CN103458413A - Method for intrusion detection based on wireless signal characters - Google Patents

Abstract

The invention relates to a method for intrusion detection based on wireless signal characters, and belongs to the field of security and protection technology and wireless network application. According to the method for the intrusion detection, the state that whether object intrusion exists or not can be detected through the influence on the wireless link signal strength from an intrusion object. According to the intrusion detection algorithm, the signal strength information of all wireless links serves as input information, whether intrusion exists or not can be detected through the two-dimensional statistical properties of the mean value and the variance of the signal strength information. A system in which the method is adopted is composed of wireless scanning nodes, a wireless aggregation node, a general PC and the intrusion detection algorithm. The intrusion detection algorithm is installed in the general PC, and the wireless scanning nodes, the wireless aggregation node and the general PC are communicated wirelessly. The method is suitable for intrusion detection at wall shielding, dark environment and other severe environments. Whether a target intrudes or not can be detected through the change, caused by the fact that the intrusion object shields a wireless signal, of the wireless link signal strength.

Description

Intrusion detection method based on the wireless signal feature

Technical field

The invention belongs to security and guard technology, wireless network application, relate to a kind of intrusion detection method based on the wireless signal feature.

Background technology

Intrusion Detection Technique has a wide range of applications in fields such as border monitoring, bank's monitoring, nucleus monitorings.Along with social development, people are more and more higher to the concern of safety, can predict in the near future, and Intrusion Detection Technique will be used widely in military affairs, industry and our daily life.

The Intrusion Detection Technique extensively adopted at present is based on the detection technique of camera, numerous scholars are to utilizing camera, based on image processing techniques, realizing that intrusion detection conducts in-depth research, as: Zhu J, Lao Y, " Object tracking in structured environments for video surveillance applications " Deng the people, IEEE Transactions on Circuits and Systems for Video Technology, 2010, the 20th volume, the 2nd phase, the P223-235 page.But system layout is more loaded down with trivial details, intruding detection system needs light condition well and can't realize that simultaneously, image processing techniques relates to privacy concern, inapplicable in some monitoring occasion to the penetrating of body of wall etc.In recent years, along with the development of wireless technology, make to utilize the wireless measurement between radio node cheaply to realize that intrusion detection becomes possibility.Due to the inherent characteristic of electric wave, when there being intrusion object to cause while covering certain wireless links, the received signal strength information potential of this link must change.Based on this, when having multi wireless links to exist, by the received signal strength information of each wireless link, can realize whether there being the object invasion to judge in the wireless link overlay area simultaneously.

With traditional intrusion detection method based on camera, compare, because radio node can cover larger zone, so the Intrusion Detection Technique based on the wireless signal feature can complete the security monitor to large scene; Because the radio node cost is lower, so the Intrusion Detection Technique based on the wireless signal feature can be in the application of the field of numerous cost sensitivities; Because wireless signal can penetrate veil, so the Intrusion Detection Technique based on the wireless signal feature can be applied under the scene more at indoor barrier; Because radio node is insensitive to illumination, humiture, so the field that the Intrusion Detection Technique based on the wireless signal feature can be more severe in environmental condition application.These characteristics has determined that the Intrusion Detection Technique based on the wireless signal feature has application prospect more widely.

Summary of the invention

The objective of the invention is to overcome the defect of prior art, invent a kind of intrusion detection method based on the wireless signal feature, with the wireless measurement signal between radio node as metrical information, adopt intrusion detection algorithm to detect the impact of intrusion object on the wireless measurement signal, the variation of the wireless link signals intensity covering of wireless signal caused according to intrusion object, realize whether the detection of target invasion is arranged.

Technical scheme of the present invention is a kind of intrusion detection method based on the wireless signal feature, intrusion detection algorithm is to utilize the impact of intrusion object on wireless link signals intensity, whether realization to there being the state-detection of object invasion, it is input message that intrusion detection algorithm be take the signal strength information of each wireless links, utilize its average, variance Two-dimensional Statistical Characteristics Detection whether to have invasion to occur, when the amplitude changed when the two-dimensional space characteristic information is greater than certain threshold value, judgement has the object invasion, and concrete steps are as follows:

A) N wireless scan node J1, J2, JN is placed on four limits of intrusion object 3 outer rectangular areas, every limit keeps at a certain distance away and places a wireless scan node, wireless aggregation node 1, general purpose PC 2 are placed on monitored area on one side or in inside, monitored area, carry out radio communication between wireless scan node, each node sends wireless signal successively, and other node receives wireless signal and records received signal strength;

B) wireless aggregation node 1 collects by wireless mode the wireless link signals strength information that all wireless scan nodes measure; Simultaneously, the information of collection is sent to general purpose PC 2;

C) on general purpose PC 2, the intrusion detection algorithm of operation is realized whether the detection of object invasion is arranged according to the wireless link strength information; Algorithm is usingd wireless link received signal strength information as input message, the intrusion target position of output estimation; Average, the variance Two-dimensional Statistical characteristic of intrusion detection algorithm based on wireless link signals intensity realizes intrusion detection; Suppose between each wireless scan node to form the n wireless links, obtain respectively in t-1 and the t moment eigenmatrix A and B that average m and variance v by this n wireless links received signal strength form as follows:

$A=\left(\begin{array}{cc}{m}_{11}& v_{12}\\ m_{21}& v_{22}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ m_{n1}& v_{n2}\end{array}\right),$ $B=\left(\begin{array}{cc}{m}_{11}^{\&prime;}& v_{12}^{\&prime;}\\ m_{21}^{\&prime;}& v_{22}^{\&prime;}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ {\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1& v_{n2}^{\&prime;}\end{array}\right)$

Wherein, the average m that eigenmatrix A and B have comprised wireless link signals intensity and variance v feature, m _n1and v _n2represent respectively signal strength signal intensity average and the variance of n wireless links; In intrusion detection algorithm calculated characteristics matrix A and B, to obtain similarity matrix C as follows for the big or small similarity degree of corresponding element value:

$C=\left(\begin{array}{cc}\frac{\sqrt{{(m_{11}-m_{11}^{\&prime;})}^2}}{d_1}& \frac{\sqrt{{(v_{12}-v_{12}^{\&prime;})}^2}}{d_1}\\ \frac{\sqrt{{(m_{21}-m_{21}^{\&prime;})}^2}}{d_2}& \frac{\sqrt{{(v_{22}-v_{22}^{\&prime;})}^2}}{d_2}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \frac{\sqrt{{(m_{n1}-{\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1)}^2}}{d_n}& \frac{\sqrt{{(v_{n2}-v_{n2}^{\&prime;})}^2}}{d_n}\end{array}\right)$

Wherein, m _n1-m' _n1represented the difference of the average of n bar link, v _n1-v' _n1represented the difference of the variance of n bar link, d _nrepresented the length of n bar link.When each element sum of similarity matrix C is greater than the threshold value of setting, intrusion detection algorithm will be judged the object invasion.

The system that this intrusion detection method adopts is by wireless scan node J1, J2, JN, wireless aggregation node 1, general purpose PC 2 and intrusion detection algorithm form, and intrusion detection algorithm is arranged in general purpose PC 2, between wireless scan node, wireless aggregation node, general purpose PC, carries out radio communication.

Beneficial effect of the present invention is: 1) can utilize the wireless measurement signal to realize whether the judgement of object invasion is arranged; 2) can utilize the radio node of a large amount of cheapnesss to realize fast the intrusion detection of scene on a large scale; 3) size, illumination condition, the condition of covering that detects scene do not had to particular requirement; 4) do not relate to privacy concern; 5) utilize multi wireless links to be detected, improved the robustness of detection system.

The accompanying drawing explanation

Fig. 1 is system architecture diagram of the present invention.In figure: J1 to J8 is wireless scan node, and 1 is wireless aggregation node; 2 is general purpose PC, the operation intrusion detection algorithm; 3 is intrusion object.

Fig. 2 intrusion detection algorithm flow process.

Embodiment

Elaborate the present invention below in conjunction with concrete technical scheme and accompanying drawing, but the present invention is not limited to specific embodiment.Embodiment: as shown in Figure 1, the system that this intrusion detection method adopts is comprised of wireless scan node, wireless aggregation node, general purpose PC, intrusion detection algorithm.System arranges 8 wireless scan node J1, J2 ... J8 and wireless aggregation node 1 be the wireless module design based on being operated in 433MHz all, transmitting power 20dBm, antenna gain 1dB.Wireless scan node J1, J2 ... four ，Mei Bian interval, the limit 5m that J8 is placed on 10m * 10m rectangular area place a wireless scan node, and placing height is 1m.Wireless aggregation node 1, PC 2 are placed on monitored area on one side or in inside, monitored area, the wireless scan node J1 of distance, and J2 ... in J8100m.Wireless scan node J1 ... J8 forms queue, sends successively wireless signal, other wireless signal that the wireless scan node reception current time sending node of transmitted signal does not send, and measure received signal strength information.Wireless aggregation node 1 is intercepted the wireless signal information of each wireless link, and the received signal strength information of each link is delivered to general purpose PC 2.

Fig. 2 means the intrusion detection algorithm flow process, and concrete steps are as follows:

A) can carry out radio communication between wireless scan node, each node sends wireless signal successively, and other node receives wireless signal and records received signal strength;

B) wireless aggregation node can be collected the wireless link signals strength information that all wireless scan nodes measure by wireless mode; Simultaneously, the information of collection is sent to general purpose PC;

C) intrusion detection algorithm moved on general purpose PC is realized whether the detection of object invasion is arranged according to the wireless link strength information; Algorithm is usingd wireless link received signal strength information as input message, the intrusion target position of output estimation.Average, the variance Two-dimensional Statistical characteristic of intrusion detection algorithm based on wireless link signals intensity realizes intrusion detection.Suppose between each wireless scan node to form the n wireless links, constantly obtain at t-1 the eigenmatrix A that average m and variance v by this n wireless links received signal strength form as follows:

$A=\left(\begin{array}{cc}{m}_{11}& v_{12}\\ m_{21}& v_{22}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ m_{n1}& v_{n2}\end{array}\right)$

Constantly obtain at t the eigenmatrix B that average m and variance v by this n wireless links received signal strength form as follows:

$B=\left(\begin{array}{cc}{m}_{11}^{\&prime;}& v_{12}^{\&prime;}\\ m_{21}^{\&prime;}& v_{22}^{\&prime;}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ {\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1& v_{n2}^{\&prime;}\end{array}\right)$

Wherein, the average m that eigenmatrix A and B have comprised wireless link signals intensity and variance v feature, m _n1and v _n2represent respectively signal strength signal intensity average and the variance of n wireless links; In intrusion detection algorithm calculated characteristics matrix A and B, to obtain similarity matrix C as follows for the big or small similarity degree of corresponding element value:

$C=\left(\begin{array}{cc}\frac{\sqrt{{(m_{11}-m_{11}^{\&prime;})}^2}}{d_1}& \frac{\sqrt{{(v_{12}-v_{12}^{\&prime;})}^2}}{d_1}\\ \frac{\sqrt{{(m_{21}-m_{21}^{\&prime;})}^2}}{d_2}& \frac{\sqrt{{(v_{22}-v_{22}^{\&prime;})}^2}}{d_2}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \frac{\sqrt{{(m_{n1}-{\mathrm{<figure-callout\; id="1"\; label="m\; n"\; filenames="HDA00003256534000012.png"\; state="\{\{state\}\}">m</figure-callout>}}_n^1)}^2}}{d_n}& \frac{\sqrt{{(v_{n2}-v_{n2}^{\&prime;})}^2}}{d_n}\end{array}\right)$

Wherein, m _n1-m' _n1represented the difference of the average of n bar link, v _n1-v' _n1represented the difference of the variance of n bar link, d _nrepresented the length of n bar link.When each element sum of similarity matrix C is greater than the threshold value of setting, intrusion detection algorithm will be judged the object invasion, as shown in Figure 2.

Using the wireless link metrical information as input, average, the variance of the signal strength signal intensity of each wireless link are carried out to On-line Estimation, the construction feature matrix B at the intrusion detection algorithm based on mean variance associating two-dimensional detection technology of the upper operation of PC (2); Afterwards, eigenmatrix B and the upper one eigenmatrix A constantly built are analyzed, calculate similarity matrix C, calculate its mould value, and then to whether having target to occur being adjudicated, and court verdict is exported to the screen of general purpose PC (2).

Test shows, in 10m * 10m rectangular area, and 8 wireless scan node J1 of system layout, J2 ... .J8, can realize the detection to intrusion object, success rate is 98%, and false alarm rate is 1%.

The method is applicable to the intrusion detection under the adverse circumstances such as body of wall covers, ambient black, and whether the variation of the wireless link signals intensity of utilizing intrusion object to cause covering of wireless signal realizes having the target invasion to be detected.

Claims (2)

1. the intrusion detection method based on the wireless signal feature, it is characterized in that, intrusion detection algorithm is to utilize the impact of intrusion object on wireless link signals intensity, whether realization to there being the state-detection of object invasion, it is input message that intrusion detection algorithm be take the signal strength information of each wireless links, utilize its average, variance Two-dimensional Statistical Characteristics Detection whether to have invasion to occur, when the amplitude changed when the two-dimensional space characteristic information is greater than certain threshold value, judgement has the object invasion, and concrete steps are as follows:

A) N wireless scan node (J1, J2, JN) be placed on four limits of the outer rectangular area of intrusion object (3), every limit keeps at a certain distance away and places a wireless scan node, wireless aggregation node (1), general purpose PC (2) are placed on monitored area on one side or in inside, monitored area, carry out radio communication between wireless scan node, each node sends wireless signal successively, and other node receives wireless signal and records received signal strength;

B) wireless aggregation node (1) collects by wireless mode the wireless link signals strength information that all wireless scan nodes measure; Simultaneously, the information of collection is sent to general purpose PC (2);

C) intrusion detection algorithm of the upper operation of general purpose PC (2) is realized whether the detection of object invasion is arranged according to the wireless link strength information; Algorithm is usingd wireless link received signal strength information as input message, the intrusion target position of output estimation; Average, the variance Two-dimensional Statistical characteristic of intrusion detection algorithm based on wireless link signals intensity realizes intrusion detection; Suppose between each wireless scan node to form the n wireless links, obtain respectively in t-1 and the t moment eigenmatrix A and B that average m and variance v by this n wireless links received signal strength form as follows:

$A=\left(\begin{array}{cc}{m}_{11}& v_{12}\\ m_{21}& v_{22}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ m_{n1}& v_{n2}\end{array}\right),$ $B=\left(\begin{array}{cc}{m}_{11}^{\&prime;}& v_{12}^{\&prime;}\\ m_{21}^{\&prime;}& v_{22}^{\&prime;}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ m_{n1}^{\&prime;}& v_{n2}^{\&prime;}\end{array}\right)$

Wherein, the average m that eigenmatrix A and B have comprised wireless link signals intensity and variance v feature, m _n1and v _n2represent respectively signal strength signal intensity average and the variance of n wireless links; In intrusion detection algorithm calculated characteristics matrix A and B, to obtain similarity matrix C as follows for the big or small similarity degree of corresponding element value:

$C=\left(\begin{array}{cc}\frac{\sqrt{{(m_{11}-m_{11}^{\&prime;})}^2}}{d_1}& \frac{\sqrt{{(v_{12}-v_{12}^{\&prime;})}^2}}{d_1}\\ \frac{\sqrt{{(m_{21}-m_{21}^{\&prime;})}^2}}{d_2}& \frac{\sqrt{{(v_{22}-v_{22}^{\&prime;})}^2}}{d_2}\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \&CenterDot;& \&CenterDot;\\ \frac{\sqrt{{(m_{n1}-m_{n1}^{\&prime;})}^2}}{d_n}& \frac{\sqrt{{(v_{n2}-v_{n2}^{\&prime;})}^2}}{d_n}\end{array}\right)$

Wherein, m _n1-m' _n1represented the difference of the average of n bar link, v _n1-v' _n1represented the difference of the variance of n bar link, d _nrepresented the length of n bar link; When each element sum of similarity matrix C is greater than the threshold value of setting, intrusion detection algorithm will be judged the object invasion.

2. a kind of intrusion detection method based on the wireless signal feature according to claim 1, it is characterized in that: this system of invading the detection method employing is by wireless scan node (J1, J2, JN), wireless aggregation node (1), general purpose PC (2) and intrusion detection algorithm form, intrusion detection algorithm is arranged in general purpose PC (2), between wireless scan node, wireless aggregation node, general purpose PC, carries out radio communication.

Images