POWERSPY LOCATION TRACKING USING MOBILE DEVICE POWER ANALYSIS 1 Yan Michalevsky (1) , Gabi Nakibly (2) , Dan Boneh (1) and Aaron Schulman (1) (1) Stanford University, (2) National Research and Simulation Center, Rafael Ltd. Presented by Brad Holliday
25
Embed
POWERSPY LOCATION TRACKING USING MOBILE DEVICE POWER ANALYSIS 1 Yan Michalevsky (1), Gabi Nakibly (2), Dan Boneh (1) and Aaron Schulman (1) (1) Stanford.
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
1
POWERSPYLOCATION TRACKING USING MOBILE DEVICE POWER ANALYSIS
Yan Michalevsky(1), Gabi Nakibly(2), Dan Boneh(1) and Aaron Schulman(1)
(1) Stanford University, (2) National Research and Simulation Center, Rafael Ltd.
Presented byBrad Holliday
2
SMARTPHONE LOCATION ≈ OWNER LOCATION
3
ACCESSING LOCATION Even coarse location based on cellular network information
SIGNAL STRENGTH DEPENDS ON GEOGRAPHY AND ENVIRONMENT
7
SIGNAL STRENGTH STABILITY
Signal strength profiles measured on two different days are stable
8
POWER PROFILE CONSISTENCY
Two Phones Same Model,
Same Drive
Different Models, Same Drive
9
WHAT CAN WE ACHIEVE BY THAT?
1. Route distinguishability
3. New route inference
2. Real-time motion tracking
10
RELATED WORK Power analysis = powerful side channel
High sample rate power traces for externally connected power monitors to recover private encryption keys from a cryptographic system
KOCHER, P., JAFFE, J., AND JUN, B. Differential power analysis. In Advances in Cryptology – CRYPTO’99 (1999), Springer, pp. 388–397.
Relationship between signal strength and power consumption in smartphones
Bartendr: demonstrated that paths of signal strength measurements are stable across several drives
SCHULMAN, A., SPRING, N., NAVDA, V., RAMJEE, R., DESHPANDE, P., GRUNEWALD, C., PADMANABHAN, V. N., AND JAIN, K. Bartendr: a practical approach to energy-aware cellular data scheduling. MOBICOM (2010)
11
1. ROUTE DISTINGUISHABILITY Collection of power consumption profiles
Each power profile is a time-series
Classifier based on time series comparison using Dynamic Time Warping (DTW)
Profiles have different baselines and variability, so clean up prior to DTW
Normalization: Calculate mean and subtract it, and divide the result by the standard deviation
Smoothing: using a moving average filter to reduce noise Down sample: by a factor of 10 to reduce computational
complexity
12
DYNAMIC TIME WARPING
Euclidian Distance DTW Distance
13
A CLASSIFICATION PROBLEM Compute the DTW distance between the new power profile
and all reference profiles
Select the known route that yields the minimal distance
14
DISTINGUISH BETWEEN ROUTES RESULTS
UniqueRoutes
# Ref.Profiles/Route
# TestRoutes
Success%
RandomGuess %
8 10 55 85 13
17 5 119 71 6
17 4 136 68 6
21 3 157 61 5
25 2 182 53 4
29 1 211 40 3
15
2. REAL-TIME TRACKING 1. A window of received samples is a subsequence of the
reference power profile
2. Infer location from reference profile
3. Route is known
3 Approaches Tracking via Dynamic Time Warping (DTW)
Improved tracking via a motion model
Tracking using Optimal Subsequence Bijection (OSB)
16
IMPROVED TRACKING USING A SIMPLE MOTION MODEL ALGORITHM
locked false //Are we locked on target?
while target moving do
loc[i], score estimateLocation()
d getDistance(loc[i], loc[i – 1])
if locked and d > MAX_DISP then
loc[i] loc [i – 1] //Resume previous estimate
end if
if score > THRESHOLD then
locked true
end if
end while
17
OPTIMAL SUBSEQUENCE BIJECTION Similar to DTW
DTW assumes the reference profile contains no noise
OSB deals with noise in either the reference profile or target sequence
Can skip elements in either sequence
18
REAL-TIME MOBILE DEVICE TRACKING RESULTS
19
3. NEW ROUTE INFERENCE Future potential routes are not explicitly known
Goal: Identify the final location after it traverses and unknown route
Assumption: Know the general area
Pre-record power profiles of all road segments
Given the power profile of the tracked device, reconstruct the unknown route
20
HYSTERESIS Hysteresis algorithm is used to decide when to hand-off to
a new base station
When a signal strength threshold is reached it will hand-off to a new station
Results: Two phones in the same location can be attached to two different base stations
21
PARTICLE FILTER
22
INFERENCE OF NEW ROUTES RESULTS
Random Frequent Alg. 3 Combined
Nexus 4 #1 33% 65% 48% 80%
Nexus 4 #2 31% 48% 56% 72%
Nexus 5 20% 33% 32% 55%
HTC Desire 22% 40% 41% 65%
23
PAPER STRENGTHS Proof of concept
Novel approach
Successful results
Machine learning is powerful
24
PAPER WEAKNESSES Too much “pre” information and assumption required
Too many variables
Device typeCellular service providerApplications likely to be used by the target