A wireless signal monitoring method based on signal behavior feature map

Abstract

The application discloses a wireless signal monitoring method based on signal behavior characteristic spectrum, and relates to the technical field of radio signal monitoring, and comprises the following steps: full-band intelligent scanning and data acquisition, improving scanning density for key frequency bands; a three-level adaptive reference system containing static reference, time-period dynamic reference and real-time sliding reference is constructed, and out-of-limit points are identified and aggregated as abnormal signals; signal appearance probability of each frequency-amplitude level is statistically calculated in real time through a two-dimensional cumulative matrix on the FPGA hardware end, and a cumulative attenuation mechanism is adopted to generate a signal behavior characteristic spectrum, a light-weight CNN model is run by using an NPU to realize real-time identification; joint decision rules are executed based on the energy detection and AI identification results to generate abnormal events and report them; a special analysis mode is switched to for in-depth analysis of key frequency bands; and multi-device signal fusion and global threat decision are realized. The application greatly reduces the false alarm rate, significantly improves the capture ability of transient signals, and realizes front-end intelligent processing.

Description

Technical Field

[0001] This invention relates to the field of radio signal monitoring technology, and more specifically to a radio signal monitoring method based on signal behavior feature maps. Background Technology

[0002] Wireless communication technology is widely used (such as in office areas, meeting places, data centers, etc.). Existing technologies for wireless signal monitoring mainly involve: technicians using handheld traditional spectrum analyzers to scan the target area and observe the spectrum waveform to determine if there are abnormal signals; deploying fixed monitoring equipment with preset signal strength thresholds, triggering alarms when the received signal exceeds the threshold; and pre-collecting the spectrum characteristics of legitimate signals to establish a whitelist, comparing the signals with the fingerprint database in real time, and considering non-matching signals as abnormal.

[0003] The above technologies can effectively monitor signals in simple electromagnetic environments, but they still have significant drawbacks in complex electromagnetic environments, such as: The actual electromagnetic environment is complex and variable. Consumer devices such as Wi-Fi, Bluetooth, and microwave ovens generate a large amount of background signals with frequent fluctuations in signal strength. Fixed thresholds or simple fingerprint database methods cannot adapt to the dynamic changes in the environment, resulting in a large number of legitimate signal fluctuations being misjudged as abnormal, leading to an extremely high false alarm rate and severely impacting the practical value of the system.

[0004] In practical wireless signal detection, anomalous signals often exhibit characteristics of "low power, short bursts, and strong concealment," potentially being transmitted within milliseconds. Traditional spectrum scanning methods, employing a segment-by-segment scanning architecture, suffer from blind spots, making it difficult to effectively capture such transient signals.

[0005] Existing monitoring methods mainly rely on the frequency domain amplitude characteristics of signals (center frequency, bandwidth, field strength), lacking in-depth analysis of the signal's time domain behavior patterns (burst, periodicity, duty cycle) and statistical characteristics (probability of occurrence, stability), making it difficult to distinguish normal communication signals from signals with abnormal behavior characteristics.

[0006] Traditional solutions typically send raw data back to a central server for processing, which puts a heavy strain on network bandwidth and causes system failure when the network is interrupted. They also lack the capability to perform real-time processing, intelligent identification, and preliminary judgment at the data acquisition front-end.

[0007] The published document (CN115641447A) discloses an electromagnetic signal sorting and identification method that integrates multi-dimensional and multi-scale features. It proposes a method for signal sorting and identification by integrating multi-dimensional features of constellation diagrams and time-frequency diagrams. However, this method focuses on the classification and identification of known signal types and cannot solve the problem of discovering and detecting unknown abnormal signals in complex electromagnetic environments.

[0008] In summary, existing technologies have the following drawbacks in complex electromagnetic environments: high false alarm rate and poor environmental adaptability; insufficient ability to capture transient and low duty cycle signals; limited signal recognition dimensions, relying solely on frequency domain amplitude characteristics; weak front-end processing capabilities, reliance on back-end feedback, and system failure when the network is interrupted. Summary of the Invention

[0009] This invention proposes a wireless signal monitoring method, the purpose of which is to detect unknown abnormal signals in complex electromagnetic environments, and to collect data while scanning to prevent signals from being missed. The second objective is to generate feature maps by statistically analyzing the occurrence probability of "frequency-amplitude level" in real time using a two-dimensional cumulative matrix on the FPGA hardware, thereby separating the hidden signal from noise and legitimate signals. The third objective is to complete real-time processing at the data acquisition front end and make local intelligent decisions.

[0010] This invention is achieved through the following technical solution: A wireless signal monitoring method based on signal behavior feature maps, comprising: The system performs cyclic scanning across the entire 20MHz-8GHz frequency band, automatically increasing the scanning density and processing priority for preset key frequency bands to obtain real-time spectrum. Construct and maintain a three-level adaptive benchmark system that includes static benchmarks, time-segmented dynamic benchmarks, and real-time sliding benchmarks. Compare the real-time spectrum with the currently enabled benchmarks to identify out-of-limit points and aggregate them into abnormal signals. On the FPGA hardware side, the probability of abnormal signals is statistically analyzed in real time using a two-dimensional cumulative matrix to generate a signal behavior feature map. A lightweight convolutional neural network model running on the NPU is used to identify the feature map in real time, and the signal type classification and behavior feature detection results are output synchronously. The identified abnormal signals, along with the output signal type classification and behavioral feature detection results, are used to execute a preset decision, generate abnormal events, and report them. Multi-source signal fusion is performed on abnormal events reported from multiple terminals, macroscopic behavior analysis is conducted on the fused signals, and a global alarm is generated by combining a multi-dimensional evaluation model.

[0011] In the above technical solution of the present invention, the automatic improvement of scanning density and processing priority includes: When scanning enters the preset key focus frequency band, the FPGA automatically shortens the generation period of the signal behavior feature map from the normal mode to the preset short period, while increasing the FFT operation frame rate in that frequency band to effectively capture transient signals with a duration of less than the short period.

[0012] In the above technical solution, within the three-level adaptive benchmark system: The static benchmark is learned manually by the user, continuously collecting the full-frequency background spectrum within a time period to generate the maximum preserved spectrum, which can be fine-tuned by the user. The time-segmented dynamic benchmark is automatically learned and generated by the system. It divides a time period into multiple time period categories, continuously accumulates historical spectrum data under each time period category, calculates fixed quantile values ​​for the frequency point level value sequence as dynamic benchmark values, and updates them periodically using a sliding window mechanism. The real-time sliding reference is based on the spectral data within a short time window, and its fixed quantile value is calculated for each frequency point to form a reference line that reflects the current instantaneous background.

[0013] In the above technical solution of the present invention, the three-level adaptive benchmark system is configured with three operating modes: In the fast start mode, only the static reference is used as the detection threshold. The real-time spectrum is compared with the static reference, and frequency points that exceed the sum of the static reference value and the allowable fluctuation margin are marked as over-limit points. In the conventional monitoring mode, the main detection threshold is a time-segmented dynamic benchmark, supplemented by a real-time sliding benchmark. The monitoring mode checks whether the difference between the real-time sliding benchmark and the dynamic benchmark continuously exceeds a preset threshold, which is used to trigger the environmental change judgment process. The hybrid mode takes the maximum value of each frequency point as the final detection threshold for static reference, time-segmented dynamic reference and real-time sliding reference, and is used to determine abnormal signals under any reference.

[0014] In the above technical solution of the present invention, the environmental determination process is applicable to dynamic benchmarks marked as healthy and usable, and the determination of the healthy and usable state includes: Simultaneously evaluate the data completeness and stability of the dynamic benchmark, and mark it as usable only when both data completeness and stability are satisfied; The data completeness requirement requires an accumulated time that reaches a preset threshold; The stability is determined by comparing whether the difference between the current dynamic reference and the historical dynamic reference of the same period in most frequency bands exceeds a preset threshold.

[0015] In the above technical solution of the present invention, the determination of the abnormal signal includes: Scan the entire frequency band and classify the out-of-limit points with adjacent frequency intervals less than the preset frequency domain tolerance into the same out-of-limit frequency band; Filter out frequency bands with bandwidth less than the preset minimum bandwidth threshold; For each valid over-limit frequency band, calculate its center frequency, bandwidth, peak power, and average power; By combining the over-limit frequency band information from multiple scanning cycles, if an over-limit signal at the same frequency position persists for more than a preset time threshold, it is marked as a continuous abnormal signal; if it only occurs once, it is marked as a transient abnormal signal.

[0016] In the above technical solution of the present invention, the generation of the signal behavior feature map includes: By using FPGA to discretize and quantize the continuous amplitude values ​​of the FFT output, the dynamic range of the signal is divided into several amplitude levels through the amplitude quantization interval. A two-dimensional cumulative matrix is ​​constructed using a dual-port BRAM of an FPGA, which is the number of frequency points multiplied by the number of amplitude levels, to record the number of times the signal of each frequency-amplitude level combination occurs. An accumulation attenuation mechanism is adopted to make the contribution of historical signals decrease exponentially over time. The accumulation attenuation mechanism is as follows: after the accumulation of a preset number of frames is completed, the count value of all units in the two-dimensional accumulation matrix is ​​shifted right by one bit. The count values ​​in the two-dimensional cumulative matrix are converted into gray values ​​through gray-scale mapping to form signal behavior feature map image data.

[0017] In the above technical solution of the present invention, the behavioral feature detection result includes: The burst index is quantified by analyzing the energy distribution of a signal in a continuous time slice, calculating the ratio of the peak slice energy to the average energy of multiple slices before and after it, and mapping it to a score value between zero and one. The concealment index is determined by analyzing whether there are signal features in the feature spectrum that have power below a preset threshold but appear regularly and can form a continuous and stable weak brightness trajectory, and by calculating the statistical contrast between the feature and the background noise.

[0018] In the above technical solution of the present invention, the preset decision includes: Strong confirmation rule: When energy detection detects abnormal signals and AI identification results contain significant abnormal behavioral characteristics, it is marked as a highly suspicious event and added to a high-priority reporting queue after the confidence level is increased. Strong suppression rule: When AI identifies a known legitimate signal type with high confidence and there is no obvious abnormal behavior, it suppresses the reporting and records it as normal signal fluctuation in the local log. The weak confirmation rule is that when energy detection detects an abnormal signal but the AI ​​cannot identify it or the confidence level of identification is lower than a preset threshold, it is marked as an unknown anomaly and added to the regular reporting queue.

[0019] In the above technical solution of this invention, the macroscopic behavior analysis of the fused signal is performed. When a suspicious event is detected in the full-band mode or when the user manually specifies it, the system switches to a specialized analysis mode to perform a stationary in-depth analysis of a specific frequency band. The specialized analysis mode includes: The Wi-Fi band-specific analysis employs a triple analysis engine: high-resolution fluorescence spectrum AI recognition, standard channel rule comparison, and built-in Wi-Fi module probe cross-validation. Bluetooth frequency band-specific analysis uses a Bluetooth decoding module to scan and output information on surrounding Bluetooth devices, while AI fluorescence spectroscopy simultaneously identifies Bluetooth signal characteristics within the frequency band. The two are then matched through frequency field matching to generate a fusion result set. The LoRa band-specific analysis employs a dual-engine approach of energy detection and AI fluorescence spectrum recognition to discover and label LoRa signals.

[0020] Compared with the prior art, the present invention has the following advantages and beneficial effects: This invention innovatively proposes a "three-level environmental adaptive benchmark" system, which combines the stability of static benchmarks, the regularity and adaptability of time-segmented dynamic benchmarks, and the rapid response of real-time sliding benchmarks. With the help of "strong suppression rules", it is expected to filter out most false alarms caused by fluctuations in conventional signals, making the system practical.

[0021] The signal behavior feature map generated in real time by the FPGA hardware of this invention can display weak and transient signals hidden under noise as "brightness trajectories" on a two-dimensional image through long-term probability accumulation. Combined with the burst and concealed feature detection of the AI ​​model, it effectively solves the problem that traditional spectrum scanning methods are difficult to capture transient signals.

[0022] This invention transforms one-dimensional time-domain signals into two-dimensional feature maps, making full use of statistical characteristics such as the "probability of occurrence" and "stability" of signals. The CNN multi-task learning architecture simultaneously outputs signal type classification and behavioral feature confidence, realizing intelligent judgment from "what kind of signal" to "whether it is abnormal".

[0023] This invention adopts a two-level architecture of front-end preprocessing + back-end in-depth research. Real-time signal processing, AI recognition and preliminary judgment are completed at the acquisition front end, and only high-quality abnormal events are reported, which greatly reduces the network backhaul bandwidth pressure.

[0024] This invention supports multi-terminal networking and collaboration, achieving precise positioning through multi-source signal fusion. It supports in-depth analysis of key frequency bands such as Wi-Fi, Bluetooth, and LoRa, and effectively improves the ability to detect and confirm concealed signals through cross-validation of AI fluorescence spectrum recognition and protocol decoding dual engines. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a schematic diagram of the system composition and network topology of this embodiment; Figure 2 This is a flowchart illustrating the process of this embodiment; Figure 3 This is a schematic diagram of the three-level environmental adaptive monitoring process; Figure 4 This is a diagram illustrating the local joint judgment and reporting process; Figure 5 This is a schematic diagram illustrating the steady-state characteristics of Wi-Fi signals as presented by digital fluorescence spectra. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0027] Example 1 The intelligent wireless signal monitoring method in this embodiment consists of two parts: a signal acquisition and analysis terminal (front end) and a comprehensive analysis terminal (back end). Figure 1 As shown, the signal acquisition and analysis terminal is deployed in key areas that need to be monitored (such as conference rooms, office areas, data centers, etc.) and is connected to the comprehensive analysis terminal through a TCP / IP network.

[0028] The signal acquisition and analysis terminal (front end) in this embodiment adopts an integrated design of receiver and antenna, with a built-in wideband omnidirectional monitoring antenna (covering 20MHz-8GHz), and internally integrates a radio frequency module, a digital signal processing module (FPGA) and a heterogeneous computing module (ARM+NPU).

[0029] The radio frequency module adopts a superheterodyne receiver structure to downconvert the radio frequency signal to an intermediate frequency.

[0030] The digital signal processing module (FPGA) realizes high-speed ADC sampling, digital down-conversion (DDC), fast Fourier transform (FFT), and real-time hardware generation of signal behavior feature maps.

[0031] The heterogeneous computing module includes an ARM processor and a neural network processing unit (NPU). The ARM is responsible for device scheduling and communication, while the NPU runs a lightweight convolutional neural network (CNN) model to perform real-time recognition of feature maps.

[0032] Comprehensive analysis terminal (back-end): Utilizes high-performance computers, deploys analysis software, aggregates data from multiple terminals, and performs multi-source signal fusion, macro-behavioral pattern analysis, and global threat determination.

[0033] Example 2 This embodiment is based on the system architecture of Embodiment 1, and performs intelligent monitoring of wireless signals, such as... Figure 2 As shown, the process specifically includes: S1: Full-band intelligent scanning for data acquisition, obtaining real-time spectrum. The system performs cyclic scanning across the entire frequency band from 20MHz to 8GHz. For preset "key focus bands" (including ISM bands, public mobile communication bands, and dedicated communication bands), the scanning density and processing priority are automatically increased to ensure the ability to capture transient signals in high-value frequency bands.

[0034] Specifically, the preferred processing method in this embodiment is as follows: the system has a pre-set list of key frequency bands, including but not limited to Wi-Fi bands (2.4GHz / 5GHz), Bluetooth bands (2.4GHz ISM), LoRa bands (470-510MHz / 863-870MHz / 902-928MHz), walkie-talkie bands (136-174MHz / 400-470MHz) and public mobile communication bands.

[0035] When scanning into the aforementioned key frequency bands, the FPGA automatically shortens the generation period of the signal behavior feature map from 1 second in the normal mode to 100ms, while increasing the FFT operation frame rate in this frequency band to ensure effective capture of transient signals with a duration of less than 100ms.

[0036] S2: Three-level environment adaptive benchmark construction and anomaly detection (the core solution to high false alarm rate) This embodiment constructs and maintains a three-level adaptive benchmark system as a reference for anomaly detection, specifically including: Level 1: Static baseline, manually triggered by the user, continuously collects the full-band background spectrum (e.g., 5 minutes) during a relatively "clean" environmental period, generating a "maximum hold spectrum". Users can perform visual fine-tuning (overall gain adjustment, segmented correction) through the backend interface. This serves as the initial baseline for the system or as a backup baseline after significant environmental changes.

[0037] Level Two: Time-segmented dynamic benchmarks, automatically learned and generated by the system, capable of adapting to long-term, regular changes in the environment, specifically including: Time period classification: The system has a built-in time period classifier that divides the week into four time period categories: "Weekday daytime (9:00-18:00)", "Weekday nighttime (18:00-9:00 the next day)", "Weekend daytime", and "Weekend nighttime". Data accumulation involves continuously accumulating historical spectrum data for each time period category, and independently recording the level value sequence for each frequency point. Statistical modeling is used to calculate the P85 quantile value (i.e., the value that the frequency point has not exceeded for 85% of the historical time) for the level value sequence of each frequency point, which is used as the dynamic benchmark value of that frequency point in that time period category. The system features adaptive updates and employs a sliding window mechanism (window duration of 7 days). Every day at midnight, it re-compiles the historical data from the previous 7 days and updates the dynamic baseline values ​​for each time period category. This allows the baseline to automatically adjust to long-term, slow environmental changes (such as seasonal changes and equipment upgrades) without the need for manual intervention.

[0038] Level 3: Real-time sliding reference. Based on the spectrum data within a short window (such as the last minute), the P90 quantile value (i.e. the level that does not exceed 90% of the time) is calculated for each frequency point to form a reference line that reflects the current instantaneous background. This is used to capture rapid environmental changes caused by equipment start-up and shutdown.

[0039] The three-level adaptive monitoring process in this embodiment is as follows: Figure 3 As shown, the baseline operation mode management includes: Quick Start Mode: This mode uses only a static benchmark as the detection threshold. The real-time spectrum is compared to the static benchmark, and frequencies exceeding "static benchmark value + allowable fluctuation margin" are marked as exceeding limits. This mode is suitable for initial system deployment, when dynamic benchmark data accumulation is insufficient (learning time < 3 hours), or when the user manually specifies a benchmark. Once the dynamic benchmark learning time reaches 3 hours and the stability assessment is passed, the system automatically prompts the user to switch to the regular monitoring mode.

[0040] Regular monitoring mode: The primary detection threshold is a time-segmented dynamic baseline (automatically matched to the corresponding dynamic baseline based on the current time period), supplemented by a real-time sliding baseline. When the difference between the real-time sliding baseline and the dynamic baseline continuously exceeds a preset threshold (e.g., 10dB), an environmental mutation judgment process is triggered. At this time, the real-time sliding baseline is temporarily referenced for detection. This mode is suitable when the dynamic baseline has been marked as "healthy and usable." After the environmental mutation judgment is passed, the system enters a hybrid mode for continuous monitoring for 30 minutes. If the environment stabilizes, it automatically switches back to regular monitoring mode.

[0041] Hybrid mode: The maximum value of each frequency point from the static benchmark, time-segmented dynamic benchmark, and real-time sliding benchmark is used as the final detection threshold, ensuring that signals deemed abnormal under any benchmark are not missed. Suitable for environmental transition periods (such as concentrated start-up and shutdown periods of large equipment) or user-specified high-security scenarios. Automatically switches back to normal monitoring mode when manually switched by the user or after the system has not detected any environmental changes for one consecutive hour.

[0042] In this embodiment, for each benchmark health status, the system assesses the dynamic benchmark's "data completeness" (whether it has accumulated for a sufficient duration, at least 3 hours) and "stability" (whether there is a significant drift compared to historical benchmarks—if the difference between the current dynamic benchmark and the dynamic benchmark of the same period last week continuously exceeds a preset threshold, such as 8dB, in most frequency bands, it is determined to be unstable). It is marked as usable only when both "data completeness" and "stability" are satisfied.

[0043] In this embodiment, abnormal signals are detected by comparing the real-time spectrum with the currently enabled benchmark. Frequency points exceeding "benchmark value + allowable fluctuation margin" are marked as "out-of-limit points". Consecutive out-of-limit points are aggregated into preliminary abnormal signals, specifically including: Frequency domain continuity determination: Scan the entire frequency band and classify the out-of-limit points with adjacent frequency intervals less than the preset frequency domain tolerance (e.g., 25kHz) into the same out-of-limit frequency band; Minimum bandwidth constraint: Filter out frequency bands with a bandwidth less than the preset minimum bandwidth threshold (e.g., 12.5kHz) to avoid misjudging single-frequency noise fluctuations as signals; Signal parameter extraction: For each valid over-limit frequency band, calculate its center frequency (midpoint between the start and end frequencies of the band), bandwidth (end frequency minus start frequency), peak power (maximum power of each frequency point within the band), and average power (average power of each frequency point within the band). Duration determination: Combining the over-limit frequency band information of multiple scanning cycles before and after, if the over-limit signal at the same frequency position persists for more than the preset time threshold (such as 3 consecutive scanning cycles), it is marked as a "continuous abnormal signal"; if it only occurs once, it is marked as a "transient abnormal signal".

[0044] S3: Signal Behavior Feature Map Generation and Intelligent Recognition (Solving Transient Signal Capture and Deep Feature Extraction). This embodiment transforms one-dimensional time-domain signals into two-dimensional image features and uses deep learning for intelligent recognition.

[0045] S31: Feature map generation. In this embodiment, the feature map is generated in real time on the FPGA hardware through a two-dimensional cumulative statistical matrix. The following process is executed inside the FPGA: Spectral amplitude quantization involves the FPGA discretizing the continuous amplitude values ​​output by the FFT. An amplitude quantization range is defined, dividing the signal's dynamic range (e.g., -120dBm to 0dBm) into N levels (N=32 or 64). The FPGA comparator array compares the current spectral amplitude with a preset quantization threshold and outputs the corresponding amplitude level index (0~N-1).

[0046] The two-dimensional cumulative matrix is ​​constructed using a dual-port BRAM of the FPGA to build a two-dimensional cumulative cache matrix of "number of frequency points × number of amplitude levels" (e.g., 4096-point FFT × 32 amplitude levels = 131072 storage units). Each storage unit records the number of times the signal corresponding to the "frequency-amplitude level" combination occurs.

[0047] Real-time counting updates: For each frame of FFT spectrum, the corresponding cell in the buffer matrix is ​​located according to the "frequency index" and "amplitude level index", and the atomic operation of "reading the current count value → count value + 1 → writing back" is performed. A ping-pong buffer mechanism is used to support simultaneous reading and writing.

[0048] The cumulative attenuation mechanism performs a right shift operation (equivalent to dividing by 2) on the count value of all units in the buffer matrix after each preset number of frames (e.g., 1000 frames) is completed. This causes the contribution of historical signals to decay exponentially over time, ensuring that the spectrum can reflect the latest electromagnetic environment dynamics.

[0049] The grayscale mapping output converts the count values ​​in the cumulative cache matrix into grayscale values ​​through a preset mapping relationship (count value 0 → grayscale 0 (black), count value ≥ threshold → grayscale 255 (white), and intermediate values ​​are linearly mapped), forming signal behavior feature map image data, which is then transmitted to the computing board NPU through a high-speed data interface.

[0050] In the graph of this embodiment, the X-axis represents frequency, the Y-axis represents amplitude level, and the pixel brightness represents the probability of the signal occurring at that frequency and amplitude level.

[0051] S32: Intelligent Recognition (NPU Inference), running a lightweight convolutional neural network (CNN) model on the NPU. This model employs a multi-task learning architecture and outputs synchronously: Signal type classification: Identifies known legitimate signal types (such as Wi-Fi 6, Bluetooth LE, LoRa, etc.) and "unknown" categories; Behavioral feature detection: Outputs the confidence scores of semantic features, including: Burstness index: Analyze the energy distribution of the signal in a continuous time slice, calculate the ratio of the peak slice energy to the average energy of the N slices before and after, and then map this ratio to a score value between 0 and 1 through a normalization transformation function to quantify the burst characteristics of the signal; Concealment index: Utilizing the "separation of signals of similar frequency and magnitude" capability of the feature spectrum, analyze whether there are signal features in the spectrum that have low power but appear regularly and can form a continuous and stable weak brightness trajectory in a strong background frequency band. The concealment is then comprehensively judged by calculating the statistical contrast between this feature and the background noise.

[0052] S4: Local Intelligent Joint Decision-Making and Reporting (Front-end Intelligent Filtering) This implementation example Figure 4 As shown, by combining the dual evidence of energy detection and AI recognition, predefined rules are executed to generate high-quality anomalous events. Then, by combining the anomalous signals detected by energy anomaly detection with the AI ​​recognition results, pre-defined decision rules are executed. Rule 1: Strong Confirmation Rule (Highly Suspicious) The triggering condition is that energy detection detects abnormal signals, and the AI ​​recognition results contain significant abnormal behavioral characteristics (high levels of suddenness and concealment). The action is processed, marked as a "highly suspicious event", the confidence level is increased by 0.1, and it is added to the high-priority reporting queue; The reporting strategy involves immediate reporting via TCP connection, supporting offline caching and retransmission.

[0053] Rule 2: Strong Suppression Rule (Normal Fluctuations) The trigger condition is that energy detection detects an abnormal signal, but the AI ​​identifies it as a known legitimate signal type with high confidence (≥0.95) and there is no obvious behavioral abnormality. The action was taken to suppress the reporting, and the local log recorded it as "normal signal fluctuation"; It is valuable in effectively filtering out the vast majority of routine false alarms.

[0054] Rule 3: Weak Confirmation Rule (Unknown Exceptions) Triggering condition: Energy detection detects abnormal signals, but AI cannot identify them or has low confidence in their identification. The action is processed, marked as "unknown anomaly", the confidence level remains unchanged, and it is added to the regular reporting queue; Note: This type of signal requires further analysis by the central terminal in conjunction with information from multiple devices.

[0055] When the detected signal is not abnormal, the system defaults to reporting the result based on the energy detection.

[0056] This embodiment optimizes the identified abnormal signals, including: Bandwidth integration: When the AI ​​recognition box is significantly larger than the multiple narrowband signals segmented by energy detection, if these narrowband signals all fall within the same AI recognition box, the system automatically merges them into a complete signal, and the bandwidth is corrected to the width of the AI ​​recognition box. Time correlation is performed to maintain the historical signal cache (last 5 minutes) and perform time correlation analysis on newly detected signals: if the new signal is highly similar to the historical signal in terms of frequency and bandwidth, and the time interval is less than the preset threshold (default 2 seconds), it is considered to be the continuous occurrence of the same signal; the start and end time and duration parameters of the signal are updated; duplicate reports are merged to reduce data redundancy.

[0057] The reported content includes structured information such as signal parameters (frequency, bandwidth, power, duration), AI recognition results, judgment basis, and device status, and is reported through a TCP long connection.

[0058] S5: Specialized analysis mode, in-depth analysis of key frequency bands In this embodiment, when a suspicious event is detected in the full-band mode, or when the user manually specifies it, the system can switch to a special analysis mode to perform a stationary in-depth analysis of a specific frequency band.

[0059] In this embodiment, the mode switching and resource reconfiguration are triggered manually by the control terminal operator who issues a task command specifying the center frequency, analysis bandwidth, and analysis type. Upon receiving the command, the terminal immediately stops full-band scanning scheduling. The RF front-end is locked to the specified frequency and bandwidth; the FPGA processing is reconfigured to prioritize high-resolution, high-refresh-rate signal processing within the specified band; and computing resources (CPU / NPU) are prioritized for specific analysis tasks.

[0060] This embodiment's Wi-Fi frequency band-specific analysis (2.4GHz: 2401-2483.5MHz; 5GHz: 5150-5850MHz), limited by the receiver's 80MHz intermediate frequency bandwidth, employs a frequency band rotation scanning strategy for a single device. The entire Wi-Fi frequency band is divided into multiple 80MHz windows for sequential scanning, with the window dwell time set to 1-5 seconds (configurable). This time-domain accumulation time setting is based on the burst transmission characteristics of Wi-Fi signals—Wi-Fi uses a CSMA / CA mechanism, with signals bursting in frames, and gaps of approximately 50-80μs between frames. A complete frame exchange cycle is approximately 1.9ms, and 1 second of accumulation can cover more than 500 complete frame exchange cycles, ensuring stable AI recognition features. Figure 5 As shown.

[0061] The core solution for Wi-Fi band-specific analysis involves using high-resolution fluorescence spectrum AI identification, standard channel rule comparison, and cross-validation with built-in Wi-Fi module probes. Specifically, this includes: Deep fluorescence spectroscopy analysis sets the fluorescence spectrum accumulation time to several seconds, making the Wi-Fi signal characteristics more stable and clear. The AI ​​model accurately identifies the signal and outputs the center frequency and bandwidth of the signal. Frequency offset detection compares the signal center frequency identified by AI with the standard Wi-Fi channel table. The standard channel center frequencies for the 2.4GHz band include 2412, 2417, 2422, 2427, 2432, 2437, 2442, 2447, 2452, 2457, 2462, 2467, and 2472MHz; for the 5GHz band, they start at 5180MHz and increase in 5MHz increments. If the frequency deviation exceeds 20% of the channel interval (±5MHz by default for the 2.4GHz band and ±10MHz by default for the 5GHz band), it is determined to be a "frequency-offset Wi-Fi signal." Protocol layer cross-validation is performed by activating the terminal's built-in Wi-Fi module (operating in monitoring mode), scanning and listing all decorable Wi-Fi networks (BSSID, SSID, channel) within the frequency band. This list is then compared with the signals identified by the AI. If the AI ​​continuously identifies a certain Wi-Fi characteristic signal, but the built-in module consistently fails to scan for any standard network information on the corresponding frequency, the signal is marked as a "hidden or non-standard Wi-Fi device."

[0062] Output fields include center frequency, bandwidth, level, Wi-Fi identity (demodulated → SSID / BSSID, non-demodulated → undemodulated), frequency offset status (normal / exceeding the standard [deviation value]), authorization status (only compares with the whitelist when the Wi-Fi identity has a value, displaying "authorized" or "unauthorized"), and threat tag.

[0063] This embodiment focuses on the Bluetooth frequency band analysis (2.4GHz ISM: 2400-2483.5MHz), employing frequency hopping spread spectrum technology. Classic Bluetooth uses 79 channels at 1600 hops per second, with a single frequency dwell time of 625μs; Bluetooth LE uses 40 channels. AI fluorescence spectroscopy can identify discrete individual frequency points through short-term accumulation. With the Bluetooth decoding module's device discovery and frequency information return capabilities as the core, AI fluorescence spectroscopy serves as an auxiliary verification method.

[0064] The core solution for Bluetooth frequency band-specific analysis involves a Bluetooth decoding module scanning and outputting information about surrounding Bluetooth devices (device name, MAC address, RSSI, connection status, authentication status, current operating frequency / channel, etc.), while AI fluorescence spectroscopy simultaneously identifies Bluetooth signal characteristics within the 2.4GHz band. The two are then precisely matched through frequency fields to generate a fusion result set. Time-domain parameter analysis (pulse width, interval, duty cycle) and frequency hopping pattern recognition are subsequent extensions.

[0065] Output fields: Device name, MAC address, signal strength (RSSI), authorization status (compare with whitelist, display "authorized" or "unauthorized"), and occurrence time. Sorting rules: Authorization status → Signal strength → Occurrence time.

[0066] This embodiment's analysis of low-power IoT frequency bands such as LoRa employs chirp spread spectrum (CSS) modulation technology, which exhibits a unique wide and flat "strawberry" spectral characteristic, clearly distinguishing it from narrowband signals (such as FSK and ASK) in terms of spectral morphology. The LoRa basic physical layer signal is not a frequency-hopping signal, but rather a continuous wideband emission; the AI ​​fluorescence spectrum can stably identify this "strawberry" spectral characteristic through time-domain accumulation.

[0067] The system is pre-configured with mainstream global LoRa frequency bands: 470-510MHz (frequency band for low-power devices in China), 863-870MHz (Europe / Middle East / Africa, etc.), and 902-928MHz (North America / South America / Australia, etc.). The device will automatically adapt to the actual location.

[0068] The core solution for the specialized analysis of low-power IoT frequency bands such as LoRa is a dual-engine approach combining energy detection and AI fluorescence spectrum recognition to discover and label LoRa signals. It records the signal's center frequency, bandwidth (commonly 125 / 250 / 500kHz), and level, and outputs a list of LoRa signals.

[0069] Output fields: frequency, bandwidth, voltage level, time. Sorting rule: signal strength → time.

[0070] S6: Multi-device signal fusion and global analysis This embodiment comprehensively analyzes and aggregates abnormal events reported by multiple front-end devices, performing multi-source signal fusion and global analysis.

[0071] Multi-source signal fusion includes: time window aggregation, which puts abnormal reported signals from different devices within a short period of time (e.g., 5 seconds) into the same processing batch; similarity calculation, which calculates the "bandwidth overlap" and "time proximity" between pairs of signals; and clustering and merging, which groups signals with high similarity into one category, considering them as signals from the same source captured by multiple devices, and merges them to generate a "fused signal" with more accurate parameters (e.g., center frequency is taken as a weighted average, amplitude is taken as the maximum value).

[0072] Macro-behavioral analysis is performed on the fused signals: periodicity detection (extracting the signal intensity time series and detecting the presence of a fixed period through frequency domain analysis); time-period activity analysis (combining a preset work schedule, statistically analyzing the activity ratio of signals in authorized and unauthorized periods, and automatically marking signals with significantly higher activity in unauthorized periods).

[0073] The global threat assessment scores threats across four dimensions and calculates a weighted sum to arrive at a comprehensive threat score: spatial distribution breadth (30%), signal identification confidence level (20%), specific analysis depth characteristics (30%), and macro-behavioral patterns (20%). Based on the comprehensive threat score, threats are automatically categorized as follows: a total score ≥75 is "urgent," 60-74 is "important," and <60 is "moderate."

[0074] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A wireless signal monitoring method based on signal behavior feature maps, characterized in that, include: The system performs cyclic scanning across the entire 20MHz-8GHz frequency band, automatically increasing the scanning density and processing priority for preset key frequency bands to obtain real-time spectrum. Construct and maintain a three-level adaptive benchmark system that includes static benchmarks, time-segmented dynamic benchmarks, and real-time sliding benchmarks. Compare the real-time spectrum with the currently enabled benchmarks to identify out-of-limit points and aggregate them into abnormal signals. On the FPGA hardware side, the probability of abnormal signals is statistically analyzed in real time using a two-dimensional cumulative matrix to generate a signal behavior feature map. A lightweight convolutional neural network model running on the NPU is used to identify the feature map in real time, and the signal type classification and behavior feature detection results are output synchronously. Based on the identified abnormal signals, the output signal type classification, and the behavioral feature detection results, a preset decision is made to generate abnormal events and report them. Multi-source signal fusion is performed on abnormal events reported from multiple terminals, macroscopic behavior analysis is conducted on the fused signals, and a global alarm is generated by combining a multi-dimensional evaluation model.

2. The wireless signal monitoring method based on signal behavior feature maps according to claim 1, characterized in that, The automatic increase in scan density and processing priority includes: When scanning enters a preset key focus frequency band, the FPGA automatically shortens the generation period of the signal behavior feature map from the normal mode to a preset short period, while increasing the FFT operation frame rate in that frequency band to capture transient signals with a duration shorter than the short period.

3. The wireless signal monitoring method based on signal behavior feature maps according to claim 1, characterized in that, In the aforementioned three-level adaptive benchmark system: The static benchmark is learned manually by the user, continuously collecting the full-frequency background spectrum within a time period to generate the maximum preserved spectrum, which can be fine-tuned by the user. The time-segmented dynamic benchmark is automatically learned and generated by the system. It divides a time period into multiple time period categories, continuously accumulates historical spectrum data under each time period category, calculates fixed quantile values ​​for the frequency point level value sequence as dynamic benchmark values, and updates them periodically using a sliding window mechanism. The real-time sliding reference is based on the spectral data within a short time window, and its fixed quantile value is calculated for each frequency point to form a reference line that reflects the current instantaneous background.

4. The wireless signal monitoring method based on signal behavior feature maps according to claim 3, characterized in that, The three-level adaptive benchmark system is configured with three operating modes: In the fast start mode, only the static reference is used as the detection threshold. The real-time spectrum is compared with the static reference, and frequency points that exceed the sum of the static reference value and the allowable fluctuation margin are marked as over-limit points. In the conventional monitoring mode, the main detection threshold is a time-segmented dynamic benchmark, supplemented by a real-time sliding benchmark. The monitoring mode checks whether the difference between the real-time sliding benchmark and the dynamic benchmark continuously exceeds a preset threshold, which is used to trigger the environmental change judgment process. The hybrid mode takes the maximum value of each frequency point as the final detection threshold for static reference, time-segmented dynamic reference and real-time sliding reference, and is used to determine abnormal signals under any reference.

5. A wireless signal monitoring method based on signal behavior feature maps according to claim 4, characterized in that, The environmental mutation determination process is applicable to dynamic benchmarks marked as healthy and usable. The determination of the healthy and usable status includes: Simultaneously, the data completeness and stability of the dynamic reference are evaluated. It is marked as usable only when both data completeness and stability are met. The data completeness requirement is that the cumulative duration reaches a preset threshold. The stability is determined by comparing whether the difference between the current dynamic reference and the historical dynamic reference of the same period in most frequency bands exceeds a preset threshold.

6. The wireless signal monitoring method based on signal behavior feature maps according to claim 4, characterized in that, The determination of the abnormal signal includes: Scan the entire frequency band and classify the out-of-limit points with adjacent frequency intervals less than the preset frequency domain tolerance into the same out-of-limit frequency band; Filter out frequency bands with bandwidth less than the preset minimum bandwidth threshold; For each valid over-limit frequency band, calculate its center frequency, bandwidth, peak power, and average power; By combining the over-limit frequency band information from multiple scanning cycles, if an over-limit signal at the same frequency position persists for more than a preset time threshold, it is marked as a continuous abnormal signal; if it only occurs once, it is marked as a transient abnormal signal.

7. The wireless signal monitoring method based on signal behavior feature maps according to claim 1, characterized in that, The generation of the signal behavior feature map includes: By using FPGA to discretize and quantize the continuous amplitude values ​​of the FFT output, the dynamic range of the signal is divided into several amplitude levels through the amplitude quantization interval. A two-dimensional cumulative matrix is ​​constructed using a dual-port BRAM of an FPGA, which is the number of frequency points multiplied by the number of amplitude levels, to record the number of times the signal of each frequency-amplitude level combination occurs. An accumulation attenuation mechanism is adopted to make the contribution of historical signals decrease exponentially over time. The accumulation attenuation mechanism is as follows: after each preset number of frames of accumulation is completed, the count value of all units in the two-dimensional accumulation matrix is ​​shifted right by one bit. The count values ​​in the two-dimensional cumulative matrix are converted into gray values ​​through gray-scale mapping to form signal behavior feature map image data.

8. A wireless signal monitoring method based on signal behavior feature maps according to claim 1, characterized in that, The behavioral feature detection results include: The burstiness index is quantified by analyzing the energy distribution of a signal in a continuous time slice, calculating the ratio of the peak slice energy to the average energy of multiple slices before and after it, and mapping it to a score value between zero and one. The concealment index is determined by analyzing whether there are signal features in the feature spectrum that have power below a preset threshold but appear regularly and can form a continuous and stable weak brightness trajectory, and by calculating the statistical contrast between the feature and the background noise.

9. A wireless signal monitoring method based on signal behavior feature maps according to claim 1, characterized in that, The preset decision includes: Strong confirmation rule: When energy detection detects abnormal signals and AI identification results contain significant abnormal behavioral characteristics, it is marked as a highly suspicious event and added to a high-priority reporting queue after the confidence level is increased. Strong suppression rule: When AI identifies a known legitimate signal type with high confidence and there is no obvious abnormal behavior, it suppresses the reporting and records it as normal signal fluctuation in the local log. The weak confirmation rule is that when energy detection detects an abnormal signal but the AI ​​cannot identify it or the confidence level of identification is lower than a preset threshold, it is marked as an unknown anomaly and added to the regular reporting queue.

10. A wireless signal monitoring method based on signal behavior feature maps according to claim 1, characterized in that, Macroscopic behavior analysis is performed on the fused signal. When a suspicious event is detected in the full-band mode or when the user manually specifies it, the system switches to a specialized analysis mode to perform in-depth, stationary analysis on a specific frequency band. The specialized analysis mode includes: The Wi-Fi band-specific analysis employs a triple analysis engine: high-resolution fluorescence spectrum AI recognition, standard channel rule comparison, and built-in Wi-Fi module probe cross-validation. Bluetooth frequency band-specific analysis uses a Bluetooth decoding module to scan and output information on surrounding Bluetooth devices, while AI fluorescence spectroscopy simultaneously identifies Bluetooth signal characteristics within the frequency band. The two are then matched through frequency field matching to generate a fusion result set. The LoRa band-specific analysis employs a dual-engine approach of energy detection and AI fluorescence spectrum recognition to discover and label LoRa signals.

Images