1. by Kejia Zhang PowerSpy: Location Tracking using Mobile Device Power Analysis Yan Michalevsky, Aaron Schulman, etc. Stanford University Published in USENIX Security '15

2. by Kejia Zhang Background r Tracking phones is valuable r GPS, base statuion/WiFi connectivity m Need permission to access r Power consumption m Free to access m Android: /sys/class/power_supply/battery/voltage_now /sys/class/power_supply/battery/current_now

3. by Kejia Zhang Background r Location ~ Signal strength m Distance to base station m Obstacles r Signal strength dominating power consumption r Location ~ Power Consumption

4. by Kejia Zhang

5. Background r Two Nexus 4 on same route

6. by Kejia Zhang Background r Nexus 4 and Nexus 5 on same route

7. by Kejia Zhang Works of this paper r Main idea m Knowing location by reading power consumption r Difficulty m Power consumption affected by Components Applications Activities m Can only read aggregate power consumption r Solution m Machine learning sees through noise

8. by Kejia Zhang Problem definition r Route distinguish m Known Power profiles of all possible routes m Learn Which route is taken r Real-time tracking m Known Which route is taken Route’s power profile m Learn Victim’s location

9. by Kejia Zhang Problem definition r New route inference m Known Power profiles of many road segments m Learn Victim’s (arbitrary) route

10. by Kejia Zhang Settings r Attacker m Only access to aggregate power consumption m Communicate with remote server m Prior knowledge of area power profiles r Victim m Moving by a car m Generate low traffic to keep connected

11. by Kejia Zhang Settings r Hysteresis m Different direction to a location may cause different signal strength m Hysteresis algorithm decides when to hand off to a new base station r Attacker can only use the same travel direction as a power reference

12. by Kejia Zhang Route distinguish r Known m Power profiles of all possible routes m Each power profile is a time series r Learn m Which route is taken r Difficulty m Different rides on same route vary in speed m Applications and activities add noise

13. by Kejia Zhang Route distinguish r Dynamic Time Warping m Measure similarity of two time series that are misaligned in time m Time Warping

14. by Kejia Zhang Route distinguish r DTW m Best alignment

15. by Kejia Zhang Route distinguish r DTW m Dynamic Programming cell(i,j) = local_distance(i,j) + MIN(cell(i-1,j), cell(i-1,j-1), cell(i, j-1))

16. by Kejia Zhang Route distinguish r Choose the route with shortest DTW distance

17. by Kejia Zhang Route distinguish r Normalizing power profile (see through noise)

18. by Kejia Zhang Real-time tracking r Known m Which route is taken m Route’s power profile r Learn m Victim’s location r Use Subsequence DTW algorithm m Search a sub-sequence in a larger sequence

19. by Kejia Zhang New route inference r Known m Power profiles of many road segments m Maybe crowd sourcing r Learn m Victim’s (arbitrary) route

20. by Kejia Zhang New route inference r Road segment m Denote by intersections (x, y) m A device must Complete a segment once it starts Can’t change direction meanwhile m (x, y) is not (y, x)

21. by Kejia Zhang

22. New route inference r Model the problem as Hidden Markov Model m State set Q m Transition probability matrix A m Output distribution B={B o,xy } B o,xy : probability of yielding a power profile o while traversing segment (x, y) m Initial state distribution Π={π xy } π xy : probability to start with segment (x, y)

23. by Kejia Zhang New route inference r Model the problem as Hidden Markov Model m Given Power profile O A, B and Π m Find Route T={s ab, s bc, …} such that p{T | O} is maximized

24. by Kejia Zhang New route inference r Matching route with particle filter (Monte Carlo approximation) m Pi: Sample set of N routes

25. by Kejia Zhang New route inference r Matching route with particle filter m Output the route occurs most in P final

26. by Kejia Zhang Experiments r PowerSpy android application m Run on Nexus 4, Nexus 5, HTC r Diminishing effects of certain activities

27. by Kejia Zhang Experiments r Route distinguish

28. by Kejia Zhang Experiments r Real-time tracking

29. by Kejia Zhang Experiments r New route inference m Training set: 13 intersections and 35 road segments m Pre-recording seesions were done by Nexus 4

30. by Kejia Zhang Experiments r New route inference m Transition probability marix A Uniformly distributed m Output distribution B Depend on distance between test and record profiles m Initial state distribution Π Starting location is known

31. by Kejia Zhang Experiments r New route inference m Nexus 4 #1, Nexus 5, HTC desire Normal number of applications m Nexus 4 #2 Large number of applications

32. by Kejia Zhang Experiments r New route inference

33. by Kejia Zhang Experiments r New route inference

34. by Kejia Zhang Experiments r New route inference