Passive Biometric Authentication and DDoS Mitigation via Channel State Information (CSI) in WiFi and 5G Networks: A Proposed Framework with Preliminary Empirical Analysis

Abstract

As artificial intelligence progresses, traditional security measures such as CAPTCHAs become more vulnerable to sophisticated bot-driven attacks. This research proposes a passive authentication method using Channel State Information (CSI) from 4G/5G and commodity WiFi devices. The method aims to distinguish automated bot traffic from genuine human presence by detecting micro-vibrations caused by involuntary physiological processes, including breathing and heart activity, and to use these cycles as a behavioral biometric for a seamless, hardware-free security layer that is resistant to relay and replay attacks. We present this as a proposed framework together with a hardwaredeployment blueprint and an initial empirical analysis on public commodity-WiFi CSI data. Our analysis shows that respiration is reliably recovered (mean absolute error $\approx 1.1$ breaths/min across 17 subjects), whereas reliable heart-rate extraction remains an open problem on commodity hardware (correlation with reference $\approx 0$, below a mean-predictor baseline). A preliminary person-identification ablation indicates that both the respiratory and cardiac sub-bands carry discriminative information (fused accuracy $\approx 74 \%$ versus 5.9% chance), albeit with a channelfingerprint confound that motivates cross-environment validation. We therefore frame high-accuracy authentication (design target 96.7%) and large-scale DDoS mitigation as objectives of the proposed blueprint, not as achieved results.