Active Injection vs Passive Sniffing

Motivation

The deployable, privacy-friendly stance for the lab's crowd-sensing thesis is passive: sniff packets that phones and laptops already send, instrument nobody. But passive capture inherits the arrival statistics of real traffic — bursty, on-off, with long idle gaps — not the steady metronome of active injection. Every Doppler/STFT feature in WS501 (Weeks 5, 7) silently assumes uniform sampling. EXP-007 Packet-Rate Floor for Motion Sensing establishes the floor on mean rate; this experiment asks whether mean rate is sufficient at all once arrivals are uneven.

The hypothesis matters because it changes what the lab must report and engineer. If a bursty 200 Hz-mean passive trace carries the same motion information as a steady 200 Hz active trace, then mean rate is the spec and passive deployment is viable wherever traffic is dense enough. If burstiness destroys the feature at matched mean rate, then either (a) passive sensing needs traffic-shaping / active probe injection to regularise arrivals, or (b) features must be redesigned for non-uniform sampling (e.g. Lomb–Scargle / NUFFT instead of STFT). Either way the thesis must commit to a position, and currently has no evidence.

sharma2024_c8a2 ↗ argues for riding ambient traffic but does not quantify the burstiness penalty; guarino2026_e72c ↗ notes capture conditions are under-reported. No vault campaign varies arrival regularity at fixed mean rate.

Setup

Simulator

• Reuse the single high-rate master CSI run from EXP-007 (coupled walk → ray-traced CSI, IP-110 Doppler-CFR). Resampling one physically-consistent run onto different arrival processes isolates arrival regularity as the only varied factor.

Independent variable — arrival process at a fixed mean rate R

For each mean rate R ∈ {500, 200, 100} Hz, resample the master run onto:

• Active (uniform): evenly spaced timestamps at rate R (the control).
• Passive-Poisson: arrivals from a Poisson process of rate R (memoryless burstiness).
• Passive-onoff: an on-off (bursty) traffic model — dense bursts of packets separated by idle gaps — with the same long-run mean R, sweeping the burstiness (e.g. Fano factor / idle-fraction) from mild to severe.

Controlled / fixed

• Scene, walk paths, carrier, motion ground truth — all identical to the EXP-007 master run.
• Feature pipeline held fixed across arrival processes (same STFT window, same detector).

Procedure

1. Resample the master CSI onto each (R, arrival-process) timestamp set. For STFT, place samples on their true (non-uniform) times; do not silently snap to a uniform grid (snapping is itself one of the W3 §4 gotchas — test it as a fourth condition).
2. Per (R, arrival-process):
   • Compute the Doppler spectrum and measure the feature SNR — motion-band energy vs leakage floor.
   • Compute the same fixed motion-detection metric (AUC/F1) used in EXP-007.
3. Sweep burstiness within the on-off model to find where the feature degrades.
4. Probe two mitigations (only if degradation is found): (a) a non-uniform spectral estimator (Lomb–Scargle / NUFFT) on the bursty arrivals; (b) light active-probe injection to fill idle gaps. Report whether either recovers the active-capture feature SNR.

Expected Outputs

• dataset/exp008/arrival_traces/ — the active / Poisson / on-off timestamp sets per R
• dataset/exp008/feature_snr.csv — Doppler feature SNR + detection metric per (R, arrival-process, burstiness)
• dataset/exp008/doppler/ — spectra showing leakage under bursty arrivals vs clean active
• Figure: feature SNR vs burstiness at matched mean rate (the headline — does uniform beat bursty at equal mean?)
• Figure: mitigation comparison (STFT-on-bursty vs NUFFT-on-bursty vs active control)

Analysis Plan

Primary

1. Matched-mean comparison: at equal mean R, is active feature-SNR significantly higher than passive-onoff? Report effect size and a paired test across scenes/seeds.
2. Burstiness threshold: the burstiness level (idle fraction / Fano factor) at which the passive feature SNR falls below a usable threshold — the practical "is this network dense enough?" line.
3. Mitigation verdict: does a non-uniform-aware estimator close the gap, or is active probing required?

Guardrails (per the campaign-rigor audit)

• Simulator-internal sampling study — the mechanism (leakage from non-uniform sampling) is geometry-agnostic; state that the magnitude needs the real-hardware check.
• Keep the detector fixed and dumb so the result is about data information content, not model tuning.
• Real-hardware follow-on: AX210 active injection vs monitor-mode sniff of genuine ambient traffic in the FIIT meeting room — the external validity check. Flag as required before any thesis claim.
• Beware the known doppler frame//n_sub alignment gotcha when reconstructing spectra from resampled CSI (seen in the c-csi-ble-fusion work); validate frame indexing before trusting the SNR numbers.

Success Criteria

• Active vs Poisson vs on-off compared at ≥2 matched mean rates on physically-consistent resampled runs
• Burstiness swept to locate the feature-degradation threshold
• Matched-mean active-vs-bursty difference reported with effect size + significance
• At least one mitigation (NUFFT or active-probe) evaluated against the active control
• A clear verdict on whether mean PRR is a sufficient capture spec for passive sensing

Related Work in Vault

• sharma2024_c8a2 ↗ — the ambient-traffic passive stance whose burstiness this quantifies
• guarino2026_e72c ↗ — under-reported capture conditions
• wu2022_75d3 ↗ — the Doppler/CSI-ratio feature pipeline that assumes regular sampling
• zheng2019_5389 ↗ — Widar3.0's DFS/BVP features computed under steady active capture

Dependencies

• The EXP-007 master CSI run (shared) — run EXP-007 first or in the same campaign
• IP-110 Doppler-CFR sionna-csi-runner, runnable locally
• (Follow-on) Intel AX210 for the active-injection vs passive-sniff hardware check

Notes

EXP-007 and EXP-008 are a pair: EXP-007 fixes the floor on mean rate; EXP-008 asks whether mean rate is the right axis once arrivals are bursty. Together they turn WS501 Week 3's two collection-stance claims into measured design rules, and they directly inform whether the thesis's passive crowd-sensing target is viable as-is or needs traffic-shaping / non-uniform-aware features. Both are sampling-mechanism studies first, with real-hardware checks flagged as the external validity gate.