单个机器人无需预设即可自动定位非法无线设备,实现快速安全响应。
RogueRover: Autonomous Rogue Device Localization for Incident Response

- 用四足机器人自主巡检,通过标准802.11接口采集带位置标签的信号强度数据。
- 单次巡检定位误差中位数仅1.62米,多轮聚合后五台设备定位精度达1米内。
- 无需射频指纹或校准,适合无基础设施部署场景下的应急响应。
物理定位未经授权的无线设备仍是网络物理安全运营中的关键瓶颈,因非法接入点可能成为横向移动和持久渗透的入口。尽管可通过网络机制检测到此类设备,但确定其物理位置通常需密集传感设施、特定场地的射频指纹或人工排查,限制了及时响应。本文研究单个商用机器人是否能在零配置条件下,无需射频指纹、预先安装传感器或场地校准,自主探测并定位非法无线设备。我们提出RogueRover系统:四足机器人自主巡逻,通过标准802.11接口采集空间标注的RSSI数据,并离线估计设备位置。在真实室内环境进行11次巡检,部署6个不同传播条件的非法设备,共62次接入点-巡检会话中,系统单次巡检定位误差中位数为1.62米,无需先验射频知识。多轮数据聚合后,六台设备中有五台定位误差小于1米。盲测验证完整流程,成功从73个观测到的BSSIDs中识别出非法设备,并实现0.34米与1.84米的定位误差。跨环境对比表明,在零先验约束下,简单加权质心估计算法性能不亚于甚至优于参数化路径损耗模型,说明自主巡检带来的测量覆盖是定位精度的关键决定因素。结果证明,无需基础设施的自主定位在实践中可行,可在不增加传感部署的前提下实现快速物理事件响应。
原文摘要 · Abstract (English)
Physically localizing unauthorized wireless devices remains a critical bottleneck in cyber-physical security operations, where rogue access points can provide entry points for lateral movement and persistent compromise. While such devices can often be detected through network-side mechanisms, determining their physical location typically requires dense sensing infrastructure, site-specific RF fingerprinting, or manual inspection, limiting timely incident response. We investigate whether a single commodity robot can autonomously detect and localize rogue wireless devices under zero-configuration constraints, without RF fingerprinting, pre-installed sensors, or site calibration. We present RogueRover, an end-to-end system in which a quadruped robot autonomously patrols, collects spatially labeled RSSI measurements via a standard 802.11 interface, and estimates device locations offline. We evaluate the system across 11 patrol runs in a real indoor environment, with 6 rogue devices deployed under heterogeneous propagation conditions. Across 62 AP-patrol sessions, RogueRover achieves a median single-patrol localization error of 1.62 m without prior RF knowledge. Under multi-run aggregation, five of six devices are localized within 1 m. A blind trial validates the full pipeline, correctly identifying rogue devices among 73 observed BSSIDs and localizing them with errors of 0.34 m and 1.84 m. Across environments, simple weighted-centroid estimators perform comparably to, or better than, parametric path-loss models, indicating that measurement coverage from autonomous patrols is the primary determinant of localization accuracy under zero-prior constraints. Our results demonstrate that infrastructure-free, autonomous localization is feasible in practice, enabling rapid physical incident response in cyber-physical environments without additional sensing infrastructure.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。