Multiple Sniffers Research Articles

Machine Learning Based Network Analysis Using Millimeter-Wave Narrow-Band Energy Traces

Next-generation wireless networks promise to provide extremely high data rates, especially exploiting the so-called millimeter-wave frequency range. Gaining information from spectrum usage is becoming important to provide smart adaptation capabilities to future network protocol stacks. Issues such as deafness, misaligned antennas, or blockage may severely impact network performance, and their identification is crucial. Despite the complexity of full analytical models, machine learning techniques are progressively being considered to improve spectrum usage at higher layers. In this paper, we design a signal processing technique that uses narrowband physical layer energy traces, obtained from one or multiple channel sniffers. The proposed technique utilizes a combination of template matching and an Explicit Duration Hidden Markov Model (EDHMM) to correctly classify frames, while coping with the non-stationarity of the traces. This leads to a protocol level monitor that does not need to decode the channel at the physical layer, but just infers the type of packets that are exchanged based on sub-sampled energy traces. The performance of this framework is evaluated using off-the-shelf mm-wave wireless devices, quantifying its detection performance in the presence of one or multiple sniffers, and assessing the impact of physical layer parameters such as noise power and signal levels.

Occupant counting modelling for intelligent buildings based on data from multiple WiFi sniffers

Knowing the occupancy information in each room can create energy saving through intelligent control of HVAC systems. In this paper, a classification-based occupant counting method using multiple WiFi sniffers is proposed firstly to get a coarse estimation of occupancy. Then, to deal with the false negative problem, i.e., those occupants who do not carry a smartphone or if the WiFi module is not enabled and cannot be counted, a p-persistent frequent itemsets with 1-right-hand-side (RHS)-based occupant correction algorithm is further proposed to improve the occupant detection accuracy using association analysis. Finally, our methods are validated through real experiments. Results show that our classification-based occupant detection method using multiple WiFi sniffers outperforms the 1-WiFi-sniffer-based method, and the association analysis-based correction algorithm can improve the accuracy because it can see occupants in buildings that the naive WiFi-based occupant detection method cannot see, which makes it suffice to be a viable approach to occupant estimation for intelligent buildings.

Passive Localization of Standard WiFi Devices

Ubiquitous wireless indoor localization can be achieved by leveraging the widespread deployment of WiFi systems. Most existing WiFi-based localization solutions are based on received signal strength (RSS) fingerprinting, which requires a database of the RSS values in the application environment to be built and maintained. The latest 802.11ac WiFi standard offers channels with wide bandwidths, which enables accurate timing-based positioning. This paper presents a passive localization system in which multiple sniffers monitor the WiFi traffic and locate the standard WiFi transmitters based on the time-of-arrival measurements. Multiple implementation issues are addressed, including sniffer clock synchronization and hardware delay calibration. The proposed system is evaluated experimentally using a prototype developed by us. It is shown that the positioning accuracy is significantly improved over existing systems.

PRAPD: A novel received signal strength–based approach for practical rogue access point detection

Rogue access point attack is one of the most important security threats for wireless local networks and has attracted great attention from both academia and industry. Utilizing received signal strength information is an effective solution to detect rogue access points. However, the received signal strength information is formed by multi-dimensional received signal strength vectors that are collected by multiple sniffers, and these received signal strength vectors are inevitably lacking in some dimensions due to the limited wireless transmission range and link instability. This will result in high false alarm rate for rogue access point detection. To solve this issue, we propose a received signal strength–based practical rogue access point detection approach, considering missing received signal strength values in received signal strength vectors collected in practical environment. First, we present a preprocessing scheme for received signal strength vectors, eliminating missing values by means of data filling, filtering, and averaging. Then, we perform clustering analysis on the received signal strength vectors, where we design a distance measurement method that dynamically uses partial components in received signal strength vectors to minimize the distance deviation due to missing values. Finally, we conduct the experiments to evaluate the performance of the practical rogue access point detection. The results demonstrate that the practical rogue access point detection can significantly reduce the false alarm rate while ensuring a high detection rate.

Toward Accurate Network Delay Measurement on Android Phones

Measuring and understanding the performance of mobile networks is becoming very important for end users and operators. Despite the availability of many measurement apps, their measurement accuracy has not received sufficient scrutiny. In this paper, we appraise the accuracy of smartphone-based network performance measurement using the Android platform and the network round-trip time (RTT) as the metric. We show that two of the most popular measurement apps—Ookla Speedtest and MobiPerf—have their RTT measurements inflated. We build three test apps for three common measurement methods and evaluate them in a testbed. We overcome the main challenge of obtaining a complete trace of packets and their timestamps using multiple sniffers and frame-based synchronization. Our multi-layer analysis reveals that the delay inflation can be introduced both in the user space and kernel space. The long path of subfunction invocations accounts for the majority of the delay overhead in the Android runtime (both Dalvik VM and ART), and the sleeping functions in the drivers are the major source of the delay overhead between the kernel and physical layer. We propose and implement a native measurement app to mitigate the delay overhead in the Android runtime, and the resulted delay inflation in the user space can be kept under 1.5 ms for almost all cases.

English

In this paper a tool to estimate the interference between nodes and links in a live wireless network by passive monitoring of wireless traffic has been proposed. This tool proposes the use of multiple sniffers being deployed across the network to capture wireless traffic trace thus does not requires any controlled experiments, injection of probe traffic in the network, or even access to the network nodes. Using machine learning approach these traces help to infer the carrier-sense relationship between network nodes. We are also able to detect selfish carrier-sense behavior. Experimental and simulation results demonstrate that the proposed approach of estimating interference relations is significantly more accurate than simpler heuristics and quite competitive with active measurements. We use ns2 simulation to also validate the approach in a real Wireless LAN environment.

Passive Measurement of Interference in WiFi Networks with Application in Misbehavior Detection

We present a tool to estimate the interference between nodes and links in a live wireless network by passive monitoring of wireless traffic. This tool does not require any controlled experiments, injection of probe traffic in the network, or even access to the network nodes. Our approach requires deploying multiple sniffers across the network to capture wireless traffic traces. These traces are then analyzed using a machine learning approach to infer the carrier-sense relationship between network nodes. This coupled with an estimation of collision probabilities helps us to deduce the interference relationships. We also demonstrate an important application of this tool-detection of selfish carrier-sense behavior. This is based on identifying any asymmetry in carrier-sense behavior between node pairs and finding multiple witnesses to raise confidence. We evaluate the effectiveness of the tool for both the applications using extensive experiments and simulation. Experimental and simulation results demonstrate that the proposed approach of estimating interference relations is significantly more accurate than simpler heuristics and quite competitive with active measurements. We also validate the approach in a real Wireless LAN environment. Evaluations using a real testbed as well as ns2 simulation studies demonstrate excellent detection ability of the selfish behavior. On the other hand, the metric of selfishness used to estimate selfish behavior matches closely with actual degree of selfishness observed.