Control method, device and storage medium for passive wireless environment detection

Abstract

This application discloses a control method, device, and storage medium for passive wireless environment detection, relating to the field of radio frequency signal identification technology. The method includes: responding to an environment detection command, extracting key information of multi-band wireless signals in the target area and organizing it into radio frequency feature data; comparing the radio frequency feature data with baseline data in the target area to identify abnormal device data; calculating and rating anomaly scores by combining cross-band coupling features and device timing features, and constructing a full-domain radio frequency situation dataset based on device correlation data; and correcting baseline parameters and feature routing strategies according to the situation data in a closed loop to generate a visualized environmental mapping archive. This application constructs a long-term, accumulative, learnable, and verifiable wireless environment reference baseline, achieving wireless environment transparency and continuous environment modeling, solving the problem of poor environmental detection data quality, and thus realizing intelligent and automated environmental detection.

Description

Technical Field

[0001] This application relates to the field of radio frequency signal identification technology, and in particular to a control method, device and storage medium for passive wireless environment detection. Background Technology

[0002] In scenarios involving wireless environment security monitoring and comprehensive device risk assessment, the ability to collect multi-band wireless signals across the entire domain, perform device correlation analysis, and dynamically identify abnormal risks directly affects the effectiveness of wireless space security management.

[0003] In related technologies, wireless environment detection and analysis is carried out by using single-band hardware detection, active interactive detection combined with centralized cloud computing and storage. This method relies on active detection to collect environmental data and on the cloud to realize data computing and storage, which is difficult to adapt to long-term portable wireless inspection scenarios in multiple areas, resulting in poor quality of environmental detection data.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main objective of this application is to provide a control method, device, and storage medium for passive wireless environmental monitoring, aiming to solve the technical problem of poor quality of environmental monitoring data.

[0006] To achieve the above objectives, this application proposes a control method for passive wireless environment detection, the method comprising: In response to environmental detection commands, key information of multi-band wireless signals in the target area is extracted according to the multi-band feature routing strategy, and radio frequency feature data is obtained. Based on the regional identifier of the target area, the corresponding benchmark data in the environmental baseline library is matched, and the radio frequency feature data is compared with the benchmark data to obtain abnormal device data. Based on the abnormal equipment data, an abnormal score is calculated by weighting cross-frequency band coupling characteristics and equipment timing characteristics, and the abnormal score is rated to obtain equipment association data including risk rating. A global radio frequency situation dataset for the target area is constructed based on the device association data. Based on the global radio frequency situation dataset, the baseline parameters and the feature splitting strategy are corrected, and a visual environmental mapping archive is generated.

[0007] In one embodiment, after responding to the environmental detection command, a passive wireless detection mode is configured for the multi-band radio frequency acquisition unit, and the timing reference of the multi-band radio frequency acquisition unit is synchronized to obtain the synchronization ready signal of the multi-band radio frequency acquisition unit. Based on the synchronization ready signal, the wireless broadcast signal in the target area is acquired through the multi-band radio frequency acquisition unit to obtain a radio frequency sampling dataset with a unified timestamp. Differentiated filtering rules are matched according to the inherent interference characteristics of each frequency band, and interference redundant data in the radio frequency sampling dataset is removed by the differentiated filtering rules to obtain the multi-band wireless signal; Based on the multi-band feature splitting strategy, the key information corresponding to each frequency band in the multi-band wireless signal is extracted and organized to obtain the radio frequency feature data.

[0008] In one embodiment, based on the area identifier of the target area and the radio frequency feature data, a subset of trusted device fingerprints associated with the target area and the corresponding benchmark data in the environmental baseline library are determined to obtain a regional device association dataset associated with the benchmark data and the subset of trusted device fingerprints. Based on the regional device association dataset and device dimensions, the radio frequency feature data is decomposed to obtain device dimension feature data; The device dimensional feature data is compared dimension by dimension with the baseline features of devices in the target area to obtain the multi-dimensional feature bias of devices in the target area. The multi-dimensional feature bias is compared with the device feature threshold to filter out the abnormal device data.

[0009] In one embodiment, the timing features of each abnormal device and the cross-frequency band coupling features corresponding to each abnormal device in the abnormal device data are parsed and extracted according to the timing coupling deconstruction strategy; Based on the device timing characteristics and the cross-frequency band coupling characteristics, and combined with the measurement weights of the anomaly measurement index, an initial score is obtained by weighted calculation. The initial score is corrected and calibrated based on the correlation strength between the anomaly metrics to obtain the anomaly score; Based on the abnormal range and the abnormal score corresponding to the abnormal device, the risk rating corresponding to the abnormal device is divided, and the risk rating is mapped to the topological relationship between devices to obtain the device association data.

[0010] In one embodiment, based on the abnormal score corresponding to the abnormal device, the corresponding abnormal interval is matched to obtain the risk rating corresponding to the abnormal device; Based on the device timing characteristics and the cross-frequency band coupling characteristics, a device association topology network is constructed to obtain an initial topology structure including node and edge weights; The risk rating corresponding to the abnormal device is mapped to the topology node corresponding to the initial topology, and the risk transmission coefficient of the associated edge in the initial topology is calculated to obtain device association data including risk transmission markers.

[0011] In one embodiment, based on the device association data, the original radio frequency data of this test is associated with the regional reference data, and integrated to obtain the basic data set of this test; The device-associated topology nodes in the basic dataset are mapped to the geospatial grid of the target area, and the device distribution density, frequency band occupancy rate and comprehensive risk level in each grid are labeled to obtain radio frequency situation grid data; The radio frequency situation grid data is aggregated according to a preset time granularity to generate spatiotemporal situation sequence data by aggregating the radio frequency characteristic fluctuations and risk evolution patterns of different time periods. The spatiotemporal situational sequence data is integrated with its region identifier, detection period, and data version to obtain the global radio frequency situational dataset.

[0012] In one embodiment, a system deviation analysis report is obtained by extracting the stable radio frequency feature distribution, periodic environmental fluctuation patterns, and abnormal evolution patterns not covered by the baseline in the target area. Based on the system deviation analysis report, the threshold values ​​of the multi-dimensional anomaly measurement indicators for each frequency band in the environmental baseline library are adjusted by region and time period, and the trusted device fingerprint subset and anomaly judgment boundary are updated to obtain the corrected environmental baseline parameter set. Based on the modified set of environmental baseline parameters, the proportion of effective information in each frequency band, and the distribution of interference intensity, the sampling weight, filtering rules, and feature extraction priority in the multi-band feature splitting strategy are adjusted to obtain the optimized multi-band feature splitting strategy. The visualized environmental mapping archive is generated by integrating the global radio frequency situation dataset, the corrected environmental baseline parameter set, and the optimized multi-band feature splitting strategy.

[0013] In one embodiment, based on the historically collected wireless feature data of trusted devices within the target area, abnormal sampling points and duplicate records are removed to obtain a historical feature dataset of trusted devices. The multidimensional attributes in the trusted device historical feature dataset are associated with the corresponding time series records to generate a device environment fingerprint set; Wireless feature statistical analysis is performed on trusted devices in the device environment fingerprint set to construct a trusted device environment baseline model that includes resident environment, high-frequency accompanying devices, and cross-frequency band correlation. The trusted device environment baseline models are classified and integrated according to the regional identifiers, and a mapping relationship between the regions and the baseline models is constructed to obtain the environment baseline library.

[0014] In addition, to achieve the above objectives, this application also proposes a passive wireless environment detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the control method for passive wireless environment detection as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the passive wireless environment detection control method described above.

[0016] This application provides a passive wireless environment detection control method, including: upon responding to an environment detection command, extracting key information of multi-band wireless signals corresponding to a target area according to a multi-band feature-splitting strategy and organizing it to obtain radio frequency (RF) feature data; matching the target area's area identifier with corresponding benchmark data in an environmental baseline library and comparing the RF feature data with the benchmark data to obtain abnormal device data; calculating anomaly scores based on the abnormal device data combined with cross-band coupling features and device timing features, and obtaining device association data including risk ratings based on the anomaly scores; constructing a full-domain RF situation dataset for the target area based on the device association data; and finally, correcting baseline parameters and feature-splitting strategies based on the full-domain RF situation dataset and generating... The complete technical process of the visualized environmental mapping archive solves the technical problems in existing passive wireless environment detection technologies, such as incomplete single-band feature extraction, high false negative and false positive rates due to reliance on individual device features for anomaly judgment while ignoring inter-device relationships, and the continuous decline in detection accuracy due to the inability to dynamically iterate and optimize the environmental baseline and feature routing strategy according to the actual environment. It improves the anomaly identification accuracy and risk assessment reliability of passive wireless environment detection, realizes closed-loop iterative optimization of the environmental baseline and detection strategy, and provides intuitive and comprehensive data support for the comprehensive management and risk tracing of the regional wireless environment through the full-domain radio frequency situation dataset and visualized environmental mapping archive.

[0017] In summary, this application constructs a long-term, accumulative, learnable, and verifiable wireless environment reference baseline, realizing wireless environment transparency and continuous environment modeling, solving the technical problem of poor environmental monitoring data quality, and thus achieving intelligent and automated environmental monitoring. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart outlining the overall framework of this application; Figure 2 This is a flowchart illustrating the first embodiment of the passive wireless environment detection control method of this application. Figure 3 This is a system framework diagram for this application; Figure 4 This is a schematic diagram illustrating the clustering and classification of scene features in this application; Figure 5 This is a schematic diagram of wireless feature deviation detection based on an environmental baseline in this application; Figure 6 This is a schematic diagram illustrating the risk transmission relationship between equipment companionship and abnormal risk scoring in this application; Figure 7 This is a hardware architecture diagram of the passive wireless environment detection method of this application.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] In related technologies, wireless environment detection and analysis is carried out by using single-band hardware detection, active interactive detection combined with centralized cloud computing and storage. This method relies on active detection to collect environmental data and on the cloud to realize data computing and storage, which is difficult to adapt to long-term portable wireless inspection scenarios in multiple areas, resulting in poor quality of environmental detection data.

[0024] This application provides a solution: First, in response to an environmental detection command, key information of multi-band wireless signals corresponding to the target area is extracted according to a multi-band feature splitting strategy, and radio frequency feature data is obtained. Then, based on the area identifier of the target area, the corresponding benchmark data in the environmental baseline library is matched, and the radio frequency feature data is compared with the benchmark data to obtain abnormal device data. Then, based on the abnormal device data, an abnormal score is calculated by weighting cross-band coupling features and device timing features, and the abnormal score is rated to obtain device association data including risk rating. Next, a global radio frequency situation dataset of the target area is constructed based on the device association data. Finally, the baseline parameters and the feature splitting strategy are corrected according to the global radio frequency situation dataset, and a visualized environmental mapping archive is generated.

[0025] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or passive wireless environment detection device capable of performing the above functions. The following description uses a passive wireless environment detection device as an example to illustrate this embodiment and the subsequent embodiments.

[0026] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0027] This application provides a control method for passive wireless environment detection, referring to... Figure 1 and Figure 2 , Figure 1 This is a flowchart outlining the overall framework of this application. Figure 2 This is a flowchart illustrating the first embodiment of the passive wireless environment detection control method of this application.

[0028] In this embodiment, the control method for passive wireless environment detection includes steps S10 to S50: Step S10: In response to the environmental detection command, extract key information of the multi-band wireless signals corresponding to the target area according to the multi-band feature splitting strategy, and organize the radio frequency feature data.

[0029] The environmental detection command is the core control command that triggers passive wireless environmental detection tasks. The multi-band feature-based routing strategy is a pre-configured set of differentiated signal acquisition, filtering, and feature extraction rules tailored to the interference characteristics and information value of wireless signals in different frequency bands. Examples include low-frequency band large-bandwidth sampling rules, mid-frequency band narrowband filtering rules, high-frequency band burst signal capture rules, and cross-band synchronization alignment rules. Radio frequency (RF) characteristic data is a structured set of data extracted from multi-band wireless signals that characterizes the wireless characteristics of the device. Examples include signal strength, broadcast period, channel identifier, device fingerprint, occurrence time, duration, and frequency band occupancy rate.

[0030] In this embodiment, the aforementioned environmental detection commands can be triggered in six ways. First, timed inspection triggering: the system automatically generates and issues environmental detection commands at specified times according to preset periodic scheduling rules to perform routine area wireless environment inspection tasks. Second, abnormal alarm linkage triggering: when the system receives area intrusion alarms or device abnormality alarms from other security systems, it automatically generates and issues environmental detection commands to conduct focused wireless environment investigations in the alarmed areas. Third, user-initiated triggering: users initiate detection requests through the system's interactive interface or input detection execution commands through the management platform; the system receives the request and generates and issues environmental detection commands to perform on-demand detection in designated areas. Fourth, device access triggering: when the system detects a new device accessing the local wireless network within the target area, it automatically generates and issues environmental detection commands to detect the surrounding wireless environment of the newly accessed device. Fifth, area boundary crossing triggering: when the system detects personnel or vehicles crossing the target area boundary through video surveillance, access control systems, etc., it automatically generates and issues environmental detection commands to perform real-time detection of the wireless environment in the boundary area. The sixth is baseline deviation triggering. When the system detects that the deviation between the wireless environment characteristics of the current area and the benchmark data in the environmental baseline library exceeds a preset threshold, it automatically generates and issues an environmental detection command to conduct comprehensive detection and verification of the deviation area.

[0031] When the passive wireless environment monitoring device receives the environment monitoring command, it starts the multi-band radio frequency acquisition unit and performs signal acquisition and feature extraction operations according to the multi-band feature splitting strategy.

[0032] For example, there are two ways to extract radio frequency feature data according to the multi-band feature splitting strategy. The first is full-band synchronous detection splitting extraction. Before the detection task is officially started, the sampling rate, filtering bandwidth, and gain parameters of all frequency band acquisition units are configured according to the multi-band feature splitting strategy. At the same time, the clock signals of all acquisition units are synchronized to ensure the time consistency of signal acquisition in each frequency band. Then, all frequency band acquisition units are started to perform fully passive no-transmission listening simultaneously, capturing wireless signals of all frequency bands in the target area in parallel. Then, according to the splitting strategy, the signals of each frequency band are filtered, denoised, and feature extracted separately. Finally, the feature data of all frequency bands are time-aligned and formatted to output radio frequency feature data. This method can capture wireless signals of all frequency bands at the same time, without missing any key information of any frequency band, and has the most comprehensive detection coverage. It is suitable for key area detection scenarios with high requirements for detection integrity.

[0033] The second method is frequency band priority dynamic scheduling and segmentation extraction. After the detection task starts, according to the preset frequency band priorities in the multi-frequency band feature segmentation strategy, acquisition resources are first allocated to high-priority frequency bands, and the acquisition units of high-priority frequency bands are activated to capture signals and extract features. Simultaneously, the signal strength and interference level of each frequency band are monitored in real time. When abnormal signal fluctuations are detected in a low-priority frequency band, the acquisition resource allocation ratio is dynamically adjusted, temporarily increasing the priority of that frequency band and activating the corresponding acquisition unit for focused acquisition. After the acquisition tasks of high-priority frequency bands are completed, the acquisition units of the remaining low-priority frequency bands are activated sequentially for supplementary acquisition. Finally, the feature data of all frequency bands are integrated and time-aligned to output radio frequency feature data. This method can dynamically adjust the allocation of acquisition resources according to the actual environment, prioritizing the detection accuracy of high-value frequency bands while effectively reducing system resource consumption, making it suitable for resource-constrained large-scale area detection scenarios.

[0034] In an exemplary scheme for extracting radio frequency (RF) feature data, a preset multi-band feature splitting strategy is first loaded. This strategy includes splitting rules for three frequency bands: low-frequency, mid-frequency, and high-frequency. Each splitting rule is pre-configured with a corresponding sampling rate, filtering bandwidth, gain parameter, and feature extraction dimension. Then, the acquisition units are initialized, configuring all frequency band acquisition units to a fully passive, no-transmission listening mode, and synchronizing the clock signals of all acquisition units to ensure that the time error does not exceed a preset threshold. Next, full-band synchronous acquisition is initiated, capturing wireless broadcast signals of each frequency band within the target area in parallel, and outputting raw RF sampling data streams of each frequency band with a unified timestamp. Then, the raw sampling data streams of each frequency band are processed according to the splitting strategy. For low-frequency signals, large-bandwidth low-pass filtering and field strength feature extraction are performed; for mid-frequency signals, narrow-band pass filtering and broadcast period feature extraction are performed; and for high-frequency signals, burst signal detection and device fingerprint feature extraction are performed. Finally, time alignment and format normalization are performed on the feature data of all frequency bands, RF interference and redundant data are removed, and standardized RF feature data is output after structured encapsulation.

[0035] Step S20: Based on the area identifier of the target area, match the corresponding reference data in the environmental baseline library, compare the radio frequency feature data with the reference data to obtain abnormal device data.

[0036] A region identifier is coded information used to uniquely identify a target region, enabling precise location of its geographical extent and spatial attributes. The environmental baseline library is a structured database storing long-term stable wireless environment characteristics of different regions. The environmental baseline library includes wireless environmental fingerprints, which include device density, frequency band occupancy, associated relationships, resident device sets, regional change patterns, and temporal patterns. The environmental baseline library also includes airport environmental baselines, campus environmental baselines, shopping mall environmental baselines, office area environmental baselines, and residential environmental baselines. The system automatically matches the current scenario type to the corresponding baseline and then performs anomaly analysis. Specifically, the environmental baseline generation module, environmental baseline learning module, and environmental baseline library work together to form a closed loop of data collection, environmental fingerprinting, environmental baseline generation, long-term learning, environmental modeling, and anomaly detection. Examples include trusted device fingerprint sets, average field strength ranges for each frequency band, normal broadcast cycle intervals, and the frequency of occurrence of common devices. The benchmark data is a set of environmental baseline data stored in the environmental baseline library that characterizes the normal wireless environment state of the target region. Environmental baselines are stable wireless environment characteristic benchmarks formed through long-term statistical analysis of the target region, characterizing the region's normal wireless environment state. Examples include the region's common frequency band occupancy level and average signal strength distribution. Anomaly device data refers to a structured data set corresponding to devices whose radio frequency characteristic data deviates significantly from baseline data. Examples include device identifier, anomaly type, characteristic offset, occurrence time, and location information. Trusted devices are user-authorized, self-owned devices used as observation anchors for wireless environment detection to determine abnormal approach and associated behaviors. Examples include user-owned laptops and smartphones.

[0037] Once the system acquires standardized radio frequency characteristic data and the area identifier of the target area, it begins to perform environmental baseline matching and feature comparison operations.

[0038] For example, there are two ways to implement matching benchmark data based on regional identifiers. The first is precise regional identifier matching. First, the unique regional identifier of the target area is extracted. Then, the benchmark data entry that is completely consistent with the regional identifier is directly retrieved from the environmental baseline database. The corresponding trusted device fingerprint set, benchmark feature parameters of each frequency band, and anomaly judgment threshold are retrieved, and the successfully matched regional benchmark data is output. This method has a simple and direct matching logic, fast retrieval speed, and high matching accuracy. It is suitable for mature area detection scenarios where a complete environmental baseline has been established.

[0039] The second method is neighboring region feature transfer matching. First, a unique regional identifier for the target region is extracted. Then, a baseline data entry matching this identifier is retrieved from the environmental baseline database. If no matching baseline data is found, the baseline data of multiple neighboring regions with the closest geographical distance and similar spatial attributes to the target region is further retrieved. These neighboring region baseline data are then weighted and fused, with the weights inversely proportional to the geographical distance between the neighboring regions and the target region. This generates temporary baseline data suitable for the target region, which is then stored in the environmental baseline database for subsequent optimization. This method can solve the detection problem in newly deployed areas or areas without established baselines, allowing for rapid detection without waiting for baseline data accumulation. It is suitable for rapid deployment in new areas and emergency detection scenarios.

[0040] After obtaining the matching benchmark data, the radio frequency characteristic data can be compared with the benchmark data in the following ways to obtain the abnormal device data.

[0041] In one alternative approach, the RF feature data is first split by device dimension, and multi-dimensional RF features for each device are extracted. Then, the RF features of each device are compared dimension-by-dimensionally with the corresponding trusted device fingerprint and baseline feature parameters in the benchmark data, calculating the offset for each feature dimension. If the offset of any feature dimension of a device exceeds a preset anomaly threshold, the device is marked as an abnormal device, and its abnormal features and offset information are integrated to output abnormal device data. This method is logically intuitive, computationally efficient, and fast, enabling rapid identification of obvious abnormal devices, and is suitable for both routine inspections and real-time detection scenarios.

[0042] In another alternative approach, the radio frequency (RF) feature data is first split along the device group dimension, dividing the devices into multiple groups based on their appearance time, location information, and frequency band characteristics. Then, the overall features of each device group are compared in batches with the associated features of the corresponding normal device group in the benchmark data to calculate the overall feature offset of the device group. If the overall feature offset of a device group exceeds a preset anomaly detection threshold, each device within the group is further compared dimension-by-dimensionally to identify the abnormal devices within the group. The abnormal features are then integrated with the associated device information to output the abnormal device data. This method can improve the accuracy of anomaly identification by leveraging the correlation between devices, effectively reducing misjudgments caused by fluctuations in single device features, and is suitable for high-precision detection scenarios in complex environments.

[0043] In an exemplary scheme for obtaining anomalous device data, the system first receives the regional identifier and standardized radio frequency (RF) feature data of the target area. It then retrieves the baseline dataset from the environmental baseline library to match the corresponding region, and simultaneously loads a subset of trusted device fingerprints associated with that region, outputting a correlated dataset of the regional baseline and trusted fingerprints. Next, using the correlated dataset of the regional baseline and trusted fingerprints as input, the RF feature data is disassembled by device dimension and compared dimensionally with baseline features such as the resident field strength, broadcast period, and frequency band occupancy of the corresponding device, outputting a multi-dimensional feature offset set for each device. Then, using the multi-dimensional feature offset set of each device as input, an initial anomaly score is calculated based on preset weights. This score is then overlaid with device temporal co-occurrence and cross-frequency band coupling features for a secondary verification of anomaly credibility, outputting a device anomaly score result with verification markings. Finally, using the device anomaly score result with verification markings as input, devices with scores exceeding a preset threshold and passing verification are selected. Their anomaly features, occurrence time periods, and associated device information are integrated to output structured anomalous device data.

[0044] Step S30: Based on the abnormal device data, calculate the abnormal score by weighting the cross-frequency band coupling characteristics and device timing characteristics, and obtain device association data including risk rating based on the abnormal score rating.

[0045] Cross-band coupling characteristics are feature parameters that characterize the correlation between wireless signals of the same device across multiple different frequency bands. Examples include the broadcast synchronization, signal strength correlation, and frequency band switching patterns of the same device across different frequency bands. Device temporal characteristics are feature parameters that characterize the pattern of wireless signal changes over time. Examples include the pattern of device appearance time, duration, signal strength variation trend, and periodic appearance. Anomaly score is a numerical indicator used to quantify the degree of device anomaly; a higher score indicates a higher degree of anomaly. Risk rating is a device risk level classified according to the anomaly score, used to visually characterize the security risk level of the device. Examples include low risk, medium risk, high risk, and extremely high risk. Device association data is a structured data set containing basic information about abnormal devices, anomaly characteristics, anomaly scores, risk ratings, and relationships with other devices.

[0046] After the system obtains the structured abnormal device data, it begins to perform anomaly score calculation and risk rating operations.

[0047] For example, there are two implementation methods for weighted calculation of anomaly scores combining cross-band coupling features and device timing features. The first method is static weighted calculation. First, fixed weight values ​​are assigned to multi-dimensional anomaly metrics such as field strength shift, broadcast duration, frequency band occupancy, and correlation strength according to preset weight allocation rules. Simultaneously, fixed weight values ​​are assigned to cross-band coupling features and device timing features. Then, the feature values ​​of each dimension of the anomaly device are multiplied by their corresponding weight values ​​and summed to obtain the initial anomaly score for the device. Finally, the initial anomaly score is corrected based on the weight values ​​of the cross-band coupling features and device timing features to obtain the final anomaly score. This method has a simple and stable calculation logic, unified and controllable weight rules, and fast calculation speed, making it suitable for routine detection and large-scale batch processing scenarios.

[0048] The second method is dynamic weight adaptive calculation. First, it retrieves data on correctly identified anomalous devices and misclassified devices from historical detection tasks, training a weight adaptive adjustment model. Then, it inputs the multi-dimensional features, cross-frequency coupling features, and temporal features of the current anomalous device into the model. The model automatically assigns dynamic weight values ​​to each feature dimension based on the degree of anomalousness and historical contribution. Finally, it multiplies each feature value by its corresponding dynamic weight value and sums the results to obtain the final anomalous score for the device. This method automatically adjusts the weight allocation based on historical data, continuously improving the accuracy of anomalous score calculation and effectively reducing false positive and false negative rates. It is suitable for high-precision detection scenarios in complex environments.

[0049] After calculating the anomaly score, the anomaly score can be used to generate a rating, which will include the device association data with risk rating.

[0050] In one alternative approach, the anomaly score of an abnormal device is first compared with a preset risk level threshold range to determine the corresponding risk level of the device. Then, the device's basic information, anomaly characteristics, anomaly score, and risk level are extracted to generate risk data for a single device. Finally, the risk data of all abnormal devices are integrated to output device-related data including risk ratings. This method is logically simple, executes quickly, and can rapidly complete risk rating, making it suitable for both routine inspections and real-time monitoring scenarios.

[0051] In another alternative approach, the anomaly score of an abnormal device is first compared with a preset risk level threshold range to determine the initial risk level of that device. Then, a device association topology network is constructed based on the temporal symbiotic relationship and cross-frequency band coupling relationship between devices, mapping the initial risk level of each device to its corresponding topology node. Next, the risk transmission coefficient is calculated along the association edges of the topology network, and the risk levels of adjacent devices are dynamically adjusted based on the risk transmission coefficient, marking high-risk transmission paths. Finally, the adjusted risk levels, association topology relationships, and high-risk transmission path information of all devices are integrated to output device association data including risk ratings. This method can consider the transmission effect of risk between devices, comprehensively assess the actual risk level of devices, effectively identify hidden high-risk devices, and is suitable for detection scenarios in key areas with high security requirements.

[0052] In an exemplary scheme for obtaining device association data including risk ratings, structured abnormal device data is first received. The temporal features and cross-frequency band coupling features corresponding to each abnormal device in the abnormal device data are extracted according to multi-dimensional feature indexing rules, and integrated to form an abnormal device feature set with multi-dimensional association attributes. Then, using the abnormal device feature set as input, and based on preset weights of multi-dimensional anomaly measurement indicators, an initial anomaly score result for each abnormal device is calculated. Next, based on the initial anomaly score result, and combined with the association strength of synchronous broadcasting, continuous accompaniment, and cross-frequency band linkage between devices, the initial score is dynamically corrected and calibrated, and a calibrated anomaly score set is output. Finally, risk levels are divided according to the calibrated anomaly score intervals, the association topology between devices is synchronously mapped, the data is structurally encapsulated, and device association data containing risk ratings is output.

[0053] Step S40: Construct a global radio frequency situation dataset for the target area based on the device association data.

[0054] The global radio frequency situation dataset is a structured spatiotemporal dataset that integrates the wireless characteristics, anomaly information, risk ratings and correlations of all devices within the target area, and can comprehensively characterize the overall wireless environment status of the target area.

[0055] Once the system obtains the device association data, including risk ratings, it begins the process of constructing a full-domain radio frequency situation dataset.

[0056] For example, there are two ways to construct a full-domain radio frequency (RF) situation dataset based on device association data. The first is a static snapshot-based construction. After the detection task is completed, all device association data, raw RF feature data, and regional baseline data obtained in this detection are integrated at once. Then, the device nodes in the device association data are mapped to the geospatial grid of the target area, and the device distribution density, frequency band occupancy rate, and comprehensive risk level in each grid are labeled to generate an RF situation snapshot at the current moment. Finally, the RF situation snapshot is normalized and its metadata is labeled, integrating information such as region identifier, detection time, and data version, and outputting the full-domain RF situation dataset after structured encapsulation. This method has a simple and stable construction logic, a complete dataset structure, and can accurately reflect the wireless environment status at the time of detection, making it suitable for regular inspections and offline analysis scenarios.

[0057] The second method is time-series incremental construction, which receives incremental updates of device-associated data in real time during the detection task. Then, the incrementally updated device-associated data is mapped in real time to the geospatial grid of the target area, dynamically updating the device distribution density, frequency band occupancy, and overall risk level of each grid. Simultaneously, time-series situational slices are generated according to a preset time granularity and stored and associated in chronological order. Upon completion of the detection task, all time-series situational slices are integrated with the full data from this detection to generate a spatiotemporal situational sequence data covering the entire detection cycle. After structured encapsulation, a full-domain radio frequency situational dataset is output. This method can reflect the dynamic changes of the wireless environment in real time, preserving complete temporal evolution information, and is suitable for real-time monitoring and long-term trend analysis scenarios.

[0058] In an exemplary scheme for constructing a comprehensive radio frequency (RF) situation dataset, structured device association data is first received, and the original RF feature data from the current detection is simultaneously associated with regional benchmark data to form a basic data set for constructing the comprehensive RF situation. Then, using this basic data set as input, device association topology nodes are mapped to a geospatial grid of the target area, and the device distribution density, frequency band occupancy rate, and overall risk level within each grid are labeled, outputting RF situation grid data with spatial attributes. Next, using this spatially attributed RF situation grid data as input, RF feature fluctuations and risk evolution patterns from different time periods are aggregated at a preset time granularity to generate a spatiotemporal situation sequence data covering the entire target area. Finally, format normalization and metadata annotation are performed on the spatiotemporal situation sequence data, integrating information such as regional identifiers, detection cycles, and data versions, and after structured encapsulation, a comprehensive RF situation dataset for the target area is output.

[0059] Step S50: Correct the baseline parameters and the feature splitting strategy according to the global radio frequency situation dataset, and generate a visual environment mapping file.

[0060] Baseline parameters are a collective term for various parameters in the environmental baseline library used to determine whether a device is abnormal. Examples include the field strength reference value for each frequency band, the broadcast cycle reference interval, the anomaly detection threshold, and the trusted device fingerprint update cycle. A visualized environmental mapping archive is a structured archive that presents full-domain radio frequency situational data in a visual manner, intuitively displaying the wireless environment distribution, abnormal device locations, risk level distribution, and evolution trends of the target area.

[0061] After the system acquires the full-domain radio frequency situation dataset of the target area, it begins to perform baseline parameter and feature splitting strategy correction operations, as well as the generation of visual environmental mapping archives.

[0062] For example, there are two ways to implement baseline parameter and feature splitting strategies based on a full-domain RF situation dataset. The first is periodic batch correction. According to a preset correction cycle, all full-domain RF situation datasets generated by all detection tasks within that cycle are collected periodically. Then, statistical analysis is performed on all datasets to extract long-term stable RF feature distributions, periodic environmental fluctuation patterns, and abnormal evolution patterns not covered by the baseline. Based on the statistical analysis results, various baseline parameters in the environmental baseline library are adjusted in batches, while the sampling weights, filtering rules, and feature extraction priorities in the multi-band feature splitting strategy are also adjusted. Finally, the corrected baseline parameters and feature splitting strategies are stored in the system for subsequent detection tasks. This method has a simple and stable correction logic, can perform comprehensive optimization based on a large amount of historical data, and is suitable for detection scenarios in conventional areas where environmental changes are relatively slow.

[0063] The second method is real-time incremental correction. After each detection task is completed and a full-domain RF situation dataset is generated, the dataset is immediately analyzed to extract new reliable device features, environmental fluctuation patterns, and anomaly modes discovered during the detection. Then, based on the analysis results, the corresponding baseline parameters in the environmental baseline library are updated incrementally in real time. Simultaneously, the sampling weights and filtering rules of the frequency bands relevant to the current detection are dynamically adjusted in the multi-band feature routing strategy. Finally, the corrected baseline parameters and feature routing strategy are stored in the system and immediately applied to the next detection task. This method can quickly adapt to dynamic environmental changes, update baselines and strategies in a timely manner, effectively improve the accuracy of subsequent detections, and is suitable for detection scenarios in complex areas with frequent environmental changes.

[0064] After revising the baseline parameters and feature splitting strategy, a visual environmental mapping archive can be generated in the following way.

[0065] In one alternative approach, the entire domain radio frequency situation dataset, corrected baseline parameters, and optimized routing strategies are first integrated. Then, multi-dimensional visualizations are generated, including geospatial distribution, temporal variation curves, and risk propagation paths. These visualizations include device distribution heatmaps, frequency band occupancy distribution maps, risk level heatmaps, abnormal device trajectory maps, and temporal variation curves. Finally, all visualizations are integrated with the corresponding structured data, and an archive cover, table of contents, and explanatory information are added. After structured encapsulation, a visualized environmental mapping archive is output. This method produces comprehensive and complete archives that fully demonstrate the wireless environment status of the target area, suitable for both formal reports and archiving scenarios.

[0066] In another alternative approach, the hierarchy and scope of the visualization content to be generated are first determined based on the user's needs and permissions. Then, data corresponding to the specified hierarchy and scope is extracted from the global radio frequency situation dataset to generate customized visualization content, such as device distribution maps for specific areas, occupancy curves for specific frequency bands, and lists of abnormal devices for specific risk levels. Finally, the customized visualization content is integrated with the corresponding structured data to generate a streamlined visualized environmental mapping archive. This method can generate personalized archives based on user needs, effectively reducing unnecessary content and improving the readability and usability of the archives, making it suitable for daily work reports and quick reference scenarios.

[0067] In an exemplary scheme for generating a visualized environmental mapping archive, the system first receives a global radio frequency situation dataset of the target area. It then extracts the long-term stable radio frequency characteristic distribution, periodic environmental fluctuation patterns, and abnormal evolution patterns not covered by the baseline, outputting a systematic deviation analysis report between the baseline and the strategy. Next, using the systematic deviation analysis report as input, it dynamically adjusts the threshold values ​​of multi-dimensional anomaly metrics for each frequency band in the environmental baseline library by region and time period, simultaneously updating the trusted device fingerprint subset and anomaly judgment boundaries, outputting a corrected set of environmental baseline parameters. Then, based on the corrected set of environmental baseline parameters, and combining the proportion of effective information and interference intensity distribution in each frequency band, it dynamically adjusts the sampling weights, filtering rules, and feature extraction priorities in the multi-band feature routing strategy, outputting an optimized multi-band feature routing strategy. Finally, it integrates the global radio frequency situation dataset, the corrected baseline parameters, and the optimized routing strategy to generate multi-dimensional visualization content including geospatial distribution, temporal variation curves, and risk transmission paths. After completing the structured encapsulation of the archive, it outputs a visualized environmental mapping archive.

[0068] Further, please refer to Figure 1 , Figure 1This is a flowchart illustrating the overall framework of this application. A passive wireless environment detection implementation method based on user-owned anchor points first performs a user-owned trusted device (Tedded Devices) entry operation, setting the user's authorized devices as wireless environment observation anchor points. Subsequently, the system enters a continuous daily monitoring state, accumulating real-world environment baseline data in different scenarios such as schools and airports over a long period. Then, a private database is constructed based on the large amount of real-world environment baseline data collected over a long period, storing the normal wireless environment characteristics and historical statistical patterns of each scenario. When an anomaly is detected in the wireless environment at a certain time and place, manifested as a significant increase in the total number of devices, excessively long dwell times for most individual devices, and other characteristics clearly deviating from the historical baseline, and the presence of newly added unknown devices approaching trusted devices, the system initiates anomaly analysis, marking the abnormal devices and abnormal environment states according to risk rating. Finally, a graph of environmental relationships and device companion relationships is drawn, and the temporal evolution trajectory is recorded simultaneously, generating an environmental relationship graph, completing a complete closed-loop detection process from baseline accumulation, anomaly identification, to relationship tracing.

[0069] Please refer to Figure 3 , Figure 3 This is a system framework diagram of this application. The hardware structure and complete software workflow of a multi-band wireless environment monitoring system are described. The hardware structure uses the ESP32-S3 as the main control chip, combined with CC1101 and SX1278 radio frequency modules to form a multi-band wireless environment acquisition platform. The main control module uses the ESP32-S3 chip, responsible for passive scanning of Wi-Fi and Bluetooth Low Energy (BLE), data caching, anomaly scoring calculation, module scheduling, and local control logic execution. It also manages data synchronization among the radio frequency modules and can perform edge preprocessing such as Received Signal Strength Indicator (RSSI) filtering and broadcast cycle extraction to reduce subsequent load. The first wireless radio frequency acquisition module uses the CC1101 chip to monitor sub-gigahertz (SubGHz) band signals. The second wireless radio frequency acquisition module uses the SX1278 chip to acquire long-range low-power broadcast signals from LoRa radio. The local storage module uses the ESP32-S3's built-in flash memory or pseudo-static random access memory to store data locally throughout the process and establish a wireless environment mapping database. The status output and software display module visualizes the results through serial ports, client software, and other means.

[0070] The software process strictly follows the module linkage logic: First, the trusted device entry module enters information such as the Media Access Control (MAC) address and broadcast characteristics of authorized devices, stores it in the trusted device fingerprint database module, and generates an initial environmental baseline. Then, the Wireless Fidelity / Bluetooth Low Energy module and the sub-gigahertz / long-range radio module are activated, and the multi-band signal acquisition module collects naturally occurring wireless broadcast signals in multiple frequency bands within the target area in a fully passive, non-transmitting manner. After acquisition, the environmental fingerprint generation module extracts multi-dimensional features such as device identification, signal strength change trends, and broadcast cycles to generate standardized device environmental fingerprints and establish time-series records. Next, the environmental baseline modeling module constructs a trusted device environmental baseline model based on long-term data collected from trusted devices, including dimensions such as the resident environment, high-frequency accompanying devices, and cross-frequency band relationships. Then, the anomaly analysis and scoring module compares the real-time collected environmental fingerprints with the baseline, combines cross-frequency band coupling characteristics and device time-series characteristics to weighted calculate anomaly scores, and classifies risk levels. Finally, the relationship graph update module dynamically updates the device association topology and marks risk transmission paths based on synchronous broadcasts, continuous accompanying relationships, and other associations between devices. Finally, the environmental mapping output module integrates all data to generate a visualized environmental mapping archive. The system runs continuously and dynamically corrects the baseline and strategy based on newly collected data, forming a dynamic closed-loop detection mechanism of wireless monitoring, environmental modeling, anomaly analysis, relationship updating, and continuous learning.

[0071] Second Embodiment This embodiment provides an exemplary scheme for multi-band radio frequency feature extraction. In this example, the multi-band radio frequency acquisition unit is first configured with a passive wireless detection mode and synchronized with a timing reference. Then, radio frequency sampling data with a unified timestamp is acquired based on the synchronization signal. Next, interference and redundant data are removed through differentiated filtering rules. Finally, key information of each frequency band is extracted according to the multi-band feature extraction strategy and the data is processed to obtain radio frequency feature data. Step S10 includes steps A11 to A14: Step A11: After responding to the environmental detection command, configure the passive wireless detection mode for the multi-band radio frequency acquisition unit, and synchronize the timing reference of the multi-band radio frequency acquisition unit to obtain the synchronization ready signal of the multi-band radio frequency acquisition unit.

[0072] Step A12: Based on the synchronization ready signal, the wireless broadcast signal in the target area is acquired through the multi-band radio frequency acquisition unit to obtain a radio frequency sampling dataset with a unified timestamp.

[0073] Step A13: Match differentiated filtering rules according to the inherent interference characteristics of each frequency band, and remove redundant interference data in the radio frequency sampling dataset through the differentiated filtering rules to obtain the multi-band wireless signal.

[0074] Step A14: Extract the key information corresponding to each frequency band in the multi-band wireless signal according to the multi-band feature splitting strategy, and organize it to obtain the radio frequency feature data.

[0075] Passive wireless detection mode refers to a working mode in which the RF acquisition unit only receives naturally occurring wireless broadcast signals in the environment, without actively emitting any RF signals or establishing a connection with the target device. This is the core working mode that ensures the concealment and security of the detection process. Examples include Wireless Fidelity passive scanning mode, Bluetooth Low Energy passive listening mode, sub-gigahertz band passive listening mode, and long-range radio band passive receiving mode. A timing reference is a time reference standard used to unify the sampling clocks of all RF acquisition units, and is a core parameter ensuring the consistency of multi-band signal acquisition time. Examples include a global clock synchronization signal, hardware trigger synchronization pulse, software timestamp synchronization reference, and sampling period synchronization marker. The RF sampling dataset is the set of raw digital signals obtained by multi-band RF acquisition units after analog-to-digital conversion of spatial wireless signals according to a preset sampling rate. It contains signal amplitude, frequency, and time information for all frequency bands. Examples include Wireless Fidelity band sampling data, Bluetooth Low Energy band sampling data, sub-gigahertz band sampling data, and long-range radio band sampling data. Differentiated filtering rules are a set of signal processing rules pre-designed to eliminate invalid signals and interference noise based on the inherent interference characteristics and noise distribution patterns of wireless signals in different frequency bands. Examples include low-frequency band high-bandwidth low-pass filtering rules, mid-frequency band narrow-band pass filtering rules, high-frequency band burst signal filtering rules, and periodic interference suppression rules. Multi-band feature demultiplexing strategies are a set of differentiated feature extraction rules pre-configured based on the information value and feature types of wireless signals in different frequency bands, used to extract key information by frequency band. Examples include field strength feature extraction rules, broadcast period extraction rules, device fingerprint extraction rules, and frequency band occupancy feature extraction rules. Radio frequency (RF) feature data is a structured data set extracted from multi-band wireless signals that uniquely characterizes the wireless characteristics of a device. It is the core foundational data for subsequent anomaly detection and risk assessment. Examples include device identifier, signal field strength, broadcast period, channel identifier, occurrence time, duration, and frequency band occupancy rate.

[0076] In this example, when configuring the passive wireless detection mode for the multi-band RF acquisition unit and synchronizing the timing reference to obtain a synchronization ready signal, hardware clock synchronization can be used. The main control chip outputs a global hardware synchronization pulse signal, simultaneously triggering clock reset and mode configuration for all RF acquisition units, ensuring complete synchronization of the sampling clocks of all acquisition units. After configuration, a synchronization ready signal is returned uniformly. Alternatively, software timestamp synchronization can be used. First, an independent local clock is configured for each RF acquisition unit. Then, the main control chip periodically sends time synchronization messages to calibrate the local clock deviation of each acquisition unit. After configuration, each acquisition unit returns a ready signal sequentially, thus completing the mode configuration and timing synchronization of the multi-band acquisition unit.

[0077] After completing the mode configuration and timing synchronization of the multi-band radio frequency acquisition units, the wireless signal acquisition process is started. Based on the synchronization ready signal, all radio frequency acquisition units simultaneously passively acquire wireless broadcast signals in the target area, and add a unified global timestamp to each sampled data point to obtain a radio frequency sampling dataset with a unified timestamp. This ensures the time consistency of multi-band signals and lays the foundation for subsequent cross-band feature correlation analysis.

[0078] After obtaining the radio frequency sampling dataset, the interference filtering process is initiated. First, the frequency band type corresponding to each frequency band sampling data is identified. Based on the frequency band type, pre-designed differentiated filtering rules are matched. The radio frequency interference redundant data in the sampling data is removed through the corresponding filtering rules, and the effective wireless broadcast signal is retained to obtain the purified multi-frequency wireless signal. In this way, the signal-to-noise ratio of each frequency band signal is improved through differentiated interference processing, and the interference of invalid data on subsequent feature extraction is reduced.

[0079] After obtaining the purified multi-band wireless signals, the feature extraction process is initiated. According to the multi-band feature demultiplexing strategy, the corresponding feature extraction rules are matched for each frequency band wireless signal, and the key information corresponding to each frequency band signal is extracted. Finally, the key information extracted from all frequency bands is formatted and structured to obtain standardized radio frequency feature data. In this way, the extraction accuracy and relevance of each frequency band feature are improved through demultiplexing feature extraction.

[0080] For example, there are two ways to extract key information of each frequency band according to the multi-band feature splitting strategy. The first is fixed-segment serial extraction. According to the preset frequency band priority order in the multi-band feature splitting strategy, the wireless signal of each frequency band is extracted sequentially. First, all key information of the high-priority frequency band is extracted, and then the key information of the second-highest priority frequency band is extracted. After the feature extraction of all frequency bands is completed, the data is uniformly formatted and structured to obtain radio frequency feature data. This method adopts priority-locked serial extraction logic. The feature extraction process of each frequency band is independent and controllable, which is not prone to data confusion and feature loss. It can ensure the feature extraction accuracy of high-priority frequency bands and is suitable for key area detection scenarios with high requirements for key frequency band detection.

[0081] The second method is dynamic parallel extraction via splitting. This involves splitting and allocating resources across multiple frequency bands of wireless signals. Based on the data volume and feature extraction complexity of each band, system computing resources are dynamically allocated, prioritizing bands with large data volumes and high feature complexity. This generates multiple feature extraction tasks that are computationally independent of each other. Parallel processing is then initiated simultaneously for all generated feature extraction tasks. Within each task, all key information for that band is extracted according to the splitting strategy. After all feature extraction tasks for all bands are completed, the key information is aggregated, formatted, and structured to obtain the radio frequency feature data. This method employs dynamic resource allocation and full-band parallel extraction logic. Through prior resource requirement analysis and dynamic scheduling, it fully utilizes the system's computing resources, improving the overall efficiency of multi-band feature extraction. It is suitable for detection scenarios involving large-scale areas and full multi-band coverage.

[0082] Furthermore, a layered approach with different optional hardware tiers is adopted to adapt to different application scenarios, deployment costs, and wireless environment analysis needs. The overall architecture employs a three-layer progressive hardware structure: The first layer is the ESP32-S3 basic monitoring layer, which implements Wi-Fi and Bluetooth Low Energy (BLE) signal monitoring and basic modeling functions. In the basic implementation, only the ESP32-S3 main control module is needed to complete basic wireless environment acquisition, trusted device input, local environment baseline establishment, abnormal broadcast behavior analysis, and basic environment mapping. It features low hardware cost, simple deployment, and low power consumption, making it suitable for core algorithm verification and lightweight wireless environment analysis scenarios. The second layer is a multi-band fusion layer, integrating the CC1101 and SX1278 RF modules to extend sub-gigahertz and LoRa long-range low-power broadcast monitoring capabilities, respectively. In the enhanced implementation, it can realize multi-band wireless environment acquisition, cross-band correlation analysis, complex wireless environment modeling, abnormal RF behavior analysis, and environmental relationship map construction, suitable for long-term continuous environmental sensing and abnormal device analysis scenarios in complex wireless environments. The third layer is the Software-Defined Radio (SDR) mapping layer, which connects to the SDR module and mapping software platform to achieve wireless environmental situational awareness. The ESP32-S3 handles low-power continuous monitoring and edge preprocessing, the SDR module handles high-precision spectrum acquisition of wider-band wireless signals, and the environmental mapping software platform performs wireless environment visualization, device relationship analysis, frequency band occupancy analysis, device distribution heatmap construction, abnormal device clustering analysis, and wireless environmental situational awareness. This layered approach allows for the gradual expansion of wireless environment detection capabilities based on different hardware configurations, forming a complete technical architecture from edge monitoring to wide-band wireless environment mapping. The environmental relationship map is a spatiotemporal network of devices constructed based on temporal and cross-band characteristics, representing the accompanying, interconnected, and coupled patterns between devices. Examples include the patterns of device accompaniment and cross-band synchronous broadcasting relationships.

[0083] Please refer to Figure 4 , Figure 4This diagram illustrates the scene feature clustering and classification used in this application. A two-dimensional scene feature space is constructed with the scene stability feature axis as the horizontal axis and the scene mobility feature axis as the vertical axis. This distribution is mapped from actual collected samples and is only used to illustrate the relative relationships between different scene features. Scene 1 (shopping mall), Scene 2 (subway), and Scene 3 (train station) are arranged sequentially along the scene stability feature axis, with scene stability gradually increasing and scene mobility gradually decreasing. Scene 4 (study room) has the highest scene stability and the lowest scene mobility, while Scene 5 (cinema) has both the highest scene stability and relatively high scene mobility. The range of fluctuation in wireless environment features for each scene is represented by dashed circles. Based on the feature differences of different scenes, the system can adapt differentiated environmental baseline parameters, anomaly detection thresholds, and multi-band feature routing strategies for each scene, thereby improving the adaptation accuracy and anomaly identification accuracy of passive wireless environment detection in different scenes.

[0084] Third Embodiment This embodiment provides an exemplary scheme for accurate identification of abnormal devices based on regional baseline matching. In this example, the baseline data in the environmental baseline library and a subset of trusted device fingerprints are first matched based on the target region identifier. Then, the radio frequency feature data is decomposed according to the device dimension. Next, the device features are compared with the baseline features dimension by dimension to obtain the feature offset. Finally, abnormal device data is obtained by filtering through feature thresholds. Step S20 includes steps B11 to B14: Step B11: Based on the area identifier of the target area and the radio frequency feature data, determine the corresponding reference data in the environmental baseline library and the trusted device fingerprint subset associated with the target area, and obtain the area device association dataset associated with the reference data and the trusted device fingerprint subset.

[0085] Step B12: Based on the regional device association dataset and device dimensions, decompose the radio frequency feature data to obtain device dimension feature data.

[0086] Step B13: Compare the device dimensional feature data with the baseline features of the devices in the target area dimension by dimension to obtain the multi-dimensional feature bias of the devices in the target area.

[0087] Step B14: Compare the multi-dimensional feature bias with the device feature threshold to filter out the abnormal device data.

[0088] The trusted device fingerprint subset is a set of wireless features of all authorized trusted devices within the target area, uniquely identifying the wireless behavior characteristics of each trusted device. Examples include device identifier, signal strength variation model, broadcast cycle characteristics, and frequency band usage characteristics. The regional device association dataset is a structured dataset obtained by associating and integrating the baseline data of the target area with the trusted device fingerprint subset; it serves as the foundation for subsequent device feature decomposition and comparison. Device-dimensional feature data is a set of multi-dimensional wireless features corresponding to each device, obtained by splitting radio frequency feature data according to device identifier; it is the smallest processing unit for device feature comparison. Examples include a single device's signal strength sequence, broadcast cycle sequence, occurrence time sequence, and frequency band occupancy sequence. Multi-dimensional feature offsets are the differences between a device's real-time features and its corresponding baseline features, used to quantify the degree to which a device's features deviate from normal conditions. Examples include signal strength offset, broadcast cycle offset, occurrence frequency offset, and duration offset. Device feature thresholds are pre-set critical values ​​used to determine whether a device's features are abnormal; when the feature offset exceeds this threshold, the device is considered abnormal.

[0089] In this example, when determining the associated dataset of regional devices based on the area identifier and radio frequency feature data of the target area, the method of precise area identifier matching can be used. This involves directly retrieving baseline data and a subset of trusted device fingerprints that are completely consistent with the target area identifier from the environmental baseline database, and then associating and integrating them to obtain the associated dataset of regional devices. Alternatively, a neighboring area feature transfer matching method can be used. If the baseline data of the target area is not found, the baseline data of multiple neighboring areas with the closest geographical distance and similar spatial attributes are retrieved. These are then weighted and fused to generate temporary baseline data and a subset of trusted device fingerprints for the target area, and finally associating and integrating them to obtain the associated dataset of regional devices. This completes the matching and association of baseline data.

[0090] After obtaining the regional device association dataset, the device dimension feature decomposition process is initiated. Based on the regional device association dataset, a list of device identifiers for all trusted devices is extracted. The radio frequency feature data is then split according to the device identifier, and a corresponding multi-dimensional feature set is generated for each device to obtain device dimension feature data. This transforms the overall radio frequency feature data into independent feature data for a single device dimension, facilitating subsequent device-by-device comparative analysis.

[0091] After obtaining the device dimensional feature data, the feature comparison process is initiated. For each device's dimensional feature data, multi-dimensional features such as field strength, broadcast period, frequency of occurrence, and duration are extracted and compared with the baseline features of the corresponding devices in the regional device association dataset. The offset of each feature dimension is calculated to obtain the multi-dimensional feature offset of all devices in the target area, thereby quantifying the degree of feature deviation of each device.

[0092] After obtaining the multi-dimensional feature offsets, the abnormal device screening process is initiated. The feature offsets of each device in each dimension are compared with the preset device feature thresholds one by one. Devices whose offsets in any dimension exceed the threshold are screened out. Their device identifiers, abnormal feature types and feature offset information are integrated to obtain structured abnormal device data, thereby completing the initial identification of abnormal devices.

[0093] For example, there are two ways to filter abnormal device data using multi-dimensional feature offsets. The first is single-device independent threshold determination. For each device, the multi-dimensional feature offset is compared one by one with the corresponding independent device feature threshold. If the offset of any dimension exceeds the corresponding threshold, the device is marked as an abnormal device. The information of all marked abnormal devices is then aggregated to obtain abnormal device data. This method uses the logic of single-device independent determination, and the determination process for each device is independent. The calculation logic is simple and stable, the execution speed is fast, and it can quickly identify obvious abnormal devices. It is suitable for routine inspection and real-time detection scenarios.

[0094] The second method involves determining the device group association threshold. First, based on the temporal co-occurrence relationship and cross-frequency band coupling relationship of the devices, the devices within the target area are divided into multiple device groups. For each device group, the average feature offset of all devices within that group is calculated. This average offset is then compared with a preset device group feature threshold. If the average offset exceeds the threshold, the feature offset of each device within the group is further compared dimension by dimension to filter out abnormal devices within the group. The abnormal device information from all device groups is then aggregated to obtain abnormal device data. This method uses the logic of device group association determination, which can improve the accuracy of anomaly identification by leveraging the association relationships between devices and effectively reduce false positives caused by random fluctuations in single device features. It is suitable for high-precision detection scenarios in complex wireless environments.

[0095] Further, please refer to Figure 5 , Figure 5 This diagram illustrates the wireless feature deviation detection based on an environmental baseline, as described in this application. An anomaly identification mechanism for the wireless environment is achieved using a baseline interval comparison mechanism. The system statistically generates a standard environmental baseline interval based on historical radio frequency data accumulated over a long period in the target area, which characterizes the range of fluctuations in the normal wireless environment of the area. During the detection process, the system plots real-time radio frequency feature data from multiple frequency bands into a real-time radio frequency feature curve according to a time series, and continuously compares the real-time radio frequency feature curve with the standard environmental baseline interval time-by-time. When the value of the real-time radio frequency feature curve exceeds the upper and lower boundaries of the standard environmental baseline interval, the system marks the feature point at the corresponding time as a feature deviation (anomaly point), thereby quickly capturing abnormal fluctuations in the wireless environment and providing a core basis for subsequent screening of abnormal devices, anomaly scoring calculation, and risk level determination.

[0096] Fourth embodiment This embodiment provides an exemplary scheme for correlation-based anomaly scoring and risk topology mapping. In this example, the temporal features and cross-frequency band coupling features of the abnormal devices are first extracted using a temporal coupling deconstruction strategy. Then, an initial score is calculated by combining the measurement weights of the anomaly measurement indicators. Next, the anomaly score is corrected and calibrated based on the correlation strength between the indicators. Finally, risk ratings are divided and mapped to the device topology relationship to obtain device correlation data. Step S30 includes steps C11 to C14: Step C11: Based on the timing coupling deconstruction strategy, analyze and extract the timing features of each abnormal device and the cross-frequency band coupling features corresponding to each abnormal device in the abnormal device data.

[0097] Step C12: Based on the device timing characteristics and the cross-frequency band coupling characteristics, and combined with the measurement weights of the anomaly measurement index, an initial score is calculated using weighted average.

[0098] Step C13: Correct and calibrate the initial score based on the correlation strength between the anomaly metrics to obtain the anomaly score.

[0099] Step C14: According to the abnormal interval and the abnormal score corresponding to the abnormal device, divide the risk rating corresponding to the abnormal device, and map the risk rating to the topological relationship between devices to obtain the device association data.

[0100] The temporal coupling deconstruction strategy is a set of structured analytical rules used to separate and extract the temporal features and cross-frequency band coupling features of anomalous equipment data. It is the core method for realizing correlation-based anomaly analysis. Examples include hierarchical extraction rules for temporal features, cross-frequency band signal synchronization matching rules, equipment correlation mining rules, and feature correlation calculation rules. Anomaly metrics are a collective term for various feature indicators used to quantify the degree of equipment anomaly, and are the basic parameters for anomaly scoring. Examples include field strength offset, broadcast duration, frequency band occupancy, correlation strength, occurrence frequency offset, and duration offset. Metric weights are pre-assigned weight coefficients to each anomaly metric, used to characterize the contribution of different indicators to the degree of anomaly. The initial score is a quantitative value of the degree of anomaly based on equipment features and metric weights, and is the basis for anomaly score correction. Correlation strength is a quantitative value characterizing the degree of correlation between different anomaly metrics, used to correct the initial score to improve scoring accuracy. Examples include the correlation strength between field strength offset and broadcast duration offset, and the correlation strength between frequency band occupancy and correlation strength. Anomaly intervals are pre-divided anomaly score intervals, each interval corresponding to a risk level. Topology is a network structure that represents the relationships between devices, consisting of device nodes and associated edges.

[0101] In this example, when extracting device timing features and cross-band coupling features using the timing coupling deconstruction strategy, the approach can be similar to single-device independent analysis. The timing features of each anomalous device are extracted one by one, and then the signal features of that device in different frequency bands are matched to obtain the cross-band coupling features. Alternatively, a device group association analysis approach can be used. First, anomalous devices are divided into multiple device groups based on their occurrence time and frequency band characteristics. Then, the timing association features and cross-band coupling features of devices within each group are extracted, thus completing the feature analysis and extraction.

[0102] After obtaining the timing characteristics and cross-band coupling characteristics of the equipment, the initial score calculation process is initiated. Each characteristic value is matched with the corresponding anomaly measurement index. Combined with the pre-set measurement weights of each index, a weighted summation calculation is performed to obtain the initial score of each abnormal device, thereby completing the preliminary quantification of the anomaly degree.

[0103] After obtaining the initial scores, a score correction and calibration process is initiated to analyze the correlation strength between various abnormal metrics. When multiple strongly correlated metrics show abnormalities simultaneously, the initial scores are positively corrected based on the correlation strength value. When there are contradictions or weak correlations between metrics, the initial scores are negatively corrected based on the correlation strength value, resulting in calibrated abnormal scores. This process eliminates scoring bias caused by fluctuations in a single metric.

[0104] After obtaining the anomaly score, the risk rating and topology mapping process is initiated. The anomaly score of each abnormal device is compared with the preset anomaly range to determine the corresponding risk level. Then, based on the temporal symbiotic relationship and cross-frequency band coupling relationship between devices, a device topology network is constructed. The risk level of each device is mapped to the corresponding topology node, high-risk propagation paths are marked, and all information is integrated to obtain device association data.

[0105] For example, there are two ways to calculate anomaly scores and generate device association data. The first is static weighted serial calculation, which calculates the initial score of each anomalous device sequentially according to a preset fixed metric weight. Then, the initial score is corrected and calibrated according to a preset fixed association strength table to obtain the anomaly score. Subsequently, risk levels are classified and device topology relationships are constructed to obtain device association data. This method uses a serial calculation logic with fixed parameters, the calculation process is simple and stable, and the execution speed is fast. It can quickly complete anomaly scoring and risk rating, and is suitable for routine inspections and large-scale batch processing scenarios.

[0106] The second method is dynamic weighted parallel computation. First, a dynamic weight adjustment model and a correlation strength calculation model are trained based on historical detection data. Multi-dimensional features of anomalous devices are input into the models, automatically generating dynamic metric weights and correlation strengths between indicators adapted to the current detection. Simultaneously, initial score calculations and correction calibrations for all anomalous devices are initiated, obtaining a batch of anomalous scores for all devices. Then, a device topology network is constructed in parallel and mapped to risk levels to obtain device correlation data. This method employs dynamic parameters and parallel computation logic, enabling automatic adjustment of scoring parameters according to the actual environment, significantly improving the accuracy and processing efficiency of anomalous scoring, and is suitable for high-precision detection scenarios in complex wireless environments.

[0107] Further, please refer to Figure 6 , Figure 6 This is a schematic diagram of the risk transmission correlation diagram based on equipment accompaniment relationships and anomaly risk scoring, as described in this application. A visualization analysis implementation method for environmental relationship graphs constructs an equipment association topology network based on equipment temporal characteristics and cross-frequency band coupling characteristics. The graph distinguishes equipment types through different node styles: solid black dots represent trusted equipment, hollow circles represent conventional equipment, and asterisk-marked circles represent risky equipment. Different line types characterize the association strength between nodes: thick solid lines represent strong accompaniment / strong coupling relationships, thin solid lines represent weak accompaniment / weak coupling relationships, and arrowed lines indicate the risk transmission direction. The system quantifies the association strength based on the spatiotemporal co-occurrence patterns of equipment and signal linkage characteristics, automatically classifies association levels, and marks risk transmission paths. The low-risk candidates (risk value = 0.32) marked in the graph are currently the only low-risk candidate equipment. The system can deduce the potential risks of associated equipment along the risk transmission direction, uncover hidden anomaly linkage behaviors, and provide a basis for correlation analysis for anomaly scoring calibration and environmental mapping.

[0108] Fifth embodiment This embodiment provides an exemplary scheme for risk transmission perception-based device association topology mapping. In this example, risk ratings are first divided by matching corresponding abnormal intervals based on the abnormal scores of abnormal devices. Then, an initial topology structure containing node and edge weights is constructed based on device time-series characteristics and cross-frequency band coupling characteristics. Finally, the risk ratings are mapped to topology nodes and the risk transmission coefficients of associated edges are calculated to obtain device association data with risk transmission labels. Step C14 includes steps D11~D13: Step D11: Based on the abnormal score corresponding to the abnormal device, match the corresponding abnormal interval to obtain the risk rating corresponding to the abnormal device.

[0109] Step D12: Construct a device association topology network based on the device timing characteristics and the cross-frequency band coupling characteristics to obtain an initial topology structure including node and edge weights.

[0110] Step D13: Map the risk rating corresponding to the abnormal device to the topology node corresponding to the initial topology, and calculate the risk transmission coefficient of the associated edges in the initial topology to obtain device association data including risk transmission markers.

[0111] Device association topology is a graph-structured network used to characterize the wireless association relationships between devices, consisting of device nodes and association edges. A node is the basic unit representing a single wireless device in the topology, storing basic information and characteristic data of the device. Edge weights are numerical indicators used to quantify the association strength between two devices; higher weights indicate a stronger association. Examples include temporal co-occurrence strength, cross-frequency band coupling, synchronous broadcast frequency, and duration of continuous association. The initial topology is the basic structure of the device association network without risk rating mapping, containing weight information for all device nodes and association edges. The risk propagation coefficient is a numerical indicator used to quantify the probability and strength of risk propagation from one device node to adjacent nodes through association edges; it is a core parameter for identifying hidden high-risk devices. Risk propagation markers are identification information used to mark high-risk propagation paths and high-risk associated nodes in the topology network.

[0112] In this example, when classifying risk ratings based on anomaly scores and matching anomaly intervals, a static anomaly interval matching method can be used, comparing the anomaly scores with preset fixed anomaly intervals one by one to determine the corresponding risk rating. Alternatively, a dynamic anomaly interval adaptive matching method can be used, dynamically adjusting the upper and lower limits of each anomaly interval based on the historical environmental baseline and the current overall anomaly level of the target area, and then comparing the anomaly scores with the adjusted dynamic intervals to determine the corresponding risk rating, thereby improving the adaptability of risk ratings to different environments.

[0113] After completing the risk rating and classification, the device association topology network construction process is initiated. The timing characteristics and cross-frequency band coupling characteristics of all devices are extracted, and the timing co-occurrence strength and cross-frequency band coupling degree between each pair of devices are calculated. The devices are used as topology nodes, and the association strength is used as edge weights to construct a complete device association topology network, resulting in an initial topology structure containing nodes and edge weights, thereby intuitively presenting the wireless association relationship between devices.

[0114] After obtaining the initial topology, the risk mapping and transmission calculation process is initiated. The risk rating of each abnormal device is mapped to the corresponding topology node. Then, the risk transmission coefficient of each edge is calculated according to the weight of the associated edge. High-risk transmission paths and affected adjacent nodes with risk transmission coefficients exceeding a preset threshold are marked. After integrating all information, device association data including risk transmission markers is obtained, thereby achieving comprehensive identification of hidden risks.

[0115] For example, there are two ways to generate device association data with risk transmission markers. The first is a serial topology construction and single-point risk transmission calculation. Topology nodes are added one by one according to the device identification order, and the association strength of each pair of devices is calculated sequentially to generate association edges. After the initial topology structure is completed, starting from each high-risk node, the risk transmission coefficient is calculated layer by layer along the association edges, and high-risk transmission paths are marked to finally obtain the device association data. This method adopts a serial construction and layer-by-layer transmission calculation logic, the topology structure is clear and controllable, and the transmission path is accurately tracked. It is suitable for small-area detection scenarios with a small number of devices.

[0116] The second approach involves parallel topology construction and distributed risk propagation computation. First, all devices are divided into multiple subsets. Multiple threads are simultaneously launched to construct the local topology structure of each subset in parallel. Then, cross-subset association edges are used to merge all local topologies into a global initial topology structure. Subsequently, the global topology is divided into multiple independent risk propagation regions, and distributed computing tasks are simultaneously launched to calculate the risk propagation coefficient within each region. The calculation results for all regions are summarized, and high-risk propagation paths are marked globally, ultimately yielding device association data. This method, employing parallel construction and distributed computing logic, can significantly improve the efficiency of topology construction and risk propagation computation in large-scale device networks, making it suitable for detection scenarios in large and complex areas with dense device populations.

[0117] Sixth Embodiment This embodiment provides an exemplary scheme for constructing a spatiotemporally fused global radio frequency (RF) situation dataset. In this example, firstly, device-related data, raw RF data, and regional benchmark data are associated to obtain a basic data set. Then, device topology nodes are mapped to a geospatial grid to generate RF situation grid data. Next, RF characteristic fluctuations and risk evolution patterns from different time periods are aggregated at a time granularity. Finally, metadata is encapsulated to obtain a global RF situation dataset. Step S40 includes steps E11-E14: Step E11: Based on the device association data, associate the original radio frequency data and regional reference data of this test, and integrate them to obtain the basic data set of this test.

[0118] Step E12: Map the device-associated topology nodes in the basic data set to the geospatial grid of the target area, and label the device distribution density, frequency band occupancy rate and comprehensive risk level in each grid to obtain radio frequency situation grid data.

[0119] Step E13: Aggregate the radio frequency situation grid data according to the preset time granularity to generate spatiotemporal situation sequence data by aggregating the radio frequency characteristic fluctuations and risk evolution patterns of different time periods.

[0120] Step E14: Integrate the region identifier, detection period, and data version of the spatiotemporal situation sequence data to encapsulate the global radio frequency situation dataset.

[0121] Raw radio frequency (RF) data consists of unprocessed, raw wireless signal sampling data directly acquired by multi-band RF acquisition units, containing the most complete raw information about the wireless environment. Regional baseline data is a set of standard data stored in the environmental baseline library, characterizing the normal wireless environment state of the target area, used for situational comparison analysis. The basic data set is a complete data set obtained by associating and integrating device-related data, raw RF data, and regional baseline data, containing all data dimensions required to construct the RF situational awareness. A geospatial grid consists of multiple continuous and non-overlapping grid cells obtained by dividing the geographic space of the target area according to preset rules; it is the basic unit for realizing spatial situational awareness visualization. Device distribution density is the number of wireless devices within a unit of geospatial grid, used to characterize the density of devices within the area. Frequency band occupancy rate is the time occupancy ratio of wireless signals in each frequency band within a unit of geospatial grid, used to characterize the usage activity of each frequency band within the area. The comprehensive risk level is the overall risk level of the grid obtained by comprehensively considering the risk levels of all devices within the grid and the risk transmission effect. RF situational grid data is a set of RF situational data with spatial attributes obtained by mapping device information to the geospatial grid. The preset time granularity is a pre-defined time interval used to aggregate time-series data, such as 1 minute, 5 minutes, 10 minutes, or 30 minutes. Radio frequency (RF) characteristic fluctuations refer to the changes in RF characteristic parameters over different time periods, such as field strength fluctuations, broadcast frequency fluctuations, and frequency band occupancy fluctuations. Risk evolution patterns represent the changing trends and transmission patterns of regional risk levels over different time periods. Spatiotemporal situational sequence data is a sequence composed of multiple RF situational grid data arranged in chronological order, containing both spatial and temporal attributes. Area identifiers are coded information used to uniquely identify the target area. The detection period is the time interval from the start time to the end time of this wireless environment detection task. Data versions are identification information used to distinguish between different batches of generated full-domain RF situational datasets. The full-domain RF situational dataset is a structured dataset that integrates full-space, full-time RF information and risk information of the target area, comprehensively characterizing the overall wireless environment status of the target area.

[0122] In this example, when obtaining the basic data set through data association, a full data association approach can be used. This involves reading all device association data, raw RF data, and regional reference data from the current inspection at once, and then matching them using device identifiers and timestamps to integrate them into a complete basic data set. Alternatively, a streaming incremental association approach can be used. During the inspection task execution, incremental updates of device association data are received in real time, and the corresponding raw RF data segments and regional reference data segments are synchronously associated to accumulate the basic data set. This allows for the parallel execution of data association and the inspection task.

[0123] After obtaining the basic dataset, the spatial mapping process is initiated, mapping all device-associated topology nodes in the basic dataset to corresponding geospatial grid cells according to their geographical location information. The number of devices in each grid is counted to calculate the device distribution density, the signal occupancy time of each frequency band in each grid is counted to calculate the frequency band occupancy rate, and the overall risk level is calculated by combining the risk level and risk transmission coefficient of all devices in the grid. This yields radio frequency situation grid data with spatial attributes, thereby realizing the spatial representation of the wireless environment situation.

[0124] After obtaining the radio frequency situation grid data, the time-series aggregation process is initiated. The entire detection cycle is divided into multiple consecutive time segments according to the preset time granularity. The radio frequency situation grid data in each time segment is aggregated, and the radio frequency characteristic fluctuations and risk evolution patterns in different time periods are statistically analyzed. The situation data of all time segments are arranged in chronological order to generate spatiotemporal situation sequence data that simultaneously contains spatial and temporal attributes, thereby fully recording the dynamic changes in the wireless environment.

[0125] After obtaining the spatiotemporal situation sequence data, the data encapsulation process is initiated to extract the area identifier of the target area, the detection cycle of this detection, and the data version information of the dataset. These are added to the spatiotemporal situation sequence data as metadata. Format normalization and data verification are then performed. After structured encapsulation, a full-domain radio frequency situation dataset is obtained, thereby achieving standardized storage and sharing of situation data.

[0126] For example, there are two ways to construct a full-domain radio frequency (RF) situation dataset. The first is a static snapshot-based construction. After all detection tasks are completed, all full data from this detection are integrated at once to generate an RF situation snapshot at the current detection time. Then, situation snapshots for historical time periods are generated back according to a preset time granularity. These snapshots are then stitched together to obtain spatiotemporal situation sequence data. Finally, metadata is encapsulated to obtain the full-domain RF situation dataset. This method uses the logic of processing all data at once, resulting in a complete and unified dataset structure and high data consistency. It is suitable for regular inspections and offline analysis scenarios.

[0127] The second method is time-series streaming incremental construction. During the execution of the detection task, incremental data is received in real time, and radio frequency (RF) situation grid slices for the current moment are generated. These slices are automatically aggregated according to a preset time granularity to generate time-series situation slices, which are then stored in a sequence database in real time. When the detection task is completed, all time-series situation slices are automatically integrated and metadata is added to obtain a full-domain RF situation dataset. This method uses streaming incremental processing logic, enabling real-time generation of situation data without waiting for the detection task to complete, making it suitable for real-time monitoring and emergency response scenarios.

[0128] Seventh Embodiment This embodiment provides an exemplary scheme for closed-loop iterative baseline correction and visualization of environmental mapping archives. In this example, firstly, stable radio frequency characteristic distributions, periodic environmental fluctuation patterns, and abnormal evolution patterns not covered by the baseline are extracted from the global radio frequency situation dataset to generate a system deviation analysis report. Then, environmental baseline parameters are corrected by region and time period based on the report. Next, the multi-band feature splitting strategy is optimized by combining the proportion of effective information in the frequency bands and interference distribution. Finally, all data is integrated to generate a visualization of the environmental mapping archives. Step S50 includes steps F11~F14: Step F11: Extract the stable radio frequency feature distribution, periodic environmental fluctuation patterns, and abnormal evolution patterns not covered by the baseline in the target area to obtain a system deviation analysis report.

[0129] Step F12: Based on the system deviation analysis report, adjust the threshold values ​​of the multi-dimensional anomaly measurement indicators for each frequency band in the environmental baseline library by region and time period, and update the trusted device fingerprint subset and anomaly judgment boundary to obtain the corrected environmental baseline parameter set.

[0130] Step F13: Based on the corrected set of environmental baseline parameters, the proportion of effective information in each frequency band, and the distribution of interference intensity, adjust the sampling weight, filtering rules, and feature extraction priority in the multi-band feature splitting strategy to obtain the optimized multi-band feature splitting strategy.

[0131] Step F14: Integrate the global radio frequency situation dataset, the corrected environmental baseline parameter set, and the optimized multi-band feature splitting strategy to generate the visualized environmental mapping archive.

[0132] Stable radio frequency (RF) characteristic distribution refers to the statistical distribution characteristics of wireless signals that remain stable over a long period within the target area, reflecting the basic state of the normal wireless environment in the area. Examples include the average field strength distribution across frequency bands, the distribution of the number of conventional devices, the usage distribution of commonly used frequency bands, and the distribution of the permanent locations of trusted devices. Periodic environmental fluctuation patterns refer to the regular changes in wireless environmental characteristics within the target area over time, caused by the periodic behavior of personnel activities and equipment usage within the area. Examples include fluctuations in frequency band occupancy between weekdays and weekends, fluctuations in the number of devices during the day and night, fluctuations in signal strength during commuting hours, and fluctuations in broadcast frequencies at fixed times. Abnormal evolution patterns not covered by the baseline refer to newly emerging abnormal trends in the wireless environment that are not recorded in the environmental baseline database, reflecting the lag and limitations of the existing baseline. Examples include the broadcast characteristics of new types of devices, the occurrence patterns of new interference signals, cluster activity patterns of abnormal devices, and new abnormal behaviors involving cross-frequency band linkage. The system deviation analysis report is a structured report generated after comprehensively analyzing all deviations between the current wireless environment and the environmental baseline, and it serves as the core decision-making basis for baseline correction and strategy optimization.

[0133] Multidimensional anomaly measurement thresholds are pre-defined critical values ​​in the environmental baseline library used to determine whether features in each dimension are abnormal; they are core parameters for identifying anomalous devices. Examples include field strength offset threshold, broadcast duration threshold, frequency band occupancy threshold, association strength threshold, and occurrence frequency threshold. The trusted device fingerprint subset is a set of wireless features from all authorized trusted devices within the target area, used to distinguish between normally authorized devices and unknown anomalous devices. The anomaly determination boundary is a comprehensive boundary condition formed by integrating all multidimensional anomaly measurements, used to determine whether a device is anomalous. The environmental baseline parameter set is a corrected, structured set containing all relevant environmental baseline parameters, used for anomaly determination in all subsequent detection tasks.

[0134] The effective information percentage for each frequency band refers to the proportion of effective device feature information contained in the wireless signals of each frequency band, reflecting the information value and detection contribution of each frequency band. Examples include the effective information percentage of the Wireless Fidelity band, the effective information percentage of the Bluetooth Low Energy band, the effective information percentage of the sub-gigahertz band, and the effective information percentage of the long-range radio band. Interference intensity distribution refers to the intensity and spatial distribution of wireless interference signals in each frequency band within the target area, reflecting the signal quality and interference level of each frequency band. Sampling weight is the proportion of acquisition resources allocated to each frequency band in the multi-band feature routing strategy; a higher weight indicates more acquisition time and computing power resources allocated to that frequency band. Filtering rules are the set of rules used in the multi-band feature routing strategy to filter interference signals and invalid signals in each frequency band. Feature extraction priority is the order of feature extraction and computing power allocation priority for each frequency band in the multi-band feature routing strategy. The optimized multi-band feature routing strategy is a dynamically adjusted set of feature routing strategies better adapted to the current wireless environment.

[0135] A visualized environmental mapping archive is a structured archive that presents global radio frequency situational data, baseline parameters, and routing strategies in a visual manner. It can intuitively display the wireless environment status, changing trends, and risk distribution of the target area. Examples include device distribution heatmaps, frequency band occupancy distribution maps, risk level heatmaps, time-series change curves, abnormal device trajectory maps, and risk propagation path maps.

[0136] In this example, when extracting features and patterns to obtain the system deviation analysis report, the offline analysis of full data can be used as a reference. This involves reading the complete global RF situation dataset generated from the current detection in one go, performing global statistical analysis and pattern mining, extracting stable RF feature distributions, periodic environmental fluctuation patterns, and abnormal evolution patterns not covered by the baseline, and generating a complete system deviation analysis report. Alternatively, incremental online data analysis can be used, reading newly generated RF situation data fragments in real time, continuously updating stable feature distributions and periodic fluctuation patterns, discovering new abnormal evolution patterns in real time, and accumulating to generate dynamically updated system deviation analysis reports. This allows for the parallel execution of deviation analysis and detection tasks.

[0137] After receiving the system deviation analysis report, the environmental baseline correction process is initiated. Based on the deviation information in the report, the threshold values ​​of multi-dimensional anomaly measurement indicators for each frequency band in the environmental baseline library are adjusted according to different geographical regions and time periods. New devices that have been stable for a long time and have no abnormal behavior are added to the trusted device fingerprint subset. At the same time, the anomaly judgment boundary is updated according to the newly discovered anomaly evolution patterns. All corrected parameters are integrated to obtain the corrected environmental baseline parameter set, thereby improving the adaptability of the environmental baseline to the current wireless environment.

[0138] After obtaining the corrected set of environmental baseline parameters, the multi-band feature splitting strategy optimization process is initiated. The effective information ratio and interference intensity distribution of each frequency band in the current environment are statistically analyzed. Based on the corrected baseline parameters, the sampling weight of each frequency band is dynamically adjusted, increasing the sampling weight of high information value and low interference frequency bands and decreasing the sampling weight of low information value and high interference frequency bands. At the same time, the interference filtering rules and feature extraction priorities of each frequency band are updated to obtain the optimized multi-band feature splitting strategy, thereby improving the efficiency and accuracy of feature extraction.

[0139] After obtaining the optimized multi-band feature routing strategy, the visualization environment mapping archive generation process is initiated. The process integrates the global radio frequency situation dataset, the corrected environmental baseline parameter set, and the optimized multi-band feature routing strategy to generate multi-dimensional visualization content including geospatial distribution, temporal change curves, and risk transmission paths. Archive metadata, detection descriptions, and version information are added, and after structured encapsulation, a visualization environment mapping archive is generated, thereby realizing an intuitive display and standardized archiving of the wireless environment status.

[0140] For example, there are two ways to complete closed-loop correction and generate a visualized environmental mapping archive. The first is periodic batch correction and full archive generation. According to a preset correction cycle, the global radio frequency situation dataset generated by all detection tasks within that cycle is collected periodically. Global deviation analysis, baseline parameter correction, and routing strategy optimization are performed in batches to generate a full visualized environmental mapping archive for that cycle. The corrected baseline parameters and routing strategies are stored in the system and uniformly applied to all subsequent detection tasks. This method adopts batch processing logic, which can perform comprehensive and systematic optimization based on a large amount of historical data. The correction results are stable and reliable, and it is suitable for detection scenarios in conventional areas where environmental changes are relatively slow.

[0141] The second method involves real-time incremental correction and dynamic archive updates. After each detection task is completed and a full-domain radio frequency situation dataset is generated, incremental deviation analysis is immediately performed. The baseline parameters for the corresponding region and time period in the environmental baseline library are corrected in real time. Simultaneously, the feature routing strategy for relevant frequency bands is dynamically adjusted. The situation data and correction information from this detection are updated in real-time to the visualized environmental mapping archive, and the corrected parameters are immediately applied to the next detection task. This method employs real-time incremental processing logic, enabling rapid adaptation to dynamic environmental changes and timely updates to baselines and strategies. This effectively improves the accuracy and response speed of subsequent detections, making it suitable for detection scenarios in complex areas with frequent environmental changes and key protection areas.

[0142] Furthermore, a passive wireless environment detection method based on trusted device anomaly proximity detection involves the following steps: First, the system performs a trusted device registration operation. Based on the registered authorized device's multi-dimensional wireless characteristics, a trusted device baseline is established, and a trusted device fingerprint database is generated. Then, the system enters a continuous passive detection environment state, collecting multi-band wireless broadcast signals within the target area in a fully passive, non-transmitting manner. Next, it analyzes and identifies unknown devices abnormally approaching the trusted device. By comparing the trusted device environment baseline with the real-time collected device timing characteristics and cross-band coupling characteristics, abnormal wireless interaction behavior is detected. Then, the behavior type and risk level of the abnormal device are determined, and the device relationship graph is updated synchronously, marking abnormal correlations and risk propagation paths. Finally, based on the updated relationship graph and full-domain radio frequency situational data, environmental mapping is performed, generating a visualized environmental mapping archive containing device distribution, risk levels, and correlations. Simultaneously, the trusted device environment baseline is dynamically updated based on the detection results, and the anomaly judgment boundaries and feature extraction rules are corrected. Finally, the system returns to the continued listening state, continuously collecting new wireless environment data and repeating the above process, forming a complete dynamic closed-loop detection mechanism that includes trusted device entry, baseline establishment, passive listening, abnormal proximity analysis, device type judgment, relationship graph update, environmental mapping, baseline iteration, and continuous listening.

[0143] Eighth embodiment This embodiment provides an exemplary scheme for constructing a trusted device environment baseline library. In this example, the historically collected wireless feature data of trusted devices in the target area is first cleaned and deduplicated to obtain a trusted device historical feature dataset. Then, multi-dimensional attributes are correlated with time series data to generate a device environment fingerprint set. Next, statistical analysis is performed on the fingerprint set to construct a trusted device environment baseline model that includes resident environments, high-frequency accompanying devices, and cross-frequency band correlations. Finally, the environmental baseline library is obtained by classifying and integrating data according to region identifiers and establishing mapping relationships. Before step S20, steps G11~G14 are also included: Step G11: Based on the historically collected wireless feature data of trusted devices within the target area, abnormal sampling points and duplicate records are removed to obtain a historical feature dataset of trusted devices.

[0144] Step G12: Associate the multidimensional attributes in the trusted device historical feature dataset with the corresponding time series records to generate a device environment fingerprint set.

[0145] Step G13: Perform wireless feature statistical analysis on trusted devices in the device environment fingerprint set to construct a trusted device environment baseline model that includes resident environment, high-frequency accompanying devices, and cross-frequency band correlation.

[0146] Step G14: Classify and integrate the trusted device environment baseline models according to the region identifier, construct the mapping relationship between the regions and the baseline models, and integrate them to obtain the environment baseline library.

[0147] Trusted device wireless characteristic data comprises all wireless signal characteristic data of authorized trusted devices collected historically by the system, serving as the original foundational data for constructing the environmental baseline. Examples include device identifier, signal strength, broadcast period, frequency band type, occurrence time, duration, and associated device information. Abnormal sampling points refer to invalid data points that significantly deviate from the normal range due to signal interference, device malfunction, or acquisition errors. Examples include signal strength values ​​exceeding physical limits, sampling data with abnormal timestamps, and empty data without a corresponding device identifier. Duplicate records refer to multiple identical sampling records generated by the same device at the same time point. The trusted device historical characteristic dataset is a high-quality collection of trusted device wireless characteristic data obtained after cleaning and deduplication, forming the basis for generating device environmental fingerprints.

[0148] A device environment fingerprint is a multi-dimensional set of features that uniquely characterizes the wireless behavior of a single trusted device, serving as the core basis for distinguishing different devices. Examples include device identification, signal strength variation trends, broadcast cycle characteristics, frequency band usage characteristics, occurrence time patterns, duration characteristics, and associated device characteristics. Time-series association records are a recording method that binds each feature value of a device to its corresponding acquisition time, used to characterize the changing patterns of device features over time. The device environment fingerprint set is a collection of environment fingerprints from all trusted devices, serving as the core input for constructing an environmental baseline model.

[0149] The Trusted Device Environment Baseline Model is a mathematical model based on long-term statistical analysis of the wireless characteristics of trusted devices. It characterizes the normal wireless behavior patterns of trusted devices and is the core criterion for distinguishing between normal and abnormal devices. The resident environment refers to the geographical area and spatial location where the trusted device appears stably over a long period. High-frequency accompanying devices refer to other trusted devices that frequently appear simultaneously with the trusted device. Cross-frequency band correlation refers to the synchronization correlation patterns between the wireless signals of the same trusted device in different frequency bands.

[0150] The mapping relationship between regions and baseline models refers to the association between each region identifier and all corresponding trusted device environment baseline models. The environment baseline library is a structured database that stores trusted device environment baseline models for all regions, serving as a core reference for subsequent anomaly device detection.

[0151] In this example, when cleaning trusted device wireless feature data to obtain a trusted device historical feature dataset, a global batch cleaning approach can be used. This involves reading all historically collected trusted device wireless feature data at once, batch-removing abnormal sampling points and duplicate records, and obtaining a complete trusted device historical feature dataset. Alternatively, a streaming incremental cleaning approach can be used. During data acquisition, newly collected trusted device wireless feature data is cleaned in real-time, removing abnormal sampling points and duplicate records, and the cleaned data is stored in the historical feature dataset in real-time, thus achieving parallel execution of data cleaning and data acquisition.

[0152] After obtaining the historical feature dataset of trusted devices, the device environment fingerprint generation process is initiated. Multi-dimensional attributes such as device identifier, signal strength, broadcast period, and frequency band type of each trusted device are extracted. Each attribute value is associated with the corresponding time series and recorded to generate a unique device environment fingerprint for each trusted device. The environment fingerprints of all trusted devices are aggregated to obtain the device environment fingerprint set, thereby transforming the original discrete sampling data into structured fingerprint data that can characterize the device behavior pattern.

[0153] After obtaining the set of device environment fingerprints, the process of building a trusted device environment baseline model is initiated. Long-term statistical analysis is performed on the environment fingerprint of each trusted device to extract core features such as the device's resident environment, high-frequency accompanying devices, stable signal strength change trends, periodic broadcast characteristics, and cross-frequency band correlations. The environmental baseline model corresponding to each trusted device is then constructed to establish the normal behavior standard of trusted devices.

[0154] After obtaining the environmental baseline models of all trusted devices, the environmental baseline library construction process is initiated. The models are classified and integrated according to the regional identifiers corresponding to each baseline model. A mapping relationship is established between the regional identifiers and the environmental baseline models of all trusted devices in that region. All baseline models and mapping relationships are stored in a structured database to complete the construction of the environmental baseline library, thereby enabling rapid retrieval and retrieval of baseline data from different regions.

[0155] For example, there are two ways to build an environmental baseline library. The first is to build it offline in batches. After the system is deployed, wireless feature data of all trusted devices in the target area are collected in a centralized manner. After the collection is completed, the entire process of data cleaning, fingerprint generation, model building and library integration is performed at once to generate a complete environmental baseline library. The baseline library built in this way has comprehensive and complete data and the baseline model is stable and reliable. It is suitable for deployment scenarios in mature areas where the number of devices is fixed and the environment changes slowly.

[0156] The second method is incremental online construction. During system operation, wireless characteristic data of newly connected trusted devices are collected in real time, and data cleaning and fingerprint generation are performed in real time. When enough historical data is collected, the environmental baseline model of the device is automatically built and added to the environmental baseline library of the corresponding area. At the same time, the mapping relationship between the area and the baseline model is dynamically updated. This method does not require centralized data collection in advance, and can support the dynamic access of trusted devices and the real-time update of the baseline. It is suitable for dynamic area deployment scenarios where devices change frequently and the environment changes rapidly.

[0157] Furthermore, the passive wireless environment detection system can be further integrated with Software-Defined Radio (SDR) capabilities to expand its wideband wireless environment perception capabilities. These SDR capabilities can be implemented through three methods: external SDR acquisition equipment, a self-developed SDR hardware module, or a SDR acquisition platform that works in conjunction with local client software. After acquiring full-spectrum data across a wider frequency range through the SDR module, the system fuses this data with conventional frequency band data acquired by the aforementioned multi-band RF acquisition unit. Combining environmental fingerprint models, device relationship models, and dynamic anomaly scoring mechanisms, the system performs unified correlation analysis and anomaly determination of device characteristics across all frequency bands in the wireless environment. Simultaneously, the system can construct a high-precision wireless environment mapping model using self-developed SDR software. This allows for multi-dimensional visualization analysis of device spatial distribution, full-band occupancy, real-time broadcast density, long-period time series changes, and complex device relationship networks within different geographical areas, further enhancing the system's comprehensive perception and in-depth analysis capabilities of complex wireless environments.

[0158] This application provides a passive wireless environment detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the passive wireless environment detection control method in Embodiment 1 above.

[0159] The following is for reference. Figure 7This document illustrates a hardware architecture suitable for implementing the passive wireless environmental monitoring device of this application embodiment. The multi-band wireless environmental monitoring hardware architecture is centered on the ESP32-S3 main control module, which integrates WiFi / BLE functionality and can independently complete the entire process of local calculation, data caching, anomaly scoring, and baseline update. The RF acquisition side connects three RF units via a Serial Peripheral Interface (SPI): the first module, CC1101#1, is responsible for passive monitoring in the 433 MHz band; the second module, SX1278, is responsible for monitoring LoRa signals; and the third module, CC1101#2, is responsible for frequency sweeping and backup acquisition in the 868 / 915 MHz band. The display and interaction side connects to a 1.3-inch OLED display screen via an internal integrated circuit bus (I2C) for real-time display of environmental status and risk warnings. The storage side features a TransFlash (TF, or Micro Secure Digital) card / local storage module for persistent storage of operation logs, environmental baselines, and device databases. The entire hardware is housed on a 400-hole breadboard / prototype carrier board, unifying the layout and installation of the main controller, RF modules, display unit, and power distribution. Power is supplied by an independent power module, supporting either a three-AA battery box or an external power adapter. After voltage regulation, the power supply provides a stable power to the ESP32-S3 main controller and all RF modules.

[0160] The passive wireless environment detection device provided in this application employs the passive wireless environment detection control method described in the above embodiments, which can solve the technical problem of poor quality of environmental detection data. Compared with the prior art, the beneficial effects of the passive wireless environment detection device provided in this application are the same as those of the passive wireless environment detection control method provided in the above embodiments, and other technical features of this passive wireless environment detection device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0161] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0162] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0163] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the passive wireless environment detection control method in the above embodiments.

[0164] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, radio frequency (RF), etc., or any suitable combination thereof.

[0165] The aforementioned computer-readable storage medium may be included in the passive wireless environment detection device; or it may exist independently and not assembled into the passive wireless environment detection device.

[0166] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the passive wireless environment detection device, the passive wireless environment detection device: responds to an environment detection command, extracts key information of the multi-band wireless signals corresponding to the target area according to a multi-band feature-splitting strategy, and organizes it to obtain radio frequency feature data; matches the corresponding benchmark data in the environmental baseline library based on the area identifier of the target area, compares the radio frequency feature data with the benchmark data, and obtains abnormal device data; calculates anomaly scores based on the abnormal device data, combining cross-band coupling features and device timing features, and rates the anomaly scores to obtain device association data including risk ratings; constructs a global radio frequency situation dataset for the target area based on the device association data; corrects the baseline parameters and the feature-splitting strategy based on the global radio frequency situation dataset, and generates a visualized environmental mapping archive.

[0167] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation that may be implemented in systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0169] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0170] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described passive wireless environment detection control method, thereby solving the technical problem of poor quality of environmental detection data. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the passive wireless environment detection control method provided in the above embodiments, and will not be repeated here.

[0171] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A control method for passive wireless environment detection, characterized in that, The method includes: In response to environmental detection commands, key information of multi-band wireless signals in the target area is extracted according to the multi-band feature routing strategy, and radio frequency feature data is obtained. Based on the regional identifier of the target area, the corresponding benchmark data in the environmental baseline library is matched, and the radio frequency feature data is compared with the benchmark data to obtain abnormal device data. Based on the abnormal equipment data, an abnormal score is calculated by weighting cross-frequency band coupling characteristics and equipment timing characteristics, and the abnormal score is rated to obtain equipment association data including risk rating. A global radio frequency situation dataset for the target area is constructed based on the device association data. Based on the global radio frequency situation dataset, the baseline parameters and the feature splitting strategy are corrected, and a visual environmental mapping archive is generated.

2. The control method for passive wireless environment detection as described in claim 1, characterized in that, The steps of responding to the environmental detection command and extracting key information of the multi-band wireless signals corresponding to the target area according to the multi-band feature splitting strategy, and organizing them to obtain radio frequency feature data, include: Upon responding to the environmental detection command, a passive wireless detection mode is configured for the multi-band radio frequency acquisition unit, and the timing reference of the multi-band radio frequency acquisition unit is synchronized to obtain the synchronization ready signal of the multi-band radio frequency acquisition unit. Based on the synchronization ready signal, the wireless broadcast signal in the target area is acquired through the multi-band radio frequency acquisition unit to obtain a radio frequency sampling dataset with a unified timestamp. Differentiated filtering rules are matched according to the inherent interference characteristics of each frequency band, and interference redundant data in the radio frequency sampling dataset is removed by the differentiated filtering rules to obtain the multi-band wireless signal; Based on the multi-band feature splitting strategy, the key information corresponding to each frequency band in the multi-band wireless signal is extracted and organized to obtain the radio frequency feature data.

3. The control method for passive wireless environment detection as described in claim 1, characterized in that, The step of comparing the radio frequency feature data with the benchmark data in the environmental baseline library based on the area identifier of the target area to obtain the abnormal device data includes: Based on the regional identifier of the target area and the radio frequency feature data, the corresponding benchmark data in the environmental baseline library and the trusted device fingerprint subset associated with the target area are determined to obtain the regional device association dataset associated with the benchmark data and the trusted device fingerprint subset. Based on the regional device association dataset and device dimensions, the radio frequency feature data is decomposed to obtain device dimension feature data; The device dimensional feature data is compared dimension by dimension with the baseline features of devices in the target area to obtain the multi-dimensional feature bias of devices in the target area. The multi-dimensional feature bias is compared with the device feature threshold to filter out the abnormal device data.

4. The control method for passive wireless environment detection as described in claim 1, characterized in that, The step of calculating anomaly scores based on the abnormal device data, combined with cross-frequency band coupling characteristics and device timing characteristics, and obtaining device-related data including risk ratings based on the anomaly scores includes: Based on the temporal coupling deconstruction strategy, the device temporal features and cross-frequency band coupling features corresponding to each abnormal device in the abnormal device data are extracted and analyzed. Based on the device timing characteristics and the cross-frequency band coupling characteristics, and combined with the measurement weights of the anomaly measurement index, an initial score is obtained by weighted calculation. The initial score is corrected and calibrated based on the correlation strength between the anomaly metrics to obtain the anomaly score; Based on the abnormal range and the abnormal score corresponding to the abnormal device, the risk rating corresponding to the abnormal device is divided, and the risk rating is mapped to the topological relationship between devices to obtain the device association data.

5. The control method for passive wireless environment detection as described in claim 4, characterized in that, The step of classifying the risk rating of the abnormal device according to the abnormal interval and the abnormal score, and mapping the risk rating to the topological relationship between devices to obtain the device association data includes: Based on the abnormal score corresponding to the abnormal device, the corresponding abnormal interval is matched to obtain the risk rating corresponding to the abnormal device. Based on the device timing characteristics and the cross-frequency band coupling characteristics, a device association topology network is constructed to obtain an initial topology structure including node and edge weights; The risk rating corresponding to the abnormal device is mapped to the topology node corresponding to the initial topology, and the risk transmission coefficient of the associated edge in the initial topology is calculated to obtain device association data including risk transmission markers.

6. The control method for passive wireless environment detection as described in claim 1, characterized in that, The step of constructing the global radio frequency situation dataset of the target area based on the device association data includes: Based on the device-related data, the original radio frequency data and regional reference data of this test are linked together to obtain the basic data set of this test; The device-associated topology nodes in the basic dataset are mapped to the geospatial grid of the target area, and the device distribution density, frequency band occupancy rate and comprehensive risk level in each grid are labeled to obtain radio frequency situation grid data; The radio frequency situation grid data is aggregated according to a preset time granularity to generate spatiotemporal situation sequence data by aggregating the radio frequency characteristic fluctuations and risk evolution patterns of different time periods. The spatiotemporal situational sequence data is integrated with its region identifier, detection period, and data version to obtain the global radio frequency situational dataset.

7. The control method for passive wireless environment detection as described in claim 1, characterized in that, The step of correcting the baseline parameters and the feature-splitting strategy based on the global radio frequency situation dataset and generating a visualized environmental mapping archive includes: Extract the stable radio frequency feature distribution, periodic environmental fluctuation patterns, and abnormal evolution patterns not covered by the baseline in the target area to obtain a system deviation analysis report; Based on the system deviation analysis report, the threshold values ​​of the multi-dimensional anomaly measurement indicators for each frequency band in the environmental baseline library are adjusted by region and time period, and the trusted device fingerprint subset and anomaly judgment boundary are updated to obtain the corrected environmental baseline parameter set. Based on the modified set of environmental baseline parameters, the proportion of effective information in each frequency band, and the distribution of interference intensity, the sampling weight, filtering rules, and feature extraction priority in the multi-band feature splitting strategy are adjusted to obtain the optimized multi-band feature splitting strategy. The visualized environmental mapping archive is generated by integrating the global radio frequency situation dataset, the corrected environmental baseline parameter set, and the optimized multi-band feature splitting strategy.

8. The control method for passive wireless environment detection as described in claim 1, characterized in that, Before the step of comparing the radio frequency feature data with the reference data in the environmental baseline library based on the area identifier of the target area to obtain the abnormal device data, the passive wireless environment detection control method further includes: Based on the historically collected wireless feature data of trusted devices within the target area, abnormal sampling points and duplicate records are removed to obtain a historical feature dataset of trusted devices. The multidimensional attributes in the trusted device historical feature dataset are associated with the corresponding time series records to generate a device environment fingerprint set; Wireless feature statistical analysis is performed on trusted devices in the device environment fingerprint set to construct a trusted device environment baseline model that includes resident environment, high-frequency accompanying devices, and cross-frequency band correlation. The trusted device environment baseline models are classified and integrated according to the regional identifiers, and a mapping relationship between the regions and the baseline models is constructed to obtain the environment baseline library.

9. A passive wireless environmental monitoring device, characterized in that, The passive wireless environment detection device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the control method for passive wireless environment detection as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the control method for passive wireless environment detection as described in any one of claims 1 to 8.

Images