An abnormal behavior detection method based on wireless signal detection

Abstract

The application discloses an abnormal behavior detection method based on wireless signal detection, relates to wireless signals, and comprises the following steps: collecting wireless signal data of terminal equipment by a plurality of wireless signal detection devices arranged in a target area, wherein the wireless signal data at least comprises a signal strength value, a detection device identifier, an equipment identifier and a time stamp; preprocessing the wireless signal data to obtain a structured observation data sequence; extracting features from the observation data sequence based on a sliding time window, and constructing a space-time feature set containing individual level features and group level features; inputting the space-time feature set into a pre-constructed anomaly detection model, and calculating an anomaly score of each sliding time window; and identifying an abnormal behavior event and generating a detection result based on the anomaly score and a preset judgment rule. The application improves the coverage rate of abnormal behavior detection, and solves the problem that the existing technology relies on user active cooperation, thereby limiting the coverage rate.

Description

Technical Field

[0001] This application relates to the field of wireless signals, and in particular to a method for detecting abnormal behavior based on wireless signal detection. Background Technology

[0002] Real-time detection of abnormal behavior has significant application value in the field of public safety management. Timely detection and early warning of abnormal behaviors such as loitering, tailgating, and unusual gatherings are crucial for improving security response efficiency and ensuring personnel safety. With the development of Internet of Things (IoT) technology, using wireless signals for personnel behavior sensing is gradually becoming an emerging technological approach for abnormal behavior detection.

[0003] Existing abnormal behavior detection solutions mainly include video surveillance-based methods and mobile application-based methods. Video surveillance solutions collect image data by deploying cameras and perform behavioral analysis, but this approach faces problems such as high equipment deployment and maintenance costs, blind spots, and significant privacy compliance risks, making it difficult to meet the combined requirements of low cost and wide coverage. Mobile application-based solutions require users to install specific applications on their terminal devices and actively report their location and behavioral data. However, this approach relies on active user cooperation, resulting in limited coverage in actual deployments and making it unable to effectively monitor personnel who have not installed the application.

[0004] Wireless signal detection devices can passively collect information such as signal strength and device identification from terminal devices without requiring users to install any applications. In reality, most users habitually keep the wireless function of their terminal devices enabled, making passive sensing highly accessible. Currently, personnel monitoring technology based on wireless signal detection has been validated in scenarios such as device counting, location estimation, and trajectory visualization, providing an engineering foundation for further abnormal behavior detection.

[0005] However, extending wireless signal detection from device counting and location estimation to anomaly detection still faces multiple challenges. First, multipath effects and occlusion in the environment cause significant signal strength fluctuations, and differences in data reporting formats and frequencies among different detection devices can easily lead to missing or dirty data, affecting the accuracy of subsequent feature extraction. Second, anomaly behavior often manifests as a deviation from both individual movement patterns and group density evolution; single-dimensional features are insufficient to fully characterize the spatiotemporal properties of anomaly behavior. Third, normal behavior patterns differ across time periods and regions; using fixed thresholds for anomaly detection can easily result in false positives or false negatives, requiring detection models that can adapt to scene changes. Finally, signal fluctuations and environmental interference can cause sporadic increases in short-term anomaly scores, necessitating effective mechanisms to suppress such false positives and improve the robustness of detection results. Summary of the Invention

[0006] To address the limitation in coverage caused by the reliance on active user cooperation in existing mobile application-based detection methods, this application provides an abnormal behavior detection method based on wireless signal detection, thereby improving the coverage of abnormal behavior detection.

[0007] One aspect of this application provides an abnormal behavior detection method based on wireless signal detection, comprising: collecting wireless signal data of terminal devices through multiple wireless signal detection devices deployed in a target area, wherein the wireless signal data includes at least signal strength value, detection device identifier, device identifier, and timestamp; preprocessing the wireless signal data to obtain a structured observation data sequence; extracting features from the observation data sequence based on a sliding time window to construct a spatiotemporal feature set containing individual-level features and group-level features; inputting the spatiotemporal feature set into a pre-constructed abnormal detection model to calculate an abnormal score for each sliding time window; and identifying abnormal behavior events and generating detection results based on the abnormal scores and preset judgment rules.

[0008] Furthermore, the individual-level features include: a first feature subset based on signal strength statistics, a second feature subset based on the consistency of observations from multiple detection devices, and a third feature subset based on motion patterns; the group-level features include: a fourth feature subset based on regional density and a fifth feature subset based on group motion patterns.

[0009] In particular, the representation of anomalous behavior in wireless signal data has multi-dimensional characteristics. On the one hand, anomalous behavior is usually accompanied by abnormal changes in the signal characteristics of a specific terminal device. For example, loitering behavior can cause signal strength to fluctuate periodically, and tailing behavior can cause the movement trajectories of two devices to show a high correlation. On the other hand, some anomalous behaviors can also cause deviations in the collective behavior patterns of multiple devices in an area. For example, abnormal clustering can cause a sudden increase in device density in a specific area, and group events can cause the movement directions of multiple devices to tend to be consistent. Relying solely on individual-level features may miss events where individual behavior is normal but group behavior is abnormal, while relying solely on group-level features may miss individual anomalous behaviors hidden within normal groups.

[0010] By combining individual-level features with group-level features to construct a joint feature vector, this application can simultaneously capture individual behavioral anomalies of a single device and group behavioral anomalies of multiple devices, thereby improving the comprehensiveness and accuracy of abnormal behavior detection.

[0011] Furthermore, the wireless signal data undergoes preprocessing, including: cleaning the raw wireless signal data to remove invalid device identifiers, out-of-bounds signal strength, and garbled records; resampling and time-aligning the data reported by multiple detection devices on a unified clock reference to eliminate timing offsets caused by different reporting frequencies; using support vector regression to predict and imput missing samples in the signal strength value sequence within a sliding time window; the wireless signal is affected by environmental obstruction and multipath effects during propagation, resulting in missing signal strength and high-frequency jitter; smoothing the imputed signal strength value sequence to suppress high-frequency jitter, which introduces false motion features; inputting the imputed signal strength value sequence into a pre-trained LSTM neural network for region attribution discrimination, filtering out terminal devices located outside the target monitoring area, and using the wireless signal data corresponding to terminal devices located within the target monitoring area as a structured observation data sequence.

[0012] Furthermore, the first feature subset includes: signal strength statistics calculated within the sliding time window, and a linear trend coefficient obtained by linearly fitting the signal strength sequence within the time window using the least squares method. The linear trend coefficient refers to the slope of the regression line obtained by linearly fitting the signal strength sequence within the sliding time window using the least squares method, with time as the independent variable and signal strength as the dependent variable. This coefficient characterizes the overall trend direction and rate of change of signal strength over time; a positive value indicates that the terminal device tends to move closer to the detection device within the time window, while a negative value indicates that it tends to move away from the detection device. The statistics include the signal strength mean, standard deviation, range, skewness, and kurtosis.

[0013] Furthermore, the second feature subset includes: a consistency metric calculated based on observations of the same terminal device by multiple detection devices, and the number of visible detection devices characterizing the observation coverage; wherein, the number of visible detection devices refers to the number of detection devices that can receive the wireless signals transmitted by the same terminal device and successfully report valid observation data within the sliding time window. This number reflects how many detection devices simultaneously observe the terminal device within the current time window, characterizing the spatial coverage of the observation; the consistency metric includes the maximum correlation coefficient and the average correlation coefficient between signal strength sequences across detection devices.

[0014] Furthermore, the third feature subset includes: motion features calculated based on the positional changes of the terminal device within the sliding time window; the motion features include the terminal device's moving speed, rate of change of moving direction, dwell time, and trajectory complexity.

[0015] The process involves: obtaining position estimates of the terminal device at adjacent time points, calculating the Euclidean distance between the two position estimates, and calculating the moving speed of the terminal device based on the Euclidean distance and the time interval; constructing the movement vector of the terminal device between adjacent time points, calculating the angle between adjacent movement vectors, and using the cumulative change of the angle within the time window as the rate of change of movement direction; where the rate of change of movement direction refers to the degree of cumulative change of the movement direction of the terminal device within the sliding time window; this index characterizes the directional stability of the terminal device's motion trajectory, and a higher rate of change of movement direction indicates that the device frequently changes its movement direction, which can be used to identify abnormal behavior patterns such as wandering and repeated back-and-forth.

[0016] A preset spatial range is defined, and the duration for which the estimated position of the terminal device remains stable within this range is recorded as the terminal device's dwell time. The actual movement path length of the terminal device within the time window is calculated, as well as the straight-line distance between the terminal device's start and end points. The trajectory complexity is obtained based on the ratio of the actual movement path length to the straight-line distance. Trajectory complexity refers to the ratio between the actual movement path length and the straight-line distance between the start and end points within the sliding time window. This ratio characterizes the degree of tortuosity of the terminal device's movement trajectory; a trajectory complexity closer to 1 indicates that the device moves along a straight line, while a higher trajectory complexity indicates a more tortuous and circuitous movement path. This can be used to distinguish between normal passage and non-linear movement behaviors such as loitering or patrolling.

[0017] Furthermore, the fourth feature subset includes: density features calculated based on the distribution of terminal devices in each region within the sliding time window; the density features include regional device density values, standardized scores of density relative to historical baselines, and density change rates.

[0018] The process involves: counting the number of detected terminal devices in each preset area within a sliding time window; obtaining the regional device density value based on the number of terminal devices and the area; calculating the historical density mean and standard deviation based on the regional device density values ​​from historical event windows; and obtaining the standardized score of density relative to the historical baseline based on the current regional device density value, the historical density mean, and the historical density standard deviation. The standardized score of density relative to the historical baseline refers to the standardized deviation of the current regional device density value from the historical density distribution. This score characterizes the direction and magnitude of the deviation of the current density from the historical normal density level of the area; a positive value indicates that the current density is higher than the historical average, and a negative value indicates that it is lower than the historical average. Finally, the difference in regional device density values ​​between adjacent sliding time windows is calculated, and the density change rate is obtained based on the difference and the corresponding time window step size.

[0019] Furthermore, the fifth feature subset includes: group motion features calculated based on the collective motion patterns of multiple terminal devices within a sliding time window; the group motion features include the group motion consistency index, group aggregation degree, and group flow direction entropy.

[0020] Specifically: calculate the movement vectors of all terminal devices within the sliding time window, normalize the movement vectors, calculate the average value of the normalized movement vectors, and use it as the group motion consistency index; calculate the group centroid position based on the estimated position values ​​of the terminal devices, calculate the distance from each terminal device to the group centroid, and calculate the group aggregation degree based on the distance.

[0021] The directional space is divided into N equally divided intervals. The distribution of movement directions of terminal devices within each interval is statistically analyzed, and the probability distribution of movement directions is calculated. Based on the probability distribution, the information entropy is calculated as the group flow direction entropy. The group flow direction entropy refers to the information entropy value calculated based on the movement direction distribution of multiple terminal devices within a sliding time window. This index characterizes the degree of orderliness of group movement directions. The lower the group flow direction entropy, the more concentrated and orderly the group movement directions are; the higher the group flow direction entropy, the more random and disordered the group movement directions are, indicating that the movement directions of the devices are dispersed across intervals. It can be used to identify abnormal events such as group directional evacuation and collective following, where the movement directions are highly consistent.

[0022] Furthermore, the spatiotemporal feature set is input into a pre-built anomaly detection model to calculate the anomaly score for each time window. This includes: combining the individual-level features (composed of the first, second, and third feature subsets) and the group-level features (composed of the fourth and fifth feature subsets) into a joint feature vector for the current sliding time window; inputting the joint feature vector into the pre-built anomaly detection model to calculate the initial anomaly score for the current sliding time window; and obtaining the pre-stored historical behavioral baselines for each preset region. The historical behavioral baseline refers to the cumulative statistical representation of the group-level features of each preset region within a historical time window. This baseline is calculated by performing an exponentially weighted moving average on the group-level features of the historical time window, reflecting the typical level of group behavioral characteristics of each region under normal conditions.

[0023] At the end of each sliding time window, the historical behavior baseline is updated based on the group-level characteristics of the current sliding time window using an exponentially weighted moving average method. The deviation of the group-level characteristics of the current sliding time window from the historical behavior baseline is calculated, and the initial anomaly score is corrected based on the deviation to obtain the corrected anomaly score of the current sliding time window. The number of windows whose corrected anomaly scores exceed a preset threshold within multiple consecutive sliding time windows is counted. When the number of windows exceeds the preset threshold, the final anomaly dispersion for the corresponding time interval is output.

[0024] In particular, whether the behavior of an individual device constitutes an anomaly cannot be determined solely based on the absolute values ​​of its own characteristics. Instead, it should be relativized and evaluated within the context of group behavior in the current spatiotemporal scenario. By maintaining historical baselines and calculating the degree of deviation between the current scenario and the baselines, the dynamic changes in group behavior are transformed into a basis for correcting individual anomaly scores. This allows anomaly detection to adapt to changes in the boundaries of normal behavior in different time periods and regions.

[0025] Compared to existing technologies, the advantages of this application are: To address the problems of high deployment costs and strong privacy intrusion in existing video surveillance-based abnormal behavior detection methods, and the limited coverage of mobile application-based detection methods due to reliance on user cooperation, making it difficult to effectively detect abnormal behavior of people in a target area without user cooperation and while protecting privacy, this application provides an abnormal behavior detection method based on wireless signal detection. This method passively collects wireless signal data from terminal devices by deploying wireless signal detection devices, constructs a spatiotemporal feature set including individual-level and group-level features, and performs scene-adaptive correction on the initial abnormality score output by the abnormality detection model based on a dynamic historical baseline. It can accurately identify abnormal behavior events such as loitering, tailgating, and abnormal gathering by analyzing the wireless signal characteristics of terminal devices without relying on cameras and mobile applications or requiring user cooperation. At the same time, the multi-time window joint judgment mechanism effectively suppresses false alarms caused by signal fluctuations or environmental interference, improving the accuracy and coverage of abnormal behavior detection. Attached Figure Description

[0026] This application will be further described by way of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not limiting; in these embodiments, the same reference numerals denote the same structures, wherein: Figure 1 This is an exemplary flowchart illustrating an abnormal behavior detection method based on wireless signal detection according to some embodiments of this application; Figure 2 This is a schematic diagram of a multi-point WiFi probe deployment according to some embodiments of this application; Figure 3 This is an exemplary flowchart of data preprocessing according to some embodiments of this application; Figure 4 This is a schematic diagram of triangular positioning and RSSI attenuation according to some embodiments of this application; Figure 5 This is a schematic diagram of the fields of the probe request according to some embodiments of this application; Figure 6 These are heat maps and trajectory diagrams shown according to some embodiments of this application; Figure 7 This is a schematic diagram of three types of abnormal confusion matrices according to some embodiments of this application; Figure 8 These are threshold scan curves shown according to some embodiments of this application; Figure 9 These are PR curves before and after migration shown in some embodiments of this application; Figure 10 This is a schematic diagram of a multi-category timeline according to some embodiments of this application. Detailed Implementation

[0027] The methods and systems provided in the embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0028] This embodiment focuses on typical indoor spaces such as teaching building corridors, shopping mall passages, and underground parking lots, constructing an abnormal behavior detection system based on WiFi probes. The system, without relying on cameras or mobile applications, requires data processing and judgment to be completed at the edge, and the alarm results to be projected onto an indoor map for handling and review. Considering the practical constraints of frontline deployment and monitoring, the system objectives include: edge-side single-window processing and decision latency not exceeding 500ms; hardware selection primarily using general-purpose probes and low-power edge gateways; algorithms with robustness to multipath and occlusion; and sensitive identifiers processed locally as much as possible with minimal cross-network transmission.

[0029] To ensure the stability of subsequent localization, re-identification, and behavior measurement, most locations within the target area need to be observed simultaneously by at least three probes, achieving a coverage level of k=3. Figure 2 Corridor scenes should prioritize locations such as stairwells, entrances / exits, and corners.

[0030] Key points are densely deployed; in large-space scenarios, points are evenly distributed based on the planar structure and pedestrian flow paths, with reserved maintenance channels for subsequent calibration and maintenance. When resources are limited, sensor deployment can be viewed as a coverage optimization problem, achieving a balance between cost and coverage through heuristic methods such as particle swarm optimization. All probes are synchronized with a unified clock, and their physical locations are registered as planar coordinates after deployment. Subsequently, coordinate transformation is used to align them with the building base map, ensuring consistent spatial reference for subsequent visualizations such as trajectories and thermal images.

[0031] A closed-loop structure of "probe—edge gateway—local service—front-end display" is adopted. The probe connects to the edge gateway via Ethernet or serial port, continuously reporting passively sniffed terminal identifiers and signal strength information. The gateway first completes local access and caching to buffer the jitter caused by high-concurrency writes, and then provides a unified structured data interface to the upstream, such as... Figure 3As shown, data ingestion follows a layered design: the access layer receives the raw JSON text stream using NoSQL; the edge service performs regular expression cleaning and field extraction at this layer, and then periodically writes the cleaned and resampled data to the relational database via memory caching. The cleaning process focuses on removing obviously invalid identifiers (such as placeholder MACs with specific prefixes), out-of-bounds RSSI values, and garbled records, and aligns and resamples multi-probe observations on the same time base to reduce time-series offsets caused by differences in reporting frequencies. For ease of subsequent analysis, the minimum field set includes timestamp, probe number, anonymized device identifier, RSSI, and channel.

[0032] In the visualization and evidence collection phase, the system retains lightweight positioning and coordinate projection capabilities at the edge. Specifically, within a sliding time window, RSSI is converted into approximate distance, combined with trilateration or weighted trilateration for location estimation, and the relative coordinates are mapped to the indoor map coordinate system to generate trajectories and heatmaps. For example... Figure 4 As shown in the figure, the RSSI attenuation model presents the relationship between wireless signal strength and device distance through different values ​​of the path loss exponent n. When the value of n is larger, the signal attenuates more rapidly, which helps to more accurately estimate the distance between the device and the AP, and further estimate the relative position of the device.

[0033] For density assessment needs, the system can optionally introduce a population estimation module based on the fusion of RSSI statistics and a simple neural network to correct systematic biases caused by relying solely on device counts. This module can optimize population estimation based on RSSI and path loss models in the environment, thereby improving the accuracy of density monitoring.

[0034] The system adheres to the principles of "minimum identifiability and local priority" for privacy protection and security governance. All device identifiers undergo irreversible anonymization before entering the persistent layer, and a rolling window strategy is used by default to temporarily retain original records locally for troubleshooting purposes; cross-network transmission only includes necessary statistics and alarm summaries. Cleaning, feature construction, and anomaly scoring are completed at the edge, with no original detection data stored at the central level. The front-end display uses aggregated views such as heatmaps and trajectories, and does not display the specific identifiers of individual devices by default. For access control, the system uses a role-based permission model and audit logs to hierarchically manage alarm viewing, parameter configuration, and historical tracing, and interfaces with a unified alarm center to form a closed loop from detection and presentation to handling.

[0035] This embodiment presents the system's application scenarios, coverage and deployment methods, data acquisition and processing pipeline, and privacy and security design, laying the engineering foundation for subsequent data preprocessing, location visualization, and anomaly detection methods. The next chapter will provide a detailed description of data cleaning, missing data imputation, indoor / outdoor discrimination, and coordinate mapping, along with corresponding parameter settings and implementation methods.

[0036] The raw data is reported by the probes in JSON / text stream format, containing fields such as device identifier, frame type, RSSI, and timestamp. Data access adopts a layered design: first, the raw stream is written to a NoSQL database to absorb high concurrency; then, a cache (such as Redis) periodically synchronizes valid data to a relational database for persistence, avoiding breakdown and consistency issues caused by high-frequency interaction with MySQL. On the cleaning side, regular expression filtering and structured extraction are performed at the edge gateway, focusing on removing obviously invalid identifiers (such as placeholder MACs starting with "00:00"), out-of-bounds or garbled RSSI records, and resampling and time alignment of multi-probe observations on a unified clock reference to reduce time-series offsets caused by different reporting frequencies. Considering the real-time requirements of downstream features and detection, this application sets the processing frequency to 1Hz, aggregating each device using a sliding window. For ease of reproduction, the minimum field set is defined as: timestamp (timeCollect), probe number (snifferID), de-identified device identifier (MACAddress), RSSI, and optional raw row (MACDataAll).

[0037] There are already clear examples and value ranges in relevant systems (e.g., RSSI in the range of -100 to 0 dBm). The raw fields that can be parsed from the probe side include... Figure 5 As shown, the data includes source / destination MAC, frame main type and subtype, channel and RSSI, etc. The functions of each field are shown in Table 1.

[0038] Indoor multipath propagation and occlusion cause RSSI fluctuations and intermittent missing data. This application performs interpolation and smoothing at the edge gateway using a sliding time window. The time window width is 5 seconds, and the step size is 1 second. For missing samples within the window, support vector regression (SVR) is used for short-term prediction interpolation to obtain more stable RSSI statistics. This approach has been used in probe-based data processing for "WiFi missing data prediction" and is combined with LSTM gatekeeping for subsequent discrimination. To further suppress high-frequency jitter, median or exponential sliding smoothing is applied to the interpolated sequence. If a device has no effective observations for several consecutive windows, its feature and location calculations are paused to avoid misjudgment.

[0039] Table 1 Functions of each field

[0040] The presence of outdoor or building-level devices significantly disrupts density and trajectory estimation. This application implements an "indoor / outdoor gatekeeper" before data enters the feature and detection stages. An LSTM-based binary classification model is used to distinguish the RSSI time series of the devices, retaining only indoor samples for subsequent calculations. Practical application demonstrates that this model achieves high accuracy in indoor / outdoor identification tasks and is reusable. Model training is completed offline, while online inference is performed at 1Hz. When the gatekeeper determines the device to be "outdoor," the device does not participate in localization or anomaly detection within the current time window.

[0041] RSSI—Distance Mapping and Localization: To obtain interpretable spatial evidence, this application retains a lightweight localization component at the edge gateway. Under the logarithmic decay model, the relationship between RSSI and distance is shown in (1). (1) (2) in, For reference received power, This is a reference distance (usually taken as 1 meter). This is the path loss index, which typically varies across different environments. It is the distance between the target device and the access point. The shadow fading follows a normal distribution.

[0042] Estimated by multi-probe Then, a weighted trilateration method was used for solution. Weight (Closer proximity yields higher reliability), and robust solutions are obtained using least squares; when the number of visible probes... At this point, position updates are paused, and instead, the motion characteristics are approximated by the synthetic intensity slope and cross-probe correlation.

[0043] Based on this, the distance to the probe is estimated by multi-probe RSSI, and the target plane coordinates (x, y) are calculated using trilateration, the basic form of which is shown in (3): (3) in, Access point coordinates It is from the device to the access point. The distance to be measured.

[0044] In real-world environments, trilateration errors are significant, necessitating weighted corrections to improve stability. A common approach is to assign greater weight to observations that are closer and have higher reliability. To ensure the availability of the solution, this application updates the position only when the number of visible probes is at least 3. When there are insufficient visible probes, motion features such as RSSI slope and cross-probe consistency are used instead to avoid introducing unstable coordinates.

[0045] The obtained coordinates are in a relative coordinate system. For ease of monitoring and evidence collection, they need to be mapped to the indoor map coordinate system. This application performs a local coordinate transformation based on the building base map to align the positioning coordinates with the indoor map, and overlays the trajectory and heat map at the front end, such as... Figure 6 As shown, this displays the dynamics of pedestrian flow and the location of events. This "location-coordinate transformation-front-end visualization" process has been validated in applications such as personnel monitoring and tracing. When an abnormal event occurs, the system simultaneously saves the trajectory slice and heat map of the corresponding time window as a basis for alarm interpretation and post-event review.

[0046] In accordance with the aforementioned access and cleansing processes, this application employs a minimal table structure in both the edge gateway and the local database to support online processing and forensics. The example table "WiFiSniffer_data" includes fields such as id, snifferID, timeCollect, MACDataAll, MACAddress, and RSSI, specifying that the RSSI value range is -100 to 0 dBm. In scenarios requiring recording of judgment results, a results table can be added to record time, device identifier, and indoor / outdoor tag information, forming structured traces beyond detection and visualization. To meet privacy and compliance requirements, MACAddress undergoes irreversible anonymization before being stored in the database, and MACDataAll is only retained briefly on a rolling basis at the edge by default.

[0047] This embodiment presents the engineering implementation on the data side: JSON access, regular expression cleaning, and time alignment are completed at the edge gateway; RSSI is interpolated and smoothed based on SVR, and outdoor interference is filtered out using LSTM gatekeeping; weighted trilateration is performed when visible probes meet the conditions, and spatial alignment with the indoor map is achieved through coordinate transformation; finally, interpretable presentation is achieved using trajectories and heatmaps. These steps provide a stable observational foundation for subsequent spatiotemporal feature construction and anomaly detection. The next chapter will define anomaly types and construct feature systems at both individual and group scales within a sliding time window.

[0048] To achieve real-time identification of abnormal behaviors such as intrusion, loitering, and running without relying on cameras and mobile applications, the system organizes multi-probe RSSI sequences using a sliding time window, simultaneously characterizing individual movement patterns and group background states. This application sets the window width to 5 seconds and the step size to 1 second, using the "device-time window" as the basic sample unit. When at least three probes are visible within the window, the target's position in the planar coordinate system is obtained through lightweight localization. Based on this, velocity and acceleration are calculated. When there are insufficient visible probes, the motion is approximated by the synthetic intensity and temporal variation of cross-probe RSSI to ensure continuous feature generation and stable online detection. Regional-scale aggregation and discrimination are performed by dividing the area into functional zones, so that subsequent visualization and management strategies are naturally aligned with site semantics.

[0049] Feature construction revolves around two main lines: "individual" and "group," and is integrated within the same time window. At the individual level, statistical quantitative indicators of RSSI are first extracted, including the mean. Standard deviation Range, skewness and kurtosis, and linear trend coefficient with respect to time. (obtained by least squares fitting within the window), they reflect the signal strength, fluctuation amplitude and short-term trend. Secondly, using the observation of the same device by multiple probes, the correlation (maximum correlation and average correlation) between cross-probe RSSI sequences and the number of visible probes k are calculated; these quantities characterize occlusion, multipath and observation consistency, and indirectly reflect the coupling effect of scene geometry and human activity [1]. When positioning is available, the kinematic characteristics are shown in (4).

[0050] (4) in, It is the device in time Location, It is a time interval. It's the speed of the equipment. It is the acceleration of the equipment.

[0051] The velocity and acceleration are given, and the turning rate is measured by the angle between adjacent displacement vectors; if positioning is unavailable, the slope of the cross-probe synthetic intensity and the first-order difference variance are used instead of the above quantities as shown in (5): (5) in The weights are (possibly weighted based on the signal strength or reliability of each probe). It is a probe In time The signal strength value is used to maintain sensitivity to phenomena such as "rapid passage" and "sudden reversal". To identify rare paths or unusual walking patterns, this application maintains a Dynamic Time Warping (DTW) distance to a historical library of common paths in each window, normalizes it, and denotes it as the path outlier. This serves as evidence of whether an individual is on an abnormal path.

[0052] At the population level, a background baseline was constructed using a "region-time window" as the unit. Density was obtained using counting or kernel density estimation. And calculate the z-score relative to the history as shown in (6) and the rate of change in 3 to distinguish between abnormal crowding or sudden sparseness; (6) in It is the average density of this area in historical data. It is the density standard deviation of this region in historical data.

[0053] To characterize the uniformity of group movement, the concentration is obtained by summing the individual velocity vectors after normalization. This is used to distinguish between orderly migration and aimless, scattered wandering. Furthermore, the entry and exit probability matrix of adjacent windows is used. Compared with historical baseline The differences characterize the anomalies in the macroscopic flow structure, using The degree of deviation is measured as shown in (7).

[0054] (7) in This is the current time step. The actual distribution on, It is either the historical baseline distribution or the target distribution.

[0055] During a certain period of time When the density continues to rise without a significant change, it usually indicates a change in path selection or movement organization. Temporal context (operating / non-operating) serves as a semantic label, working in conjunction with the aforementioned statistics to adaptively adjust the threshold under different management strategies.

[0056] Based on the above characteristics, this application formally defines three types of abnormal events using a combination of rule constraints and statistical deviations, and then superimposes robustness strategies onto the subsequent unsupervised detection output. Intrusion (including boundary breaches and timeouts) is primarily driven by spatial and temporal semantics: when the device is in a restricted area... Appearing during or outside of business hours Once observed, the intrusion condition is considered triggered. To suppress occasional false triggers, this condition must be consistently met within 2–3 consecutive windows. Furthermore, if a significant increase in path outlier or regional shift occurs simultaneously, the alarm confidence level is increased. Loitering is characterized by "low speed, localized, and long duration": within a radius... Within the neighborhood, the speed remained below the site's empirical threshold, and the cumulative dwell time reached Meanwhile, the population density z-score should not be too high to exclude passive stagnation caused by congestion; if positioning is unavailable, the criteria are the state where the slope of the synthetic intensity is close to zero and the variance is small, the frequency of occurrence of combinations and the continuity of the window.

[0057] Running is determined by a speed threshold. Continue to exceed Time-triggered; when there is no localization, the variance of the first-order difference of the synthesized intensity exceeds an empirical threshold. As an alternative, robustness is improved by using the majority principle of "at least 3 out of 5 windows must be satisfied". The above thresholds are not fixed constants, but rather derived from a two-stage adaptive process: first, the density, velocity and transfer distribution of each region are estimated based on long-term alarm-free data and the high quantile is used as the initial value; second, fine-tuning is performed on a small-scale labeled set using the maximum F1 or Youden index; during operation, EWMA (exponentially weighted moving average) is used to update historical statistics to track seasonality and business changes, and false alarms are reduced by using time-period whitelists and regional masking when short-term drastic disturbances (such as construction or major promotions) occur.

[0058] To support on-duty response and post-event review, the system generates an interpretable evidence package for each alarm, including a time window index, spatial segments (trajectory slices and heatmaps), and a summary of the triggering basis. For example, an intrusion alarm will indicate "entering a restricted area during non-business hours, with the path outlier ranking at the 99th percentile historically"; a loitering alarm will specify "a local trajectory diameter of 3.2m within 4 minutes, with a speed consistently below 0.3m / s"; and a running alarm will indicate "speed continuously exceeding the threshold by 3 / 5 of the window, with a peak speed of 3.7m / s, and cross-probe correlation remaining at a high level," enabling rapid manual verification, coordinated response, and high-quality feedback for model iteration.

[0059] This embodiment presents a spatiotemporal feature system and event definitions for judgment and interpretation, and forms an integrated evidence package output for monitoring purposes. To verify the effectiveness, robustness, and deployability of this method in real-world scenarios, a comparative experiment is designed and implemented below, and key detection indicators and engineering overhead are reported.

[0060] Example 2 This embodiment was conducted in two typical indoor spaces: a two-story corridor in a teaching building and an underground parking lot. The two scenarios differed significantly in spatial scale, occlusion and metallic reflection intensity, and daily pedestrian flow rhythms, allowing for the testing of the model's adaptability across domains. Six to ten WiFi probes were deployed in each scenario to cover the main passageways. After NTP unified timing and planar coordinate registration, the probe positions were aligned with the building's base map through local coordinate transformation. Data collection lasted two to four weeks, covering weekdays and weekends, and business and non-business hours. In constructing abnormal samples, the principle of "scripted triggering + manual verification" was followed: during non-business hours, subjects were organized to enter the restricted area according to a preset route and speed, lingering for a long time and passing quickly, corresponding to intrusion, loitering, and running events, respectively; simultaneously, natural pedestrian flow was retained as normal samples. The edge gateway, powered by a general gateway, handled data access, rule cleaning, sliding window feature construction, and isolated forest scoring, while the central terminal only received alarm summaries and statistical indicators for visualization and verification.

[0061] The evaluation employs common metrics for detection tasks, including precision, recall, and F1 score, and records AUROC and AUPRC to measure overall capability under different thresholds. Simultaneously, operational metrics such as single-window processing latency and end-to-end alarm latency are statistically analyzed on the engineering side. Three representative baseline methods are selected: a simple threshold method based solely on MAC count fluctuations, reflecting minimum available background monitoring; a single-source threshold method based solely on RSSI statistics (mean or variance), used to test the separability of signal-side information; and a trajectory method based on velocity, displacement, and path rules within the available positioning window, representing traditional rule-based approaches. All methods are run on the same sliding window organization (window width 5 s, step size 1 s) and preprocessing link to ensure comparability. Under the same conditions, the proposed method uses the individual and group spatiotemporal features defined in Chapter 4 as input, performs online scoring using an isolated forest at the edge gateway, selects the threshold on the validation set based on the maximum F1 principle, and stabilizes the output through a "continuous window majority" strategy; during runtime, EWMA adaptively updates the density and transition baseline.

[0062] In terms of overall accuracy, the confusion matrix is ​​as follows: Figure 7 As shown, the diagonal elements of the three anomaly types are dominant, with 78, 88, and 82 correctly identified for intrusion, loitering, and running, respectively. A small number of misclassifications mainly occur at the boundary window between loitering and running, presumably related to short-term acceleration / deceleration and RSSI jitter in adjacent regions. The matrix yields a macro-average F1 of approximately 0.86, indicating that class imbalance has a relatively small impact on the overall performance. This suggests that continuous window majority and group background modeling play a role in suppressing occasional false alarms.

[0063] The threshold selection follows a two-stage strategy of "validation set selection + runtime adaptation". Figure 8 The diagram shows the precision, recall, and F1 curves as the threshold changes. As the threshold moves from low to high, precision monotonically increases while recall decreases, exhibiting a typical trade-off among the three. The F1 score peaks in the 0.55–0.65 range, consistent with the strategy of selecting the threshold based on the highest F1 score on the validation set. For nighttime monitoring that emphasizes low false alarms, the operating point can be shifted slightly to the right within this range to achieve higher precision. For emergency drills that emphasize high detection rates, the operating point can be shifted slightly to the left to obtain higher recall, but this requires continuous window majority and manual review to suppress short-term noise.

[0064] Figure 9The PR curves before and after migration are presented. After adaptation, the curve shifts upward overall, with a significant improvement in precision, especially in the low recall region. This indicates that no additional annotation is needed; simply updating the density and transfer baseline over short periods can effectively mitigate domain shift. Consistent with cross-testing, direct migration leads to a slight performance decrease, while the adaptive mechanism can recover to a stable level in a short time. In engineering, the adaptive cycle can be tied to the site's operating rhythm, such as rolling updates after daily closing, to maintain long-term performance without interrupting real-time monitoring.

[0065] Regarding interpretability and boundary effects, Figure 10 The score curves of the three types of anomalies were overlaid with the true / predicted label bands on a unified time axis. It can be seen that the predicted and true segments are generally aligned, with minor fragmentation or slight misalignment at the boundaries, mainly due to boundary uncertainties caused by window segmentation and RSSI jitter. The score peaks for intrusion and running are sharp, while the score plateau for hesitant is relatively flat, consistent with the semantic characteristics of the three types of events. After adopting the "continuous window majority" strategy, sporadic noise in non-event segments is largely suppressed. To address residual errors, adding boundary probes, increasing the minimum event duration, or applying a stronger smoothing prior to the boundary window can further improve performance.

[0066] The foregoing illustrative description of the present application and its embodiments is not restrictive and can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. The accompanying drawings are only one embodiment of the present application, and the actual structure is not limited thereto. Therefore, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the present application, such designs should fall within the scope of protection of this application. Furthermore, the word "comprising" does not exclude other elements or steps, and the word "a" preceding an element does not exclude the inclusion of "a plurality" of that element. Terms such as "first," "second," etc., are used to indicate names and do not indicate any specific order.

Claims

1. A method for detecting abnormal behavior based on wireless signal detection, characterized in that, include: The wireless signal data of the terminal device is collected by multiple wireless signal detection devices deployed in the target area. The wireless signal data includes at least the signal strength value, detection device identifier, device identifier, and timestamp. The wireless signal data is preprocessed to obtain a structured observation data sequence; Feature extraction is performed on the observed data sequence based on a sliding time window to construct a spatiotemporal feature set containing individual-level features and group-level features; Input the spatiotemporal feature set into the pre-built anomaly detection model and calculate the anomaly score for each sliding time window; Based on anomaly scores and preset judgment rules, abnormal behavior events are identified and detection results are generated.

2. The abnormal behavior detection method based on wireless signal detection according to claim 1, characterized in that: Individual-level features include: a first feature subset based on signal strength statistics, a second feature subset based on the consistency of observations from multiple detection devices, and a third feature subset based on motion patterns; The group-level features include a fourth feature subset based on region density and a fifth feature subset based on group movement patterns.

3. The abnormal behavior detection method based on wireless signal detection according to claim 2, characterized in that: Preprocessing of wireless signal data includes: Clean the raw wireless signal data to remove invalid device identifiers, out-of-bounds signal strength, and garbled records; Data reported by multiple detection devices are resampled and time-aligned on a unified clock reference to eliminate timing offsets caused by different reporting frequencies; The support vector regression method is used to predict and impute missing samples in the signal intensity value sequence within a sliding time window. The interpolated signal strength value sequence is smoothed to suppress high-frequency jitter; The interpolated signal strength value sequence is input into a pre-trained LSTM neural network for region attribution discrimination, filtering out terminal devices located outside the target monitoring area, and using the wireless signal data corresponding to terminal devices located within the target monitoring area as a structured observation data sequence.

4. The abnormal behavior detection method based on wireless signal detection according to claim 2, characterized in that: The first feature subset includes: signal strength statistics calculated within the sliding time window, and linear trend coefficients obtained by linearly fitting the signal strength sequence within the time window using the least squares method; The statistics include the signal strength mean, standard deviation, range, skewness, and kurtosis.

5. The abnormal behavior detection method based on wireless signal detection according to claim 2, characterized in that: The second feature subset includes: a consistency measure calculated based on observations of the same terminal device by multiple detection devices, and the number of visible detection devices characterizing the observation coverage. The consistency metric includes the maximum correlation coefficient and the average correlation coefficient between signal strength sequences across detection devices.

6. The abnormal behavior detection method based on wireless signal detection according to claim 4, characterized in that: The third feature subset includes: motion features calculated based on the positional changes of the terminal device within the sliding time window; Motion characteristics include the terminal device's moving speed, rate of change of moving direction, dwell time, and trajectory complexity; in: Obtain the estimated position of the terminal device at adjacent time points, calculate the Euclidean distance between the two position estimates, and calculate the moving speed of the terminal device based on the Euclidean distance and the time interval. Construct the movement vector of the terminal device between adjacent time points, calculate the angle between adjacent movement vectors, and use the cumulative change of the angle within the time window as the rate of change of movement direction; Set a preset spatial range and count the duration for which the estimated location value of the terminal device remains stable within the corresponding spatial range, which is taken as the dwell time of the terminal device. The actual movement path length of the terminal device within the time window is calculated, the straight-line distance between the starting and ending points of the terminal device is calculated, and the trajectory complexity is obtained based on the ratio of the actual movement path length to the straight-line distance.

7. The abnormal behavior detection method based on wireless signal detection according to claim 4, characterized in that: The fourth feature subset includes: density features calculated based on the distribution of terminal devices in each region within the sliding time window; Density characteristics include regional equipment density values, standardized scores of density relative to historical baselines, and density change rates; in: The number of terminal devices detected in each preset area within the sliding time window is counted, and the area device density value is obtained based on the number of terminal devices and the area. The historical density mean and historical density standard deviation are calculated based on the regional equipment density values ​​of the historical event window. Based on the current regional equipment density value, the historical density mean, and the historical density standard deviation, a standardized score of density relative to the historical baseline is obtained. Calculate the difference in regional device density values ​​between adjacent sliding time windows, and obtain the density change rate based on the difference and the corresponding time window step size.

8. The abnormal behavior detection method based on wireless signal detection according to any one of claims 4 to 7, characterized in that: The fifth feature subset includes: group motion features calculated based on the collective motion patterns of multiple terminal devices within a sliding time window; Group movement characteristics include the group movement consistency index, group aggregation degree, and group flow direction entropy; in: Calculate the movement vectors of all terminal devices within the sliding time window, normalize the movement vectors, and calculate the average value of the normalized movement vectors as the group motion consistency index. The location of the group centroid is calculated based on the location estimate of the terminal devices, the distance from each terminal device to the group centroid is calculated, and the group aggregation degree is calculated based on the distance. The directional space is divided into N equal intervals. The distribution of the movement direction of terminal devices in each interval is statistically analyzed, the probability distribution of the movement direction is calculated, and the information entropy is calculated based on the probability distribution as the group flow direction entropy.

9. The abnormal behavior detection method based on wireless signal detection according to claim 8, characterized in that: The spatiotemporal feature set is input into a pre-built anomaly detection model to calculate the anomaly score for each time window, including: Individual-level features and group-level features are combined into a joint feature vector for the current sliding time window. The joint feature vector is then input into a pre-built anomaly detection model to calculate the initial anomaly score for the current sliding time window. Obtain the historical behavior baseline of each preset region that has been stored in advance; At the end of each sliding time window, the historical behavior baseline is updated using an exponentially weighted moving average method based on the group-level characteristics of the current sliding time window; Calculate the deviation of the group-level features of the current sliding time window relative to the historical behavior baseline, and correct the initial anomaly score based on the deviation to obtain the corrected anomaly score of the current sliding time window. The system counts the number of windows whose corrected anomaly scores exceed a preset threshold within multiple consecutive sliding time windows. When the number of windows exceeds the preset threshold, the system outputs the final anomaly dispersion for the corresponding time interval.

10. The abnormal behavior detection method based on wireless signal detection according to claim 9, characterized in that: The anomaly detection model uses the isolated forest model.

Images