CN104955149B - The passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal - Google Patents
The passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal Download PDFInfo
- Publication number
- CN104955149B CN104955149B CN201510315738.1A CN201510315738A CN104955149B CN 104955149 B CN104955149 B CN 104955149B CN 201510315738 A CN201510315738 A CN 201510315738A CN 104955149 B CN104955149 B CN 104955149B
- Authority
- CN
- China
- Prior art keywords
- mrow
- fuzzy
- rule
- msub
- formula
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W64/00—Locating users or terminals or network equipment for network management purposes, e.g. mobility management
-
- H04W4/04—
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Image Analysis (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
A kind of passive intrusion detection localization method in the interior based on WLAN is claimed in the present invention.The relatively traditional indoor orientation method of this localization method carries relevant hardware devices without people to be positioned or target and is actively engaged in realize positioning.Since the appearance and athletic meeting of indoor WLAN wireless environments servant cause reflection, scattering, diffraction of indoor radio signal etc., so as to cause signal fadeout, so that the signal under the relatively unmanned silent environment of wireless signal when someone invades indoors is varied from, then, detect in environment whether have abnormal intrusion using the change of this wireless signal.Fuzzy reasoning comprehensively utilizes the wireless signal variation feature in environment to train fuzzy rule, build the mapping relations of wireless signal Abnormal Characteristics and position, so as to fulfill the location estimation to intrusion target, and the change of environment is adapted to by designing fuzzy rule adaptive learning algorithm, so as to improve the robustness of the method for the present invention.
Description
Technical field
The present invention relates to the passive intrusion detection localization methods of WLAN in radio communication field, are specially that one kind is based on obscuring
The passive intrusion detection localization methods of indoor WLAN of Policy Updates.
Background technology
With economic and science and technology development, people are higher and higher for the demand of Context-Aware Services, are based especially on position
Explosive growth is presented in the business demand for the service (LBS, Location Based Services) put.Online in recent years
Offline (O2O) pattern progressively becomes the basis of business, and O2O business models flourish so that LBS carries good business
Gene.LBS at present outdoor mainly have global position system (such as GPS, Beidou satellite navigation system),
Network based positioning system, assisted GPS location system (Assisted GPS, A-GPS) etc.；Mainly there is bluetooth indoors
(Bluetooth) alignment system, radio frequency identification (Radio Frequency Identification, RFID) alignment system,
ZigBee alignment systems, WLAN alignment systems etc..Due to the activity space of people 80% be indoors, and outdoor positioning system believe
Number easily influenced indoors by building defilade etc. and limit its application range.In addition, indoors in alignment system,
The factors such as Bluetooth alignment systems need deployment bluetooth sending device, operating distance is short, security is poor limit its application.
RFID and ZigBee alignment systems are because operating distance is short, and the factors such as large scale deployment cost is higher also limit its application.With
This at the same time, with the development of mobile Internet, the life of people enters mobile Internet epoch, 80% mobile phone sum number
Produced indoors according to connection business, the growth of mobile phone and data connection business promotes WLAN deployment increasingly to popularize.WLAN
In shopping centre, office building, campus, airport, residential block, hotel etc., various environment have been widely deployed, and WLAN alignment systems need not
Extra hardware expense and device upgrade, have saved positioning cost and have had the characteristics that non-line-of-sight propagation, so that it is in positioning side
Face is able to extensively using and is increasingly becoming the mainstream of indoor positioning technologies.
Traditional alignment system usually requires target to be positioned and carries location equipment, and needs the active ginseng of target to be positioned
With so as to can not be carried out to no carrying location equipment (such as mobile phone, Bluetooth Receiver) and the abnormal user that is not actively engaged in
Intrusion detection and positioning.For this problem, the indoor WLAN proposed by the present invention based on fuzzy rule renewal passively invades inspection
Localization method is surveyed, no carrying location equipment and the people for not being actively engaged in positioning can be performed intrusion detection and positioned.This hair
It is bright to can be applied to sensitizing range protection, disaster assistance, asset management, safe early warning etc..
Fuzzy reasoning is a kind of using Fuzzy Set Theory as basic description instrument, and with the one of processing fuzzy message ability
Kind uncertain reasoning method.Fuzzy reasoning can realize complex Nonlinear Mapping relation, it is in industrial control field quilt
Extensive use, but be not applied also in terms of the passive intrusion detection positioning of WLAN indoors at present.The present invention is based on fuzzy rule
The passive intrusion detection localization methods of indoor WLAN then updated will comprehensively utilize wireless signal in environment according to fuzzy reasoning method
The fuzzy message of changing features, establishes the fuzzy rule base of signal characteristic change and the mapping of invasion position, and then is directed to unknown mesh
The Passive Positioning of target is realized in mark invasion.
Intrusion detection positioning result is exported, and terminates intrusion detection positioning.
The present invention is a kind of can effectively to solve indoor abnormal intrusion detection and the method without equipment Passive Positioning.Pass through place
Signal sliding window Variance feature finds the abnormal thresholding of environment invasion in reason environment, according to signal characteristic in real-time detection environment
Whether abnormal thresholding is more than, to judge whether there is abnormal intrusion in environment.Meanwhile trained using fuzzy rule, build fuzzy rule
Then storehouse, establishes abnormal signal situation and the mapping relations of abnormal intrusion position, and then realizes the location estimation to intrusion target.
The content of the invention
In view of the deficiencies of the prior art, it is proposed that a kind of location estimation realized to intrusion target, and it is fuzzy by designing
Rules self-adaptive learning algorithm adapts to the change of environment, so that improve the method for the robustness of the method for the present invention, the present invention
Technical solution it is as follows：A kind of passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal, it is characterised in that
Comprise the following steps：
Step 1：Under unmanned silent environment, gathered using monitoring device MP in environment and come from different radio access point AP
Signal strength sj,t, so as to collect K data flow Sj=[sj,1,...,sj,m] (j=1 ..., K), (wherein, K MP
The product of number and AP numbers, sj,t, (t=1 ..., m) is the signal strength values of t moment in j-th of data flow, and m is quiet for nobody
Silent environmental monitoring time span, and count and be combined into A={ S according to adfluxion1,...,SK}；
Step 2：Using the slip window function shown in formula (1), by data flow SjM-1 sliding window array is divided into, is made
Wj,t(t=2 ..., m) it is sliding window array of j-th of data flow in t moment；
Wherein, L slides window width to be maximum；
Step 3：Calculate the traffic spike feature X of t momentt=[x1,t,x2,t,...,xk,t], (t=2 ..., m), its
In, xj,t(j=1 ..., K；T=2 ..., m) it is each sliding window Wj,tThe variance of middle signal strength, its calculating process such as formula
(2) shown in：
Step 4：Based on the Epanechnikov kernel functions described in formula (4), x is obtainedj,tProbability density function fj(x)
(j=1 ..., K), as shown in formula (3)：
Wherein, hjFor Density Estimator bandwidth, its value is obtained according to Scott rules, as shown in formula (4),
Shown in the calculation expression such as formula (4) of Epanechnikov kernel functions V.
hj=2.345 σj×m-0.2 (5)
Wherein, σjFor all sliding window variance x in j-th of data flowj,tStandard deviation；
Step 5：Calculate the abnormal decision threshold u of each data flow sliding window variancej(j=1 ..., K), such as formula (6) institute
Show.
Wherein, functionFor density function fj(x) cumulative distribution function Fj(x) inverse function；
Using fuzzy set " normal ", "abnormal", " severely subnormal " to data flow signal characteristic xj,tDivided, and point
Yong not symbol A1、A2And A3Represent three above fuzzy set；Traffic spike feature xj,tFuzzy set " normal " is subordinate to
DegreeAs shown in formula (7),
Traffic spike feature xj,tTo the degree of membership of fuzzy set "abnormal"As shown in formula (8),
Wherein,
Traffic spike feature xj,tTo the degree of membership of fuzzy set " severely subnormal "As shown in formula (9),
Wherein,
Step 6：Utilize N group training datas [Xi,Zi] (i=1 ..., N) extraction fuzzy rule, as shown in formula (10)；
Regular Ri：IfAnd ..., andIt is Z then to invade regioniFormula (10)
Wherein, fuzzy rule is divided into Indistinct Input and fuzzy output two parts, X in formula teni=[x1,i,x2,i,...,
xK,i] (i=1 ..., N) be i-th group of training data K data flow signal characteristic, ZiRegion is invaded for i-th group of training data,
Environment is divided into g region, and uses Zone respectively1,...,ZonegRepresent, then have Zi∈{Zone1,Zone2,...,
Zoneg, orderRepresent signal characteristic xj,iThe fuzzy set of affiliated degree of membership maximum
Close, i.e.,：
Formula (11)
Step 7：The excitation density ω of the N number of fuzzy rule built in calculation procedure sixi, such as formula (12).
Formula (12)
Step 8：The N number of regular confidence level CF built in calculation procedure sixi, as shown in formula (13).
Formula (13)
Wherein, P for it is N number of rule in regular RiThere is the regular set of identical Indistinct Input, have N in set PpA rule,
Corresponding excitation density isC for it is N number of rule in regular RiThere are the identical fuzzy rule output and input
Set then, has N in set CCA rule, corresponding excitation density are
Step 9：Fuzzy rule merges, and for there is the rule of identical Indistinct Input and fuzzy output, only retains maximum confidence
That rule of degree, the fuzzy inference system of structure fuzzy rule base S, wherein, the structure of fuzzy rule base S is as follows：
Rule 1：IfAnd ..., andIt is Z then to invade region1Confidence level be CF1
Rule 2：IfAnd ..., andIt is Z then to invade region2Confidence level be CF2
………
Regular N'：IfAnd ..., andIt is Z then to invade regionN'Confidence level be CFN'
Wherein, N' is the fuzzy rules after merging,For traffic spike feature xj, (j=1,
2 ..., K) degree of membership maximum fuzzy set, i.e.,Fuzzy output Z1,Z2,...,
ZN'∈{Zone1,Zone2,...,ZonegIt is invasion region；
Step 10：Signal data stream in each real-time monitoring of environmental of MP；
Step 11：Detect the set of data flows A={ S in dynamic environment1,...,SKWhether occur because of wireless access point
Set of data flows element variation caused by increase or failure, if the element in set of data flows A changes, the data of change
Stream element set is denoted as A', A'={ S1,...,SK', wherein, K' is the number of data streams after change, enters step 12, no
Then, 14 are entered step；
Step 12：Newly there is the duration t of set of data flows A' in record environment, if t exceedes given threshold td, then
Judge that the set of data flows in environment changes, and enter step 13, otherwise, enter step 14；
Step 13：Adaptive updates fuzzy rule：
Emerging data flow, i.e. S caused by increasing due to wireless access pointj∈ A' andSignal characteristic xj,t
New fuzzy set is divided into without the Central Shanxi Plain, degree of membership is set to 1, and fuzzy set " unrelated " uses A4Represent, i.e.,
The distribution function f of the signal characteristic of emerging data flow is calculated using formula (3)j(x), and using formula (6) calculate newly to go out
Existing data flow SjAbnormal decision threshold
Data flow i.e. S to causing disappearance due to wireless access point failurej∈ A andSignal characteristic xj,tBy its
Fuzzy division is changed to " unrelated ", its degree of membership is set to 1, i.e.,
Step 14：Judge the signal characteristic x of each data flow in dynamic environmentj,t(j=1,2 ..., K') whether it is more than respectively
Self-corresponding exception decision threshold(j=1,2 ..., K'), if the signal characteristic of each data flow is respectively less than each
From abnormal decision threshold, then judge that signal characteristic is normal at this time and in monitoring of environmental without invasion, enter step 15, otherwise,
Judge there is the appearance of invasion situation in signal characteristic exception at this time and monitoring of environmental, enter step 16；
Step 15：By normal traffic spike feature xj,t, (j=1 ..., K') substitute into Step 4: in step 13
Corresponding data flow, the number of increase normal signal feature recalculate the distribution of each traffic spike feature using formula (3)
Function, abnormal decision threshold is recalculated using formula sixAnd enter step 10；
Step 10 six：It will be judged as the signal characteristic x of abnormal data stream in step 14j,t, (j=1 ..., K') carry out
Fuzzy division is to build Indistinct Input, as shown in formula (14)：
If x1,tIt isAnd x2,tIt is..., and xK',tIt is (14)
Wherein, xj,t(j=1 ..., K') is the corresponding signal characteristic of each data flow,(j=1 ..., K') it is corresponding
Traffic spike feature xj,tThe fuzzy set of degree of membership maximum；
Step 10 seven：Rule in Indistinct Input and fuzzy rule base that step 10 six is built is matched, if fuzzy
It is regular matching in rule base, then 19 are entered step, otherwise, enters step 18；
Step 10 eight：Set distance between fuzzy set as：D (" normal ", "abnormal")=1, D ("abnormal", it is " serious different
Often ")=1, D (" severely subnormal ", " unrelated ")=1, D (" normal ", " severely subnormal ")=2, D (" normal ", " unrelated ")=3, D
("abnormal", " unrelated ")=2, calculate Xt=[x1,t,...,xK',t] structure Indistinct Input it is regular similar in rule base S
Property, as shown in formula (15)；
Formula (15)
Wherein, RqFor q-th of rule in rule base S, M is the fuzzy rules in rule base S,To be right in step 10 six
xj,t, the fuzzy set of (j=1 ..., K') division,For regular RqIn j-th of traffic spike feature xj,tMaximum be subordinate to
Fuzzy set, in M rule, finds out the highest rule R of Indistinct Input similitude built with step 10 sixq', such as formula
(16) shown in；
S(X(t),Rq')≥S(X(t),Rq), (q=1 ... M), q' ∈ 1,2 ..., and M } formula (16)
In formula (16), Rq'For the highest rule of Indistinct Input similitude built with abnormal data stream signal characteristic,
Rq'Fuzzy output be abnormal data stream signal characteristic Xt=[x1,t,x2,t,...,xk',t] corresponding intrusion detection result；
Utilize XtThe Indistinct Input of structure and rule Rq'Fuzzy output, build new fuzzy rule Rnew, utilize rule
RnewExpand fuzzy rule base S.Regular RnewElect as and XtThe matched rule of Indistinct Input of structure, enters step 20；
Step 10 nine：Selection and X in the databasetThe matched strictly all rules of Indistinct Input of structure, selects matching degree most
High regular fuzzy output is positioning result.Shown in rule match degree such as formula (17).
Mq=ωq×CFq, (q=1 ..., M) (17)
Select the regular R of matching degree maximumq*, it meets formula 18.
Mq*≥Mq, (q=1 ..., M) (18)
Regular Rq*Elect as and XtThe matched rule of Indistinct Input of structure；
Step 2 ten：With XtThe fuzzy output of the Indistinct Input matched rule of structure is intrusion detection positioning result, output
Intrusion detection positioning result, and terminate intrusion detection positioning.
Further, the data flow anomaly decision threshold in step 5Calculating process such as
Under：
First, based on formula (3) described in Epanechnikov kernel functions, obtain xj,tProbability density function fj(x)(j
=1 ..., K), as shown in formula (3)：
Wherein, hjFor Density Estimator bandwidth, its value is obtained according to Scott rules, as shown in formula five,
Shown in the calculation expression such as formula (4) of Epanechnikov kernel functions V,
hj=2.345 σj×m-0.2 (5)
Wherein, σjFor all sliding window variance x in j-th of data flowj,tStandard deviation；
Then, the abnormal decision threshold u of each data flow sliding window variance is calculatedj(j=1 ..., K), such as formula (6) institute
Show：
Further, the intrusion detection fuzzy rule base structure of step 9, that is, build signal characteristic with invading the non-of region
The fuzzy rule of linear mapping relation.The fuzzy rule form of structure is as follows：
Rule 1：IfAnd ..., andIt is Z then to invade region1Confidence level be CF1
Rule 2：IfAnd ..., andIt is Z then to invade region2Confidence level be CF2
………
Regular N'：IfAnd ..., andIt is Z then to invade regionN'Confidence level be CFN'
Wherein, N' is the fuzzy rules after merging,For traffic spike feature xj, (j=1,
2 ..., K) degree of membership maximum fuzzy set (" normal ", "abnormal", " severely subnormal "), i.e.,(p=
1,2,3), fuzzy output Z1,Z2,...,ZN'∈{Zone1,Zone2,...,ZonegIt is invasion region.
Further, the non-abnormal signal feature update abnormal thresholding u monitored in real time is utilized in step 15j, (j=1,
2 ..., K') so that intrusion detection location algorithm can effectively adapt to the wireless network environment of real-time change.Abnormal thresholding uj,(j
=1,2 ..., K') update method it is as follows：
First, it is determined that in dynamic environment each data flow signal characteristic xj,t(j=1,2 ..., K') whether more than each right
The abnormal decision threshold answered(j=1,2 ..., K'), if the signal characteristic of each data flow is respectively less than respective
Abnormal decision threshold, then judge that signal characteristic is normal at this time and in monitoring of environmental without invasion, enter step 15, otherwise, judge
There is the appearance of invasion situation in signal characteristic exception and monitoring of environmental at this time, enter step 16；
Then, normal traffic spike feature x will be judged as in step 13j,t, (j=1 ..., K') substitute into step
The number for increasing normal signal feature in four recalculates the distribution function of each traffic spike feature using formula three, and utilizes
Formula (6) recalculates abnormal decision threshold
Further, the set of data flows situation of change adaptive updates fuzzy rule monitored in real time is utilized in step 13
Storehouse, its update method are as follows：
First, to increasing due to wireless access point caused by emerging data flow (i.e. Sj∈ A' and) signal
Feature xj,tIt is divided into new fuzzy set " unrelated ", degree of membership is set to 1, and fuzzy set " unrelated " uses A4Represent, i.e.,Emerging data flow (i.e. S is calculated using formula threej∈ A' and) signal characteristic distribution function
fj(x), and using formula six emerging data flow S is calculatedjAbnormal decision threshold
Then, to causing data flow (the i.e. S of disappearance due to wireless access point failurej∈ A and) signal characteristic
xj,tIts fuzzy division is changed to " unrelated ", its degree of membership is set to 1, i.e.,
Further, new fuzzy rule R is built in step 10 eight using similitudenewAnd perform intrusion detection positioning, phase
Process like property structure fuzzy rule is as follows：
First, set distance between fuzzy set as：D (" normal ", "abnormal")=1, D ("abnormal", " severely subnormal ")
=1, D (" severely subnormal ", " unrelated ")=1, D (" normal ", " severely subnormal ")=2, D (" normal ", " unrelated ")=3, D is (" different
Often ", " unrelated ")=2, calculate Xt=[x1,t,...,xK',t] structure Indistinct Input and rule base S in regular similitude,
As shown in formula (15)；
Formula (15)
Wherein, RqFor q-th of rule in rule base S, M is the fuzzy rules in rule base S.To be right in step 10 six
xj,t, the fuzzy set of (j=1 ..., K') division,For regular RqIn j-th of traffic spike feature xj,tMaximum be subordinate to
Fuzzy set.In M rule, the highest rule R of Indistinct Input similitude built with step 10 six is found outq', such as formula
(16) shown in；
S(X(t),Rq')≥S(X(t),Rq), (q=1 ... M), q' ∈ 1,2 ..., and M } formula (16)
In formula (16), Rq'For the highest rule of Indistinct Input similitude built with abnormal data stream signal characteristic,
Rq'Fuzzy output be abnormal data stream signal characteristic Xt=[x1,t,x2,t,...,xk',t] corresponding intrusion detection result；
Then, X is utilizedtThe Indistinct Input of structure and rule Rq'Fuzzy output, build new fuzzy rule Rnew, utilize
Regular RnewExpand fuzzy rule base S.Regular RnewElect as and XtThe matched rule of Indistinct Input of structure, enters step 20.
Advantages of the present invention and have the beneficial effect that：
The present invention based on fuzzy rule renewal the passive intrusion detection localization methods first of indoor WLAN, relative to traditional
Indoor detection localization method carries location equipment without target to be positioned, and is actively engaged in without target to be positioned, utilizes monitoring
Detection and positioning are realized in the change of WLAN signal data flow in environment.Secondth, the present invention is on existing extensive wlan network
It can be achieved, without extra network deployment and hardware device upgrading, save expense.3rd, the data in step 5 of the present invention
The probability density function profiles situation using data flow sliding window signal characteristic of the calculating innovation of throat floater decision threshold is accurate
Calculate data flow anomaly situation.4th, the fuzzy rule base using step 9 structure that the present invention innovates carries out fuzzy reasoning pair
Indoor objects invasion is positioned.5th, the present invention utilizes the continuous update abnormal detection door of step 15 in detection process
Limit enables the invention to effectively adapt to the wireless network environment of real-time change.6th, the present invention is monitored in real time using step 10 six
Set of data flows situation of change adaptive updates fuzzy rule base so that the deployment of AP or MP in the environment of the invention changes
It is to remain to work normally.7th, the fuzzy rule new using fuzzy rule similitude structure that the present invention innovates in step 10 eight
Then increase intrusion detection positioning accuracy.
Brief description of the drawings
Fig. 1 is the system flow chart of the present invention；
Fig. 2 is the indoor WLAN intrusion detections positioning schematic diagram of the present invention；
Fig. 3 is the experiment test environment of the present invention；
Fig. 4 is the traffic spike intensity of the present invention；
Fig. 5 is the intrusion detection positioning result of the present invention；
Fig. 6 is the intrusion detection probability results of the present invention.
Embodiment
Below in conjunction with attached drawing, the invention will be further described：
Referring to Fig. 1, embodiment one：Illustrate present embodiment with reference to Fig. 1, present embodiment step is as follows：
Step 1：Under unmanned silent environment, gathered in environment and come from using monitoring device (Monitor Point, MP)
The signal strength of different radio access point (Access Point, AP), so as to collect K data flow Sj=[sj,1,...,
sj,m] (j=1 ..., K), wherein, K is the product of MP numbers and AP numbers, sj,t, (t=1 ..., m) is in j-th of data flow the
The signal strength values of t moment, m is unmanned silent environmental monitoring time span, and counts and be combined into A={ S according to adfluxion1,...,SK}；
Wherein, unmanned silent environment is the ambient condition of the appearance of nobody or target in monitoring of environmental.If have in environment
There is then ambient condition and are known as target intrusion status in people or target.
Step 2：Using the slip window function shown in formula one, by data flow SjM sliding window array is divided into, makes Wj,t
(t=2 ..., m) (t was changed to since 2 seconds) for j-th of data flow t moment sliding window array.
Formula one
Wherein, L slides window width to be maximum；
Step 3：Calculate the traffic spike feature X of t momentt=[x1,t,x2,t,...,xk,t], (t=2 ..., m), (t
It is changed to since 2 seconds) wherein, xj,t(j=1 ..., K；T=2 ..., m) (t was changed to since 2 seconds) be each sliding window Wj,tIn
The variance of signal strength, its calculating process is as shown in formula two：
Formula two
Step 4：Based on the Epanechnikov kernel functions described in formula four, x is obtainedj,tProbability density function fj(x)
(j=1 ..., K), as shown in formula three：
Formula three
Wherein, hjFor Density Estimator bandwidth, its value is obtained according to Scott rules, as shown in formula five,
The calculation expression of Epanechnikov kernel functions V is as shown in formula four.
Formula four
hj=2.345 σj×m-0.2Formula five
Wherein, σjFor all sliding window variance x in j-th of data flowj,tStandard deviation；
Step 5：Calculate the abnormal decision threshold u of each data flow sliding window variancej(j=1 ..., K), such as the institute of formula six
Show.
Formula six
Wherein, functionFor density function fj(x) cumulative distribution function Fj(x) inverse function.
Using fuzzy set " normal ", "abnormal", " severely subnormal " to data flow signal characteristic xj,tDivided, and point
Yong not symbol A1、A2And A3Represent three above fuzzy set.
Traffic spike feature xj,tTo the degree of membership of fuzzy set " normal "As shown in formula seven.
Formula seven
Traffic spike feature xj,tTo the degree of membership of fuzzy set "abnormal"As shown in formula eight.
Formula eight
Wherein,
Traffic spike feature xj,tTo the degree of membership of fuzzy set " severely subnormal "As shown in formula nine.
Formula nine
Wherein,
Step 6：Utilize N group training datas [Xi,Zi] (i=1 ..., N) extraction fuzzy rule, as shown in formula ten.
Regular Ri：IfAnd ..., andIt is Z then to invade regioniFormula ten
Wherein, fuzzy rule is divided into Indistinct Input and fuzzy output two parts in formula ten.Indistinct Input is fuzzy rule
The condition part of condition judgment sentence, such as：IfAnd ..., andFuzzy output is sentenced for fuzzy rule condition
The conclusion part of conclusion sentence, such as：Invasion region is Zi。Xi=[x1,i,x2,i,...,xK,i] (i=1 ..., N) it is i-th group of training
K data flow signal characteristic of data, ZiRegion is invaded for i-th group of training data, environment is divided into g region, and respectively
Use Zone1,...,ZonegRepresent, then have Zi∈{Zone1,Zone2,...,Zoneg, orderRepresent signal characteristic xj,iThe fuzzy set of affiliated degree of membership maximum, i.e.,：
Formula 11
Step 7：The excitation density ω of the N number of fuzzy rule built in calculation procedure sixi, such as formula 12.
Formula 12
Step 8：The N number of regular confidence level CF built in calculation procedure sixi, as shown in formula 13.
Formula 13
Wherein, P for it is N number of rule in regular RiThere is the regular set of identical Indistinct Input, have N in set PpA rule,
Corresponding excitation density isC for it is N number of rule in regular RiThere are the identical fuzzy rule output and input
Set then, has N in set CCA rule, corresponding excitation density are
Step 9：Fuzzy rule merges, and for there is the rule of identical Indistinct Input and fuzzy output, only retains maximum confidence
That rule of degree, the fuzzy inference system of structure fuzzy rule base S.Wherein, the structure of fuzzy rule base S is as follows：
Rule 1：IfAnd ..., andIt is Z then to invade region1Confidence level be CF1
Rule 2：IfAnd ..., andIt is Z then to invade region2Confidence level be CF2
………
Regular N'：IfAnd ..., andIt is Z then to invade regionN'Confidence level be CFN'Wherein, N' is conjunction
Fuzzy rules after and,For traffic spike feature xj, the mould of (j=1,2 ..., K) degree of membership maximum
Paste set (" normal ", "abnormal", " severely subnormal "), i.e.,(p=1,2,3), fuzzy output Z1,
Z2,...,ZN'∈{Zone1,Zone2,...,ZonegIt is invasion region.
Step 10：Signal data stream in each real-time monitoring of environmental of MP；
Step 11：Detect the set of data flows A={ S in dynamic environment1,...,SKWhether occur because of wireless access point
Set of data flows element variation caused by increase or failure, if the element in set of data flows A changes, the data of change
Stream element set is denoted as A', A'={ S1,...,SK', wherein, K' is the number of data streams after change, enters step 12, no
Then, 14 are entered step；
Step 12：Newly there is the duration t of set of data flows A' in record environment, if t exceedes given threshold td, then
Judge that the set of data flows in environment changes, and enter step 13, otherwise, enter step 14；
Step 13：Adaptive updates fuzzy rule：
Step 13 one：Emerging data flow (i.e. S caused by increasing due to wireless access pointj∈ A' and)
Signal characteristic xj,tIt is divided into new fuzzy set " unrelated ", degree of membership is set to 1, and fuzzy set " unrelated " uses A4Table
Show, i.e.,Emerging data flow (i.e. S is calculated using formula threej∈ A' and) signal characteristic distribution
Function fj(x), and using formula six emerging data flow S is calculatedjAbnormal decision threshold
Step 13 two：Data flow (i.e. S to causing disappearance due to wireless access point failurej∈ A and) letter
Number feature xj,tIts fuzzy division is changed to " unrelated ", its degree of membership is set to 1, i.e.,
Step 14：Judge the signal characteristic x of each data flow in dynamic environmentj,t(j=1,2 ..., K') whether it is more than respectively
Self-corresponding exception decision threshold(j=1,2 ..., K').If the signal characteristic of each data flow is respectively less than each
From abnormal decision threshold, then judge that signal characteristic is normal at this time and in monitoring of environmental without invasion, enter step 15.Otherwise,
Judge there is the appearance of invasion situation in signal characteristic exception at this time and monitoring of environmental, enter step 16；
Step 15：By normal traffic spike feature xj,t, (j=1 ..., K') substitute into Step 4: step 13 one
In corresponding data flow, the number of increase normal signal feature recalculates the distribution of each traffic spike feature using formula three
Function, abnormal decision threshold is recalculated using formula sixAnd enter step 10；
Step 10 six：It will be judged as the signal characteristic x of abnormal data stream in step 14j,t, (j=1 ..., K') carry out
Fuzzy division is to build Indistinct Input, as shown in formula 14：
If x1,tIt isAnd x2,tIt is..., and xK',tIt isFormula 14
Wherein, xj,t(j=1 ..., K') is the corresponding signal characteristic of each data flow,To be corresponding
Traffic spike feature xj,tThe fuzzy set of degree of membership maximum.
Step 10 seven：Rule in Indistinct Input and fuzzy rule base that step 10 six is built is matched, if fuzzy
It is regular matching in rule base, then 19 are entered step, otherwise, enters step 18；
Step 10 eight：Set distance between fuzzy set as：D (" normal ", "abnormal")=1, D ("abnormal", it is " serious different
Often ")=1, D (" severely subnormal ", " unrelated ")=1, D (" normal ", " severely subnormal ")=2, D (" normal ", " unrelated ")=3, D
("abnormal", " unrelated ")=2, calculate Xt=[x1,t,...,xK',t] structure Indistinct Input it is regular similar in rule base S
Property, as shown in formula 15.
Formula 15
Wherein, RqFor q-th of rule in rule base S, M is the fuzzy rules in rule base S.To be right in step 10 six
xj,t, the fuzzy set of (j=1 ..., K') division,For regular RqIn j-th of traffic spike feature xj,tMaximum be subordinate to
Fuzzy set.In M rule, the highest rule R of Indistinct Input similitude built with step 10 six is found outq', such as formula ten
Shown in six.
S(X(t),Rq')≥S(X(t),Rq), (q=1 ... M), q' ∈ 1,2 ..., and M } formula 16
In formula 16, Rq'For the highest rule of Indistinct Input similitude built with abnormal data stream signal characteristic,
Rq'Fuzzy output be abnormal data stream signal characteristic Xt=[x1,t,x2,t,...,xk',t] corresponding intrusion detection result.
Utilize XtThe Indistinct Input (as shown in formula 14) of structure and rule Rq'Fuzzy output, build new fuzzy rule
Then Rnew, utilize regular RnewExpand fuzzy rule base S.Regular RnewElect as and XtThe matched rule of Indistinct Input of structure, enters
Step 2 ten.
Step 10 nine：Selection and X in the databasetThe matched strictly all rules of Indistinct Input of structure, selects matching degree most
High regular fuzzy output is positioning result.Rule match degree is as shown in formula 17.
Mq=ωq×CFq, (q=1 ..., M) formula 17
Select the regular R of matching degree maximumq*, it meets formula 18.
Mq*≥Mq, (q=1 ..., M) formula 18
Regular Rq*Elect as and XtThe matched rule of Indistinct Input of structure；
Step 2 ten：With XtThe fuzzy output of the Indistinct Input matched rule of structure is intrusion detection positioning result, output
Intrusion detection positioning result, and terminate intrusion detection positioning.
In Chongqing Mail and Telephones Unvi's administrative building hall (as shown in Figure 3), which is interior for the test environment selection of the present invention
Spacious environment, size are the rectangular area of 14m × 8m.The rectangular area is divided into 4 homalographic subregions, is labeled as
Area1, Area2, Area3 and Area4.
AP and MP is disposed respectively in tetra- sub-regions of Area1, Area2, Area3 and Area4, such as Fig. 3 institutes
Show.The selected rectangular area lower left corner is origin, front-right to surface to the respectively positive direction of reference axis X and Y, then four
The position coordinates of AP is respectively (0,8), (14,8), (0,0), (14,0), meanwhile, the position coordinates of four MP be respectively (3.5,
6),(10.5,6),(3.5,2),(10.5,2)。
The unmanned silent environment of collection, target invasion Area1 subregions, target invade Area2 respectively in test environment
Each traffic spike intensity in region, target invasion Area3 subregions and target invasion Area4 subregions, to build fuzzy rule
Then storehouse.It is a certain that target invasion is changed into by unmanned silence, and the traffic spike intensity being eventually returned under unmanned silent status is such as
Shown in Fig. 4.Wherein, there is no the ambient condition that target occurs in unmanned silent status finger ring border；And if have target appearance in environment,
It is then target intrusion status.
Detect in environment whether have target invasion by method proposed by the present invention.If judge to there is target to enter in environment
Invade, then using fuzzy inference system, and according to the fuzzy rule base built, infer the invasion region of intrusion target.Fig. 6 is provided
The present invention is to the testing result of target invasion, it will be appreciated from fig. 6 that when detecting environment and being in unmanned silent status, institute of the present invention
Extracting method detection is judged as that the accuracy of unmanned silent environment is 92.1%, and the probability for being mistaken for target invasion is 7.9%.When
When having target invasion in detection environment, the accuracy that institute's extracting method detection of the present invention is judged as having target invasion environment is
95.3%, the probability for being judged as unmanned silent environment is 4.7%.
Fig. 5 gives the passive intrusion detection positioning results of indoor WLAN based on fuzzy rule renewal that the present invention is carried,
It can be seen from the result of Fig. 5 when there is target to invade Area1 regions, the accuracy for being judged as target invasion Area1 regions is
100%；When there is target to invade Area2 regions, the accuracy for being judged as target invasion Area2 regions is 93.2%；When there is mesh
During mark invasion Area3 regions, it is 93.6% to be judged as the accuracy for invading Area3 regions；Area4 regions are invaded when there is target
When, it is 94.9% to be judged as the accuracy for invading Area4 regions.
The intrusion target under indoor WLAN environment is carried out in conclusion institute's extracting method of the present invention can be obtained and can be realized
Detection and positioning.
The above embodiment is interpreted as being merely to illustrate the present invention rather than limits the scope of the invention.
After the content for having read the record of the present invention, technical staff can make various changes or modifications the present invention, these equivalent changes
Change and modification equally falls into the scope of the claims in the present invention.
Claims (1)
1. a kind of passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal, it is characterised in that including following
Step：
Step 1：Under unmanned silent environment, the letter from different radio access point AP in environment is gathered using monitoring device MP
Number intensity sj,t,, so as to collect K data flow Sj=[sj,1,...,sj,m] (j=1 ..., K), (wherein, K is MP numbers
With the product of AP numbers, sj,t, (t=1 ..., m) is the signal strength values of t moment in j-th of data flow, and m is unmanned silent ring
Border monitoring time length, and count and be combined into A={ S according to adfluxion1,...,SK}；
Step 2：Using the slip window function shown in formula (1), by data flow SjM-1 sliding window array is divided into, makes Wj,t(t
=2 ..., m) it is sliding window array of j-th of data flow in t moment；
<mrow>
<msub>
<mi>W</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
</mrow>
</msub>
<mo>=</mo>
<mfenced open = "{" close = "">
<mtable>
<mtr>
<mtd>
<mrow>
<mo>&lsqb;</mo>
<mrow>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mn>1</mn>
</mrow>
</msub>
<mo>,</mo>
<mn>...</mn>
<mo>,</mo>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
</mrow>
</msub>
</mrow>
<mo>&rsqb;</mo>
</mrow>
</mtd>
<mtd>
<mrow>
<mn>1</mn>
<mo><</mo>
<mi>t</mi>
<mo><</mo>
<mi>L</mi>
</mrow>
</mtd>
</mtr>
<mtr>
<mtd>
<mrow>
<mo>&lsqb;</mo>
<mrow>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
<mo>-</mo>
<mi>L</mi>
<mo>+</mo>
<mn>1</mn>
</mrow>
</msub>
<mo>,</mo>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
<mo>-</mo>
<mi>L</mi>
<mo>+</mo>
<mn>2</mn>
</mrow>
</msub>
<mo>,</mo>
<mn>...</mn>
<mo>,</mo>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
</mrow>
</msub>
</mrow>
<mo>&rsqb;</mo>
</mrow>
</mtd>
<mtd>
<mrow>
<mi>t</mi>
<mo>&GreaterEqual;</mo>
<mi>L</mi>
</mrow>
</mtd>
</mtr>
</mtable>
</mfenced>
<mo>-</mo>
<mo>-</mo>
<mo>-</mo>
<mrow>
<mo>(</mo>
<mn>1</mn>
<mo>)</mo>
</mrow>
</mrow>
Wherein, L slides window width to be maximum；
Step 3：Calculate the traffic spike feature X of t momentt=[x1,t,x2,t,...,xk,t], (t=2 ..., m), wherein,
xj,t(j=1 ..., K；T=2 ..., m) it is each sliding window Wj,tThe variance of middle signal strength, its calculating process such as formula (2) institute
Show：
<mrow>
<msub>
<mi>x</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
</mrow>
</msub>
<mo>=</mo>
<mfenced open = "{" close = "">
<mtable>
<mtr>
<mtd>
<mfrac>
<mrow>
<mo>&lsqb;</mo>
<msup>
<mrow>
<mo>(</mo>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mn>1</mn>
</mrow>
</msub>
<mo>-</mo>
<mfrac>
<mrow>
<munderover>
<mo>&Sigma;</mo>
<mrow>
<mi>m</mi>
<mo>=</mo>
<mn>1</mn>
</mrow>
<mi>t</mi>
</munderover>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>m</mi>
</mrow>
</msub>
</mrow>
<mi>t</mi>
</mfrac>
<mo>)</mo>
</mrow>
<mn>2</mn>
</msup>
<mo>+</mo>
<mn>...</mn>
<mo>+</mo>
<msup>
<mrow>
<mo>(</mo>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
</mrow>
</msub>
<mo>-</mo>
<mfrac>
<mrow>
<munderover>
<mo>&Sigma;</mo>
<mrow>
<mi>m</mi>
<mo>=</mo>
<mn>1</mn>
</mrow>
<mi>t</mi>
</munderover>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>m</mi>
</mrow>
</msub>
</mrow>
<mi>t</mi>
</mfrac>
<mo>)</mo>
</mrow>
<mn>2</mn>
</msup>
<mo>&rsqb;</mo>
</mrow>
<mi>t</mi>
</mfrac>
</mtd>
<mtd>
<mrow>
<mn>1</mn>
<mo><</mo>
<mi>t</mi>
<mo><</mo>
<mi>L</mi>
</mrow>
</mtd>
</mtr>
<mtr>
<mtd>
<mfrac>
<mrow>
<mo>&lsqb;</mo>
<msup>
<mrow>
<mo>(</mo>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
<mo>-</mo>
<mi>L</mi>
<mo>+</mo>
<mn>1</mn>
</mrow>
</msub>
<mo>-</mo>
<mfrac>
<mrow>
<munderover>
<mo>&Sigma;</mo>
<mrow>
<mi>m</mi>
<mo>=</mo>
<mi>t</mi>
<mo>-</mo>
<mi>L</mi>
<mo>+</mo>
<mn>1</mn>
</mrow>
<mi>t</mi>
</munderover>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>m</mi>
</mrow>
</msub>
</mrow>
<mi>L</mi>
</mfrac>
<mo>)</mo>
</mrow>
<mn>2</mn>
</msup>
<mo>+</mo>
<mn>...</mn>
<mo>+</mo>
<msup>
<mrow>
<mo>(</mo>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
</mrow>
</msub>
<mo>-</mo>
<mfrac>
<mrow>
<munderover>
<mo>&Sigma;</mo>
<mrow>
<mi>m</mi>
<mo>=</mo>
<mi>t</mi>
<mo>-</mo>
<mi>L</mi>
<mo>+</mo>
<mn>1</mn>
</mrow>
<mi>t</mi>
</munderover>
<msub>
<mi>s</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>m</mi>
</mrow>
</msub>
</mrow>
<mi>t</mi>
</mfrac>
<mo>)</mo>
</mrow>
<mn>2</mn>
</msup>
<mo>&rsqb;</mo>
</mrow>
<mi>L</mi>
</mfrac>
</mtd>
<mtd>
<mrow>
<mi>L</mi>
<mo>&le;</mo>
<mi>t</mi>
</mrow>
</mtd>
</mtr>
</mtable>
</mfenced>
<mo>-</mo>
<mo>-</mo>
<mo>-</mo>
<mrow>
<mo>(</mo>
<mn>2</mn>
<mo>)</mo>
</mrow>
</mrow>
Step 4：Based on the Epanechnikov kernel functions of formula (4), x is obtainedj,tProbability density function fj(x) (j=
1 ..., K), as shown in formula (3)：
<mrow>
<msub>
<mi>f</mi>
<mi>j</mi>
</msub>
<mrow>
<mo>(</mo>
<mi>x</mi>
<mo>)</mo>
</mrow>
<mo>=</mo>
<mfrac>
<mn>1</mn>
<mrow>
<mi>m</mi>
<mo>&times;</mo>
<msub>
<mi>h</mi>
<mi>j</mi>
</msub>
</mrow>
</mfrac>
<munderover>
<mo>&Sigma;</mo>
<mrow>
<mi>t</mi>
<mo>=</mo>
<mn>1</mn>
</mrow>
<mi>m</mi>
</munderover>
<mi>V</mi>
<mrow>
<mo>(</mo>
<mfrac>
<mrow>
<mi>x</mi>
<mo>-</mo>
<msub>
<mi>x</mi>
<mrow>
<mi>j</mi>
<mo>,</mo>
<mi>t</mi>
</mrow>
</msub>
</mrow>
<msub>
<mi>h</mi>
<mi>j</mi>
</msub>
</mfrac>
<mo>)</mo>
</mrow>
<mo>-</mo>
<mo>-</mo>
<mo>-</mo>
<mrow>
<mo>(</mo>
<mn>3</mn>
<mo>)</mo>
</mrow>
</mrow>
Wherein, hjFor Density Estimator bandwidth, its value is obtained according to Scott rules, as shown in formula (5), Epanechnikov
Shown in the calculation expression of kernel function V such as formula (4)；
hj=2.345 σj×m-0.2 (5)
Wherein, σjFor all sliding window variance x in j-th of data flowj,tStandard deviation；
Step 5：Calculate the abnormal decision threshold u of each data flow sliding window variancej(j=1 ..., K), as shown in formula (6)；
<mrow>
<msub>
<mi>u</mi>
<mi>j</mi>
</msub>
<mo>=</mo>
<msubsup>
<mi>F</mi>
<mi>j</mi>
<mrow>
<mo>-</mo>
<mn>1</mn>
</mrow>
</msubsup>
<mrow>
<mo>(</mo>
<mn>0.9</mn>
<mo>)</mo>
</mrow>
<mo>-</mo>
<mo>-</mo>
<mo>-</mo>
<mrow>
<mo>(</mo>
<mn>6</mn>
<mo>)</mo>
</mrow>
</mrow>
Wherein, functionFor density function fj(x) cumulative distribution function Fj(x) inverse function；
Using fuzzy set " normal ", "abnormal", " severely subnormal " to data flow signal characteristic xj,tDivided, and used respectively
Symbol A1、A2And A3Represent three above fuzzy set；Traffic spike feature xj,tTo the degree of membership of fuzzy set " normal "As shown in formula (7),
Traffic spike feature xj,tTo the degree of membership of fuzzy set "abnormal"As shown in formula (8),
Wherein,
Traffic spike feature xj,tTo the degree of membership of fuzzy set " severely subnormal "As shown in formula (9),
Wherein,
Step 6：Utilize N group training datas [Xi,Zi] (i=1 ..., N) extraction fuzzy rule, as shown in formula (10)；
Regular Ri：IfAnd ..., andIt is Z then to invade regioni(10)
Wherein, fuzzy rule is divided into Indistinct Input and fuzzy output two parts, X in formula (10)i=[x1,i,x2,i,...,xK,i]
(i=1 ..., N) is K data flow signal characteristic of i-th group of training data, ZiRegion is invaded for i-th group of training data, by ring
Border is divided into g region, and uses Zone respectively1,...,ZonegRepresent, then have Zi∈{Zone1,Zone2,...,Zoneg, orderRepresent signal characteristic xj,iThe fuzzy set of affiliated degree of membership maximum, i.e.,：
Step 7：The excitation density ω of the N number of fuzzy rule built in calculation procedure sixi, such as formula (12)；
Step 8：The N number of regular confidence level CF built in calculation procedure sixi, as shown in formula (13)；
Wherein, P for it is N number of rule in regular RiThere is the regular set of identical Indistinct Input, have N in set PpA rule, it is corresponding
Excitation density beC for it is N number of rule in regular RiThere is the identical fuzzy regular collection output and input
Close, have N in set CCA rule, corresponding excitation density are
Step 9：Fuzzy rule merges, and for there is the rule of identical Indistinct Input and fuzzy output, only retains maximum confidence
That rule, the fuzzy inference system of structure fuzzy rule base S, wherein, the structure of fuzzy rule base S is as follows：
Rule 1：IfAnd ..., andIt is Z then to invade region1Confidence level be CF1
Rule 2：IfAnd ..., andIt is Z then to invade region2Confidence level be CF2
… … …
Regular N'：IfAnd ..., andIt is Z then to invade regionN'Confidence level be CFN'
Wherein, N' is the fuzzy rules after merging,For traffic spike feature xj(j=1,2 ..., K) it is subordinate to
The fuzzy set of category degree maximum, i.e.,Fuzzy output Z1,Z2,...,ZN'∈{Zone1,
Zone2,...,ZonegIt is invasion region；
Step 10：Signal data stream in each real-time monitoring of environmental of MP；
Step 11：Detect the set of data flows A={ S in dynamic environment1,...,SKWhether occur because of wireless access point increase
Or the set of data flows element variation caused by failure, if the element in set of data flows A changes, the data flow member of change
Element set is denoted as A', A'={ S1,...,SK', wherein, K' is the number of data streams after change, enters step 12, otherwise, into
Enter step 14；
Step 12：Newly there is the duration t of set of data flows A' in record environment, if t exceedes given threshold td, then judge
Set of data flows in environment changes, and enters step 13, otherwise, enters step 14；
Step 13：Adaptive updates fuzzy rule：
Emerging data flow, i.e. S caused by increasing due to wireless access pointj∈ A' andSignal characteristic xj,tBy its
New fuzzy set is divided into without the Central Shanxi Plain, degree of membership is set to 1, and fuzzy set " unrelated " uses A4Represent, i.e.,Utilize
Formula (3) calculates the probability density function f of the signal characteristic of emerging data flowj(x), and using formula (6) calculate newly to go out
Existing data flow SjAbnormal decision threshold
Data flow i.e. S to causing disappearance due to wireless access point failurej∈ A andSignal characteristic xj,tObscured
Division is changed to " unrelated ", its degree of membership is set to 1, i.e.,
Step 14：Judge the signal characteristic x of each data flow in dynamic environmentj,t(j=1,2 ..., K') whether more than each right
The abnormal decision threshold answeredIf the signal characteristic of each data flow is respectively less than respective exception
Decision threshold, then judge that signal characteristic is normal at this time and in monitoring of environmental without invasion, enter step 15, otherwise, judge at this time
There is the appearance of invasion situation in signal characteristic exception and monitoring of environmental, enter step 16；
Step 15：By normal traffic spike feature xj,t(j=1 ..., K') substitute into Step 4: corresponding in step 13
Data flow, the number of increase normal signal feature recalculates the probability density of each traffic spike feature using formula (3)
Function, abnormal decision threshold is recalculated using formula (6)And enter step 10；
Step 10 six：It will be judged as the signal characteristic x of abnormal data stream in step 14j,t(j=1 ..., K') carry out fuzzy draw
Divide to build Indistinct Input, as shown in formula (14)：
If x1,tIt isAnd x2,tIt is..., and xK',tIt is
Wherein, xj,t(j=1 ..., K') is the corresponding signal characteristic of each data flow,For corresponding data
Flow signal characteristic xj,tThe fuzzy set of degree of membership maximum；
Step 10 seven：Rule in Indistinct Input and fuzzy rule base that step 10 six is built is matched, if fuzzy rule
It is regular matching in storehouse, then 19 are entered step, otherwise, enters step 18；
Step 10 eight：Set distance between fuzzy set as：D (" normal ", "abnormal")=1, D ("abnormal", " severely subnormal ")
=1, D (" severely subnormal ", " unrelated ")=1, D (" normal ", " severely subnormal ")=2, D (" normal ", " unrelated ")=3, D is (" different
Often ", " unrelated ")=2, calculate Xt=[x1,t,...,xK',t] structure Indistinct Input and rule base S in regular similitude,
As shown in formula (15)；
Wherein, RqFor q-th of rule in rule base S, M is the fuzzy rules in rule base S,For in step 10 six to xj,t(j
=1 ..., K') division fuzzy set, v represent degree of membership,For regular RqIn j-th of traffic spike feature xj,tMost
It is subordinate to fuzzy set greatly, in M rule, finds out the highest rule R of Indistinct Input similitude built with step 10 sixq', such as
Shown in formula (16)；
S(X(t),Rq')≥S(X(t),Rq), (q=1 ... M), q' ∈ 1,2 ..., and M } formula (16)
In formula (16), Rq'For the highest rule of Indistinct Input similitude built with abnormal data stream signal characteristic, Rq''s
Fuzzy output is abnormal data stream signal characteristic Xt=[x1,t,x2,t,...,xk',t] corresponding intrusion detection result；
Utilize XtThe Indistinct Input of structure and rule Rq'Fuzzy output, build new fuzzy rule Rnew, utilize regular RnewExpand
Fill fuzzy rule base S；Regular RnewElect as and XtThe matched rule of Indistinct Input of structure, enters step 20；
Step 10 nine：Selection and X in the databasetThe matched strictly all rules of Indistinct Input of structure, selects the highest rule of matching degree
Fuzzy output then is positioning result；Shown in rule match degree such as formula (17)；
Mq=ωq×CFq, (q=1 ..., M) (17), MqRepresent rule match degree；
Select the rule of matching degree maximumIt meets formula (18)；
Represent maximum rule match degree；
RuleElect as and XtThe matched rule of Indistinct Input of structure；
Step 2 ten：With XtThe fuzzy output of the Indistinct Input matched rule of structure is intrusion detection positioning result, output invasion inspection
Measure position as a result, and terminate intrusion detection positioning.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510315738.1A CN104955149B (en) | 2015-06-10 | 2015-06-10 | The passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510315738.1A CN104955149B (en) | 2015-06-10 | 2015-06-10 | The passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104955149A CN104955149A (en) | 2015-09-30 |
| CN104955149B true CN104955149B (en) | 2018-04-27 |
Family
ID=54169403
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510315738.1A Active CN104955149B (en) | 2015-06-10 | 2015-06-10 | The passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104955149B (en) |
Families Citing this family (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| TWI581652B (en) * | 2015-11-05 | 2017-05-01 | Chunghwa Telecom Co Ltd | Energy - saving system and method based on wireless signal strength |
| CN107153584A (en) * | 2016-03-03 | 2017-09-12 | 中兴通讯股份有限公司 | Method for detecting abnormality and device |
| TWI602407B (en) * | 2016-09-13 | 2017-10-11 | 微波資訊科技有限公司 | An invading detecting system and method based on the sinr estimation |
| CN107103302B (en) * | 2017-04-26 | 2020-04-17 | 重庆邮电大学 | Behavior extraction method based on optimal detection threshold |
| CN107333233B (en) * | 2017-05-23 | 2020-04-28 | 北京中电普华信息技术有限公司 | Intrusion detection method and device for power distribution and utilization communication network |
| CN109274440B (en) * | 2018-10-10 | 2021-05-18 | 重庆邮电大学 | Passive intrusion detection method based on environmental characteristic self-adaptive screening |
| CN109461295B (en) * | 2018-12-07 | 2021-06-11 | 连尚（新昌）网络科技有限公司 | Household alarm method and equipment |
| CN109784282A (en) * | 2019-01-18 | 2019-05-21 | 重庆邮电大学 | Passive type personnel motion detection and method for tracing based on signal coherence feature |
| CN110276921B (en) * | 2019-07-08 | 2021-04-06 | 重庆邮电大学 | Indoor invasion and spatial structure change identification method based on wireless signal characteristics |
| CN112785142B (en) * | 2021-01-19 | 2023-11-24 | 翰克偲诺水务集团有限公司 | Intelligent work party early warning method and system for sewage treatment equipment of Internet of things |
| CN115297440A (en) * | 2022-08-12 | 2022-11-04 | 中建八局第二建设有限公司 | Non-cooperative indoor personnel counting, positioning and external intrusion detection method |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102223710B (en) * | 2003-06-27 | 2015-10-14 | 高通股份有限公司 | For the method and apparatus of wireless network mixed positioning |
| CN101639527B (en) * | 2009-09-03 | 2011-11-23 | 哈尔滨工业大学 | K nearest fuzzy clustering WLAN indoor locating method based on REE-P |
| US9103916B2 (en) * | 2012-05-02 | 2015-08-11 | Texas Instruments Incorporated | Apparatus and method for indoor positioning |
| CN103476118B (en) * | 2013-09-29 | 2016-03-23 | 哈尔滨工业大学 | A kind of WLAN indoor location fingerprint positioning method for monitoring in real time |
-
2015
- 2015-06-10 CN CN201510315738.1A patent/CN104955149B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN104955149A (en) | 2015-09-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104955149B (en) | The passive intrusion detection localization methods of indoor WLAN based on fuzzy rule renewal | |
| Abdelnasser et al. | SemanticSLAM: Using environment landmarks for unsupervised indoor localization | |
| Lv et al. | The discovery of personally semantic places based on trajectory data mining | |
| CN104736968B (en) | Mass-rent indoor positioning | |
| Li et al. | Smart home monitoring system via footstep-induced vibrations | |
| CN103176164B (en) | Based on the Multi-Target Passive Tracking method of wireless sensor network | |
| KR101510458B1 (en) | Location information representation method, location information processing method, location information model constructing method, and locational information processing apparatus | |
| CN107277765A (en) | A kind of mobile phone signaling track preprocess method based on cluster Outlier Analysis | |
| Anil Kumar et al. | Development of flood forecasting system using statistical and ANN techniques in the downstream catchment of Mahanadi Basin, India | |
| CN104936148A (en) | Indoor positioning method for WIFI (Wireless Fidelity) based on fuzzy KNN (k-Nearest Neighbor) | |
| Xu et al. | Self-adapting multi-fingerprints joint indoor positioning algorithm in WLAN based on database of AP ID | |
| CN104394588A (en) | Indoor positioning method based on Wi-Fi fingerprints and multi-dimensional scaling analysis | |
| CN103491627B (en) | A kind of closely real-time accurate positioning method of integrated many algorithms | |
| CN108362289A (en) | A kind of mobile intelligent terminal PDR localization methods based on Multi-sensor Fusion | |
| Tu et al. | Epidemic contact tracing with campus WiFi network and smartphone-based pedestrian dead reckoning | |
| CN106021290A (en) | Method for social network association excavation based on multi-scale geographic information | |
| CN106454750A (en) | Multi-region indoor safety positioning method based on compressed sensing technology | |
| CN110022530A (en) | A kind of wireless location method and system for the underground space | |
| CN105844168B (en) | Method for secret protection and device for intelligent perception | |
| Wang et al. | An adaptive indoor positioning method using multisource information fusion combing Wi-Fi/MM/PDR | |
| Mantoro et al. | Extreme learning machine for user location prediction in mobile environment | |
| Zheng et al. | An adaptive framework coping with dynamic target speed for device-free passive localization | |
| CN106879065A (en) | A kind of Wi-Fi indoor orientation methods based on improvement WKNN | |
| Maekawa et al. | How well can a user’s location privacy preferences be determined without using GPS location data? | |
| Zhang et al. | Dual-band wi-fi based indoor localization via stacked denosing autoencoder |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |