SurFi: Detecting Surveillance Camera Looping Attacks with Wi-Fi Channel State Information Nitya Lakshmanan * , Inkyu Bang + , Min Suk Kang * , Jun Han * , Jong Taek Lee # * National University of Singapore, + Agency for Defense Development, # Electronics and Telecommunications Research Institute + research done while working in NUS
Surveillance cameras are now everywhere 2
Surveillance camera looping attack Place of interest Surveillance system Surveillance system Video shows Video shows a normal a normal activity! activity! valuable video feed security guard security guard 3
Surveillance camera looping attack Place of interest Surveillance system Surveillance system Video shows Video shows a normal a normal activity! activity! valuable video feed security guard security guard No activity 4
Surveillance camera looping attack Place of interest Surveillance system Surveillance system Video shows Video shows a normal a normal activity! activity! valuable video feed looped ! security guard security guard No activity Looped 5
Surveillance camera looping attack Place of interest Surveillance system Surveillance system Video shows Video shows a normal a normal activity! activity! valuable video feed looped ! security guard security guard Robbery No activity Looped Reality Seen by the guard 6
Surveillance camera looping is a reality now Looping Surveillance Cameras Exploiting Surveillance Cameras like in the movies Like a Hollywood Hacker DefCon 2015 BlackHat 2013 Live video Replayed image Modified timestamp 7
Mitigation of camera looping attack is hard Surveillance camera with Video frame comparison integrity protection Live (3 pm) This morning (10 am) Not robust against an adversary Incur prohibitive cost who can manipulate the video 8
Mitigation of camera looping attack is hard Surveillance camera with Video frame comparison integrity protection Live (3 pm) This morning (10 am) Can we mitigate the camera looping attack effectively at no extra hardware cost? Not robust against an adversary Incur prohibitive cost who can manipulate the video 9
SurFi (Surveillance with Wi-Fi) detects camera looping attack Video shows a normal activity! valuable video feed looped ! security guard channel state SurFi information (CSI) Compare Wi-Fi receiver Place of interest Surveillance system No extra Low false alarms hardware cost 10
SurFi (Surveillance with Wi-Fi) detects camera looping attack Video shows a normal activity! valuable video feed looped ! security guard SurFi achieves attack detection accuracy of 98.8% and Video and false positive rate of 0.1% CSI shows a channel state SurFi normal information (CSI) activity! Compare Wi-Fi receiver Place of interest Surveillance system No extra Low false alarms hardware cost 11
System model: indoor space under video surveillance Field-of-view ✓ Place of interest such as bank or jewelry store ✓ Field-of-view of the camera ✓ CSI measurement cannot be compromised Place of interest 12
Threat model: adversary can loop surveillance video feed Field-of-view ✓ Manipulate video feed ✓ Evade detection of his unauthorized activities Place of interest 13
Challenge: video and CSI signals are different Video CSI ✓ Displacement of body keypoints (e.g., wrist, ✓ Amplitude of subcarriers elbow)
Challenge: video and CSI signals are different Video CSI How to find common attributes for reliable comparison of two different sensing modalities? ✓ Displacement of body keypoints (e.g., wrist, ✓ Amplitude of subcarriers elbow)
Main intuition: Both signals capture the similar timing and frequency components • • Frequency component: Prominent Timing components: Start and end frequency time of the activity End time Start time Prominent frequency 16
Main intuition: Both signals capture the similar timing and frequency components • • Frequency component: Prominent Timing components: Start and end frequency time of the activity Reliable detection observed consistently across different activities, people, and times End time Start time Prominent frequency 17
System design of SurFi looped or not ? Data Pre- Attribute extraction Comparison Decision processing module module module module New Event (i) detected Event(1), S(1) Video Compute … attributes similarity Live video CSI event score Event(i), feed OpenPose detector module ( S(i) ) S(i) … CSI Event(N), attributes S(N) Wi-Fi CSI Denoise signal 18
1) Data preprocessing module: Preprocesses the raw video and CSI signals Video OpenPose 19
1) Data preprocessing module: Preprocesses the raw video and CSI signals Raw video signal Processed video signal Video OpenPose Raw CSI signal Processed CSI signal ✓ Filter high frequency CSI Denoise noises 20
2) CSI event detector module: Uses the motion energy to detect the start of a new event 1) Data pre- processing module 2) CSI event detector Start module 21
3) Attribute extraction module: Extracts common attributes Video Time Frequency Prominent Start time End time frequency CSI Time Frequency 22
4) Comparison module: Computes the per-event similarity score of a single event Per-attribute threshold Video 1 Time 0 Frequency 1 Prominent ∑ Compare Start time End time frequency 0 Per-event similarity score S(i) 1 [0, 3] 0 CSI Time Frequency 23
5) Decision module: Outputs looped or not after observing multiple events Event 1, S(1) Event 2, S(2) Not looped Decision Event 3, S(3) Compare S(i) are averaged threshold Looped Event 4, S(4) Event 5, S(5) The more the events seen, the higher the confidence for the final decision 24
Experiment setup Place of interest • Redmi Note 4 phone camera (13- Megapixel) receiver transmitter • Wi-Fi transmitter receiver pair 2.6-meter Wi-Fi Wi-Fi set up on Thinkpad laptops running Linux 802.11n CSI tools participant 4.9-meter 25
Three events ( E 1 ) ( E 2 ) ( E 3 ) stand/arm waving sit/clapping sit/fist thumping 26
Clear difference in the per-event similarity Legit: High similarity score Attack: Low similarity score 27
Multiple events are observed for a duration of time Example: 25 sec 15 sec 30 sec 23 sec 10 sec 10 sec 15 sec 13 sec 25 sec Time 28
Attack detection accuracy increases with more events 5 events 98.8% 1 event 36% 29
Future improvements • Stronger adversary • Performs criminal activities while replicating start + end times, prominent frequency of legitimate events • Future work: Investigate more attributes • Multiple events in sequence • Future work: Activity recognition techniques 30
Deployment consideration 1 1 1 • Threshold calibration 0 0 0 • Adjust to the new environment Not looped Looped • Placement of the receiver behind-the-wall activities • Strategically placing the receiver way from the wall Wi-Fi Wi-Fi 31
Conclusion • First practical system to detect surveillance camera looping attack in real-time • Defense technique requiring no additional hardware deployment • Attack detection accuracy of 98.8% with false positive rate of 0.1% • Future work : more diverse events, sophisticated adversary model 32
Video shows a normal activity! valuable video feed looped ! security guard channel state information SurFi (CSI) Compare Wi-Fi receiver Place of interest Surveillance system Questions? nityalak@comp.nus.edu.sg 33
Extra Slides 34
Activities behind-the-wall may degrade the performance of SurFi Far Near Middle behind-the-wall receiver transmitter receiver receiver Wi-Fi Wi-Fi Wi-Fi Wi-Fi Conduct experiments to test behind-the-wall activities. 35
Strategically placing the receiver at a certain distance from the wall will minimize false alarms ✓ Varying motion energy may lead to false detection of an activities. ✓ Activities are not detected since the corresponding motion energy is close to zero. 36
Recommend
More recommend
