1

AirTrack: Locating Non-WiFi Interferers using Commodity WiFi Hardware

Ashish Patro, Shravan Rayanchu, Suman Banerjee University of Wisconsin-Madison

Sep 20, 2011 / Mobicom 2011 SRC

2

Talk Outline• How non-WiFi devices affect WiFi traffic?

• How to detect non-WiFi transmissions using “commodity” WiFi cards?

• How to physically locate these non-WiFi devices?

• Evaluation

Sep 20, 2011 / Mobicom 2011 SRC

Some Non-WiFi devices

Analog Cordless Phone

Video Camera Microwave OvenZigBee

FHSS Cordless Phone

Bluetooth SCO/ACL Game Controllers Audio

Transmitter

Narrowband/High-duty devices Broadband devices

Frequency-hopping devices

Sep 20, 2011 / Mobicom 2011 SRC 3

4

Problem

Sep 20, 2011 / Mobicom 2011 SRC

Non-WiFi devices exist in 2.4GHz/5.8GHz spectrum and impact WiFi performance

5

Scenario Access Point

GOALS• How do we detect and locate these non-WiFi devices?• How to do this in real time using commodity WiFi cards?

Sep 20, 2011 / Mobicom 2011 SRC

6

Why use commodity WiFi cards?• Software-only solution that works on top of the cards

• Can easily deploy this software solution in current WLANs

• No additional expensive hardware needed• e.g. spectrum analyzers

Sep 20, 2011 / Mobicom 2011 SRC

7

What do commodity WiFi cards provide?

Wireless Card

WiFi Packets

Packet Capture

FFT Samples

Non-WiFi devices

Sub-carrier energy

samples

Sep 20, 2011 / Mobicom 2011 SRC

-73, -65, -72, …

9

Talk Outline• How non-WiFi devices affect WiFi traffic?

• How to detect non-WiFi transmissions using “commodity” WiFi cards?

• How to physically locate these non-WiFi devices?

• Evaluation

Sep 20, 2011 / Mobicom 2011 SRC

10

How to detect non-WiFi devices?

Capture energy

samplesPo

we

r

Frequency TimingProperties

Duration

Bandwidth

“Tagged Pulses”

e.g., Bluetooth

“Classify”Pulses

Extract ``Feature

s’’ Identify

``Pulses”

Sniffer

Sep 20, 2011 / Mobicom 2011 SRC

11

Talk Outline• How non-WiFi devices affect WiFi traffic?

• How to detect non-WiFi transmissions using “commodity” WiFi cards?

• How to physically locate these non-WiFi devices?

• Evaluation

Sep 20, 2011 / Mobicom 2011 SRC

12

AirTrack Overview Access Point(with Sniffer)

Culprit Device Locations:

1. Analogphone @ Room 1042. Analogphone @ Room 1103. FHSS Phone @ Room 1054. ZigBee @ Room 108

Sep 20, 2011 / Mobicom 2011 SRC

13

Device Localization

S1 S2

S3

S1: -40dbS2: -70dbS3: -75db

Use RSSI vector to localize each device

Sep 20, 2011 / Mobicom 2011 SRC

14

How to create RSSI vectors?

Same pulse caught by multiple sniffers

FHSS Pulse

S1

S2

S3

S1: -70dbS2: -60dbS3: -45db

S1: -70db

S2: -60db

S1: -45db

“Merge”

Sep 20, 2011 / Mobicom 2011 SRC

Merge pulses using matching start/end times and center frequency + bandwidth

Synchronize the APs

16

A problem…

FHSS Device 1

FHSS Device 2

We can’t decode non-WiFi pulses

Sep 20, 2011 / Mobicom 2011 SRC

How many devices?Which pulse belongs to what device?

18

How to segregate pulses?

FHSS phoneMerged Pulses

FHSS Pulse Cluster 2

FHSS Pulse Cluster 1• Cluster using• RSSI vector• Timing properties

• Algorithms• DBSCAN• EM + k-Means

Clustering process segregates pulses belonging to different device instances

Sep 20, 2011 / Mobicom 2011 SRC

19

Each “Pulse Cluster” is a device

FHSS Pulse Cluster 2

FHSS Pulse Cluster 1

S1: -40dbS2: -70dbS3: -75db

S1: -70dbS2: -60dbS3: -45db

FHSS Device 1

FHSS Device 2

Each cluster is represented by an RSSI Vector

Sep 20, 2011 / Mobicom 2011 SRC

21

Putting it together…

Synchronize access points

“Tagged Pulses”

Access Point (with Sniffer)

AirTrack

Locate non-WiFi devices using multiple Sniffers

Localize each device

(Pulse Cluster)

Merge + Cluster pulses

Sep 20, 2011 / Mobicom 2011 SRC

22

Putting it together…

Synchronize access points

“Tagged Pulses”

Access Point (with Sniffer)

AirTrack

Locate non-WiFi devices using multiple sniffers

Localize each device

(Pulse Cluster)

Merge + Cluster pulses

Sep 20, 2011 / Mobicom 2011 SRC

23

Localization algorithms• AP locations are known

• Tested various algorithms with different requirements

Algorithm Input Parameters

Fingerprint Known Fingerprints

Sep 20, 2011 / Mobicom 2011 SRC

24

Localization algorithms• AP locations are known

• Tested various algorithms with different requirements

Algorithm Input Parameters

Fingerprint Known Fingerprints

RSS Triangulation Device Transmit Power + Propagation Model

Sep 20, 2011 / Mobicom 2011 SRC

25

Localization algorithms• AP locations are known

• Tested various algorithms with different requirements

Algorithm Input Parameters

Fingerprint Known Fingerprints

RSS Triangulation Device Transmit Power + Propagation Model

Pairwise AP Propagation Model

Sep 20, 2011 / Mobicom 2011 SRC

26

Pairwise AP algorithm

Pairwise AP: S0,S2 Pairwise AP: S3,S5

We can localize without knowing device transmit power

FHSS Cordless Phone

Sep 20, 2011 / Mobicom 2011 SRC

27

Talk Outline• How non-WiFi devices affect WiFi traffic?

• How to detect non-WiFi transmissions using “commodity” WiFi cards?

• How to physically locate these non-WiFi devices?

• Evaluation

Sep 20, 2011 / Mobicom 2011 SRC

28

Clustering results

FHSS Phones Microwave Oven FHSS Phones

Time domain clustering RSS domain clustering

• Each cluster is a unique active device• AirTrack can differentiate between multiple devices

Sep 20, 2011 / Mobicom 2011 SRC

29

Localization Accuracy

Localization error < 6 metres for 80% of the locations

Sep 20, 2011 / Mobicom 2011 SRC

30

Summary

• Presented a system for real-time localization of non-WiFi devices using commodity WiFi cards.

• Localization works in the presence of multiple device instances.

• Don’t require to know the device transmit power for localization.

Sep 20, 2011 / Mobicom 2011 SRC

31

Demo

Sep 20, 2011 / Mobicom 2011 SRC

32

Thank You!!

Sep 20, 2011 / Mobicom 2011 SRC