by Kejia Zhang PowerSpy: Location Tracking using Mobile Device Power Analysis Yan Michalevsky, Aaron Schulman, etc. Stanford University Published in USENIX Security '15
by Kejia Zhang Background r Tracking phones is valuable r GPS, base statuion/WiFi connectivity m Need permission to access r Power consumption m Free to access m Android: /sys/class/power_supply/battery/voltage_now /sys/class/power_supply/battery/current_now
by Kejia Zhang Background r Location ~ Signal strength m Distance to base station m Obstacles r Signal strength dominating power consumption r Location ~ Power Consumption
by Kejia Zhang
Background r Two Nexus 4 on same route
by Kejia Zhang Background r Nexus 4 and Nexus 5 on same route
by Kejia Zhang Works of this paper r Main idea m Knowing location by reading power consumption r Difficulty m Power consumption affected by Components Applications Activities m Can only read aggregate power consumption r Solution m Machine learning sees through noise
by Kejia Zhang Problem definition r Route distinguish m Known Power profiles of all possible routes m Learn Which route is taken r Real-time tracking m Known Which route is taken Route’s power profile m Learn Victim’s location
by Kejia Zhang Problem definition r New route inference m Known Power profiles of many road segments m Learn Victim’s (arbitrary) route
by Kejia Zhang Settings r Attacker m Only access to aggregate power consumption m Communicate with remote server m Prior knowledge of area power profiles r Victim m Moving by a car m Generate low traffic to keep connected
by Kejia Zhang Settings r Hysteresis m Different direction to a location may cause different signal strength m Hysteresis algorithm decides when to hand off to a new base station r Attacker can only use the same travel direction as a power reference
by Kejia Zhang Route distinguish r Known m Power profiles of all possible routes m Each power profile is a time series r Learn m Which route is taken r Difficulty m Different rides on same route vary in speed m Applications and activities add noise
by Kejia Zhang Route distinguish r Dynamic Time Warping m Measure similarity of two time series that are misaligned in time m Time Warping
by Kejia Zhang Route distinguish r DTW m Best alignment
by Kejia Zhang Route distinguish r DTW m Dynamic Programming cell(i,j) = local_distance(i,j) + MIN(cell(i-1,j), cell(i-1,j-1), cell(i, j-1))
by Kejia Zhang Route distinguish r Choose the route with shortest DTW distance
by Kejia Zhang Route distinguish r Normalizing power profile (see through noise)
by Kejia Zhang Real-time tracking r Known m Which route is taken m Route’s power profile r Learn m Victim’s location r Use Subsequence DTW algorithm m Search a sub-sequence in a larger sequence
by Kejia Zhang New route inference r Known m Power profiles of many road segments m Maybe crowd sourcing r Learn m Victim’s (arbitrary) route
by Kejia Zhang New route inference r Road segment m Denote by intersections (x, y) m A device must Complete a segment once it starts Can’t change direction meanwhile m (x, y) is not (y, x)
by Kejia Zhang
New route inference r Model the problem as Hidden Markov Model m State set Q m Transition probability matrix A m Output distribution B={B o,xy } B o,xy : probability of yielding a power profile o while traversing segment (x, y) m Initial state distribution Π={π xy } π xy : probability to start with segment (x, y)
by Kejia Zhang New route inference r Model the problem as Hidden Markov Model m Given Power profile O A, B and Π m Find Route T={s ab, s bc, …} such that p{T | O} is maximized
by Kejia Zhang New route inference r Matching route with particle filter (Monte Carlo approximation) m Pi: Sample set of N routes
by Kejia Zhang New route inference r Matching route with particle filter m Output the route occurs most in P final
by Kejia Zhang Experiments r PowerSpy android application m Run on Nexus 4, Nexus 5, HTC r Diminishing effects of certain activities
by Kejia Zhang Experiments r Route distinguish
by Kejia Zhang Experiments r Real-time tracking
by Kejia Zhang Experiments r New route inference m Training set: 13 intersections and 35 road segments m Pre-recording seesions were done by Nexus 4
by Kejia Zhang Experiments r New route inference m Transition probability marix A Uniformly distributed m Output distribution B Depend on distance between test and record profiles m Initial state distribution Π Starting location is known
by Kejia Zhang Experiments r New route inference m Nexus 4 #1, Nexus 5, HTC desire Normal number of applications m Nexus 4 #2 Large number of applications
by Kejia Zhang Experiments r New route inference
by Kejia Zhang Experiments r New route inference
by Kejia Zhang Experiments r New route inference