Towards Energy Efficient Wireless Sensing by Leveraging Ambient Wi-Fi Traffic ^†

Abstract

Wireless-based sensing of physical environments has garnered tremendous attention recently, and its applications range from intruder detection to environmental occupancy monitoring. Wi-Fi is positioned as a particularly advantageous sensing medium, due to the ubiquity of Wi-Fi-enabled devices in a more connected world. Although Wi-Fi-based sensing using Channel State Information (CSI) has shown promise, existing sensing systems commonly configure dedicated transmitters to generate packets for sensing. These dedicated transmitters substantially increase the energy requirements of Wi-Fi sensing systems, and hence there is a need for understanding how ambient transmissions from nearby Wi-Fi devices can be leveraged instead. This paper explores the potential of Wi-Fi-based sensing using CSI derived from ambient transmissions of Wi-Fi devices. We demonstrate that CSI sensing accuracy is dependent on the underlying traffic type and the Wi-Fi transceiver architecture, and that control packets yield more robust CSI than payload packets. We also show that traffic containing upload data is more suitable for human occupancy counting, using the Probability Mass Function (PMF) of CSI. We further demonstrate that multiple spatially diverse streams of Wi-Fi CSI can be combined for sensing to an accuracy of $99\%$. The experimental study highlights the importance of training Wi-Fi sensing systems for multiple transmission sources to improve accuracy. This research has significant implications for the development of energy-efficient Wi-Fi sensing solutions for a range of applications.

1. Introduction

1.1. Background

Wi-Fi sensing solutions have emerged as a useful tool for the spatial monitoring and tracking of patrons in public spaces, especially in the context of the COVID-19 pandemic. The pandemic has made it difficult for authorities to enforce social distancing requirements and for contact tracers to identify where people have been exposed to the virus. Although modern equipment such as cameras or ultrasonic sensors can be used for monitoring, they raise privacy concerns and are not ubiquitous enough to be deployed quickly. Recent work has shown that Wi-Fi signal strengths and complex machine learning algorithms can accurately detect and count people in the coverage area of Wi-Fi networks, with no privacy concerns. However, passive sensing through harvesting existing Wi-Fi traffic presents several challenges, including the introduction of spatially diverse signals that may move and carry unknown data, for which the sensing device is not prepared. Beyond the pandemic, Wi-Fi sensing can be useful for fall detection, home security, attendance tracking, and other use cases for spatial monitoring.

1.2. Motivation and Contributions

Wi-Fi sensing has shown great promise in detecting human activity and occupancy in public spaces, but the existing literature has largely been limited to sterile experimental setups that use Internet Control Message Protocol (ICMP) Ping packets. This paper highlights the need for Wi-Fi sensing to be tested in real-world scenarios using ambient traffic such as YouTube or Twitch data, which may be sourced from Access Points (AP) or end user devices. The authors suggest that if successful, Wi-Fi sensing systems could be deployed covertly in public spaces, sensing human activity and occupancy without making our presence known. Furthermore, the reduced hardware requirements of Wi-Fi sensing would make it more competitive with existing sensing solutions that have large overhead and high energy demands. This research represents an important step towards the real-world application of wireless sensing and has the potential to improve the competitiveness of Wi-Fi sensing solutions.

Our contributions are four-fold:

• This paper makes a crucial contribution to the real-world application of wireless sensing by investigating the robustness of human occupancy counting based on Wi-Fi traffic that is not limited to ICMP Ping packets. The authors explore the potential of ambient Internet of Things (IoT) traffic as a source of Wi-Fi traffic for occupancy counting, which could enable covert sensing in public spaces without a dedicated transmitter;
• We introduce a novel framework that characterises the correlation between Channel State Information (CSI) and the underlying network traffic in an otherwise static channel. This is subsequently exploited as our paper considers Wi-Fi sensing, which aggregates multiple transmission sources, a necessary advancement for eventual implementation of Integrated Sensing and Communications (ISAC) in public spaces;
• Having shown that ambient Wi-Fi traffic can be used for sensing, we also demonstrate the varying utility of traffic that is sourced from internet control packets, payload packets, and whether these packets are travelling upstream or downstream;
• Lastly, this paper makes recommendations regarding the implementation of passive Wi-Fi sensing systems, after experimentally demonstrating the varying utility of packets derived from streaming devices against wireless access points.

1.3. Paper Organisation

The paper is organised as follows. In Section 2, we present a brief State-of-the-Art on Wi-Fi sensing, highlighting the research gap preventing passive commercial application. Then, in Section 3, we introduce mathematical models to describe Wi-Fi sensing and our physical metric (CSI), before detailing the ambient sensing topology. In Section 4, we introduce our framework for CSI-based occupancy counting, which is the chosen application used to investigate ambient sensing in this paper. Finally, in Section 5, we perform occupancy counting in a lecture theatre using ambient Wi-Fi CSI, before performing more tailored experiments to understand the role of packet source in Section 6. Finally, in Section 7, we summarise our findings.

2. State of the Art

In this section, we discuss recent literature on Wi-Fi sensing and state the research gaps this paper will address.

2.1. Sensing Using Wi-Fi

Recent work has shown that variations in Wi-Fi signal strength can be leveraged to predict information about the channel those signals propagated through [1,2,3,4]. In the same manner that visible light is scattered by physical objects and our eyes interpret what is present, the multipath propagation effects caused by objects leave artefacts on Wi-Fi signal strength, and Machine Learning (ML) can be used to interpret what was in the signal path.

Early work used variations in the Received Signal Strength Indicator (RSSI) to detect activities such as walking, running, crawling and squatting to accuracies greater than $70\%$ [3,5,6,7]. RSSI is a simple measure of the received signal power of an inbound Wi-Fi packet, and early work has leveraged relative changes in this signal power for detecting activities in the channel or localisation [8]. Prior work has shown that these RSSI-based localisation technologies suffer in Non Line of Sight (NLOS) conditions [9], where channel blockages degrade the signal strength substantially. Furthermore, these RSSI-based techniques rely on knowledge of the transmit power, which may be unknown and necessitate complex estimation methods [10]. It was also found that, since the received signal power is affected by channel noise, there is a ceiling on the level of activity detection accuracy achievable using RSSI techniques [5]. Hence, more recent work has utilised CSI as the metric for detection [11,12,13,14,15]. CSI is a complex-valued metric which describes the channel characteristics, in terms of how it attenuates and delays a signal [16]. Whereas RSSI describes how much a signal was attenuated, which depends on the transmitted signal itself and noise, CSI describes the inherent response of the wireless channel. More recent work utilising CSI for sensing has achieved accuracies exceeding $90\%$ in applications such as human activity detection [17,18] and occupancy monitoring [16,19].

2.2. Processing CSI

Although CSI is independent of channel noise, it is subject to measurement noise due to fluctuations in transmission rate and the internal CSI reference level of Wi-Fi Network Interface Cards (NIC) [20]. This causes high-frequency artefacts in CSI data as well as outliers. In the literature, it has been shown that low pass filters applied to the CSI amplitude time series are effective at mitigating the mentioned high-frequency noise [21,22], and Hampel filters are effective at removing those outliers [2]. The filtered CSI can have a large dimensionality, owing to the Orthogonal Frequency Division Multiplexing (OFDM) transmission scheme [2]. In this scheme, Wi-Fi packets are sent over a domain of n subcarriers. The size of n depends on the channel bandwidth (i.e., $n=64$ for a 20 MHz channel). Hence, CSI extraction tools such as [23] produce n complex CSI values for every sample. This means that a sampling interval will produce n independent CSI timeseries that can be used to profile the physical environment. Deciding how to most effectively use these independent subcarrier timeseries has been a challenge in prior work. Instead of using all subcarriers, dimensionality reduction techniques such as Principle Component Analysis (PCA) have been effective in concentrating artefacts of human motion from all subcarriers into a single vector [2,12,14]. Other approaches have successfully used information learning to assess the utility of different subcarriers and select the best one for subsequent feature extraction [24,25]. Tadayon et al. [26] have further identified that the CSI reported by tools such as Nexmon [23] and Intel [27] do not represent the channel matrix concisely. CSI incurs synchronisation issues and signal processing effects during the sampling process, and it has been shown that these can be removed to obtain a closer measurement of the true channel matrix [26]. These processing techniques are complex, requiring substantial computational power not available on edge devices. It has been further shown that compression techniques and cloud-based processing can be utilised to perform large-scale Wi-Fi sensing, which involves a lot of real-time data [28].

2.3. Machine Learning Techniques

Once pre-processing has been applied to CSI to accentuate human artefacts, ML is used to correlate features in CSI with corresponding changes in the channel. It has been shown that the CSI amplitude of different OFDM subcarrier frequencies can be exploited for profiling a static channel [29,30,31]. Applications that aim to profile static channels often use statistical features calculated on the CSI Amplitude profile across the domain of OFDM subcarriers [19,30]. The temporal or static features are then used to train supervised classifiers. State-of-the-art Wi-Fi sensing systems utilise Deep Neural Networks (DNN) [16,32] or Convolutional Neural Networks (CNN) [33,34] to learn non-obvious features; however, instance-based classifiers such as Support Vector Machines (SVM) or K-Nearest-Neighbour (KNN) offer comparable accuracy at much better computational complexity [19,30]. Transfer Learning (TL) has also been applied, as it allows trained networks to be adaptable to deployment in new environments [35,36,37].

2.4. Ambient Sensing

Ambient sensing refers to passive data collection from everyday user devices. This term is used to distinguish it from the traditional method of injecting dedicated packets, which is commonly used in Wi-Fi sensing literature. The traditional method involves using a dedicated transmitter to populate the channel with Ping packets, usually placed in a Line of Sight (LOS) position within the sensing environment. On the other hand, in ambient sensing, we are merely listening to the existing traffic in the channel, without injecting any dedicated packets to estimate CSI. In an ambient sensing scenario, multiple devices can act as transmitters and propagate packets for collection by a single CSI extractor. We identify WiTraj [38], which uses multiple CSI extractors and a single transmitter to measure spatially diverse channels for greater coverage of the sensing environment. WiTraj used a single transmitter, broadcasting ICMP Ping packets at 400 Hz [38], which does not reflect normal user traffic. Instead of introducing multiple CSI extractors, IoT devices already in the channel could be used to achieve the same spatial diversity. Whether a CSI extractor could effectively combine these spatially diverse streams to enhance its ability to profile the environment remains an important research question. Furthermore, these streams could be either uploading or downloading data from a server and the effect of these different configurations on sensing accuracy has not been investigated. To the best of our knowledge, we only identify one study, Et tu Alexa, Ref. [39] which performed CSI-based presence detection by passively estimating CSI using packets derived from normal user devices such as laptops and smartphones in a building. Their end-user devices were not transmitting Ping packets, rather they were sending normal Wi-Fi packets as part of their everyday functionality. Et tu Alexa could successfully detect the presence of humans in physical environments by observing movement-based oscillations in CSI amplitude [39]. Their result cannot be generalised to all Wi-Fi sensing applications, such as occupancy counting and object recognition, since these applications are not simply solved by observing temporal variations in CSI Amplitude. We further identify that the system in [39] was evaluated with the same network traffic used to train it, and hence a further research question is whether Wi-Fi sensing systems trained with a known set of traffic types maintain their performance when evaluated using CSI harvested from unseen traffic types.

3. System Description

In this section, we introduce technical details surrounding Wi-Fi sensing and introduce a model to understand how CSI varies with traffic type.

3.1. CSI Sensing Model

When a transmitter (Tx) broadcasts a signal X, and a receiver (Rx) collects a signal Y, the transmission can be modelled by the equation [40]:

$$Y(f,t)=H(f,t)X(f,t)+N(f,t)$$

(1)

$$\forall f\in \{1,2,\dots ,56\}$$

$$\forall t=\{t\in \mathbb{R},t>0\}$$

where, for a carrier frequency f and any instant t, $X(f,t)$ is the transmitted signal, $Y(f,t)$ is the received wireless signal, and $H(f,t)$ represents the mathematical transformation incurred on the transmitted signal by the channel. Equation (1) further comprises a noise component $N(f,t)$, which represents random additive noise due to interference in the wireless channel and non-idealities of the NIC on Tx and Rx [41]. The domain of f is the set of orthogonal subcarriers as part of the $802.11$n wireless standard. All 64 of these spectral components carry modulated data, and together they span a 20 MHz channel. By comparing the received signal with the transmitted signal, $H(f,t)$, otherwise known as CSI, can be calculated on each of these subcarriers. In this way, we are able to understand how signals of different frequencies are transformed by the same channel. In the same manner that different wavelengths of light are affected uniquely by physical medium, we expect that these varying frequency subcarriers will be uniquely attenuated and delayed by channel stimuli [31]. This will offer us insight into the channel composition. We further identify the dependence of CSI on the wireless link as [2]:

$$H(f,t)=H_{\mathrm{s}}(f,t)+\sum _{k\in P}{a}_k(f,t)e^{\frac{-j2\pi d_k\left(0\right)+v_{k}t}{\lambda }}$$

(2)

where $H_{\mathrm{s}}(f,t)$ is the response of the static signal path, P is the total dynamic signal path, $a_k$ is the attenuation on path k, $d_k$ is the path length from receiver to transmitter, $v_k$ is the rate at which the length of the kth path is changing, and $\lambda$ is the signal wavelength.

3.2. Ambient Device Architecture

As per Equation (1), it is clear that we require packets propagating in the wireless channel, which can be used to estimate H. As emphasised in Section 2, existing work equips the sensing environment with a dedicated Tx and Rx in order to measure CSI. This scenario is depicted in the left side of Figure 1.

In Figure 1, we first illustrate an office environment in which there are 2 bystanders and a desk with a personal computer. In existing Wi-Fi sensing endeavours, such a room is rigged with a CSI extractor and a transmitter, with their LOS crossing the main diagonal of the room. Tx propagates ICMP Ping packets into the room, and the CSI extractor intercepts these for CSI estimation. This approach has the following limitations:

• The sensing system is not concealed, since the MAC address and presence of Tx will be visible due to the propagation of Ping packets. Furthermore, occupying the channel with Ping packets for sensing will severely degrade the bandwidth available for everyday users.
• A dedicated transmitter introduces computational and power expenses, and prevents us from sensing environments where we do not have access to place a transmitter. This shortcoming prevents implementation in discrete surveillance applications, and increases the burden of power requirements on the user.

To demonstrate the power requirements of a dedicated Tx in Wi-Fi sensing systems, we configure ESP32 and Raspberry Pi 4B devices to transmit ICMP Ping packets at various rates. We measure the device power consumption in each case and illustrate these below.

In Figure 2, we present plots of the energy consumption for 2 common Wi-Fi sensing transmitters; ESP32 and Raspberry Pi 4B. The ESP32 has an average power draw exceeding 300 mW, which increases slightly as a function of the sensing transmission rate. We note also that the ESP32 has a ceiling on its achievable transmission rate at around 200 Hz. The power consumption is far greater for the Raspberry Pi, with an average power draw exceeding $2.5$ W beyond a transmission rate of 200 Hz. Its consumption also increases slightly as a function of the Tx rate, before flattening off. Overall, these results show that Wi-Fi sensing transmitters can draw large amounts of power, especially as the sensing rate is increased. This can pose deployment issues in remote environments where battery operation would be required.

In Figure 1, we subsequently depict the ambient Wi-Fi sensing topology to address these flaws in the same environment. In this scenario, the CSI extraction device collects multiple packet streams from users’ mobile devices. These packet streams reflect normal user activity, such as media streaming and web browsing. The sensing system is completely passive, and does not pollute the wireless channel with dedicated sensing packets. As depicted in Figure 1, this deployment topology introduces the following challenges:

• Doppler artefacts: As the transmission devices themselves could be moving, this will introduce additional changes to the dynamic signal path P as defined by Equation (2). In applications such as occupancy monitoring or activity recognition where the dynamic signal path is vital, this Tx movement creates a significant barrier to accurate sensing outcomes.
• Spatial diversity: The use of multiple transmission devices for CSI harvesting creates spatial diversity within the sensing system. Whilst this can improve the sensing systems coverage over the environment, it poses additional challenges to the classifier and increases the processing resource requirements.
• NLOS: The signals propagating between Tx and Rx may not have LOS coverage over the sensing subject. Rather than using a dedicated transmitter placed in a specific LOS position, the system is dependent on harvesting traffic from Wi-Fi devices which could have any location within the room. Referring to Equation (2), this represents a change in the static signal path $H_{\mathrm{s}}(f,t)$.
• Varying packet contents: As the Wi-Fi devices are unrestrained, their packet streams will reflect normal user activities such as music streaming, video buffering, or web browsing. Firstly, the non-uniformity of the transmission characteristics for these media types creates inequality in the attainable CSI sampling rate for Rx. Furthermore, It has been shown in prior work that the underlying CSI varies when harvested from varying traffic types [42]. Here, we recall that the operating principle of Wi-Fi sensing is to correlate changes in CSI with changes in the physical channel. Hence, it is likely that any unwanted changes in CSI due to changes in packet type or transmission rate will reduce the robustness of the trained classifier.

This paper aims to empirically investigate the impact of these challenges on Wi-Fi sensing outcomes, within the context of human occupancy counting.

3.3. CSI Sensing with Different Traffic

In this section, we more concisely motivate our investigation into the influence of underlying packet types on the efficacy of ambient Wi-Fi sensing.

3.3.1. Variation in CSI with Packet

As discussed, prior work has demonstrated that CSI varies as a function of the underlying traffic used to estimate it. To understand the reason for this, we first illustrate the typical $802.11$ Wi-Fi transceiver architecture in Figure 3.

In Figure 3, we illustrate the transceiver architecture for a wireless NIC to demonstrate how the measured CSI varies from the actual channel $H(f,t)$. We observe from Figure 3 that the measured CSI (in red) encompasses effects such as Cyclic Delay Diversity (CDD), Spatial Mapping, Inverse Fast Fourier Transform (IFFT), Windowing, Analogue/Digital conversions (ADC), and the Fast Fourier Transform (FFT). These signal transformations are dependent on the signal length, which in turn is dependent on the underlying traffic type. This model, in addition to results from prior work [42], lead us to believe that the measured CSI will have some dependence on the underlying traffic type. We hypothesize that this will impede accurate sensing outcomes if those traffic types were not accounted for during the training phase.

3.3.2. Degrees of Freedom

In line with the model above, we can attribute certain degrees of freedom to a Wi-Fi IoT packet that might affect the underlying CSI. These include:

• Traffic Type (Control or Payload)
• Media Type (Video or Text)
• Direction (Upstream or Downstream)
• Source Device (Access Point or Laptop)

In this paper, we use an easily controllable laptop to generate Wi-Fi packets, varying the above parameters as our independent variables and observing the change in Wi-Fi sensing accuracy as our dependent variable.

4. Occupancy Counting Framework

For the experimental validation of our new ambient sensing topology depicted in Figure 1, we conduct occupancy counting using CSI and use prediction accuracies as our performance metric. We will investigate how the accuracy of an occupancy counting system is affected by traffic types and multiple ambient streams; however, these results apply generally to any sensing application which uses ML to correlate CSI patterns with pre-defined classes. This section covers our ML and signal processing framework for occupancy counting with CSI.

4.1. Data Processing and System Flow

As mentioned, CSI is subject to high frequency noise as well as burst noise due to the measuring equipment. We first take the magnitude of our CSI timeseries and discard the phase information. The data are first processed using a Hampel filter of length 10, which removes outliers due to burst noise. Our data processing pipeline then uses a low-pass Finite Impulse Response (FIR) filter with an upper frequency of 5 Hz in order to attenuate the high frequency noise whilst preserving the CSI signal shape. Recent work, including our own [31], has shown correlation between the CSI amplitude profile across OFDM subcarriers and channel blockage [29]. We hence use statistical features that represent the distribution of CSI amplitudes across our OFDM subcarriers. These features are then fed into the SVM for training and evaluation, and the SVM is subsequently used to provide an occupancy estimate. This proposed framework is illustrated in Figure 4 below.

4.2. Feature Set

As defined in Section 3.1, $H(f,t)$ represents the complex valued CSI across the 56 OFDM subcarriers. We subsequently define $\left|H\right[f,n\left]\right|$ to be the sampled CSI amplitude values for each sample n. Motivated by the literature [30,31], we define a set of 64 OFDM subcarrier-based statistical features for each sample n. Firstly, our feature vector includes the 56 filtered CSI amplitudes $\left|H\right[f,n\left]\right|$ with the mean, standard deviation across this set of CSI amplitudes, and median absolute difference, along with maximum and minimum values across 56 carriers for each sample forming the next 5 features. The 62nd and 63rd features are measures of central tendency of the set $\left|H\right[f,n\left]\right|$, skewness and kurtosis. The final feature is entropy, calculated as $F_{64}=-{\sum }_{k=1}^{10}{P}_k{log}_2{P}_k$, where $P_k$ is the probability of a CSI amplitude in the set $\left|H\right[f,n\left]\right|$ being in any of 10 sets k which form the linear space between the minimum and maximum CSI amplitudes. These features are calculated for each training sample and the labelled dataset is used to train an SVM classifier in MATLAB. Once the classifier is trained, data can be fed into it to make real-time predictions.

4.3. Probability Mass Function of CSI Amplitude

We utilise the Probability Mass Function (PMF) to perform qualitative analysis of the CSI amplitudes, which was first adopted in [42]. It is a metric which demonstrates the distribution of CSI amplitudes for a given OFDM subcarrier, and can be expressed as:

$$F_{H[f,n]}(x;f)=\frac{\#(x_{\mathrm{low}}<|H[f,n]|\le x_{\mathrm{up}})}{N}$$

(3)

where $F_{H[f,n]}$ denotes the PMF of CSI amplitude $H[f,n]$ subcarrier f over the sampling window, with $\#(x_{low}<H[f,n]\le x_{up})$ denoting the number of CSI frames that fall within the xth amplitude bin $(x_{\mathrm{low}},x_{\mathrm{up}}]$, and N denoting the total number of CSI samples.

5. Real World Ambient Sensing

First, we perform experiments to demonstrate an ambient sensing scenario, where human occupancy will be predicted using the framework described in Section 4. This experiment will demonstrate how sensing outcomes vary with the underlying traffic type, and how multiple transmitters can be leveraged.

5.1. Experimental Setup

Without loss of generality, we perform experiments in a large amphitheatre that has the layout depicted in Figure 5.

In Figure 5, we depict the experimental environment for verifying the utility of ambient Wi-Fi sensing. In Figure 5a, we present a photograph of the amphitheatre alongside the device topology in Figure 5b. As shown in Figure 5b, the room is equipped with two CSI measurement devices (Rx 1 and Rx 2), two transmission devices (Laptop 1 and Laptop 2), an AP, and four patrons. The laptops use the Wi-Fi AP to connect to the internet, and the two CSI extractors serve the following purposes:

• CSI Extractor 1, on the lectern, only collects CSI on traffic received from Laptop 1 and Laptop 2.
• CSI Extractor 2, in the bottom right corner, collects CSI on traffic received from the Wi-Fi AP.

The CSI Extractors are configured to extract CSI from frames transmitted by specific MAC addresses; in this case, Laptop 1 and 2 for Rx 1, and the Wi-Fi AP for Rx 2. As MAC addresses are embedded within the header of each wireless packet, this allows for targeted CSI extraction from the desired devices. This CSI extraction is enabled by the Nexmon CSI tool [23], which allows us to calculate CSI on sniffed packets where we are not the intended recipient. The Nexmon tool (version $\mathrm{2.2.2}$) has further advantages over other CSI measurement software:

• It can be installed on Raspberry Pi devices, which are portable and inexpensive;
• Estimation of CSI on 56 subcarriers as opposed to the Intel5300 tool [27], which provides 30 for a 20 MHz bandwidth channel;
• Higher precision than the Intel5300 tool, with 16-bit integers to represent each of the real and imaginary components of CSI;
• Nexmon CSI allows for passive CSI extraction without the need to establish a direct Wi-Fi connection between Tx and Rx, unlike the Intel5300 tool.

Further details about the specific hardware used for experimentation are presented in

Table 1. Experimental hardware details.

Item	Manufacturer	Purpose	Specification
Raspberry Pi 4B	Raspberry Pi, Sydney, Australia	Rx1 and Rx2	Equipped with Nexmon CSI Firmware $\mathrm{2.2.2}$
Macbook Pro 13 inch 2018	Apple, Sydney, Australia	Laptop 1	Airport Wireless Card and MAC OSX
Dell XPS 15	Dell, Sydney, Australia	Laptop 2	Killer Wireless 1535 NIC
Huawei HG659 Modem	Huawei, Sydney, Australia	AP	$802.11$n compatible @ $2.4$ GHz, 3 dual band antennas with 12 dBi gain

below.

With the device setup in Figure 5, we collect data with two aims:

• To measure the counting accuracy with a single transmitter, where the single CSI stream has different underlying traffic types;
• To collect CSI from both laptops with varying network traffic. The two transmitters are pictured in Figure 5, and the traffic types utilised were Ping, Twitch, and YouTube.

We note that a factor at play here is the varying packet rates of these traffic types. Notably, as Ping is an arbitrary network traffic, compared with other ambient traffics, the Ping rate is constant at a configured level of 100 packets/second using the “Ping -i” command. Here, it is also important to note that configuring the Ping rate at 100 Hz will result in an achieved CSI rate of 200 Hz, since each Ping request entails the injection of both a request packet and an acknowledgement packet into the wireless network. Since YouTube is pre-recorded video streaming, its packets are typically transmitted in bursty batches, while Twitch would transmit at a more consistent rate as it is live video streaming. These different packet rates would be equivalent to varying the sampling rate from the sensing perspective. For each permutation of transmitters and network traffic, CSI was measured with the occupancy at zero, one, two, three, and four people. For fair comparison between the different packet streams, each experimental trial ran for 2 min with CSI being harvested from the available network traffic during that time. During these 2 min, our occupants moved around to three different locations and carried Wi-Fi-enabled smartphones as a source of interference. The occupants exhibited typical behaviour as would be seen in commercial environments; moving slowly around the room and stopping to engage in conversation with hand gestures and micro-movements such as swaying. As the amphitheatre has elevated seating, this included walking up and down stairs. Overall, these behaviours comprise a highly realistic experimental setup for which the different permutations of trials are tabulated below.

In

Table 2. Experimental samples in lecture theatre.

Laptop 1	Laptop 2	Samples
-	Ping	$\mathrm{117,065}$
-	YouTube	$\mathrm{53,292}$
-	Twitch	$\mathrm{299,002}$
Ping	Ping	$\mathrm{183,617}$
Ping	Twitch	$\mathrm{313,865}$
Ping	YouTube	$\mathrm{160,490}$
Twitch	Twitch	$\mathrm{448,911}$
Twitch	YouTube	$\mathrm{222,065}$
YouTube	YouTube	$\mathrm{67,824}$

, we present the number of CSI samples measured for each experimental trial in the lecture theatre. We observe that over the same trial duration of 2 min, the trials involving YouTube streams consistently had the least amount of samples. This is followed by Ping, which was set to a Ping rate of 100 Hz, and then Twitch with the most number of samples. This result implies that when the sampling rate is important, such as in movement detection applications, Twitch may be more favourable than YouTube. We observe some irregularity in the number of samples, such as the trial with two Twitch streams not having two times as many samples as a single Twitch stream. This is symptomatic of the problem that true ambient sensing poses, with packet rates fluctuating as a function of the content being streamed and the media quality of that content. To further visualise this, we compute the instantaneous CSI sampling rate for the first three rows and plot this over each trial duration (120 s). This is illustrated below.

In Figure 6, we illustrate the instantaneous CSI sampling rate throughout an experimental trial. The x-axis represents the time elapsed since the trial beginning (120 s in total) and the y-axis represents the instantaneous CSI measurement rate at a given time. We have provided three solid curves that represent the instantaneous CSI sampling rates for Ping traffic (black), Twitch traffic (purple) and YouTube traffic (red). Figure 6 is further overlaid with the average CSI sampling rate in dotted lines for each traffic type. We observe clearly from the dashed lines that the mean CSI rate is highest for Twitch at 520 Hz, followed by Ping at 200 Hz and then YouTube at 60 Hz. Furthermore, we observe from the drift between the solid curves and their respective dotted mean-lines that both Twitch and YouTube packet streams incur large deviations of the CSI sampling rate from the mean throughout the experimental duration. This is in contrast with Ping packet streams, which have almost no oscillations throughout the trial. In any sensor network, reliable and dense sampling is critical for robust sensing, and these preliminary results further motivate the following sections to investigate the utility of diverse packet streams for Wi-Fi sensing applications. The datasets detailed in Table 2 and subsequent sections are split $80/20\%$ for training and testing the SVM, respectively.

5.2. Occupancy Counting with Different Network Traffic

In this section, we discuss the results of human occupancy counting with different traffic types, and then with multiple transmitters.

Firstly, to qualitatively validate our use of different network traffic, we use the PMF function described in Section 4.3 to visualise the CSI amplitude distribution for an occupancy level of 2, for the different network traffic.

In Figure 7, we present the PMF spectrograms of the CSI collected with an occupancy of two people, for each of our three traffic types. The horizontal axis represents the OFDM subcarrier index, and the vertical axis represents CSI amplitude bins. The colour is then the probability, in log scale, of CSI amplitudes falling within that bin, with yellow tones indicating a higher probability as denoted by the colour scale.

We observe that the PMFs for Ping and YouTube have three distinct peaks, but the PMF for Twitch has several more local maxima. Furthermore, the PMF for YouTube is less yellow near the peaks, implying a greater concentration of CSI Amplitudes in lower bins. Overall, the contrast in these PMFs demonstrates that they may not be classified similarly by an ML framework, despite representing the same human occupancy level. To validate this, we use our experimental data to establish whether our chosen traffic types offer varying prediction accuracies in a single transmitter topology. This relates to the first three rows of trials in Table 2. We trained linear SVMs with each traffic type and then evaluated each SVM with all traffic types. The accuracies are illustrated in Figure 8 below:

In Figure 8, we present a bar plot to show the degradation in prediction accuracy when a CSI sensing system trained with CSI harvested from a particular traffic type is evaluated with another traffic type. The horizontal axis has three clusters, representing our three SVM’s trained with CSI harvested from Ping, YouTube and Twitch traffic, respectively. The blue, orange and yellow bars then represent the human occupancy counting accuracy when an SVM is tested with CSI collected from Ping, YouTube, and Twitch data, respectively.

With a single stream of data, the Wi-Fi sensing system has an accuracy exceeding $95\%$ when the network traffic used for training is the same as the network traffic for testing. This is illustrated by the largest three columns in Figure 8. Here, we make our first novel observation, that CSI collected using YouTube and Twitch packets may allow for more accurate occupancy counting than Ping packets, denoted by the dotted lines.

Remark 1.

CSI systems that solely use YouTube and Twitch packets can be more accurate in human occupancy counting than traditional Ping-based approaches.

When considering the other cases in Figure 8, where the training and testing traffic is different, there is a notable decrease in classification accuracy. For each SVM type, we find the errors incurred by testing with the different traffic types, as labelled in Figure 8. The average of error₁ and error₂ is hence considered the average accuracy error incurred by that SVM type when evaluated with an unseen traffic. The average errors for the Ping, YouTube and Twitch SVMs are thus $18.4\%$, $25.8\%$ and $22.15\%$, respectively.

Remark 2.

The degradation in performance when CSI harvested from differing IoT traffic is cross-evaluated highlights a vulnerability of existing CSI sensing literature which naively trains only with Ping packets.

Next, we performed the same classification and testing on the data collected by CSI extractor 2. This CSI extractor only collects CSI on packets transmitted by the Wi-Fi AP. These results are illustrated in Figure 9 below.

As was the case for the CSI collected from the laptops, Figure 9 shows that YouTube and Twitch packets offer superior counting accuracies than Ping traffic. Once more, the accuracies drop considerably when the training and evaluation traffic are different. Using the same method for calculating average error as before, we see a degradation of $22.45\%$, $31.4\%$, and $24.75\%$ when an SVM is evaluated with unseen data. Clearly, the degradation is larger for the data intercepted from the AP, due to a larger discrepancy between the response packets for different traffic types.

Remark 3.

In a real-world setting, it will be beneficial for the CSI extractor to intercept packets from the user devices directly, as opposed to the AP, to reduce sensing outcome degradation.

Overall, the results above show that the existing norm in the literature to train Wi-Fi sensing classifiers with CSI collected on Ping packets is inadequate, as the accuracy drops when harvesting ambient IoT traffic.

5.3. Occupancy Counting with Multiple Transmitters

Next, we attempt to perform occupancy counting using CSI harvested from multiple spatially diverse streams. The relevant data corresponds to rows 4–9 of Table 2. We consider the base scenario of an SVM trained with CSI collected from two streams of Ping data. We then examine how the accuracy changes when the aforementioned SVM is evaluated with multiple streams of data that may have different traffic types. These results are illustrated below.

As expected,

Table 3. Counting accuracy for SVM trained with multiple CSI streams.

Testing Traffic	Accuracy
Ping–Ping	$99.36\%$
Ping–YouTube	$83.12\%$
Ping–Twitch	$88.85\%$
YouTube–Twitch	$84.00\%$
YouTube–YouTube	$79.80\%$
Twitch–Twitch	$78.91\%$

shows that the SVM trained with Ping from both laptops had the highest accuracy when evaluated with Ping from both laptops, at $99\%$. This result confirms that, at least in the case of no traffic mixing, multiple spatially diverse streams of CSI can be aggregated correctly by our ML framework, and hence Wi-Fi sensing can be performed with multiple transmitters.

Remark 4.

Multiple streams of CSI from spatially diverse devices can be combined for sensing.

The accuracy then drops when the SVM is evaluated with Ping–YouTube and Ping–Twitch, to $83\%$ and $88\%$, respectively. This is in line with our result for a single transmitter, where the underlying network traffic proved critical for sensing accuracy. We note that in this case, the accuracy is lowest when the SVM is evaluated with YouTube–YouTube and Twitch–Twitch. We hypothesise that this could be for two reasons:

• When neither of the testing traffics is the training traffic, Ping, the accuracy will understandably diminish due to an inherent difference in CSI for the different traffic types.
• Diversity in the testing traffic can be exploited in the case where the traffic is unseen. For example, referring again to Table 3, the accuracy for our SVM evaluated with YouTube–Twitch is higher than the evaluation with YouTube–YouTube or Twitch–Twitch. Although both these traffics are unseen to the SVM during the training phase, testing with a combination of multiple unseen traffic performs better than testing with one specific unseen traffic.

Remark 5.

Diversity in the testing traffic is favourable to minimise accuracy degradation.

To further reiterate the research gap, we demonstrate how an SVM trained to count with a single CSI stream responds to multiple CSI streams during evaluation. We use the SVM trained in Section 5.2 with a single stream of Ping packets, and evaluate this SVM with Ping data from both laptops. This yields an accuracy of $81.98\%$, down from $96\%$ before. Clearly, a Wi-Fi sensing system trained with a single stream cannot remain as accurate when fed multiple streams of CSI.

Remark 6.

Wi-Fi sensing systems trained for a single input stream will be severely degraded when evaluated with multiple streams.

6. Effects of Upload and Download Payloads on Sensing Outcomes

A key result from Section 5 was that CSI harvested from the AP offered poorer sensing performance. This can be understood using Figure 10. When a Laptop or user device wants to download a YouTube video, it sends a request packet (red) to the Access Point, which is then propagated to the YouTube Server. Crucially, this request packet does not contain any video data, but the response packet (green) does contain data pertaining to the media type being streamed. Hence, we anticipate that CSI collected using broadcasts from the AP will have a larger variation for different traffic types, as compared to CSI collected using broadcasts from the laptops or end user devices.

In this section, we perform a second experiment, this time investigating the optimal device topology for sensing outcomes. In a real-world scenario, the CSI extractor will have the choice to use Wi-Fi packet streams from diverse IoT devices in the area. These devices could be uploading or downloading data, or they could be propagating either request or service packets.

6.1. Experimental Setup

Once more, we performed human occupancy counting with various permutations of IoT traffic and used sensing accuracy as our performance metric. The experiment was conducted in a small office where occupancy might realistically be monitored and Wi-Fi devices are usually present.

In Figure 11, we illustrate the experimental setup for our device topology experiment. The room has dimensions 7 m by 4 m, and is equipped with standard office furniture such as desks and chairs. We place a Wi-Fi AP next to a laptop, such that their antennas are precisely co-located. These devices are denoted in a circular bubble in Figure 11. The computer is connected to the internet via a Wireless Local Area Network (WLAN) facilitated by the Wi-Fi AP. As these devices communicate, their Wi-Fi packets propagate to the CSI extractor (right) which subsequently estimates independent CSI samples using these independent streams. Since the Wi-Fi AP and laptop are located exactly in the same position, the packet streams that propagate to the CSI Extractor are assumed to have the same multipath characteristics. This allows us to compare the CSI collected from the AP with that from the laptop purely on the basis of their origin, without the channel as a variable. We collect CSI in this manner with the Computer downloading a YouTube video, then a Twitch stream, and then receiving Ping packets. Then, we collect CSI with the computer uploading a YouTube video, uploading a stream to Twitch, and broadcasting Ping packets. This was repeated for occupancy levels ranging from 0 to 3. As before, the occupants were encouraged to move around and occupy different positions in the room to diversify the dataset, and they engaged in typical conversation with associated hand gestures and micro-movements of the body. When trained and evaluated using CSI from the same underlying network traffic, each individual dataset (12 total) achieved occupancy counting accuracies exceeding $95\%$. This is in line with the occupancy counting results in previous sections. In the following subsections, we will cross-evaluate these datasets to further examine how SVMs trained with a single type of traffic perform when evaluated with new traffic. The experimental hardware is summarised in

Table 4. Experimental hardware details.

Item	Manufacturer	Purpose	Specification
Raspberry Pi 4B	Raspberry Pi, Sydney, Australia	Rx	Equipped with Nexmon CSI Firmware $\mathrm{2.2.2}$
HP Z8 G4 Workstation	Hewlett Packard, Sydney, Australia	Computer	Netgear A6100 Wi-Fi Adapter
Huawei HG659 Modem	Huawei, Sydney, Australia	AP	802.11n Compatible @ 2.4 GHz and 5 GHz, 3 dual band antennas with 2 dBi gain

below:

6.2. Request vs. Service

In the first case, we consider a CSI sensing system that leverages traffic from the computer. The computer could be uploading or downloading media, and the packets it permeates for each scenario are intercepted by the CSI extractor for subsequent channel estimation. We first compare how, for three different traffic types, the occupancy counting systems trained with download traffic perform when evaluated with upload traffic (and vice versa). It is important to distinguish here that the download traffic that we collect emanating from the workstation does not contain any payload data. Rather, these packets are actually control messages (such as TCP Acknowledgements) that the computer uses to tell the server it has successfully received a payload segment. The accuracies when cross-evaluating CSI streams are tabulated below.

In

Table 5. Request vs. service.

SVM Training Traffic	SVM Evaluation Traffic	Accuracy
YouTube Upload	YouTube Request	$87.57\%$
YouTube Request	YouTube Upload	$98.52\%$
Twitch Upload	Twitch Request	$68.40\%$
Twitch Request	Twitch Upload	$91.98\%$
Ping Send	Ping Response	$99.62\%$
Ping Response	Ping Send	$98.96\%$

, we present the accuracies that our SVMs trained with a single traffic stream from the workstation achieved when evaluated with the opposite corresponding request packet. We first observe that the highest accuracies were achieved by the Ping SVMs when evaluated against each other. This result is indicative of the similarity between outgoing and incoming Ping packets. We next note that the second highest accuracy is achieved by the YouTube SVMs, which indicates that CSI harvested from YouTube upload payload packets are not too dissimilar from control packets. Finally, we note that the Twitch SVM performed most poorly, with the upload SVM only achieving $68.40\%$ accuracy when evaluated with CSI collected from Twitch download request packets. Overall, these results show that even for the same traffic type, request and payload (service) packets differ enough to make them largely incompatible in CSI sensing systems. This supports the result from Section 5. One interesting result here is that in all cases, the download (request) packets offered better robustness when evaluated with payload data in all cases.

Remark 7.

Download (request) packets offer superior robustness for CSI-based occupancy counting.

This further supports the result in Section 5 that CSI sensing systems should leverage request packets from end-user devices performing downloads. To complete our investigation of the robustness of these packets, we further cross-evaluate the CSI streams, this time comparing different traffic types.

In Figure 12, we present the occupancy counting accuracies of our CSI sensing systems trained and evaluated with different traffic. There are six rows corresponding to the six types of training traffic, and then each row has six columns corresponding to the six types of testing traffic. Each entry is then the accuracy (0–100%) achieved when an SVM created with the training traffic is evaluated with the testing traffic. More green colours distinguish a higher achieved accuracy, and red represents lower accuracies. We firstly note that the upload SVMs achieved an average accuracy of $84.14\%$ when evaluated with other upload traffic, and an accuracy of $87.66\%$ for the response/request packets. This behaviour was mirrored by the SVMs trained with response traffic, which also performed better when evaluated with other response traffic ($95.03\%$) compared with upload traffic ($93.5\%$). Overall, this conclusively shows that it is favourable to evaluate any CSI sensing system with dataless control packets, such as Ping response or YouTube/Twitch request packets.

Remark 8.

Ambient Wi-Fi sensing systems should harvest CSI from control packets since these packets do not contain data and hence they can be interfaced more robustly.

Furthermore, the results show that the service traffic-based SVM’s for YouTube, Twitch and Ping received overall accuracies of $92.9\%$, $75.9\%$, and $88.9\%$, respectively. This is lower than the overall accuracy of the request-based SVM’s, which achieved $93.74\%$, $95.9\%$, and $93.09\%$ accuracy for YouTube, Twitch and Ping, respectively. When averaging across our traffic types, we arrive at an overall accuracy of $85.9\%$ for service packet-based SVM’s and $94.265\%$ for request packet-based SVM’s. This result clearly demonstrates that it is preferable to train an SVM with CSI collected from control (request) packets.

6.3. Uplink vs. Downlink

In the previous section, we compared the utility of service packets (YouTube upload data) with request packets. Now, we will compare CSI sensing systems, which are trained using upload and download traffic for different media types.

As mentioned in the Experimental Setup, our Wi-Fi AP and laptop are co-located and the CSI extractor collects packets from both. Given that their antennas are at the same point, the channel is considered to be a controlled variable. When the laptop is uploading data, the upload payload packet can be collected by listening to the CSI stream directly from the laptop. When the laptop is downloading data, the download payload packet can be collected by listening instead to the CSI stream from the Wi-Fi AP. This can be understood using Figure 10. We first present PMF plots of the CSI captured with our upload and download payload packets, for each traffic type. These PMFs are presented for two occupancy levels: two person occupancy and three person occupancy.

We observe in the series of PMFs in Figure 13 and Figure 14 above that there is a larger discrepancy in the CSI between occupancy levels for the upload traffic. This larger discrepancy in CSI would allow for more accurate separation by our classifier. This corroborates the result from Figure 12, in which we observed that the occupancy counting SVMs trained with CSI harvested from upload traffic always had higher accuracies. Each of these CSI streams is used to train individual SVMs for human occupancy counting, and then each SVM is evaluated with the converse payload stream. These results are tabulated below.

In

Table 6. Upload vs. download.

SVM Training Traffic	SVM Evaluation Traffic	Accuracy
YouTube Upload Payload	YouTube Download Payload	$73.38\%$
YouTube Download Payload	YouTube Upload Payload	$77.14\%$
Twitch Upload Payload	Twitch Download Payload	$65.79\%$
Twitch Download Payload	Twitch Upload Payload	$79.52\%$

, we observe that CSI measured using payloads of the same media type are not compatible, seeing as the occupancy counting accuracy drops well below the $80\%$. Critically, we make a novel observation that in all cases, the SVM’s trained with download traffic are more robust, maintaining higher accuracy than the SVM’s trained with upload traffic. This result shows that not only does the traffic type matter, but CSI sensing systems are sensitive to whether the packets contain upstream or downstream data. This can once more be understood by referring to Figure 10, which demonstrates the inherent reliance of measured CSI on packet contents and processing within the NIC.

Remark 9.

When traffic containing payload data must be used for CSI estimation, it is preferable to use downstream traffic as it is more robust to variations in the media type.

7. Concluding Remarks

This paper aims to motivate the progression of Wi-Fi sensing towards the use of CSI harvested from ambient traffic. This is motivated within the context of covertness and energy efficiency, as we empirically demonstrate the significant power requirements of dedicated Wi-Fi sensing transmitters. We subsequently demonstrate that the existing approach in the literature using Ping packets for harvesting CSI is not robust in an ambient sensing deployment. We experimentally demonstrate that such systems do not maintain their accuracy when encountering unseen traffic types, such as Twitch or YouTube. We further show that this degradation in performance is worse when a CSI sensing system intercepts packets from an AP instead of end user devices since network payload packets differ more in their contents. This paper demonstrates that two spatially diverse streams of CSI can be used to effectively profile a channel, allowing use in public spaces where multiple user devices could be leveraged. We highlight a challenge in this endeavour, showing that CSI sensing systems trained with a single stream of CSI cannot accurately evaluate multiple streams. Finally, this paper showed the influence of packet direction on sensing outcomes. The key observations from this paper are summarised in

Table 7. Summary of experimental findings.

Independent Variable	Outcome
Network Traffic	Different traffics could be used to sense with similar accuracies, but we observed a degradation in sensing accuracy when packets were cross validated.
Number of Devices	CSI from two devices could be combined to train an SVM which counts the occupancy level. We showed that the accuracy goes down when the evaluation streams vary from the training streams. In the case where both streams are unknown traffic types, diversity lead to better accuracy.
Packet Type	Payload and control packets from AP’s and end-user devices were compared, and the control packets offered better sensing in an ambient setting with diverse traffic types.
Traffic Direction	Sensing was performed using CSI estimated from download and upload packets, respectively, and it was shown that upload traffic achieved better accuracy, which was demonstrable in the larger interclass discrepancy of their PMF plots.

below.

We identify that another significant challenge to energy efficient ambient Wi-Fi sensing is the movement of transmission devices, since this would change the baseline signal power and incur Doppler artefacts within the measured CSI. We suggest that future work should investigate the efficacy of Wi-Fi sensing systems that uses such traffic from mobile devices.