## 3 Background
### CSI-Based Attack
#### 3.2.2 CSI-Based Input Sensitive Information Recovery Model  
When the user inputs sensitive information, the finger movements will introduce relative multi-path propagation of the wireless signal, and an unique pattern will be generated in time series CSI measurements, and different finger motions correspond to different multi-path propagation; and thus, it can be used to recognize the input sensitive information.  
For the CSI-based sensitive information recovery model, there are several steps. First, noise needs to be removed from the obtained signal. After noise removal, it is necessary to extract the features and then use machine learning algorithms to recognize the input sensitive information, as shown in Figure 2.  
(1) Noise removal:  
The CSI measurements received by commercial WiFi NICs usually contain inherent noise, such as Gaussian white noise, because the transmission rates and internal CSI inference levels change frequently. In order to use CSI measurements to recover input sensitive information, such inherent noise needs to be removed from CSI time series measurements.  
There are many methods to remove noise, such as MIMO beamforming or directional antennas to focus on the certain parts of the body, discrete wavelet decomposition to remove noise, a low-pass filter to remove high frequency noise, and so on.  
(2) Feature Extraction:  
The CSI measurements usually start being collected before the input sensitive information starts and finish being collected after the input sensitive information ends. Therefore, after removing noise from the obtained signals, the actual influenced signal traces need to be extracted from time series CSI measurements.  
When the input sensitive information starts, the CSI waveforms will show a similar rising or falling trend. Thus, a simple method, sliding window, can be used to extract the features. However, the input sensitive information can be classified into two categories: one is consecutive finger motions, and the other is discrete finger motions. For consecutive finger motions, there exists no pause in the sensitive information performing process, such as unlock patterns on an Android screen and applications; while for discrete finger motions, there exists a pause in the sensitive information performing process,  
Figure 2: The process of CSI-based attack. After obtaining CSI measurements at the receiver end, the attacker needs to remove the noise, extract the features from the noise-removed signals and finally recognize the input sensitive information using machine learning algorithms.  
such as keystrokes of laptops or digital unlock passwords. For discrete finger motions, the system first segments the time series CSI measurements into individual motions, then extracts the features for each individual motion.  
After obtaining the starting and ending point, for each individual motion, the PCA (principal component analysis) method can be used to extract the principal components and then calculate the time-frequency features for each motion.  
(3) Sensitive information recovery:  
After extracting features, the machine learning algorithms will be applied to recover input sensitive information. There exists a similarity between speech recognition and gesture recovery; thus, a well-established technique, DTW (dynamic time warping), borrowed from speech recognition can be used to recover the input sensitive information. Besides, KNN (k-nearest neighbor), NB (naive Bayesian) and other classification algorithms can also be used to recover the input sensitive information using time-frequency features.