CN103458413A - Method for intrusion detection based on wireless signal characters - Google Patents

Abstract

The invention relates to an intrusion detection method based on wireless signal characteristics, which belongs to the field of security technology and wireless network application, and relates to an intrusion detection method based on wireless signal characteristics. The detection method is to use the influence of the intruding object on the signal strength of the wireless link to realize the state detection of whether there is an object intrusion. Features detect whether an intrusion has occurred. The system adopted in this method is composed of wireless scanning nodes, wireless aggregation nodes, general PCs and intrusion detection algorithms. The intrusion detection algorithm is installed in a general-purpose PC, and wireless communication is carried out between wireless scanning nodes, wireless sink nodes and general-purpose PCs. This method is suitable for intrusion detection in harsh environments such as wall shading and dark environments, and uses the change in the signal strength of the wireless link caused by the shading of the wireless signal by the intruding object to detect whether there is a target intrusion.

Description

Intrusion detection method based on the wireless signal feature

Technical field

The invention belongs to security and guard technology, wireless network application, relate to a kind of intrusion detection method based on the wireless signal feature.

Background technology

Intrusion Detection Technique has a wide range of applications in fields such as border monitoring, bank's monitoring, nucleus monitorings.Along with social development, people are more and more higher to the concern of safety, can predict in the near future, and Intrusion Detection Technique will be used widely in military affairs, industry and our daily life.

The Intrusion Detection Technique extensively adopted at present is based on the detection technique of camera, numerous scholars are to utilizing camera, based on image processing techniques, realizing that intrusion detection conducts in-depth research, as: Zhu J, Lao Y, " Object tracking in structured environments for video surveillance applications " Deng the people, IEEE Transactions on Circuits and Systems for Video Technology, 2010, the 20th volume, the 2nd phase, the P223-235 page.But system layout is more loaded down with trivial details, intruding detection system needs light condition well and can't realize that simultaneously, image processing techniques relates to privacy concern, inapplicable in some monitoring occasion to the penetrating of body of wall etc.In recent years, along with the development of wireless technology, make to utilize the wireless measurement between radio node cheaply to realize that intrusion detection becomes possibility.Due to the inherent characteristic of electric wave, when there being intrusion object to cause while covering certain wireless links, the received signal strength information potential of this link must change.Based on this, when having multi wireless links to exist, by the received signal strength information of each wireless link, can realize whether there being the object invasion to judge in the wireless link overlay area simultaneously.

With traditional intrusion detection method based on camera, compare, because radio node can cover larger zone, so the Intrusion Detection Technique based on the wireless signal feature can complete the security monitor to large scene; Because the radio node cost is lower, so the Intrusion Detection Technique based on the wireless signal feature can be in the application of the field of numerous cost sensitivities; Because wireless signal can penetrate veil, so the Intrusion Detection Technique based on the wireless signal feature can be applied under the scene more at indoor barrier; Because radio node is insensitive to illumination, humiture, so the field that the Intrusion Detection Technique based on the wireless signal feature can be more severe in environmental condition application.These characteristics has determined that the Intrusion Detection Technique based on the wireless signal feature has application prospect more widely.

Summary of the invention

The objective of the invention is to overcome the defect of prior art, invent a kind of intrusion detection method based on the wireless signal feature, with the wireless measurement signal between radio node as metrical information, adopt intrusion detection algorithm to detect the impact of intrusion object on the wireless measurement signal, the variation of the wireless link signals intensity covering of wireless signal caused according to intrusion object, realize whether the detection of target invasion is arranged.

Technical scheme of the present invention is a kind of intrusion detection method based on the wireless signal feature, intrusion detection algorithm is to utilize the impact of intrusion object on wireless link signals intensity, whether realization to there being the state-detection of object invasion, it is input message that intrusion detection algorithm be take the signal strength information of each wireless links, utilize its average, variance Two-dimensional Statistical Characteristics Detection whether to have invasion to occur, when the amplitude changed when the two-dimensional space characteristic information is greater than certain threshold value, judgement has the object invasion, and concrete steps are as follows:

A) N wireless scan node J1, J2, JN is placed on four limits of intrusion object 3 outer rectangular areas, every limit keeps at a certain distance away and places a wireless scan node, wireless aggregation node 1, general purpose PC 2 are placed on monitored area on one side or in inside, monitored area, carry out radio communication between wireless scan node, each node sends wireless signal successively, and other node receives wireless signal and records received signal strength;

B) wireless aggregation node 1 collects by wireless mode the wireless link signals strength information that all wireless scan nodes measure; Simultaneously, the information of collection is sent to general purpose PC 2;

C) on general purpose PC 2, the intrusion detection algorithm of operation is realized whether the detection of object invasion is arranged according to the wireless link strength information; Algorithm is usingd wireless link received signal strength information as input message, the intrusion target position of output estimation; Average, the variance Two-dimensional Statistical characteristic of intrusion detection algorithm based on wireless link signals intensity realizes intrusion detection; Suppose between each wireless scan node to form the n wireless links, obtain respectively in t-1 and the t moment eigenmatrix A and B that average m and variance v by this n wireless links received signal strength form as follows:

$A=\left(\begin{array}{cc}{m}_{11}& v_{12}\\ m_{21}& v_{22}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ m_{n1}& v_{n2}\end{array}\right),$ $B=\left(\begin{array}{cc}{m}_{11}^{\&prime;}& v_{12}^{\&prime;}\\ m_{21}^{\&prime;}& v_{22}^{\&prime;}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ {\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1& v_{n2}^{\&prime;}\end{array}\right)$

Wherein, the average m that eigenmatrix A and B have comprised wireless link signals intensity and variance v feature, m _n1and v _n2represent respectively signal strength signal intensity average and the variance of n wireless links; In intrusion detection algorithm calculated characteristics matrix A and B, to obtain similarity matrix C as follows for the big or small similarity degree of corresponding element value:

$C=\left(\begin{array}{cc}\frac{\sqrt{{(m_{11}-m_{11}^{\&prime;})}^2}}{d_1}& \frac{\sqrt{{(v_{12}-v_{12}^{\&prime;})}^2}}{d_1}\\ \frac{\sqrt{{(m_{21}-m_{21}^{\&prime;})}^2}}{d_2}& \frac{\sqrt{{(v_{22}-v_{22}^{\&prime;})}^2}}{d_2}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \frac{\sqrt{{(m_{n1}-{\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1)}^2}}{d_n}& \frac{\sqrt{{(v_{n2}-v_{n2}^{\&prime;})}^2}}{d_n}\end{array}\right)$

Wherein, m _n1-m' _n1represented the difference of the average of n bar link, v _n1-v' _n1represented the difference of the variance of n bar link, d _nrepresented the length of n bar link.When each element sum of similarity matrix C is greater than the threshold value of setting, intrusion detection algorithm will be judged the object invasion.

The system that this intrusion detection method adopts is by wireless scan node J1, J2, JN, wireless aggregation node 1, general purpose PC 2 and intrusion detection algorithm form, and intrusion detection algorithm is arranged in general purpose PC 2, between wireless scan node, wireless aggregation node, general purpose PC, carries out radio communication.

Beneficial effect of the present invention is: 1) can utilize the wireless measurement signal to realize whether the judgement of object invasion is arranged; 2) can utilize the radio node of a large amount of cheapnesss to realize fast the intrusion detection of scene on a large scale; 3) size, illumination condition, the condition of covering that detects scene do not had to particular requirement; 4) do not relate to privacy concern; 5) utilize multi wireless links to be detected, improved the robustness of detection system.

The accompanying drawing explanation

Fig. 1 is system architecture diagram of the present invention.In figure: J1 to J8 is wireless scan node, and 1 is wireless aggregation node; 2 is general purpose PC, the operation intrusion detection algorithm; 3 is intrusion object.

Fig. 2 intrusion detection algorithm flow process.

Embodiment

Elaborate the present invention below in conjunction with concrete technical scheme and accompanying drawing, but the present invention is not limited to specific embodiment.Embodiment: as shown in Figure 1, the system that this intrusion detection method adopts is comprised of wireless scan node, wireless aggregation node, general purpose PC, intrusion detection algorithm.System arranges 8 wireless scan node J1, J2 ... J8 and wireless aggregation node 1 be the wireless module design based on being operated in 433MHz all, transmitting power 20dBm, antenna gain 1dB.Wireless scan node J1, J2 ... four ，Mei Bian interval, the limit 5m that J8 is placed on 10m * 10m rectangular area place a wireless scan node, and placing height is 1m.Wireless aggregation node 1, PC 2 are placed on monitored area on one side or in inside, monitored area, the wireless scan node J1 of distance, and J2 ... in J8100m.Wireless scan node J1 ... J8 forms queue, sends successively wireless signal, other wireless signal that the wireless scan node reception current time sending node of transmitted signal does not send, and measure received signal strength information.Wireless aggregation node 1 is intercepted the wireless signal information of each wireless link, and the received signal strength information of each link is delivered to general purpose PC 2.

Fig. 2 means the intrusion detection algorithm flow process, and concrete steps are as follows:

A) can carry out radio communication between wireless scan node, each node sends wireless signal successively, and other node receives wireless signal and records received signal strength;

B) wireless aggregation node can be collected the wireless link signals strength information that all wireless scan nodes measure by wireless mode; Simultaneously, the information of collection is sent to general purpose PC;

C) intrusion detection algorithm moved on general purpose PC is realized whether the detection of object invasion is arranged according to the wireless link strength information; Algorithm is usingd wireless link received signal strength information as input message, the intrusion target position of output estimation.Average, the variance Two-dimensional Statistical characteristic of intrusion detection algorithm based on wireless link signals intensity realizes intrusion detection.Suppose between each wireless scan node to form the n wireless links, constantly obtain at t-1 the eigenmatrix A that average m and variance v by this n wireless links received signal strength form as follows:

$A=\left(\begin{array}{cc}{m}_{11}& v_{12}\\ m_{21}& v_{22}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ m_{n1}& v_{n2}\end{array}\right)$

Constantly obtain at t the eigenmatrix B that average m and variance v by this n wireless links received signal strength form as follows:

$B=\left(\begin{array}{cc}{m}_{11}^{\&prime;}& v_{12}^{\&prime;}\\ m_{21}^{\&prime;}& v_{22}^{\&prime;}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ {\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1& v_{n2}^{\&prime;}\end{array}\right)$

Wherein, the average m that eigenmatrix A and B have comprised wireless link signals intensity and variance v feature, m _n1and v _n2represent respectively signal strength signal intensity average and the variance of n wireless links; In intrusion detection algorithm calculated characteristics matrix A and B, to obtain similarity matrix C as follows for the big or small similarity degree of corresponding element value:

$C=\left(\begin{array}{cc}\frac{\sqrt{{(m_{11}-m_{11}^{\&prime;})}^2}}{d_1}& \frac{\sqrt{{(v_{12}-v_{12}^{\&prime;})}^2}}{d_1}\\ \frac{\sqrt{{(m_{21}-m_{21}^{\&prime;})}^2}}{d_2}& \frac{\sqrt{{(v_{22}-v_{22}^{\&prime;})}^2}}{d_2}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \frac{\sqrt{{(m_{n1}-{\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1)}^2}}{d_n}& \frac{\sqrt{{(v_{n2}-v_{n2}^{\&prime;})}^2}}{d_n}\end{array}\right)$

Wherein, m _n1-m' _n1represented the difference of the average of n bar link, v _n1-v' _n1represented the difference of the variance of n bar link, d _nrepresented the length of n bar link.When each element sum of similarity matrix C is greater than the threshold value of setting, intrusion detection algorithm will be judged the object invasion, as shown in Figure 2.

Using the wireless link metrical information as input, average, the variance of the signal strength signal intensity of each wireless link are carried out to On-line Estimation, the construction feature matrix B at the intrusion detection algorithm based on mean variance associating two-dimensional detection technology of the upper operation of PC (2); Afterwards, eigenmatrix B and the upper one eigenmatrix A constantly built are analyzed, calculate similarity matrix C, calculate its mould value, and then to whether having target to occur being adjudicated, and court verdict is exported to the screen of general purpose PC (2).

Test shows, in 10m * 10m rectangular area, and 8 wireless scan node J1 of system layout, J2 ... .J8, can realize the detection to intrusion object, success rate is 98%, and false alarm rate is 1%.

The method is applicable to the intrusion detection under the adverse circumstances such as body of wall covers, ambient black, and whether the variation of the wireless link signals intensity of utilizing intrusion object to cause covering of wireless signal realizes having the target invasion to be detected.

Claims (2)

1. An intrusion detection method based on wireless signal characteristics, characterized in that the intrusion detection algorithm utilizes the influence of the intrusion object on the signal strength of the wireless link to realize the state detection of whether there is an object intrusion, and the intrusion detection algorithm uses each wireless The signal strength information of the link is the input information. Use its mean value and variance two-dimensional statistical characteristics to detect whether there is an intrusion. When the change in the two-dimensional spatial feature information is greater than a certain threshold, it is judged that there is an object intrusion. The specific steps are as follows: a) N wireless scanning nodes (J1, J2, ... JN) are placed on the four sides of the rectangular area outside the intrusion object (3), and a wireless scanning node is placed at a certain distance on each side, wireless convergence node (1), general-purpose PC ( 2) Placed on the side of the monitoring area or inside the monitoring area, wireless scanning nodes perform wireless communication, each node sends wireless signals in turn, other nodes receive wireless signals and record the received signal strength; b) The wireless aggregation node (1) collects the wireless link signal strength information measured by all wireless scanning nodes wirelessly; at the same time, sends the collected information to the general PC (2); c) The intrusion detection algorithm running on the general-purpose PC (2) realizes the detection of object intrusion according to the wireless link strength information; the algorithm uses the received signal strength information of the wireless link as input information, and outputs the estimated intrusion target position; The detection algorithm realizes intrusion detection based on the two-dimensional statistical characteristics of the mean value and variance of the wireless link signal strength; assuming that n wireless links are formed between the wireless scanning nodes, the n wireless link The characteristic matrices A and B composed of the mean value m and variance v of the received signal strength are as follows: $\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; =</span>\left(\begin{array}{cc}{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; 11</span>}}& {\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; 12</span>}}\\ {\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; one</span>}}& {\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; two</span>}}\\ <span\; class="notranslate">\; \&CenterDot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ <span\; class="notranslate">\; \&CenterDot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ <span\; class="notranslate">\; \&CenterDot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ {\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}}& {\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}}\end{array}\right)<span\; class="notranslate">\; ,</span>$ $\mathrm{<span\; class="notranslate">\; B</span>}<span\; class="notranslate">\; =</span>\left(\begin{array}{cc}{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; 11</span>}}^{<span\; class="notranslate">\; \&prime;</span>}& {\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; 12</span>}}^{<span\; class="notranslate">\; \&prime;</span>}\\ {\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; one</span>}}^{<span\; class="notranslate">\; \&prime;</span>}& {\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; two</span>}}^{<span\; class="notranslate">\; \&prime;</span>}\\ <span\; class="notranslate">\; \&CenterDot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ <span\; class="notranslate">\; \&CenterDot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ <span\; class="notranslate">\; \&CenterDot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ {\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}& {\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}\end{array}\right)$ Among them, the characteristic matrices A and B include the mean value m and variance v characteristics of the wireless link signal strength, m _n1 and v _n2 represent the mean value and variance of the signal strength of the nth wireless link respectively; the intrusion detection algorithm calculates the characteristic matrix A and The degree of similarity of the corresponding element values in B to obtain the similarity matrix C is as follows: $\mathrm{<span\; class="notranslate">\; C</span>}<span\; class="notranslate">\; =</span>\left(\begin{array}{cc}\frac{\sqrt{{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; 11</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; 11</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}}}{{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}& \frac{\sqrt{{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; 12</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; 12</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}}}{{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}\\ \frac{\sqrt{{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; one</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; one</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}}}{{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}}& \frac{\sqrt{{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; two</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; twenty\; two</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}}}{{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}}\\ <span\; class="notranslate">\; \&Center\; Dot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ <span\; class="notranslate">\; \&CenterDot;</span>& <span\; class="notranslate">\; \&Center\; Dot;</span>\\ <span\; class="notranslate">\; \&Center\; Dot;</span>& <span\; class="notranslate">\; \&CenterDot;</span>\\ \frac{\sqrt{{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 1</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}}}{{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}}& \frac{\sqrt{{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}\mathrm{<span\; class="notranslate">\; 2</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}}}{{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}}\end{array}\right)$ Among them, m _n1 -m' _n1 represents the difference in the mean value of the nth link, v _n1 -v' _n1 represents the difference in the variance of the nth link, and d _n represents the length of the nth link; When the sum of the elements of the similarity matrix C is greater than the set threshold, the intrusion detection algorithm will determine that the object is intruded. 2. An intrusion detection method based on wireless signal characteristics according to claim 1, characterized in that: the system used in the intrusion detection method consists of wireless scanning nodes (J1, J2, ... JN), wireless convergence nodes (1 ), a general-purpose PC (2) and an intrusion detection algorithm, the intrusion detection algorithm is installed in the general-purpose PC (2), and the wireless scanning node, the wireless convergence node, and the general-purpose PC perform wireless communication.

Images