Attack Detection in Wireless Localization Yingying Chen Chen Yingying Dept. of Computer Science, Rutgers University Dept. of Computer Science, Rutgers University Wireless Information Network Laboratory (WINLAB) Wireless Information Network
SLIDE 1
Attack Detection in Wireless Localization
Yingying Yingying Chen Chen
Dept. of Computer Science, Rutgers University
Dept. of Computer Science, Rutgers University
Wireless Information Network Laboratory (WINLAB) Wireless Information Network Laboratory (WINLAB)
Joint work with Prof. Wade Trappe and Prof. Richard P. Martin Joint work with Prof. Wade Trappe and Prof. Richard P. Martin WINLAB IAB WINLAB IAB Spring 2007 Spring 2007
SLIDE 2
I ntroduction
What is localization? What is localization?
Simply to find the position of a wireless device or a sensor Simply to find the position of a wireless device or a sensor node. node.
Attention is on Received Attention is on Received Signal Strength (RSS) Signal Strength (RSS)-
based
based localization techniques localization techniques
Reuse the existing Reuse the existing communication infrastructure communication infrastructure Tremendous cost savings Tremendous cost savings
Adversary may affect the Adversary may affect the receive signal power by: receive signal power by:
Alter transmit power of nodes Alter transmit power of nodes Remove direct path by Remove direct path by introducing obstacles introducing obstacles Introduce absorbing or Introduce absorbing or attenuating material attenuating material Introduce ambient channel Introduce ambient channel noise noise
Distance Power Received d1 r1 r2 d2
Absorbing Material
SLIDE 4
Feasibility of Signal Strength Attacks
Attenuate or amplify RSS Attenuate or amplify RSS Materials Materials – – easy to access easy to access Attacks Attacks – – simple to simple to perform with low cost perform with low cost
Attack the wireless node Attack the wireless node Compromise the landmarks Compromise the landmarks
Easy to control attack Easy to control attack effects effects
Simply choose different Simply choose different materials materials
SLIDE 5
Motivation: Secure Localization
The localization infrastructure can become the target The localization infrastructure can become the target
f
f malicious attacks
malicious attacks
Location Location-
based services become more prevalent
based services become more prevalent Cryptographic attacks Cryptographic attacks – – addressed by authentication addressed by authentication Non Non-
conventional security threats
conventional security threats (non (non-
cryptographic attacks)
cryptographic attacks)
SLIDE 6
Outline
Introduction and motivation Introduction and motivation Background Background A generalized attack detection model A generalized attack detection model Common features in RSS Common features in RSS-
based methods
based methods Test statistic in Test statistic in multilateration multilateration methods methods Experimental evaluation Experimental evaluation Conclusion Conclusion Related work Related work
SLIDE 7
[-35,-68,-56]
RSS Reading (x?,y?)
[(x,y),s1,s2,s3] [(x,y),s1,s2,s3]
(x2,y2) (x1,y1) (x3,y3) time t
Background
Transmit packets at Transmit packets at unknown unknown location location Landmarks Landmarks Receive packets Receive packets Or the other way around Or the other way around Modality Modality
Received Signal Strength (RSS) Received Signal Strength (RSS) Time Time-
Of
Of-
Arrival (TOA)
Arrival (TOA) Angle Angle-
Of
Of-
Arrival (AOA)
Arrival (AOA)
Principle Principle to compute position to compute position
Lateration Lateration Angulation Angulation Scene (fingerprint) matching Scene (fingerprint) matching Training data/radio map Training data/radio map Probabilistic Probabilistic
Formulate as statistical significance testing Formulate as statistical significance testing
Null hypothesis: Null hypothesis:
H H0
0: normal (no attack)
: normal (no attack)
Test statistic Test statistic T T
Acceptance region Acceptance region
If , no attack If , no attack If , declare an attack is present If , declare an attack is present
Significance testing with Significance testing with significance level significance level α
α
Ω
SLIDE 9
Effectiveness of Attack Detection
Cumulative Distribution Function (CDF) of the Cumulative Distribution Function (CDF) of the test statistic test statistic T T Detection Rate (DR) Detection Rate (DR)
Plot of attack detection accuracy against the false Plot of attack detection accuracy against the false positive rate positive rate Measure the Measure the tradeoff tradeoff between the false between the false-
positive and
positive and correct detections correct detections
SLIDE 10
Choosing a Test Statistic
Signal Signal-
strength based algorithms
strength based algorithms – – range range-
based and
based and scene matching scene matching
Reuse the existing wireless infrastructure Reuse the existing wireless infrastructure – – tremendous cost tremendous cost savings savings Common feature: Common feature: distance in signal space distance in signal space Area based Probability (ABP) Area based Probability (ABP)
Bayes Bayes’ ’ rule to compute the likelihood of an RSS matching a rule to compute the likelihood of an RSS matching a fingerprint for each area fingerprint for each area
Bayesian Networks (BN) Bayesian Networks (BN)
Use Bayesian Graphical Model to predict the sampling distributio Use Bayesian Graphical Model to predict the sampling distribution n
f the possible location
f the possible location
Multilateration Multilateration methods methods – – single and multi single and multi-
hop range
hop range-
based
based
Non Non-
linear Least Squares (NLS)
linear Least Squares (NLS) Linear Least Squares (LLS) Linear Least Squares (LLS)
SLIDE 11
Test Statistic: Distance in Signal Space
Key advantage Key advantage -
attack detection before localization
attack detection before localization
Physical Space (D) Signal Space (R) F G
: a single point or a region
distance error perturbation distance distance error under attack
DS
D
DS
S as a test statistic
as a test statistic
If
If D DS
S ﹥τ
﹥τ for a given for a given α α, RSS readings under attack , RSS readings under attack
Choosing a threshold
Choosing a threshold ( (τ τ): ): empirical methodology vs. statistical modeling empirical methodology vs. statistical modeling
SLIDE 12
Test Statistic for Multilateration Methods
Using Least Squares
Ranging step: Ranging step:
Distance estimation between unknown node and Distance estimation between unknown node and landmarks landmarks Various methods available: RSS, TOA, hop count Various methods available: RSS, TOA, hop count
Lateration Lateration step: step:
Traditional: Non Traditional: Non-
linear Least squares (NLS)
linear Least squares (NLS) Linear Least squares (LLS) Linear Least squares (LLS)
SLIDE 13
Test Statistic: The Residuals
Localization with LLS Localization with LLS
Linear regression: Linear regression: Location estimation: Location estimation:
Define the residuals Define the residuals Assume they follow a multivariate Gaussian Assume they follow a multivariate Gaussian distribution: ~ distribution: ~ N( N(μ μ, , Σ Σ) ) Choose the residuals as the test statistic Choose the residuals as the test statistic T T for for attack detection attack detection
SLIDE 14
The Detection Scheme
Perform after the localization phase Perform after the localization phase An observed value: An observed value: Model the residuals as multivariate Gaussian Model the residuals as multivariate Gaussian random variables: random variables: Acceptance Region: Acceptance Region: Under attack, if Under attack, if (significance level)
(significance level)
SLIDE 15
Experimental Setup:
(Two buildings: CoRE Building and I ndustrial Lab)
Floor plan:
Floor plan: 200ft x 80ft (16000 ft 200ft x 80ft (16000 ft2
2)
)
802.11 (
802.11 (WiFi WiFi) Network ) Network
802.15.4 (
802.15.4 (ZigBee ZigBee) Network ) Network
Floor plan:
Floor plan: 225ft x 144ft (32400 ft 225ft x 144ft (32400 ft2
2)
)
802.11 (
802.11 (WiFi WiFi) Network ) Network
SLIDE 16
Comparison
Statistical Significance Testing: generic and specific test statistics
Performance: similar detection rates!
SLIDE 17
Receiving Operating Characteristic (ROC)
Using LLS Residuals
A closer look: A closer look: CoRE CoRE, , 802.11 network, 802.11 network, α = 0.01 Impact of small attacks: ~ 1.55 ft/dB
SLIDE 18
Summary
Generic Generic approach approach
Across algorithms, networks, and buildings Across algorithms, networks, and buildings
Effectiveness Effectiveness of our attack detection schemes
f our attack detection schemes
High detection rates, over 95% High detection rates, over 95% (attacks > 15dB)
Distance bounding protocols [Brands 1994, Distance bounding protocols [Brands 1994, Sastry Sastry 2003] 2003] Verifiable Verifiable multilateration multilateration mechanisms [ mechanisms [Capkun Capkun Infocom Infocom 2005] 2005] Hidden and mobile base stations [ Hidden and mobile base stations [Capkun Capkun Infocom Infocom 2006] 2006] Directional antennas and distance bounding [ Directional antennas and distance bounding [Lazos Lazos IPSN 2005] IPSN 2005] Eliminate attack efforts using data redundancy or neighbor Eliminate attack efforts using data redundancy or neighbor information [Li IPSN 2005, Liu IPSN 2005, Liu ICDCS 2005, Du information [Li IPSN 2005, Liu IPSN 2005, Liu ICDCS 2005, Du IPDPS 2005] IPDPS 2005]
