Reference-Free Amplitude-Based WiFi Passive Sensing

The parasitic exploitation of WiFi signals for passive sensing purposes is a topic that is attracting considerable interest in the scientific community. In an attempt at meeting the requirements for sensor compactness, easy deployment, and low cost, we resort to a noncoherent signal processing scheme that does not rely on the availability of a reference signal and relaxes the constraints on the sensor hardware implementation. Specifically, with the proposed strategy, the presence of a moving target echo is determined by detecting the amplitude modulation that it produces on the direct signal transmitted from the WiFi access point. We investigate the target discrimination capability of the resulting sensor against the competing interference background and we theoretically characterize the impact of undesired amplitude fluctuations in the received signal that are determined by causes other than the superposition of the target echo, thereby including the waveform properties. Hence, we propose different solutions to address the limitations identified, characterized by different complexities, and we investigate their advantages and drawbacks. The conceived signal processing schemes are thoroughly validated on both simulated and experimental data, collected in different operational scenarios.


I. INTRODUCTION
In recent years, the steady proliferation of wireless devices has ensured that access points (APs) based on WiFi standards are now available in almost all private and public environments.This has motivated the development of strategies and solutions that enable the parasitic exploitation of these signals for short-range sensing purposes in both indoor and outdoor areas, see e.g., [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], and the references therein.The implementation of radio frequency (RF) based sensing solutions for public or private areas is very appealing since they are not affected by lighting conditions and they alleviate many privacy concerns and discomfort issues that cameras might cause.Specifically, RF radar sensors do not require any cooperation from the target, such as carrying a wearable device.Finally, the parasitic exploitation of the existing RF sources provides additional benefits in terms of energy consumption and potential interference with preexisting RF systems operating in the same area.For all these advantages, nowadays, the field of application of passive WiFi sensing solutions ranges from occupancy estimation, detection and localization of humans or small unmanned aerial vehicles (UAVs) [1], [2], [3], [4], [5], [6], [7], to the e-healthcare applications, such as human gait recognition or breath detection [8], [9], [10], [11], [12].
However, most of the techniques proposed in the technical literature set strict requirements on the implementation of the WiFi sensor.As an example, approaches that rely on channel state information extraction [4], [8], [9], [10], [11], [12] require a perfect knowledge of the adopted WiFi Standards and are limited to operation with orthogonal frequency-division multiplexing (OFDM) signals.Moreover, they require the accurate synchronization in time, frequency, and phase.On the other hand, WiFi sensors based on passive radar (PR) approaches [1], [2], [3], [5], [6], [7], [14] can, in principle, be operated with any waveform modulation and have the potential to increase the sensitivity of the sensor.However, they are typically limited by the high computational complexity and the requirement for a reference signal.The former issue has been addressed in recent works [14], [15], [16] that have focused on the simplification of the PR processing chain with the purpose of streamlining the processing architecture and reducing the computational load.Still, the sensor requires a good copy of the transmitted signal to be available at the receiver since it not only provides a reference in the processing chain (e.g., for matched filtering) but also it inherently offers the required synchronization in time, frequency, and phase.The requirement for a good reference signal can be accomplished according to different strategies.
1) If the AP is accessible, the reference signal can be directly extracted by means of a wired link.This makes available a very good copy of the transmitted signal but requires a dedicated receiving channel and additional infrastructure.
2) The reference signal can be obtained using a dedicated antenna steered toward the AP.This strategy also requires a dedicated receiving channel but exploits a wireless link between the AP and the receiver that simplifies the implementation.However, the collected signal could be affected by multipath.
3) The reference signal can be obtained by demodulating and remodulating the received signal packet.This strategy requires only one receiving channel but it needs knowledge of the employed IEEE 802.11Standard, it requires additional processing efforts, and it might be subject to reconstruction errors.4) An alternative approach is to limit the signal processing to a priori known portions of the physical layer protocol data unit (PPDU), e.g., the PHY Preamble, without requiring any dedicated receiving channel or reconstruction.However, using limited portions of the available signals implies signal-to-noise ratio (SNR) loss.Moreover, using a synthetic reference signal does not guarantee synchronization in time, frequency, and phase with the main echo signal and ad hoc approaches must be implemented to restore the coherency [17].
The aforementioned solutions do not take into account key aspects required to facilitate the widespread use of WiFi-based sensors, such as low cost and low computational complexity, compactness and lightness, as well as the easy deployment and setup.
In this article, we take this perspective with the aim of enabling a WiFi sensing application that employs a simple, standalone, and low-cost sensor that could be implemented with commercial off-the-shelf hardware components and uses a WiFi passive sensing strategy whose aim is to detect targets without any attempt at isolating or regenerating the reference signal.In order to meet these requirements, we aim to detect the presence of a moving target in the scene by observing the amplitude modulation that it induces on the main source signal.This principle of operation exploits the interference amplitude pattern between the signal transmitted by the AP and multiple reflections from the environment.The analysis of the target-induced amplitude modulation not only provides information about its presence but also allows the extraction of its Doppler signature across time.Therefore, in the following, we will refer to this approach as interference Doppler processing (IDP).Compared with the PR approach, this can be inherently considered as a reference-free approach since it does not require the knowledge of the signal transmitted by the AP.
Amplitude-based approaches have been widely investigated in the technical literature.For instance, a similar concept is employed for noncoherent radar but it has also been applied to forward scatter radar (FSR) [18], [19], [20], [21], [22], [23], [24], [25], [26], [27], [28].Moreover, typical amplitude-based strategies used in WiFi sensing are based on the received signal strength indication extraction [29], [30].Thus, it should be noted that although this work may have commonalities with several approaches considered in the general field of sensing, it represents an advancement with respect to each of these.The specific innovative aspects are better clarified in the following.
The purpose of this work is twofold.First, we aim to adopt the considered principle of operation and investigate the proposed strategy for the application in hand.This latter point also includes identification and theoretical characterization of the main limitations of this approach inherently caused by the characteristics of the WiFi signals.It is well known, in fact, that the more the direct signal is constant over time, the higher is the ability of the proposed strategy to discriminate the presence of a target against a competing background based on the amplitude modulation only.This problem has been studied in [28] with reference to a digital video broadcasting-terrestrial (DVB-T)-based passive FSR application; therefore, we follow a similar procedure as the one used therein; however, we extend the discussion in order to include real-world aspects that are specific to the application in hand, thereby including the peculiar characteristics of the adopted waveforms of opportunity.This provides a broader discussion and a result that allows the accurate prediction of the achievable performance for the proposed WiFi sensor.
On the other hand, we propose possible solutions to the main identified limitations and, for each, we investigate advantages and drawbacks both in terms of performance and in terms of complexity.All strategies are tested and thoroughly validated on both simulated and experimental data.To this purpose, ad hoc acquisition campaigns have been conducted by means of an experimental WiFi receiver developed at Sapienza University of Rome using different cooperative targets in order to mimic different application scenarios.
The rest of this article is organized as follows.Section II introduces the signal model and the proposed IDP scheme.In Section III, we theoretically characterize the interference background level against which the target discrimination competes and we confirm the validity of the theoretical findings by application to both simulated and real-world WiFi data.In Section IV, we propose different solutions to the problems identified, being the discussion supported by simulated analyses, while Section V is devoted to a thorough experimental validation in real scenarios.Finally, Section VI concludes this article.

A. Signal Model
The considered scenario is depicted in Fig. 1.During a given observation time, the transmitter (Tx), a WiFi AP, emits a train of consecutive packets.Let T (p)   s be the temporal duration of the pth packet, which is assumed to encompass an integer number of symbols, namely fundamental blocks of the signal, which depend on the adopted modulation.Specifically, the pth packet is composed by N s N (p)  sym = T (p) s f s samples, being f s the employed sampling frequency, N (p)  sym the number of symbols inside the pth packet, and N s the number of samples inside each symbol.The signal received by the WiFi sensor (Rx) in Fig. 1 contains the coherent superposition of different contributions, namely the direct signal transmitted by the AP and its N R multipath replicas caused by the reflections on stationary obstacles (e.g., walls, floor, and ceiling), the delayed and Doppler-shifted echoes from N T moving targets, as well as thermal noise.
The discrete version of the complex baseband signal received for the pth WiFi packet emitted by the AP is then written as ( τr )  p (l ) where the following points can be considered.
1) s (τ ) p (l ) is the resampled version of the waveform transmitted at the pth packet, i.e., s p (l ), delayed by τ .Note that the adopted notation also accounts for fractional delays.In this article, the pth packet waveform is modeled as a zero-mean unitary power random process whose characteristics depend on the modulation scheme.2) α r,p are the complex amplitudes of the stationary contributions at the pth packet; specifically, α 0,p is the amplitude of the direct signal, while α r,p (r = 1, . . ., N R ) is the amplitude of the rth multipath reflection.These parameters encode both the Tx power level and the propagation losses and they are assumed to be constant within the packet whereas they might vary across consecutive packets.3) τr is the delay of the rth stationary contribution; in the following, without the loss of generality, we assume that the delay of the direct signal is zero, i.e., τ0 = 0, and we measure the delays of all the other contributions with respect to it.4) β q,p and τ q,p (q = 1, . . ., N T ) are the complex amplitude and the delay of the qth target echo at the pth packet and, despite target movements, their variation is assumed to be negligible within the packet due to the typical duration of WiFi packets compared with the velocity of the targets of interest.5) ϕ q,p (l ) encodes the motion-induced phase variation for the qth target echo at the pth packet, and it is defined as ϕ q,p (l ) = 2π λ , where λ is the wavelength and R q,p (l ) = R T x−T GT q,p (l ) + R Rx−T GT q,p (l ) − B is the relative bistatic range law of the qth target along the pth packet, being B the distance between the Tx and the Rx, and R T x−T GT q,p (l ) and R Rx−T GT q,p (l ) the time-varying distances between the target and the Tx and between the target and the Rx, respectively.6) d p (l ) is the additive noise affecting the pth packet at the receiving sensor.It is assumed to be a white, zero-mean complex Gaussian process with variance σ 2 D , statistically independent of the source signal.
With a PR approach, the presence of a moving target is detected by first removing the stationary contributions in (1) and then focusing the energy of the target echo by means of a matched filter or alternative techniques [1], [14].This approach requires the availability of a reference signal, namely a good copy of the transmitted signal, which also provides inherent time, phase, and frequency synchronization [17].However, as previously discussed, such approach sets strong requirements on the Rx architecture, above all the need for at least two simultaneous and coherent receiving channels, thus increasing its cost [17].
Aiming at reducing the complexity of the WiFi sensor, we propose to adopt a reference-free approach.For this purpose, a possible strategy is to exploit an amplitude-based processing scheme where the presence of a moving target echo is detected by extracting the amplitude modulation that it produces on the direct signal from the AP.

B. IDP Scheme
Fig. 2 sketches the main blocks of the processing scheme proposed for a WiFi sensor to detect the presence of moving target(s) against the stationary scene and to extract its instantaneous Doppler frequency, which is referred to as IDP.It mirrors the approach adopted in FSR but it also includes appropriate modifications to make it effective against WiFi signals.
First, the square modulus of the signal is extracted, thus discarding the phase information y p (l ) = x p (l )  2 . (2) Afterward, based on the assumption that the amplitude modulation produced by the target is much slower that the signal Nyquist sampling rate, the output of Fig. 2 undergoes a low-pass filter (LPF) and downsampling stage aimed at removing the high-frequency amplitude variations due to the signal itself, to its multipath replicas and to the noise.We recall that we are dealing with a pulsed-type transmission where the packet emission rate is still higher than the Doppler frequency components of the targets of interest.Therefore, a very simple solution to implement this block with WiFi signals is to resort to an energy detector at packet level, namely an integrator, thus setting the cutoff frequency of the LPF equal to the inverse of the packet duration and the output sampling rate equal to the packet emission rate (l ) . ( Once this stage has been performed, the sequence of samples z(p), p = 0, . . ., N P − 1 undergoes the dc removal, aimed at canceling the strongest stationary scene components, above all the direct signal from the AP z p = z p − z DC p ( where z DC (p) represents the average value of z(p), evaluated over an appropriate time window T DC around the current sample.
Finally, z(p) undergoes a time-frequency analysis that provides as output the typical spectrogram where the presence of a target is detected via its Doppler signature.Specifically, if the packet emission rate is constant over time, i.e., if T (p+1) 0 − T (p) 0 = T 0 ∀p, T (p) 0 being the time instant where the pth packet starts, a short-time Fourier transform (STFT) is implemented that operates against partially overlapped batches of T STFT seconds each, thus encompassing where p 0 is the first packet of the considered batch and h(p) is an appropriate weighting function, used to keep the Doppler sidelobes level under control.
Note that, in practical situations, the sequence z(p) collects samples that are not taken at equally spaced time instants, being the sampling rate set by the random packet emission rate.In such case, a possibility is to resort to an appropriate interpolation stage, which basically yields a resampled version of the sequence z(p).Provided that the original average packet transmission rate was high enough, this approach still allows advantage to be taken of the fast Fourier transform speed to evaluate the required output.

C. Example of IDP Results on Simulated Data
To preliminarily investigate the effectiveness of the IDP for WiFi sensing, a simulated dataset has been generated for the scenario, as depicted in Fig. 1.Specifically, a WiFi AP and the WiFi Rx are placed at two opposite corners of the simulated scene while one target crosses the baseline according to a nonrectilinear trajectory.A stream of OFDMmodulated WiFi packets is simulated at the Rx containing the direct signal contribution, the signal backscattered by the moving target, as well as thermal noise.Note that, for all simulations reported in this article, the target is modeled as a point-like scatterer.To make the simulation more adherent to reality, more complex target models could be considered.However, this is out of the scope of this work because, depending on the target type and observation geometry, the employed model could significantly change, and the theoretical derivation and discussion would be considerably complicated but without changing the message of the article since the main focus of this work is on the impact of the WiFi waveform.Nevertheless, the experimental results, as reported in Section V, will highlight some aspects due to the true target response under different observation geometries.
For the purpose of the following analysis, multipath reflection contributions are assumed negligible.
Table I collects the set of parameters employed in the simulation.For simplicity, the direct signal-to-noise ratio, DNR p = σ −2 D |α 0,p | 2 , and the target signal-to-noise ratio, SNR p = σ −2 D |β 0,p | 2 , are assumed constant across packets during the entire acquisition time of approximately 10 s, i.e., DNR p = DNR = 25 dB and SNR p = SNR = −15 dB, p = 0, . . ., N P − 1; moreover, the OFDM packets are all of the same duration of 80 μs.Note that the SNR values provided are defined over a frequency band used for the considered WiFi transmission standard, in this case, corresponding to 20 MHz.Fig. 3 shows the result obtained with the IDP in the bistatic velocity-time plane.The processing scheme, as detailed in Section II-B, has been applied with T DC = T STFT = 1 s and a Hamming weighting function h(p) to control Doppler sidelobes.The spectrogram is reported for positive frequency values only (the results are symmetrical about zero since the input signal is a real-valued signal) and is scaled to a reference noise power level D as expected at the output of the processing scheme [27].Fig. 3 demonstrates that, by applying the IDP strategy, the WiFi sensor can distinguish the presence of a moving target from the competing background and correctly measure the absolute value of the target Doppler frequency or equivalently of the target bistatic velocity, i.e., |v B |, across time.
Nevertheless, it is also worth noting that the background level against which the target must compete is quite high.In the considered case study, it appears at approximately 48.8 dB above the reference noise level, which is expected to yield significant masking effects on weak target signatures.A similar problem was addressed in [27] with reference to broadcast radio and television transmissions, where it was shown that this level strongly depends on the modulation adopted by the signal that is being exploited as well as on the DNR.
In Section III, we extend the analysis in [27] so that it can also be a representative for WiFi signals.Moreover, we generalize the adopted hypotheses to include real-world effects that were not considered in the theoretical development in [27] and are shown to further degrade the performance.The theoretical characterization of the background level represents a key step in the identification of appropriate strategies to mitigate this issue in order to improve the performance of the proposed IDP in WiFi sensing applications.The points above will be addressed in Sections III and IV, respectively.

III. BACKGROUND CHARACTERIZATION
The background level at the output of the IDP chain is evaluated by computing the average power level of the spectrogram under the null hypothesis H 0 (absence of targets), i.e., E {|w(m)| 2 |H 0 }, where E {•} denotes the expectation operator.As shown in [28], it is expected that the background level increases in the presence of random amplitude fluctuations in the received signal that are determined by causes other than the superposition of the target echo.Therefore, all possible sources of amplitude fluctuation should be properly modeled and included in the analysis.To this purpose, we consider the signal at the pth packet, as written in (1), under the H 0 hypothesis and assuming that the multipath contributions are negligible with respect to the direct signal We make very general assumptions for the quantities in ( 6) in order to model real-world effects that are expected to limit the achievable performance.Specifically, the following points are observed.
1) The direct signal amplitude α 0,p associated with the pth packet is modeled as a random variable to encode the unpredictable variations in the Tx power level and propagation loss across packets.Such effect is expected to limit the performance of the IDP since this technique relies on the assumption that the direct signal constitutes a stable power reference source.In contrast, if the direct signal power level varies across packets, the observed amplitude modulation cannot be solely attributed to the presence of a target that becomes more difficult to be detected.Specifically, we assume α 0,p to be zero-mean with variance m α,2 = E α {|α 0,p | 2 } = DNR avg σ 2 D , where we have implicitly defined an average DNR across the processing time.Moreover, we define the parameter σ 2 DNR = (m α,4 − m α,2 )/σ 4 D that encodes the DNR variance across packets and depends on the fourth moment of α 0,p , m α,4 = E α {|α 0,p | 4 }.
2) The number N (p)  sym of symbols inside the pth packet is modeled as a random variable to encode the variable length of WiFi packets with first and second moments, respectively, given by m N,1 = E N {N (p)  sym } and sym ) 2 }.As for the direct signal amplitude, this parameter affects the energy detection stage at packet level and determines an unwanted amplitude modulation in the output sequence z(p) that might be responsible of a masking effect on the target echo.
3) The waveform s p (l ) transmitted at the pth packet might show an inherent amplitude fluctuation depending on the adopted modulation.In order to model the statistics of the corresponding process, we refer to the two most common modulation schemes used in WiFi standards [31].
a) For direct sequence spread spectrum (DSSS)modulated packets, we write the waveform as follows: where index q = l/N s scans the symbols, while index n = l − qN s scans the samples within the symbol.In this case, the fundamental block in the waveform is given by the pseudonoise Barker code b(n) of length N s = 11, which is used to chip the baseband signal at 11 MHz.c (p,q) is the complex data transmitted at the qth symbol of the pth packet and is drawn from either a BPSK or a QPSK constellation (M c -PSK with M c = 2, 4) with equiprobable symbols.It is worth noticing that, while the complex data stream can randomly take different values within the constellation, the waveform in (7) shows a constant modulus so that it does not contribute to undesired amplitude fluctuations on the received signal and it is expected to be the best performing in terms of background level.b) For OFDM-modulated packets Nc kn q = 0, . . ., where q = l/N s scans the symbols and n = l − qN s − N cp scans the samples within the symbol.In this case, the number of samples within the OFDM symbol is equal to where N c is the number of subcarriers and η = N cp /N c is the fraction of useful symbol samples that is cyclically repeated at the beginning of each symbol, namely the cyclical prefix (CP).Note that, according to the 802.11WiFi Standard [31], N c = 64 while η may take values equal to 1/4, 1/8, or 1/16.Different subcarriers are assumed to be modulated by statistically independent streams of equiprobable symbols drawn from a constellation of dimension M c .Specifically, c (p,q) k is the constellation symbol transmitted at the qth symbol of the pth packet using the kth subcarrier.We recall that, according to the 802.11Standard, the available constellations are BPSK (M c = 2), QPSK (M c = 4), 16-QAM (M c = 16), and 64-QAM (M c = 64).In both DSSS and OFDM cases, the constellation symbols {γ m } m=0,...,M c −1 of the adopted constellation map are properly defined in order to guarantee the unitary power characteristic for the resulting waveform s p (l ).Specifically, in the DSSS case, such condition yields with the adopted BPSK or QPSK schemes.When OFDM signals are considered, we set the average power of the constellation as In addition, we define as the scaled fourth moment of the adopted constellation, which yields the values reported in Table II.With the assumptions above, the theoretical background level at the output of the IDP chain is given by the following unified expression (see Appendix for detailed derivation): where D denotes the output power level that is solely due to the noise at the Rx, namely the value that would be measured in the absence of direct signal, i.e., As a consequence, the remaining factor represents the background-to-noise ratio, namely The function g(η) in (10) depends on the adopted constellation via the parameter μ but it takes nonzero (positive) values only in the presence of a CP, i.e., for η > 0, thus reflecting the background increment expected due to the cyclical repetition of signal fragments within the waveform.Its expression is reported in Table II for the considered waveforms of interest.
Equation (10) generalizes the result in [28] by introducing additional effects that were not considered before and provides an appropriate tool that can be exploited also for the case of pulsed transmissions as WiFi signals.
In particular, it shows that the BNR at the output of the IDP scheme takes a minimum value equal to approximately 2DNR avg but it might experience a large increase depending on the following: 1) the transmitted waveform and employed modulation, via μ and g(η), since these determine the inherent amplitude fluctuation in the waveform; 2) the fluctuation of the packets length and specifically of the number of symbols included in the employed packets, described by N,1 )/m N,1 ; 3) the fluctuation of the direct signal power level, described by σ 2 DNR .This theoretical expression is validated against the experimental data in Section V.In the rest of this section, a thorough analysis is reported against the simulated data.This allows us to better understand the effects of different parameters that can be individually simulated.To this purpose, we consider three case studies separately addressed in the following.

A. Case Study A
In Case Study A, we investigate the effect of packet length fluctuation within the processing interval while removing the signal amplitude fluctuations due to other effects.Therefore, we assume that the DNR is constant across packets, i.e., σ 2 DNR = 0 (and DNR p = DNR avg = DNR), and we set μ = 1 and g (η) = 0, which correspond to a constant amplitude waveform, e.g., DSSS-modulated WiFi packets.Accordingly, (10) becomes To validate this expression, we simulate streams of DSSS packets with variable lengths.To this aim, the number of symbols inside each packet is drawn from a discrete uniform distribution with mean value m N,1 and variance σ 2  N .Different values of these two parameters are used in order to obtain different values for the ratio σ 2  N /m N,1 in (11).The received signal is simulated according to (6) for a target-free and multipath-free scenario.Then, it is sent in input to the IDP scheme and the BNR is numerically evaluated from the output Doppler-time map.In Fig. 4, we report the results as a function of the DNR.Different line styles and colors represent the theoretical results for different values of σ 2 N /m N,1 , while different colored markers represent the BNR measured on the simulated data.As is apparent, the simulation results confirm the correctness of the theoretical formula in (11).
When σ 2 N = 0, the last term in (11) is null; therefore, the BNR is at its lowest value equal to As σ 2 N /m N,1 grows, the last term in (11) becomes progressively larger.In other words, the higher is the amplitude fluctuation due to the varying packet length, the lower is the system capability of discriminating a target from the competing background.
In particular, the BNR deviates from the 2DNR level even for very small σ 2 N /m N,1 values.As an example, with the considered discrete uniform distribution for N (p)  sym , the case σ 2  N / m N,1 = 10 −4 (blue line) is a representative of a fluctuation of less than [±1] symbol around an average value of m N,1 = 6000 symbols.Finally, we notice that, for σ 2  N /m N,1 ≥ 10 −2 , the BNR grows proportional to the square of the DNR since the last term in (11) becomes the dominant term in the range of typical DNR values considered.The analysis above reveals that the BNR is very sensitive to packet length fluctuation.However, an easy approach to solve this issue is to crop all packets to a common length.This obviously implies some losses in terms of target SNR since a part of the available energy on receive is discarded.However, target detection is expected to largely benefit from the resulting control of the BNR, which typically represents the limiting factor.Actually, the capability of detecting moving targets is jointly limited by the background level and the noise contribution via the signal-to-background-plusnoise ratio SBNR = S/(B + N ).However, in the considered application, we have shown that the background level is typically much higher than the noise floor, especially when amplitude-modulated signals are used.By rewriting the SBNR as SBNR = (S/N )/(B/N + 1) = SNR/(BNR + 1), it is well apparent that the BNR term represents the degrading factor with respect to the original SNR when BNR >> 1; therefore, if a sufficient SNR is available, the capability of mitigating the BNR might be critical for target detection.

B. Case Study B
In Case Study B, we investigate the effect of the direct signal amplitude fluctuation on the output background by keeping constant the packets duration, i.e., σ 2 N = 0, and the waveform amplitude, i.e., using a DSSS packets.With these assumptions, (10) becomes From Fig. 5, the following comments apply.
1) For ξ = 0, namely when DNR p = DNR avg , the BNR level is the minimum achievable and equal to 2DNR avg regardless of N sym .2) For limited ξ > 0, we can identify a DNR avg value from which the BNR curve deviates from the minimum obtainable value and rapidly grows.Moreover, the higher is N sym , the lower is the DNR avg value where the deviation occurs.3) For higher ξ > 0, the BNR curve never reaches the lower 2DNR avg bound within the ranges of DNR values considered in this analysis.Moreover, for a fixed ξ , the higher is N sym , the higher is the BNR.4) Finally, all simulation results match the corresponding theoretical expressions, meaning that the formula in ( 13) is able to correctly predict the performance in all cases.

C. Case Study C
In Case Study C, we assume that both the DNR and the packet lengths are constant across packets, i.e., σ 2 DNR = 0 DNR p = DNR avg = DNR and σ 2 N = 0, and we study the impact of the different WiFi waveforms on the output background.Accordingly, (10) can be written as follows: (η) .
(14) In Fig. 6, we report the theoretical BNR versus DNR curves for different modulation schemes and different constellations, identified by different colors and line styles.In all cases, the simulated packets are composed of N sym = 5 symbols; however, as correctly predicted by ( 14), under the considered hypotheses, the BNR does not change with the packet duration.
The results in Fig. 6 show the following.
1) The BNR obtained with DSSS packets is equal to 2DNR (solid black curve) since, for a constant amplitude waveform, the second term in ( 11) is equal to zero.2) With OFDM-modulated signals, the BNR is much larger than the one of the black curve.3) When the OFDM packets use a 16-QAM or a 64-QAM constellation (dot-dash blue or dotted magenta curve), the measured BNR is approximately equal to DNR 2 (as observed for the example in Fig. 5).4) In contrast, when the employed OFDM constellation is either a BPSK or a QPSK (dashed red or dotted green curves), the obtained background level is up to 10 dB lower than the DNR 2 level.In other words, smaller constellation schemes imply smaller fluctuations in the resulting waveform amplitude that is encoded in a smaller μ value, equal to 1 for both BPSK and QPSK.Actually, from ( 14), we observe that with such a value for μ, the BNR deviates from the lower bound of 2DNR only because of the presence of the CP, whose effect is encoded in g(η).In fact, with BPSK and QPSK constellation, the energy associated to the useful portion of any OFDM symbol would be constant regardless of the transmitted data.The fluctuation in the sequence z(p) at the output of the packet energy extractor is only due to the fractions of OFDM symbols cyclically extended to build the CP.
Based on the theoretical findings and analyses reported in this section, it is evident that the best performing condition for the IDP scheme is given by a constant amplitude source signal at the input of the STFT stage.We have demonstrated that DSSS-modulated packets show favorable conditions and only yield a BNR increase when the DNR is not strictly constant over time.In contrast, we have shown how the use of OFDM-modulated packets could significantly increase the output BNR, potentially preventing small targets from being detected.Section IV presents possible solutions to handle this issue.

IV. BACKGROUND REDUCTION STRATEGIES
Two approaches are proposed in this section to lower the average background level obtained when exploiting OFDMmodulated WiFi transmissions.First, we separately address them in the following sections; then, we compare them by application against simulated data, under different operative conditions.

A. IDP With Signal-Based Background Cancelation (SBC)
In [28], an effective approach is presented to mitigate the background level when exploiting DVB-T signals as waveforms of opportunity for an amplitude-based sensing system.This approach, named SBC, exploits the knowledge of the transmitted signal, possibly reconstructed from the received signal itself, to remove its effect on the observed background by direct subtraction from the dc-free amplitude signal.We refer the interested reader to the article presented in [28] for a comprehensive description.
In Fig. 7, the IDP, including an SBC stage, is sketched and will be referred to as the SBC-IDP in the following.Notice that the SBC in [28] can be easily applied to the WiFi case by assuming that the energy variation across transmitted WiFi packets is known at the receiver, up to a scale factor.This is obtained in Fig. 7 by means of a rough reconstruction from the received signal.Under the hypothesis that the main contribution to the background level is the direct signal from the AP, the subtraction of the reconstructed signal prior to the STFT is expected to reduce the background level down to that observed for a constant amplitude waveform.This is shown in Fig. 8 that reports the result of the SBC-IDP when applied to the same simulated dataset used in Section II-C.Notice that the considered case study includes equal length packets transmitted with a constant Tx power level; therefore, the background level observed in Fig. 3 was only due to the waveform properties.By comparing Fig. 3 with Fig. 8, the advantage of the SBC-IDP solution is evident as the target SNR stays the same, while the average background level decreases to approximately 28 dB (i.e., 2•DNR), namely as per a constant-amplitude waveform.The result in Fig. 8 demonstrates the effectiveness of the proposed solution to lower the BNR level when OFDM waveforms are exploited.
However, a few additional considerations are in order.
1) SBC-IDP requires a partial knowledge of the transmitted WiFi signal.Specifically, the waveform energy at packet level should be available or computed from a reasonably good copy of the transmitted waveform, which in turn can be obtained according to the different strategies mentioned in the introduction.Fig. 7 shows the case when the signal is reconstructed via demodulation and remodulation [31], thus preserving the "reference-free" characteristic of the proposed scheme.2) Despite the SBC approach requires the reconstruction of the transmitted waveform, we observe that such signal is not used as a reference for time/phase/frequency synchronization since the IDP inherently relies on amplitude information only.Therefore, compared with the case of the reference signal used in PR, the implementation of this additional block yields looser requirements on the quality of the regenerated signal.3) In this simulated analysis, we assumed a perfect copy of the transmitted signal to be available.In practical scenarios, reconstruction errors are likely to corrupt the available signal, especially when the DNR degrades or when the target contribution in the received signal becomes larger.While a limited number of errors may be tolerated, the increase in the error rate would obviously prevent the possibility to correctly reconstruct the energy variation of the source signal across packets and in turn to effectively reduce the corresponding background level.4) Despite not considered in the reported simulated results, also slow variations in the Tx power level could be tracked and mitigated with this approach by properly selecting the parameters of the SBC.

B. WiFi PHY Preamble-Based IDP (WPP-IDP)
The application in hand also suggests the possibility of an alternative simple solution that maintains the reference-free characteristic of the IDP approach while guaranteeing the desired reduction of the BNR also for amplitude-modulated waveforms.Based on the theoretical findings of Section III, in the absence of Tx power level fluctuations, we observe that in order to achieve the 2•DNR lower bound for the BNR, it is sufficient that the energy across packets is kept constant, in turn, that can be obtained by selecting and using only time-invariant and data-independent portions of the transmitted packets.This possibility is readily offered by OFDM WiFi packets that, based on the WiFi Standards [31], encompass three main fields (see Fig. 9): 1) the PHY Preamble, which is composed by N Preamble samples, is a priori defined and is used for synchronization and channel estimation purposes; 2) the Signal, which is composed by a single OFDM symbol and contains information on the transmission mode for the payload; 3) the data that enclose the transmitted information and might have a variable number of OFDM symbols.
Therefore, we investigate the possibility of limiting the application of the IDP approach to the time-invariant PHY Preamble portion of the packet and refer to this approach as the WPP-IDP.We observe that, with this position and assuming that the Tx power level variations are negligible, the signal at the output of the energy detector can be written as follows: denoting {•} as the real part of {•} and being the first term on the R.H.S. the major contributor to the background level when the DNR is high enough.However, this term is constant across packets since the summation is limited to the invariant preamble fragment, meaning that such term can be effectively canceled by the dc removal stage of Fig. 2 without any additional processing stage.
Clearly, we observe that this solution is effective as long as the Tx power level fluctuations are negligible.However, the analysis in Section III-B has shown that such effect becomes apparent only at very high values of the average DNR.Fig. 10 shows the results for the simulated dataset exploited for both Figs. 3 and 8, where it is evident that the average BNR level is comparable with that of Fig. 8, approximately 28 dB, which corresponds to the 2•DNR lower bound.As expected, the main drawback of this approach is the loss on the target signature obtained by limiting the processing to a small portion of the WiFi packet.Specifically, the maximum peak level in Fig. 8 is equal to 67.3 dB, while that of Fig. 10 is equal to 60.2 dB.
In fact, as reported in Table I, the employed simulated dataset is composed of 20 OFDM symbols, while the PHY Preamble only includes 4 OFDM symbols; therefore, an SNR loss of approximately 7 dB is observed.It is worth mentioning that, when small OFDM constellations are employed, namely BPSK or QPSK, an additional solution is possible to lower the background level.In fact, we have shown in Section III that those constellations have μ = 1, such as the DSSS-modulated packets [see (9)].Therefore, the only factor responsible for a higher BNR level is the presence of the CP, whose effect in encoded in g(η) [see (40) of the Appendix].
This observation suggests that, for packets using these constellations, it is sufficient to remove the CP samples at each OFDM symbol for the background level to reach the lower bound of 2•DNR.Note that this solution would allow keeping a larger packet length with respect to the use of the WPP-IDP, therefore obtaining lower SNR loss at the packet level.However, depending on the employed WiFi Standard, limiting the processing to BPSK-or QPSKmodulated packets might significantly reduce the packet rate and, in turn, the target integration gain.

C. Comparative Analysis Against Simulated Data
Table III reports the results obtained with the two described strategies when applied against the same simulated dataset employed in Section III for Fig. 6.Specifically, the SBC-IDP and the WPP-IDP approaches are compared in terms of achievable BNR when applied to a stream of OFDM-modulated WiFi packets employing a 64-QAM constellation, namely the constellation that yields the highest BNR level with the original IDP.The results in Table III confirm the effectiveness of both strategies to achieve the desired lower bound of 2•DNR for the BNR level.A further comparison is reported in Fig. 11, where the three different strategies are compared when applied to the simulated scenario, as described in Table I, for three different DNR values while keeping the input SNR constant.
As evident with the original IDP scheme, the higher the DNR is, the lower is the capability of discriminating the targets against the background despite the target signature amplitude increases.This is due to the larger increase of the BNR that follows a square law as a function of the DNR.In fact, for a DNR of 40 dB, the target signature is buried in the map background and would no longer be detected.By either applying the SBC-IDP or the WPP-IDP, the average background level is correctly lowered.Clearly, as mentioned above, the limited complexity of the WPP-IDP is traded for a higher SNR loss due to the use of a small portion of the available packet.Note that these results have been obtained with a simulated dataset where the multipath contributions are negligible.In practice, especially in indoor scenarios, the signal reflections from the walls, the floor, and the ceiling might not be negligible and might jeopardize the WiFi sensing application.To investigate the robustness of these strategies to multipath, let us first consider a scenario where the multipath contribution is limited to a single multipath ray (N R = 1) with the same power level of the direct signal and delayed by τ1 .
Therefore, the received signal in this case is written as follows: x p (l ) = α 0,p s p (l ) + α 1,p s ( τ1 )  p (l ) and we assume that α 1,p = |α 0,p | e j 2π τ1 c λ +π .The amplitudes are set so that each ray taken separately has a power level DNR = 25 dB above noise.The power level of their superposition, namely after coherent summation, appears DNR eq dB above noise and this value depends on the phase of the multipath ray, which in turn depends on the delay τ1 .
In Fig. 12(a) and (b), we report the measured BNR versus a grid of delay values associated with the multipath ray.More specifically, we compare the result obtained with the conventional processing [see Fig. 12(a)] and the background reduction strategies [see Fig. 12(b)], namely the SBC-IDP (red, green, blue, and magenta markers) and the WPP-IDP (light blue dots).Different colors and markers denote the different OFDM constellations employed for the simulated data generation.Moreover, the black curve represents the lower expected level, corresponding to twice the estimated equivalent DNR eq in input.
The following observations are in order.
1) For negligible delay values, the multipath reflection represents a destructive interference for the direct signal.This is because the rays are assumed with equal power but with opposite phase.2) When no background reduction strategy is applied, the measured BNR is very high and depends on the employed constellation, as demonstrated above for the multipath-free condition.
3) The SBC-IDP reduces the background contribution with respect to the conventional IDP only by few dBs [compare the equally colored markers in Fig. 12(a) and (b)].This is because the energy variation used to perform the SBC is no longer representative of the entire observed fluctuation on the received signal, which also depends on the multipath contribution.4) The WPP-IDP approach is able to reach the desired BNR level for all the considered delay values.In fact, although the considered samples are no longer identical to the transmitted signal, namely to the theoretical PHY Preamble described in the Standard, but also contain a delayed copy of it, provided that  the stationary scene does not change over time, the energy of the considered portion will still be time invariant.
The above analysis is extended in the following by considering a more realistic scenario where the received signal includes several multipath replicas.The considered geometry is depicted in Fig. 13, where the positions of the AP and the Rx are indicated together with the N R = 20 multipath rays (in orange) obtained according to a ray tracing approach by including both the single-bounce reflection (dashed lines) and the double-bounce reflections (dash-dot lines) from the walls, the floor, and the ceiling.Three out of the four walls are assumed made of concrete, while one is assumed made of glass, and the reflection coefficients are set accordingly [32].Overall, we assume the multipath contributions to have a multipath-to-noise ratio of 20 dB.
Fig. 14 shows the outcome of the IDP approach for the described simulated scenario, with or without a background reduction strategy.
Note that, the overall signal has an average signal to noise level of 23.1 dB.The SBC-IDP [see Fig. 14(b)] decreases the background level with respect to the conventional IDP approach [see Fig. 14(a)] only of about 6 dB, while the WPP-IDP [see Fig. 14(c)] yields a reduction of approximately 19.5 dB, obtaining a BNR of approximately 27.8 dB.
It is worth recalling that the same SNR loss of approximately 7 dB observed comparing Fig. 8 with 10 is obtained with the WPP-IDP approach that only employs a small portion of the entire packet, in this case composed of 20 OFDM symbols.Finally, by measuring the ratio between the target peak and the average background level, we get a signal-to-background ratio that equals 20.4 dB for the conventional IDP, 26.44 dB when the SBC-IDP is applied, and 33.01 dB when the WPP-IDP is used.This analysis confirms that such a simple solution is the preferred strategy, especially in multipath-limited scenarios.

V. EXPERIMENTAL VALIDATION
In this section, we demonstrate the effectiveness of the proposed IDP approach against the real-world WiFi data; this also allows to investigate the practical benefits of the devised strategies to mitigate the background level.For the purpose of this analysis, an ad hoc acquisition campaign was carried out and different datasets were collected, varying the acquisition geometry, the number and type of targets in the scene, and the employed WiFi Standard.For the sake of simplicity, Section V-A focuses on the datasets collected in a target-free scenario and is mostly intended to investigate the performance in terms of background control, while Section V-B reports the results obtained against cooperative targets in order to understand the corresponding advantages in terms of detection capability.

A. Experimental Results on Target-Free Data
First, we consider experimental data collected in a disturbance-only condition and apply a simple IDP scheme in order to experimentally demonstrate the validity of the theoretical BNR expression, as derived in Section III.To this purpose, we have employed three different IEEE 802.11 standards and we have extracted DSSS-modulated beacons from dataset #1, QPSK-modulated OFDM symbols from the ACK signals of dataset #2, and 16-QAM-modulated symbols from the ACK signals of dataset #3.With this approach, we were able to test the validity of (10) under different conditions in terms of employed modulation scheme.Additional details for each dataset are reported in Table IV.
As a first result, Fig. 15 shows the output of the IDP scheme in the absolute bistatic velocity-time plane for the three described datasets.In each case, the IDP was applied with T DC = 0.1 s and T STFT = 0.5 s.Moreover, we select N sym = 100 for DSSS beacons and N sym = 2 for the OFDM ACK packets.Note that, since we only use signaling packets for the purpose of this analysis, their length is intrinsically constant over time.However, we recall that, based on the findings of Section III, if packets with different original lengths were employed, it would be preferrable to limit the packet duration to a constant number of symbols N sym .All the maps in Fig. 15 are scaled for the expected D in order for the noise level to be around 0 dB and for the map values to represent the BNR.In all cases, the input average DNR was measured to be between 29.6 and 31.5 dB.From Fig. 15, we can notice that how the average power level largely differs depending on the employed modulation.In fact, we obtain BNR ∼ = 32.6 dB, BNR ∼ = 56.6 dB, and BNR ∼ = 51.7 dB, for subfigures (a), (b), and (c), respectively.
To understand the BNR behavior as a function of average DNR, we repeat this analysis by boosting the thermal noise power level in the received signal.Specifically, we add additive white Gaussian noise with gradually increasing power, thus emulating gradually decreasing DNR avg values, and we report in Fig. 16 the BNR values measured on the final spectrograms after the application of the IDP.The results are shown in Fig. 16(a), (b), and (c) as black, blue, and green colored markers for datasets #1, #2, and #3, respectively.Moreover, in each subfigure, curves with different colors and line styles identify the corresponding theoretical BNR curve, obtained using (10) by properly selecting N sym , μ, and g(η) depending on the considered dataset and by fitting the ξ value to the data.Finally, in all subfigures, we also report the 2DNR avg bound as dashed-gray curve for comparison.
The curves in Fig. 16(a) are referred to dataset #1, composed by DSSS-only packets, and are obtained by limiting the packet duration to either N sym = 100 or N sym = 1000 repetitions of the Barker code.We might observe that, as expected, for low DNRs, the two curves tend to look alike and equal to the dashed-gray one, i.e., the 2DNR avg bound.Instead, the larger is the packet duration N sym , the lower is the DNR avg value where the BNR curve deviates from the dashed-gray one and grows.This is because of the DNR fluctuation, which has higher impact on longer PPDUs.Observing them, two considerations are in order: as expected, the measured BNR is much higher than that obtained in Fig. 16(a) for DSSS-modulated packets and does not reach the dashed-gray curve for none of the considered DNR values, and although the DNR fluctuation is higher than that observed in the DSSS case, it has a smaller impact on the obtained results, both because the packets are much shorter and because the major observed effect is related to the waveform; therefore, the green and blue curves do not significantly differ from those, as shown in Fig. 6, obtained with σ 2 DNR = 0. Fig. 16(b) and (c) also reports additional colored markers showing the results obtained with the background reduction strategies proposed in Section IV.Note that, in order to enable the application of the SBC-IDP, during the experiments, the transmitted signal was extracted from the employed AP via a wired connection.For both the considered datasets, the use of a WPP-IDP based on N sym = 2 OFDM symbols extracted from the PHY Preamble portion of the WiFi PPDUs (light blue markers) is the best performing solution and effectively reduces the measured BNR to the minimum achievable value, represented by the dash-dot black curve.In contrast, although the SBC-IDP (magenta markers) significantly reduces the measured BNR in both cases, the measured values lay on the black curve only for dataset #3 [see Fig. 16(c)].Note that, as reported in Table IV, dataset #2 has been collected in an indoor area, which is likely to be affected by higher multipath contributions that might jeopardize the effectiveness of the SBC strategy, as shown in Section IV.Finally, for dataset #3 [see Fig. 16(c)], orange markers are obtained by removing the CP from the QPSK OFDM symbols.As mentioned in Section IV, this solution is also able to effectively lower the BNR.However, we recall that keeping N sym constant, the CP-free solution offers a lower integration gain since one-fifth of each OFDM symbol is discarded in the considered case; and this solution would not be effective against symbols with larger constellations (with μ = 1).

B. Experimental Results on Data Including Target Echoes
The test data illustrated in this section have been collected using the same setup described above and listed in Table IV.Specifically, dataset #4 only includes 802.11bDSSS-modulated packets, while dataset #5 is composed by OFDM-modulated PPDUs.
1) Results for Tests With DSSS-Modulated Packets: Dataset #4 is composed by 802.11b beacons, with a nominal beacon interval of 3 ms and has been collected with the experimental configuration, as sketched in Fig. 17.It features one person, acting as a cooperative target and walking along the direction described by the green arrow, namely along a linear trajectory, orthogonally crossing the Tx-Rx baseline approximately in its middle point (∼ 10 m from both the AP and the Rx).
Fig. 18 shows the output of the IDP scheme applied to the collected signal, with N sym = 100, T DC = 0.5 s, and T STFT = 1 s and a Hamming tapering window for Doppler sidelobes level control.The results reported in Fig. 18 shows that the IDP processing can recognize the target signature throughout the entire trajectory that spans a wide range of bistatic angles, from 180°, when it crosses the baseline, up to approximately 70°, when it stops moving.Note that, based on the intensity of the signature when the target stops  moving, at about 16 s, it is expected that the target could be detected well beyond limit.The high capability of recognizing the presence of a target is certainly favored by the low background level measured on the map which, as demonstrated above, is typically obtained with the employed DSSS modulation.In fact, note that for an average DNR of approximately 23.1 dB measured for this dataset, the average level competing with the target response is of approximately 30 dB (represented by the blue color in this figure ).
Finally, note that, compared with the results obtained on the simulated data with a point-like target, the following differences are apparent due to the real target response: 1) an enhancement of the response at the apex of the V-shaped Doppler signature, namely when the target crosses the baseline; 2) a fading of target signature as its distance from the baseline increases; 3) a modulation of the signature due to micro-Doppler effects caused by the periodic movement of the target's limbs.

2) Results for Tests With OFDM-Modulated Packets:
The purpose of this last analysis is to investigate the capability of the proposed IDP technique to detect a small radar cross section (RCS) target.To this end, a small drone (DJI Mavic Pro) was exploited as a cooperative target.Note that the employed UAV is lightweight (about 730 g) with small size (about 30 × 25 × 8 cm).The experimental configuration is sketched in Fig. 19 and the employed setup is the same, as reported in Table IV, for dataset #3.Specifically, in the performed test, the small UAV gets close to the Tx-Rx baseline along an orthogonal trajectory, stops for 5 s, and then moves away.The results are reported in Fig. 20, for T DC = 0.2 s and T STFT = 0.5 s.Note that, in this case, we do not limit the processing to a single constellation; therefore, we include both ACK and RTS packets characterized by QPSK and 16-QAM data fields, respectively.
By observing Fig. 20, the following comments apply.To elaborate further on the comparison between the SBC-IDP and the WPP-IDP, we should recall that the reference signal used to operate the SBC was made available in this case for analysis purpose; in a practical scenario, it should be reconstructed from the received signal and might be subject to reconstruction errors.Moreover, the need to reconstruct the transmitted waveform as well as the SBC-IDP overall require higher computational load than the WPP-IDP.Also, we recall that the SBC in the considered test is operated in a favorable condition since this dataset was collected in an outdoor scenario, where the multipath contributions are expected to be limited.On the other hand, for the purpose of this analysis, we have limited to N sym = 2 OFDM symbols the packets portion processed in all cases; however, if the SBC-IDP is applied, the use of the entire WiFi packet is, in principle, possible, which could enable a higher target SNR.Overall, both the SBC-IDP and the WPP-IDP can be considered as effective solutions for BNR mitigation when OFDM signals are used and their benefits in term of capability of detection small targets are apparent.The best solution among the two might depends on the specific application.

VI. CONCLUSION
In this work, we have investigated the possibility of using a novel, reference-free, and amplitude-based processing approach for WiFi-based passive sensing.Specifically, we look for the presence of a moving target by observing the amplitude modulation that it produces on the direct signal transmitted from the WiFi AP across time.
The main outcomes of this work are listed as follows.
1) The adaptation of the considered principle of operation to the application at hand.2) A theoretical characterization of the average disturbance level measured at the output of the proposed processing and competing with the target, taking into account real-world effects that are expected to limit the achievable performance, such as the waveform properties.3) Validation of the theoretical findings with both simulated and real WiFi data.4) The proposal of two possible solutions that address the identified issues, namely the SBC-IDP and the WPP-IDP, characterized by different complexities and achievable performances.5) Extensive testing with experimental data employing different RCS targets and bistatic geometries.

APPENDIX
In this appendix, we theoretically derive the background level at the output of the IDP scheme based on the signal model in (6) and subsequent definitions, under the null H 0 hypothesis (target absent).To this aim, we follow a similar procedure as that used in [28] but the mathematical developments are extended in order to take into account realistic effects typical of the application under analysis.Specifically, we look for E {|w(m)| 2 |H 0 } that, using (5), can be evaluated as follows: where E {•} denotes the statistical expectation with respect to all the considered random variables, i.where we used the assumption that the employed waveform s p (l ) is a zero-mean unitary power random process and the disturbance is modeled as a zero-mean complex Gaussian process with variance σ 2 D .Therefore, (20) can be simply evaluated as follows: Moreover, we can write In order to rework (25), we recall that and we compute the last expected value in (25) as ( The larger order statistics of the random process modeling the waveform, instead, depend on the employed modulation scheme. 1) For DSSS-modulated packets E s s p qN s + n 4 = E s c (p,q) 4 = C 2 μ = 1 (28) where we recall that index q = l/N s scans the symbols, index n = l − qN s scans the samples within the symbol, C represents the average power of the employed constellation, defined as and we used μ = 1 since, in this case, either BPSK or QPSK constellations are adopted E s s p qN s + n 2 s p q N s + n 2 = m 2 s,2 = 1, if q = q E s s p qN s +n 2 s p qN s +n 2 =1, if q= q . (29) 2) For OFDM-modulated packets Assuming that the constellation is scaled so that the waveform is a unitary power process, i.e., C = 1/N c , the fourth-order moment of the transmitted waveform can be expressed as follows: Furthermore, we can write E s s p qN s + n 2 s p q N s + n Based on 4 otherwise.
Equation ( 31) can be reworked as follows: where the δ(n − n , N c ) function accounts for the correlation of the samples inside the OFDM symbol with its repeated portion (CP).Moreover, the additional δ(n + n , N c ) function in the M c = 2 case is due to the symmetry of the OFDM BPSK symbol, obtained as the inverse fast Fourier transform (IFFT) of a real sequence.Therefore, we have By substituting either (34) or ( 29), (26), and ( 27) in (25), we obtain:  39) in (19).Finally, the obtained result is used in (17).By defining which corresponds to the expression in (10).

Fig. 3 .
Fig. 3. Results of the IDP on simulated data.The white line represents the true target trajectory mapped onto the absolute bistatic velocity-time plane.
) In Fig. 5, we report the BNR versus DNR avg for different values of ξ = σ DNR /DNR avg (denoted by different colors) for two different N sym values, represented with different line styles.

Fig. 16
Fig.16(a) further demonstrates the need account for this power-level fluctuation in the theoretical derivation, as reported in Section III, probably due to the nonidealities of the system (e.g., instability of the commercial APs and nonconstant sampling at the receiver), in order to obtain a very accurate prediction of the BNR.However, Fig.16(a) also confirms that, in the presence of limited DNR fluctuations and for typical DNR avg values, DSSS-modulated packets do not require any strategy to lower the BNR level since this is largely comparable with the lower bound of 2 • DNR avg .Blue and green curves and markers in Fig.16(b) and (c), instead, respectively, refer to datasets #2 and #3, both composed by OFDM-modulated packets but employing different constellations.Observing them, two considerations are in order: as expected, the measured BNR is much higher than that obtained in Fig.16(a) for DSSS-modulated packets and does not reach the dashed-gray curve for none of the considered DNR values, and although the DNR fluctuation is higher than that observed in the DSSS case, it has a smaller

1 )
When N sym = 2 are extracted from the data portion of the PPDUs and no background reduction strategy is applied [see Fig. 20(a)], the target signature is barely distinguished from the background level.2) When N sym = 2 are extracted from the data portion of the PPDUs and the SBC approach is applied [see Fig. 20(b)], the improvement is tremendous and the target echo is easily distinguished for the entire trajectory.3) When N sym = 2 are extracted from the PHY Preamble portion of the PPDUs, namely when a WPP-IDP approach is used [see Fig. 20(c)], the target track is entirely visible.Still, the effects of some spurious packets are observed, especially between 4 and 6 s, which corresponds to deviations in the Tx power level.These are effectively estimated and mitigated with the SBC-IDP, whereas the WPP-IDP relies on the ideal hypothesis of constant energy preambles.

TABLE II Expressions
for μ and g(η)

TABLE IV Disturbance
-Only Datasets' Parameters s,d x p (l ) 2 x p l