Work-In-Progress: Rssi-Based Presence Detection In Industrial Wireless Sensor Networks

Abstract

We propose to add a monitoring system consisting of so-called path- and guard nodes to industrial wireless sensor network (IWSN), to increase the security level by using RSSI measurements. Via these measurements, the monitoring system determines the presence of a mobile sensor node in a predefined area, which can be used to handle access rights and to increase automation capabilities in industrial applications. We add this monitoring system to an IWSN based on the EPhESOS protocol, which has a high degree of flexibility to meet industrial requirements in different applications throughout the lifetime of a sensor node while enabling energy-autonomous operation. Two practical machine learning algorithms for RSSI-based presence detection are presented, namely a support vector machine and a neural network algorithm. They are evaluated in an automotive example and tested for their robustness against malicious attacks. Additionally, a method to find the best node locations of the monitoring system is presented.

Full text

Work-In-Progress: RSSI-Based Presence Detection
in Industrial Wireless Sensor Networks
Hans-Peter Bernhard∗†, Julian Karoliny∗†, Bernhard Etzlinger†, Andreas Springer†
†Johannes Kepler University Linz, Institute for Communications Engineering and RF-Systems, 4040 Linz, Austria
∗Silicon Austria Labs GmbH, 8010 Graz
Abstract—We propose to add a monitoring system consisting
of so-called path- and guard nodes to industrial wireless sensor
networks (IWSNs), to increase the security level by using re-
ceive signal strength indicator (RSSI) measurements. Via these
measurements, the monitoring system determines the presence
of a mobile sensor node in a predefined area, which can be used
to handle access rights and to increase automation capabilities
in industrial applications. We add this monitoring system to
an IWSN based on the EPhESOS protocol, which has a high
degree of flexibility to meet industrial requirements in different
applications throughout the lifetime of a sensor node while
enabling energy-autonomous operation. Two practical machine
learning algorithms for RSSI-based presence detection are pre-
sented, namely a support vector machine and a neural network
algorithm. They are evaluated in an automotive example and
tested for their robustness against malicious attacks. Additionally,
a method to find the best node locations of the monitoring system
is presented.
I. INT ROD UC TI ON A ND R EL ATED W OR K
Industrial sensor systems are typically used for monitoring
objects and processes across the whole value chain. Tradition-
ally, data is transmitted via a wired industrial communication
network like a field bus (e.g., CANopen or Profibus-DP) or an
Ethernet network (e.g., TSN IEEE802.1xx or EtherCAT). The
goal of IWSNs is to replace the cable-based infrastructure on
the ”last meters” to the sensor nodes. Today, various wireless
standards are used in industrial communication, including
ZigBee, WirelessHART, ISA100.11a, and WIA-PA. Those
standards are based on the IEEE802.15.4 PHY and MAC
layers, which have strongly limited communication resources,
e.g. a maximum data rate of 250 kbps, that has to be shared by
all active nodes. Thus, they only partly fulfill current industrial
specifications [1]. Alternative solutions are based on Bluetooth
and IEEE802.11. However, both standards could not achieve a
break through in industrial monitoring applications as they are
not fully compliant to the requirements of I4.0 factory cells
[1].
In this paper we use the energy and power efficient syn-
chronous sensor network (EPhESOS) protocol [2] and add
a monitoring system consisting of so-called path- and guard
nodes to IWSNs, to increase the security level by using
This work has been supported in part by the SCOTT project.
SCOTT(www.scott-project.eu) has received funding from the Electronic Com-
ponent Systems for European Leadership Joint Undertaking under grant agree-
ment No 737422. This Joint Undertaking receives support from the European
Union’s Horizon 2020 research and innovation programme and Austria, Spain,
Finland, Ireland, Sweden, Germany, Poland, Portugal, Netherlands, Belgium,
Norway.
RSSI measurements. Via these measurements, the monitoring
system determines the presence of a mobile sensor node in a
predefined area.
The paper is structured as follows: Section II describes
the industrial environment in which the wireless network is
implemented together with its extension on network security.
The subsequent section III explains presence detection and
section IV covers validation. A short summary completes the
work.
II. INDUSTRIAL SETTING
Applications in a factory as depicted in Fig. 1 are highly de-
manding with respect to mobile measurements. In this specific
automotive factory example, vehicle tests are performed for the
purpose of certifying cars according to the Euro 6 standard. To
perform soak testing measurement campaigns for certification,
sensor data has to be traced in time and position. Continuously
monitoring all observation variables is a basic requirement for
the Euro 6 certification and especially challenging since cars
are moving between different condition and testing areas. In
wired systems, this task is solved with human interaction for
manual data monitoring. In wireless systems the task can be
solved during standard operation without human interaction.
The presented solution has to be in line with other wireless
Fig. 1: Chassis dyno testing factory. The colored areas are the
vehicle conditioning zones and the gray boxes represent the
test boxes, the chassis dynamometer.
factory communication demands which are surveyed in [1].
We use the EPhESOS communication protocol [2] as it
provides low energy consumption and security. It is based
on a deterministic media access control (MAC) layer using
time division multiple access (TDMA), which is an important
prerequisite for energy efficient communication.
A. Implementation
The physical (PHY) layer is implemented using Bluetooth®
low energy (BLE) and is used to build a network with up

to 100 nodes per base station. As hardware platform the
NordicTM NRF52840 family is used to design energy efficient
sensor nodes. The parameters of the network communication
within one cell are a superframe (SF) length 100 ms, time
to first time slot of 2 ms and time slot length of 980 µs.
In this implementation the data rate is limited to 9k3 bit/sec
per sensor node. The sensor nodes have an average power
consumption of less than 200µW, which enables the possibility
of autarkic operation with solar cells optimized for ambient
light in factory.
B. Authentication and data security
Since industrial wireless sensor and actuator networks
(IWSANs) have high security requirements, it is necessary
to join each sensor node individually to the network by a
key exchange procedure. This process is done by a two-factor
authentication. Nodes must have a second channel to securely
confirm the successful key exchange [3]. Obviously, data
communication must be secured by, e.g., AES128 encryption
which uses individual keys for each node. Additionally, it is
a must to update these keys session- or time-dependent. This
security requirement is not part of this work.
C. Location monitoring for presence detection
We propose the passive collection of positioning informa-
tion about the mobile nodes by the so-called path nodes,
which passively listen to the regular data communication of
the mobile nodes. These path nodes are arranged alongside
the routes of mobile nodes in a factory. So-called guard nodes
are located outside the protected area. The guard nodes jointly
monitor the site or factory to detect early if there is interference
or jamming from the outside. Path- and guard nodes have
the same architecture as conventional sensor nodes and are
participating in the same way in the EPhESOS protocol as
regular nodes. As they are pre-installed and static, they do not
require energy autarkic operation. Thus, they can continuously
listen to the network communication and record the RSSI
values of each packet and monitor packets, synchronicity and
other parameters of the ongoing regular communication in
the network. The RSSI values are sent to an edge computing
device via the base station. It will be shown in section IV
how a presence detection algorithm can make use of this
information. Evaluation results of position, synchronicity etc.,
can be used to assure that a sensor node is not physically
removed, off track, or otherwise compromised. In combination
with time stamping of the transmitted data, the measurement
campaigns are eligible for official documentation which is
one of the requested use cases for standardized production
processes.
Fig. 2 shows a typical factory situation. A mobile sensor
node e.g. moves along a conveyor belt, or is mounted on a
car in the vehicle test site. The claimed node location must
be verified to accept the sensor data. The advantage of this
approach is, that no specialized localization systems with addi-
tional hardware or software is required. This helps in fulfilling
Fig. 2: Factory building with symbolized receiving areas of
path nodes. The overlapping coverage of several path nodes is
used in the presence detection algorithm.
IWSN requirements. Also no change in the communication
schedule of the regular nodes is required.
A similar concept can be used to detect and localize
jamming devices. In Fig. 2, guard nodes for the surveillance
of the surroundings of the factory are mounted around the
building or on a fence. The guard nodes are monitoring
the communication channel also outside the factory to detect
whether or not the channel is occupied by jamming signals.
This information can be used twofold. Firstly, to detect the
area where the jamming attack takes place and secondly, to
localize the position of the jammer. In many cases jamming is
just an unintended disturbance of the channel, so the jammer
can be isolated or even removed if the device is precisely
located.
III. METHODS FOR LOCATION MONITORING
Guard- and path nodes measure RSSI values from packets
that are sent by the sensor nodes (cf. Sec. II-C). Here, the
goal is to assign a location out of a set of possible locations
to the node, based on these measurements. Model-based
approaches for indoor localization suffer from harsh signal
propagation conditions in the testing area, like non-line-of-
sight and multipath propagation. Thus, model-free machine
learning solutions are preferred.
Based on MRSSI measurements collected in x∈RM, the
inference task is to determine if a sensor node is in an area of
interest or not, i.e., it is a binary classification task with output
y∈ {−1,1}. In this section, two machine learning algorithms
for binary classification are presented. One algorithm uses
support vector machine (SVM) and provides a deterministic
approach via a convex formulation of the training problem.
The second algorithm applies a neural network (NN) to offer
a higher degree of freedom in the solutions. Finally, a method
for optimally selecting the location of guard- or path nodes is
proposed.
A. Support Vector Machines
SVMs are popular machine learning approaches for regres-
sion and classification tasks [4]. For binary classification, the
SVM uses y=sgnwTφ(x) + b,where sgn·denotes the
sign function, wis the weighting vector, φ(·)denotes a feature
space transformation and bis a bias. Note that wTφ(x) + b

describes a hyperplane in the transformed feature space that
is used to separate the input data xinto two classes. To
find the best possible separating hyperplane, the separation
area (referred to as margin) between the classes has to be
maximized. This problem is reformulated to
y=sgnN
X
n=1
antnkx,xn+b,(1)
where an≥1are Lagrange multipliers that are solved in
the optimization problem. In this work radial basis function
(RBF) kernels of the form k(x,x0) = exp −kx−x
0k2
2σ2,
performed best for classifying the training and validation data.
The resulting classifier in the form of (1) is thus defined by
the training data set tn,xnN
n=1 and the found Lagrange
multipliers an. As several anwill be zero, only a subset
of the training measurements is used for classification. These
surviving vectors are referred to as support vectors.
B. Neural Networks
The NN, i.e., the feed-forward multilayer perceptron, uses
multiple layers of logistic regression models, commonly used
for classification tasks and pattern recognition [4]. The used
NN consists of one input layer (with layer index k= 0),
Khidden layers (k= 1, . . . , K), and one output layer (k=
K+1). The number of perceptrons Jkin the k-th layer can be
chosen freely. Just the number of input and output perceptrons,
respectively, is set to the number of inputs and outputs, i.e.,
J0=Mand JK+1 = 1 for the binary classification. Given
the N-sampled training set tn,xnN
n=1, the weights w(k)
jk,jk−1,
jk= 1, . . . , Jk,k= 1, . . . , K +1, have to be learned, e.g. by
an implementation of the back-propagation algorithm [4].
C. Post-Processing
The presence detection from SVM and NN is evaluated
individually for each measurement, i.e., there is no knowledge
about dynamic behavior integrated. From tests conducted in
the context of this work, it could be observed that noisy
classifications occur close to the border of the cell. There,
the classifiers output is frequently changing with a new mea-
surement. By assuming a simple dynamic dependency, i.e.,
that the mobile sensor node is not performing abrupt cluster
changes, the model output ytat time interval tis filtered
using Lpast and future outputs using a windowed median
yt= med yt−L, . . . , yt+Lwhere yt∈ {0,1}.
D. Node Selection Scheme
In a factory environment there are many nodes available.
The identification of the best combination is partitioned in:
(i) evaluate the detection accuracy obtained with all available
sensor combinations with SVM; (ii) select the ten best sensor
node combinations according to the accuracy, learn the NN
models for these, and evaluate the corresponding accuracy; (iii)
validate the models attack scenarios, that will be described in
Sec. IV-A and only pick node combinations which are safe
against these attacks; (iv) choose the one with the highest
accuracy.
IN
OUT
other cars
TN-1 (3)
TN-2 (4)
TN-3 (5)
TN-4 (6)
EN-OUT (8)
EN-IN (7)
BN-LE (2)
BN-RI (1)
(0,0,0)
y
x
Fig. 3: Measurement setup
IV. EVALUATION OF IWSN PRESENCE DETECTION
To validate the proposed approach, presence detection is
evaluated in an environment comparable to Fig. 1. Note that
presence detection requires path nodes that are installed along
the area of interest. Thus, in this chapter, the installment
of path nodes, the performance of the algorithms and their
robustness towards attacks is investigated.
A. Measurement Setup and Attack Scenarios
The proposed classification methods for determining
whether a mobile node is inside or outside of a predefined cell,
are tested in a garage similar to the soak testing application.
A mobile node is mounted at the front of a car while driving
with walking speed into a cell, i.e. a parking lot. The mobile
node transmits data to the base station every 0.5 s, hence, the
sampling time of the RSSI measurements at the guard nodes
is the same as the packet transmission rate of the mobile node.
Fig. 3 depicts the measurement setup with the trajectory of the
car and the positions of the path nodes.
Eight path nodes were placed in different positions inside
the parking lot and alongside the possible path. The path
nodes are mounted on the ceiling (Top-Nodes TN), directly
at the borders of the cluster (Border-Nodes BN) and at the
end positions of the driving trajectory (End-Nodes EN).
With this setup, the proposed machine learning approaches
were trained to perform the cell presence detection. The
ground truth data were generated by using a photo-detector
installed at the border of the cell to report when the car is
passing. An exemplary sequence of the training data of two
path nodes is depicted in Fig. 4 together with ground truth data.
In total, at a sampling rate of 2 Hz, each path node sampled
785 RSSI values as training data. To validate the presence
detector, a validation set with 654 measurements per path node
similar to the training set was collected at the same sampling
rate. The accuracy of the methods is evaluated with the mean
absolute time difference between ground truth cell entering
and the estimated cell entering. This is the most crucial part
of the route and denoted as error ¯e.
Furthermore, two attack scenarios are considered. First, an
attacker is positioned at different locations outside the area
of interest and tries to make the system believe that it is

0 20 40 60 80
−80
−60
−40
RSSI Value in dBm
0 20 40 60 80
0
1
tin s
tin s
Fig. 4: RSSI measurements over time for the EN-IN ( )
and EN-OUT ( ) nodes compared to ground truth ( 1 in
cell; 0 not in cell) ( ).
entering by increasing its transmit power. Second, an attacker
is positioned in the center of the area of interest and reduces its
transmit power to force the system to believe that the attacker
is exiting. In the two scenarios, denoted by aoand aifor
“attacker out” “and attacker in”, respectively, a conventional
sensor node is used and is programmed to vary its transmit
power linearly from -16 dBm to +8 dBm, i.e., such that it
causes received signal dynamics similar to moving nodes.
B. Results
To highlight the effect of the post-processing, the estimation
results with and without post-processing are depicted in Fig. 5.
Based on post-processing, miss detection of singular samples
are corrected. Those miss detections occur mainly close to
the transition time. In the shown sequence, the presence of
the node in the cell was detected correctly for all experiments
when the node is in the cell center. Errors occur as difference
between estimated and ground truth cell transition time.
0 20 40 60 80
0
1
tin s
(a)
0 20 40 60 80
0
1
tin s
(b)
Fig. 5: SVM estimated position ( 1 in cell; 0 not in cell) of
the node ( ) compared to ground truth ( ) without post-
processing (a) and with post-processing (b).
combination. The error increase is explained by the fact that
the node combination ranking is not done based on NN results.
The error depends on which combination of the path nodes
(cf. Fig. 3) is used to measure the RSSI values. Therefore,
according to Sec. III-D, the error of all 255 possible com-
binations is evaluated with SVM. The ten combinations with
the smallest error are listed in Tab. I and are also evaluated
with the NN. Note that the NN has slightly higher error
for the same path node combinations and has a different
ranking. Moreover, as indicated by 7in the ¯ecolumn for
NN, the presence detection fails for one of the top-ten node
SVM NN
Combination ¯e[s]a0ai¯e[s]aoai
{1, 2, 4, 5, 7}0.577 371.191 3 3
{1, 2, 3, 4, 5, 7, 8}0.600 370.873 3 3
{2, 3, 5, 6, 7, 8}0.668 370.664 3 3
{2, 3, 4, 6, 7, 8}0.686 371.145 37
{1, 2, 5, 6, 7}0.668 3 3 0.986 3 3
{2, 3, 5, 7, 8}0.691 371.036 3 3
{2, 3, 4, 5, 7, 8}0.691 3 3 73 3
{2, 4, 5, 7, 8}0.714 3 3 1.127 3 3
{2, 4, 5, 6, 7, 8}0.714 3 3 1.082 3 3
{1, 2, 3, 5, 7, 8}0.736 371.059 3 3
TABLE I: Ten most accurate path node combinations evaluated
with SVM and compared to NN.
To evaluate the robustness against attacks the node
combinations are further tested against the attack scenarios. If
an attacker failed and the method could correctly identify the
node presence, it is indicated by 3. If the attacker succeeded
and the method detected a cell crossing, it is indicated by 7.
A node combination and the estimation technique can only be
used, if an attacker did not succeed for both cases. Thus, for
SVM and NN, respectively, the best path node combination
are {1,2,5,6,7}and {2,3,5,6,7,8}. For a comparison of
SVM versus NN in the considered scenario, the results in
Tab. I indicate that SVM has less error results while NN
is more robust against attacks. Note, however, that results
obtained with NN are highly depending on the training of the
model. Thus, the presented results can not be generalized and
have to be evaluated individually for each application.
V. CONCLUSION
In this work we proposed a novel concept of path and guard
nodes that are used to classify the sensor nodes to location
areas and which is robust against malicious attacks. As a proof
of concept, two machine learning algorithms together with
a path node selection scheme were developed and validated
in an automotive use case. We could show that the RSSI
measurements are sufficient to localize sensor nodes with a
adequate accuracy. We have to emphasize that the RSSI values
are measured during regular operation of the network without
any change to protocol, setting or measurement nodes. In
further studies the performance of the adaptability to various
conditions in factories will be evaluated.
REFERENCES
[1] Montgomery Karl, Candell Richard, Liu Yongkang, and Hany Mohamed,
“Wireless user requirements for the factory workcell,” Tech. Rep.,
National Institute of Standards and Technology, jan 2020.
[2] Hans-Peter Bernhard, Andreas Springer, Achim Berger, and Peter Priller,
“Life cycle of wireless sensor nodes in industrial environments,” in 2017
IEEE 13th International Workshop on Factory Communication Systems
(WFCS), May 2017, pp. 1–9.
[3] Leander B. H¨
ormann, Christian Kastl, Hans-Peter Bernhard, Peter Priller,
and Andreas Springer, “Lifetime security concept for industrial wireless
sensor networks,” in 2020 IEEE 16th International Workshop on Factory
Communication Systems (WFCS), 2020, pp. 1–8.
[4] Christopher M. Bishop, Pattern Recognition and Machine Learning
(Information Science and Statistics), Springer, 8 edition, 2009.