LTE Signal Fingerprinting Device-Free Passive Localization in Changing Environments

Giovanni Pecoraro*, Ernestina Cianca, Mauro De Sanctis and Simone Di Domenico

Department of Electronic Engineering, University of Rome “Tor Vergata” Via del Politecnico, 1, 00133 Rome, Italy


* Corresponding Author

Received 19 August 2019; Accepted 24 January 2020; Publication 24 February 2020


This paper proposes a fingerprinting-based device Free Passive localization system based on the use of the LTE signal and it is robust to environment changes. The proposed methodology uses as fingerprints descriptors calculated on the CSI vectors rather than directly CSI vectors. The paper shows the performance of the proposed methods also assuming that the monitored environment might be different from the one characterized during the training phase as some equipment may be moved. Moreover, the paper compares the proposed method with signal fingerprinting approaches based on RSSI or direct CSI vectors. Experimental results, which consider one single LTE receiver in the monitored room, show the effectiveness of the proposed solution.

Keywords: Localization, device-free, fingerprinting, CSI, LTE.

1 Introduction

The need for accurate indoor localization, pushed also by many emerging applications such as shopper analytics and smart home, has called for the development of localization techniques not based on the use of Global Navigation Satellite Systems but rather on the analysis of radio signals that can be transmitted by dedicated sensors or by opportunistic sources such as WiFi Access Points (APs) or cellular Base Stations (BSs) [1]. One of the possible approach is the so called signal fingerprinting localization, where the location of a target is achieved by comparing the signal pattern received from transmitters to a predefined database of signal patterns [2, 3]. Most of the proposed techniques are device-based, i.e., the target must be equipped with a communication device that can send out radio signals or is able to receive the radio signals of interest. In this paper, the focus is on Device-free Passive (DfP) localization, which allows to detect, track, and identify people that do not carry any device, nor participate actively in the localization process. Since the pioneering work of Youssef [4], DfP localization has attracted extensive research interest. Some proposed DfP approaches are based on bistatic or multistatic radars [5]. Other approaches are based on the use of signal of opportunity, such as FM radio [6] or WiFi signals [7, 8], which are widely available indoor without deploying an additional dedicated infrastructure. Ambient radio signals transmitted by BSs of a cellular systems or by radio broadcasters have been also considered, but mainly for outdoor applications, using GSM [9] or UMTS [10]. Recently, also Long Term Evolution (LTE) signals have been considered for signal fingerprinting localization techniques [11–13]. The mentioned works use as fingerprints vectors of Channel State Information (CSI) rather than the RSSI, more commonly in previously proposed systems. A novel approach in the use of CSI and LTE signals for indoor localization has been presented in [14]. In [14], the fingerprints are vector containing a number N of features calculated on CSI vectors, rather than the direct CSI vectors. However, the system proposed in [14] is device-based. Moreover, it does not face one of the main problem related to fingerprinting approaches based on the use of CSI, which is the fact that room environment might change with respect to the training phase performed to build the database of fingerprints. Some very recent works have investigated the accuracy degradation of RSSI-based DfP fingerprinting due to the changes in the environment [15–18]. This paper proposes a DfP localization system based on the use of LTE and CSI descriptors as in [14] and shows, through experimental results, the robustness of the proposed approach when the environment changes (e.g., furniture is moved) with respect to an approach based on direct CSI vectors or RSSI.

The paper is organized as follows: Section 2 shows how CSI is extracted from the LTE receiver; the proposed signal fingerprinting DfP localization method is presented in Section 3; Section 4 describes the experimental setup; results are shown in Section 5 and conclusions are drawn in 6.

2 Theoretical Background

The CSI represents a fine-grained channel measurement which is performed by the modern Orthogonal Frequency-Division Multiplexing (OFDM) receivers. In detail, the CSI is employed for channel equalization since it represents the vector of complex channel gains for all subcarrier. In this Section it is explained how these channel gains have been extracted by an LTE receiver. First of all, only the LTE Frequency Division Duplexing (FDD) mode, where the uplink and downlink channels are separated in frequency, has been analyzed. In the LTE standard, the information data is transmitted over a time-frequency grid. The radio frame represents the largest time unit in this grid with a duration of 10 ms. It can be subdivided into 10 subframes of 1 ms, each of which can be further split into 2 slots of 0.5 ms. According to the length of the cyclic prefix, each slot can contain 6 or 7 OFDM symbols. In the frequency domain, instead, the subcarriers are reciprocally spaced by 15 kHz. The smallest resource unit is the Resource Element (RE), which corresponds in the frequency domain to an OFDM subcarrier and in the time domain to an OFDM symbol. The Resource Block (RB) consists of a group of 12 contiguous subcarriers (180 kHz) over a time interval of a slot and is the minimum resource unit which is allocable to a User Equipment (UE). In the LTE standard, it has also been introduced the concept of antenna port. Downlink symbols transmitted via the same antenna port are subject to the same channel conditions therefore an eNodeB c can map its logical antenna ports to Tc physical transmitting antennas in order to take advantage of spatial diversity.

If we consider an eNodeB transmitting a vector of complex symbols xc over N subcarriers from one among all the antennas, the received complex vector yc after the N-point FFT at the receiver can be expressed as:

yc=Xchc+w (1)

where Xc is the transmitted diagonal complex matrix, hc is the vector containing the channel complex gains per subcarrier and w is a complex white Gaussian random process modeling the noise and the inter-cell interference. The subcarrier channel gains are estimated by the receiver using the Cell Specific Reference Signals (CRS), which are inserted in specific OFDM symbols and subcarriers within every slot. In one slot there are 4 CRSs per antenna, as shown in Figure 1, where different antenna ports are represented by different colors. In this work, it is possible to assume that the channel is rather stationary over a slot (0.5 ms), i.e., the coherence time is equal or greater than its duration. Following this assumption, for each antenna we can align at the same instant the CRSs in different positions in the same slot, doubling the size of the CRS resulting vector. Since we are analyzing 10 MHz-bandwidth LTE signals, 50 RBs are available, resulting in a vector of N = 50*2*2 = 200 (50 RBs × 2 CRSs × 2 positions) complex channel gains for 200 different OFDM subcarriers. This complex vector represents the result of the channel estimation process and it is what we call CSI vector in the following. An LTE receiver can extract a CSI vector h^c,t for each eNodeB that is received in a specific position and for all its transmitting antenna ports:

h^c,t=[h^c,t(0),,h^c,t(n),,h^c,t(N1)],c,tTc (2)


Figure 1 Layout of the Cell Specific Reference Signals for 4 antenna ports within 1 Resource Block over 2 consecutive slots.

In this paper, it has also been performed a comparison with other LTE signal measurements applied to fingerprinting, such as RSSI and Reference Signal Received Power (RSRP). The RSRP is defined as the average power of the CSI over the entire bandwidth, so it can be calculated for each transmitting antenna port on the vectors h^c,t as follows:

RSRPc,t=1Nn=0N1|h^c,t(n)|2,c,tTc (3)

The RSSI, instead, represents the measurement of the average RE received power relative to the whole OFDM symbols containing CRSs for antenna port 0 (symbols 0 and 4 in a slot). For this reason, the RSSI includes the power from co-channel serving and non-serving cells, adjacent channel interference and the thermal noise:

RSSIc=1Ll=0L1|Xc(l,l)|2 (4)

where L is the overall number of available subcarriers, that in case of 10 MHz signal bandwidth (50 RBs) is equal to L = 50 ∗ 12 = 600.

3 Device Free LTE Signal Fingerprinting

Device free signal fingerprint-based localization techniques are based on the concept that persons/objects in a given position modify the radio signal, which is received by one or more receiver, differently with respect to other positions. Therefore, it is possible to associate to each position a specific signal pattern, which is built by the signal received by one or more receivers not carried by the person. As any fingerprint-based localization technique, it consists of the following phases:

Table 1 The offline fingerprint database storing fingerprints relative to RPs

RP Coordinates Cell 1 ... Cell c ... Cell C
1 (x1, y1) R1,1 ... R1,c ... R1,C
2 (x2, y2) R2,1 ... R2,c ... R2,C
r (xr, yr) Rr,1 ... Rr,c ... Rr,C
R (xR, yR) RR,1 ... RR,c ... RR,C

The RP r¯, that is associated to the TP whose fingerprint is TF, in case of Nearest Neighbor (NN) matching, is the RP that minimizes a deterministic function called Fingerprint Distance (FD):

r¯:FD(RFr¯,TF)FD(RFr,TF),rr¯ (5)

then the location (x, y) of the TP is calculated through the following association:

(x,y)(xr¯,yr¯) (6)

The basic signal measurements extracted from the LTE receiver are the vectors hc of N = 200 elements as described in Section 2. From these vectors, computed by the same receiver on the LTE signals transmitted by different antennas relative to multiple eNodeBs, a database as the one shown in Table 1 can be built. In Table 1, for each RP r, and for each eNodeB c (denoted as Cell), whose signal is received in the RP, a reference fingerprint Rr,c is calculated.

In the traditional deterministic RSSI-based fingerprinting localization the reference fingerprint Rr is simply given by the average RSSI values measured from all the available eNodeBs, where RSSIc(s) represents the measured value in a single time slot:

Rr,c=RSSI¯c=1Nslots=0Nslot1RSSIc(s) (7)
RFr=[Rr,1,,Rr,c,,Rr,C]=[RSSI¯1,,RSSI¯c,,RSSI¯C] (8)

The fingerprint distance metric FD in case of RSSI comparison is chosen equal to:

FD(RFr,TF)=1Cc=1C[d(Rr,c,TFc)]=1Cc=1C|Rr,cTFc| (9)

where d is the magnitude of the difference between the reference and the test RSSI.

On the other hand, traditional approaches based on CSI use as fingerprints CSI vectors incoherently averaged over a time interval of Nslot to remove noise and undesired channel fluctuations:

hc,t=1Nslots=0Nslot1[|h^c,t(s,0)|,,|h^c,t(s,n)|,,|h^c,t(s,N1)|]=[h0,,hn,,hN1] (10)

Rr,c is a vector directly containing all vectors hc,t, which are the CSIs estimated on the signal received from the cell c and the antenna port t. Therefore, considering again the c-th eNodeB with Tc = 4 antennas, Rr,c is given by:

Rr,c=[Rr,c,1,Rr,c,2,Rr,c,3,Rr,c,4] (11)


Rr,c,t=hc,t=[h0,,hn,,hN1] (12)

Obviously, the same procedure is followed for every test fingerprint TF and the fingerprint distance metric in case of direct CSI comparison has been chosen equal to:

FD(RFr,TF)=1Cc=1C[1Tct=1Tcd(RFr,c,t,TFc,t)] (13)

where d is again the Euclidean distance between two vectors, that is now computed between vectors relative to the same antenna port of the same eNodeB and then averaged.

Another signal metric related to the channel frequency response of the channel and that can be used as fingerprint is the Reference Signal Received Power (RSRP). In this case, the fingerprint Rr,c is linked to the vector RSRPc,t, which represents the sequence of the values of the reference signal received power from the cell c and the antenna port t. Therefore, considering the c-th eNodeB with Tc = 4 antennas, Rr,c is given by:

Rr,c=[Rr,c,1,Rr,c,2,Rr,c,3,Rr,c,4] (14)


Rr,c,t=RSRP¯c,t=1Nslots=0Nslot1RSRPc,t(s) (15)

and then the whole reference fingerprint:

RFr=[Rr,1,,Rr,c,,Rr,C] (16)

3.1 RSRP and CSI Descriptors (F-DESCRIPTORS)

This work presents a signal fingerprinting DfP localization method that employs as fingerprints vectors of specific features calculated on the CSI or RSRP.

In particular, Rr,c is a vector containing F features calculated on the vectors RSRPc,t or hc,t and each feature is a number which is somehow related to the statistics of the RSRP (Table 2) or to the “shape” or statistics of the CSI (Table 3).

Table 2 RSRP statistical descriptors

Descriptor Formula Description
Mean μ=1Nslots=0Nslot1RSRP[s] The arithmetic mean of the RSRP.
Standard Deviation σ=1Nslot1s=0Nslot1(RSRP[s]μ)2 The standard deviation of the RSRP.
Fano Factor FF=σ2μ The ratio between the variance of the RSRP and its arithmetic mean.

Table 3 CSI statistical and shape descriptors

Descriptor Formula Description
Mean μ=1Nn=0N1hn The arithmetic mean of the CSI.
Standard Deviation σ=1N1n=0N1(hnμ)2 The standard deviation of the CSI.
Fano Factor FF=σ2μ The ratio between the variance of the CSI and its arithmetic mean.
Spectral Centroid fn = (3n – 6RB)15 kHz
The “center of mass” calculated as the weighted mean of the frequency values with CSI normalized magnitudes as weights.
Spectral Lambda λ=1N1n=1N1hnhn1fnfn1+2hn+hn1 The mean of the derivative function for the CSI.
Spectral Entropy SE=n=0N1hnj=0N1hjlog2hni=0N1hi The amount of information contained in the CSI.
Spectral Flatness SF=n=0N1Nhn1Nn=0N1hn A measure used in digital signal processing to quantify how noise-like the CSI is.
Spectral Slope SSL=n=0N1(fnf¯n)(hnμ)n=0N1(fnf¯)2 A measure of the slope of the spectral shape of CSI.
Spectral Moment ηj=n=0N1hnfnji=0N1hi The j-th order spectral moment of the CSI.
Spectral Central Moment ξj=n=0N1hn(fnSC)ji=0N1hi The j-th order spectral central moment of the CSI.
Spectral Spread SSP=n=0N1hn(fnSC)2i=0N1hi A measure of how the spectrum is distributed around its centroid.
Spectral Kurtosis SKU=n=0N1hnTn4i=0N1hi,Tn=fnSCξ2 A measure of the “tailedness” of the CSI.
Spectral Skewness SSK=n=0N1hnTn3i=0N1hi A measure of the asymmetry of the CSI about its spectral centroid.

Descriptors are heterogeneous quantities and can assume values in widely different intervals. In order to perform deterministic classification, it is necessary to balance the contributions of all the involved descriptors during distance calculation. For this reason, a min–max normalization approach is applied to both reference and test fingerprints:

R^r,c,t=Rr,c,tminr,c[Rr,c,t]maxr,c[Rr,c,t]minr,c[Rr,c,t],t (17)
T^r,c=Tr,cminr,c[Rr,c,t]maxr,c[Rr,c,t]minr,c[Rr,c,t],t (18)

and then the fingerprint distance is calculated as the vector distance between the normalized fingerprints:

FD(RF^r,TF^)=d(RF^r,TF^) (19)

The descriptor approach has essentially two fundamental advantages with respect to the direct CSI method, in fact it reduces the amount of data that must be stored in the database and the computational complexity associated to the matching phase. A similar approach has already been successfully employed in [12] and [14] to perform device-based localization and in [19] for DfP crowd counting and occupancy estimation by using WiFi. In particular, in [12] it has been shown that the proposed method achieves an accuracy in meter of around 1m in a living room 5×7 wide. In the following, experimental results show the robustness of the proposed method to the environment changes.

4 Experimental Setup

The experimental phase was conducted in a medium-size room of 5 m × 4 m. The experiments have been performed to prove the feasibility of the proposed device-free localization approach and assess its robustness to the changes that might occur in the area of interest. Therefore, 5 different positions inside the room have been considered, corresponding to the empty room case (position 0) and to other 4 different positions, as shown in Figure 2 by the green crosses. Moreover, 5 different configurations for the room have been considered, as shown again in Figure 2: standard configuration (Scenario A), first displacement of a chair (Scenario B), second displacement of a chair (Scenario C), third displacement of a chair (Scenario D) and then displacement of the sofa (Scenario E).


Figure 2 The 5 different configurations of the experimental scenario: (a) base configuration (Scenario A), (b) displacement of a chair (Scenario B), (c) displacement of another chair (Scenario C), (d) displacement of a further chair (Scenario D) and (e) displacement of the sofa (Scenario E).

During the training and test phases, each test position have been occupied by a 1.70 m-tall standing man. The man was not forced to be still, in fact he could freely gesticulate and move around the green cross to simulate a real-life situation. The receiver employed for data acquisition is the Great Scott Gadget HackRF, which is able to capture up to 20 MSamples/s with 8-bit resolution, equipped by an ANT500 omni-directional antenna. The receiver was placed on the table, approximately in the center of the room. The RF amplifier and AGC were disabled, the IF gain was set to 40 dB and the baseband gain to 30 dB in order to avoid distortions due to variable gains. The sampling frequency and the receiving bandwidth were respectively set to 15.36 MS/s and to 10 MHz in order to directly extract 50 RBs.

The IQ raw samples of the LTE signal were collected while the user was in each position for a duration of 20 seconds and stored as binary files. Signal dataset acquisitions for each user position were repeated for each one among the aforementioned scenarios (A, B, C, D and E). Binary files were then processed through an LTE software receiver, which performed the channel estimation process providing RSSI, RSRP and CSI vectors. The estimated channel vectors are then used to calculate the descriptors as in Tables 2, 3. The localization analysis was performed in MATLAB environment, where a fraction of the collected data was employed to train the localization algorithm, while the remaining part was used as test data. In particular, for each position only 1 training fingerprint was included in the database, while 250 equally spaced in time fingerprints were used for testing. In both cases, a time interval of 1 s, corresponding to NSLOT = 2000 slots, was selected to incoherently average the captured RSSI, RSRP and CSI. As a performance metric we chose the Localization Accuracy, which represents the probability of correctly matching between the actual location of the human in the test phase and the location estimated by the fingerprinting system. If we define with Ncorr the number of position correctly matched and with Ntot the number of total considered test positions, the location accuracy is defined as:

accuracy=NcorrNtot100% (20)

5 Experimental Results

The purpose of the experimental results shown in this Section is to prove the feasibility of the proposed method for DfP localization and assess its robustness with respect to changes that might occur in the room. Therefore, the training phase has been done in one scenario (i.e., room furniture configuration) and tests have been performed in the same scenario as well as in the other 4 considered scenarios. First of all, Table 5 reports the accuracy of RSSI, RSRP, direct CSI and descriptors when both the training and the testing phase are performed in the same room configuration. Figure 3 represents a bar chart of the values shown in Table 5, where the x-axis reports all the possible training scenarios and the y-axis the localization accuracy, and graphically demonstrates that the approach based on RSSI performs very poorly if compared to the others. RSRP exhibits a slightly better behavior, but CSI and descriptors clearly outperform both of them. In detail, RSSI provides an accuracy always below 50%, while CSI-methods, in particular direct CSI and descriptors, are around 100%.

Table 4 shows the average accuracy of all the proposed deterministic methods for all the combinations of training and testing scenarios. The descriptors combination was chosen through an exhaustive search by fixing the training scenario (A, B, C, D or E) and maximizing the average localization accuracy for all testing scenarios (A, B, C, D and E). No more than 4 descriptors were considered in the fingerprint since a further increase in their number has not provided any additional accuracy improvement.

From Table 4, it is evident that all methods show a performance degradation with respect to the simple case of training and testing in the same scenario. The maximum accuracy of the method using direct CSI (and not descriptos) for scenario A is 100% and falls to 20% in case of testing in scenario E. Similar performance degradation was observed in paper [17], where due to the opening of doors or windows, the localization accuracy drops to 40% up to 18%.

Table 6 and Figure 4 report the average localization accuracies for different training room configurations (the ones indicated in the x-axis), where the average is calculated over all possible testing configurations. It is important to outline that the Scenario A and E are rather different from each other and hence, in these cases, all methods show worst performance. Generally, the average performance of the direct CSI and descriptors are comparable and clearly much better than both RSSI and RSRP. In general, CSI methods, both direct CSI and descriptors are shown to be rather robust to environment changes in most scenarios (A–D). This is related to the fact that CSI is more tightly related to the size (not only the position) of the scatterers and, at the chosen bandwidth, the person as a scatterer has more impact on the CSI than a smaller scatterer such as a chair. When the static scatterer that is moved is bigger, such as in case of scenario E, also direct CSI shows much worst performance. In this case, CSI descriptors, which only catches the main characteristics of the channel frequency response, likely impressed by the bigger scatterer such as the person, has still a good behavior also in scenario E. In particular, its performance ranges from 85% to 70% while direct CSI localization accuracy drops down to 60% in case of training in Scenario A.

Table 4 Localization accuracy of proposed deterministic approaches for all combinations of training and testing scenarios

Training Scenario Fingerprint Type Test Scen. A Accuracy [%] Test Scen. B Accuracy [%] Test Scen. C Accuracy [%] Test Scen. D Accuracy [%] Test Scen. E Accuracy [%]
A RSSI 38 39 38 39 32
RSRP 76 58 46 52 20
CSI 100 96 47 80 20
3-DES. 100 80 100 79 85
4-DES. 100 80 100 78 88
B RSSI 23 49 45 36 39
RSRP 63 93 52 43 37
CSI 98 100 100 100 35
3-DES. 100 93 95 80 67
4-DES. 100 100 80 98 80
C RSSI 30 34 46 39 27
RSRP 51 49 76 70 40
CSI 80 100 100 100 60
3-DES. 99 84 100 80 60
4-DES. 100 87 99 80 60
D RSSI 32 36 21 42 26
RSRP 57 45 41 84 40
CSI 91 100 96 100 40
3-DES. 80 100 69 100 95
4-DES. 80 100 73 100 100
E RSSI 22 40 21 21 36
RSRP 40 40 43 40 79
CSI 80 80 86 79 100
3-DES. 93 77 60 50 94
4-DES. 97 75 61 51 98

Table 5 Localization accuracy in case of training and testing in the same scenario

Fingerprint Type Training Scen. A Accuracy [%] Training Scen. B Accuracy [%] Training Scen. C Accuracy [%] Training Scen. D Accuracy [%] Training Scen. E Accuracy [%]
RSSI 38 49 46 42 36
RSRP 76 93 76 84 79
CSI 100 100 100 100 100
3-DES. 100 93 100 100 94
4-DES. 100 100 99 100 98


Figure 3 Localization accuracy in case of training and testing in the same scenario.

Table 6 Average localization accuracy in case of training in one scenario and testing in scenarios A, B, C, D and E

Fingerprint Type Training Scen. A Accuracy [%] Training Scen. B Accuracy [%] Training Scen. C Accuracy [%] Training Scen. D Accuracy [%] Training Scen. E Accuracy [%]
RSSI 37 38 35 31 28
RSRP 50 58 57 53 48
CSI 69 87 88 85 85
3-DES. 89 87 85 89 75
4-DES. 89 92 85 91 76


Figure 4 Average localization accuracy in case of training in one scenario and testing in all the others.

6 Conclusion

This paper proposes a DfP localization system based on the use of LTE signals and a fingerprinting, which is shown to be robust to changes in the environment of interest, such as changes in the forniture. The experimental set-up includes a single LTE receiver in the monitored room and 4 different test positions plus the empty room case. Through experimental results the performance of the proposed approach are compared to LTE signal finger-printing approaches based on RSSI, RSRP or direct CSI vectors. From the experimental results it is possible to conclude that:

  1. RSSI-based method provides very poor DfP localization accuracy even if training and testing are performed in the same scenario.
  2. RSRP is more accurate with respect to RSSI in case of training and testing in the same scenario, but the localization accuracy deeply reduces if some furniture is moved.
  3. Direct CSI and descriptors provide very good average accuracy in both cases.
  4. CSI descriptors reduce the memory occupancy and computational complexity of the fingerprint database and also exhibit, on average, a more stable behavior when the room configuration is changed (i.e., the performance degradation is maximum 15% against a 25% of performance loss in case of direct CSI).

The achieved results are promising and open the way to future works where more receivers per room can be considered and or to the application of the proposed methods also to the fine-grained DfP localization case.


[1] Y. Gu, A. C. C. Lo, and I. G. Niemegeers. A survey of indoor positioning systems for wireless personal networks. IEEE Communications Surveys and Tutorials, 11(1):13–32, 2009.

[2] Q. D. Vo and P. De. A survey of fingerprint-based outdoor localization. IEEE Communications Surveys and Tutorials, 18(1):491–506, 2016.

[3] X. Wang, L. Gao, S. Mao, and S. Pandey. CSI-based fingerprinting for indoor localization: A deep learning approach. IEEE Transactions on Vehicular Technology, 66(1):763–776, January 2017.

[4] M. Youssef, M. Mah, and A. Agrawala. Challenges: Device-free passive localization for wireless environments. In Proceedings of the 13th Annual International Conference on Mobile Computing and Networking, MOBICOM 2007, Montréal, Québec, Canada, September 9–14, 2007, pages 222–229. ACM, 2007.

[5] F. Adib and D. Katabi. See through walls with wifi! SIGCOMM Comput. Commun. Rev., 43(4):75–86, August 2013.

[6] A. Popleteev and T. Engel. Device-free indoor localization based on ambient FM radio signals. IJACI, 6(1):35–44, 2014.

[7] J. Xiao, K. Wu, Y. Yi, L. Wang, and L. M. Ni. Pilot: Passive device-free indoor localization using Channel State Information. In IEEE 33rd International Conference on Distributed Computing Systems, ICDCS 2013, 8–11 July, 2013, Philadelphia, Pennsylvania, USA, pages 236–245. IEEE Computer Society, July 2013.

[8] H. Abdel-Nasser, R. Samir, I. Sabek, and M. Youssef. MonoPHY: Mono-stream-based device-free WLAN localization via physical layer information. In 2013 IEEE Wireless Communications and Networking Conference (WCNC), Shanghai, Shanghai, China, April 7–10, 2013, pages 4546–4551. IEEE, April 2013.

[9] M. Ibrahim and M. Youssef. CellSense: An accurate energy-efficient GSM positioning system. IEEE Trans. Vehicular Technology, 61(1):286–296, 2012.

[10] J. Borkowski and J. Lempiäinen. Pilot correlation positioning method for urban UMTS networks. In 11th European Wireless Conference 2005 – Next Generation wireless and Mobile Communications and Services, Nicosia, Cyprus, 10–13 April, 2005, pages 1–5. VDE, April 2005.

[11] J. Turkka, T. Hiltunen, R. U. Mondal, and T. Ristaniemi. Performance evaluation of LTE radio fingerprinting using field measurements. In 2015 International Symposium on Wireless Communication Systems (ISWCS), Brussels, Belgium, August 25–28, 2015, pages 466–470. IEEE, August 2015.

[12] G. Pecoraro, S. Di Domenico, E. Cianca, and M. De Sanctis. LTE signal fingerprinting localization based on CSI. In 13th IEEE International Conference on Wireless and Mobile Computing, Networking and Communications, WiMob 2017, Rome, Italy, October 9–11, 2017, pages 1–8. IEEE Computer Society, October 2017.

[13] T. Wigren. LTE fingerprinting localization with altitude. In Proceedings of the 76th IEEE Vehicular Technology Conference, VTC Fall 2012, Quebec City, QC, Canada, September 3–6, 2012, pages 1–5. IEEE, September 2012.

[14] G. Pecoraro, S. Di Domenico, E. Cianca, and M. De Sanctis. CSI-based fingerprinting for indoor localization using LTE signals. EURASIP Journal on Advances in Signal Processing, 2018(1):49, July 2018.

[15] B. Mager, P. Lundrigan, and N. Patwari. Fingerprint-based device-free localization performance in changing environments. IEEE Journal on Selected Areas in Communications, 33(11):2429–2438, November 2015.

[16] Q. Lei, H. Zhang, H. Sun, and L. Tang. Fingerprint-based device-free localization in changing environments using enhanced channel selection and logistic regression. IEEE Access, 6:2569–2577, 2018.

[17] Xi Chen, Chen Ma, Michel AllegueMartnez, and Xue Liu. Taming the inconsistency of wi-fi fingerprints for device-free passive indoor localization. 05 2017.

[18] X. Wan, X. Li, Z. Liu, and B. Dai. Hybrid wireless fingerprint indoor localization method based on a convolutional neural network. Sensors, 10 2019.

[19] S. Di Domenico, G. Pecoraro, E. Cianca, and M. De Sanctis. Trained-once device-free crowd counting and occupancy estimation using WiFi: A doppler spectrum based approach. In 12th IEEE International Conference on Wireless and Mobile Computing, Networking and Communications, WiMob 2016, New York, NY, USA, October 17–19, 2016, pages 1–8. IEEE Computer Society, October 2016.



Giovanni Pecoraro has attended the Italian Air Force Academy from 2008 to 2013 and has received his B.Sc. and M.Sc. degrees cum laude in Telecommunications Engineering at the University of Naples “Federico II” in 2013. He has also received a M.Sc. degree cum laude in “Advanced Communication and Navigation Satellite Systems” in 2015 and a Ph.D. in Electronic Engineering at the University of Rome “Tor Vergata”. From 2013 to 2019 he worked as a Spacecraft Operation Engineer for the Italian Ministry of Defense where he was responsible for providing space systems performance analysis, investigating on anomalies and failures and managing all satellites operations. Since 2019 he has been working as Head of Cyberspace Operations at the Italian Joint Cyber Operations Command. His research is mainly focused on Device-free RF-based activity recognition/crowd counting/density estimation and localization, but currently he is also working on the development of innovative Red Team tactics, techniques, and procedures (TTPs).


Ernestina Cianca is Associate Professor at the Dept. of Electronic Engineering of the University of Rome Tor Vergata, where she teaches Digital Communications and ICT Infrastructure and Applications (WSN, Smart Grid, ITS etc.). She is the Director of the II Level Master in Engineering and International Space Law in Satellite systems for Communication, Navigation and Sensing. She is vice-director of the interdepartmental Center CTIF-Italy.

She has worked on wireless access technologies (CDMA, OFDM) and in particular in the waveforms design, optimization and performance analysis of radio interfaces both for terrestrial and satellite communications. An important part of her research has focused on the use of EHF bands (Q/V band, W band) for satellite communications and on the integration of satellite/terrestrial/HAP (High altitude Platforms) systems. Currently her main research interests are in the use of radio-frequency signals (opportunistic signals such as WiFi or specifically designed signals) for sensing purposes, and in particular device-free RF-based activity recognition/crowd counting/density estimation and localization; UWB radar imaging (i.e., stroke detection). She is author/co-author of 130 papers in international journals and conferences.


Mauro De Sanctis received the “Laurea” degree in Telecommunications Engineering in 2002 and the Ph.D. degree in Telecommunications and Microelectronics Engineering in 2006 from the University of Roma “Tor Vergata” (Italy). From the end of 2008 he is Assistant Professor in the Department of Electronics Engineering, University of Roma “Tor Vergata” (Italy), teaching “Information Theory and Data Mining”. In April 2017, he received the Associate Professor habilitation (Italian National Scientific Habilitation – ASN 2016) from the Italian Ministry of University and Research for the scientific sector of telecommunications.

From January 2004 to December 2005 he has been involved in the MAGNET (My personal Adaptive Global NET) European FP6 integrated project and in the SatNEx European network of excellence. From January 2006 to June 2008 he has been involved in the MAGNET Beyond European FP6 integrated project as scientific responsible of WP3/Task3.

He has been involved in research activities for several projects funded by the Italian Space Agency (ASI): DAVID satellite mission (DAta and Video Interactive Distribution) during the year 2003; WAVE satellite mission (W-band Analysis and VErification) during the year 2004; FLORAD (Micro-satellite FLOwer Constellation of millimeter-wave RADiometers for the Earth and space Observation at regional scale) during the year 2008; CRUSOE (CRUising in Space with Out-of-body Experiences) during the years 2011/2012.

He is serving as Associate Editor for the Signal Processing and Communication in Aerospace Systems area of the IEEE Aerospace and Electronic Systems Magazine and as Associate Editor for the Command, Control and Communications Systems area of the IEEE Transactions on Aerospace and Electronic Systems. His main areas of interest are: wireless terrestrial and satellite communication networks, data mining and information theory. He published more than 90 papers on journals and conference proceedings, 4 book chapters, one book and one patent. He was co-recipient of the best paper award from the 2009 International Conference on Advances in Satellite and Space Communications (SPACOMM 2009).


Simone Di Domenico received both Bachelor and Master degrees in Internet technology engineering from the University of Roma “Tor Vergata”, in 2012 and 2014, respectively. He got the Ph.D. degree in Electronic Engineering at the University of Roma “Tor Vergata” in 2018. Currently, he is a postdoctoral researcher at the University of Roma “Tor Vergata” and his main research interests include the RF device-free human activity recognition and the RF device-free people counting.


1 Introduction

2 Theoretical Background


3 Device Free LTE Signal Fingerprinting

3.1 RSRP and CSI Descriptors (F-DESCRIPTORS)

4 Experimental Setup


5 Experimental Results



6 Conclusion