A Robust Passive Intrusion Detection System with Commodity WiFi Devices

In recent years, due to the rapidly growing capacities of physical layer, device-free passive detection holds great importance for a broad range of application. Most recent works focus on motion detection, intrusion detection, and vital sign with commodity WiFi devices in the indoor environment. Conventional device-free motion detection techniques, which utilize received signal strength (RSS), may su ﬀ er from coarse granularity and high variability problems. In resorting to the ﬁ ner-grained channel state information (CSI), we propose PhaseMode, a novel approach for device-free motion detection leveraging CSI phase di ﬀ erence data between adjacent antenna pairs. We implement our approach on commercial WiFi devices and validate its performance. We conduct experiments in di ﬀ erent test periods of three indoor environments; the results show that the proposed scheme achieves an average accuracy over 99.4% of motion detection in di ﬀ erent scenarios.


Introduction
Device-free passive detection has been an emerging technology to detect entities without carrying any device over the last decade [1,2].Many applications have been developed to improve people's experience, including human detection for intrusion detection, human behavior recognition, and detection of living people in a fire environment.There are many existing methods, which can achieve intrusion detection, such as camera-based, sensor-based, and RSS-based.Camera-based approaches use a camera installed in the monitoring environment to achieve passive activity recognition by capturing the video screams and analyzing the images.However, it can only be employed in lighting environments, and the line-of-sight (LOS) condition is indispensable.Furthermore, its main issues include the potential privacy leakage and high false alarm rate.The sensor-based methods leverage body-attached motion sensors such as accelerometers or a gyroscope to collect the information on people's activities and behaviors, but these approaches may have a high false alarm rate caused by the environmental disturbance.Attaching a sensor on the body is a limitation for some people may feel inconvenient and some scenarios are not applicable for wearing sensors.Moreover, all these approaches share the requirement of infrastructure installation in the environment.
Due to the recent development in wireless network techniques and smart devices, a range of applications have been explored, including motion detection [3][4][5][6], gesture recognition [7], indoor localization [8,9], and activity identification [10][11][12].We can use pervasive WiFi signals to realize passive detection of moving targets by detecting whether there exists any wireless content changes in the surrounding environment without attaching any proposed device to users.Received signal strength (RSS) has been used successfully for device-free passive localization for wireless environments because it is easy to access the existing wireless infrastructures.When an object intrudes the monitoring area, the signal between receiver and transmitter attenuated.RSSbased approaches exploit variations in RSS measurements to infer dynamic environment changes.Although RSS is handy to use, it is not a stable metric as it suffers from coarse granularity and high susceptibility to environmental noise interference.
In recent years, since channel state information (CSI) becomes available with commodity devices.More and more researchers have resorted to the robust and finer-grained physical layer metrics for device-free motion detection, and a range of systems [3-5, 11, 13, 14] have been proposed to detect human's activities and environmental changes.CSI contains both amplitude and phase measurements separately for each OFDM subcarrier, which reflects the varying multipath reflection caused by people's existence due to its significant frequency diversity.Compared with RSS, CSI provides fine-grained channel information in the physical layer, which can now be read from modified device drivers for several off-the-shelf WiFi network interface cards (NIC), such as the Intel WiFi Link 5300 NIC [15] and the Atheros AR9580 chipset [16].Although some previous works make great progress with the physical layer CSI amplitude and phase information, few works use the more sensitive CSI phase difference.
In this paper, we propose a novel scheme termed Phase-Mode, WiFi-based important area intrusion detection, for device-free passive human detection, by exploiting CSI phase difference data.Different from previous works, we derive the useful phase information from phase difference data between adjacent antenna pairs to monitor the environment changes.Actually, phase difference is more robust than amplitude, which usually exhibits large fluctuations because of the attenuation over the link distance, obstacles, and the multipath effect [17].To achieve this, we firstly pass the raw CSI measurements to the preprocessing module to eliminate the significant random noise and sift out biased observations.We extract phase difference from the processed phase in neighboring antennas.Afterwards, we extract maximum eigenvalue of covariance matrix as the novel features from the processed phase difference data.Finally, we introduce machine-learning algorithms including the support vector machine (SVM), random forest (RF), and K-nearest neighbor (KNN) to classify the feature values for distinguishing motion detection.
To validate our system, we construct the prototype of PhaseMode on commodity off-the-self (COTS) WiFi devices and evaluate its performance in three indoor scenarios, including laboratory, meeting room, and corridor.Experiment results demonstrate that PhaseMode achieves both TN rate for static scenario and TP rate for dynamic scenario over 99.4% on average.
In summary, the main contributions of our work are as follows: (1) We propose a design for robust passive device-free human detection with commodity WiFi devices.We leverage only phase difference information of CSI as a metric for device-free human detection.
(2) Different from using the correlation of CSI information (amplitude and phase) in the time dimension, we explore the subcarrier dimension information with frequency diversity and extract more sensitive and robust features in subcarrier dimension.
(3) We explore the space diversity provided by multiantennas supported by modern MIMO systems and extract the features from the phase difference between adjacent antennas.We adopt the SVM, random forest, and K-nearest neighbor machine learning classification algorithm to detect the intrusion.
(4) We analyze some key factors such as the number of features and size of sliding window and sum up how it affects the detection accuracy.
(5) We conduct experiments and validate the performance in three different environments (corridor, meeting room, and laboratory).Experiment results show that it can achieve both TN rate for humanfree and TP rate for human moving scenario over 99.4%, transcending existing passive device-free human detection schemes.
The remainder of the paper is organized as follows.We first review the related work in Section 2. In Section 3, we briefly introduce some preliminaries about CSI and MIMO.Section 4 presents an overview of the system architecture, while the detailed design of each component is provided in Section 5. Section 6 elaborates the experiment settings and performance evaluation.Finally, conclusion are presented in Section 7.

Related Works
Device-free motion detection has drawn much attention in the past decade [1,2].In this section, we primarily review the related work from two categories of techniques, that is, RSS-based and CSI-based.
2.1.RSS-Based Detection.RSS is especially attractive for device-free motion detection due to its handy accessibility with commodity devices.It mainly relies on the received signal strength changes caused by target presence and motion.More specifically, a large value of RSS variance generally indicates a moving target in the monitoring area whereas a small value infers none.Youssef et al. and Moussa and Youssef [1,18] firstly introduced the concept of devicefree passive and proposed a maximum likelihood estimatorbased algorithm (MLE) to improve the performance of DFP systems in the real environment.The most well-known RSS-based device-free motion should be the radio tomographic imaging (RTI) [19], which deploys a wireless sensor network around the interesting area and uses the RSS measurements to obtain images of moving targets.Wilson and Patwari also proposed vRTI in [20], as an extension of the RTI technique, which leverages the motion-induced variance of RSS measurement within a wireless network.In RASID system [21], Kosba et al. improve the detection accuracy by adopting standard deviation of RSS as the feature approximates its distribution with a kernel function and leverages a nonparametric technique for adapting to environment changes.Since RSS signal is too sensitive to the slight variation of the environment, a robust device-free localization (DFL) scheme based on differential RSS is proposed [22], Journal of Sensors which can eliminate the need of acquiring reference RSS measurements as well as overcome the negative effect environment induced.Since RSS schemes suffer from coarse granularity of 1 dB and limited accuracy, researchers begin to pay more attention to CSI-based schemes owing to its frequency diversity [11].
2.2.CSI-Based Detection.Many finer-grained CSI-based schemes have been implemented to realize better detection in recent years since we can extract CSI from commodity wireless NICs, that is, Intel 5300 [15] and Atheros [16].Compared with RSS feature, CSI can be a more finedgrained signal feature, which characterizes the multipath effect at the granularity of the OFDM subcarrier in the frequency domain [23].Similar to an RSS-based scheme, most CSI-based detection systems also leverage variations in CSI measurement to alarm target presence or intrusion.Xiao et al. proposed both Pilot [8] and FIMD [6] systems based on the perspective that CSI streams maintain temporal stability in a static environment.FIMD realizes device-free motion detection by leveraging the eigenvalues of a CSIbased correlation matrix in a given time period.Pilot leverages the correlation of CSI over time to monitor abnormal appearance and further locate the entity.PADS [3] and DeMan [4] further exploit full information (both amplitude and phase) of CSI, extracting the maximum eigenvalues of the covariance matrix from successive CSI to enhance detection performance.OmniPHD [24] achieves the omnidirectional sensing coverage for passive human detection in typical multipath-rich indoor scenarios.Wang et al. [13] propose a local outlier factor using an anomaly detection algorithm to detect the anomaly change in wireless signal.E-eyes [10] leverages the moving average and probability distribution of CSI measurements to identify the presence of an activity or not.Researcher also exploits the characteristics of CSI to detect the moving target through the wall [5], monitor multiperson breathing beats [17], and analyze customer's product preference [25].CARM [12] was proposed, a model-based approach, which is more robust to environmental changes.
Most of the previous works have exploited the CSI amplitude and leveraged phase information, but few works pay attention to phase difference.In this paper, we explore phase difference for passive device-free motion detection.

Preliminaries
In this section, we briefly introduce the characteristics of CSI and MIMO technology used in device-free detection.

Channel State Information.
In the wireless communication system, CSI not only describes the channel properties of the communication link in the subcarrier level but also represents what a signal has undergone while passing through the subcarriers and reveals the combined effect owing to fading, scattering, and path loss.In OFDM, the transmitting data stream is partitioned into multiple narrow and orthogonally overlapped subcarriers, and data stream is transmitted over all subcarriers using the same modulation and coding scheme (MCS) to restrain frequency selective fading.In a narrow-band flat fading channel, the WiFi OFDM system viewed in the frequency domain can be represented as follows: where Y i is the received signal vectors, X i denotes transmitted signal vectors, H is the channel matrix, and N i represents the additive white Gaussian noise (AWGN).
In the WiFi OFDM system, 56 subcarriers can be available for data transmission with a 20 MHz bandwidth channel.However, the slightly modified Intel 5300 NIC device driver can only capture 30 subcarriers using the channel bonding technique, which can be expressed as follows: where H f i is the CSI vector at the subcarrier i with central frequency f i .Each CSI H f i depicts the amplitude |H f i | and phase ∠H f i of OFDM subcarrier i: Multiple Input and Multiply Output (MIMO).MIMO techniques have revolutionized the wireless communication over the past decade.It is an approach for increasing network bandwidth, range, and reliability leveraging multiple antennas at the transmitter and receiver to exploit multipath propagation.MIMO is an essential element of IEEE 802.11n (WiFi).In a MIMO system, the combination of N t transmitters and N r receivers can be considered as a separate TX-RX data stream, and we can express the CSI data screams as follows: where H N t N r is a vector describing the CSI of 30 subcarriers between the N t th transmitters and the N r th receivers.Since each TX-RX data stream occupies different paths in the multipath environment, the H N t N r is distinguishing, which results in distinctive CSIs received at different antennas.

Overview
In the section, we elaborate the overall architecture of our system mainly consisting of four components: sensing, data preprocessing, feature extraction, and intrusion detection module as shown in Figure 1.The first sensing module was used to sense the changes of the channel and collect CSI data from the commodity off-the-shelf Intel 5300 NIC and then pass the raw CSI measurements through a data preprocessing 3 Journal of Sensors module to sift the occasional outliers and eliminate the phase random noise.
To compare the performance between CSI amplitude and phase difference information to detect the intrusion target, we firstly construct the covariance matrices of a normalized version of amplitude and phase difference data for each subcarrier then calculate the corresponding three maximum eigenvalues for each correlation matrix.The maximum eigenvalues are combined into a six-dimensional feature to infer the presence of moving people.The extracted features are fed to three different machine learning classification models to search for a separation line between human presence and absence.Finally, for the multiple antennas in modern MIMO systems, we select the best values according to the detection results of every TX-RX antenna pair to enhance the detection accuracy and robustness.

Methodology
In this section, we elaborate the design of our system Phase-Mode by real measurements.Moreover, the system consists of four functional modules: sensing, data preprocessing, feature extraction, and intrusion detection.As shown in Figure 1, in the sensing module, we collect the raw CSI data at the receiver side with three antennas of a commodity WiFi device, then fed raw CSI streams into data preprocessing module to filter the noise and outliers as well as get the phase difference.In the feature extraction module, we extract features from the phase difference and pass it to the intrusion detection module to detect whether there is a person or a moving object in the area.
5.1.Data Preprocessing.In the preliminary part, we know that the amplitude and phase of each CSI can be represented as follows: where |H f i | and ∠H f i denote the amplitude and phase response of the subcarrier i, respectively.H f i is the CSI at the subcarrier i i ∈ 1, 30 with central frequency of f i .We collect the consecutive CSI streams and split it into equal length sequence with a specific time window to monitor changes in the environment.It can be denoted as the following.
We then use the T measurements of CSI as the basic input for the detection process; it first pass through a phase extraction process and then an outlier filtering process to sift out the outliers and some noise.
5.1.1.Outlier Removal.Due to the environmental noises as well as some protocol specifications, there exists some outlier observations, which are obviously not caused by human movement and should be sifted before human detection.Figure 2 illustrates the outliers contained in the raw CSI collected in the human-free scenario.To identify and remove these biased outliers, we adopt a Hampel identifier [26], which declares all points falling out of the closed interval μ − γ * σ, μ + γ * σ as outliers, where μ and σ are the median and the median absolute deviation (MAD) of the

4
Journal of Sensors data sequence, respectively.γ is application dependent and the most widely used value is 3.We apply the Hampel identifier on all 30 subcarriers.Figure 2 shows the CSI of two subcarriers (number 1 and number 10) before and after performing outlier removal.We can see that the Hampel filter can effectively sift out the significant abrupt changes.
5.1.2.Noise Filtering.Since the collected CSI measurements are easily disturbed by environmental noise including electromagnetic interference and other motions, before extracting feature from amplitude, we apply a median filter to the CSI amplitude data to remove the high frequency noise and high amplitude impulse, which is unlikely to be caused by human's motions.We adopt a 2-point median filter to all the 30 subcarriers as shown in Figure 3.

Phase Difference Extraction.
In this section, we use the phase difference between two adjacent antennas to remove the randomness caused by the unsynchronized time and frequency as well as environment noise.From [27], we know that phase difference is more robust and sensitive to the environment than amplitude because it is the sum of individual variance between two antennas.Firstly, we validate that the measured phase difference values between the neighbor antenna pairs are highly stable with the successively received packets.The measured CSI phase ∠ ĥi in the ith subcarrier can be expressed as follows [28]: where ∠ ĥi and ∠h i represent the measured CSI phase and the true phase values of the ith subcarrier, respectively.δ i indicates the timing lag at the receiver due to SFO, and β is an unknown phase offset caused by CFO.Z i is some measurement noise.k i ranging from 1 to 30 denotes the index of the ith subcarriers; N is the FFT size (equals to 64 from IEEE 802.11n specification).Due to the δ i , β, and the Z i , it is infeasible to obtain the true phase information.As Figure 4 shows, the raw CSI phase data are randomly distributed, which caused by the variable δ i .Sen et al. [29] present a linear transformation method, which can remove the random noise of the raw phase data effectively.
Due to the three antennas on the same NIC, we know that the antennas have same sampling clock and downconverter frequency [30].The measured phase difference on the ith subcarrier is given as follows: where Δ∠ ĥi = ∠ ĥi,1 − ∠ ĥi,2 and Δ∠h i = ∠h i,1 − ∠h i,2 are the measured CSI phase difference and the true phase difference values of the ith subcarrier, respectively.Δδ i = δ i,1 − δ i,2 is the timing lag difference at the adjacent receiver antennas.Δβ is the unknown phase offset difference, and ΔZ i is some measurement noise difference.The three receiver antennas are placed at a distance of half the wavelength from each other, and denote λ as the wavelength, c as the light speed, f as 5 Journal of Sensors the center frequency, θ as the angle of arrival, and T s as the sample interval (T s is 50 ns with 20 MHz bandwidth).We can roughly estimate the Δδ i as follows: As we select the WiFi setting running on 2.4 GHz frequency, Δδ i is thus approximately equal to 0.0041.With the given k i , the measured phase difference Δ∠ ĥi can be expressed as follows: The Figure 4 shows the raw phase (marked as blue dots) and the phase difference between antenna number 1 and antenna number 2 (marked as red cross) and antenna number 2 and antenna number 3 (marked as green circle) of the 20th subcarrier in the polar coordinate plot for 1000 consecutively received packets.From Figure 4, we can see that the raw CSI phase scatters randomly over all feasible angles between 0 °and 360 °; however, the phase difference concentrate into a sector between 0 °and 15 °as well as 340 °and 355 °, which indicates that the measured phase difference data on each subcarrier between adjacent antennas is stable enough for motion detection.
Figure 5 plots the CSI phase difference in static and dynamic environments.We can see that the phase difference remains stable with no human movement in the environment, while become inordinate when there exists some movements.

Feature Extraction.
It is critical to extract appropriate features for a device-free detection system.In this module, we extract some features from CSI phase difference and amplitude, considering to build a real-time, robust, and reliable device-free detection system; the features we selected need to meet two conditions: (1) sensitive to human presence and (2) resistive to environmental variations.After the data preprocessing in the previous module, we get the phase difference as an input.In the previous work, various metrics such as variance, mean, and distribution distance have been exploited for detection.Previous work [3,4] only seeks for amplitude-based or combination of amplitude and phase.In this paper, we leverage phase difference-based features for motion detection.
For extracting features for motion detection, we construct corresponding covariance matrix Ĥ and Φ from the    Journal of Sensors normalized CSI amplitude H and the normalized phase difference Φ, respectively.The covariance matrix can be represented as follows: where cov H i , H j denotes the covariance between H i and H j , H indicates the normalized version of variable H. Afterwards, we calculate the eigenvalues of both CSI amplitude covariance matrix and phase difference covariance matrix, which finally form a six-tuples For both eigenvalues α and β, with lower eigenvalues, the link is more likely to be static and free of intrusion.In contrast, higher eigenvalues would indicate that some people intrude the monitoring area and cause dynamic changes.Figure 6 plots the amplitude and phase feature distribution with human-free and human present for 580 samples.The first 340 feature samples indicate a human-free state, and the last 240 feature samples mean human intruded.Apparently, we can see that both amplitude and phase difference feature metrics in the case of human intrusion changed significantly compared with the static cases.However, compared in Figures 6(a) and 6(b), we can see that the amplitude features are not sensitive than phase difference features in some sample points.This also explains that phase difference is more robust and sensitive to the environment than amplitude because it is the sum of individual variance between two antennas.

Motion Detection.
After extracting features from CSI amplitude and phase difference, we need to choose an appropriate classification method to classify these features and determine if anyone broke in.We can classify the extracted features into two categories: nonobjective class and objective class.
To test the validity of the extracted features, Figure 7 plots the distribution of amplitude features α i , phase difference features β i , and their combination for 540 groups of measurements.Considering the contingency of measurement, we collect CSI data in different environments and periods.In Figure 7(a), we can see that there is no longer a clear gap for identifying human movement when we use amplitude features α 1 and α 2 as input.However, when the phase difference features β 1 and β 2 are used as input, an obvious hyperplane divides the feature points into two parts in Figure 7(b).From Figures 7(c) to 7(e), we can see that the effect of classification improved as the phase difference features added.Therefore, we choose the phase difference features for human detection.
We apply three kinds of machine-learning classification algorithms including the support vector machine (SVM), random forest (RF), and K-nearest neighbor (KNN) for distinguishing motion detection.
We first conduct a SVM by utilizing a LIBSVM tool [31] on the phase difference features β 1 and β 2 collected, as shown in Figure 8, a clear gap can be seen to distinguish the data corresponding to the presence and absence of intruding human.Figure 8 shows the preliminary classification results using a SVM with only a few CSI samples, and we prove that it is sufficient to provide a satisfied detection performance in the experiments and evaluation part.

Experiments and Evaluation
In this section, we first explicate the prototype implementation of our PhaseMode system and describe the details of experimental settings.Then, we analyze the experimental methodology.Finally, we present the performance evaluation of PhaseMode in three typical indoor scenarios.
6.1.Implementation.In this section, we conduct our extensive experimental studies to evaluate the proposed system, PhaseMode.We prototype PhaseMode with commodity WiFi devices and evaluate its performance in a typical office building including a meeting room, corridor, and a laboratory as shown in Figure 9.We employ a Sony laptop running Ubuntu 14.04 OS equipped with COS Intel 5300 NIC and a modified firmware as the receiver.A commercial TP-LINK TL-WR880N wireless router is set as the transmitter operating in IEEE 802.11nAP mode at 2.4 GHz.The three omnidirectional receiver antennas are placed at a distance of 6.25 cm, which is half of the wavelength in the 2.4 GHz band.We send the ping packets from the transmitter to the receiver antennas and extract the phase difference information from the neighbor antennas for motion detection.
6.2.Experimental Methodology.We collect data from two categories: (1) static data (there is no person present in the monitoring area) and ( 2) dynamic data (one or more persons walking in the monitoring area).We do our experiments in the corridor, laboratory, and meeting room, respectively, as shown in Figure 10, and we list some parameters of the three experimental areas in Table 1.To collect dynamic data, we let one to three experimenters randomly walking around the interesting area at normal speed.We set the transmitter and receiver antenna at the height of 1.4 m in the corridor, laboratory, and meeting room in order to avoid the signal being blocked by the indoor facilities.Particularly, we consider LOS propagation with different distances ranging from 2 meters to 6 meters.For intrusion target detection, we first apply the wellknown support vector machine (SVM) with the features,  (i) True positive rate (TPR): the probability that a moving human presence is correctly classified.
(ii) True negative rate (TNR): the probability that no human presence is correctly identified.
(iii) Detection accuracy: the probability of identifying the environmental changes in different scenarios.
6.3.2.Overall Performance.Firstly, we conduct our experiments in different environments to examine the overall performance of our system.Figure 11 shows the performance of moving detection using different features with three kinds of the classification algorithm.From Figure 11, we can see that the TN rate of both phase difference feature and amplitude and phase difference feature is higher than amplitude-based and the same as the TP rate.The detection accuracy results are shown in Table 2.
6.3.3.Impact of the Number of Features.We inspect the impact of the number of features on detection accuracy in different scenarios.From Figure 12, we can see that the detection accuracy undergoes some loss but still keeps at 99.62% with the number of features increase and more higher than the PADS method, which exploit both amplitude and phase information.The phase differencebased features we extracted are based on the correlation between neighbor subcarriers, which fluctuate with the change of the environment.The first several features represent the correlation to a great extent; applying more features will result to the reduction of detection accuracy.As illustrated in Figure 12, we can use two features to achieve a high motion detection accuracy.
6.3.4.Impacts of Sliding Window Size. Figure 13 shows the detection accuracy for different sliding window sizes.We compare our system with FIMD and PADS.As illustrated in Figure 13, for all three schemes, the larger the size of the sliding window, the higher the detection accuracy in the overall trend.With a larger window size, we get more feature samples in the time dimension that might alleviate the influence of temporal variance.However, when the size reaches some threshold, the rate might keep stable.Compared with PADS, our system achieves a slightly better detection performance.
Phase diff Amplitude and phase diff Amplitude

Conclusion
In this paper, we design and implement a new passive devicefree scheme to detect indoor human intrusion leveraging wireless physical layer information CSI in commercial NICs.We implement the system on COTS WiFi devices and evaluate it in real different scenarios including a laboratory, corridor, and meeting room.The experimental results demonstrate that our system can improve the sensitivity as well as robustness compared with the previous schemes, and the average detection accuracy can be up to 99.4%.

Figure 5 :
Figure 5: A sample phase difference of 470 packets in two different situations.

Figure 6 :
Figure 6: Feature distribution with human-free and human present.

Figure 7 : 1 Figure 8 :
Figure 7: The feature distribution of amplitude and phase difference.

Table 1 :
Parameters of experimentation.thatis, β 1 , β 2 , β 3 , to obtain a threshold line, based on a portion of measurements.6.3.Performance Evaluation 6.3.1.Evaluation Metrics.We mainly use the following metrics for evaluating the performance of our system.
diff Phase diff Amplitude (b) TP rate with human walking

Figure 11 :
Figure 11: Detection accuracy with different features.

Figure 12 :
Figure 12: Impacts of the number of features on detection accuracy.

Figure 13 :
Figure 13: Detection accuracy with different window sizes.

Table 2 :
Detection accuracy in different scenarios with three classification algorithms.