I still know you were here: Leveraging probe request templates for identifying Wi-Fi devices at scale

Localization of mobile wireless devices carries critical importance for applications such as search and rescue, public safety, surveillance, and occupancy monitoring. In this paper, we study the problem of localizing WiFi-enabled mobile devices such as smartphones and tablets using the measurements captured by an unmanned aerial vehicle (UAV). We make use of the continuously broadcasted WiFi probe requests from mobile devices, capture them at different locations at a WiFi sniffer carried by a UAV, and subsequently estimate the user's location using random-forest based machine learning technique. More specifically, the geographical area of interest is partitioned into multiple zones, and based on the measured probe requests, we are interested to identify the zone where the WiFi device is located. Our experimental results show that the WiFi device can be detected in correct occupancy zone with a 81.8% accuracy.

Zone-level occupancy tracking is a critical technology for smart buildings and can be used for applications such as building energy management, surveillance, and security. Existing occupancy tracking techniques typically require installation of large number of occupancy monitoring sensors inside a building as well as an established network. In this study, in order to achieve occupancy tracking, we consider the use of WiFi probe requests that are continuously transmitted from WiFi enabled smart devices. To this end, WiFi Pineapple equipment are used for passively capturing ambient probe requests from WiFi devices such as smart phones and tablets, where no connectivity to a WiFi network is required. This information is then used to localize users within coarsely defined occupancy zones, and subsequently obtain occupancy count within each zone at different time scales. Our numerical results using WiFi data collected at FIU over several days show that utilization of WiFi probe requests can be a viable solution for zone-level occupancy tracking in smart buildings.

Zone-level occupancy counting is a critical technology for smart buildings and can be used for applications, such as building energy management, surveillance, and public safety. Existing occupancy counting techniques typically require installation of large number of occupancy monitoring sensors inside a building and an established wireless network. In this paper, in order to achieve occupancy counting, we consider the use of Wi-Fi probe requests that are continuously transmitted from Wi-Fi enabled smart devices for discovering nearby access points. To this end, Wi-Fi Pineapple equipment are used for passively capturing ambient probe requests from Wi-Fi devices, such as smart phones and tablets, where no connectivity to a Wi-Fi network is required. This information is then used to localize users within coarsely defined occupancy zones, and subsequently to obtain occupancy count within each zone at different time scales. An interacting multimodel (IMM) Kalman filter technique is developed to improve occupancy counting accuracy. Our numerical results using Wi-Fi data collected at a university building show that the use of Wi-Fi probe requests in conjunction with IMM-based Kalman filters can be a viable solution for zone-level occupancy monitoring in smart buildings.

In the past decade, several algorithms have been proposed to monitor people's mobility based on the analysis of management messages generated by Wi-Fi devices and which rely on the factory physical addresses to identify the source. However, since 2012, major mobile device manufacturers have started protecting their clients' privacy through non-reversible encryption of these identifiers and the omission of other infor-mation. To still protect user privacy and at the same time allow for the identification of frames generated by the same source, we have conducted an extensive analysis of the major fields of these messages, which are called Information Elements. To this, we have analysed an open dataset of Probe Requests sent by individual devices that were captured in isolated or pseudo-isolated environments. In the first part of our analysis, we used the Random Forest algorithm to evaluate the importance of Information Elements for the clustering of Probe Requests, and we discovered that three of them are more valuable than the others. By exploiting this outcome, we implemented a clustering algorithm and found the best settings which allowed us to achieve the correct Probe Requests clustering on average in 92% of cases.

To improve city services, local administrators need to have a deep understanding of how the citizens explore the city, use the relevant services, interact and move. This is a challenging task, which has triggered extensive research in the last decade, with major solutions that rely on analysing traces of network traffic generated by citizens WiFi devices. One major approach relies on catching the probe requests sent by devices during WiFi active scanning, which allows for counting the number of people in a given area and to analyse the permanence and return times. This approach has been a solid solution until some manufacturer introduced the MAC address randomization process to improve the user’s privacy, even if in some circumstances this seems to deteriorate network performance as well as the user experience. In this work we present a novel techniques to tackle the limitations introduced by the randomization procedures and that allows for extracting data useful for smart cities development. The proposed algorithm extracts the most relevant information elements within probe requests and apply clustering algorithms (such as DBSCAN and OPTICS) to discover the exact number of devices which are generating probe requests. Experimental results showed encouraging results with an accuracy of 65.2% and 91.3% using the DBSCAN and the OPTICS algorithms, respectively.

MAC address de-randomization for WiFi device counting: Combining temporal- and content-based fingerprints

Motivated by the fact that a significant number of personal mobile devices are carried into vehicles and that the majority of those devices continuously emit Wi-Fi frames, we investigate the feasibility to use these transmissions for road traffic analysis. Background transmissions are emitted by the majority of Wi-Fi-enabled devices by means of so called probe requests. We show by a real-world measurement on an Austrian motorway that a sufficient number of probe requests can be received in order to re-identify devices traveling between two locations and to estimate travel times. Our results show that by proper post-processing of measurement data, meaningful travel time information for the respective highway segment can be derived. We also propose a simple method to protect user privacy by pruning the recorded Wi-Fi device identifiers. Doing so allows us to generate travel time estimates without creating reversible relations between measurement data points and individual devices, which could potentially be linked to user identities. Obviously, using truncated identifiers has an impact on the estimation result. Based on the measurement data at hand we can show that there exists a fundamental trade-off between privacy and accuracy.

Across different Wi-Fi devices, there exist differences in the probing behavior during active scanning. We conjecture that the behavior is sufficiently distinct to identify individual device types. We propose a feature engineering strategy to training machine learning algorithms for determination of the device type. We propose a concurrent capture across multiple Wi-Fi channels, thus allowing the features to include attributes for the transitions happening between channels during active scanning. Small-scale proof-of-concept results provide encouraging results about the method's potential.

We present a proof-of-concept investigation into the use of sensor networks for tracking of WiFi users in outdoor urban environments. Sensors are fixed, and are capable of measuring signal power from users’ WiFi devices. We derive a maximum likelihood estimate for user location based on instantaneous sensor power measurements. The algorithm takes into account the effects of power control, and is self-calibrating in that the signal power model used by the location algorithm is adjusted and improved as part of the operation of the network. Simulation results to verify the system’s performance are presented. The simulation scenario is based on a 1.5 km 2 area of lower Manhattan, The self-calibration mechanism was verifi ed for initial rms (root mean square) errors of up to 12 dB in the channel power estimates: rms errors were reduced by over 60% in 300 track-hours, in systems with limited power control. Under typical operating conditions with (without) power control, location rms errors are about 8.5 (5) meters with 90% accuracy within 9 (13) meters, for both pedestrian and vehicula r users. The distance error distributions for smaller distances (<30 m) are well-approximated by an exponential distribution, while the distributions for large distance errors have fat tails. The issue of optimal sensor placement in the sensor network is also addressed. We specify a linear programming algorithm for determining sensor placement for networks with reduced number of sens ors. In our test case, the algorithm produces a network with 18.5% fewer sensors w ith comparable accuracy estimation performance. Finally, we discuss future res earch directions for improving the accuracy a nd capabilities of sensor network systems in urban environments. Keywords: sensor network, tracking, WiFi, urban, outdoor, maximum likelihood Distribution A. Approved for public release: distribution unlimited. Case Number: 88ABW-2017-1886. 1. INTRODUCTION 1.1 Motivation and background There are a number of situations in which it is useful to be able to track the motion of individuals in an urban environment. This ability can enable the determination of tr affic patterns; it may also enable surveillance, or providing directions and location-specific information to the individuals. Urban environments pose a challenge to location technologies such as GPS, because “urban canyons” between tall buildings shield users from satellite signals required to give them a position fix. Using WiFi signals to track individuals is a feasible alternative which has recently received much attention ([1],[2],[3],[4]). With the exploding popularity of smart phones, the percentage of individuals who produce WiFi signals is quite large. Furthermore, the signal produced by each individual is uniquely identifiable, since WiFi devices periodically transmit a probe request packet whic h includes the MAC address of the device [5]. Other researchers have studied tracking of targets along roads: see [6] for example, and the citations therein. However, we are not aware of any prior work that treats urban tracking with a WiFi sensor network. In this investigation, we propose, simulate, and verify th e performance of a design for a fixed sensor network dedicated to tracking outdoor urban WiFi users. Our design takes into account the possible effects of power control, which is not required for WiFi systems but may be implemented in some deployments. We also propose and evaluate an algorithm for reducing the number of sensors in the network which minimize the impact on the ne twork’s performance.

the paper provides an insight into the complex of events for probable location of attacker right after he/she has committed an attack on Wi-Fi network. The new approach of additional attackers' devices identification is offered in a way of usage of Wireless Honeypot as a Service model. The method of additional attackers' devices identification is described, proof of concept is designed. Based on gathered probe requests from attacker's Wi-Fi devices, the paper displays the new approach which enables finding list of locations where access points are located.

PmA: A real-world system for people mobility monitoring and analysis based on Wi-Fi probes

I Know you were here: Leveraging Probe Request Templates for Identifying Wi-Fi Devices

An Improvement for Detection of Wi-Fi Device Utilizing Random MAC Address by Focusing on Inter-arrival Time and Periodicity of Probe Request Frames

MAC randomization occurs when non-connected Wi-Fi devices continuously change their MAC address to confuse analytics systems. It is a real challenge for building services based on presence, location, and tracking data since the information is useless due to the produced distortion. This contribution aims to mitigate this problem by constructing unique, stable, and reliable identifiers for these non-connected Wi-Fi devices. We propose a new system that builds identifiers based on the Probe Request frames. In addition, we present what is (to the best of our knowledge) the most exhaustive field study on the accuracy of this type of system with real users and real devices in operation. In this study, we compare the hand count performed in a campus building with the count done automatically by our MAC de-randomization system, obtaining an accuracy between 87 and 95%.

Broadcasted WiFi traffic of mobile devices is the foundation of several estimation techniques like location tracking or crowd counting. Many pervasive applications use these techniques to infer the current state of an environment allowing better planning of resources. A vast majority of techniques use WiFi probe request frames, which contain the unique MAC address of a mobile device. This MAC address allows counting of unique devices and thus, their carriers. To ensure privacy, device manufacturers introduced MAC randomization as anonymization technique. This causes a considerable impact on the data quality of many pervasive applications as randomizing devices create fake MAC addresses. Previous works show that randomized MAC addresses can be linked to their origin device using different derandomization techniques. However, these approaches are not feasible in practice as novel randomization techniques are designed to prevent derandomization. Moreover, the frequency of WiFi probe request frames varies significantly on several factors making it difficult to estimate device presence in a timely manner. This paper assesses the challenges with probe request frames using a new data quality framework for device detection. Additionally, alternative detection methods that do not rely on probe request frames are presented. This includes a recently publicized WiFi device detection technique and a new way of detecting devices associated with a third-party network using a feature of the 802.11 protocol.