RogueRover: Autonomous Rogue Device Localization for Incident Response

Asaf Shabtai; Priyanka Prakash Surve; Yuval Elovici

arxiv: 2606.21264 · v1 · pith:4Z36VMAFnew · submitted 2026-06-19 · 💻 cs.RO

RogueRover: Autonomous Rogue Device Localization for Incident Response

Priyanka Prakash Surve , Asaf Shabtai , Yuval Elovici This is my paper

Pith reviewed 2026-06-26 14:00 UTC · model grok-4.3

classification 💻 cs.RO

keywords rogue device localizationautonomous robot patrolRSSI measurementswireless incident responsezero-configuration localizationquadruped robotindoor securityweighted centroid estimation

0 comments

The pith

A single quadruped robot can localize rogue wireless devices to a median error of 1.62 meters by autonomously collecting RSSI measurements with no prior RF knowledge or site calibration.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that a robot can patrol an indoor space, gather spatially labeled signal strength readings from standard Wi-Fi interfaces, and estimate the positions of unauthorized devices offline. Accuracy holds across heterogeneous propagation conditions because the volume and spread of measurements matter more than complex signal models. This approach removes the need for fixed sensor networks, manual sweeps, or fingerprint databases, which currently slow physical response to wireless intrusions. Evaluation across multiple patrols and a blind test with dozens of observed networks confirms the pipeline works end-to-end. The results indicate that measurement coverage from autonomous movement is the decisive factor for practical zero-configuration localization.

Core claim

RogueRover shows that a quadruped robot performing autonomous patrols can collect spatially labeled RSSI measurements through a commodity 802.11 interface and localize rogue devices offline with a median single-patrol error of 1.62 m. Multi-run aggregation reduces error so that five of six devices fall within 1 m. A blind trial among 73 observed BSSIDs correctly flags the rogues and localizes them at 0.34 m and 1.84 m. Weighted-centroid estimators perform as well as or better than parametric path-loss models, establishing that coverage from the patrols themselves is the dominant accuracy driver under zero-prior constraints.

What carries the argument

Autonomous patrol collection of spatially diverse RSSI measurements, processed by simple weighted-centroid estimators that treat measurement density as the main accuracy driver.

If this is right

Weighted-centroid methods based on coverage match or exceed path-loss models when patrol density is high.
Aggregating data from five or more independent patrols brings most devices inside 1 meter error.
The full pipeline identifies rogue devices among dozens of observed networks without manual labeling.
Localization remains feasible across heterogeneous indoor conditions without site-specific tuning.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Path-planning algorithms that maximize spatial coverage could further lower error without changing the estimator.
The same coverage principle may apply to outdoor or multi-floor settings if robot endurance permits repeated traversals.
Real-time onboard processing of incoming RSSI could shift the system from offline analysis to immediate response.
Fixed sensor grids might become unnecessary in many facilities if one mobile unit can patrol on demand.

Load-bearing premise

Autonomous patrols will reliably produce enough spatially spread RSSI samples to overcome varying signal propagation without any calibration or prior maps.

What would settle it

In a controlled indoor test with known device positions, repeated patrols that achieve dense spatial coverage still produce median localization errors above 3 meters.

Figures

Figures reproduced from arXiv: 2606.21264 by Asaf Shabtai, Priyanka Prakash Surve, Yuval Elovici.

**Figure 1.** Figure 1: Spatially labeled RSSI measurements collected at patrol waypoints (39 in our evaluation). The offline phase performs rogue detection followed by RSSI-based localization without RF fingerprinting, pre-installed sensors, or site calibration. This separation enables RogueRover to operate as an on-demand incident response tool: the robot performs a single patrol to collect measurements, after which detection … view at source ↗

**Figure 2.** Figure 2: Per-session ExpWCL error for each AP, grouped by propagation environment. Each dot is one patrol; red bars mark per-AP medians. APs with multi-sided waypoint coverage show lower, more stable error than those primarily observed from one direction. Ensemble and WCL follow at 1.77 m and 1.95 m respectively, a gap of 0.33 m between the most complex centroid combination and the zero-parameter baseline. This sma… view at source ↗

**Figure 3.** Figure 3: Aggregate localization results. Five of six APs fall below 1 m under the best estimator [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

**Figure 4.** Figure 4: Localization error vs. patrol coverage. Performance remains stable down to moderate coverage levels, after which degradation accelerates, indicating a minimum spatial density requirement. 5.6 Limitations The evaluation is limited to a single building over four days. All APs are stationary and non-adaptive. The system does not address MAC spoofing or adversarial evasion. Performance under multi-floor enviro… view at source ↗

read the original abstract

Physically localizing unauthorized wireless devices remains a critical bottleneck in cyber-physical security operations, where rogue access points can provide entry points for lateral movement and persistent compromise. While such devices can often be detected through network-side mechanisms, determining their physical location typically requires dense sensing infrastructure, site-specific RF fingerprinting, or manual inspection, limiting timely incident response. We investigate whether a single commodity robot can autonomously detect and localize rogue wireless devices under zero-configuration constraints, without RF fingerprinting, pre-installed sensors, or site calibration. We present RogueRover, an end-to-end system in which a quadruped robot autonomously patrols, collects spatially labeled RSSI measurements via a standard 802.11 interface, and estimates device locations offline. We evaluate the system across 11 patrol runs in a real indoor environment, with 6 rogue devices deployed under heterogeneous propagation conditions. Across 62 AP-patrol sessions, RogueRover achieves a median single-patrol localization error of 1.62 m without prior RF knowledge. Under multi-run aggregation, five of six devices are localized within 1 m. A blind trial validates the full pipeline, correctly identifying rogue devices among 73 observed BSSIDs and localizing them with errors of 0.34 m and 1.84 m. Across environments, simple weighted-centroid estimators perform comparably to, or better than, parametric path-loss models, indicating that measurement coverage from autonomous patrols is the primary determinant of localization accuracy under zero-prior constraints. Our results demonstrate that infrastructure-free, autonomous localization is feasible in practice, enabling rapid physical incident response in cyber-physical environments without additional sensing infrastructure.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

RogueRover gives concrete evidence that a quadruped robot can hit 1.62 m median rogue-device localization from RSSI alone in real indoor runs without any calibration.

read the letter

The main thing to take from this is that a single quadruped robot running autonomous patrols can collect RSSI data sufficient for meter-scale localization of rogue access points in a real indoor setting, with no site fingerprinting or extra sensors. The 1.62 m median single-patrol error, the multi-run improvement to sub-1 m for most devices, and the blind trial that correctly flags rogues among 73 BSSIDs are the numbers that matter.

The work is new in its end-to-end application: a commodity quadruped doing the patrols, standard 802.11 RSSI collection with spatial labels, and offline estimation that works under zero-configuration rules. The finding that weighted-centroid methods perform as well as or better than path-loss models across their heterogeneous test conditions is useful, because it points to coverage from the robot path as the main driver rather than model sophistication. The 11 patrol runs and 62 AP-patrol sessions give the claims some grounding in actual deployments.

The soft spot is the limited visibility into whether the patrol trajectories reliably produce the spatial diversity needed when propagation varies. The abstract states that coverage determines accuracy, but does not report area coverage fractions, point density per device, or any controlled check of error versus sampling density. If the robot paths in their site happened to sample well, the zero-prior claim could weaken in environments with bigger dead zones or more correlated samples along the route. The blind-trial errors (0.34 m and 1.84 m) show it worked in practice for them, but that does not fully close the gap.

This is for groups working on physical-layer incident response or robot sensing for security. A reader who needs practical numbers on infrastructure-free localization will find the experimental setup worth looking at. The paper has enough specific results and a clear empirical focus to deserve a serious referee.

Referee Report

2 major / 2 minor

Summary. The paper presents RogueRover, a system in which a quadruped robot autonomously patrols an indoor environment, collects spatially labeled RSSI measurements from a standard 802.11 interface, and performs offline localization of rogue wireless devices without RF fingerprinting, site calibration, or prior knowledge. Evaluation across 11 real patrol runs, 62 AP-patrol sessions, and 6 devices under heterogeneous conditions reports a median single-patrol error of 1.62 m; multi-run aggregation localizes five of six devices within 1 m; a blind trial correctly identifies rogues among 73 BSSIDs with errors of 0.34 m and 1.84 m. The work concludes that simple weighted-centroid estimators match or exceed parametric path-loss models and that measurement coverage is the primary accuracy determinant under zero-prior constraints.

Significance. If the empirical results hold, the demonstration that a single commodity robot can achieve meter-scale localization of rogue devices without infrastructure or calibration has clear practical value for rapid incident response in cyber-physical security. The strength lies in the concrete real-world evaluation (11 patrol runs, blind trial with specific error numbers) rather than simulation or synthetic data; the finding that coverage-driven simple estimators perform comparably across environments is a useful empirical observation that could inform future zero-configuration systems.

major comments (2)

[Abstract and §5 (results)] Abstract and §5 (results): the claim that 'measurement coverage from autonomous patrols is the primary determinant of localization accuracy' is load-bearing for the central thesis yet is not supported by any quantitative coverage metrics (fraction of area sampled, spatial density of RSSI points per device, path-length statistics, or ablation of error versus coverage). Without these, it remains unclear whether the reported 1.62 m median error arises from sufficient independent samples or from other unstated factors under heterogeneous propagation.
[§4 (system/algorithm description)] §4 (system/algorithm description): the exact localization algorithm, data processing pipeline, and implementation of the weighted-centroid versus path-loss estimators are not fully specified, preventing assessment of how spatial labeling is performed or how the 'across environments' comparison was conducted; this directly affects reproducibility of the 1.62 m and sub-1 m claims.

minor comments (2)

[Tables/Figures] Table or figure captions (e.g., those reporting the 62 AP-patrol sessions) could more explicitly state the number of RSSI samples per device and the patrol trajectory lengths to aid interpretation of coverage.
[Blind trial subsection] The blind-trial section would benefit from a brief statement of how the 73 BSSIDs were filtered before localization to clarify the identification step.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback highlighting opportunities to strengthen the empirical support for our central claims and to improve the reproducibility of the localization pipeline. We address each major comment below and will incorporate revisions to address the concerns raised.

read point-by-point responses

Referee: [Abstract and §5 (results)] Abstract and §5 (results): the claim that 'measurement coverage from autonomous patrols is the primary determinant of localization accuracy' is load-bearing for the central thesis yet is not supported by any quantitative coverage metrics (fraction of area sampled, spatial density of RSSI points per device, path-length statistics, or ablation of error versus coverage). Without these, it remains unclear whether the reported 1.62 m median error arises from sufficient independent samples or from other unstated factors under heterogeneous propagation.

Authors: We agree that the manuscript does not include explicit quantitative coverage metrics to directly support the claim. In the revised version we will add these in §5, specifically: (i) fraction of floor area sampled per patrol (computed from the robot's odometry traces), (ii) spatial density of RSSI samples per device (points per square meter), (iii) total path length and coverage overlap statistics across the 11 runs, and (iv) an ablation correlating localization error against coverage level. These additions will clarify whether the 1.62 m median error is driven primarily by coverage under the zero-prior constraint. revision: yes
Referee: [§4 (system/algorithm description)] §4 (system/algorithm description): the exact localization algorithm, data processing pipeline, and implementation of the weighted-centroid versus path-loss estimators are not fully specified, preventing assessment of how spatial labeling is performed or how the 'across environments' comparison was conducted; this directly affects reproducibility of the 1.62 m and sub-1 m claims.

Authors: We acknowledge that §4 provides only high-level descriptions of the estimators and does not include the precise equations, data-processing steps, or implementation details needed for full reproducibility. In the revised manuscript we will expand §4 with: the exact weighted-centroid formula (including weighting function and RSSI-to-distance mapping), the path-loss model equations and parameter fitting procedure, the spatial labeling pipeline (how RSSI samples are associated with robot pose), and pseudocode for the offline aggregation step. These additions will allow independent replication of the reported error figures. revision: yes

Circularity Check

0 steps flagged

No circularity; results are empirical measurements only

full rationale

The paper reports localization performance from 11 real patrol runs collecting RSSI data with a quadruped robot and standard 802.11 interface, then applies off-the-shelf estimators (weighted-centroid, path-loss models) to the measured points and tabulates median errors (1.62 m single-patrol, sub-1 m multi-run) directly from those trials. No equations derive a result from prior fitted parameters, no self-citation supplies a uniqueness theorem or ansatz, and the central claim that coverage determines accuracy is an observed outcome of the experiments rather than a reduction to inputs by construction. The work is therefore self-contained against its own experimental benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The central claim rests on the empirical feasibility of RSSI-based localization from robot patrols in heterogeneous indoor conditions; no new entities are introduced and the approach uses standard assumptions from wireless sensing.

axioms (1)

domain assumption Spatially labeled RSSI measurements collected via standard 802.11 interface during autonomous patrols are sufficient to estimate device locations without site-specific calibration or fingerprinting
This premise underpins the zero-configuration claim and the conclusion that measurement coverage determines accuracy.

pith-pipeline@v0.9.1-grok · 5829 in / 1417 out tokens · 28320 ms · 2026-06-26T14:00:34.836095+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

15 extracted references

[1]

Emerging Science Journal9(1), 284–310 (2025)

Arisandi, D., Ahmad, N.M., Kannan, S.: Invisible scout: A layer 2 anomaly system for detecting rogue access point (rap). Emerging Science Journal9(1), 284–310 (2025)

2025
[2]

In: Proceedings of the International Computer Sciences and Informatics Conference (ICSIC), Amman, Jordan

Awad, F., Hussien, D.A., Al-Qura An, B.T.: Wimap: an efficient wi-fi access point localization mechanism. In: Proceedings of the International Computer Sciences and Informatics Conference (ICSIC), Amman, Jordan. pp. 12–13 (2016)

2016
[3]

Sensors 18(2), 407 (2018)

Awad, F., Naserllah, M., Omar, A., Abu-Hantash, A., Al-Taj, A.: Collaborative indoor access point localization using autonomous mobile robot swarm. Sensors 18(2), 407 (2018)

2018
[4]

In: Proceedings IEEE INFOCOM 2000

Bahl, P., Padmanabhan, V.N.: Radar: An in-building rf-based user location and tracking system. In: Proceedings IEEE INFOCOM 2000. Conference on computer communications. Nineteenth annual joint conference of the IEEE computer and communications societies (Cat. No. 00CH37064). vol. 2, pp. 775–784. Ieee (2000)

2000
[5]

In: 2007 IEEE international symposium on intelligent signal processing

Blumenthal,J.,Grossmann,R.,Golatowski,F.,Timmermann,D.:Weightedcentroid localization in zigbee-based sensor networks. In: 2007 IEEE international symposium on intelligent signal processing. pp. 1–6. IEEE (2007)

2007
[6]

https: //documentation.meraki.com/Wireless/Operate_and_Maintain/User_Guides/ Monitoring_and_Reporting/Air_Marshal(2024), accessed: 2026-01-19

Cisco Meraki: Air marshal: Wireless intrusion prevention. https: //documentation.meraki.com/Wireless/Operate_and_Maintain/User_Guides/ Monitoring_and_Reporting/Air_Marshal(2024), accessed: 2026-01-19

2024
[7]

IEEE Communications Surveys & Tutorials21(1), 508–525 (2018)

Jang, B., Kim, H.: Indoor positioning technologies without offline fingerprinting map: A survey. IEEE Communications Surveys & Tutorials21(1), 508–525 (2018)

2018
[8]

IEEE Commu- nications letters15(2), 187–189 (2010)

Koo, J., Cha, H.: Localizing wifi access points using signal strength. IEEE Commu- nications letters15(2), 187–189 (2010)

2010
[9]

In: IEEE INFOCOM 2008-The 27th Conference on Computer Communications

Ma, L., Teymorian, A.Y., Cheng, X.: A hybrid rogue access point protection framework for commodity wi-fi networks. In: IEEE INFOCOM 2008-The 27th Conference on Computer Communications. pp. 1220–1228. IEEE (2008)

2008
[10]

In: 2020 IEEE 92nd Vehicular Technology Conference (VTC2020-Fall)

Parashar, R., Parasuraman, R.: Particle filter based localization of access points using direction of arrival on mobile robots. In: 2020 IEEE 92nd Vehicular Technology Conference (VTC2020-Fall). pp. 1–6. IEEE (2020)

2020
[11]

IEEE Transactions on Parallel and Distributed Systems24(7), 1300–1309 (2012)

Wu, K., Xiao, J., Yi, Y., Chen, D., Luo, X., Ni, L.M.: Csi-based indoor localization. IEEE Transactions on Parallel and Distributed Systems24(7), 1300–1309 (2012)

2012
[12]

ACM Computing Surveys (CSUR)46(2), 1–32 (2013)

Yang, Z., Zhou, Z., Liu, Y.: From rssi to csi: Indoor localization via channel response. ACM Computing Surveys (CSUR)46(2), 1–32 (2013)

2013
[13]

In: Proceedings of the 3rd international conference on Mobile systems, applications, and services

Youssef, M., Agrawala, A.: The horus wlan location determination system. In: Proceedings of the 3rd international conference on Mobile systems, applications, and services. pp. 205–218 (2005)

2005
[14]

IEEE Internet of Things Journal7(11), 10773–10781 (2020) 14 Surve et al

Zhang, L., Chen, Z., Cui, W., Li, B., Chen, C., Cao, Z., Gao, K.: Wifi-based indoor robot positioning using deep fuzzy forests. IEEE Internet of Things Journal7(11), 10773–10781 (2020) 14 Surve et al

2020
[15]

IEEE Wireless Communications Letters4(6), 693–696 (2015)

Zhuang, Y., Li, Y., Lan, H., Syed, Z., El-Sheimy, N.: Wireless access point localiza- tion using nonlinear least squares and multi-level quality control. IEEE Wireless Communications Letters4(6), 693–696 (2015)

2015

[1] [1]

Emerging Science Journal9(1), 284–310 (2025)

Arisandi, D., Ahmad, N.M., Kannan, S.: Invisible scout: A layer 2 anomaly system for detecting rogue access point (rap). Emerging Science Journal9(1), 284–310 (2025)

2025

[2] [2]

In: Proceedings of the International Computer Sciences and Informatics Conference (ICSIC), Amman, Jordan

Awad, F., Hussien, D.A., Al-Qura An, B.T.: Wimap: an efficient wi-fi access point localization mechanism. In: Proceedings of the International Computer Sciences and Informatics Conference (ICSIC), Amman, Jordan. pp. 12–13 (2016)

2016

[3] [3]

Sensors 18(2), 407 (2018)

Awad, F., Naserllah, M., Omar, A., Abu-Hantash, A., Al-Taj, A.: Collaborative indoor access point localization using autonomous mobile robot swarm. Sensors 18(2), 407 (2018)

2018

[4] [4]

In: Proceedings IEEE INFOCOM 2000

Bahl, P., Padmanabhan, V.N.: Radar: An in-building rf-based user location and tracking system. In: Proceedings IEEE INFOCOM 2000. Conference on computer communications. Nineteenth annual joint conference of the IEEE computer and communications societies (Cat. No. 00CH37064). vol. 2, pp. 775–784. Ieee (2000)

2000

[5] [5]

In: 2007 IEEE international symposium on intelligent signal processing

Blumenthal,J.,Grossmann,R.,Golatowski,F.,Timmermann,D.:Weightedcentroid localization in zigbee-based sensor networks. In: 2007 IEEE international symposium on intelligent signal processing. pp. 1–6. IEEE (2007)

2007

[6] [6]

https: //documentation.meraki.com/Wireless/Operate_and_Maintain/User_Guides/ Monitoring_and_Reporting/Air_Marshal(2024), accessed: 2026-01-19

Cisco Meraki: Air marshal: Wireless intrusion prevention. https: //documentation.meraki.com/Wireless/Operate_and_Maintain/User_Guides/ Monitoring_and_Reporting/Air_Marshal(2024), accessed: 2026-01-19

2024

[7] [7]

IEEE Communications Surveys & Tutorials21(1), 508–525 (2018)

Jang, B., Kim, H.: Indoor positioning technologies without offline fingerprinting map: A survey. IEEE Communications Surveys & Tutorials21(1), 508–525 (2018)

2018

[8] [8]

IEEE Commu- nications letters15(2), 187–189 (2010)

Koo, J., Cha, H.: Localizing wifi access points using signal strength. IEEE Commu- nications letters15(2), 187–189 (2010)

2010

[9] [9]

In: IEEE INFOCOM 2008-The 27th Conference on Computer Communications

Ma, L., Teymorian, A.Y., Cheng, X.: A hybrid rogue access point protection framework for commodity wi-fi networks. In: IEEE INFOCOM 2008-The 27th Conference on Computer Communications. pp. 1220–1228. IEEE (2008)

2008

[10] [10]

In: 2020 IEEE 92nd Vehicular Technology Conference (VTC2020-Fall)

Parashar, R., Parasuraman, R.: Particle filter based localization of access points using direction of arrival on mobile robots. In: 2020 IEEE 92nd Vehicular Technology Conference (VTC2020-Fall). pp. 1–6. IEEE (2020)

2020

[11] [11]

IEEE Transactions on Parallel and Distributed Systems24(7), 1300–1309 (2012)

Wu, K., Xiao, J., Yi, Y., Chen, D., Luo, X., Ni, L.M.: Csi-based indoor localization. IEEE Transactions on Parallel and Distributed Systems24(7), 1300–1309 (2012)

2012

[12] [12]

ACM Computing Surveys (CSUR)46(2), 1–32 (2013)

Yang, Z., Zhou, Z., Liu, Y.: From rssi to csi: Indoor localization via channel response. ACM Computing Surveys (CSUR)46(2), 1–32 (2013)

2013

[13] [13]

In: Proceedings of the 3rd international conference on Mobile systems, applications, and services

Youssef, M., Agrawala, A.: The horus wlan location determination system. In: Proceedings of the 3rd international conference on Mobile systems, applications, and services. pp. 205–218 (2005)

2005

[14] [14]

IEEE Internet of Things Journal7(11), 10773–10781 (2020) 14 Surve et al

Zhang, L., Chen, Z., Cui, W., Li, B., Chen, C., Cao, Z., Gao, K.: Wifi-based indoor robot positioning using deep fuzzy forests. IEEE Internet of Things Journal7(11), 10773–10781 (2020) 14 Surve et al

2020

[15] [15]

IEEE Wireless Communications Letters4(6), 693–696 (2015)

Zhuang, Y., Li, Y., Lan, H., Syed, Z., El-Sheimy, N.: Wireless access point localiza- tion using nonlinear least squares and multi-level quality control. IEEE Wireless Communications Letters4(6), 693–696 (2015)

2015