RASID: A Robust WLAN Device-free Passive Motion Detection System
aa r X i v : . [ c s . N I] F e b RASID: A Robust WLAN Device-free Passive MotionDetection System
Ahmed E. Kosba
Dept. of Comp. and Sys. Eng.Faculty of EngineeringAlexandria University, [email protected]
Ahmed Saeed
Dept. of Comp. Sc. and Eng.Egypt-Japan Univ. of Sc. andTech. (E-JUST), [email protected]
Moustafa Youssef
Dept. of Comp. Sc. and Eng.Egypt-Japan Univ. of Sc. andTech. (E-JUST), [email protected]
ABSTRACT
WLAN Device-free passive (
DfP ) indoor localization is anemerging technology enabling the localization of entities thatdo not carry any devices nor participate actively in the local-ization process using the already installed wireless infras-tructure. This technology is useful for a variety of applica-tions such as intrusion detection, smart homes and borderprotection.We present the design, implementation and evaluation of
RASID , a
DfP system for human motion detection.
RASID combines different modules for statistical anomaly detectionwhile adapting to changes in the environment to provide ac-curate, robust, and low-overhead detection of human activ-ities using standard WiFi hardware. Evaluation of the sys-tem in two different testbeds shows that it can achieve anaccurate detection capability in both environments with anF-measure of at least 0.93. In addition, the high accuracyand low overhead performance are robust to changes in theenvironment as compared to the current state of the art
DfP detection systems. We also relay the lessons learned duringbuilding our system and discuss future research directions.
Keywords
Anomaly detection, device-free passive localization, mo-tion detection systems, robust device-free localization.
1. INTRODUCTION
The increasing need for context-aware informationand the rapid advancements in communication networkshave motivated significant research effort in the areaof location-based services. This effort resulted in thedevelopment of many location determination systems,including the GPS system [1], ultrasonic-based systems[2], infrared-based (IR) systems [3], and radio frequency-based (RF) systems [4]. Moreover, motion detectionsystems, that aim at detecting the motion of an entitycarrying a device, were also developed [5–13]. Thesesystems require the tracked entity to carry a device thatparticipates in the localization process. Thus, we referto them as device-based systems.Motivated by the wide use of wireless LANs for indoor (cid:1)(cid:2)(cid:3)(cid:4)(cid:5)(cid:4)(cid:6)(cid:7)(cid:8)(cid:2)(cid:9)(cid:4)(cid:7)(cid:2)(cid:10)(cid:2)(cid:7)(cid:11)(cid:12)(cid:6)(cid:13)(cid:14)(cid:15)(cid:2)(cid:16)(cid:17)(cid:5)(cid:4)(cid:3)(cid:18)(cid:1)(cid:2)(cid:11)(cid:2)(cid:3)(cid:11)(cid:4)(cid:6)(cid:7)(cid:12)(cid:6)(cid:13)(cid:14)(cid:15)(cid:2)(cid:19)(cid:20)(cid:6)(cid:9)(cid:4)(cid:15)(cid:2)(cid:18)(cid:21)(cid:5)(cid:11)(cid:4)(cid:10)(cid:17)(cid:11)(cid:4)(cid:6)(cid:7)(cid:12)(cid:6)(cid:13)(cid:14)(cid:15)(cid:2)(cid:5) (cid:22)(cid:6)(cid:20)(cid:10)(cid:17)(cid:15)(cid:18)(cid:19)(cid:20)(cid:6)(cid:9)(cid:4)(cid:15)(cid:2)(cid:5)(cid:8)(cid:17)(cid:13)(cid:4)(cid:6)(cid:18)(cid:12)(cid:17)(cid:23) (cid:8)(cid:2)(cid:24)(cid:4)(cid:6)(cid:7)(cid:25)(cid:20)(cid:17)(cid:3)(cid:26)(cid:4)(cid:7)(cid:24)(cid:27)(cid:7)(cid:11)(cid:2)(cid:20)(cid:9)(cid:17)(cid:3)(cid:2)(cid:28)(cid:4)(cid:24)(cid:7)(cid:17)(cid:15)(cid:18)(cid:28)(cid:11)(cid:20)(cid:2)(cid:7)(cid:24)(cid:11)(cid:29)(cid:18)(cid:8)(cid:2)(cid:17)(cid:13)(cid:4)(cid:7)(cid:24)(cid:5)(cid:18)(cid:30)(cid:6)(cid:15)(cid:15)(cid:2)(cid:3)(cid:11)(cid:6)(cid:20)(cid:31)(cid:23)(cid:23)(cid:15)(cid:4)(cid:3)(cid:17)(cid:11)(cid:4)(cid:6)(cid:7)(cid:18)(cid:31)(cid:19)(cid:27) (cid:31) (cid:23)(cid:23) (cid:15)(cid:4) (cid:3) (cid:17) (cid:11) (cid:4) (cid:6) (cid:7) (cid:18) (cid:28) (cid:2) (cid:20) (cid:2) (cid:20) (cid:12)(cid:19) (cid:31)(cid:19)(cid:22)(cid:6)(cid:20)(cid:10)(cid:17)(cid:15)(cid:18)(cid:19)(cid:20)(cid:6)(cid:9)(cid:4)(cid:15)(cid:2)!(cid:23)(cid:13)(cid:17)(cid:11)(cid:2)(cid:18)(cid:12)(cid:6)(cid:13)(cid:14)(cid:15)(cid:2)(cid:22)(cid:6)(cid:20)(cid:10)(cid:17)(cid:15)(cid:18)(cid:19)(cid:20)(cid:6)(cid:9)(cid:4)(cid:15)(cid:2)(cid:30)(cid:6)(cid:7)(cid:5)(cid:11)(cid:20)(cid:14)(cid:3)(cid:11)(cid:4)(cid:6)(cid:7)(cid:12)(cid:6)(cid:13)(cid:14)(cid:15)(cid:2)
Figure 1:
RASID system architecture. communication, we recently introduced the concept ofdevice-free passive
DfP localization [14] which enablesthe detection and tracking of entities that do not carryany devices nor participate in the localization process.This concept depends on the fact that the presence andmotion of entities in an RF environment affects the RFsignal strength, especially when dealing with the 2.4GHz band which is used in different IEEE standardssuch as 802.11b and 802.11g (WiFi). Different
DfP al-gorithms were proposed for detection [14,15] and track-ing [14, 16–18] of entities in indoor environments. Ourfocus in this paper is on the detection problem.In particular, we address the problem of designinga low-overhead, accurate, and robust
DfP motion de-tection system. We introduce the
RASID system thatprovides a software only solution on top of the alreadyinstalled wireless networks enabling a wide set of appli-cations including intrusion detection, border protection,and smart homes. As a typical
DfP system,
RASID consists of signal transmitters, such as access points(APs), signal receivers or monitoring points (MPs), such1s standard laptops , and an application server whichcollects and processes information about the receivedsignals from each MP. The application server containsthe main system modules responsible for performing thedetection function (Figure 1).Our research on RASID is motivated by several fac-tors: First, the technologies that can be used to providethe desired detection capability (e.g. cameras [19], IRsensors, radio tomographic imaging [20], pressure sen-sors [21], etc) share the requirement of installing specialhardware. In addition, cameras and IR sensors are lim-ited to line-of-sight vision and thus the cost of coveringan area might be prohibitive. Moreover, regular cam-eras fail to work in the dark or in the presence of smoke.
RASID avoids these drawbacks by using the alreadyinstalled wireless infrastructure without installing anyspecial hardware. It also makes use of the fact that RFwaves do not require LOS for propagation.From another perspective, the previously proposedWLAN
DfP detection techniques [14, 15] provide goodperformance under strong assumptions, which limit theirapplication domain. For example, they are not robustto changes in the environment. That is they do notadapt to changes in the environment, e.g. humidity andtemperature changes. Moreover, their parameters needto be changed as the deployment area changes. In ad-dition, the technique proposed in [15] requires the con-struction of a human motion profile which leads to highoverhead inside large-scale environments. The cost ofthis technique may be prohibitive, as it requires accessto all areas of a building which might include restrictedor private areas and requires several hours of calibra-tion. Finally, all techniques were either evaluated incontrolled environments, e.g. [14], or in small-scale realenvironments, e.g. [15].In order to achieve its objectives,
RASID uses a sta-tistical anomaly detection technique to detect motioninside indoor environments.
RASID only constructs anon-parametric profile for the signal strength readingsreceived at the MPs when there is no human activityduring a short training phase of only two minutes, lead-ing to minimal deployment overhead.
RASID also em-ploys techniques for continuously updating its silenceprofile to adapt to the environment changes. The sys-tem also applies a decision refinement procedure in or-der to reduce the false alarms due to the signal noise.Furthermore,
RASID also provides an interface by whichthe regions of activity can be identified. We evaluatethe system in two different large-scale environments richin multi-path and compare
RASID to the state-of-the-art
DfP detection techniques [14, 15]. Our results showthat
RASID achieves its goals of high accuracy in bothenvironments with minimal deployment overhead. In Note that it is also possible to use the access points them-selves as monitoring points. addition, it is robust to changes in the environment.In summary, the contributions of this paper are four-fold: • We present the architecture and implementation of
RASID : a system that provides robust device-freemotion detection along with techniques for adapt-ing to environment changes and handling the wire-less signal noise. • We analyze different signal strength features thatcan be used for detection and identify the mostpromising one. • We evaluate the system in two different large-scalereal testbeds and compare it to the state-of-the-art
DfP detection techniques. • We present a comparison of parametric and non-parametric approaches for system operation.The rest of this paper is organized as follows: Section2 reviews related work. Section 3 presents the
RASID system architecture and operation. Section 4 presentsthe experimental evaluation of
RASID and a compari-son with other techniques. Section 5 compares the non-parametric approach used in the system to a parametricanalytical model for the system operation. In Section6, we discuss our experience with
RASID and presentsome open research issues for future work. Finally, Sec-tion 7 concludes the paper and discusses future work.
2. RELATED WORK
Motion Detection in device-based systems has beenan active field of research. Several works have been pro-posed to detect the motion of an entity carrying a deviceeither with the use of special hardware like accelerome-ters or motion sensors [5–8], or by using the existing net-work infrastructures like wireless networks [9–11] andGSM [12, 13].From the device-free perspective, multiple technolo-gies can be used to provide the desired capabilities in-cluding: ultra-wide band radar [22], computer vision[19], physical contact based systems [21] and radio to-mographic imaging [20]. Other technologies include theusage of wireless sensors for tracking transceiver-free ob-jects [23] as well as the usage of RFID tags [24]. Thosetechnologies share the requirement of installing specialhardware to handle the device-free different functional-ities. In addition, cameras and IR sensors are limitedto line-of-sight vision and thus they require a high costdeployment to cover all site regions. Moreover, regularcameras can fail to work in the dark or in the presenceof smoke, and they can cause privacy concerns. Ultra-wide band radar based techniques also suffer from highcomplexity. Moreover, some techniques can require highdensity to provide full coverage like radio tomographic2maging and physical contact based systems using pres-sure sensors.WLAN device-free passive systems try to avoid theabove drawbacks by using the already available wire-less infrastructure. The concept of device-free passivedetection and tracking using WLANs was first proposedin [14] with a large number of applications including in-trusion detection, border protection [25], smart homes,and traffic estimation [26]. Techniques for
DfP detec-tion [14, 15] and tracking [14, 16, 17] were introduced.The proposed techniques for the detection capabilityare either based on time-series analysis like the mov-ing average and moving variance techniques proposedin [14] or based on classification using the maximumlikelihood estimation [15].In comparison,
RASID uses anomaly detection tech-niques to identify the deviations from the normal (si-lence) state.
RASID system uses a semi-supervisedstatistical technique that models the learned normal be-havior using a kernel-function based non-parametric es-timation. The kernel-function based anomaly detectionhas been used in several applications where the distri-bution of the normal behavior is not known. For exam-ple, non-parametric estimation using Gaussian kernelswas used in network intrusion detection [27] and noveltydetection applied to oil flow data [28]. Also, density es-timation using Epanechnikov kernels was used in onlineoutlier detection in sensor data [29] and to achieve con-tinuous adaptive outlier detection on distributed datastreams [30].Compared to the previously proposed WLAN
DfP detection techniques, the usage of the statistical anomalydetection technique, along with the other techniques de-vised for adapting to environment changes and refiningthe decision, enable
RASID to achieve low deploymentoverhead, high accuracy and high robustness.
3. THE RASID SYSTEM
In this section, we give the details of the
RASID sys-tem. We start by an overview of the system architecturefollowed by the details of the system modules.
Figure 1 gives an overview of the system architec-ture. The modules of the proposed system are imple-mented in the application server that collects samplesfrom the monitoring points and processes them. Thesystem works in two phases: 1) A short offline phase,during which the system studies the signal strength val-ues when no human is present inside the area of interestto construct what we call a “normal or silence profile”for each stream. The profiles of all streams are con-structed concurrently in that short phase. 2) A moni-toring phase, in which the system collects readings fromthe monitoring points and decides whether there is hu- man activity (anomalous behavior) or not based on theinformation gathered in the offline phase. It also up-dates the stored normal profile so that it can adaptto environment changes. Finally, a decision refinementprocedure is applied to further enhance the accuracy.The
Normal Profile Construction Module constructsthe initial silence profiles based on a short, typically twominutes, training sample taken when there is no humanmotion present in the area of interest. (Section 3.3)The
Basic Detection Module examines each streamreadings in the monitoring phase and decides whetherthere is an anomalous behavior or not. This operationis applied to each stream independently. It also assignsan anomaly score to each stream to express the intensityof the anomalous behavior. (Section 3.5)The
Normal Profile Update Module updates the nor-mal profiles constructed in the offline phase in order toadapt to changes in the environment. (Section 3.6)The
Decision Refinement Module applies heuristicmethods to refine the decision generated by the basicdetection module to reduce the false alarm rates. (Sec-tion 3.7)The
Region Tracking Interface provides an interfacethat visualizes the output of the above modules. Thisinterface enables the user to identify the detected eventsand provides the regions of the moving entities. (Sec-tion 3.8)We start by giving the mathematical notations fol-lowed by the details of the different modules.
Let k be the number of streams, which is equal tothe number of APs times the number of MPs. Let s j,t denote the received signal strength (RSS) reading for astream j that is received at a time instant t . The systemstudies the behavior of a sliding window W j,t of size l that ends at time t , i.e. W j,t = [ s j,t − l +1 , s j,t − l +2 , ..., s j,t ].In order to study the behavior of the sliding win-dows, each sliding window W j,t is mapped to a single feature or value x j,t through a function g . For exam-ple, if the mean is the selected feature, then g ( W j,t ) = l P li =1 s j,t − l + i . Two types of features can be consid-ered: measures of central tendency, such as the mean,and measures of dispersion or variation, such as thevariance. The purpose of the Normal Profile Construction Mod-ule is to construct a normal profile, capturing the re-ceived signal strength characteristics when there is nohuman in the area of interest. This is used later by othermodules to detect anomalies. This module runs in theoffline phase. It extracts the feature values from thesliding windows over the collected data and estimatesits distribution. The density function of the feature val-3es observed is estimated using non-parametric kerneldensity estimation . This is done for each stream inde-pendently. Figure 2 illustrates the operation.Formally, for a stream j , given a set of n slidingwindows, each of length l samples, each window W j,i is mapped to a value x j,i , where x j,i = g ( W j,i ). As-sume f j is the density function representing the distri-bution of the observed x j,i ’s, then given a random sam-ple x j, , x j, , ..., x j,n , the estimated density function ˆ f j is given by [31]:ˆ f j ( x ) = 1 nh j n X i =1 V (cid:18) x − x j,i h j (cid:19) (1)where h j is the bandwidth and V is the kernel function.The choice of the kernel function is not significant forthe results of the approximation [32]. Hence, we choosethe Epanechnikov kernel as it is bounded and efficientto integrate: V ( q ) = ( (1 − q ) , if | q | ≤ , otherwise (2)Also, we used Scott’s rule to estimate the optimalbandwidth [32]: h ∗ j = 2 .
345 ˆ σ j n − . (3)where ˆ σ j is an estimate for the standard deviation forthe x j,i ’s.After estimating the density function for the featurevalues extracted from the sliding windows, critical boundsare selected so that if the feature values observed inthe monitoring state exceed those bounds, the observedvalues are considered anomalous. Given a significanceparameter α and assuming ˆ F j is the CDF of distribu-tion shown in Equation 1, if the feature is a measure ofcentral tendency, which can deviate to the left or theright, then lower and upper bounds will be calculatedsuch that the lower bound is ˆ F j − ( α/
2) and the up-per bound is ˆ F j − (1 − α/ F j − (1 − α ). In the nextsubsection, we study different features that can be se-lected. As the system requires an offline phase before opera-tion, to learn the behavior of the signal readings in thenormal state, the selected feature for system operationshould be resistant to possible environmental changes In Section 5, we present the motivation for using a non-parametric approach by providing a performance compari-son with a parametric modeling of the system operation. that may affect the stored data, e.g. temporal varia-tions . In addition, the selected feature should also besensitive to the human motion to enhance the detectionaccuracy.In this section, we compare two categories of fea-tures: central tendency measures and dispersion mea-sures. The goal of this study is to identify the categorythat will be more promising for the system operation.For this study, we consider the mean as a central ten-dency measure, and the standard deviation as a measureof dispersion. We use the standard deviation, ratherthan the variance, as the variance is a squared measure,while the mean is not. The selected feature should be sensitive to humanactivity. To compare the two features, we use the Eu-clidean distance between the normalized histograms rep-resenting the silence and motion states. The Euclideandistance is defined as the square root of the sum of thesquared distance between each corresponding histogrambin. The histograms are constructed over a two-minuteperiod for each state using Testbed 1, which is discussedlater in Section 4. Figure 3 shows the comparison ver-sus different window sizes. The figure shows that thedistance between the histograms of the standard devia-tion is larger than the distance between the histogramsof the mean. This indicates that the standard devia-tion feature is more discriminant of the human motionthan the mean feature. This conclusion can be justi-fied by observing the motion effect on typical wirelesssignals. Figure 4 provides a visualization of the rawsignal strength for two different streams during silenceand human motion periods. The figure shows that inthe case of human motion, the fluctuations can be upor down around the normal/silence signal level, whichleads to a limited effect on the mean as compared tothe standard deviation.
As the proposed system requires a learning phase be-fore operation, it is necessary to reduce the temporalvariation effect on the stored profiles. To compare thetwo features, we use two different silence data sets col-lected two weeks apart. Figure 5 shows the results. Themore similar the histograms, the more resistive the fea-ture is to the introduced variations. The figure showsthat the standard deviation feature is less affected bytemporal variations. This is due to the fact that thestandard deviation is a relative measure as it is calcu-lated with respect to the mean, whereas the mean itself Our experiments show that the changes in the traffic loadon the network do not affect the signal strength. Therefore,temporal variations here refer to changes in the physicalenvironment that affect the signal strength. igure 2: Illustration of the normal profile construction. D i s t an c e be t w een N o r m a li z ed H i s t og r a m s MeanStandard Deviation
Figure 3: Distance between the features’ nor-malized histograms for silence and motionstates. R e c e i v ed S i gna l S t r eng t h ( d B m ) MotionSilence
Figure 4: Illustrating the motion effect on wire-less signals of two different streams. provides an absolute value that is more susceptible tobe affected by changes in the conditions.From this study, we conclude that the measures of D i s t an c e be t w een N o r m a li z ed H i s t og r a m s MeanStandard Deviation
Figure 5: Distance between the features’ nor-malized histograms for the two week-separatedsilence data. dispersion, e.g. the standard deviation or variance, aremore suitable for our proposed system. For the rest ofthe paper, we use the sample variance as the selectedfeature.
The Basic Detection Module runs during the moni-toring phase. The purpose of this module is to detectsignal strength anomalies, i.e. human presence, basedon the normal profiles constructed during the offlinephase. In particular, for a window of samples W j,t forstream j at a given time instant t , the module calcu-lates the corresponding feature value x j,t , i.e. the sam-ple variance. A stream j is considered anomalous if x j,t is above a critical bound u j . Given a significance pa-rameter α and assuming ˆ F j is the CDF of distributionshown in Equation 1, the upper bound u j will be equalto the 100(1 − α ) th percentile of the CDF function, such5hat u j = ˆ F j − (1 − α ).The Basic Detection Module declares a global alarmwhen any stream is anomalous. This approach can leadto many false positives due to signal strength outliers.This is enhanced later by the Decision Refinement Mod-ule. The Basic Detection Module also calculates ananomaly score a j,t for each stream j to keep track ofthe significance of any anomalous activity. For a givenwindow, W j,t , the anomaly score, a j,t , can be calculatedas: a j,t = x j,t u j where x j,t is the sample variance of thewindow and u j is the critical value. This means that adetected anomaly will have a score greater than one anda silence window will have a score of less than one. Theanomaly score is used by the Normal Profile Updateand Decision Refinement modules to further enhancethe accuracy.In summary, the basic detection procedure requirestwo parameters: the window size l and the significance α . Analysis of both parameters is presented in Section4.3. Due to the dynamic changes in the environment, thestored profiles may not capture the real normal state.Therefore, the systems needs to update the stored pro-files during the online phase. The technique we employfor handling the update process is based on continu-ously updating the estimated density in Equation 1,by adding x j,t ’s, that do not have high anomaly scoresin average to it. In particular, during the monitoringphase, the system groups the consecutive x j,t ’s in dis-joint groups of size l update . The group that has an av-erage anomaly score of less than one is added to thenormal profile. The parameter l update can be tuned toprovide the desired performance. We quantify the effectof the l update parameter in detail in Section 4.3.2.Adding new data to the normal profiles implies theneed to give more weight to the recent data. Therefore,Equation 1 is modified to:ˆ f j ( x ) = 1 h j n X i =1 w i V (cid:18) x − x j,i h j (cid:19) (4)where n P i =1 w i = 1. We choose linear weights such that w i = in ( n +1) / ( n is constant). We found that exponen-tial weights do not provide good performance due tothe high discrimination introduced between older andnewer data. Typical wireless environments are noisy. This factcan cause many false alarms if the system generatesalarms just based on a single stream. The goal of the S u m o f A no m a l y S c o r e s UnsmoothedSmoothedMotionPeriods
Figure 6: The behavior of the sum of anomalyscores for Testbed 1.
Decision Refinement Module is to reduce the false alarmrate by fusing different streams.Since the
Basic Detection Module assigns an anomalyscore to each detected event that expresses its signifi-cance, this can be leveraged to enhance the detectionperformance. The Decision Refinement Module studiesthe behavior of a global anomaly score a t that is cal-culated by summing the individual anomaly scores foreach stream. If a noticeable change in a t occurs, basedon a threshold, while at least one stream is anomalous,this implies the start of an anomalous behavior. Themodule makes use of the history of the activity stateinside the environment through the usage of exponen-tial smoothing to monitor the a t in order to avoid thenoisy samples, hence reducing the false alarm rate. Italso implicitly makes use of the locality of human mo-tion, meaning that the human will continue to affect thesame stream and/or other streams near it, causing thesum of anomaly scores smoothed curve to have highervalues during the motion period (Figure 6). The system provides an interface that provides in-formation about the probable regions of the detectedevent. This is based on visualizing the anomaly degreeof each stream enabling the user to identify the regionsthat probably have moving entities inside. This is doneby coloring each pixel on the map according to its dis-tance from each stream endpoints and according to theanomaly score of each stream. Figure 7 displays theoutput of this interface when two persons are movinginside a typical site, showing the true locations of thetwo persons.
4. EXPERIMENTAL EVALUATION
In this section, we study the effect of the differentparameters on the performance of the
RASID systemand compare it to the previous WLAN
DfP detection6 a) Silence State(b) Two Persons Moving
Figure 7: The output of the Region TrackingInterface. techniques [14, 15].
We collected two sets of data to evaluate the sys-tem performance, each in a different testbed. The firsttestbed is an office of approximately 2000 ft . Thesecond experiment was conducted in a two-floor homebuilding where each floor was approximately 1500 ft .Both tesbeds were covered with typical furniture. Forboth testbeds, we used four Cisco Aironet 1130AG se-ries access points and used three DELL laptops equippedwith D-Link AirPlus G+ DWL-650+ Wireless NICs asMPs. The access points were operating on differentchannels. The experiments were conducted in typicalIEEE 802.11b environments. Figures 8 and 9 show thelayouts of both experiments.For the data collection, sets of normal (silence) statereadings and continuous motion readings were collectedfor each testbed. A total of about one hour and 15minutes of data was collected for each testbed with a MP 1MP 3 AP 3MP 2AP 2AP 4 AP 115.6m12.3m
Figure 8: Testbed 1 layout and motion pattern. sampling rate of one sample per second using the activescanning technique [4]. For Testbed 1, this includesthree motion sets, while for Testbed 2, this includestwo motion sets. A motion set covers the entire area ofthe testbed, as shown in figures 8 and 9, and representsthe motion of a single person walking normally aroundthe site without any stops.For system evaluation, extreme conditions were em-ployed: The training period is chosen to be only thefirst two minutes of the entire data collected with theabsence of human motion. In addition, only one personmoved in the area of interest. More people in the area ofinterest will lead to higher variance [33] and hence bet-ter detection. Therefore, the reported results present alower bound on the performance of the
RASID system.
We used three metrics to analyze the detection per-formance: the false positive (FP) rate, the false negative(FN) rate and the F-measure. The false positive raterefers to the probability that the system generates analarm while there is no human motion in the area ofinterest. The false negative rate refers to the probabil-ity that the system fails to detect the human motion inany place in the area. We also use the F-measure, whichprovides a single value to measure the effectiveness ofthe detection system [34].Since each anomalous sample may not be detectedsimultaneously, we also studied the detection latency,i.e. how much time the system needs to associate ananomalous sample with a detected event. The overall90 th detection latency percentile in both testbeds wasfound to be less than one second. asic Detection Normal Profile Decision RefinementModule Update Module Module ( RASID Perf. )Testbed 1 FN Rate 0.0672 0.0876
FP Rate 0.2158 0.1176
F-measure 0.8683 0.8989
Enhancement - 3.52% %Testbed 2 FN Rate 0.2368 0.2069
FP Rate 0.1059 0.0903
F-measure 0.8167 0.8422
Enhancement - 3.1% % Table 1: System performance under the same parameters ( l = 5 , α = 0 . , l update = 15 ) for the twotestbeds. Enhancement is with respect to the F-measure of the Basic Detection Module. (a) Floor 1(b) Floor 2 Figure 9: Testbed 2 layout and motion patterns.
Table 1 summarizes the system performance for bothtestbeds using the same parameters for all modules.The table also shows the enhancement introduced byeach module to show the robustness of the techniques.
As mentioned earlier, this module requires the selec-tion of the sliding window size l and the significance α . Figure 10 illustrates the effect of these parametersapplied to Testbed 1. Similar performance has been ob-served for Testbed 2. The figure shows that choosing atoo short window size will make the system less sensitiveto human motion. On the other hand, choosing a verylarge window size will introduce a very high FP rate.For the significance parameter, as α decreases, the FPrate decreases and the FN rate slightly increases. Thismeans that increasing the significance will result in lesssystem sensitivity. Therefore, to balance the differentperformance metrics, we choose l = 5 and α = 0 . Normal Profile Update Module . The Normal Profile Update Module requires the se-lection of the update window size l update . Choosing atoo small l update will make the system very sensitive tonoisy readings causing a high FP rate. On the otherhand, a very large l update will make the system less sen-sitive to human motion causing a higher FN rate. Fig-ure 11 illustrates these effects of the update window sizeon the system performance for Testbed 1 when l = 5and α = 0 .
01. The figure shows that an update windowsize between 10 and 20 is sufficient to reduce the highFP rate without causing much increase to the FN Rate.Thus, we choose l update = 15. The results are shownin Table 1. The table shows that there is about 50%reduction in the FP rate in the first testbed, but thislead to a slight growth in the FN rate. For Testbed 2,the results of both the FN and the FP rates were en-8
10 20 30 40 0 0.02 0.04 0.0600.10.20.30.4
SignificanceWindow Size F N r a t e (a) False negative rate Window SizeSignificance F P r a t e (b) False positive rate Figure 10: Analysis of the Basic Detection Mod-ule parameters for Testbed 1. hanced due to adapting to the environment. Overall,the F-measure was enhanced by 3 to 4% with respectto the Basic Detection Module performance.This enhancement can be explained by the observa-tion that the Normal Profile Update Module reducesthe effect of the temporal variations between the en-vironment true normal profiles and the stored normalprofiles by updating them. We verified that by applyingthe two-sample Kolmogorov-Smirnov test to the distri-butions of the updated profiles and the distributions ofthe true normal state. The test accepted the hypothesesthat those distributions came from the same underlyingdistribution at a significance of 0.05. Figure 12 providesan example comparing the starting, updated and truesample variance profiles at the end of Experiment 1.
Normal Profile Update Module FP RateNormal Profile Update Module FN RateBasic Detection Module FP RateBasic Detection Module FN Rate
Figure 11: Effect of the update window size pa-rameter ( l update ). ) P r obab ili t y D en s i t y True Normal ProfileStarting ProfileUpdated Profile
Figure 12: Comparison between the startingprofile, updated profile and the true profile forthe sample variance of the AP4-MP3 stream atthe end of Experiment 1. As shown, the updatedand true profiles are almost congruent.
This module fuses the data from all streams. Fig-ure 6 displays the sum of anomaly scores curve for thedata collected for Testbed 1. To reduce the FP rate,the curve is exponentially smoothed with a smoothingcoefficient of 0.04. A large increment in the smoothedcurve, by more than 20% to 25% from the normal level,implies a period of human motion. Our experimentsshow that deviations from these parameters values willnot lead to significant degradation in the results. Thefigure shows that the motion periods are clearly distin-guishable from the silence state. Table 1 shows thatthis module can lead to up to 10 to 14% enhancementin the F-measure for both testbeds with respect to theBasic Detection Module. It is important to note thatthis module also reduced the FN rate, as some of thepreviously undetected events are now detected becausethis technique makes use of the history of the state ofthe activity as described earlier.
9n this section, we compare the performance of
RASID to the previous techniques devised for WLAN
DfP de-tection. We start by a brief description of the tech-niques, followed by the different aspects we evaluatethe techniques on. Finally, we present the results of thecomparison.
Three techniques are considered for the comparison:1. The moving average technique [14]: The movingaverage technique uses a central tendency feature ,i.e. the average. It uses two sliding window av-erages: a short window average representing thecurrent system condition and a long window aver-age representing history. The idea is to comparethe two averages and if the difference is above athreshold, a detection is announced. It is impor-tant to note that the moving average techniquedoes not require a training phase.2. The moving variance technique [14]: The mov-ing variance technique uses a dispersion feature ,i.e. the variance. Similar to the moving averagetechnique, it compares the variance of the currentsystem state, based on a sliding window, to thevariance of the silence period, obtained through atraining phase. If the difference is above a thresh-old, a detection is announced.3. The maximum likelihood classification (MLE) tech-nique [15]: This technique constructs profiles forthe silence period as well as for the motions periodfor different locations in the area of interest. Theprofiles represent the signal strength distributionfor each stream at each location. Therefore, it in-volves significant training data. During the detec-tion phase, the system finds the profile that hasthe maximum likelihood given a signal strengthvector, one entry for each stream. If the estimatedprofile corresponds to a motion profile, an alarmis generated. • Static accuracy: accuracy when the system is eval-uated with the same profiles it was trained on (ifany). This is to test the best attainable accuracy. • Profiles’ robustness: that is how consistent theperformance of the system is when the tested pro-files are different from the trained ones, for exam-ple due to temporal changes in the environment.For this case, the testing data set is collected twoweeks after the data sets used for training. • Overhead: the effort needed to deploy the system.
Table 2 shows the comparison results in two cases.In terms of the static accuracy, the results show thatthe F-measure of the
RASID system is better than othersystems in Testbed 1 and is slightly lower than the MLEtechnique in Testbed 2. Compared to the Moving Aver-age and Moving Variance techniques, the
RASID sys-tem provides high accuracy due to the techniques ituses to enhance the performance. On the other hand,the MLE technique achieves slightly higher accuracy inTestbed 2 as it stores a motion profile, which requiresmuch higher overhead than the
RASID system.In terms of profiles’ robustness, the Moving Aver-age technique does not store any profiles. Therefore,its overall performance is low but almost the same asthe profiles change. On the other hand, the robustnessof the MLE technique is the least as it uses the meansignal strength values as the features used for classi-fication. Therefore, after two weeks, the distributionof the signal strength does not follow the learned one.This is why the FP rate for the MLE technique is toohigh due to the shift that occurred in the signal dis-tributions. It can also be noted that
RASID perfor-mance in the two cases was the best because
RASID uses the variance for its operation (dispersion feature)and employs techniques for adapting to changes in theenvironment and for enhancing the performance. Thisis why
RASID performance is better than the MovingVariance in general, although the Moving Variance usesthe same feature as
RASID .In terms of overhead, the Moving Average techniquehas the minimum overhead as it does not need anylearning phase. The Moving Variance and
RASID de-ployment need to construct normal profiles by collectingsamples for two minutes when the human is not present.On the other hand, the MLE technique has the worstoverhead as it constructs motion profile at each locationin the area of interest in addition to the normal profile.In summary, although the static detection accuracyof
RASID is as accurate as the MLE technique, theMLE technique has significantly higher overhead than
RASID because of its motion profile requirements. Inaddition,
RASID is the most robust technique to tem-poral changes in the training profiles and significantlyoutperforms the remaining techniques.
5. COMPARISON WITH A PARAMETRICAPPROACH
In this section, we compare the performance of thesystem’s non-parametric approach to an analytical modelthat models the sample variance parametrically. Theresults of this model can help validate the results of ourparameter analysis in the previous section and can alsomotivate the usage of the non-parametric density esti-mation. The next evaluation will be based on the results10 esults with static profilesMoving Average Moving Variance MLE
RASID
Testbed 1 FN Rate 0.1446 0.1426 0.0363 0.0468FP Rate 0.1385 0.104 0.1547 0.0378F-measure 0.858 0.8743 0.9099
Testbed 2 FN Rate 0.0759 0.308 0.0372 0.0966FP Rate 0.7412 0.1478 0.0774 0.0372F-measure 0.6935 0.7522
RASID
Testbed 1 FN Rate 0.2165 0.319 0.1653 0.0472FP Rate 0.0711 0.1561 0.952 0.0782F-measure 0.8449 0.7414 0.5991
Testbed 2 FN Rate 0.2641 0.4152 0.1203 0.0931FP Rate 0.3602 0.0513 0.831 0.0722F-measure 0.7022 0.7149 0.6491
Overhead No overhead Minimal Worst Minimal
Table 2: Performance comparison with previous
DfP detection techniques. of the Basic Detection Module only, so as to evaluatethe two approaches without the enhancements. First,we describe the analytical model, then we present theresults of the comparison.
The sample variance can be modeled parametricallygiven some conditions. According to Cochran’s The-orem [35], the sample variance of l independent nor-mally distributed random samples follows a chi-squaredistribution with l − ( l − s σ ∼ χ l − , where σ is the population variance.According to [36], the signal strength readings (in dBm)distributions for a stream j can be assumed to followa normal distribution. Given that assumption, a para-metric model can be devised for the system when thesample variance is used. Given a significance α and awindow size l , the upper bound for the sample vari-ance observed during the monitoring phase is χ l − , − α .However, [36] also stated that the normality assump-tion may not hold in some cases. In addition, the signalstrength readings may not be independent [37]. Thus,we believe that the non-parametric model described be-fore will provide better performance than the paramet-ric model. This will be verified in the following subsec-tion. First, to check how close the parametric model isto the actual system, we compare the critical upperbounds obtained by both methods. For example, inFigure 13 we compare the critical sample variance val-ues in both cases for the stream AP4-MP3 from Exper-iment 1, when the population variance is assumed to be2.02 dBm which is an experimental estimate for thepopulation variance of that stream. The figure showsthat the parametric model and the actual system crit- C r i t i c a l V a r i an c e ( d B m ) Parametric − alpha = 0.01Non−parametric − alpha = 0.01Parametric − alpha = 0.05Non−parametric − alpha = 0.05
Figure 13: Comparison of the critical variancevalues of the parametric model and the
RASID system model (non-parametric approach). ical values follow the same trends. However the differ-ence between the curves suggests that the real case doesnot exactly follow the assumed parametric model. Inaddition, the effects of Basic Detection Module param-eters can be inferred from the parametric model curves.As the window size parameter l increases, the criticalvariance value decreases which results in increased sys-tem sensitivity (i.e. higher FP rate and lower FN rate).Also, as the significance parameter α increases, the crit-ical variance value decreases which also results in in-creased sensitivity. This is consistent with the analysispresented in Figure 10.The next point is to study how the usage of the para-metric model instead of non-parametric estimation canaffect the system performance. As the distribution ofthe sample variance depends on the population vari-ance, we analyze its effect. Figure 14 shows the effectof the population variance on the performance of theBasic Detection Module when the parametric model is11 ) F − m ea s u r e Non−parametric modelParametric model
Figure 14: The performance of the Basic De-tection Module when the parametric model isused versus the population variance, given l = 5 and α = 0 . . The best population variance con-figuration provides an F-measure of 0.843 com-pared to 0.8683 that was obtained using the non-parametric estimation. used for Experiment 1. From the figure, we can con-clude that the best performance achieved in terms ofthe F-measure (0.843) is less than the F-measure ob-tained using non-parametric estimation (0.8683).To conclude, the parametric model leads to lower per-formance compared to the non-parametric estimationbecause the assumptions that the signal strength val-ues are independent and follow a normal distributionmay not hold. Also, the parametric model requires theselection of an accurate population variance. This can-not be done accurately without training for long timeperiods. Therefore, we conclude that RASID approachof constructing non-parametric profiles in a short of-fline phase and updating them in the online phase doesprovide a better option.
6. DISCUSSION
In this section, we discuss some points related to theconfiguration and the performance of the
RASID sys-tem. We also highlight some research issues and somechallenges that can be addressed in future work.
As mentioned before, the basic detection module stud-ies each stream independently by estimating the uni-variate density for the selected feature of the slidingwindows extracted from the training data. Anotherpossibility was to construct a multivariate density es-timate for the data of all streams. This implies a mod-ification to the anomaly detection criteria. Differentalgorithms can be applied in this case, e.g. [27]. Ourexperience with this algorithm shows that this leads toa degradation of the system accuracy. The main rea- son for this degradation is that the system sensitivityis significantly reduced, especially when the number ofstreams is large. In that case, the system may not beable to detect an anomaly in one stream only, as itseffect may not be much sensed.
Typically in real wireless environments, it is expectedthat many monitoring points may be using the wirelessnetwork for handling typical tasks (e.g. downloadingupdates or patches). The question is whether such net-work activities will require any change in the systemnormal profiles if they were originally collected whilethere is no network activity. In this subsection, wepresent an experimental study to investigate that ef-fect.In order to examine that effect, a simple experimentwas conducted on a single stream between an accesspoint and a laptop acting as a monitoring point in si-lence state. Two signal strength data sets were collectedwhile there was no network activity at the monitoringpoint, while another two sets were collected while themonitoring point were downloading data through thewireless stream with the maximum download speed al-lowed (50 KBytes per second). The collected data areused to construct normal profiles in the same way pre-sented earlier in Section 3.3. Figure 15 compares theconstructed profiles for the four sets. From the figure, itis clear that the difference between the distributions inboth cases is negligible. Furthermore, we apply the two-sample Kolmogorov-Smirnov test to each of the fourdifferent pairs of those constructed profiles. The testaccepted the hypotheses that those estimated distribu-tions came from the same underlying distribution witha significance of 0.05. Therefore, we can conclude thatthe constructed sample variance profiles are invariantwith respect to the state of network activity.
The above experiments showed that the system is ca-pable of detecting a single person moving inside the areaof interest. Obviously, the detection performance willbe enhanced if there were more than one entity in thearea of interest. We verified that the system will be ableto declare that there is anomalous behavior inside thearea more clearly in this case.It would be useful to identify the number of movingentities in some applications. Figure 7 shows that wecan detect that there are multiple entities in the area ofinterest. However, as our system uses limited data tosatisfy the feasibility design goal (normal profiles only),the system cannot provide full information about thenumber of entities in all cases. For example, if two12 ) P r obab ili t y D en s i t y No Network Activity − Set 1No Network Activity − Set 2High Network Activity − Set 1High Network Activity − Set 2
Figure 15: The effect of network activity on theconstructed sample variance normal profiles. Asshown, the difference between the profiles is notsignificant. entities are affecting a single stream only, the systemwill detect them as one entity. This is because thereis no enough information that enables the system todifferentiate between the two cases. On the other hand,in some cases, the system can tell with high probabilitythat some events are due to independent entities. Here,we briefly describe the constraints through which thesystem can provide information about the number ofindependent entities.First, let T min , a k × k square matrix denote what wecall a minimum time reachability matrix. Each entryin this matrix stores the minimum time needed for anentity to affect two streams i and j , such that T min ij = D min ij v max (5), where D min ij represents the minimum distance be-tween the nearest two points on the i and j streamslines of sight and v max represents the maximum move-ment velocity inside the area. The distance D min ij canbe calculated from the site map, and v max can be esti-mated based on empirical observations.Two events E and E are considered independent(i.e. not generated by the same entity), if they satisfythe following conditions. First, they should be affectingtwo different streams i and j and second, the time dif-ference between E and E is less than the value T min ij .The time difference between the two events are calcu-lated based on the time difference between the timeswhen the anomaly scores for the two events reach thepeaks as they express the moments when the entitiesare affecting the streams the most. To tell that n eventsare independent, each pair of those events should satisfythe conditions described above. The above conditionsimply that the system cannot detect more than k mov-ing entities, where k is the number of streams as stated earlier.To conclude, despite the limited information the sys-tem uses, the system can provide information about thenumber of independent events inside the monitored areagiven some conditions. The significance of this pointcan be clear when applied inside large scale environ-ments.Another possibility is to use the level of the changein variance as an indication of the number of entities.The hypothesis is that the more human affecting a sin-gle stream, the higher the variance should be. Thishypothesis still needs to be verified though. Our system can provide useful information to
DfP tracking systems like the ones proposed in [16,17]. First,a
DfP tracking system can use our system to decidewhether to start the tracking process or not. Also, thesystem can enhance the tracking accuracy by limitingthe probable locations to a certain area (e.g. as in Fig-ure 7). In addition, given the conditions described ear-lier, our system can help the tracking system identifythe number of intruders and the area of each one, sothat it can apply the tracking algorithms to each areaindependently. This will need further investigation andexperimentation.
Although we showed in this paper that using the vari-ance as a feature is better than using the mean, bothfeatures can be used concurrently to achieve better per-formance. Our initial results show that combining bothfeatures and using a simple voting scheme can enhancethe results in some cases. This is a subject for futureinvestigations.
The synchronization of the signal strength readingsreceived at the monitoring point can be necessary insome cases. For example, the technique described be-fore for checking the independence of the detected eventsrequires synchronization of the readings across the streams.In addition, the decision refinement module requires thedifferent streams to be synchronized. In this paper, wetook a centralized approach for synchronization, wherethe application server requests the MPs to initiate areading. Other approaches, such as time synchroniza-tion of the MPs can be employed. The advantages anddisadvantages of each technique in terms of accuracyand overhead can also be investigated.
The hardware used to capture the signal strength val-ues can affect system performance. Through our exper-iments, we studied how the WLAN NIC type affects thequality of the collected readings. We found that NICs13iffer in two main aspects: sensitivity to human activ-ity and noise readings. For example, some cards cannotsense the human shadowing effect unless it is sustainedfor a sufficient period of time. The readings of someother cards are noisy and requires extensive filtering.These experiments considered the NICs only. Howeverthis can hold from the APs perspective too. Therefore,we believe a study is needed to identify which hardwarewill be more suitable for the system operation and howto account for these variation between cards and allowthe system to operate with different cards.
7. CONCLUSIONS AND FUTURE WORK
In this paper, we presented the
RASID system, a sys-tem that enables device-free passive motion detectionusing the already installed wireless networks.
RASID uses non-parametric statistical anomaly detection tech-niques to provide the detection capability. The
RASID system also employs profile update techniques to cap-ture changes in the environment and to enhance thedetection accuracy. The system was evaluated in twodifferent real environments. Using the same parametersfor the two testbeds, the system provided an accuratedetection capability reaching an F-measure of at least0.93 in both testbeds. The performance of the
RASID system was compared to the previously introduced tech-niques for WLAN
DfP detection. The results showedthat the
RASID system outperformed the state-of-the-art techniques in terms of robustness and accuracy. Inaddition, we showed that the non-parametric approachemployed by
RASID has significant advantages over aparametric approach for the system operation.Currently, we are expanding
RASID in several direc-tions: One direction is to integrate
RASID ’s detectioncapability with
DfP tracking systems while consideringlarger testbeds. Another direction is to study possiblesources of noise in typical wireless environments, e.g.other devices inside or outside the area of interest, andhow to reduce their effect. We are also studying howthe detected entity’s characteristics, e.g. size, shapeand motion pattern, can affect the system performance.Moreover, the site configuration, i.e. the positions of theAPs and MPs, can also be studied in order to optimizethe system performance.
8. REFERENCES [1] P. Enge and P. Misra, “Special Issue on GlobalPositioning System,” in
Proceedings of the IEEE ,January 1999, pp. 3–172.[2] N. B. Priyantha, A. Chakraborty, andH. Balakrishnan, “The Cricket Location-SupportSystem,” in
MobiCom ’00: Proceedings of the 6thAnnual International Conference on MobileComputing and Networking , New York, NY,USA, 2000, pp. 32–43. [3] R. Want, A. Hopper, V. Falcao, and J. Gibbons,“The Active Badge Location System.”
ACMTrans. Inf. Syst. , vol. 10, no. 1, 1992.[4] M. A. Youssef and A. Agrawala, “The HorusWLAN Location Determination System,” in
Communication Networks and DistributedSystems Modeling and Simulation Conference ,2005, pp. 205–218.[5] J. Krumm, L. Williams, and G. Smith,“SmartMoveX on a Graph - An InexpensiveActive Badge Tracker,” in
UbiComp ’02:Proceedings of the 4th International Conferenceon Ubiquitous Computing , 2002.[6] C. Randell and H. Muller, “Context Awareness byAnalyzing Accelerometer Data,” in
ISWC ’00:Proceedings of the 4th IEEE InternationalSymposium on Wearable Computers , 2000, pp.175–176.[7] L. Bao and S. S. Intille, “Activity Recognitionfrom User-annotated Acceleration Data,” in
Pervasive Computing (LNCS) , vol. 3001, 2004.[8] M. Philipose, K. P. Fishkin, M. Perkowitz, D. J.Patterson, D. Fox, H. Kautz, and D. Hahnel,“Inferring Activities from Interactions withObjects,”
IEEE Pervasive Computing , vol. 3,October 2004.[9] M. Wallbaum and S. Diepolder, “A MotionDetection Scheme For Wireless LAN Stations,” in
Proceedings of the 3rd International Conferenceon Mobile Computing and UbiquitousNetworking , 2006.[10] J. Krumm and E. Horvitz, “LOCADIO: InferringMotion and Location from Wi-Fi SignalStrengths,” 2004, pp. 4–13.[11] K. Kleisouris, B. Firner, R. Howard, Y. Zhang,and R. P. Martin, “Detecting Intra-room Mobilitywith Signal Strength Descriptors,” in
MobiHoc’10: Proceedings of the Eleventh ACMInternational Symposium on Mobile Ad HocNetworking and Computing , 2010.[12] I. Anderson and H. Muller, “Context Awarenessvia GSM Signal Strength Fluctuation,” in
Pervasive 2006, Late Breaking Results , 2006.[13] T. Sohn, A. Varshavsky, A. Lamarca, M. Y.Chen, T. Choudhury, I. Smith, S. Consolvo,J. Hightower, W. G. Griswold, and E. D. Lara,“Mobility Detection Using Everyday GSMTraces,” in
Ubicomp ’06: Proceedings of theEighth International Conference on UbiquitousComputing , 2006, pp. 212–224.[14] M. Youssef, M. Mah, and A. Agrawala,“Challenges: Device-free Passive Localization forWireless Environments,” in
MobiCom ’07:Proceedings of the 13th Annual ACMInternational Conference on Mobile Computing nd Networking . ACM, 2007, pp. 222–229.[15] M. Moussa and M. Youssef, “Smart Devices forSmart Environments: Device-free PassiveDetection in Real Environments,” in IEEEPerCom Workshops , 2009.[16] A. E. Kosba, A. Abdelkader, and M. Youssef,“Analysis of a Device-free Passive TrackingSystem in Typical Wireless Environments ,” in
NTMS ’09: Proceedings of the 3rd InternationalConference on New Technologies, Mobility andSecurity , 2009, pp. 291–295.[17] M. Seifeldin and M. Youssef, “A DeterministicLarge-scale Device-free Passive LocalizationSystem for Wireless Environments,” in
PETRA’10: Proceedings of the 3rd InternationalConference on Pervasive Technologies Related toAssistive Environments , 2010.[18] M. A. Seifeldin, A. F. El-keyi, and M. A. Youssef,“Kalman filter-based tracking of a device-freepassive entity in wireless environments,” in
WiNTECH’11: Proceedings of the 6th ACMInternational Workshop on Wireless NetworkTestbeds, Experimental Evaluation andCharacterization . New York, NY, USA: ACM,2011, pp. 43–50.[19] J. Krumm, S. Harris, B. Meyers, B. L. Brumitt,M. Hale, and S. A. Shafer, “Multi-CameraMulti-Person Tracking for Easyliving,” in
Proceedings of the Third IEEE InternationalWorkshop on Visual Surveillance , 2000, pp. 3–10.[20] J. Wilson and N. Patwari, “Radio TomographicImaging with Wireless Networks,”
IEEETransactions on Mobile Computing , May 2010.[21] R. J. Orr and G. D. Abowd, “The Smart Floor: AMechanism for Natural User Identification andTracking,” in
Proceedings of ACM CHI 2000Conference on Human Factors in ComputingSystems , vol. 2, 2000.[22] S. S. Ram, Y. Li, A. Lin, and H. Ling, “HumanTracking Using Doppler Processing and SpatialBeamforming.” IEEE Radar Conference, 2007.[23] D. Zhang, J. Ma, Q. Chen, and L. M. Ni, “AnRF-Based System for Tracking Transceiver-FreeObjects,” in
PerCom ’07: Proceedings of the FifthIEEE International Conference on PervasiveComputing and Communications , 2007, pp.135–144.[24] R. S. Moore, R. Howard, P. Kuksa, and R. P.Martin, “A Geometric Approach to Device-FreeMotion Localization Using Signal Strength,”Rutgers University, Tech. Rep. DCS-TR-674,September 2010.[25] A. L. AlHusseiny, M. Youssef, andM. ELTowiessy, “WCPS-OSL: A wirelesscyber-physical system form object sensing and localization,” in
The Workshop on Collaborative,Autonomic, and Resilient Defenses for CyberPhysical Systems (CyPhyCARD’11), inconjunction with CollaborateCom 2011. [26] N. Kassem, A. E. Kosba, and M. Youssef,“RF-based vehicle detection and speedestimation,” in
VTC’12-Spring: Proceedings ofthe 75th IEEE Vehicular Technology Conference,2012 .[27] D.-Y. Yeung and C. Chow, “Parzen-WindowNetwork Intrusion Detectors,” in
ICPR ’02:Proceedings of the Sixteenth InternationalConference on Pattern Recognition , 2002, pp.385–388.[28] C. M. Bishop, “Novelty Detection and NeuralNetwork Validation,”
Vision, Image and SignalProcessing, IEE Proceedings- , vol. 141, no. 4, pp.217–222, 1994.[29] S. Subramaniam, T. Palpanas, D. Papadopoulos,V. Kalogeraki, and D. Gunopulos, “OnlineOutlier Detection in Sensor Data UsingNon-parametric Models,” in
VLDB ’06:Proceedings of the 32nd International Conferenceon Very Large Data Bases , 2006, pp. 187–198.[30] L. Su, W. Han, S. Yang, P. Zou, and Y. Jia,“Continuous Adaptive Outlier Detection onDistributed Data Streams,” in
Proceedings of theThird International Conference on HighPerformance Computing and Communications ,2007, pp. 74–85.[31] B. W. Silverman,
Density Estimation forStatistics and Data Analysis . Chapman &Hall/CRC, April 1986.[32] D. W. Scott,
Multivariate Density Estimation:Theory, Practice, and Visualization . Wiley, 1992.[33] A. Rahim, S. Zeisberg, M. Fernandez, andA. Finger, “Impact of People Movement onReceived Signal in Fixed Indoor RadioCommunications,” in
Proceedings of the 17thIEEE International Symposium on Personal,Indoor and Mobile Radio Communications , 2006.[34] C. J. V. Rijsbergen,
Information Retrieval ,2nd ed. Newton, MA, USA:Butterworth-Heinemann, 1979.[35] W. Cochran, “The Distribution of QuadraticForms in a Normal System with Applications tothe Analysis of Covariance,” in
MathematicalProceedings of the Cambridge PhilosophicalSociety , 1934.[36] K. Kaemarungsi and P. Krishnamurthy,“Modeling of Indoor Positioning Systems basedon Location Fingerprinting,” in
INFOCOM 2004.Twenty-third Annual Joint Conference of theIEEE Computer and Communications Societies ,vol. 2, pp. 1012–1022.1537] M. Youssef and A. Agrawala, “Handling samplescorrelation in the Horus system,” in