Phones today carry sensitive information and have a great number of ways to communicate that data. As a result, malware that steal money, information, or simply disable functionality have hit the app stores. Current security solutions for preventing undesirable data leaks are mostly high-overhead and have not been practical enough for smartphones. In this paper, we show that simply monitoring just some instructions (only memory loads and stores) it is possible to achieve low overhead, highly accurate information flow tracking. Our method achieves 98% accuracy (0% false positive and 2% false negative) over DroidBench and was able to successfully catch seven real-world malware instances that steal phone number, location, and device ID using SMS messages and HTTP connections.

Recent work has shown that network protocols which rely on precisely-timed concurrent transmissions can achieve reliable, energy-efficient, and conceptually simple network flooding. While these multi-transmitter schemes work well, they require all nodes in the network to forward every data packet, which has inherent inefficiencies for non-flooding traffic patterns (where not all nodes need to receive the data). In this work, we formalize the concept of the “useful” forwarder set for point-to-point transmissions in low power multi-transmitter networks, those nodes which help forward data to the destination. We present a mechanism for approximating membership in this set based on simple heuristics. Incorporating forwarder selection on our 66-node testbed reduced radio duty cycle by 30% and increased throughput by 49% relative to concurrent flooding while preserving a 99.4% end-to-end packet reception ratio under the collection traffic pattern. We envision forwarder selection as a fundamental task in an efficient multi-transmitter networking stack. This work demonstrates that adding forwarder selection can improve energy efficiency and throughput while providing similar end-to-end packet delivery rates to flooding.

The major challenge for accurate fingerprint-based indoor localization is the design of robust and discriminative wireless signatures. Even though WiFi received signal strength indicator (RSSI) signatures are widely available indoors, they vary significantly over time and are susceptible to human presence, multipath, and fading due to the high operating frequency. To overcome these limitations, we propose to use FM broadcast radio signals for robust indoor fingerprinting. Because of the lower frequency, FM signals are less susceptible to human presence, multipath, and fading, they exhibit exceptional indoor penetration, and according to our experimental study they vary less over time when compared to WiFi signals. In this paper, we demonstrate through a detailed experimental study in three different buildings across the US, that FM radio signal RSSI values can be used to achieve room-level indoor localization with similar or better accuracy to the one achieved by WiFi signals. Furthermore, we propose to use additional signal quality indicators at the physical layer (i.e., SNR, multipath, etc.) to augment the wireless signature, and show that localization accuracy can be further improved by more than 5 percent. More importantly, we experimentally demonstrate that the localization errors of FM and WiFi signals are independent. When FM and WiFi signals are combined to generate wireless fingerprints, the localization accuracy increases as much as 83 percent (when accounting for wireless signal temporal variations) compared to when WiFi RSSI only is used as a signature.

The major challenge for accurate fingerprint-based indoor localization is the design of robust and discriminative wireless signatures. Even though WiFi RSSI signatures are widely available indoors, they vary significantly over time and are susceptible to human presence, multipath, and fading due to the high operating frequency. To overcome these limitations, we propose to use FM broadcast radio signals for robust indoor fingerprinting. Because of the lower frequency, FM signals are less susceptible to human presence, multipath and fading, they exhibit exceptional indoor penetration, and according to our experimental study they vary less over time when compared to WiFi signals. In this work, we demonstrate through a detailed experimental study in 3 different buildings across the US, that FM radio signal RSSI values can be used to achieve room-level indoor localization with similar or better accuracy to the one achieved by WiFi signals. Furthermore, we propose to use additional signal quality indicators at the physical layer (i.e., SNR, multipath etc.) to augment the wireless signature, and show that localization accuracy can be further improved by more than 5%. More importantly, we experimentally demonstrate that the localization errors of FM andWiFi signals are independent. When FM and WiFi signals are combined to generate wireless fingerprints, the localization accuracy increases as much as 83% (when accounting for wireless signal temporal variations) compared to when WiFi RSSI only is used as a signature.

Biking is one of the most efficient and environmentally friendly ways to control weight and commute. To precisely estimate caloric expenditure, bikers have to install a bike computer or use a smartphone connected to additional sensors such as heart rate monitors worn on their chest, or cadence sensors mounted on their bikes. However, these peripherals are still expensive and inconvenient for daily use. This work poses the following question: is it possible to use just a smartphone to reliably estimate cycling activity? We answer this question positively through a pocket sensing approach that can reliably measure cadence using the phone's on-board accelerometer with less than 2% error. Our method estimates caloric expenditure through a model that takes as inputs GPS traces, the USGS elevation service, and the detailed road database from OpenStreetMap. The overall caloric estimation error is 60% smaller than other smartphone-based approaches. Finally, the smartphone can aggressively duty-cycle its GPS receiver, reducing energy consumption by 57%, without any degradation in the accuracy of caloric expenditure estimates. This is possible because we can recover the bike's route, even with fewer GPS location samples, using map information from the USGS and OpenStreetMap databases.

We present A-MAC, a receiver-initiated link layer for low-power wireless networks that supports several services under a unified architecture, and does so more efficiently and scalably than prior approaches. A-MAC's versatility stems from layering unicast, broadcast, wakeup, pollcast, and discovery above a single, flexible synchronization primitive. A-MAC's efficiency stems from optimizing this primitive and with it the most consequential decision that a low-power link makes: whether to stay awake or go to sleep after probing the channel. Today's receiver-initiated protocols require more time and energy to make this decision, and they exhibit worse judgment as well, leading to many false positives and negatives, and lower packet delivery ratios. A-MAC begins to make this decision quickly, and decides more conclusively and correctly in both the negative and affirmative. A-MAC's scalability comes from reserving one channel for the initial handshake and different channels for data transfer. Our results show that: (i) a unified implementation is possible; (ii) A-MAC's idle listening power increases by just 1.12× under interference, compared to 17.3× for LPL and 54.7× for RI-MAC; (iii) A-MAC offers high single-hop delivery ratios; (iv) network wakeup is faster and more channel efficient than LPL; and (v) collection routing performance exceeds the state-of-the-art.

IEEE 802.15.4 links can be classified into three distinct reception regions: connected, transitional, and disconnected. The transitional region is large in size and characterized by the existence of links with intermediate reception ratios. Our work leverages previous work on understanding the properties of wireless links in the space and time domains but differs in the sense that we seek opportunities to actively adjust the physical topologies of sensor networks to improve link quality. Based on an existing theoretical model supported by extensive experiments in a variety of environments, we propose an efficient mechanism to identify locations with high reception ratios in the transitional region. The proposed mechanism can be used to effectively construct long, yet high reception ratio links that are 100% longer than the size of the connected region, thereby reducing the number of relay nodes necessary to interconnect sparse sensor networks by 34%. Furthermore, this mechanism can help better position mobile sinks and guide the communication protocols for mobile sensor networks. Overall, this paper provides fresh insights into the implications of the log-normal path loss model on deploying and moving sensor motes.

We present the design of the Tempo mote that operates on ambient energy harvested from the environment. Equipped with a ultra low-power timing module that acquires Coordinated Universal Time (UTC) information from a longrange radio transmitter, Tempo can persistently access the global time and is thereby resilient to power outages. A prototype implementation of the Tempo mote shows that it achieves millisecond level accuracy at 100 μA current draw. We argue that one can more generally leverage the access to global time across all nodes of a wireless sensor network to overcome the challenges related to the very tight energy budget that is inherent with harvesting ambient energy.

We present A-MAC, a receiver-initiated link layer for low-power wireless networks that supports several services under a unified architecture, and does so more efficiently and scalably than prior approaches. A-MAC's versatility stems from layering unicast, broadcast, wakeup, pollcast, and discovery above a single, flexible synchronization primitive. A-MAC's efficiency stems from optimizing this primitive and with it the most consequential decision that a low-power link makes: whether to stay awake or go to sleep after probing the channel. Today's receiver-initiated protocols require more time and energy to make this decision, and they exhibit worse judgment as well, leading to many false positives and negatives, and lower packet delivery ratios. A-MAC begins to make this decision quickly, and decides more conclusively and correctly in both the negative and affirmative. A-MAC's scalability comes from reserving one channel for the initial handshake and different channels for data transfer. Our results show that: (i) a unified implementation is possible; (ii) A-MAC's idle listening power increases by just 1.12x under interference, compared to 17.3x for LPL and 54.7x for RI-MAC; (iii) A-MAC offers high single-hop delivery ratios, even with multiple contending senders; (iv) network wakeup is faster and far more channel efficient than LPL; and (v) collection routing performance exceeds the state-of-the-art.

Staff shortages and an increasingly aging population are straining the ability of emergency departments to provide high quality care. At the same time, there is a growing concern about hospitals' ability to provide effective care during disaster events. For these reasons, tools that automate patient monitoring have the potential to greatly improve efficiency and quality of health care. Towards this goal, we have developed MEDiSN , a wireless sensor network for monitoring patients' physiological data in hospitals and during disaster events. MEDiSN comprises Physiological Monitors (PMs), which are custom-built, patient-worn motes that sample, encrypt, and sign physiological data and Relay Points (RPs) that self-organize into a multi-hop wireless backbone for carrying physiological data. Moreover, MEDiSN includes a back-end server that persistently stores medical data and presents them to authenticated GUI clients. The combination of MEDiSN's two-tier architecture and optimized rate control protocols allows it to address the compound challenge of reliably delivering large volumes of data while meeting the application's QoS requirements. Results from extensive simulations, testbed experiments, and multiple pilot hospital deployments show that MEDiSN can scale from tens to at least five hundred PMs, effectively protect application packets from congestive and corruptive losses, and deliver medically actionable data.

Staff shortages and an increasingly aging population are straining the ability of emergency departments to provide high-quality care. Moreover, there is a growing concern about the ability of hospitals to provide effective care during disaster events. Tools that automate patient monitoring would greatly improve efficiency, quality of care, and the volume of patients treated. Towards this goal, we have developed MEDiSN, a wireless sensor network for monitoring patients' vital signs in hospitals and disaster events. MEDiSN consists of Patient Monitors which are custom-built, patient-worn motes that sample, compress and secure medical data, and Relay Points that form a static multi-hop wireless backbone for carrying patient data. Moreover, MEDiSN includes a back-end server that persistently stores medical data and presents them to multiple GUI clients. MEDiSN's heterogeneous architecture enables it to address the compound challenge of reliably delivering large volumes of data while meeting the application's QoS requirements.