Probe Request Frames Research Articles

Bleach: From WiFi probe-request signatures to MAC association

Smartphones or similar WiFi-enabled devices regularly discover nearby access points by broadcasting management frames known as probe-requests. Probe-request frames relay, as information, the MAC addresses of sending devices, which act as the device identifiers. To protect the user’s privacy and location, probe-requests use a randomized MAC address generated according to the MAC address randomization protocol. Unfortunately, MAC randomization greatly limits any studies on trajectory inference, flow estimation, crowd counting, etc. To overcome this limitation while respecting users’ privacy, we propose Bleach, a novel, efficient, and comprehensive approach allowing randomized MAC addresses to device association from probe-requests. Bleach models the frame association as a resolution of MAC conflicts in small time intervals. We use time and frame content-based signatures to resolve and associate MACs inside a conflict. We propose a novel MAC association algorithm involving logistic regression using signatures and our introduced time metric. To the best of our knowledge, this is the first work that formulates the probe-request association problem as a generic resolution of conflicts and benchmarks the association concerning several datasets. Our results show that Bleach outperforms the state-of-the-art schemes in terms of accuracy (as high as 99%) and robustness to a wide range of input probe-request datasets.

Analyzing Broadcast Patterns and Randomization Techniques in Wi-Fi Probe Request Frames

Analyzing Broadcast Patterns and Randomization Techniques in Wi-Fi Probe Request Frames

A Novel Covert Channel for IEEE 802.11 Networks Utilizing MAC Address Randomization

Vendors implement the MAC address randomization technique to prevent IEEE 802.11 client station devices from being tracked. Although it conceals device identity, it cannot hide its occurring data transmission. This paper presents a novel covert channel that leverages the MAC address randomization technique to create a covert channel to hide data transmission inside IEEE 802.11 networks. The secret data are a disposable random MAC address generated by the IEEE 802.11 station as part of the probe request frame while scanning the network. The paper presents the concept of the covert channel, its implementation, and performance metrics. The study covers diverse scenarios, including the adaptation of the modified Selective Repeat ARQ protocol to alleviate the impact of the number of client stations and their offered loads on the covert channel. The results show that with the appropriate parameter selections, we can adapt the covert channel to produce excellent throughput, efficiency, delay, and jitter according to the environment in which it is installed.

Proposal for Low-Layer Metadata Collection Technology to Enhance IoT Metadata Utilization

With the rapid spread of Internet of Things (IoT) services, the number of sensor devices has exploded, and the complexity of managing sensor devices has become a problem. To solve this problem, a metadata-based approach that uses the unique environmental information associated with each device for its management is being developed. This paper focuses on metadata collection for device management and control, and proposes a new collection method that uses low-layer communication while not modifying the existing protocol. Our proposal utilizes the extended area of the probe request (PRQ) frame of IEEE 802.11, which is a layer-2 protocol, to collect metadata. This makes it possible to achieve stable operation even on inexpensive and resource-limited IoT devices, and to realize metadata collection with low communication overhead and power consumption. It is shown to reduce the load on the central processing unit (CPU) and reduce power consumption compared to Internet Protocol (IP) -based metadata collection (layer-3 protocol and above). In addition, in terms of time sensitivity, the collection delay at the time of rising from deep sleep is reduced by 89.8% compared to IP-based techniques. Furthermore, as a benefit of low-layer collection, it enables periodic metadata collection in the background regardless of network connection above the IP layer. To demonstrate this benefit, an example of applying metadata collection to device management is prototyped and its feasibility is experimentally confirmed.

Probe Request Based Device Identification Attack and Defense

Wi-Fi network has an open nature so that it needs to face greater security risks compared to wired network. The MAC address represents the unique identifier of the device, and is easily obtained by an attacker. Therefore MAC address randomization is proposed to protect the privacy of devices in a Wi-Fi network. However, implicit identifiers are used by attackers to identify user’s device, which can cause the leakage of user’s privacy. We propose device identification based on 802.11ac probe request frames. Here, a detailed analysis on the effectiveness of 802.11ac fields is given and a novel device identification method based on deep learning whose average f1-score exceeds 99% is presented. With a purpose of preventing attackers from obtaining relevant information by the device identification method above, we design a novel defense mechanism based on stream cipher. In that case, the original content of probe request frame is hidden by encrypting probe request frames and construction of probe request is reserved to avoid the finding of attackers. This defense mechanism can effectively reduce the performance of the proposed device identification method whose average f1-score is below 30%. In general, our research on attack and defense mechanism can preserve device privacy better.

CrowdProbe

Devices with integrated Wi-Fi chips broadcast beacons for network connection management purposes. Such information can be captured with inexpensive monitors and used to extract user behavior. To understand the behavior of visitors, we deployed our passive monitoring system---CrowdProbe, in a multi-floor museum for six months. We used a Hidden Markov Models (HMM) based trajectory inference algorithm to infer crowd movement using more than 1.7 million opportunistically obtained probe request frames. However, as more devices adopt schemes to randomize their MAC addresses in the passive probe session to protect user privacy, it becomes more difficult to track crowd and understand their behavior. In this paper, we try to make use of historical transition probability to reason about the movement of those randomized devices with spatial and temporal constraints. With CrowdProbe, we are able to achieve sufficient accuracy to understand the movement of visitors carrying devices with randomized MAC addresses.

A localization and tracking scheme for target gangs based on big data of Wi-Fi locations

The modeling and analysis of target gangs’ usual haunts plays a very important role in law enforcement and supervision. Existing localization and tracking schemes usually need to deploy a large number of monitoring devices or continue to move with the target, which lead to high cost. In this paper, a localization and tracking scheme based on big data of Wi-Fi locations is proposed. Firstly, the characteristic of the smart mobile device that continuously broadcasts probe request frames is used to obtain its MAC address and Wi-Fi connection history. Secondly, the service set identifier (SSID) in the Wi-Fi connection history of smart mobile devices held by the target gangs are queried from the Wi-Fi location database, and the target gangs’ usual haunts are gained by statistical analysis. Lastly, monitoring devices are deployed in these places, and most of the target gangs’ activity pattern are known with only a small number of monitoring devices. The results of the related experimental tests demonstrate the feasibility of the proposed scheme.

Mobile Device Passive Localization Based on IEEE 802.11 Probe Request Frames

This paper presents a novel passive mobile device localization mode based on IEEE 802.11 Probe Request frames. In this approach, the listener can discover mobile devices by receiving the Probe Request frames and localize them on his walking path. The unique location of the mobile device is estimated on a geometric diagram and right-angled walking path. In model equations, site-related parameter, that is, path loss exponent, is eliminated to make the approach site-independent. To implement unique localization, the right-angled walking path is designed and the optimal location is estimated from the optional points. The performance of our method has been evaluated inside the room, outside the room, and in outdoor scenarios. Three kinds of walking paths, for example, horizontal, vertical, and slanted, are also tested.