Anomaly Detection for Sensing Security

2025-06-12

AI Summary

To address the challenge of detecting motion eavesdropping attacks in WiFi Channel State Information (CSI)-based sensing security, this paper proposes a lightweight and environment-robust anomaly detection method. To meet real-time detection requirements under thermal drift and phase noise interference, we introduce, for the first time, a CSI feature collaborative prediction framework integrating moving average, autoregressive modeling, and Kalman filtering, coupled with a bidirectional/unidirectional hypothesis testing mechanism. Experiments on commercial WiFi devices validate the effectiveness of multiple algorithm-feature combinations against motion attacks and demonstrate that transmit power randomization alone is insufficient to thwart CSI-aware adversaries. Consequently, we propose a novel frequency-variation randomization paradigm. Our approach significantly enhances detection robustness and real-time performance, overcoming key limitations of conventional physical-layer defenses.

Technology Category

• Computer Vision: Motion & Tracking
• Machine Learning: Privacy
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Various approaches in the field of physical layer security involve anomaly detection, such as physical layer authentication, sensing attacks, and anti-tampering solutions. Depending on the context in which these approaches are applied, anomaly detection needs to be computationally lightweight, resilient to changes in temperature and environment, and robust against phase noise. We adapt moving average filters, autoregression filters and Kalman filters to provide predictions of feature vectors that fulfill the above criteria. Different hypothesis test designs are employed that allow omnidirectional and unidirectional outlier detection. In a case study, a sensing attack is investigated that employs the described algorithms with various channel features based on commodity WiFi devices. Thereby, various combinations of algorithms and channel features show effectiveness for motion detection by an attacker. Countermeasures only utilizing transmit power randomization are shown insufficient to mitigate such attacks if the attacker has access to channel state information (CSI) measurements, suggesting that mitigation solutions might require frequency-variant randomization.

Problem

• Anomaly detection for physical layer security in varying environments
• Developing lightweight, resilient algorithms for sensing attack detection
• Evaluating countermeasures against WiFi-based motion detection attacks

Innovation

• Adapt moving average and Kalman filters
• Employ omnidirectional hypothesis tests
• Use frequency-variant randomization countermeasures