Leveraging neighbors' wireless access points in wireless-signal-variation-based physical intruder detection systems

• US 9,378,634 B1
• Filed: 12/30/2014
• Issued: 06/28/2016
• Est. Priority Date: 12/30/2014
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Kashyap, Anand, Cai, Yongjie, Wang, Qiyan
• Primary Examiner(s): Nguyen, Phung
• Application Number:
  US14/585,737
• Time in Patent Office: 546 Days
• Field of Search: 340/541, 340/539.21, 340/545.2, 340/545.3, 340/552, 340/561, 340/565
• US Class Current: 1/1
• CPC Class Codes: G08B 13/2491 Intrusion detection systems, i.e. where the body of an intruder causes the interference with the electromagnetic field
• CPC Class Codes: H04B 17/20 of receivers
• CPC Class Codes: H04B 17/318 Received signal strength

Abstract

A method for intruder detection is provided. The method includes monitoring, at a wireless sniffer in a building, received signal strength relative to each of a plurality of wireless access points, wherein a first wireless access point of the plurality of wireless access points is located within the building and a second wireless access point of the plurality of wireless access points is located external to the building. The method includes creating a profile of the received signal strength from each of the plurality of wireless access points, during a learn mode and comparing activity of the received signal strength from each of the plurality of wireless access points to the profile, during an intruder detection mode. The method includes issuing a notification, based on the comparing. An intruder detection system is also provided.

Claims

1. A method for intruder detection, comprising:

monitoring, at a wireless sniffer in a building, received signal strength relative to each of a plurality of wireless access points, wherein a first wireless access point of the plurality of wireless access points is located within the building and a second wireless access point of the plurality of wireless access points is located external to the building;

creating a profile of the received signal strength from each of the plurality of wireless access points, during a learn mode;

comparing activity of the received signal strength from each of the plurality of wireless access points to the profile, during an intruder detection mode; and

issuing a notification, based on the comparing, wherein at least one step of the method is performed by a processor.

2. The method of claim 1, further comprising:

denoting in a memory an anomaly event, responsive to an anomaly in the received signal strength relative to the first wireless access point.

3. The method of claim 1, further comprising:

denoting in a memory an anomaly event, responsive to an anomaly in the received signal strength relative to the second wireless access point and an anomaly in the received signal strength relative to a third wireless access point located external to the building.

4. The method of claim 1, wherein issuing the notification is further based on two anomaly events in the activity of the received signal strength in a specified time interval.

5. The method of claim 1, wherein issuing the notification comprises sending an alert, via a network, to a server or a user device.

6. The method of claim 1, wherein the comparing comprises analyzing the received signal strength relative to each of the plurality of wireless access points as to anomaly in comparison with the profile.

7. The method of claim 1, wherein the monitoring comprises distinguishing the received signal strength relative to each of the plurality of wireless access points according to beacon messages from the plurality of wireless access points.

8. A tangible, non-transitory, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:

forming an activity profile based on received signal strength relating to each of a plurality of wireless access points as determined, during a training mode, at a wireless sniffer in a building, wherein a first wireless access point of the plurality of wireless access points is internal to the building and a second wireless access point of the plurality of wireless access points is external to the building;

monitoring the received signal strength in an intruder detection mode;

detecting a physical intruder, based on the activity profile and the monitoring in the intruder detection mode; and

producing an alert, responsive to the detecting.

9. The computer-readable media of claim 8, wherein the method further comprises:

determining a first anomaly event, responsive to an anomaly in the received signal strength relative to the first wireless access point; and

determining a second anomaly event, responsive to an anomaly in the received signal strength relative to the second wireless access point and a further anomaly in the received signal strength relative to a third wireless access point that is external to the building, wherein detecting the physical intruder and producing the alert is responsive to determining the first anomaly event and determining the second anomaly event.

10. The computer-readable media of claim 8, wherein producing the alert comprises sending the alert as a message, via a network.

11. The computer-readable media of claim 8, wherein the method further comprises:

determining the received signal strength relating to each of the plurality of wireless access points, based on beacon messages transmitted by the plurality of wireless access points.

12. The computer-readable media of claim 8, wherein forming the activity profile includes establishing a threshold for detection of human presence, based on the received signal strength.

13. The computer-readable media of claim 8, wherein monitoring the received signal strength comprises:

associating a value of the received signal strength to each of the plurality of wireless access points based on information in beacon messages transmitted by the plurality of wireless access points.

14. An intruder detection system, comprising:

a wireless sniffer, configured to indicate a received signal strength;

a memory, configured to store at least one profile;

an alert module, configured to issue an alert responsive to being triggered; and

an analytics module, configured to generate or update the at least one profile, based on the received signal strength of each of a plurality of wireless access points as monitored during a learn mode, and further configured to trigger the alert module responsive to detection of an intruder based on comparison of the at least one profile and the received signal strength of two or more of the plurality of wireless access points during an intruder detection mode.

15. The intruder detection system of claim 14, wherein the two or more of the plurality of wireless access points includes an access point internal to a building housing the wireless sniffer and a further access point external to the building housing the wireless sniffer.

16. The intruder detection system of claim 14, wherein the analytics module is configured to trigger the alert module responsive to a determination of a first anomaly in the received signal strength of one of the plurality of wireless access points internal to a building housing the wireless sniffer, determination of a second anomaly in the received signal strength of one or more of the plurality of wireless access points external to the building, and determination of a third anomaly in the received signal strength of the one or more of the plurality of wireless access points external to the building.

17. The intruder detection system of claim 14, further comprising:

a communication port, configured to send the alert via a wired or wireless network.

18. The intruder detection system of claim 14, further comprising:

a timer, configured to time a duration of an anomaly of the received signal strength and time a spacing between anomalies of the received signal strength, wherein the detection of the intruder is further based on a result from the timer.

19. The intruder detection system of claim 14, wherein the memory, the alert module and the analytics module are included in a computing device having a processor, and wherein the wireless sniffer is included in a wireless module of the computing device.

20. The intruder detection system of claim 14, further comprising:

a communication port; and

the alert module configured to send the alert, via the communication port, to one of a server, a mobile communication device, an authority, or an agency.