Conference PaperPDF Available

Work-In-Progress: Rssi-Based Presence Detection In Industrial Wireless Sensor Networks

Authors:

Abstract and Figures

We propose to add a monitoring system consisting of so-called path- and guard nodes to industrial wireless sensor network (IWSN), to increase the security level by using RSSI measurements. Via these measurements, the monitoring system determines the presence of a mobile sensor node in a predefined area, which can be used to handle access rights and to increase automation capabilities in industrial applications. We add this monitoring system to an IWSN based on the EPhESOS protocol, which has a high degree of flexibility to meet industrial requirements in different applications throughout the lifetime of a sensor node while enabling energy-autonomous operation. Two practical machine learning algorithms for RSSI-based presence detection are presented, namely a support vector machine and a neural network algorithm. They are evaluated in an automotive example and tested for their robustness against malicious attacks. Additionally, a method to find the best node locations of the monitoring system is presented.
Content may be subject to copyright.
Work-In-Progress: RSSI-Based Presence Detection
in Industrial Wireless Sensor Networks
Hans-Peter Bernhard∗†, Julian Karoliny∗†, Bernhard Etzlinger, Andreas Springer
Johannes Kepler University Linz, Institute for Communications Engineering and RF-Systems, 4040 Linz, Austria
Silicon Austria Labs GmbH, 8010 Graz
Abstract—We propose to add a monitoring system consisting
of so-called path- and guard nodes to industrial wireless sensor
networks (IWSNs), to increase the security level by using re-
ceive signal strength indicator (RSSI) measurements. Via these
measurements, the monitoring system determines the presence
of a mobile sensor node in a predefined area, which can be used
to handle access rights and to increase automation capabilities
in industrial applications. We add this monitoring system to
an IWSN based on the EPhESOS protocol, which has a high
degree of flexibility to meet industrial requirements in different
applications throughout the lifetime of a sensor node while
enabling energy-autonomous operation. Two practical machine
learning algorithms for RSSI-based presence detection are pre-
sented, namely a support vector machine and a neural network
algorithm. They are evaluated in an automotive example and
tested for their robustness against malicious attacks. Additionally,
a method to find the best node locations of the monitoring system
is presented.
I. INT ROD UC TI ON A ND R EL ATED W OR K
Industrial sensor systems are typically used for monitoring
objects and processes across the whole value chain. Tradition-
ally, data is transmitted via a wired industrial communication
network like a field bus (e.g., CANopen or Profibus-DP) or an
Ethernet network (e.g., TSN IEEE802.1xx or EtherCAT). The
goal of IWSNs is to replace the cable-based infrastructure on
the ”last meters” to the sensor nodes. Today, various wireless
standards are used in industrial communication, including
ZigBee, WirelessHART, ISA100.11a, and WIA-PA. Those
standards are based on the IEEE802.15.4 PHY and MAC
layers, which have strongly limited communication resources,
e.g. a maximum data rate of 250 kbps, that has to be shared by
all active nodes. Thus, they only partly fulfill current industrial
specifications [1]. Alternative solutions are based on Bluetooth
and IEEE802.11. However, both standards could not achieve a
break through in industrial monitoring applications as they are
not fully compliant to the requirements of I4.0 factory cells
[1].
In this paper we use the energy and power efficient syn-
chronous sensor network (EPhESOS) protocol [2] and add
a monitoring system consisting of so-called path- and guard
nodes to IWSNs, to increase the security level by using
This work has been supported in part by the SCOTT project.
SCOTT(www.scott-project.eu) has received funding from the Electronic Com-
ponent Systems for European Leadership Joint Undertaking under grant agree-
ment No 737422. This Joint Undertaking receives support from the European
Union’s Horizon 2020 research and innovation programme and Austria, Spain,
Finland, Ireland, Sweden, Germany, Poland, Portugal, Netherlands, Belgium,
Norway.
RSSI measurements. Via these measurements, the monitoring
system determines the presence of a mobile sensor node in a
predefined area.
The paper is structured as follows: Section II describes
the industrial environment in which the wireless network is
implemented together with its extension on network security.
The subsequent section III explains presence detection and
section IV covers validation. A short summary completes the
work.
II. INDUSTRIAL SETTING
Applications in a factory as depicted in Fig. 1 are highly de-
manding with respect to mobile measurements. In this specific
automotive factory example, vehicle tests are performed for the
purpose of certifying cars according to the Euro 6 standard. To
perform soak testing measurement campaigns for certification,
sensor data has to be traced in time and position. Continuously
monitoring all observation variables is a basic requirement for
the Euro 6 certification and especially challenging since cars
are moving between different condition and testing areas. In
wired systems, this task is solved with human interaction for
manual data monitoring. In wireless systems the task can be
solved during standard operation without human interaction.
The presented solution has to be in line with other wireless
Fig. 1: Chassis dyno testing factory. The colored areas are the
vehicle conditioning zones and the gray boxes represent the
test boxes, the chassis dynamometer.
factory communication demands which are surveyed in [1].
We use the EPhESOS communication protocol [2] as it
provides low energy consumption and security. It is based
on a deterministic media access control (MAC) layer using
time division multiple access (TDMA), which is an important
prerequisite for energy efficient communication.
A. Implementation
The physical (PHY) layer is implemented using Bluetooth®
low energy (BLE) and is used to build a network with up
to 100 nodes per base station. As hardware platform the
NordicTM NRF52840 family is used to design energy efficient
sensor nodes. The parameters of the network communication
within one cell are a superframe (SF) length 100 ms, time
to first time slot of 2 ms and time slot length of 980 µs.
In this implementation the data rate is limited to 9k3 bit/sec
per sensor node. The sensor nodes have an average power
consumption of less than 200µW, which enables the possibility
of autarkic operation with solar cells optimized for ambient
light in factory.
B. Authentication and data security
Since industrial wireless sensor and actuator networks
(IWSANs) have high security requirements, it is necessary
to join each sensor node individually to the network by a
key exchange procedure. This process is done by a two-factor
authentication. Nodes must have a second channel to securely
confirm the successful key exchange [3]. Obviously, data
communication must be secured by, e.g., AES128 encryption
which uses individual keys for each node. Additionally, it is
a must to update these keys session- or time-dependent. This
security requirement is not part of this work.
C. Location monitoring for presence detection
We propose the passive collection of positioning informa-
tion about the mobile nodes by the so-called path nodes,
which passively listen to the regular data communication of
the mobile nodes. These path nodes are arranged alongside
the routes of mobile nodes in a factory. So-called guard nodes
are located outside the protected area. The guard nodes jointly
monitor the site or factory to detect early if there is interference
or jamming from the outside. Path- and guard nodes have
the same architecture as conventional sensor nodes and are
participating in the same way in the EPhESOS protocol as
regular nodes. As they are pre-installed and static, they do not
require energy autarkic operation. Thus, they can continuously
listen to the network communication and record the RSSI
values of each packet and monitor packets, synchronicity and
other parameters of the ongoing regular communication in
the network. The RSSI values are sent to an edge computing
device via the base station. It will be shown in section IV
how a presence detection algorithm can make use of this
information. Evaluation results of position, synchronicity etc.,
can be used to assure that a sensor node is not physically
removed, off track, or otherwise compromised. In combination
with time stamping of the transmitted data, the measurement
campaigns are eligible for official documentation which is
one of the requested use cases for standardized production
processes.
Fig. 2 shows a typical factory situation. A mobile sensor
node e.g. moves along a conveyor belt, or is mounted on a
car in the vehicle test site. The claimed node location must
be verified to accept the sensor data. The advantage of this
approach is, that no specialized localization systems with addi-
tional hardware or software is required. This helps in fulfilling
Fig. 2: Factory building with symbolized receiving areas of
path nodes. The overlapping coverage of several path nodes is
used in the presence detection algorithm.
IWSN requirements. Also no change in the communication
schedule of the regular nodes is required.
A similar concept can be used to detect and localize
jamming devices. In Fig. 2, guard nodes for the surveillance
of the surroundings of the factory are mounted around the
building or on a fence. The guard nodes are monitoring
the communication channel also outside the factory to detect
whether or not the channel is occupied by jamming signals.
This information can be used twofold. Firstly, to detect the
area where the jamming attack takes place and secondly, to
localize the position of the jammer. In many cases jamming is
just an unintended disturbance of the channel, so the jammer
can be isolated or even removed if the device is precisely
located.
III. METHODS FOR LOCATION MONITORING
Guard- and path nodes measure RSSI values from packets
that are sent by the sensor nodes (cf. Sec. II-C). Here, the
goal is to assign a location out of a set of possible locations
to the node, based on these measurements. Model-based
approaches for indoor localization suffer from harsh signal
propagation conditions in the testing area, like non-line-of-
sight and multipath propagation. Thus, model-free machine
learning solutions are preferred.
Based on MRSSI measurements collected in xRM, the
inference task is to determine if a sensor node is in an area of
interest or not, i.e., it is a binary classification task with output
y∈ {−1,1}. In this section, two machine learning algorithms
for binary classification are presented. One algorithm uses
support vector machine (SVM) and provides a deterministic
approach via a convex formulation of the training problem.
The second algorithm applies a neural network (NN) to offer
a higher degree of freedom in the solutions. Finally, a method
for optimally selecting the location of guard- or path nodes is
proposed.
A. Support Vector Machines
SVMs are popular machine learning approaches for regres-
sion and classification tasks [4]. For binary classification, the
SVM uses y=sgnwTφ(x) + b,where sgn·denotes the
sign function, wis the weighting vector, φ(·)denotes a feature
space transformation and bis a bias. Note that wTφ(x) + b
describes a hyperplane in the transformed feature space that
is used to separate the input data xinto two classes. To
find the best possible separating hyperplane, the separation
area (referred to as margin) between the classes has to be
maximized. This problem is reformulated to
y=sgnN
X
n=1
antnkx,xn+b,(1)
where an1are Lagrange multipliers that are solved in
the optimization problem. In this work radial basis function
(RBF) kernels of the form k(x,x0) = exp kxx
0k2
2σ2,
performed best for classifying the training and validation data.
The resulting classifier in the form of (1) is thus defined by
the training data set tn,xnN
n=1 and the found Lagrange
multipliers an. As several anwill be zero, only a subset
of the training measurements is used for classification. These
surviving vectors are referred to as support vectors.
B. Neural Networks
The NN, i.e., the feed-forward multilayer perceptron, uses
multiple layers of logistic regression models, commonly used
for classification tasks and pattern recognition [4]. The used
NN consists of one input layer (with layer index k= 0),
Khidden layers (k= 1, . . . , K), and one output layer (k=
K+1). The number of perceptrons Jkin the k-th layer can be
chosen freely. Just the number of input and output perceptrons,
respectively, is set to the number of inputs and outputs, i.e.,
J0=Mand JK+1 = 1 for the binary classification. Given
the N-sampled training set tn,xnN
n=1, the weights w(k)
jk,jk1,
jk= 1, . . . , Jk,k= 1, . . . , K +1, have to be learned, e.g. by
an implementation of the back-propagation algorithm [4].
C. Post-Processing
The presence detection from SVM and NN is evaluated
individually for each measurement, i.e., there is no knowledge
about dynamic behavior integrated. From tests conducted in
the context of this work, it could be observed that noisy
classifications occur close to the border of the cell. There,
the classifiers output is frequently changing with a new mea-
surement. By assuming a simple dynamic dependency, i.e.,
that the mobile sensor node is not performing abrupt cluster
changes, the model output ytat time interval tis filtered
using Lpast and future outputs using a windowed median
yt= med ytL, . . . , yt+Lwhere yt∈ {0,1}.
D. Node Selection Scheme
In a factory environment there are many nodes available.
The identification of the best combination is partitioned in:
(i) evaluate the detection accuracy obtained with all available
sensor combinations with SVM; (ii) select the ten best sensor
node combinations according to the accuracy, learn the NN
models for these, and evaluate the corresponding accuracy; (iii)
validate the models attack scenarios, that will be described in
Sec. IV-A and only pick node combinations which are safe
against these attacks; (iv) choose the one with the highest
accuracy.
IN
OUT
other cars
TN-1 (3)
TN-2 (4)
TN-3 (5)
TN-4 (6)
EN-OUT (8)
EN-IN (7)
BN-LE (2)
BN-RI (1)
(0,0,0)
y
x
Fig. 3: Measurement setup
IV. EVALUATION OF IWSN PRESENCE DETECTION
To validate the proposed approach, presence detection is
evaluated in an environment comparable to Fig. 1. Note that
presence detection requires path nodes that are installed along
the area of interest. Thus, in this chapter, the installment
of path nodes, the performance of the algorithms and their
robustness towards attacks is investigated.
A. Measurement Setup and Attack Scenarios
The proposed classification methods for determining
whether a mobile node is inside or outside of a predefined cell,
are tested in a garage similar to the soak testing application.
A mobile node is mounted at the front of a car while driving
with walking speed into a cell, i.e. a parking lot. The mobile
node transmits data to the base station every 0.5 s, hence, the
sampling time of the RSSI measurements at the guard nodes
is the same as the packet transmission rate of the mobile node.
Fig. 3 depicts the measurement setup with the trajectory of the
car and the positions of the path nodes.
Eight path nodes were placed in different positions inside
the parking lot and alongside the possible path. The path
nodes are mounted on the ceiling (Top-Nodes TN), directly
at the borders of the cluster (Border-Nodes BN) and at the
end positions of the driving trajectory (End-Nodes EN).
With this setup, the proposed machine learning approaches
were trained to perform the cell presence detection. The
ground truth data were generated by using a photo-detector
installed at the border of the cell to report when the car is
passing. An exemplary sequence of the training data of two
path nodes is depicted in Fig. 4 together with ground truth data.
In total, at a sampling rate of 2 Hz, each path node sampled
785 RSSI values as training data. To validate the presence
detector, a validation set with 654 measurements per path node
similar to the training set was collected at the same sampling
rate. The accuracy of the methods is evaluated with the mean
absolute time difference between ground truth cell entering
and the estimated cell entering. This is the most crucial part
of the route and denoted as error ¯e.
Furthermore, two attack scenarios are considered. First, an
attacker is positioned at different locations outside the area
of interest and tries to make the system believe that it is
0 20 40 60 80
80
60
40
RSSI Value in dBm
0 20 40 60 80
0
1
tin s
tin s
Fig. 4: RSSI measurements over time for the EN-IN ( )
and EN-OUT ( ) nodes compared to ground truth ( 1 in
cell; 0 not in cell) ( ).
entering by increasing its transmit power. Second, an attacker
is positioned in the center of the area of interest and reduces its
transmit power to force the system to believe that the attacker
is exiting. In the two scenarios, denoted by aoand aifor
“attacker out” “and attacker in”, respectively, a conventional
sensor node is used and is programmed to vary its transmit
power linearly from -16 dBm to +8 dBm, i.e., such that it
causes received signal dynamics similar to moving nodes.
B. Results
To highlight the effect of the post-processing, the estimation
results with and without post-processing are depicted in Fig. 5.
Based on post-processing, miss detection of singular samples
are corrected. Those miss detections occur mainly close to
the transition time. In the shown sequence, the presence of
the node in the cell was detected correctly for all experiments
when the node is in the cell center. Errors occur as difference
between estimated and ground truth cell transition time.
0 20 40 60 80
0
1
tin s
(a)
0 20 40 60 80
0
1
tin s
(b)
Fig. 5: SVM estimated position ( 1 in cell; 0 not in cell) of
the node ( ) compared to ground truth ( ) without post-
processing (a) and with post-processing (b).
combination. The error increase is explained by the fact that
the node combination ranking is not done based on NN results.
The error depends on which combination of the path nodes
(cf. Fig. 3) is used to measure the RSSI values. Therefore,
according to Sec. III-D, the error of all 255 possible com-
binations is evaluated with SVM. The ten combinations with
the smallest error are listed in Tab. I and are also evaluated
with the NN. Note that the NN has slightly higher error
for the same path node combinations and has a different
ranking. Moreover, as indicated by 7in the ¯ecolumn for
NN, the presence detection fails for one of the top-ten node
SVM NN
Combination ¯e[s]a0ai¯e[s]aoai
{1, 2, 4, 5, 7}0.577 371.191 3 3
{1, 2, 3, 4, 5, 7, 8}0.600 370.873 3 3
{2, 3, 5, 6, 7, 8}0.668 370.664 3 3
{2, 3, 4, 6, 7, 8}0.686 371.145 37
{1, 2, 5, 6, 7}0.668 3 3 0.986 3 3
{2, 3, 5, 7, 8}0.691 371.036 3 3
{2, 3, 4, 5, 7, 8}0.691 3 3 73 3
{2, 4, 5, 7, 8}0.714 3 3 1.127 3 3
{2, 4, 5, 6, 7, 8}0.714 3 3 1.082 3 3
{1, 2, 3, 5, 7, 8}0.736 371.059 3 3
TABLE I: Ten most accurate path node combinations evaluated
with SVM and compared to NN.
To evaluate the robustness against attacks the node
combinations are further tested against the attack scenarios. If
an attacker failed and the method could correctly identify the
node presence, it is indicated by 3. If the attacker succeeded
and the method detected a cell crossing, it is indicated by 7.
A node combination and the estimation technique can only be
used, if an attacker did not succeed for both cases. Thus, for
SVM and NN, respectively, the best path node combination
are {1,2,5,6,7}and {2,3,5,6,7,8}. For a comparison of
SVM versus NN in the considered scenario, the results in
Tab. I indicate that SVM has less error results while NN
is more robust against attacks. Note, however, that results
obtained with NN are highly depending on the training of the
model. Thus, the presented results can not be generalized and
have to be evaluated individually for each application.
V. CONCLUSION
In this work we proposed a novel concept of path and guard
nodes that are used to classify the sensor nodes to location
areas and which is robust against malicious attacks. As a proof
of concept, two machine learning algorithms together with
a path node selection scheme were developed and validated
in an automotive use case. We could show that the RSSI
measurements are sufficient to localize sensor nodes with a
adequate accuracy. We have to emphasize that the RSSI values
are measured during regular operation of the network without
any change to protocol, setting or measurement nodes. In
further studies the performance of the adaptability to various
conditions in factories will be evaluated.
REFERENCES
[1] Montgomery Karl, Candell Richard, Liu Yongkang, and Hany Mohamed,
“Wireless user requirements for the factory workcell, Tech. Rep.,
National Institute of Standards and Technology, jan 2020.
[2] Hans-Peter Bernhard, Andreas Springer, Achim Berger, and Peter Priller,
“Life cycle of wireless sensor nodes in industrial environments,” in 2017
IEEE 13th International Workshop on Factory Communication Systems
(WFCS), May 2017, pp. 1–9.
[3] Leander B. H¨
ormann, Christian Kastl, Hans-Peter Bernhard, Peter Priller,
and Andreas Springer, “Lifetime security concept for industrial wireless
sensor networks,” in 2020 IEEE 16th International Workshop on Factory
Communication Systems (WFCS), 2020, pp. 1–8.
[4] Christopher M. Bishop, Pattern Recognition and Machine Learning
(Information Science and Statistics), Springer, 8 edition, 2009.
... For many use cases, it is necessary to record the spatial position of the wireless sensor in addition to its measured value. As an example, we present an extension to an IWSNbased measurement system [4] for the emission certification of cars according to the Euro 6 standard which traces the required measurements in time and position [5]. During these tests, cars are moved between differently conditioned areas and for the position tracking a non-interfering add-on-localization extends This work is funded by the InSecTT project (https://www.insectt.eu/). ...
Preprint
Full-text available
For Cyper-Physical Production Systems (CPPS), localization is becoming increasingly important as wireless and mobile devices are considered an integral part. While localizing targets in a wireless communication system based on the Received Signal Strength Indicators (RSSIs) is a usual solution, it is limited by sensor quality. We consider the scenario of a car moving in and out of a chamber and propose to use a particle filter for sensor fusion, allowing us to incorporate non-idealities in our model and achieve a high-quality position estimate. Then, we use Machine Learning (ML) to classify the vehicle position. Our results show that the location output of the particle filter is a better input to the classifiers than the raw RSSI data, and we achieve improved accuracy while simultaneously reducing the number of features that the ML has to consider. We also compare the performance of multiple ML algorithms and show that SVMs provide the overall best performance for the given task.
... For many use cases, it is necessary to record the spatial position of the wireless sensor in addition to its measured value. As an example, we present an extension to an IWSNbased measurement system [4] for the emission certification of cars according to the Euro 6 standard which traces the required measurements in time and position [5]. During these tests, cars are moved between differently conditioned areas and for the position tracking a non-interfering add-on-localization extends This work is funded by the InSecTT project (https://www.insectt.eu/). ...
Preprint
Full-text available
Industrial wireless sensor networks are becoming crucial for modern manufacturing. If the sensors in those networks are mobile, the position information, besides the sensor data itself, can be of high relevance. E.g. this position information can increase the trustability of a wireless sensor measurement by assuring that the sensor is not physically removed, off track, or otherwise compromised. In certain applications, localization information at cell-level, whether the sensor is inside or outside a room or cell, is sufficient. For this, localization using Received Signal Strength Indicator (RSSI) measurements is very popular since RSSI values are available in almost all existing technologies and no direct interaction with the mobile sensor node and its communication in the network is needed. For this scenario, we propose methods to improve the robustness and accuracy of common machine learning classifiers, by using features based on short-term moments and a second classification stage using Hidden Markov Models. With the data from an extensive measurement campaign, we show the applicability of our method and achieve a cell-level localization accuracy of 93.5\%.
Conference Paper
Full-text available
We present the design of a suite of protocols for wireless sensor networks (WSNs) with respect to a complete life cycle of a WSN node from warehouse to the end of operation. While there are numerous publications on various, usually isolated, aspects of WSNs, the whole life cycle of a node from registration in an automation system via warehouse, calibration, mounting, performing measurements to finally unmounting, has not yet been sufficiently addressed as compound survey. Our application example is a WSN to be used in automotive test beds in which a large amount of testing with many different sensors is performed in controlled environments. While there is published work on WSNs for performing the measurements focusing on node hardware and MAC protocol, we now extend this work by accounting for the whole life cycle of operation of such a WSN and its nodes. This is mainly achieved by introducing optimized MAC protocols for wireless communication in all life cycle phases. Right from beginning of the life cycle the nodes are synchronized with a base node. Even during long offline periods nodes stay synchronized. The life cycle is modeled via a set of states, instantiated in state machines, which control operation in the base station and the nodes. Besides, considering the whole life cycle of the sensor nodes, our design minimizes energy consumption, largely avoids collisions due to suitable multiple access protocols, and allows tight synchronization even during long sleep periods. A demonstrator concludes the presentation and shows functionality and benefits of the concept.
Book
The dramatic growth in practical applications for machine learning over the last ten years has been accompanied by many important developments in the underlying algorithms and techniques. For example, Bayesian methods have grown from a specialist niche to become mainstream, while graphical models have emerged as a general framework for describing and applying probabilistic techniques. The practical applicability of Bayesian methods has been greatly enhanced by the development of a range of approximate inference algorithms such as variational Bayes and expectation propagation, while new models based on kernels have had a significant impact on both algorithms and applications. This completely new textbook reflects these recent developments while providing a comprehensive introduction to the fields of pattern recognition and machine learning. It is aimed at advanced undergraduates or first-year PhD students, as well as researchers and practitioners. No previous knowledge of pattern recognition or machine learning concepts is assumed. Familiarity with multivariate calculus and basic linear algebra is required, and some experience in the use of probabilities would be helpful though not essential as the book includes a self-contained introduction to basic probability theory. The book is suitable for courses on machine learning, statistics, computer science, signal processing, computer vision, data mining, and bioinformatics. Extensive support is provided for course instructors, including more than 400 exercises, graded according to difficulty. Example solutions for a subset of the exercises are available from the book web site, while solutions for the remainder can be obtained by instructors from the publisher. The book is supported by a great deal of additional material, and the reader is encouraged to visit the book web site for the latest information. A forthcoming companion volume will deal with practical aspects of pattern recognition and machine learning, and will include free software implementations of the key algorithms along with example data sets and demonstration programs. Christopher Bishop is Assistant Director at Microsoft Research Cambridge, and also holds a Chair in Computer Science at the University of Edinburgh. He is a Fellow of Darwin College Cambridge, and was recently elected Fellow of the Royal Academy of Engineering. The author's previous textbook "Neural Networks for Pattern Recognition" has been widely adopted.
Wireless user requirements for the factory workcell
  • Montgomery Karl
  • Candell Richard
Montgomery Karl, Candell Richard, Liu Yongkang, and Hany Mohamed, "Wireless user requirements for the factory workcell," Tech. Rep., National Institute of Standards and Technology, jan 2020.