CN115623531B - Hidden monitoring equipment discovering and positioning method using wireless radio frequency signal - Google Patents
Hidden monitoring equipment discovering and positioning method using wireless radio frequency signal Download PDFInfo
- Publication number
- CN115623531B CN115623531B CN202211504490.XA CN202211504490A CN115623531B CN 115623531 B CN115623531 B CN 115623531B CN 202211504490 A CN202211504490 A CN 202211504490A CN 115623531 B CN115623531 B CN 115623531B
- Authority
- CN
- China
- Prior art keywords
- time
- hidden
- hidden monitoring
- equipment
- monitoring equipment
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 41
- 238000000034 method Methods 0.000 title claims abstract description 37
- 238000004891 communication Methods 0.000 claims abstract description 27
- 238000013145 classification model Methods 0.000 claims abstract description 14
- 238000001228 spectrum Methods 0.000 claims abstract description 6
- 238000012806 monitoring device Methods 0.000 claims description 61
- 238000004364 calculation method Methods 0.000 claims description 18
- 230000002776 aggregation Effects 0.000 claims description 15
- 238000004220 aggregation Methods 0.000 claims description 15
- 238000001514 detection method Methods 0.000 claims description 14
- 239000011159 matrix material Substances 0.000 claims description 9
- 239000013598 vector Substances 0.000 claims description 9
- 230000005540 biological transmission Effects 0.000 claims description 8
- 230000000630 rising effect Effects 0.000 claims description 6
- 238000012549 training Methods 0.000 claims description 6
- 238000005516 engineering process Methods 0.000 claims description 5
- 238000012360 testing method Methods 0.000 claims description 5
- 238000013507 mapping Methods 0.000 claims description 3
- 238000005259 measurement Methods 0.000 claims description 3
- 230000000737 periodic effect Effects 0.000 claims description 3
- 238000005070 sampling Methods 0.000 claims description 3
- 230000008901 benefit Effects 0.000 abstract description 5
- 230000008569 process Effects 0.000 abstract description 4
- 230000009286 beneficial effect Effects 0.000 abstract description 2
- 238000010586 diagram Methods 0.000 description 3
- 239000000284 extract Substances 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000007547 defect Effects 0.000 description 2
- 238000012216 screening Methods 0.000 description 2
- 238000000060 site-specific infrared dichroism spectroscopy Methods 0.000 description 2
- 240000007594 Oryza sativa Species 0.000 description 1
- 235000007164 Oryza sativa Nutrition 0.000 description 1
- 230000009471 action Effects 0.000 description 1
- 230000003044 adaptive effect Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 239000000428 dust Substances 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000005672 electromagnetic field Effects 0.000 description 1
- 230000004807 localization Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 239000002184 metal Substances 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 235000009566 rice Nutrition 0.000 description 1
- 230000035945 sensitivity Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/08—Testing, supervising or monitoring using real traffic
-
- G—PHYSICS
- G01—MEASURING; TESTING
- G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
- G01S5/00—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations
- G01S5/02—Position-fixing by co-ordinating two or more direction or position line determinations; Position-fixing by co-ordinating two or more distance determinations using radio waves
- G01S5/0257—Hybrid positioning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W64/00—Locating users or terminals or network equipment for network management purposes, e.g. mobility management
- H04W64/006—Locating users or terminals or network equipment for network management purposes, e.g. mobility management with additional information processing, e.g. for direction or speed determination
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Radar, Positioning & Navigation (AREA)
- Remote Sensing (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention relates to a hidden monitoring equipment discovering and positioning method by utilizing wireless radio frequency signals, which comprises the following steps: constructing a hidden monitoring equipment classification model in an off-line manner; setting a time period for discovering the hidden monitoring equipment, and carrying out time slice division to discover an active communication channel; designing a self-adaptive spectrum sensing method of the equipment, and determining a communication channel for hiding the discovery and positioning of the monitoring equipment; collecting wireless flow data packets on line, grouping the wireless flow data packets according to physical addresses, and identifying the type of the hidden monitoring equipment; and the equipment positioning is realized by utilizing the wireless flow bit rate and the wireless signal strength of the hidden monitoring equipment. The beneficial effects of the invention are: the method can be deployed on mobile equipment such as a smart phone or a tablet personal computer of a user, has the advantages of universality, easiness in deployment, automation in discovery process and high positioning accuracy, and has great social public benefit significance and economic value.
Description
Technical Field
The invention relates to the technical field of hidden device discovery, in particular to a method for discovering and positioning hidden monitoring devices by utilizing wireless radio frequency signals.
Background
The existing detection method for hiding the monitoring equipment comprises the following steps: 1) Based on the detection method of light reflection, signs of minute reflection from the camera lens are detected. There are studies to detect hidden monitoring devices by detecting infrared rays emitted by an infrared camera in dark light, but this technology can only detect in dark light and can only detect the infrared camera. The research also uses an LED lattice to actively emit laser, and hidden equipment is found by detecting the image of the laser lattice after being refracted by a lens, but the technology can only detect under the condition of dim light and is easy to misjudge; 2) Electromagnetic leakage from an operating camera is identified based on a detection method of the electromagnetic field. The method has the main defects that the interference items are too many, and the high magnetic field can be detected when the interference items approach an electronic device or a piece of metal, so that the false alarm is frequently detected; 3) The detection method based on wireless spectrum sensing, but the prior art fails in two cases, namely, a lawless person can use a separate wireless network for the hidden monitoring device and provide the user with access to a separate guest network, and in another case, the hidden monitoring device is allocated to a different 802.11 wireless channel, encryption is enabled (for example, WPA2/WPA 3), and the network SSID of the device connection is hidden.
Disclosure of Invention
The invention aims to overcome the defects in the prior art and provides a hidden monitoring device discovering and positioning method by utilizing wireless radio frequency signals. The technical principle of the invention is that video and audio can be continuously generated in the process of hiding the data recorded by the monitoring equipment, and the audio and the video can generate unique audio and video stream data under the action of a check coding mechanism. Thus, if these invisible network traffic pattern characteristics can be captured, the presence of the hidden camera can be sent and further located. The method comprises the following specific steps:
s1, collecting transmission data packets of various hidden monitoring devices in an off-line stage, designing device identification characteristics by using inherent flow patterns and time fingerprints of different devices, and training a multi-classification model to find the classes of the hidden monitoring devices;
s2, setting a time period for discovering the hidden monitoring equipment, dividing the time period into a plurality of time slices with fixed lengths, adopting periodic polling to each time slice, and taking a communication channel receiving a polling reply beacon as an active communication channel;
s3, designing a self-adaptive frequency spectrum sensing method of the equipment, selecting a wireless communication channel for hiding the discovery and positioning of the monitoring equipment from all active communication channels of each time slice, and collecting all wireless flow data packets of the communication channel;
s4, grouping the wireless flow data packets collected in the step S3 according to the physical addresses of the devices, and inputting each group of wireless flow data packets into the device classification model established in the step S1 to obtain the device types corresponding to the group of wireless flow data packets;
s5, in the step S4 of detecting environment movement record, hiding the rising and falling conditions of the wireless flow bit rate of the monitoring equipment, and carrying out coarse-grained position location on the hidden monitoring equipment; and then, combining the wireless signal strength measurement value with an inertial ranging technology to obtain a final positioning result of the hidden monitoring equipment.
Preferably, S1 comprises:
s101, when different monitoring devices communicate with a gateway, the gateway records a plurality of communication data traffic packets of different monitoring device setting stages, and analyzes traffic packet metadata, wherein attribute information extracted from each data packet comprises: the length of the physical address frame; controlling a frame; a duration of time; a physical address of a network access point; a source device physical address; a physical address of the destination device; a link layer protocol; a transport layer protocol; packet length; an IP address;
s102, constructing time aggregation characteristics for each attribute information; designing a multi-time scale feature scheme to select a time window suitable for each device transmission mode; first, a maximum sensing time window is defined
For each characteristic attribute, for each time instant +>
Defining different time offsets>
To set time windows of different lengths>
In which
(ii) a Calculating the characteristics of each attribute in each time window by using an aggregation function according to the attribute information of each time window, and splicing and connecting calculation results in series to obtain the equipment identification characteristics of the window; the aggregation function specifically comprises an average value, a standard deviation, a median, a maximum value, a minimum value, a sum, an entropy and a histogram;
s103, standardizing the time aggregation characteristics and eliminating the correlation redundant characteristics;
s104, for each monitoring device
The gateway also records data packets &fromthe device>
Is reached time->
It is added to the data packet arrival time sequence->
To the end of (c). L is a preset empirical threshold when the gateway receives L +1 slave devices +>
Is greater than or equal to>
，
，…,
Then utilize>
Counting a sequence of data packet arrival intervals>
In which>
The calculation method of (A) is as follows:
s105, calculating time interval sequencePAIThe distribution characteristics of the distribution are obtained by the sectional density, and the calculation method is as follows: time interval
Average score->
Sub-time interval (` or `)>
). ComputingPAIThe number of middle time intervals falling in each subinterval is recorded as @>
. Order toSUMIs composed ofPAIIn which the time interval falls in a time interval +>
The segment density calculation method is as follows:
the
Dimension sequence->
Is recorded as device>
The time fingerprint of (c).
S106, for each data packet, the time aggregation characteristics and the time series distribution characteristics processed in the step S103 are processed
Splicing to form sample characteristic vectors, and establishing a hidden monitoring equipment classification model by adopting the following method: and constructing an integrated classifier by using the Hough tree as a base classifier, creating a classifier pool, and training the examples. When the data stream is input, a fast Hough drift detection method is used for detection, if concept drift occurs, the current data stream instance is cached in a window, a current base classifier is reset, the base classifier is retrained by using the instance in the window, and the base classifier is added into a classifier pool. Updating the base classifier according to the classification accuracy of the test data, and when the base classifier is added, adding one base classifier at a timeAnd the basic classifier with the weight value smaller than the preset threshold value is deleted while the basic classifier is increased according to the principle of the basic classifier. When the base classifier is reduced, the base classifier with the worst performance is deleted according to the threshold value. Finally, the number of base classifiers for the best ensemble classifier is determined.
Preferably, S3 comprises:
s301, for all active wireless communication channels in the time slice
Randomly initializing its selection score between 0 and 1
；
S302, each device related to the time slice collection data packet
Calculate its selection score ≥>
；
S303, utilizing equipment
Is selected score->
Obtaining and device>
And selecting the communication channel with the highest selection score as a data packet acquisition channel for discovering the hidden monitoring equipment in the time slice.
Preferably, S302 includes:
s3021, if the slave device
The issued data packet is greater than a preset threshold value>
Then the device in the time slice is used
Selection of score->
Set to 0;
s3022, if the slave device
Issued data packets which are smaller than a preset threshold value>
Picking device>
The data packet in the time slice is taken as input, and the device classification model established in the off-line stage in step S1 is used to obtain the device->
The device type of (d); counting the devices in the time slice>
Is counted as ≧ based on the average packet inter-arrival time>
(ii) a Calculating device/s using the formula>
Selection score of (2):
wherein,
indicating that the last time a message was received from the device in the time slice>
The time of the data packet of (a), device for combining or screening>
Indicates the current time instant, <' > is>
Representing a pair>
The result of the calculation of (2) is rounded up.
Preferably, in S4, for any device, the center of the time window is defined as
Which corresponds to the arrival time of the data packet and extracts the feature vector { -greater than or equal to the time period in accordance with step S102>
Then the device type prediction probability is:
where K is the number of device types,
built for step S1 for a device type +>
In conjunction with a classifier, in combination with a classifier>
Is at a time slice->
Classifying a device as +>
The probability of (d); feature vector +>
In a final predictive device tag of &>
：
Within a given time period for discovering hidden monitoring devices
And performing majority voting to obtain a final type prediction label of the equipment.
Preferably, S5 includes:
s501, automatically extracting an intervention time window by using an accelerometer on intelligent equipment, recording correspondingly found rising and falling conditions of the wireless flow bit rate of the hidden monitoring equipment through multiple movements and stops of a user, judging whether the hidden monitoring equipment and the user are located in the same space, and realizing coarse-grained positioning of the hidden monitoring equipment;
s502, collecting when the user walks in the detection environment
A sample, where x and y are coordinates obtained by the inertial navigation estimation method with respect to the initial point of the user' S initial walking, and RSS represents the signal strength of the hidden monitoring device found in step S4. The method comprises the following steps of carrying out grid division on a walking area of a user, and estimating grids without observing signal strength based on the following steps:
first, for mesh that is not observed
Selecting a rectangular area comprising N grids based on the grid as a center>
；
Secondly, according to the spatial similarity of the wireless radio frequency information, grid coordinates are matched
And its signal strength->
The mapping function of (c) is expressed as follows:
wherein,
is a multi-quad radial basis function, parameter->
For the distance between two grids to be calculated, is->
Represent
Grid to grid &>
N is the number of meshes of the rectangular area.
The following 3 rd order polynomial is used for calculation:
wherein
To estimate the parameters.
Will be provided with
Rewriting as matrix form:
Wherein:
，
。
c represents a matrix of the signal strengths of the grid,
and expressing a radial basis function, substituting all networks with known signal strength in a rectangular area into the matrix equation, and calculating all estimation parameters.
In S502, all areas are divided into grids
The data set is fitted to a form of ^ h>
Sampling to generate a small area mesh (such as 1 x 1 cm) as a query point, generating a three-dimensional linear curved surface at each point based on triangulation interpolation, and extracting the maximum value of the area of the curved surface as a final positioning result of the device position.
The beneficial effects of the invention are: the hidden monitoring equipment discovering and positioning method utilizing the wireless radio frequency signals can be deployed on mobile equipment such as a smart phone or a tablet personal computer of a user, has the advantages of universality, easiness in deployment, automatic discovering process and high positioning accuracy, and has great social public benefit significance and economic value.
Drawings
FIG. 1 is a schematic diagram of an application scenario provided herein;
FIG. 2 is a flow chart providing hidden monitoring device discovery and location of the present application;
FIG. 3 is a flow chart of a hidden monitoring device classification model configuration provided herein;
fig. 4 is a flowchart of adaptive spectrum sensing for a hidden monitoring device provided in the present application;
FIG. 5 is a flow chart of hidden monitoring device positioning provided by the present application;
FIG. 6 is a schematic diagram of a user walking track area meshing provided by the present application;
fig. 7 is a surface fitting graph for regional radio frequency signal strength estimation provided in the present application.
Detailed Description
The present invention will be further described with reference to the following examples. The following examples are set forth merely to aid in the understanding of the invention. It should be noted that, for a person skilled in the art, several modifications can be made to the invention without departing from the principle of the invention, and these modifications and modifications also fall within the protection scope of the claims of the present invention.
Example 1:
a suitable scenario for the invention involves a lawbreaker placing a hidden surveillance device to monitor a user in an unfamiliar environment (e.g., hotel rooms or public restrooms, etc.), as shown in fig. 1. A lawbreaker would like to hide monitoring devices to monitor users/guests entering this strange environment, and the user would like to discover and locate these hidden monitoring devices. Lawbreakers and users all have to interact with three key resources: physical environment, hidden monitoring devices and wireless networks. The physical environment applicable to the invention can be a single room in a hotel or a complex multi-room setting in a public place. The hidden monitoring device may be of various types, such as a camera, a recording pen, a speaker, a plug, a dust collector, and the like. The hidden monitoring equipment carries out flow transmission through a wireless network controlled by a lawless person. The capabilities and resources of the lawbreakers are expressed as follows:
the physical environment: lawbreakers have completely controlled the environment in advance, installing and hiding the monitoring devices.
Hide the supervisory equipment: lawbreakers purchase and place off-the-shelf monitoring devices to monitor users and can control various device settings, such as resolution, sensitivity, etc., through the device API. Lawbreakers can also physically disguise devices such as cameras hidden in thermostats or smart plugs doubling as cameras.
A wireless network: lawbreakers can gain full access to 802.11 wireless networks and access points and can take a number of measures to hide the internet of things devices. For example, a separate wireless network may be used for the internet of things device and the user is provided access to a separate guest network, and the device may also be assigned to a different 802.11 wireless channel, enabling encryption (e.g., WPA2/WPA 3) to hide the SSID of the network to which the internet of things device is connected.
The user's capabilities and resources are expressed as follows:
physical environment: the user can search and move around in the physical environment.
Hiding the monitoring device: the user has no knowledge of the hidden surveillance devices and does not know how many hidden surveillance devices are in this unfamiliar environment.
A wireless network: user access to the wireless network is limited; for example, access may be allowed to a guest network that may be different from the network in which the hidden monitoring device operates, but encrypted broadcast wireless traffic packets may be sniffed wirelessly.
Example 2:
considering that a user mostly does not carry expensive hardware or special detection equipment in an unfamiliar environment (such as a hotel or a living room), the invention provides a hidden monitoring equipment discovering and positioning method by using a wireless radio frequency signal, the hidden monitoring equipment can be discovered and positioned only by using mobile equipment such as a smart phone or a tablet personal computer of the user, and the method has great social and economic significance.
Specifically, as shown in fig. 2, the steps of the present invention include:
s1, collecting transmission data packets of various hidden monitoring devices in an off-line stage, designing device identification characteristics by using inherent flow patterns and time fingerprints of different devices, and training a multi-classification model to find the classes of the hidden monitoring devices;
s2, setting a time period for discovering the hidden monitoring equipment, dividing the time period into a plurality of time slices with fixed lengths, adopting periodic polling to each time slice, and taking a communication channel receiving a polling reply beacon as an active communication channel;
s3, designing a self-adaptive frequency spectrum sensing method of the equipment, selecting a wireless communication channel for hiding the discovery and positioning of the monitoring equipment from all active communication channels of each time slice, and collecting all wireless flow data packets of the communication channel;
s4, grouping the wireless flow data packets collected in the step S3 according to the physical addresses of the devices, and inputting each group of wireless flow data packets into the device classification model established in the step S1 to obtain the device types corresponding to the group of wireless flow data packets;
s5, in the step S4 of detecting environment movement record, hiding the rising and falling conditions of the wireless flow bit rate of the monitoring equipment, and carrying out coarse-grained position location on the hidden monitoring equipment; and then, combining the wireless signal strength measurement value with an inertial ranging technology to obtain a final positioning result of the hidden monitoring equipment.
As shown in fig. 3, S1 includes:
s101, when different monitoring devices communicate with a gateway, the gateway records a plurality of communication data traffic packets of different monitoring device setting stages, and analyzes traffic packet metadata, wherein attribute information extracted from each data packet comprises: the length of the physical address frame; controlling a frame; a duration of time; a physical address of a network access point; a source device physical address; a physical address of the destination device; a link layer protocol; a transport layer protocol; packet length; an IP address;
s102, constructing time aggregation characteristics for each attribute information; designing a multi-time scale feature scheme to select a time window suitable for each device transmission mode; first, a maximum sensing time window is defined
For each characteristic attribute, for each time instant +>
Defining different time offsets>
To set time windows of different lengths>
Wherein
(ii) a Calculating the characteristics of each attribute in each time window by using an aggregation function according to the attribute information of each time window, and splicing and connecting calculation results in series to obtain the equipment identification characteristics of the window; the aggregation function specifically comprises an average value, a standard deviation, a median, a maximum value, a minimum value, a sum, an entropy and a histogram;
s103, standardizing the time aggregation characteristics, and eliminating the correlation redundant characteristics;
s104, for each monitoring device
The gateway also records data packets &fromthe device>
Is reached time->
It is added to the data packet arrival time sequence->
To the end of (c). L is a preset empirical threshold, and when the gateway receives L +1 slave devices->
Is greater than or equal to>
，
，…,
Then utilize->
Evaluating a sequence of data packet arrival intervals>
In which>
The calculation method is as follows:
s105, calculating time interval sequencePAIThe distribution characteristics are obtained by the sectional density, and the calculation method comprises the following steps: time interval
Averagely divide into>
Sub-time interval (` or `)>
). ComputingPAIThe number of middle time intervals falling in each subinterval is recorded as @>
. Order toSUMIs composed ofPAIIn falls in the time interval->
The segment density calculating method is as follows:
the device is
Dimension sequence>
Is recorded as device>
Time fingerprint of (2).
S106, for each data packet, the time aggregation characteristics and the time series distribution characteristics processed in the step S103
Splicing to form a sample characteristic vector, and establishing a hidden monitoring equipment classification model by adopting the following method: and constructing an integrated classifier by using the Hough tree as a base classifier, creating a classifier pool, and training the examples. When the data stream is input, a fast Hough drift detection method is used for detection, if concept drift occurs, the current data stream instance is cached in a window, a current base classifier is reset, the base classifier is retrained by using the instance in the window, and the base classifier is added into a classifier pool. And updating the base classifier according to the classification accuracy of the test data, and deleting the base classifier with the weight value smaller than a preset threshold value while increasing according to the principle of increasing one base classifier at a time when increasing the base classifier. When the base classifier is reduced, the base classifier with the worst performance is deleted according to the threshold value. Finally, the number of base classifiers for the best ensemble classifier is determined.
As shown in fig. 4, S3 includes:
s301, for all active wireless communication channels in the time slice
Randomly initializing its selection score between 0 and 1
；
S302, each device related to the time slice collection data packet
Calculating a selection score thereof>
；
S303, utilizing equipment
Selection of score->
Obtaining and device>
And selecting the communication channel with the highest selection score as a data packet acquisition channel for discovering the hidden monitoring device in the time slice.
If in S303, the wireless communication channel is active
If there is a transmitting device, the maximum value of the selection scores of all the devices transmitting on the wireless channel is used as the channel->
Is selected score of->
。
S302 comprises the following steps:
s3021, if the slave equipment
The issued data packet is greater than a preset threshold value>
Then the device is asserted on that time slice>
Is selected score->
Set to 0;
s3022, if the slave device
Issued data packets which are smaller than a preset threshold value>
Picking device>
Taking the data packet in the time slice as input, obtaining the device based on the device classification model established in the off-line stage in the step S1>
The device type of (d); statistics of the device in the time slice>
Is recorded as @, based on the average packet inter-arrival time>
(ii) a Calculating device/s using the formula>
The selection score of (2):
wherein,
indicating the last reception in the time slice from a device +>
The time of the data packet of (a), device for combining or screening>
Which is indicative of the current time of day,
represents a pair->
The result of the calculation of (a) is rounded up.
In S4, for any equipment, the center of the time window is defined as
Which corresponds to the arrival time of the data packet and extracts the feature vector { -greater than or equal to the time period in accordance with step S102>
Then the device type prediction probability is:
where K is the number of device types,
built for step S1 for a device type +>
In the multi-classifier of (4), in>
Is at a time slice>
Classifying a device as +>
The probability of (d); pick up the feature vector>
Is flagged as +>
：
Within a given time period for discovering hidden monitoring devices
And performing majority voting to obtain a final type prediction label of the equipment.
As shown in fig. 5, S5 includes:
s501, if the hidden monitoring device directly monitors the user (such as video recording or sound recording), when the user starts moving, the bit rate of the device transmission flow should be displayed to be obviously increased, and when the user stops, the bit rate should be displayed to be reduced. Therefore, the method and the device automatically extract the intervention time window by using the accelerometer on the intelligent device, record the correspondingly found wireless flow bit rate rising and falling conditions of the hidden monitoring device through multiple movements and stops of the user, judge whether the hidden monitoring device and the user are positioned in the same space, and realize coarse-grained positioning of the hidden monitoring device;
s502, collecting when the user walks in the detection environment
A sample, where x and y are coordinates obtained by an inertial navigation estimation method with respect to an initial point where a user starts to walk, and RSS represents the signal strength of the hidden monitoring device found in step S4; and (3) performing grid division (for example, dividing into 0.5 m by 0.5 m grids) on the walking area of the user, calculating the average observed signal intensity value of each grid, and then selecting the center of the grid with the maximum average signal intensity value as the positioning result of the hidden monitoring equipment. By way of example, fig. 6 shows a user walking track area meshing schematic diagram, wherein each black point represents a walking coordinate point of a user. The walking area in fig. 6 is divided into four grids a, B, C and D, each grid is provided with a plurality of walking coordinate points, the average observation signal intensity values of different grids can be obtained by calculating the signal intensity of all the walking coordinate points in each grid, and the positioning result of the hidden monitoring device can be determined. For example, when the average observed signal strength value of grid a is greater than the average observed signal strength values of grids B, C, and D, grid a is used as the positioning result of the hidden monitoring device.
In S502, the grid for which no signal strength is observed is estimated based on the following steps:
first, for mesh that is not observed
Selecting, centered on the gridRectangular area comprising N grids>
；
Secondly, according to the spatial similarity of the wireless radio frequency information, grid coordinates are matched
And its signal strength->
The mapping function of (a) is expressed as follows:
wherein,
is a multi-quad radial basis function, a parameter->
For the distance between two grids to be calculated, is->
Represents->
Grid to grid &>
N is the number of meshes of the rectangular area;
The following 3 rd order polynomial is used for calculation:
wherein
To estimate the parameters;
will be provided with
Rewriting is in matrix form:
Wherein:
，
；
c represents a matrix of the signal strengths of the grid,
and expressing a radial basis function, substituting all networks with known signal strength in a rectangular area into the matrix equation, and calculating all estimation parameters.
In S502, the pairs
The data set is fitted to a pattern->
Sampling to generate a small-area grid (such as 1 x 1 cm) as a query point, generating a three-dimensional linear curved surface on each point based on triangulation interpolation, and extracting the maximum value of the area of the curved surface as a final positioning result of the device position. Illustratively, FIG. 7 shows a surface fitting graph for regional radio frequency signal strength estimation, dividing a walking region into an A region, a B region, a C region and a D region, and determining the walking region according to the area in each region
The data set is fitted and,a corresponding->
A curved surface. In the surface, the X, Y, axis represents the planar position of the query point, and the Z axis represents the signal strength of the query point. And then, the final positioning result of the equipment position can be determined according to the maximum value of the area of the curved surface.
In order to verify effectiveness, 50 hidden monitoring devices are selected for experimental testing in an actual scene, and the experimental testing is as follows: a camera: 25, the number of the channels is 25; 15 recording pens are arranged; a microphone: 10, each category having multiple devices of the same type, to avoid overfitting the experimental results to a particular supplier. The experimental environment included 4: 1) 50 square meters of office; 2) Apartment of 26 square meters and 35 square meters; 3) 300 square meters laboratory.
The experimental results are shown in the table below, and the experimental results show that the method can achieve the precision equivalent to the method assuming the whole network access.
Table 1 hidden monitoring device discovery and localization effects
| Experimental Environment | Number of deployed hidden monitoring devices | Hidden monitoring device identification accuracy | Concealing positioning errors of |
| Office | |||
| 22 | 95.45% | 1.2m | |
| Apartment units (26 flat rice) | 12 | 91.7% | 0.8m |
| Apartment single body (35 square meter) | 18 | 94.5% | 1.1m |
| Laboratory | 50 | 96.0% | 1.5m |
In summary, the method and the device for detecting the hidden monitoring device in the space rapidly identify whether the hidden monitoring device exists in the space and perform accurate positioning by detecting whether the network flow mode specific to the hidden monitoring device exists in the environment, the detection process does not need to be accessed to a device network, does not need to provide any information for a user, can be deployed on a mobile phone or a tablet personal computer carried by the user, and have great social and economic benefits and values.
Claims (7)
1. A hidden monitoring device discovering and positioning method using wireless radio frequency signals is characterized by comprising the following steps:
s1, collecting transmission data packets of various hidden monitoring devices in an off-line stage, designing device identification characteristics by using inherent flow patterns and time fingerprints of different devices, and training a multi-classification model to find the classes of the hidden monitoring devices;
s2, setting a time period for discovering the hidden monitoring equipment, dividing the time period into a plurality of time slices with fixed lengths, adopting periodic polling to each time slice, and taking a communication channel receiving a polling reply beacon as an active communication channel;
s3, designing a self-adaptive frequency spectrum sensing method of the equipment, selecting a wireless communication channel for hiding the discovery and positioning of the monitoring equipment from all active communication channels of each time slice, and collecting all wireless flow data packets of the communication channel;
s4, grouping the wireless flow data packets collected in the step S3 according to the physical addresses of the devices, and inputting each group of wireless flow data packets into the device classification model established in the step S1 to obtain the device types corresponding to the group of wireless flow data packets;
s5, in the step S4 of detecting the environment movement record, hiding the rising and falling conditions of the wireless flow bit rate of the monitoring equipment, and carrying out coarse-grained position location on the hidden monitoring equipment; then, combining the wireless signal strength measurement value with an inertial ranging technology to obtain a final positioning result of the hidden monitoring equipment;
s1 comprises the following steps:
s101, when different monitoring devices communicate with a gateway, the gateway records a plurality of communication data traffic packets of different monitoring device setting stages, and analyzes traffic packet metadata, wherein attribute information extracted from each data packet comprises: the length of the physical address frame; controlling a frame; a duration of time; a physical address of a network access point; a source device physical address; a physical address of the destination device; a link layer protocol; a transport layer protocol; packet length; an IP address;
s102, constructing time aggregation characteristics for each attribute information; designing a multi-time scale feature scheme to select a time window suitable for each device transmission mode; first, a maximum sensing time window is defined
For each characteristic attribute, for each time instant +>
Defining different time offsets>
To set time windows of different lengths>
In which>
(ii) a Calculating the characteristics of each attribute in each time window by using an aggregation function according to the attribute information of each time window, and splicing and connecting calculation results in series to obtain the equipment identification characteristics of the window; the aggregation function specifically comprises an average value, a standard deviation, a median, a maximum value, a minimum value, a sum, an entropy and a histogram;
s103, standardizing the time aggregation characteristics, and eliminating the correlation redundant characteristics;
s104, for each monitoring device
The gateway also records data packets &fromthe device>
Is reached time->
Adding it to a sequence of arrival times in data packets->
End of (3); l is a preset empirical threshold, and when the gateway receives L +1 slave devices->
In a data packet>
，
，…,
Then utilize->
Counting a sequence of data packet arrival intervals>
Wherein is present>
The calculation method is as follows:
s105, calculating time interval sequencePAIThe distribution characteristics are obtained by the sectional density, and the calculation method comprises the following steps: time interval
Is averagely divided into>
A sub-time interval; calculating outPAIThe number of the middle time interval falling in each sub-interval is recorded as
(ii) a Order toSUMIs composed ofPAIIn which the time interval falls in a time interval +>
The segment density calculation method is as follows:
the device is
Dimension sequence->
Is recorded as device>
The time fingerprint of (a);
s106, for each data packet, the time aggregation characteristics and the time series distribution characteristics processed in the step S103 are processed
Splicing to form a sample characteristic vector, and establishing a hidden monitoring equipment classification model by adopting the following method: constructing an integrated classifier by using a Hough tree as a base classifier, creating a classifier pool, and training an example; detecting by using a fast Hough drift detection method when a data stream is input, caching a current data stream instance into a window if concept drift occurs, resetting a current base classifier, retraining the base classifier by using the instance in the window, and adding the base classifier into a classifier pool; updating the base classifier according to the classification accuracy of the test data, and deleting the base classifier with the weight value smaller than a preset threshold while increasing according to the principle of increasing one base classifier at a time when increasing the base classifiers; when the base classifiers are reduced, deleting the base classifier with the worst performance according to a threshold value; finally, the number of base classifiers for the best ensemble classifier is determined.
2. The hidden monitoring device discovering and locating method using wireless radio frequency signals according to claim 1, wherein S3 comprises:
s301, for all active wireless communication channels in the time slice
Initializing its selection score randomly between 0 and 1>
；
S302, each device related to the time slice collection data packet
Calculate its selection score
；
S303, utilization equipment
Is selected score->
Get and device->
And selecting the communication channel with the highest selection score as a data packet acquisition channel for discovering the hidden monitoring device in the time slice.
3. The hidden monitoring device discovering and locating method according to claim 2 utilizing wireless radio frequency signals, wherein S302 comprises:
s3021, if the slave device
The issued data packet is greater than a preset threshold value>
Then the device on that time slice is taken>
Selection of score->
Set to 0;
s3022, if the slave device
Issued data packets which are smaller than a preset threshold value>
Extracting device
Taking the data packet in the time slice as input, obtaining the device based on the device classification model established in the off-line stage in the step S1>
The device type of (d); statistics of the device in the time slice>
Is counted as ≧ based on the average packet inter-arrival time>
(ii) a Calculating device/s using the formula>
Selection score of (2):
wherein,
indicating the last reception in the time slice from a device +>
The time of the data packet of (a), device for selecting or keeping>
Which is indicative of the current time of day,
representing a pair>
The result of the calculation of (a) is rounded up.
4.The hidden monitoring device discovering and locating method according to claim 1 wherein in S4, for any device, the center of the time window is defined as
Corresponding to the packet arrival time and extracting a feature vector { (R) } for the time segment according to step S102>
Then the device type prediction probability is:
where K is the number of device types,
device type for which step S1 is designed>
In conjunction with a classifier, in combination with a classifier>
Is at a time slice->
Classifying a device as->
The probability of (d); pick up the feature vector>
Is flagged as +>
：
Within a given time period for discovering hidden monitoring devices
And performing majority voting to obtain a final type prediction label of the equipment.
5. The hidden monitoring device discovering and locating method according to claim 1 utilizing wireless radio frequency signals, wherein S5 comprises:
s501, an intervention time window is automatically extracted by an accelerometer on intelligent equipment, the rising and falling conditions of the wireless flow bit rate of the hidden monitoring equipment correspondingly found are recorded through multiple movements and stops of a user, whether the hidden monitoring equipment and the user are located in the same space or not is judged, and coarse-grained positioning of the hidden monitoring equipment is achieved;
s502, collecting when the user walks in the detection environment
A sample, wherein x and y are coordinates relative to an initial point where a user starts to walk obtained by an inertial navigation calculation method, and RSS represents the signal strength of the hidden monitoring device found in step S4; and carrying out grid division on a walking area of the user, calculating an average observation signal intensity value of each grid, and selecting a grid center with the maximum average signal intensity value as a positioning result of the hidden monitoring equipment.
6. The hidden monitoring device discovering and locating method according to claim 5 wherein in S502, the grid without observed signal strength is estimated based on the following steps:
first, for mesh that is not observed
Selecting a rectangular region including N meshes centering on the mesh
；
Secondly, according to the spatial similarity of the wireless radio frequency information, grid coordinates are matched
And its signal strength->
The mapping function of (a) is expressed as follows:
wherein,
is a multi-quad radial basis function, a parameter->
For the distance between two grids to be calculated>
Represents->
Grid to grid->
N is the number of meshes of the rectangular region;
The following polynomial of order 3 is used for calculation:
wherein
To estimate the parameters;
will be provided with
Rewriting as matrix form:
Wherein:
，
；
c represents a matrix of the strength of the grid signal,
and expressing a radial basis function, substituting all networks with known signal strength in a rectangular area into the matrix equation, and calculating all estimation parameters.
7. The hidden monitoring device discovering and locating method according to claim 6 wherein in S502 zones are gridded
The data set is fitted to a pattern->
Sampling to generate a small-area mesh as a query point, and triangulating the small-area mesh on each pointAnd (4) generating a three-dimensional linear curved surface by interpolation, and extracting the maximum value of the area of the curved surface as a final positioning result of the equipment position. />
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211504490.XA CN115623531B (en) | 2022-11-29 | 2022-11-29 | Hidden monitoring equipment discovering and positioning method using wireless radio frequency signal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211504490.XA CN115623531B (en) | 2022-11-29 | 2022-11-29 | Hidden monitoring equipment discovering and positioning method using wireless radio frequency signal |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115623531A CN115623531A (en) | 2023-01-17 |
| CN115623531B true CN115623531B (en) | 2023-03-31 |
Family
ID=84879556
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211504490.XA Active CN115623531B (en) | 2022-11-29 | 2022-11-29 | Hidden monitoring equipment discovering and positioning method using wireless radio frequency signal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115623531B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118714567A (en) * | 2024-08-28 | 2024-09-27 | 中国科学院信息工程研究所 | Equipment identification and access method and device based on radio frequency information and network traffic |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014210246A1 (en) * | 2013-06-28 | 2014-12-31 | Mcafee, Inc. | Rootkit detection by using hardware resources to detect inconsistencies in network traffic |
| CN108718257A (en) * | 2018-05-23 | 2018-10-30 | 浙江大学 | A kind of wireless camera detection and localization method based on network flow |
| CN109581282A (en) * | 2018-11-06 | 2019-04-05 | 宁波大学 | Indoor orientation method based on the semi-supervised deep learning of Bayes |
| CN112073988A (en) * | 2020-07-31 | 2020-12-11 | 中国科学院信息工程研究所 | Detection method for hidden camera in local area network |
| WO2021114231A1 (en) * | 2019-12-11 | 2021-06-17 | 中国科学院深圳先进技术研究院 | Training method and detection method for network traffic anomaly detection model |
| CN113873674A (en) * | 2015-11-05 | 2021-12-31 | 索尼公司 | Electronic device in wireless communication system and method for wireless communication |
| WO2022116420A1 (en) * | 2020-12-01 | 2022-06-09 | 平安科技（深圳）有限公司 | Speech event detection method and apparatus, electronic device, and computer storage medium |
-
2022
- 2022-11-29 CN CN202211504490.XA patent/CN115623531B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2014210246A1 (en) * | 2013-06-28 | 2014-12-31 | Mcafee, Inc. | Rootkit detection by using hardware resources to detect inconsistencies in network traffic |
| CN113873674A (en) * | 2015-11-05 | 2021-12-31 | 索尼公司 | Electronic device in wireless communication system and method for wireless communication |
| CN108718257A (en) * | 2018-05-23 | 2018-10-30 | 浙江大学 | A kind of wireless camera detection and localization method based on network flow |
| CN109581282A (en) * | 2018-11-06 | 2019-04-05 | 宁波大学 | Indoor orientation method based on the semi-supervised deep learning of Bayes |
| WO2021114231A1 (en) * | 2019-12-11 | 2021-06-17 | 中国科学院深圳先进技术研究院 | Training method and detection method for network traffic anomaly detection model |
| CN112073988A (en) * | 2020-07-31 | 2020-12-11 | 中国科学院信息工程研究所 | Detection method for hidden camera in local area network |
| WO2022116420A1 (en) * | 2020-12-01 | 2022-06-09 | 平安科技（深圳）有限公司 | Speech event detection method and apparatus, electronic device, and computer storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115623531A (en) | 2023-01-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Abdelnasser et al. | SemanticSLAM: Using environment landmarks for unsupervised indoor localization | |
| US11164329B2 (en) | Multi-channel spatial positioning system | |
| JP5495235B2 (en) | Apparatus and method for monitoring the behavior of a monitored person | |
| Wittenburg et al. | A system for distributed event detection in wireless sensor networks | |
| US10198625B1 (en) | Association of unique person to a mobile device using repeat face image matching | |
| Zhang et al. | Ev-loc: integrating electronic and visual signals for accurate localization | |
| CN104335564B (en) | For identify and analyze user personal scene system and method | |
| TWI587717B (en) | Systems and methods for adaptive multi-feature semantic location sensing | |
| CN107223332A (en) | Audio-visual scene analysis based on acoustics camera | |
| US9167554B1 (en) | Method and system for tracking communication devices in a radio communication network in a facility | |
| Singh et al. | Ensemble based real-time indoor localization using stray WiFi signal | |
| Tang et al. | Indoor crowd density estimation through mobile smartphone wi-fi probes | |
| CN115623531B (en) | Hidden monitoring equipment discovering and positioning method using wireless radio frequency signal | |
| CN111294728A (en) | Method and device for analyzing same lines | |
| Higuchi et al. | Mobile devices as an infrastructure: A survey of opportunistic sensing technology | |
| Ding et al. | Counting human objects using backscattered radio frequency signals | |
| Ravi et al. | Fiatlux: Fingerprinting rooms using light intensity | |
| Alawami et al. | LocAuth: A fine-grained indoor location-based authentication system using wireless networks characteristics | |
| Liu et al. | Vi-Fi: Associating moving subjects across vision and wireless sensors | |
| Luo et al. | Indoor smartphone SLAM with learned echoic location features | |
| Marakkalage et al. | Identifying indoor points of interest via mobile crowdsensing: An experimental study | |
| Teng et al. | EV: Efficient visual surveillance with electronic footprints | |
| Van Hyfte et al. | Immediate proximity detection using wi-fi–enabled smartphones | |
| Shad et al. | Precise location acquisition of mobility data using cell-id | |
| CN115696195A (en) | Position semantic fingerprint database construction method and related device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |