Abstract
At present, indoor intrusion detection technologies based on WLAN are widely applied to protect the privacy of users and have a robust anti-interference ability under the condition of the Non-line-of-sight (NLOS), which become the mainstream topics of domestic and foreign studies. Most of the existing researches rely on the signal strength to train heuristic models, while the relationship between intrusion targets and signal fluctuations is not explored fully. In this circumstance, this paper proposes a novel indoor intrusion detection method based on fuzzy membership degree and Dempster-Shafer Theory (DST). First of all, the correlation between WLAN signal fluctuation features and locations of intrusion targets are converted into DST mass function by fuzzy membership. Second, the reliability values from each MP are combined to select reliable reference positions by using the reliability combination rules in DST. Finally, the positions of the intrusion target are calculated based on the weighted maximum likelihood and centroid method. Finally, the related experimental results show that the proposed approach can not only ensure the high accuracy of intrusion detection but also obtain ideally accurate locations of the intrusion target.
Keywords
Introduction
Intrusion detection technology has a wide range of applications in the field of security monitoring such as valuables monitoring, empty-nest elderly monitoring, and military defense. The indoor intrusion detection technology based on WLAN has become the mainstream of domestic and foreign studies because of its user privacy protection effect and strong anti-interference ability under the non-line-of-sight condition. Generally, indoor wireless devices are used for communication purposes, and if the data obtained by the wireless device can be reused for indoor activity research, such as intrusion detection, we can not only save the cost of installing specialized equipment, but also use the collected data for testing and analysis at any time.
The concept of device-free intrusion detection [1–3] was first proposed in [4], in which the target to be detected neither carries special equipment nor actively participates in the intrusion detection process. For example, RASID [5, 6] uses the non-parametric kernel density estimation approach to calculate an upper bound from the offline silence profiles of the environment so that an intrusion is detected when the corresponding online profile exceeds this upper bound. The authors in [7] select the Hidden Markov Model (HMM) as a classifier to conduct intrusion detection. In order to compensate for the lack of data in the classifier used to train for the intrusion detection, the authors in [8] propose a multi-feature based Probabilistic Neural Network (PNN) to classify the silence and intrusion with high precision rate. Traditional Radio Frequency Identification (RFID) indoor positioning algorithms use Received Signal Strength (RSS) indicators to track objects. However, RSS values are susceptible to environmental noise and other disturbances. The authors in [9] propose an indoor positioning algorithm based on Bayesian probability and K nearest neighbor (KNN), the purpose is to reduce position fluctuations and errors caused by multipath and environmental disturbances. Previous indoor positioning methods mainly relied on labor-intensive on-site surveys at each location. To overcome this difficulty, the authors in [10] propose a new indoor positioning method that does not require on-site investigation or know the location of the AP. The main idea is to combine the RSS fingerprint with the user’s movement, the fingerprint is divided into different virtual rooms, and the logical floor plan is constructed accordingly. Aiming at the symmetry of human motion, the authors in [11] propose an indoor dynamic positioning method with error self-correction function, which uses inertial positioning to compensate for the sensitivity defects of Ultra Wideband (UWB) signal obstacles. Recently, the WLAN-based indoor intrusion detection technology describes the parameters of the intrusion target location information, mainly including the physical layer signal characteristics of the WLAN signal—Channel State Information (CSI) and link layer signal characteristics—the received signal strength RSS.The FILA system proposed in [12], which uses channel state information (CSI) to establish a propagation model and fingerprint identification system, which effectively solves the distance estimate of received RSS affected by changes in time and space due to multipath effects.Additionally, it can be extracted from certain NICs without any firmware modifications [13]. CSI contains the subcarrier information of OFDM frame, and it has a great improvement in detection accuracy compared with RSS. By using signal statistical features such as moving average and moving variance, the algorithm in [14, 15] records the WLAN signal variance as the feature in the silent state in the offline phase, and then performs the target intrusion detection according to the change of this feature relative to the silent state in the online phase. The studies in [1–5] are all based on the characteristics of RSS, but in the intrusion detection, the APs are challenging to perceive weak changes in the environment, so it is not easy to detect changes in the actual environment with the simple classification learning. The neural network in [7, 8] requires a large amount of prior information for parameter training. Although the method based on the ray tracing [16, 17] does not need to collect data manually, but it is difficult to simulate the RSS distribution in the room when the environmental layout is complicated. In this circumstance, this paper proposes a DST intrusion detection method based on fuzzy membership degree, which is suitable for modeling the uncertainty of the indoor environment and the uncertainty of RSS signal fluctuations. The proposed system structure is shown Fig. 1 and the three main contributions of this paper are summarized below.
System structure.
1) We build an evaluation function (called mass function) based on fuzzy membership to evaluate the information provided by each MP.
2) An information combination evaluation system based on the DST is established with the purpose of combining the information from different MPs to maximize the useful information for evaluation.
3) The weighted maximum likelihood and centroid method is proposed to jointly estimate credible reference points.
The rest of this paper is outlined as follows. Section II shows some related work on indoor target intrusion detection systems. Section III includes the offline establishment of the intrusion detection fingerprint database, which describes the data collection method as well as the selection of RSS signal features. Section IV presents the online detection system, which describes the basic framework of DST, the establishment of the mass function based on fuzzy membership, and the evaluation method based on the joint rule of the mass function. Section V gives the location decision system, in which two position decision methods based on KNN and maximum likelihood estimation are considered. In section VI, we compare the proposed and some other off-the-shelf indoor intrusion detection methods. Finally, Section VII concludes this paper and also provides some future directions.
In 2007, Professor Moustafa of the University of Maryland firstly presented the WLAN unknown target intrusion detection at the 13th International Conference on Mobile Computing and Networks [18]. Professor Moustafa divides the location service into two categories: known target active location and unknown target intrusion detection according to whether the target to be located actively participates in the positioning. Among them, the target active positioning is known as the traditional WLAN indoor positioning, and the unknown target intrusion detection needs to realize the presence or absence of the unknown target and the detection of the existing area without carrying any hardware device. Unknown targets generally refer to invading human targets that interfere with the propagation of WLAN signals.Since the unknown target intrusion detection based on WLAN technology can detect and locate unknown targets without any hardware devices, its application value can be reflected in many emerging fields. Existing indoor target intrusion detection systems mainly utilize video images [19], Global Positioning System (GPS) [20], infrared ray [21], ultrasonic wave [22], pressure sensors [23], and wireless sensor networks [24]. Video images have the problem of user privacy leakage, and also it cannot be used at night or in poor lighting conditions. GPS, infrared ray, ultrasonic wave, and pressure sensors typically require detected targets to carry special hardware devices. Wireless sensor networks often require a large number of sensor nodes to be deployed in the detection area, which results in the high system deployment cost.
In recent years, neural networks (NN) is utilized to classify signal characteristics in silent and intrusive states in the target region. The authors in [25] propose a flexible position estimation algorithm using generalized regression neural network (GRNN) and weighted centroid localization. Specifically, firstly, using the RSS data collected from the reference node at the access point, two GRNNs are trained for the reference point coordinates. Then, the approximate position of the target point and its neighboring points is estimated using the network, and finally, the position of the target point is determined by calculating the weighted center of gravity of the neighboring nodes. The authors in [26] propose an indoor positioning system using the affinity propagation clustering algorithm and particle swarm optimization based artificial neural network (PSO-ANN). The clustering technique is used to reduce the positioning error and improve the prediction performance of the PSO-ANN model. The powerful learning capabilities of the PSO-ANN model enable the proposed system to adapt to complex indoor environments. At the same time, the fast learning and prediction speed of PSO-ANN will greatly reduce the time consumption. The authors in [27] proposes a wireless positioning method based on deep learning. For changing and unpredictable wireless signals, the location is projected into a four-layer deep neural network (DNN) structure that learns reliable features from a large number of samples, avoiding manual operations. In this circumstance, a great number of domestic and foreign scholars have begun to study indoor WLAN target intrusion detection systems, which are mainly based on the three typical algorithms below.
(1) Intrusion detection algorithm based on signal statistical features such as moving average and moving variance [28]: This algorithm needs to record the mean and variance characteristics of the WLAN signal in the silent state of the target area in the offline phase, and then perform the target intrusion detection according to the change of these characteristics in the online phase, but this an algorithm cannot estimate the location of the intrusion target.
(2) Intrusion detection algorithm based on the geometric position of the interfered link: This algorithm infers the interfered link according to the characteristics of the wireless link variation, and then estimates the intrusion target position by the geometric position coordinates of the interfered link such as the algorithm in [29] which achieving the target intrusion detection based on the geometric image relationship between the RF link change and intrusion target position, but the performance of this algorithm may deteriorate dramatically due to the severe multipath fading in indoor environments.
(3) Intrusion detection algorithm based on the fingerprint learning: This algorithm builds a prior knowledge base through collecting a large number of WLAN signal features in the target region as well as WLAN signals in different intrusion states in the offline phase, and then the location of the intrusion target is estimated by matching the new observation link interference value against the prior knowledge base in the online phase. For example, the Neural Network (NN) is used to classify signal characteristics in the silent and intrusive states in the target region [30]. However, the main problem of this algorithm is that the construction of the prior knowledge base usually involves the huge labor and time cost.
Compared to the algorithms mentioned above, the proposed one is based on the fuzzy membership degree and DST to investigate the correlation between WLAN signal fluctuation features and locations of intrusion targets with the purpose of achieving the high intrusion detection accuracy as well as low deployment cost.
Data collection and processing
A proper feature can bring a pretty effect in intrusion detection. This section will introduce the processes of data collection and feature selection. We assume that there are M APs (i.e., signal transmitter) and N MPs (i.e., signal receiver) in the environment and each MP is within the propagation range of every AP, and meanwhile a volunteer traverses Q different reference locations with the speed around 1 m/s. When the volunteer walks at the position j, the signal strength from the m-th AP at the n-th MP is set as
Fuzzy membership evaluation
After the fuzzy theory is first proposed in [31], the fuzzy theory extends the object of mathematical research to qualitative and unified objects and concepts with ambiguity [32–33]. The fuzzy theory extends the object of mathematical research to the object of uniform mass and quantity and also the concept of ambiguity. Based on this, this paper introduces the fuzzy set theory into the intrusion detection system to solve the problem of modeling subjective trust with ambiguity.
Fuzzy membership
In fuzzy set theory, we let U ={ x1, x2, …, x n } be a collection of all elements, μ A be a function that maps any A ∈ U into a value in the interval [0, 1], A (x) be a fuzzy set of U, and μ A (x) be the degree that the element x in U which belongs to A, such that μ A (x) : U → [0, 1] , x ∈ U.
Here, μ A (x) → 1 indicates that the membership is high, while μ A (x) → 0 indicates that the membership is low. Since the fuzzy identification information is obtained by the membership function, the determination of an appropriate membership function should be significantly considered, which will be carefully introduced in the next section.
Membership function determination
The fuzzy subset is completely described by its membership function, so the identification information is required to be obtained before the process of fuzzy recognition.
The standard deviation of RSS provided from M APs at the n-th MP is calculated by (1), from which we can obtain the set of standard deviations of RSS at the n-th MP relative to the position j as
Figure 2 depicts the relationship between the standard deviation of RSS and the distance between the intruder and transmitting AP, from which we can find that the closer distance between the intruder and AP results in the more significant impact on the standard deviation of RSS (i.e., greater fluctuation of the transmitted signal.
Standard deviations and membership function.
Dempster-Shaper theory is also known as DST. It is an inaccurate reasoning theory discovered by Harvard mathematician A. P. Dempster in the 1960 s by using upper and lower bound probabilities to solve multivalued mapping problems and further developed by his student Shafer to process the uncertain information [35]. DST does not need to know prior probabilities to be able to represent uncertainty well and is widely used to process uncertain data. It is used in many applications such as the information fusion, intelligence analysis, and multi-attribute decision analysis [36–38]. The degree of uncertainty about the object in DST is usually described by three functions, namely mass, plausibility, and belief. Various independent and irrelevant pieces of evidence are fused through specific joint rules for DST [39, 40]. In this section, the concept of DST is introduced to be applied into indoor intrusion detection systems.
Frame of DST
In DST, a finite set of recognition frames is defined as Θ ={ H1, H2, …, H n }, in which each element is corresponding to a basic event in the probability theory (or called as a primitive). By letting 2 Θ as the power of Θ, the all subsets of Θ, including the empty set φ is represented as 2 Θ = { φ { H1 } , …, { H i } , {H1, H2 } , …, { H1, …, H N } , Θ }. We assume Θ as an exhaustive set of all possible values for variable H, and then let the elements in Θ be mutually exclusive. Based on this, the choice of A depends on the level of knowledge, which is called as the frame of discernment. Here, the mass function m satisfies the conditions m (φ) =0 ∑A∈2 Θ m (A) =1,where m is the reliability assignment function of Θ and φ is an empty set. For all the A ∈ Θ, m (A) is the reliability function of A. When m (A) ≠ 0, A is set as the focal element to the reliability function and the reliability value of A reflects the reliability of A.
The credibility function bel is used to calculate the overall credibility of A, which is defined as the sum of the reliability of all subsets in A, notated as B, such that ∀∈2 Θ , bel (A) = ∑B⊆A,B≠φm (B).
In the context of the indoor intrusion. There are N distinct information sources S
i
(i ∈ { 1, ⋯ , N }), where the i-th information source corresponds to the ith MP
i
and corresponding that each hypothesis H
j
(j ∈ { 1, ⋯ , Q }) represents a reference point position P
j
. In any case, an intrusion position can be assumed to be located at position H
j
or
Since the evaluation of uncertain events is challenging, many existing studies rely on converting probability measurements into mass functions [41]. Since the probability distribution of an event is usually approximated by its histogram, the mass function can be modeled by the method proposed in [42], such that
Where
The reliability value given by mass function is low when the source S
i
is unreliable for hypothesis H
j
. Here, ωi,j = 1 indicates that S
i
is reliable for H
j
, while ωi,j = 0 indicates that S
i
is unreliable for H
j
. In the intrusion detection, the closer the intruder is to the AP, the greater the fluctuation of the signal and consequently higher standard deviation of RSS. In other words, the more useful information provided from the AP results in the more contribution given by the corresponding source, and thereby it is obtained that ωi,j (see (8)) is relative to the standard deviation of RSS from the i-th AP.
In the centroid mode: In general, the centroid of an object is the average position of the mass distribution of the particle system. By assuming that k (k ⩾ 3) ideally trusted positions are selected by the evidence combination, the position credibility value is inversely proportional to its Euclidean distance from the real position. Thus, the intrusion position can be obtained by the weighted centroid algorithm and the weight is calculated by
In the maximum likelihood mode: The maximum likelihood estimation uses observation results to derive out the optimal parameters through several experiments, which is often used in the localization algorithm to find the best position. After obtaining the positions of k candidate reference points, the least-square method is applied to calculate the position coordinates of the target node, such that
Environmental layout
The environmental layout selected for the testing is shown in Fig. 3, in which there are 7 APs (D-Link DAP 2310) and 7 MPs (SAMSUNG GT-S7568) placed at 2 m and 0.5 m height respectively. At each MP, 5-minute RSS data (with the sampling rate of 1 Hz) from each AP in silence and intrusion states are collected respectively. Also, we calibrate 90 reference positions in target environment to establish an intrusion fingerprint database for the testing.
Environmental layout.
To investigate the selection of the number of reference points at which the intrusion occurs, a comparison of the detection precision under different number of reference points is shown in Fig. 4, from which we can find that although the detection precision increases with the increase of the number of reference points, the more number of reference points results in the more laboring and computation cost. To be clearer, the average time cost of the fingerprint database establishment for each pair of AP and MP is shown in Table 1. From this table, we can find that our method is superior to the PNN [8] and ray tracing [17] in terms of time cost. This result is due to the reason that the ray tracing needs to traverse all the ray path combinations of the active part and the PNN requires collecting a large amount of RSS data for the training of network parameters, which both involve a huge computation cost.
Precision comparison under different number of reference points.
Average time cost of fingerprint database establishment for each pair of AP and MP
In the results that follow, we rely on three metrics, i.e., False Positive (FP), False Negative (FN), and Detection Accuracy (DA), to investigate the impact of DST based on the fuzzy membership degree on the performance of intrusion detection. Here, the FP is defined as the probability of judging as the intrusion state under the silence state, FN is defined as the probability of judging as the silence state under the intrusion state, and DA is defined as the probability of judging as correct states, and DA is defined as the probability of judging as correct states.(the FP, FN, and DA with different numbers of MPs is shown in Table 2. Based on this, Table 3 illustrates the FP, FN, and DA by the PNN, ray tracing, and our method, from which the effectiveness of our method is demonstrated.
FP, FN, and DA with different sliding window size
FP, FN, and DA with different sliding window size
FP, FN, and DA by different intrusion detection methods
For the sake of investigating the intrusion detection performance of our method, we compare it with the ray tracing and PNN in terms of cumulative probability distribution of positioning errors in Fig. 5. As can be seen from figure, the performance of intrusion detection can be significantly improved with the increase of the number of reference points, and meanwhile our method is verified to outperform the other two existing methods.
Performance comparison of different intrusion detection methods.
After four reliability positions are obtained by the evidence combination, the two proposed methods, i.e., centroid mode [45] and maximum likelihood mode [46], are used to conduct the localization. Fig. 6 shows much small distance errors between these two methods, which indicates that our method is robust to the choice of localization algorithms in terms of intrusion detection accuracy.
Localization result by different methods.
In this paper, we propose a new approach for indoor WLAN intrusion detection by using the fuzzy membership based on DST for data collection and processing, and also creating a fingerprint database at each reference point. In the fuzzy membership evaluation processing, we rely on a linear independent function to model the membership function, and meanwhile in DST evaluation, this membership function is selected as the mass function to evaluate each reference point. After that, in the decision making part, the weighted maximum likelihood and centroid modes are considered to obtain the location of the intrusion target. Finally, the experimental results show that our method is with better intrusion detection performance compared to the existing PNN and ray tracing. However, there are still some limitations of our method. For example, how to guarantee the performance of our method under the conditions of environmental change and small number of MPs forms an interesting topic in future.
Footnotes
Acknowledgment
The authors wish to thank the editor and reviewers for the effort in processing this paper and careful review. This work was supported in part by the Program for Changjiang Scholars and Innovative Research Team in University (IRT1299) and National Natural Science Foundation of China (61301126 and 61471077).