💻 computer science

RogueRover: Autonomous Rogue Device Localization for Incident Response

RogueRover is an infrastructure-free system that enables a quadruped robot to autonomously detect and physically localize unauthorized wireless devices with high accuracy using only standard 802.11 RSSI measurements and zero prior site calibration, thereby overcoming critical bottlenecks in cyber-physical incident response.

Original authors: Priyanka Prakash Surve, Asaf Shabtai, Yuval Elovici

Published 2026-06-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Priyanka Prakash Surve, Asaf Shabtai, Yuval Elovici

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a large, busy office building where the security team knows that a "spy" has set up a secret, unauthorized Wi-Fi hotspot somewhere inside. They know the spy is there because their network software flagged a strange signal, but they have no idea where the spy is hiding.

Usually, finding this spy requires a team of experts with expensive, specialized equipment to map out every inch of the building's radio waves, or they have to send a human guard to walk around with a signal detector until they find it. Both methods are slow, expensive, or require the building to be pre-scanned and calibrated.

Enter "RogueRover."

The researchers at Ben Gurion University built a system that uses a single, off-the-shelf robot dog (a quadruped) to solve this problem. Here is how it works, broken down into simple concepts:

1. The Robot is the "Sniffer Dog"

Think of the robot not as a high-tech spy, but as a very disciplined dog on a leash.

The Map: The security team gives the robot a digital map of the building (like a floor plan).
The Patrol: The robot walks a pre-planned route, stopping at 39 specific spots (waypoints) along the way.
The Sniff: At each stop, the robot pauses for 10 seconds. It doesn't need special sensors; it just uses a standard Wi-Fi card (like the one in your laptop) to "sniff" for all the Wi-Fi signals in the air. It records the strength of the signal and its exact location.

2. The "No-Map" Challenge

The trickiest part of this paper is that the robot has zero prior knowledge.

It doesn't know how strong the spy's signal is.
It doesn't know if walls block the signal.
It doesn't have a pre-made map of where signals usually go.

Usually, to find a signal source without this info, you'd need complex math that often fails. The researchers tested this by setting up 6 fake "rogue" devices (like phones acting as hotspots) in different parts of the building: in open hallways, behind glass walls, and inside drywall rooms.

3. The "Flashlight" Analogy for Finding the Spot

Once the robot finishes its patrol, the data is sent to a computer for analysis. The computer tries to guess where the rogue device is based on the signal strength readings.

The paper found that the most effective method was surprisingly simple, like using a weighted average:

Imagine the robot is holding a flashlight. The closer it gets to the rogue device, the brighter the light (stronger signal).
The computer looks at all the spots where the robot stopped. It ignores the spots where the signal was very weak (too far away).
It then calculates the "center of gravity" of the strong signals. If the robot got a very strong signal at three spots near the north wall, the computer guesses the device is right in the middle of those three spots.

4. The Results: How Good Was It?

The researchers ran this experiment 11 times. Here is what they found:

One Patrol is Enough: After just one 20-minute walk around the building, the system could pinpoint the rogue device to within 1.62 meters (about 5 feet) on average.
Room-Level Accuracy: This level of accuracy is usually enough to tell security guards, "Go check the room on the second floor, near the breakroom," rather than having them search the whole building.
Better with More Data: If the robot walked the route a few more times, the accuracy improved, getting within 1 meter for most devices.
The "Blind" Test: In a final test, they moved the devices to new, secret locations the robot had never seen before. The system still found them correctly, with errors as low as 0.34 meters (about 1 foot).

5. The Big Takeaway

The most surprising discovery in the paper wasn't about complex math. The researchers found that the robot's path mattered more than the algorithm.

Think of it like trying to find a lost key in a dark room.

Complex Math: Using a fancy calculator to guess where the key is based on a few clues.
Good Patrol: Walking around the room and shining a light in every corner.

The paper shows that if the robot walks a good route that surrounds the hidden device from different angles, even a simple math method works great. If the robot only walks past the device from one side, even the smartest math struggles.

Summary

RogueRover proves that you don't need expensive, pre-installed sensors or a team of engineers to find a rogue Wi-Fi device. You just need a standard robot dog, a map of the building, and a simple strategy: walk around, sniff the air, and let the pattern of signal strengths tell you where the intruder is hiding. This bridges the gap between "knowing there is a problem" and "physically finding and removing the problem."

Technical Summary: RogueRover

Problem Statement

In cyber-physical systems (CPS), unauthorized wireless devices, such as rogue access points (RAPs), pose a significant security risk by enabling covert network access and lateral movement. While network-side mechanisms (e.g., whitelist comparisons) can detect the presence of these devices, a critical bottleneck remains in physically localizing them for incident response. Existing solutions face distinct limitations:

Static WIDS/WIPS: Require dense, pre-installed sensing infrastructure, often leaving coverage gaps.
Fingerprinting: Achieves high accuracy but demands site-specific calibration and maintenance, which is infeasible during rapid incident response.
CSI-based Techniques: Offer sub-meter accuracy but rely on specialized hardware and modified firmware.
Multi-robot Swarms: Improve coverage but introduce high coordination complexity.

The paper addresses the challenge of localizing unknown rogue devices in a dynamic environment without prior RF knowledge, pre-installed sensors, site calibration, or specialized hardware.

Methodology: RogueRover System

RogueRover is an end-to-end system designed to autonomously detect and localize rogue wireless devices using a single commodity quadruped robot. The system operates under a zero-configuration constraint, meaning it requires no prior RF fingerprinting or environmental calibration.

1. System Architecture

Platform: A Unitree Go2 quadruped robot equipped with ROS2 Foxy, LiDAR-based navigation, and dual 802.11n interfaces (one for passive scanning, one for robot communication).
Operational Protocol (Stop-and-Scan): The robot follows a pre-defined path of waypoints derived from an occupancy grid map. At each waypoint, the robot halts for a 10-second dwell period to perform a passive 802.11 beacon scan.
Data Collection: The system logs spatially labeled Received Signal Strength Indicator (RSSI) measurements $(x_i, y_i, r_i)$ for each detected BSSID, where $(x_i, y_i)$ is the robot's position and $r_i$ is the RSSI in dBm.

2. Detection Pipeline

To identify rogue devices without training, the system employs a lightweight heuristic scoring mechanism based on three signals:

Locally Administered MAC Address: A score increase if the IEEE locally administered bit is set (common in consumer hotspots).
SSID Patterns: Positive scores for mobile hotspot patterns (e.g., "Galaxy_*") and negative scores for known whitelisted infrastructure names.
Vendor Lookup: Negative scores for manufacturers associated with managed infrastructure.
Devices with a score $\ge 0.5$ are flagged as candidates, provided they are observed at at least $k_{min}=3$ distinct waypoints to ensure spatial diversity.

3. Localization Algorithms

The system estimates the rogue AP position $(\hat{x}, \hat{y})$ offline using only the collected RSSI data. The paper evaluates three centroid-based approaches against a parametric baseline, all under zero-prior constraints:

Weighted Centroid (WCL): Estimates position as the power-weighted average of waypoint positions ( $w_i = 10^{r_i/10}$ ).
Exponentially Weighted Centroid (ExpWCL): Uses exponential weights ( $w_i = e^{\beta r_i}$ ) to emphasize high-RSSI measurements, increasing the influence of points near the emitter.
Ensemble Method: Combines estimates from WCL, ExpWCL, and a parametric baseline. If estimates are consistent (within 5m), they are averaged; otherwise, the geometric median is used.
Parametric Baseline (LS+Huber): A log-distance path-loss model that jointly estimates transmit power, path-loss exponent, and position using Huber-loss minimization. This serves as a comparison to determine if model complexity aids accuracy without calibration.

Key Contributions

Infrastructure-Free Localization: The presentation of an autonomous system capable of localizing rogue devices without RF fingerprinting, pre-installed sensors, or site calibration.
Zero-Configuration Feasibility: Demonstration that a single commodity robot can achieve practical localization accuracy (median error of 1.62 m) during a single patrol without prior RF knowledge.
Bridging Detection and Remediation: A workflow that closes the gap between network-level detection and physical incident response, enabling rapid physical investigation.

Experimental Results

The system was evaluated in an 800 $m^2$ indoor office environment over 11 patrol runs with 6 deployed rogue APs (smartphones and laptops acting as hotspots) across open, drywall-enclosed, and glass-partitioned areas.

Single-Patrol Performance: Across 62 AP-patrol sessions, ExpWCL achieved a median localization error of 1.62 m, with 32.3% of estimates falling within 1 m.
- Centroid vs. Parametric: Simple centroid estimators (WCL, ExpWCL) significantly outperformed the parametric LS+Huber baseline (median error 3.41 m) under zero-prior conditions. This indicates that without calibration, parametric models introduce variance due to the ill-conditioned nature of joint parameter estimation.
- Estimator Sensitivity: The difference between the best centroid method (ExpWCL) and the zero-parameter baseline (WCL) was only 0.33 m, suggesting estimator complexity is a secondary factor compared to measurement geometry.
Multi-Patrol Aggregation: When aggregating data from multiple patrols, five of the six devices were localized within 1 m.
Blind Validation: In a blind trial with two previously unseen devices, the system correctly identified them among 73 observed BSSIDs and localized them with errors of 0.34 m and 1.84 m.
Geometric Determinants: Accuracy was primarily driven by spatial measurement coverage. Devices surrounded by waypoints from multiple directions achieved sub-meter accuracy, while those observed primarily from one direction (e.g., near the patrol periphery) exhibited higher errors.

Significance and Claims

The paper claims that infrastructure-free, autonomous localization is feasible in practice for incident response. The primary significance lies in demonstrating that:

Spatial Coverage is Paramount: Under zero-prior constraints, the quality of localization is determined more by the spatial diversity of the patrol route than by the sophistication of the localization algorithm.
Operational Viability: A simple, single-robot patrol can provide sufficient accuracy (median ~1.6 m) to guide security teams to the correct room or corridor segment for physical remediation, eliminating the need for dense static sensor networks or time-consuming calibration.
Robustness: Lightweight centroid-based methods provide more stable and reliable solutions than complex parametric models when no prior propagation data is available.

The authors conclude that RogueRover effectively bridges the gap between detection and physical remediation, offering a practical tool for rapid incident response in cyber-physical environments where additional sensing infrastructure is unavailable.