Passive Localization of Moving Target with Channel State Information

. With the popularity of wireless networks and smart devices, wireless signal-based passive target sensing and localization have become a hot research topic and attracted numerous researchers ’ interests. The existing passive localization solutions require multiple receivers, which is not practical for real-world applications. In response to this compelling problem, in this paper, we propose a practical single access point-based passive moving target localization system. Concretely, it ﬁ rst utilizes multiple antennas of the access point to form an antenna array and extended antenna, to capture channel state information (CSI) at di ﬀ erent spatial locations. Then, leveraging the obtained CSI, the signal parameters, including the angle of arrival (AoA) and time of ﬂ ight (ToF), are estimated. Based on the estimated signal parameters and the locations of the antenna array and extended antenna, ﬁ nally, the passive localization of the moving target is realized. Comprehensive experiments are conducted under the real-world scenario with two di ﬀ erent test platforms, and the experimental results show the proposed algorithm ’ s median localization can reach 1.087m when the number of antennas is 4 and the signal bandwidth is 80MHz, demonstrating the e ﬀ ectiveness of the proposed algorithm.


Introduction
With the ubiquitous penetration of wireless signals and high levels of public acceptance of smart devices, passive localization has become a research hotspot, with important applications, including security surveillance [1] and elderly care [2]. During the last few years, diverse methods have been used for the passive localization, such as visible light [3,4], infrared [5,6], and ultrasound [7,8]. Some of these systems can realize an impressive localization accuracy. However, for the real-world passive localization, the Wi-Fi-based system stands out as a particularly promising method, due to the pervasive availability of Wi-Fi access points (APs) [9], especially with the emergence and use of PHY channel state information (CSI) in recent years [10].
Typically, Wi-Fi-based localization systems can be divided into two main categories. The first one works in an active manner, which always employs multiple receivers (or single receiver) to capture signal travels from the transmitter to the receiver directly and extract signal parameters, such as received signal strength (RSS) [11], angle of arrival (AoA) [12], time of flight (ToF) [13], and angle of departure (AoD) [14], to realize indoor localization of the transmitter. For example, BMW [15] employs the output of the 9-axis sensor coupled with the pedestrian dead reckoning (PDR) algorithm to get a location estimation. On this basis, BMW fuses the estimated location with the RSS localization result via Kalman filter, to realize the localization of the user. Leveraging the CSI obtained by multiple receivers, the classic system SpotFi [16] estimates the signal AoA and combines the extracted AoA with the received signal strength (RSS) to realize the localization of the signal transmitter. Combining the CSI with deep learning, DeepFi [17] trains all weights of the deep network as fingerprints in the off-line training phase and employs a greedy learning algorithm to reduce complexity. During the online localization phase, DeepFi uses a probabilistic method based on the radial basis function to realize localization. ToneTrack [18] proposes a novel algorithm, which combines time-of-arrival (ToA) data from different transmissions as a mobile device hops across different channels, approaching time resolutions previously not possible with a single narrowband channel. On this basis, it can accurately estimate the signal ToF and achieve localization based on the estimated ToF. Recent work M3 [19] jointly estimates AoA, relative ToF (rToF), and AoD based on the CSI extracted from a single receiver and pinpoints the transmitter based on these extracted parameters, under the line-of-sight (LoS) scenario. Some other researchers [20] first construct constraints by using ToF differences between reflection paths and direct path. Then, with the help of AoA, they develop a Particle Swarm Optimization-(PSO-) based searching algorithm to realize the target and reflection point localization.
The other one is the device-free localization system, which works in a passive manner, indicating they achieve the localization without the requirement for having the user carry any wireless-enabled devices [21][22][23][24][25]. Essentially, this kind of system focus on estimating parameters of the signal reflected from the target. On this basis, these systems utilize the estimated signal parameters and the spatial location of the receiver to construct geometric constraints, so as to realize passive localization of the target. For instance, IndoTrack [12] estimates the Doppler and AoA of the signal reflected by the target through the CSI obtained by multiple receivers, which are deployed in different spatial locations. Then, it estimates target velocity and location to rebuild the absolute trajectory of the moving target through the proposed probabilistic comodeling of spatialtemporal Doppler and AoA information, which are estimated from the CSI obtained by multiple receivers. Leveraging the incoherence between the direct signal and target-induced reflection (TIR), MaTrack [26] estimates the AoA of the TIR and combines the estimated AoA with the locations of receivers to achieve passive target localization. By using the three-dimensional multiple signal classification (3D-MUSIC) algorithm and the proposed interference cancellation algorithm, our previous work [27] estimates the AoA, ToF, and Doppler frequency shift (DFS) of the TIR under the through-the-wall (TTW) scenario, so as to achieve TTW passive moving target localization. Some other systems, such as Widar 2.0 [28] and mD-Track [14], use SAGE [29], cross-correlation, and other algorithms to estimate more signal parameters, including ToF, AoA, AoD, and DFS, and construct geometric constraints based on the estimated signal parameters and locations of transmitter and receiver, to achieve passive localization of the target. These systems rely on accurate signal parameters estimation, indicating the resolvability is important for these systems. So, some recent works attempt to enlarge the antenna array by physically moving the antenna and form a larger bandwidth by combining adjacent channels via channel hopping [30,31], so as to further improve the signal parameter estimation accuracy and localization accuracy.
Although promising, it is not difficult to see that all above mentioned passive localization systems strongly rely on the assumption, that is, no matter how many receivers are involved in passive localization, the location of the transmitter is fixed and preacquired. This assumption could be broken easily under the real-world scenario, since the user may move their device (such as laptop and cell phone, which may act as the signal transmitter), driving the location of transmitter unpredictable and finally lead to a failure in passive localization. So, we ask the following question: is it possible to realize the passive localization with only one receiver, while holding no requirement for the preobtaining location of the transmitter?
In this paper, we propose a single receiver-based passive localization system SR-PLoc, which employs the CSI measurements obtained by a single receiver to achieve passive localization of the target without preobtaining the location of the transmitter or assuming it is never changed. The essential observation lies in SR-PLoc is that the phase errors [31], including carrier frequency offset (CFO), sample frequency offset (SFO), and packet detection delay (PDD), are caused by the unsynchronization between transmitter and receiver and hardware imperfection, indicating all propagation paths (including the direct path from the transmitter to the receiver and the TIR) recorded by CSI, undergo the same phase error. Leveraging this fact, SR-PLoc first uses multiple antennas of the receiver to form an antenna array and extended antenna, so as to capture the CSI at different locations. Based on the obtained CSI, SR-PLoc estimates AoA and ToF of the direct signal and TIR. Finally, SR-PLoc combines the estimated signal parameters with the locations of the antenna array and extended antenna to construct geometric constraints, so as to realize the passive localization of the moving target. Unlike the previous works, the proposed SR-PLoc achieves the passive localization of the moving target with only one receiver, while holding no need for preobtaining the location of the transmitter. We build two test platforms and carry out rich experiments under the real-world scenario. The experimental results demonstrate the effectiveness and practicability of the proposed algorithm.

Materials and Methods
SR-PLoc aims to realize passive localization of moving target with a single receiver; the whole localization process mainly includes three steps, as Figure 1 shows.

CSI Obtaining and Signal
Parameter Estimation. Considering a receiver with multiple antennas, SR-PLoc builds a uniform linear array (ULA) with antenna spacing of halfwavelength and extended antenna to capture the CSI at different locations, as Figure 1 shows. At time t, the reported CSI measurements extracted from ULA and extended antenna can be expressed as where h i,k is the CSI corresponding to kth subcarrier of the i th antenna of the ULA, c k ðtÞ is the CSI extracted from the k th subcarrier of the extended antenna, and I and K are the 2 Journal of Sensors number of antenna and subcarrier, respectively. Taking the multipath effect into consideration, the received signal is a superposition of multiple signals. Thereby, we have where h i,k is the CSI extracted from the kth subcarrier of the ith antenna; G R and G D are the sets of the direct path and reflection path components, respectively; c k is the CSI extracted from the kth subcarrier of the extended antenna; and n i,k and n k are the noise. Without loss of generality, for any propagation path l ∈ fG D ∪ G R g, one can see that the CSI extracted from ULA and extended antenna can be denoted as where α l , τ l , θ l , and n l i,k are the attenuation, ToF, AoA, and noise of the lth propagation path, respectively, corresponding to the ULA; f c is the central frequency; f k = f c + ðk − 1ÞΔf is the frequency of the kth subcarrier; Δf is the frequency spacing between two adjacent subcarriers; and α l ′, τ l ′, and n l k are the attenuation, ToF, and noise of the lth propagation path, respectively, corresponding to the extended antenna. In practice, due to the phase error induced by PDD, CFO, SFO, the real CSI extracted from the antenna array and extended antenna can be denoted as where λ b and λ o are the time offset introduced by the PDD and SFO, respectively, and e −j2πβ is the phase offset induced by CFO. When the target moves within the detection area, the propagation path length of the TIR changes accordingly, which introduces a nonnegligible DFS to the human-induced where v t is the speed of path length change and c is the speed of light. Considering the time interval between two adjacent CSI packets is Δt, at time ðt + ΔtÞ, we have Taking the first CSI measurements as a reference, for a CSI trace with M measurements, we have where ⊗ represents the Kronecker product. Based on the above analysis, it can be seen that, through the phase difference between antennas, subcarriers, and measurements, the CSI trace describes the AoA, ToF, and the DFS, respectively. So, the 3D-MUSIC algorithm, presented in our previous work [27], is used to estimate signal AoA, ToF, and DFS jointly. Taking the CSI received by the array as an example, here, we briefly describe the estimation process. First, we rewrite the CSI trace as where

Journal of Sensors
Then, the three-dimensional smoothing is performed on H to eliminate the influence of coherent signals on parameter estimation. After that, the eigenvalue decomposition is conducted on the autocorrelation matrix of H ′ , which is the smoothed form of H. Based on the Minimum Description Length (MDL) criterion [32], the dimension of noise subspace is estimated, so the noise subspace E n , spanned by small eigenvalues, can be extracted. At last, the signal AoA, ToF, and DFS is estimated via the function where aðθ, τ, vÞ is the corresponding steering matrix and f⋅g H is the conjugate transpose operator. In a similar way, SR-PLoc uses the CSI extracted from the extended antenna to realize the joint estimation of DFS and ToF. Due to the phase error introduced by the PDD, CFO, and SFO, the estimated ToF is not the absolute signal ToF. However, the signal AoA and rToF between different propagation paths are not contaminated, since the phase error is the same for all paths, as discussed above. So, based on the estimated signal parameters, SR-PLoc filters out moving target introduced reflection by analyzing the DFS and employs its AoA and rToF to achieve passive moving target localization.

Passive Moving Target Localization.
Assuming the coordinates of the transmitter, moving target, antenna array, and extended antenna are l T ½x t , y t , l R ½x r , y r , l A ½x a , y a , and l E ½x e , y e , respectively, as Figure 2 shows, then, based on the estimated signal parameters and previous discussion, we have where k⋅k 2 is two-norm operator; Δτ × c is the distance corresponding to the ToF offset induced by phase error; ε TA , ε TE , and ε TRA are the estimating error;τ ta andτ te are the estimated ToF of the direct path from transmitter to the antenna array and extended antenna, respectively; andτ r is the estimated ToF of the moving target induced reflection arrives at the antenna array. Combining the AoA of the direct path estimated by the antenna array with the first two equations in Equation (10), the following constraints can be built whereφ is the estimated AoA of the direct path from the transmitter to the antenna array and ε φ is the AoA estimating error. Leveraging Equation (11), the location of the transmitter can be calculated where When y t = y a , it indicates the AoA of the direct path reaches 90 degrees. At this time, the localization of the transmitter can be achieved via the rToF. After obtaining the location of the transmitter, one can see that  Figure 2: The receiver of the SDR test platform. The receiver is composed of three independent X310, which can provide 6 RF channels to receive the wireless signal, and the signal bandwidth can reach up to 100 MHz. 4 Journal of Sensors which is an elliptic equation, indicating the moving target is located on an ellipse whose focus is transmitter and antenna array. Meanwhile, based on the estimated AoA of the moving target induced reflection, we have where e θ is the estimated AoA of the TIR and ε θ is the AoA estimating error. Leveraging the constraints given in Equations (14) and (15), finally, the location of the moving target can be calculated as where So far, by using the AoA (extracted from the CSI obtained by the antenna array) and the rToF (extracted from the CSI obtained by the antenna array and extended antenna), SR-PLoc realizes the passive moving target localization. Since the reflection paths are weaker than the direct signal traveling from the transmitter to the receiver, SR-PLoc employs the CSI-CR algorithm proposed in our previous work [33] to reduce the direct path induced interference to further improve the ToF estimation accuracy, during the parameter estimation process.

Results and Discussion
3.1. Implementation. To verify and evaluate the performance of SR-PLoc, comprehensive experiments are carried out in a typical indoor office room, which, as Figure 3 shows, contains office furniture such as computers, work desks, and bookcases. Multiple test locations, which are denoted as blue dots, are selected for the moving target. At the same time, to fully analyze the system performance, multiple test locations are selected for the transmitter and extended antenna, which are denoted as green and red boxes, respectively. To accurately obtain the ground truth of the reflection, the tester is asked to stand at the test reflection locations and wave an iron plate to generate the reflection path.
To test the performance of the proposed algorithm with different configurations (i.e., different bandwidth and the number of antennas), two test platforms are constructed, as Figures 2 and 4 show.
(i) As presented in Figure 2, the first one is the Software Defined Radio (SDR) platform. The receiver includes three USRP X310 devices [34] with six RF UBX-160 cards, which are synchronized via the OctoClock-G [35] to ensure antennas (including antenna array and extended antenna) can sample the spatial signal simultaneously. The transmitter contains a USRP X310 device with two RF UBX-160 cards to send the signal. The workstation equipped with GNU radio is used to control SDR equipment, to send the signal, or extract CSI from the received OFDM signal, which can cover a bandwidth up to 100 MHz (ii) The second one is a commercial access point (AP) equipped with Broadcom 4366C0 wireless NIC and NexMon tool [36]. A computer with Ubuntu 18.04 operating system controls an AP, which acts as the receiver, to complete the CSI data extraction via instructions set. Another AP with the same configuration is used as the transmitter to send the signal. The receiver of this platform contains four antennas, which can collect CSI with a bandwidth up to 80 MHz based on the IEEE 802.11 ac protocol During the experiment, the default signal bandwidth is 80 MHz, the central frequency is 5G Hz, the number of antennas in the antenna array is 3, the CSI packet transmission rate is 200 Hz (i.e., the transmitter sends 200 packets per second), and the number of the extended antenna is 1. Both transmitter and receiver are placed 1.5 meters above the ground. Before the test, the power splitter is used to measure the phase difference among different RF channels. The measured phase difference will be used to compensate for the initial phase offset to make sure the AoA can be estimated effectively. Leveraging the data collected from these platforms, the system evaluation is conducted from three aspects. At first, the localization accuracy of the transmitter is briefly analyzed. Next, the impact of the transmitter's location on the moving target localization accuracy is analyzed. At last, the localization accuracy of the moving target with different configurations is inspected, including the impact of the signal bandwidth, number of antennas in the ULA, and location of the extended antenna.

Performance Evaluation.
At first, the transmitter localization performance of SR-PLoc is analyzed via the comparison with SIFI [37], which expands multiple antennas of a single receiver to capture CSI at different locations and estimate ToA to realize localization. The localization performance comparison is presented in Figure 5, via the Cumulative Distribution Function (CDF) of the localization error. One can see from the result, SR-PLoc's median localization error is about 1.016 m, which is slightly better than SIFI's 1.110m when the extended antenna is at R1. The error under the ratio of 66.7% of SR-PLoc can reach 1.220 m, which is 0.121 m lower than that of SIFI, demonstrating the effectiveness of the proposed SR-PLoc in transmitter localization. When the extended antenna is at R2, one can see that the transmitter localization accuracy is further improved. Concretely, SR-PLoc's median localization error and error under the ratio of 66.7% can reach 0.821 m and 1.088 m, respectively. The reason for this enhancement is that the layout of the receiver is more suitable for localization when the distance between the extended antenna and the antenna array is increased within a reasonable range. However, for the real-world application, this distance should not be too large; otherwise, it will cause inconvenience to the deployment of the receiver.
After the transmitter localization performance evaluation, next, the impact of the transmitter's location on the moving target localization accuracy is analyzed and the result is presented in Figure 6. Overall, it can be seen that, on the one hand, SR-PLoc performs better when the extended antenna is at R2. This can be explained by that the transmitter localization accuracy is higher when the extended antenna is at the R2, resulting in an improvement of moving target localization accuracy. On the other hand, when the transmitter is at T2 and T3, the localization accuracy moving target is better than that of the transmitter at T1 and T4. Taking the median localization error as an example, when the extended antenna is at R1, the median localization error can reach 1.592 m, 0.959 m, 0.759 m, and 1.211 m when the transmitter is at T1, T2, T3, and T4, respectively. A similar trend can be observed when the extended antenna is at R2. This is because T1 and T4 are at the edge of the test area, indicating the transmitter is close to the wall and furniture, which may introduce strong reflection and cause a decrease in the accuracy of parameter estimation and finally lead to a failure in filtering out the moving target induced reflection.
With different signal bandwidths, the localization accuracy of the moving target is analyzed. From Figure 7, it is not hard to observe that the moving target localization performance is boosted with the increase of the signal   Figure 7, one can see that the moving target localization accuracy is improved when the extended antenna is moved to R2. This can be also inter-preted by that the layout is more suitable for localization when the distance between the extended antenna and the antenna array is increased. At last, we analyze the impact of the number of antennas on the moving target localization accuracy. As Figure 8 shows, it can be seen that the median localization error of SR-PLoc can reach 1.708, 1.087 m, 0.931 m, and 0.710 m, with 2, 3, 4, and 5 antennas in the antenna array, respectively, when the extended antenna is at R1. This phenomenon means the localization accuracy is positively correlated with the number of antennas. Since the increase in the 7 Journal of Sensors number of antennas improves the AoA estimation accuracy and finally results in the improvement of localization accuracy. Comparing two subgraphs in Figure 7, one can see that the median localization error of SR-PLoc is reduced by about 0.104 m, 0.101 m, 0.104, and 0.113 m, with 2, 3, 4, and 5 antennas in the antenna array, respectively, when the extended antenna is moved to the location R2. Similar to the previous result, this enhancement is also introduced by the improvement in transmitter localization accuracy.

Conclusions
In this paper, we propose SR-PLoc, a single receiver-based passive moving target localization system. Taking the nonsynchronization between the transmitter and the receiverinduced phase errors recorded in CSI into full consideration, the proposed algorithm constructs an antenna array and an extended antenna, by using multiple antennas from a single receiver, to capture the wireless signal at different spatial locations. On this basis, SR-PLoc estimates the signal AoA and ToF and combines the estimated parameters with locations of the antenna array and extended antenna to realize the passive localization of the moving target. Different from the existing solutions, which rely on the assumption that the transmitter's location is preacquired and unchanged, SR-PLoc holds no requirement for that, making it more promising for real-world applications. Comprehensive experiments are conducted based on the two test platforms, which are built upon the SDR equipment and commercial AP. The experimental results verify the effectiveness and practicality of the proposed algorithm, which lays a solid foundation for ubiquitous passive localization for the moving target.

Data Availability
The data that support the findings of this study are available from the corresponding author upon reasonable request.

Conflicts of Interest
The authors declare that there is no conflict of interest regarding the publication of this paper.