This timestamp serves as the time reference for subsequent time series analysis, trajectory construction, and anomaly detection, ensuring time series consistency.

[0079] Subsequently, based on the frame header features, modulation scheme, communication rate, and protocol feature fields of the wireless data packets, protocol type identification processing can be performed on all wireless data packets. The output identification results can clearly distinguish between Wi-Fi and Bluetooth protocol types. Further, based on the identification results, corresponding protocol parsing processes can be initiated. For example, deep parsing can be performed on the Wi-Fi 7 protocol to extract protocol fields such as MAC address, communication channel, encryption method, and connection status. For the Bluetooth 5.4 protocol, broadcast data and connection interaction data parsing can be performed to extract protocol fields such as device identifier, broadcast interval, connection status, and signal characteristics. In addition, the received signal strength indication value of wireless data packets at the current monitoring point can be collected through the signal strength detection unit built into each monitoring point. Each monitoring point is pre-configured with a unique and fixed monitoring point identifier, which is bound to the monitoring point's physical location and hardware number. After collection, the received signal strength indication value can be initially associated with the corresponding monitoring point identifier, ensuring the traceability of spatially collected information.

[0080] Finally, the protocol fields, arrival timestamp, received signal strength indicator value, and monitoring point identifier corresponding to a single wireless data packet can be bound and integrated in four dimensions through a data association matching algorithm to generate a standardized analytical signal joint record. This analytical signal joint record integrates four core types of information: protocol characteristics, time, signal strength, and spatial location. It provides a unified structured data carrier for subsequent data aggregation, trajectory construction, anomaly identification, and location handling, ensuring the data integrity and relevance of subsequent processing procedures.

[0081] In one embodiment, the joint records of the parsed signals are aggregated to generate a corresponding joint feature tuple for each device. The joint feature tuples of the same device within a continuous time window are arranged in chronological order to construct a spatiotemporal protocol joint trajectory. Furthermore, the link association between the terminal and the access point is established based on the protocol field content of each device, resulting in a topology network structure, including:

[0082] The continuous time axis is divided into multiple equal-length and non-overlapping time windows. Based on the arrival timestamps of the joint records of each analytical signal, the joint records of the analytical signals are divided into the corresponding time windows.

[0083] For the joint records of analytical signals within the same time window, perform device identity classification processing, collect the corresponding joint records of analytical signals for each device, and obtain the collected joint records of analytical signals.

[0084] Extract the protocol fields corresponding to each device from the aggregated analytical signal joint record to obtain the protocol field content of each device;

[0085] Identify the access point identifier and device type information from the protocol fields of each device to distinguish between terminal devices and access point devices;

[0086] Based on the aggregated joint record of the analytical signals, calculate the statistical characteristics of the received signal strength indication value and the quantitative characteristics of the protocol behavior of each device, and generate the joint feature tuple corresponding to each device.

[0087] The joint feature tuples of the same device within a continuous time window are processed in chronological order to construct a spatiotemporal protocol joint trajectory.

[0088] Based on the protocol field content and access point identifier of each device, the communication association between the terminal device and the access point device is matched, the link correspondence between the terminal and the access point is established, and the topology network structure is generated.

[0089] Specifically, based on the communication frequency of wireless devices within the target area, the continuous timeline of the system operation can be divided into multiple equal-length, non-overlapping time windows according to a unified scale. After division, all parsed signal joint records are traversed, and the arrival timestamp carried by each record is matched with the time interval of each time window to accurately allocate the parsed signal joint records to their respective time windows. This achieves time-series slicing management of discrete data and provides time-series boundaries for subsequent single-device data aggregation. After time-series allocation, device identification processing can be performed on all parsed signal joint records within a single time window using the device's unique identifier as the core index. The device's unique identifier can be extracted from the protocol field, prioritizing the extraction of the MAC address of Wi-Fi 7 devices and the device identifier of Bluetooth 5.4 devices. For devices with ambiguous identifiers, frame structure features and communication behavior features can be combined for auxiliary determination. Through identifier matching, all parsed signal joint records belonging to the same physical device can be aggregated and integrated to form a single-device-specific aggregated parsed signal joint record, ensuring that multi-dimensional data collected from the same device is not confused.

[0090] Subsequently, the protocol fields of the corresponding devices can be extracted from the aggregated and analyzed signal joint records. These protocol fields may include characteristic information such as SSID, BSSID, communication channel, encryption method, broadcast interval, and connection status under Wi-Fi 7 and Bluetooth 5.4 protocols. Based on the extracted protocol fields, terminal devices and access point devices within the target area can be clearly distinguished by identifying the access point's unique identifier and terminal device characteristic fields. The access point identifier includes the BSSID and hotspot service set identifier, while the terminal device characteristics include fields related to active probe frames and connection request frames, providing a basis for subsequent link association and topology construction.

[0091] Furthermore, based on the joint record of the analyzed signals collected from a single device, the statistical characteristics of the received signal strength indication (RSI) and the quantitative characteristics of the protocol behavior of the device can be calculated separately. The RSI statistical characteristics can be calculated using a weighted statistical method, with the weighting factor dynamically allocated based on the reliability of the monitoring points. The reliability of the monitoring points can be obtained through calibration of their historical data integrity and hardware operational stability. Illustratively, the RSI statistical characteristics can be calculated using the following formula:

[0092]

[0093] in, This is a weighted statistical feature of the device's received signal strength indication value. This represents the number of valid signal acquisitions by a single device within the current time window (the amount of data acquired after removing outliers). For the first The reliability weight of the monitoring point corresponding to each data collection is in the range of 0-1, determined by the formula... Calculations show that This represents the number of times historical data for this monitoring point has been lost. This represents the total number of historical data collections for this monitoring point. This is the raw received signal strength indication value for a single acquisition.

[0094] Specifically, protocol behavior quantification features can be obtained by combining the protocol characteristics of Wi-Fi 7 and Bluetooth 5.4 to accurately statistically analyze core behavioral indicators for different device types. For example, for access point devices, the frequency of Beacon frame broadcasts, access request response rate, channel occupancy time percentage, and number of encryption method switching times per unit time can be statistically analyzed. For terminal devices, the frequency of Probe Request frame transmissions, number of association request attempts, data frame transmission rate fluctuations, and Bluetooth broadcast packet transmission interval stability can be statistically analyzed. All of the above indicators are calculated using the current time window as the statistical period to ensure that the features accurately reflect the device's communication behavior patterns within that time period. By integrating the statistical features of received signal strength indication values ​​with the protocol behavior quantification features according to a preset data structure, a joint feature tuple representing the overall state of the device can be generated. This joint feature tuple includes the device's protocol behavior, signal strength, and spatial acquisition information.

[0095] Specifically, joint feature tuples generated by the same physical device within multiple consecutive time windows can be arranged in chronological order of arrival timestamps to form a spatiotemporal protocol joint trajectory that fully reflects the temporal changes in device communication behavior, spatial distribution of signal strength, and dynamic evolution of protocol characteristics. This trajectory provides the core data carrier for subsequent anomaly identification and near-field localization. Furthermore, based on the protocol field content of each device and the identified access point identifiers, communication link matching between terminals and access points can be performed. During the matching process, protocol interaction frames can be used as the core basis to establish a one-to-one or many-to-one link correspondence between terminal devices and corresponding access point devices. Integrating the link correspondences and device type information, the wireless communication network structure within the target area can be reconstructed, generating a network device topology and link relationship diagram. This topology provides the environmental foundation for anomaly risk identification, proactive triggering, and control.

[0096] In one embodiment, based on the topological network structure, protocol feature vectors and received signal strength indication (RSI) observation vector sequences are extracted from the spatiotemporal protocol joint trajectory. Anomalies are calculated on the protocol feature vectors and RSI observation vector sequences using both a protocol behavior baseline model and a signal spatial consistency model, yielding behavior anomalies and consistency anomalies. Based on these behavior anomalies and consistency anomalies, the joint feature tuples are labeled to generate labeled joint feature tuples, including:

[0097] The spatiotemporal protocol joint trajectories of multiple historical normally operating equipment were collected, and the protocol feature vectors of each historical normally operating equipment were extracted. Based on the protocol feature vectors of each historical normally operating equipment, unsupervised clustering was used to determine the cluster center and feature distribution interval of normal protocol behavior, and a baseline model of protocol behavior was constructed.

[0098] Based on the temporal variation data and spatial distribution data of the received signal strength indication values ​​of historically operating equipment within the topological network structure, the signal propagation characteristics of historically operating equipment are extracted, and a signal spatial consistency model is established.

[0099] Based on the topological network structure, the communication association range between each device is determined, and the protocol feature vector and the observed vector sequence of received signal strength indication value of each device are extracted from the spatiotemporal protocol joint trajectory.

[0100] The protocol feature vector is input into the protocol behavior baseline model to calculate the behavior anomaly degree used to characterize the device behavior deviating from the normal mode;

[0101] The sequence of received signal strength indication observation vectors is input into the signal spatial consistency model to calculate the consistency anomaly degree, which characterizes the signal spatial distribution as not conforming to physical laws.

[0102] Based on the magnitude of the behavioral anomaly degree and the consistency anomaly degree, a risk level determination is performed to obtain the risk level corresponding to each device. Risk labels corresponding to the risk level are added to the joint feature tuples of each device to generate labeled joint feature tuples.

[0103] Specifically, when constructing the protocol behavior baseline model, the spatiotemporal protocol joint trajectories of multiple historically operating devices can be retrieved through the data storage module. These historically operating devices can include compliant Wi-Fi 7 terminals, access points, Bluetooth 5.4 terminals, gateway devices, etc., and the trajectory data covers the entire normal communication process. Protocol feature vectors for each historically operating device can be extracted from these trajectories. These feature vectors integrate standardized quantitative features such as frame type distribution, communication frequency, encryption configuration, broadcast interval, and connection status. Based on these feature vectors, unsupervised clustering can be performed. The clustering algorithm iteratively calculates the cluster centers for normal protocol behavior, determines the normal distribution range of each feature dimension, and removes abnormal noise data during the clustering process. This ensures that the constructed protocol behavior baseline model accurately represents the standard protocol behavior patterns of compliant devices, providing a benchmark for identifying abnormal behavior.

[0104] Specifically, when constructing a signal spatial consistency model, a topological network structure can be used as a basis. Historical data on the temporal variation and spatial distribution of received signal strength indicators at various monitoring points for normally operating equipment can be retrieved. Combined with the physical propagation laws of wireless signals, signal propagation characteristics under normal conditions can be extracted, such as the attenuation characteristics of signal strength with transmission distance, the correlation characteristics of signal strength among multiple monitoring points, and the stationarity of temporal variations. Integrating these characteristics into signal spatial consistency judgment rules can form a signal spatial consistency model. This model, constrained by the topological correlation range, only judges signal data within the effective communication coverage area of ​​the equipment, thus improving model adaptability and judgment accuracy.

[0105] After completing the above model construction, the communication association range of each device can be determined based on the topological network structure. The communication association range is bounded by the coverage area of ​​the access point to which the device belongs and the reachable interval of adjacent devices. Within the defined range, the protocol feature vector and the sequence of received signal strength indication observation vectors of the corresponding devices can be extracted from the spatiotemporal protocol joint trajectory. The protocol feature vector maintains the same feature dimensions as the baseline model training data, and the sequence of received signal strength indication observation vectors is arranged in time window order, containing standardized signal strength data collected from each monitoring point. The extracted protocol feature vector is input into the protocol behavior baseline model, and the deviation of the protocol feature vector from the normal cluster center can be calculated to obtain the behavior anomaly degree. The behavior anomaly degree is used to quantify the difference between the device protocol behavior and the normal mode. The higher the deviation, the larger the behavior anomaly degree value. Its calculation can be performed using the following formula:

[0106]

[0107] in, For the degree of behavioral abnormality, This is the protocol feature vector of the current device. The normal cluster center vector of the protocol behavior baseline model. The operator for calculating vector Euclidean distance is... This represents the maximum permissible distance within the normal characteristic distribution range.

[0108] Specifically, the observed vector sequence of received signal strength indicators is input into the signal spatial consistency model. The observed sequence is matched with the model's preset signal propagation characteristics to calculate the degree of non-compliance between the signal spatial distribution and physical laws, yielding a consistency anomaly score. A higher consistency anomaly score indicates a greater violation of normal propagation laws in the signal spatial distribution, potentially indicating risks such as signal spoofing or abnormal device location. Subsequently, a risk level determination is performed based on the behavioral anomaly score and the consistency anomaly score. This involves combining the combined scores of the two anomalies and classifying devices into different risk levels according to preset thresholds. These risk levels correspond to different risk types, such as suspicious access points, spoofed hotspots, and abnormal terminals. After the determination, matching risk labels are added to the joint feature tuples of each device. These risk labels simultaneously record the risk level and risk type, ultimately generating labeled joint feature tuples containing risk labeling information. These tuples provide a risk basis for subsequent target selection, proactive induction triggering, and location-based handling.

[0109] In one embodiment, such as Figure 2 As shown, targets to be induced are screened based on risk labels in the marked trajectory. Coarse positioning is performed based on the observation vector of the received signal strength indication value of the target, yielding coarse coordinates, azimuth interval, and range estimate. An induced detection frame is constructed based on the protocol feature vector of the target. Transmission parameters are set based on the azimuth interval and range estimate, and the induced detection frame is transmitted in a directional manner. This process may include:

[0110] S201: Traverse the risk labels in the marked trajectory and filter out devices whose risk level is higher than the preset level standard as targets to be induced;

[0111] S202: Based on the observation vector sequence of the received signal strength indication value of the target to be induced, extract the observation vector of the received signal strength indication value of the target to be induced, and decompose the received signal strength indication value corresponding to each monitoring point from the observation vector of the received signal strength indication value of the target to be induced; use the received signal strength indication value corresponding to each monitoring point as the weight of coordinate estimation, and perform coordinate estimation processing in combination with the coordinates of each monitoring point to obtain the coarse coordinates, azimuth interval and distance estimate of the target to be induced;

[0112] S203: Determine the target azimuth for directional launch based on the azimuth angle range; determine the equipment type based on the protocol feature vector of the target to be induced; and construct the corresponding induced detection frame by matching the corresponding frame structure rules according to the equipment type.

[0113] S204: Set the beam pointing parameters according to the azimuth angle range and set the transmit power parameters according to the distance estimation; based on the beam pointing parameters and transmit power parameters, transmit induced detection frames in the azimuth direction of the target through a directional antenna array.

[0114] Specifically, the system iterates through the labeled trajectories of all devices and extracts the risk labels carried by each joint feature tuple. These labels contain risk level and risk type information. By retrieving the preset risk level judgment criteria, devices with risk levels higher than the criteria can be screened as targets to be induced. Targets to be induced mainly include high-risk devices such as illegal access points, disguised hotspots, and concealed wireless terminals. The screening process can be executed by the abnormal risk identification module to ensure that the inducement resources are concentrated on target devices with high security risks, providing target objects for the targeted operation of the active inducement trigger module.

[0115] Furthermore, the received signal strength indication (RSI) observation vector sequence can be retrieved from the spatiotemporal protocol joint trajectory of the target to be induced. The RSI observation vector at the current moment can be extracted, and the observation vector can be decomposed into RSI values ​​corresponding to each monitoring point according to the monitoring point identifier. Using the RSI value of each monitoring point as a weighting factor, and combining it with the pre-calibrated physical coordinates of each monitoring point, a weighted coordinate estimation is performed to obtain the coarse coordinates of the target to be induced. The coarse coordinates can be calculated using the following formula:

[0116]

[0117]

[0118] in The rough x-coordinate of the target to be induced. The approximate vertical coordinate of the target to be induced. The total number of monitoring points that effectively collected data. For the first The weights of the received signal strength indication values ​​for each monitoring point are positively correlated with the received signal strength indication values. For the first The x-coordinate of each monitoring point For the first The ordinates of each monitoring point.

[0119] Furthermore, the azimuth interval can be calculated based on the spatial distribution gradient of the received signal strength indicators from multiple monitoring points. For example, the received signal strength indicators from each monitoring point can be normalized to eliminate signal strength deviations caused by differences in hardware sensitivity at different monitoring points. After normalization, the signal strength value range is uniformly mapped to the [0,1] interval. Based on the normalized signal strength data, a spatial distribution matrix of signal strength in the target area is constructed. Using the coordinates of the monitoring points as nodes, the signal strength gradient values ​​between adjacent monitoring points are calculated. The direction of the gradient value points from low signal strength monitoring points to high signal strength monitoring points, and the gradient magnitude represents the rate of change of signal strength. The density clustering algorithm DBSCAN is used to perform cluster analysis on the gradient directions of all monitoring points, and the gradient direction cluster with the highest proportion is selected. The direction corresponding to this cluster is the core azimuth reference of the target to be induced. By combining the physical coordinates of each monitoring point, the angle between the core azimuth reference and the line connecting each monitoring point is calculated. The intersection of all angles is taken as the initial azimuth angle interval. Combined with the communication coverage range of the access points in the topology network structure, the azimuth angles that exceed the coverage radius are eliminated, and the constrained azimuth angle interval can be obtained. This interval can clearly define the spatial pointing range of the target to be induced, providing a directional basis for directional launch.

[0120] As an illustration, in distance estimation, the logarithmic distance path loss model can be used as the wireless signal propagation attenuation model, and the model expression is as follows:

[0121]

[0122] in, The signal strength indication value received by the monitoring point. For reference distance The standard signal strength value at that location, This is the path loss index, which is obtained by calibrating based on the target area's environmental type and using signal propagation data from historically functioning equipment. For example, in an indoor environment, the value is 1.5-2.5. The actual distance between the target to be induced and the monitoring point. The shadow fading value (following a normal distribution, with variance determined through statistical historical data) is used. For each monitoring point, the estimated distance between the target to be induced and that monitoring point is inferred based on the above model. The reverse calculation process uses the least squares method to solve for the distance parameters. Furthermore, a confidence weight for each monitoring point can be introduced to weight and fuse the distance estimates from multiple monitoring points, improving the accuracy of the distance estimation. This confidence weight is positively correlated with the signal strength stability and historical data integrity of the monitoring points. The fusion formula is as follows:

[0123]

[0124] in, For the final distance estimation result, For the first The credibility weight of each monitoring point For the first The distance estimates for each monitoring point are fused. After fusion, a consistency check can be performed on the distance estimates. If the deviation between the single-station distance estimate for a monitoring point and the fused result exceeds a preset threshold, the data for that monitoring point is considered abnormal, removed, and the fused result is recalculated to ensure the reliability of the distance estimates. The final output distance estimate clearly defines the spatial distance between the target to be induced and the monitoring network, providing a quantitative basis for configuring transmit power parameters.

[0125] Through the above azimuth interval calculation and distance estimation process, the rough coordinates, azimuth interval and distance estimation results of the target to be induced can be output, which together constitute the spatial constraint parameters for directional guidance.

[0126] Specifically, the target azimuth of the directional transmission can be locked based on the azimuth angle range. This azimuth is the spatial direction of the target to be induced. Furthermore, the device type and protocol type information can be extracted from the protocol feature vector of the target to be induced. Then, according to different device types, the corresponding Wi-Fi 7 or Bluetooth 5.4 frame structure rules are matched to construct an induced detection frame that is adapted to the target device protocol specification. This induced detection frame can adopt the frame format of active detection, associated inducement, or broadcast stimulus to effectively trigger the message response of the covert device and improve the detection probability of covert illegal terminals.

[0127] Based on the constructed induced detection frames, the beam pointing parameters of the directional antenna array can be configured according to the azimuth angle range, enabling the antenna beam to be precisely focused on the target azimuth. The transmit power parameters are configured based on the distance estimate, with the transmit power setting balancing the signal reception requirements of the target device and the anti-interference requirements of surrounding normal equipment. After completing the beam pointing and transmit power parameter configuration, the induced detection frames can be directionally transmitted towards the target azimuth through the directional antenna array to avoid global signal interference, meeting the wireless security control requirements of classified environments. Furthermore, after the induced detection frames are transmitted, the target to be induced can be quickly triggered to return a response message, providing data support for subsequent trajectory optimization and precise positioning.

[0128] In one embodiment, based on the optimized spatiotemporal protocol joint trajectory, the temporal and spatial variation characteristics of the received signal strength indication value of the target to be induced are extracted. Anomaly analysis is performed based on the temporal and spatial variation characteristics to obtain identification results and positioning information, including:

[0129] Extract the received signal strength indication data of the target to be induced within a continuous preset time window from the optimized spatiotemporal protocol joint trajectory;

[0130] Based on the time series distribution of the received signal strength indication data, the temporal variation characteristics of the target to be induced are obtained;

[0131] Based on the distribution differences of received signal strength indication data among multiple monitoring points, and combined with preset signal propagation attenuation characteristics, a correlation analysis is performed to obtain the spatial variation characteristics of the target to be induced.

[0132] Based on the temporal change characteristics, the continuity of equipment behavior is determined to obtain a first determination result; based on the spatial change characteristics, the rationality of equipment location is determined, and a second determination result is obtained by matching a preset physical space propagation model; combining the first determination result and the second determination result, a multi-dimensional anomaly review analysis is performed to obtain anomaly review results.

[0133] Based on the anomaly review results, the identity type of the target to be induced is confirmed. The risk assessment criteria corresponding to the identity type are matched to determine the final risk level of the target to be induced. The identity type and the final risk level are integrated to generate the corresponding identification result.

[0134] Based on the spatial variation characteristics of the received signal strength indication data, directional analysis is performed on the signal strength differences at each monitoring point to obtain the azimuth trend of the target to be induced; based on the temporal variation characteristics of the received signal strength indication data, fitting analysis is performed on the signal strength changes over a continuous preset time window to obtain the distance variation trend of the target to be induced.

[0135] By combining the orientation trend and the distance change trend, the rough coordinates of the target to be induced are refined to obtain the positioning information.

[0136] Specifically, the optimized spatiotemporal protocol joint trajectory integrates the original monitoring data and induced response data, significantly improving data integrity and feature richness. Therefore, the received signal strength indication value data of the target to be induced within a continuous preset time window can be extracted from the optimized spatiotemporal protocol joint trajectory. This data covers the collection results of all monitoring points and the signal increment data after the induced response. Based on the time series distribution of the received signal strength indication value data, the temporal change characteristics of the target to be induced can be obtained through time series trend calculation and fluctuation analysis. This characteristic is used to characterize the change law of the device signal strength over time. Among them, the temporal change characteristics of normal and compliant devices show stable and continuous characteristics, while illegal and concealed devices will show abnormal behaviors such as signal abrupt changes and interruptions.

[0137] Based on the distribution differences of received signal strength indication data across multiple monitoring points, correlation analysis can be conducted by combining preset signal propagation attenuation characteristics. By comparing the degree of matching between the gradient changes in signal strength at each monitoring point and the physical propagation laws, the spatial variation characteristics of the target to be induced can be obtained. This characteristic directly reflects whether the spatial distribution of the device's signal conforms to the physical rules of wireless transmission, providing a core basis for determining the rationality of the location. Illustratively, the stationarity of the temporal variation characteristics can be quantified using the following formula:

[0138]

[0139] in, The value represents the stationarity of time series changes; the closer the value is to 1, the more continuous and stable the time series changes. The total number of consecutive preset time windows. For the first Statistical characteristics of received signal strength indicators for each time window. This is the average of the received signal strength indicators for all time windows.

[0140] Subsequently, the continuity of device behavior can be determined based on the temporal variation characteristics; that is, a preset temporal stability threshold can be obtained first, and if... If the value is greater than or equal to this threshold, the device behavior is deemed to be continuously compliant, and the first determination result is normal. If... If the signal strength is below this threshold, further analysis can be conducted to determine the correlation between the timing of the signal mutation and the transmission timing of the induced detection frame. If the mutation occurs within the induced response window and there is no reasonable communication triggering event, the first determination is "timing anomaly," and auxiliary information such as the mutation amplitude and duration is recorded. Furthermore, the rationality of the device location can be determined based on spatial variation characteristics. This involves matching the signal distribution characteristics of multiple monitoring points with a preset physical space propagation model, such as a logarithmic distance path loss model, and calculating the average absolute error between the actual signal strength and the model prediction. If the average absolute error is less than or equal to a preset error threshold, and the spatial correlation coefficient... If the error exceeds a preset threshold, the second determination result can be "spatial compliance". If the mean absolute error exceeds this threshold or... If the signal is below this threshold, further verification can be performed to determine if the signal distribution conflicts with the communication coverage area in the topological network structure. If a conflict exists, the second determination result is "spatial anomaly," and details such as the error distribution and conflict monitoring points are recorded. Illustratively, the spatial correlation of signals from multiple monitoring points can be calculated using the following formula:

[0141]

[0142] in, This is the spatial correlation coefficient; the closer the value is to 1, the higher the consistency of the spatial distribution. To determine the effective number of monitoring points, , The first The and the first The received signal strength indication value at each monitoring point , These are the average received signal strength indicators for the corresponding monitoring points.

[0143] Specifically, a two-dimensional cross-validation matrix can be used to perform multi-dimensional anomaly review analysis by combining the first and second judgment results. For example, if the first judgment result is normal and the second judgment result is spatially compliant, the anomaly review result can be "no anomaly," maintaining the initial risk level. If the first judgment result is normal but the second judgment result is "spatial anomaly," the adaptability of the physical space propagation model can be re-verified (e.g., adjusting the path loss index), and the error can be recalculated. If the anomaly conditions are still met, the review result is "single spatial anomaly," the risk level remains unchanged, and it is marked as "requiring further trajectory verification." If the first judgment result is "temporal anomaly" and the second judgment result is spatially compliant, it can be checked whether there are temporal changes caused by equipment movement. By comparing the coarse coordinate change amplitude of the continuous time window, if the change amplitude exceeds the physical movement limit, the review result is "single temporal anomaly," and the risk level is increased by one level. If the first judgment result is "temporal anomaly" and the second judgment result is "spatial anomaly," the review result is "double anomaly," the risk level is increased by two levels, and the risk type library in the anomaly risk identification module is linked synchronously to preliminarily match the anomaly causes such as signal forgery and illegal boundary crossing. This cross-validation process effectively eliminates misjudgments caused by environmental interference or temporary equipment failures in single-dimensional judgments, ensuring the accuracy of anomaly verification results.

[0144] Based on the anomaly verification results, the identity type of the target to be induced can be confirmed. Double anomalies can correspond to malicious devices such as unauthorized access points, spoofed hotspots, or concealed Bluetooth terminals. "Single temporal anomalies" may indicate a faulty compliant device or a temporary unauthorized access terminal. "Single spatial anomalies" require further investigation based on the network topology to determine if it is an out-of-bounds access device. "No anomalies" indicates a compliant device. Subsequently, by matching the identity type with pre-set risk assessment criteria, the final risk level of the target to be induced is comprehensively determined. The identity type and final risk level are integrated to generate an identification result, which can be simultaneously pushed to the anomaly risk identification module and the handling control module, providing a basis for decision-making.

[0145] Specifically, based on the spatial variation characteristics of received signal strength indication data, directional analysis can be performed on the signal strength differences between monitoring points. For example, the signal strength difference between any two monitoring points is first calculated, constructing a signal strength gradient matrix with the gradient direction pointing from the low-intensity monitoring point to the high-intensity monitoring point. Cluster analysis is then performed on all gradient directions to select the cluster with the highest proportion. The center direction of this cluster is used as a candidate azimuth. Furthermore, the communication association range of the target to be induced in the topological network structure can be combined to exclude candidate azimuths that exceed the coverage radius of the access point. By calculating the angle between the high-intensity monitoring point and the candidate azimuth, the azimuth trend of the target to be induced can be determined. Simultaneously, based on cross-validation of the azimuth from multiple monitoring points, the azimuth trend range, such as ±5°, can be output to ensure the accuracy of the azimuth determination.

[0146] Specifically, based on the temporal variation characteristics of received signal strength indication data, fitting analysis can be performed on signal strength changes within consecutive preset time windows. For example, abnormal peaks in the time-series data can be identified and removed using the 3σ criterion, and replaced with the mean of adjacent windows. According to preset signal propagation attenuation characteristics, a suitable fitting model is selected; for example, logarithmic fitting is used when signal strength and distance have a logarithmic relationship, and linear fitting is used when the device moves at a constant speed. The received signal strength indication values ​​of each time window and the corresponding rough distance estimates are used as fitting samples, substituted into the model to solve for the fitting parameters, resulting in a fitting curve of the temporal variation of signal strength. Subsequently, the rate of change of signal strength can be calculated using the slope of the fitting curve, combined with the signal propagation attenuation coefficient, to convert it into the rate of change of distance to the target to be induced. Based on the absolute value of the positive or negative value of the rate of change of distance, the trend of distance change can be determined. For example, a negative slope and a decreasing absolute value indicate that the target is gradually moving away at a slower pace, while a positive slope and an increasing absolute value indicate that the target is gradually approaching at a faster pace. The confidence level of the distance change trend can also be output, calculated based on the goodness-of-fit R².

[0147] Specifically, by combining azimuth trends and distance change trends, the coarse coordinates of the target to be induced can be refined. This involves using the azimuth trend range as a directional constraint and the distance change rate as a dynamic adjustment basis to construct a coordinate correction model. The correction direction for the horizontal and vertical coordinates is determined by the azimuth trend, and the correction amount is calculated based on the distance change rate and the time window duration. The refined coordinates can be calculated using the following formula:

[0148]

[0149] in, These are the refined positioning coordinates. These are rough coordinates. dist_rate , dist_rate dist_rate is the rate of change of distance. The total duration of the continuous time window. It represents the central direction angle of the directional trend.

[0150] The above refinement process eliminates random errors in coarse positioning through trend correction and, combined with the signal analysis capabilities of Wi-Fi 7 and Bluetooth 5.4 protocols, can ultimately output the positioning information (including coordinates, orientation, distance, and confidence level) of the target to be induced. The refined positioning information and the recognition result together form a complete detection conclusion, which can be used to perform real-time countermeasures, blacklist registration, alarm linkage, and other actions. The relevant data is also synchronized to the report generation module, providing core data support for the generation of the detection report.

[0151] Based on the same inventive concept, this application also provides a wireless communication anomaly risk identification and positioning system for implementing the above-described method for identifying and locating anomalies in wireless communication. The solution provided by this system is similar to the implementation described in the above method. Therefore, the specific limitations of one or more embodiments of the wireless communication anomaly risk identification and positioning system provided below can be found in the limitations of the wireless communication anomaly risk identification and positioning method described above, and will not be repeated here.

[0152] In one exemplary embodiment, such as Figure 3 As shown, a wireless communication-based anomaly risk identification and positioning system 300 is provided, comprising:

[0153] The protocol parsing and record generation module 301 is used to execute S1, which includes: parsing multiple wireless data packets using multiple protocols to obtain protocol fields, binding the protocol fields, arrival timestamps, received signal strength indication values ​​and corresponding monitoring point identifiers of each wireless data packet, and generating a joint record of parsed signals.

[0154] The trajectory construction and topology association module 302 is used to execute S2. S2 includes: aggregating the joint records of the parsed signals, generating a corresponding joint feature tuple for each device, arranging the joint feature tuples of the same device in a continuous time window in chronological order, constructing a spatiotemporal protocol joint trajectory, and establishing the link association relationship between the terminal and the access point based on the protocol field content of each device to obtain the topology network structure.

[0155] Anomaly detection and trajectory labeling module 303 is used to execute S3, which includes: extracting protocol feature vectors and received signal strength indication (RSI) observation vector sequences from the spatiotemporal protocol joint trajectory based on the topology network structure; calculating the anomaly degree of the protocol feature vectors and RSI observation vector sequences using the protocol behavior baseline model and the signal space consistency model, respectively, to obtain the behavior anomaly degree and the consistency anomaly degree; labeling the joint feature tuples based on the behavior anomaly degree and the consistency anomaly degree to generate labeled joint feature tuples; updating the spatiotemporal protocol joint trajectory using the labeled joint feature tuples to obtain the labeled trajectory;

[0156] The induced detection and trajectory optimization module 304 is used to execute S4, which includes: screening the target to be induced based on the risk label in the labeled trajectory; performing coarse positioning based on the observation vector of the received signal strength indication value of the target to be induced to obtain coarse coordinates, azimuth interval and distance estimate; constructing an induced detection frame based on the protocol feature vector of the target to be induced; setting the transmission parameters based on the azimuth interval and distance estimate; and directionally transmitting the induced detection frame; acquiring the response data packet of the target to be induced; processing the response data packet according to the method of S1 to generate a joint record of response signals; merging the joint record of response signals and the joint record of analytical signals to obtain an updated joint record of analytical signals; repeating S2 and S3 to obtain the optimized spatiotemporal protocol joint trajectory.

[0157] The feature analysis and risk location module 305 is used to execute S5, which includes: extracting the temporal and spatial variation features of the received signal strength indication value of the target to be induced based on the optimized spatiotemporal protocol joint trajectory, performing anomaly analysis based on the temporal and spatial variation features, and obtaining the identification results and location information.

[0158] In one exemplary embodiment, the present invention also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the abnormal risk identification and location method for wireless communication according to this application. A multi-core processor is preferred to improve the system's parallel processing capability. The memory provides sufficient temporary storage space to support program execution and data processing. The memory capacity should be large enough to accommodate large amounts of data and computational tasks.

[0159] In one exemplary embodiment, the present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of an abnormal risk identification and location method for wireless communication according to the present application. The computer-readable storage medium may include: a read-only memory, a random access memory, a solid-state drive, or an optical disk, etc.

[0160] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A method for identifying and locating abnormal risks in wireless communication, characterized in that, The method includes: S1: Perform multi-protocol parsing on multiple wireless data packets to obtain protocol fields, and bind the protocol fields, arrival timestamps, received signal strength indicators and corresponding monitoring point identifiers of each wireless data packet to generate a joint parsing signal record; S2: Aggregate the joint records of the parsed signals, generate a corresponding joint feature tuple for each device, arrange the joint feature tuples of the same device in a continuous time window in chronological order, construct a spatiotemporal protocol joint trajectory, and establish the link association relationship between the terminal and the access point according to the protocol field content of each device to obtain the topology network structure. S3: Based on the aforementioned topological network structure, extract the protocol feature vector and the received signal strength indicator observation vector sequence from the spatiotemporal protocol joint trajectory. Calculate the anomaly degree of the protocol feature vector and the received signal strength indicator observation vector sequence using both the protocol behavior baseline model and the signal space consistency model to obtain the behavior anomaly degree and the consistency anomaly degree. Based on the behavior anomaly degree and the consistency anomaly degree, label the joint feature tuple to generate labeled joint feature tuples. Update the spatiotemporal protocol joint trajectory using the labeled joint feature tuples to obtain the labeled trajectory. S4: Filter targets to be induced based on the risk labels in the labeled trajectory, perform coarse positioning based on the received signal strength indication value observation vector of the target to be induced, and obtain coarse coordinates, azimuth interval, and distance estimate; construct an inducement detection frame based on the protocol feature vector of the target to be induced, set transmission parameters based on the azimuth interval and the distance estimate, and directionally transmit the inducement detection frame; obtain the response data packet of the target to be induced, process the response data packet according to the method of S1, generate a joint record of response signals, merge the joint record of response signals and the joint record of analytical signals to obtain an updated joint record of analytical signals, repeat S2 and S3 to obtain the optimized spatiotemporal protocol joint trajectory; S5: Based on the optimized spatiotemporal protocol joint trajectory, extract the temporal and spatial variation features of the received signal strength indication value of the target to be induced, perform anomaly analysis based on the temporal and spatial variation features, and obtain the identification results and positioning information.

2. The method according to claim 1, characterized in that, The process involves performing multi-protocol parsing on multiple wireless data packets to obtain protocol fields. Then, the protocol fields, arrival timestamps, received signal strength indicators, and corresponding monitoring point identifiers of each wireless data packet are bound together to generate a joint parsing signal record, including: Collect wireless signals within the target area to obtain multiple wireless data packets; By using a global clock synchronization reference, the arrival time of each wireless data packet is marked, and the arrival timestamp corresponding to each wireless data packet is obtained. Perform protocol type identification processing on each of the wireless data packets to obtain the type identification result. Based on the type identification result, perform Wi-Fi protocol parsing and Bluetooth protocol parsing respectively to obtain the corresponding protocol fields. Collect the received signal strength indication value of each wireless data packet at the corresponding monitoring point, and determine the monitoring point identifier corresponding to each wireless data packet; The protocol field, arrival timestamp, received signal strength indicator value, and monitoring point identifier of each wireless data packet are bound together to generate the parsed signal joint record.

3. The method according to claim 1, characterized in that, The process involves aggregating the joint records of the parsed signals to generate a corresponding joint feature tuple for each device. The joint feature tuples of the same device within a continuous time window are arranged chronologically to construct a spatiotemporal protocol joint trajectory. Furthermore, link associations between terminals and access points are established based on the protocol field content of each device, resulting in a topology network structure, including: The continuous time axis is divided into multiple equal-length and non-overlapping time windows. Based on the arrival timestamp of each of the analytical signal joint records, the analytical signal joint records are divided into the corresponding time windows. For the joint records of the parsed signals within the same time window, perform device identity classification processing, and collect the corresponding joint records of the parsed signals for each device to obtain the collected joint records of the parsed signals. Extract the protocol fields corresponding to each device from the aggregated joint record of the parsed signals to obtain the protocol field content of each device; Identify the access point identifier and device type information from the protocol field content of each device to distinguish between terminal devices and access point devices; Based on the aggregated joint record of the parsed signals, the statistical characteristics of the received signal strength indication value and the quantitative characteristics of the protocol behavior of each device are calculated to generate the joint feature tuple corresponding to each device. The joint feature tuples of the same device within consecutive time windows are sorted in chronological order to construct the spatiotemporal protocol joint trajectory. Based on the protocol field content of each device and the access point identifier, the communication association between the terminal device and the access point device is matched, the link correspondence between the terminal and the access point is established, and the topology network structure is generated.

4. The method according to claim 1, characterized in that, Based on the topological network structure, protocol feature vectors and received signal strength indication value observation vector sequences are extracted from the spatiotemporal protocol joint trajectory. Anomalies are calculated on the protocol feature vectors and received signal strength indication value observation vector sequences using the protocol behavior baseline model and the signal space consistency model, respectively, to obtain behavior anomalies and consistency anomalies. Based on the behavioral anomaly degree and the consistency anomaly degree, the joint feature tuples are labeled to generate labeled joint feature tuples, including: The spatiotemporal protocol joint trajectories of multiple historical normally operating equipment are collected, and the protocol feature vectors of each historical normally operating equipment are extracted. Based on the protocol feature vectors of each historical normally operating equipment, unsupervised clustering is used to determine the cluster center and feature distribution interval of normal protocol behavior, and the baseline model of the protocol behavior is constructed. Based on the temporal variation data and spatial distribution data of the received signal strength indication values ​​of the historically normally operating equipment within the topological network structure, the signal propagation characteristics of the historically normally operating equipment are extracted, and the signal spatial consistency model is established. Based on the topological network structure, the communication association range between each device is determined, and the protocol feature vector and the received signal strength indication value observation vector sequence of each device are extracted from the spatiotemporal protocol joint trajectory. The protocol feature vector is input into the protocol behavior baseline model to calculate the behavior anomaly degree used to characterize the device behavior deviating from the normal mode; The received signal strength indication value observation vector sequence is input into the signal spatial consistency model to calculate the consistency anomaly degree used to characterize the signal spatial distribution not conforming to physical laws; Based on the numerical values ​​of the behavioral anomaly degree and the consistency anomaly degree, a risk level determination is performed to obtain the risk level corresponding to each device. A risk label corresponding to the risk level is added to the joint feature tuple of each device to generate the labeled joint feature tuple.

5. The method according to claim 1, characterized in that, The process includes: screening targets to be induced based on risk labels in the marked trajectory; performing coarse positioning based on the received signal strength indication value observation vector of the target to be induced to obtain coarse coordinates, azimuth interval, and distance estimate; constructing an induced detection frame based on the protocol feature vector of the target to be induced; setting transmission parameters based on the azimuth interval and the distance estimate; and directionally transmitting the induced detection frame. Traverse the risk labels in the marked trajectory and filter out devices whose risk level is higher than the preset level standard as the target to be induced; Based on the observation vector sequence of the received signal strength indication value of the target to be induced, the observation vector of the received signal strength indication value of the target to be induced is extracted, and the received signal strength indication value corresponding to each monitoring point is obtained from the observation vector of the received signal strength indication value of the target to be induced; the received signal strength indication value corresponding to each monitoring point is used as the weight of coordinate estimation, and coordinate estimation processing is performed in combination with the coordinates of each monitoring point to obtain the coarse coordinates, azimuth interval and distance estimate of the target to be induced; The target azimuth for directional launch is determined based on the azimuth angle range. The device type is determined based on the protocol feature vector of the target to be induced, and the corresponding frame structure rule is matched according to the device type to construct the corresponding induced detection frame; The beam pointing parameter is set according to the azimuth angle range, and the transmit power parameter is set according to the distance estimate; Based on the beam pointing parameters and the transmit power parameters, the induced detection frame is transmitted directionally to the target location via a directional antenna array.

6. The method according to claim 1, characterized in that, Based on the optimized spatiotemporal protocol joint trajectory, the temporal and spatial variation features of the received signal strength indication value of the target to be induced are extracted. Anomaly analysis is performed based on the temporal and spatial variation features to obtain identification results and positioning information, including: Extract the received signal strength indication data of the target to be induced within a continuous preset time window from the optimized spatiotemporal protocol joint trajectory; Based on the time series distribution of the received signal strength indication data, the temporal variation characteristics of the target to be induced are obtained; Based on the distribution differences of the received signal strength indication data among multiple monitoring points, and combined with the preset signal propagation attenuation characteristics, a correlation analysis is performed to obtain the spatial variation characteristics of the target to be induced. Based on the temporal change characteristics, the device behavior continuity determination process is performed to obtain a first determination result; based on the spatial change characteristics, the device location rationality determination process is performed, and a second determination result is obtained by matching a preset physical space propagation model; combining the first determination result and the second determination result, a multi-dimensional anomaly review analysis is performed to obtain an anomaly review result; Based on the anomaly verification result, the identity type of the target to be induced is confirmed. The risk judgment standard corresponding to the identity type is matched to determine the final risk level of the target to be induced. The identity type and the final risk level are integrated to generate the corresponding identification result. Based on the spatial variation characteristics of the received signal strength indication data, directional analysis is performed on the signal strength differences at each monitoring point to obtain the azimuth trend of the target to be induced; based on the temporal variation characteristics of the received signal strength indication data, fitting analysis is performed on the signal strength changes within the continuous preset time window to obtain the distance variation trend of the target to be induced. By combining the azimuth trend and the distance change trend, the coarse coordinates of the target to be induced are refined to obtain the positioning information.

7. A wireless communication anomaly risk identification and positioning system, characterized in that, The system includes: The protocol parsing and record generation module is used to execute S1, which includes: parsing multiple wireless data packets using multiple protocols to obtain protocol fields, binding the protocol fields, arrival timestamps, received signal strength indication values ​​and corresponding monitoring point identifiers of each wireless data packet, and generating a joint parsing signal record; The trajectory construction and topology association module is used to execute S2, which includes: aggregating the joint records of the parsed signals, generating a corresponding joint feature tuple for each device, arranging the joint feature tuples of the same device in a continuous time window in chronological order, constructing a spatiotemporal protocol joint trajectory, and establishing a link association relationship between the terminal and the access point based on the protocol field content of each device to obtain the topology network structure. An anomaly detection and trajectory labeling module is used to execute S3, which includes: based on the topological network structure, extracting protocol feature vectors and received signal strength indication (RSI) observation vector sequences from the spatiotemporal protocol joint trajectory; calculating the anomaly degree of the protocol feature vectors and the RSI observation vector sequences using a protocol behavior baseline model and a signal space consistency model, respectively, to obtain behavior anomaly degree and consistency anomaly degree; labeling the joint feature tuples based on the behavior anomaly degree and the consistency anomaly degree to generate labeled joint feature tuples; and updating the spatiotemporal protocol joint trajectory using the labeled joint feature tuples to obtain the labeled trajectory. The induced detection and trajectory optimization module is used to execute S4, which includes: filtering targets to be induced based on risk labels in the labeled trajectory; performing coarse positioning based on the received signal strength indication value observation vector of the target to be induced to obtain coarse coordinates, azimuth interval, and distance estimate; constructing an induced detection frame based on the protocol feature vector of the target to be induced; setting transmission parameters based on the azimuth interval and the distance estimate; and directionally transmitting the induced detection frame; acquiring the response data packet of the target to be induced; processing the response data packet according to the method of S1 to generate a joint record of response signals; merging the joint record of response signals and the joint record of analytical signals to obtain an updated joint record of analytical signals; and repeating S2 and S3 to obtain the optimized spatiotemporal protocol joint trajectory. The feature analysis and risk location module is used to execute S5, which includes: extracting the temporal and spatial variation features of the received signal strength indication value of the target to be induced based on the optimized spatiotemporal protocol joint trajectory; performing anomaly analysis based on the temporal and spatial variation features to obtain identification results and location information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images