1. 1 Robust Statistical Methods for Securing Wireless Localization in Sensor Networks (IPSN ’05) Zang Li, Wade Trappe Yanyong Zhang, Badri Nath Rutgers University Presented by Seung-Min Jung

2. 2 Contents  Introduction  Localization Specific Attacks  Robust Localization Algorithms  Robust Methods – Triangulation & Experiments – RF-Based Fingerprinting & Experiments  Conclusions

3. 3 Introductions(1)  Many sensor applications need the location of wireless devices  Localization infrastructure will become the target of malicious attacks – Localization-specific threats that cannot be address through traditional security services – Need for localization algorithm that are robust to corrupted measurements

4. 4 Introductions(2)  What is the purpose of this paper? – To examine the problem of secure localization – To provide localization-specific, attack-tolerant mechanisms  Basic Idea throughout the paper – To live with bad nodes rather than eliminate the all possible bad nodes  Uniqueness of this paper  Approach of the paper – Robust Statistical Methods for Localization

5. 5 Localization Attacks(1)  Primarily non-cryptographic attacks – Bypass the conventional security countermeasures – c.f.) Cryptographic attack example: Sybil Attack  There are many solutions  Attacks classification by methods – Time of Flight – Signal Strength – Angle of Arrival – Region Inclusion – Hop Count – Neighbor Location

6. 6 Localization Attacks(2)

7. 7 Localization Attacks(3)  Hop-Count Attack Example

8. 8 Robust Localization(1)  Approach: Living with Bad Guys – There is no silver bullet for removing all threats to wireless localization – Make use of the redundancy in the deployment of the localization infra. to provide stability to contaminated measurements

9. 9 Robust Localization(2)  Strategy – Focused localization scheme  Triangulation  RF-Based fingerprinting – Make use of the (statistical) median  as a resilient estimate of the average of aggregated data – Estimate position from physical measurement  e.g.) Signal Strength, Hop Count  Robust statistical method & Less computation overhead

10. 10 Robust Method for Triangulation  Find Device Location by Triangulation Anchor1 (x1,y1) d1 d2 Anchor2 (x2,y2) Wireless device (x0,y0) d3 d4 Anchor3 (x2,y2) Anchor4 (x2,y2) minimum is the wireless device location

11. 11 Review(1)  Regression Analysis Simple Linear Regression Model: Minimize

12. 12 Review(2)  Least Squares (LS) – Find θ that minimize J(θ) – Non-robustness to “outliers” N = total number of samples θ = the parameter to estimate (location) = corresponds to = corresponds to position (xi, yi) of the anchors

13. 13 Review(3)  Residue  Least Median Squares (LMS) – Minimize the median of the residue squares – Robust to outliers – Tolerates up to 50% outliers(errors) – Computation expensive (for exact solution) – Efficient computation  Random subsets of samples to get several candidate  M: # of subset, n: # of samples

14. 14 Robust Method for Triangulation(1)  Attacks – An intruder can disturb the distance d  Change hop count in DV-hop algorithm – A single perturbation can alter the result  Solution – Switch from least squares (LS) estimation to least median squares (LMS) when attacked

15. 15 Robust Method for Triangulation(2)  LMS algorithm – Choose a number of M subsets of size n from the N Samples – Applying LS, find the estimate, j=1, …,M for each subset – Based on the median residual error assign a weight for each  weight=1 if the error is less than a threshold  weight=0 if otherwise – Compute weighted estimated

16. 16 Robust Method for Triangulation(3)  Robust Localization with LMS – When no attack, LS method – When attack, LMS method

17. 17 Robust Method for Triangulation(4)  How to choose n and M for LMS – Idea: at least one subset is “good” (no contamination) with probability: ε = contamination ratio => εN samples are outliers n=4 (3 would be minimum to decide a location) M=20 (depends on computational capabilities) P>=0.99 ε <=30%

18. 18 Robust Method for Triangulation(5)  How to get a location estimate from samples efficiently Nonlinear LS: Linear LS:

19. 19 Robust Method for Triangulation(6)  The comparison between linear LS and nonlinear LS – Use linear LS – reduces computational complexity  As # of samples increase, gap between linear LS and nonlinear LS decrease.

20. 20 Robust Method for Triangulation(7)  Simulation Settings – The strength of the attack: – DV-hop algorithm – N = 30 anchor nodes – Resign: 500 x 500 m 2

21. 21 Robust Method for Triangulation(8) Performance: LS vs. LMS Impact of ε : LS vs. LMS robust up to ε = 30%

22. 22 Robust Method for Triangulation(9)  Example linear regression demonstration => LS performs better than LMS at low attacking strength Outlier data are distinctiveOutlier data are close to inliers

23. 23 Robust Method for Triangulation(10)  An Efficient Switching LS-LMS – The variance indicates the distance between inliers and the outliers – If, apply LMS : normal measurement noise level : estimated data variance T=1.5 T : threshold

24. 24 Robust Method for RF Fingerprinting(1)  Attacks – Corrupted signal strength at one base station  Insert an absorbing barrier between mobile host and base station (e.g. Microwave, Passenger)  Solution – Use a median-based distance metric – “nearest” neighbor: Minimize  RADAR system – in buildings – Multiple base stations

25. 25 Robust Method for RF Fingerprinting(2)  How it works: – Setup phase: form a radio map with signal strengths(fingerprints)  a mobile host broadcasts to base stations  records are written in radio map on central base station and they have the format described below: – (x, y) : mobile position – : received signal strength at the i-th base station – Localization phase: nearest neighbor in signal space (NNSS)  send to central base station  search the radio map and find the best matching fingerprint on central base station Euclidian distance : Median approach:

26. 26 Robust Method for RF Fingerprinting(3) α : attacking strength CDF of error distance for the NNSSMedian of error distance Size: 45m X 25m, 6 base station are installed, 2 base station are attacked α = 0.6

27. 27 Conclusions  As increasing location-based services, localization infrastructure become more vulnerable  To secure localization, this paper – Enumerates a list of attacks that are unique to wireless localization algorithms – Provides robust statistical methods to make localization attack- tolerant  Based on triangulation and RF-based fingerprinting method  Use median approach more robust than the average to outliers

28. 28 Supplements  Median

29. 29 Supplements  Wormhole attack

30. 30 Supplements