Many sensing tasks, such as plant stress sensing and blood pressure estimation, require co-located multi-modal measurements from two to five sensors at one site. RF backscatter enables low-power sensing, but existing tags usually support only one sensor; using multiple tags increases footprint and antenna coupling. We present Matrix, a fully-analog single-chain backscatter tag that supports multiple onboard sensors by multiplexing them into a composite voltage for transmission through one analog modulation chain. Unlike time-division polling, which introduces inter-sensor sampling offsets, or frequency-division, which requires separate chains, Matrix uses voltage-division multiplexing. Each sensor is encoded as a PWM waveform whose duty cycle represents the measurement, while amplitude enables multiplexing. Binary-weighted voltage-division weights make each active-sensor set uniquely invertible for reliable demultiplexing. The composite voltage is then converted into backscatter frequency shifts through the same chain. At the receiver, Matrix uses a Hidden Markov Model to recover per-sensor readings. Its ASIC consumes 25.56μW. A five-sensor prototype achieves 20 dB average reconstruction SNR at 30 kHz sampling, and we validate Matrix in plant sensing, health monitoring, and microphone-based direction finding.

Touchscreen interfaces have become ubiquitous in modern household appliances, yet they remain largely inaccessible to the blind due to their lack of tactile feedback. Existing accessibility solutions, such as tactile overlays, remote control applications, and proximity-based interfaces, suffer from failing to capture real-time appliance states, limited generalizability, indirect interactions, or strong environmental dependencies. In this work, we introduce SingSprite a novel appliance interaction system that allows blind users to seamlessly identify and control appliances by recognizing their unique acoustic signatures. The key insight is that many appliances emit distinct, device-specific humming sounds during operation, primarily generated by internal power supply components. SingSprite captures these acoustic fingerprints using commodity smartphone microphones, applying a tailored background noise cancellation scheme to enhance signal clarity. To address the issue of low mobile sampling rates, we integrate a Variational Mode Decomposition (VMD) approach with an autoencoder framework for effective feature extraction. The HumNet classifier, which concurrently classifies appliance types and operational states, demonstrates robust performance with an F1 score of 0.95 across a diverse set of 100 appliances. Additionally, user studies conducted with blind participants confirm the system’s usability and its practical effectiveness in real-world scenarios. Additionally, user studies conducted with blind participants confirm the system’s usability and its practical effectiveness in real-world scenarios.SingSprite offers a hardware-free and scalable accessibility solution, providing proximity-aware interaction in smart homes without the need for additional infrastructure, paving the way for more inclusive and intuitive environments for blind users. Using natural device acoustics, SingSprite pioneers a universal, proximity-sensitive interaction paradigm that significantly advances accessibility in smart home environments, without requiring any modifications to existing infrastructure.

Account migration in sharded blockchains presents a critical trade-off between optimization effectiveness and system availability. While dynamically reallocating accounts across shards can significantly reduce cross-shard transaction overhead, existing migration mechanisms cause service disruptions that intensify as state data volumes grow. To address this challenge, we propose BIND, a batch-wise account migration protocol that eliminates service interruptions by enabling continuous transaction processing throughout migration. BIND introduces a dual transaction pool architecture that isolates transactions involving migrating accounts while allowing non-migrating accounts to operate uninterrupted. To optimize migration efficiency, we design a reverse greedy heuristic algorithm that partitions accounts into batches based on community cohesion, maximizing intra-batch connectivity to front-load cross-shard communication reduction. We evaluate BIND using real Ethereum transactions, demonstrating superior performance over existing mechanisms. BIND achieves 12% higher overall throughput, reduces migration time to 23.6%-39.3% of the one-shot baseline (across 1-10Gbps bandwidth), and lowers cross-shard transaction rates by 24.1% compared to random batching. These results confirm BIND as a practical solution for large-scale, non-disruptive account migration in production sharded blockchains.

Cyber Threat Intelligence (CTI) and serverless computing are two emerging technologies that have significantly impacted their respective domains in recent years. However, their interaction remains surprisingly underexplored. In this work, through in-depth semi-structured interviews with cybersecurity experts, we identify the trust issues within the CTI ecosystem that can be exploited to introduce fake CTI manipulation, enabling indirect attacks against entities with dynamic IP allocation, such as those in serverless computing. Furthermore, these attacks can be amplified by commercial CTI platforms due to their widespread adoption and sharing mechanisms. Based on these insights, we propose Ares, a novel attack strategy that leverages fake CTI manipulation to enable large-scale, stealthy indirect denial-of-service attacks against serverless infrastructures. We demonstrate the feasibility and impact of Ares through extensive evaluations in a controlled experimental environment. Our results show that Ares can rapidly and widely disseminate fake CTI within the CTI ecosystem, leading to an overall average reject rate of 23.03% and a high reject rate of up to 45.42% when accessing top websites in certain industries, while maintaining a low detection rate across state-of-the-art serverless security systems. These findings underscore the urgent need for more frequent communication and collaboration among CTI platforms and related stakeholders to develop a more robust trustworthiness model across the ecosystem.

Smart devices are proliferating in every aspect of our lives, providing convenience but also exposing us to the risk of information leakage at any moment. Attackers can monitor the user and infer private information such as personality and preferences by stealing the behavioral information. In this paper, we investigated the potential threat of information stealing via the leakage current of laptops and electrodes in wearable devices (e.g., smart watches and bracelets). Specifically, the leakage current in the laptop adapter can flow from the metal casing into the human body and be collected by electrodes in wearable devices when the user is using a laptop with a metal casing (e.g., MacBook). We verified the correlation between leakage current and the working states of the laptop, where different operations corresponding to different CPU instructions can generate different leakage currents. Based on this, we proposeLeakThief, a system that consists of three components: leakage current detection, application operation detection, and application recognition. The experiments in a real-world environment demonstrated that the proposed system can recognize 25 common applications with high accuracy, including launching-based (96.4%) and in-application operation-based recognition (81.2%).

Real-time audio streaming transmission and processing play a crucial role in time-sensitive applications such as food delivery services and ride-hailing platforms, where rapid response is essential. However, existing server-based audio streaming architectures struggle to handle the high concurrency of massive mobile devices efficiently. Traditional compression methods like MP3 and AAC offer limited compression ratios, while deep learning-based approaches often fail to meet the real-time transmission demands of edge computing environments. In this paper, we propose a novel edge-to-server audio streaming architecture that leverages Mel filter bank spectral features to achieve ultra-high compression efficiency. Our system integrates audio denoising, Mel feature extraction, and quantization-based compression at the edge, effectively suppressing environmental and device-induced noise while achieving an extreme compression ratio of 0.39% relative to the original uncompressed audio. Compared to conventional methods like MP3, our approach further reduces the file size by 96.1%. The decompressed Mel features remain task-independent, enabling seamless support for various general-purpose audio processing tasks in the server. We evaluate our system across three key audio tasks: speech recognition, speech emotion recognition, and audio classification. Extensive experiments on five different mobile devices demonstrate a 93.10% reduction in transmission latency at 1 Mbps bandwidth compared to 64 kbps MP3 audio, while maintaining task performance within a 5% deviation from state-of-the-art (SOTA) models across six mainstream audio datasets. These results highlight the efficiency, robustness, and scalability of our approach for real-time edge-to-server audio processing.

Protecting privacy-sensitive hardware usage on mobile devices is crucial. Although mobile operating systems (OSs) and smartphone manufacturers have set the permission settings, attackers can evade these defenses using covert methods, enabling malicious camera recording, microphone eavesdropping, and screen capture. Electronic devices emit unique yet weak electromagnetic interference (EMI) signals when accessing privacy-sensitive hardware. But, these signals are easily affected by foreground application activities and geomagnetic fluctuations caused by device movement. Our prior work showed that supervised learning can extract EMI features correlated with privacy hardware states from complex magnetometer readings, but it requires substantial labeled data, limiting practical deployment to new device models or OS versions. To eliminate this reliance on labeled data, this paper proposes a multimodal contrastive learning framework that leverages the device's built-in magnetometer and synchronized system logs as dual-modal inputs. Through self-supervised training, the framework can learn the intrinsic associations between EMI features and the operating states of privacy-sensitive hardware. Building on this, we design an EMI-based eavesdropping classifier that can analyze a user device's magnetometer readings offline to detect covert eavesdropping activities. Experimental results show that the proposed method can effectively identify eavesdropping behavior related to access to camera, microphone, and screen recording data. Testing across ten diverse mobile devices achieved an average classification accuracy of 89.1% on Android devices and 88.5% on iOS devices for identifying the specific hardware being eavesdropped upon.

Understanding the nature of user-device interactions (e.g., who is using the device and what he/she is doing with it) is critical for many applications including time management, user profiles, and privacy protection. However, in scenarios where mobile devices are shared among family members or multiple employees in a company, conventional account-based statistics are not meaningful. This poses an even bigger problem when dealing with sensitive data. Moreover, fingerprint readers and front-facing cameras were not designed to continuously identify users. In this study, we developedMagPrint++, a novel approach to fingerprint users based on unique patterns in the electromagnetic (EM) signals associated with the specific use patterns of users. Initial experiments showed that time-varying EM patterns are unique to individual users. They are also temporally and spatially consistent, which makes them suitable for fingerprinting.MagPrint++has a number of advantages over existing schemes: i) Non-intrusive fingerprinting, ii) implementation both on COTS mobile phones and a small and easy-to-deploy device, and iii) high accuracy thanks to the proposed classification algorithm. In experiments involving 30 users,MagPrint++achieves$94.3\%$accuracy in classifying users from these traces, which represents a$10.9\%$improvement over the state-of-the-art classification method.

As cardiovascular diseases and arrhythmias rise globally, pacemakers have become a critical therapeutic option for managing cardiac rhythm disorders. Accurate identification of pacemaker implantation sites is essential for personalized pacing therapy and optimal clinical outcomes. While 12-lead electrocardiogram (ECG) signals provide a non-invasive means to infer implantation locations, they are susceptible to noise and morphological variability, posing challenges for high-accuracy localization. To advance data-driven solutions in this domain, we present PILDE, the first publicly available dataset specifically designed for pacemaker implantation site identification, comprising 12-lead ECG recordings from 733 patients across four distinct implantation locations. Based on this dataset, we propose STELLAR, a novel deep learning framework that integrates a Spatio-Temporal Lead-Harmonic Mechanism to model both the temporal dynamics of ECG waveforms and the spatial coherence across leads. Extensive experiments demonstrate that STELLAR outperforms conventional deep models-including CNN, LSTM, and Transformer baselines-on both the PILDE and PTB-XL datasets. Specifically, STELLAR achieves an average accuracy improvement of 10.45 % on PILDE and 14.19 % on PTB-XL, with significant gains in sensitivity and F1-score for minority classes. These results highlight the robustness and precision of STELLAR in automating implantation site identification, offering a promising tool for pre-procedural planning and clinical decision support. The source code and dataset access information will be made publicly available.

Magnetic resonance imaging (MRI) provides highquality soft tissue contrast images and is crucial in medical diagnosis. However, systems face trade-offs between image resolution and scan time. Low-resolution MRI scans reduce scan time and patient burden but lose critical details needed for accurate diagnosis. To address this problem, super-resolution techniques have been developed to improve the clarity of lowresolution input images. Single-image super-resolution (SISR), which minimizes patient scanning time, has gradually become a research focus, but existing methods often struggle to balance the reconstruction of low-frequency structural information and high-frequency details. In this paper, we propose a novel superresolution up-sampling pipeline that enhances both the highfrequency and low-frequency components of magnetic resonance imaging. In addition, we introduce an enhanced loss function that includes symmetry and edge constraints to preserve critical structural details for improved diagnostic accuracy. The extensive experiments across multiple datasets validate the effectiveness of our SISR model. Source code will be made publicly available.

Electroencephalography (EEG) analysis plays a crit-ical role in applications such as brain-computer interfaces, epilepsy detection, and cognitive state recognition. However, EEG data are often limited in volume due to high acquisition costs and exhibit complex spatio-temporal coupling across multiple channels. Convolutional Neural Networks (CNNs) have become the predominant approach for EEG signal analysis, owing to their effectiveness in local feature extraction and compatibility with grid-like sensor topologies. Nevertheless, the locality as-sumption inherent in conventional CNN s restricts their ability to capture functional connectivity and dynamic dependencies between spatially distant channels. To address this limitation, we propose NLCTCN, a novel non-local Temporal Convolutional Network that leverages a hierarchical greedy strategy to identify and exploit long-range correlations in multi-channel time series. We further introduce a new fusion scheme, integrated into an end-to-end lightweight CNN architecture to effectively combine these non-local interactions and optimize their configurations for improved predictive performance. Experimental results are presented on 10 real-world EEG datasets. These datasets cover human physiology, cognitive tasks, and clinical applications. The results show that NLCTCN significantly outperforms state-of-the-art methods. On average, NLCTCN achieves an accuracy improvement of 7.5 %. These results validate the effectiveness and superiority of the proposed approach in modeling non-local spatio-temporal dynamics under data-scarce and multi-channel conditions.

We introduce M 2 Silent, which enables multi-user silent speech interactions in shared spaces using multi-directional speakers.Ensuring privacy during interactions with voice-controlled systems presents significant challenges, particularly in environments with multiple individuals, such as libraries, offices, or vehicles.M 2 Silent addresses this by allowing users to communicate silently, without producing audible speech, using acoustic sensing integrated into directional speakers.We leverage FMCW signals as audio carriers, simultaneously playing audio and sensing the user's silent speech.

Elastic Block Storage (EBS) has a pivotal role in modern data center infrastructure, providing reliable, high-performance and flexible block storage service to users. In Alibaba Cloud, EBS is the most widely used service and has been supporting the operation of millions of virtual disks. However, even with layers of load balancing and caching, we still observe significant traffic skewness across the EBS stack. This motivates us to comprehensively investigate symptoms and root causes behind the traffic patterns and, more importantly, explore the fixes for the identified issues.

Speech-based interaction systems are widely used in mobile devices like smartphones. With advances in deep neural networks, tasks such as speech emotion recognition (SER) enhance these systems’ user-friendliness. However, deploying SER models on mobile devices is challenging due to their complexity and computational demands. While pruning can reduce complexity, it often compromises accuracy, and hardware accelerators like FPGAs are difficult to integrate into mobile devices. This paper proposes AMSER, a real-time speech emotion recognition framework using signal compression and task offloading. AMSER utilizes logarithmic Mel-filter bank coefficients (Fbank) and singular value decomposition (SVD) for feature extraction and compression. The compressed signal is only 6.25% of the original size, achieving 2.24x faster transfer rates and 55.35% energy savings compared to raw audio transmission. Despite the compression, the features preserve key audio information for text and emotion recognition, performed server-side. Experiments show a WER of 4.68% (Librispeech), 10.69% (CommonVoice), and 69.83% emotion recognition accuracy (IEMOCAP).

Blockchain enhances the robustness and user engagement of Federated Learning (FL) systems but fails to meet the throughput and real-time requirements for model transmission. While sharding architectures improve system throughput, the latency introduced by mainchain model transmission remains a performance bottleneck, compromising the QoS of FL systems. In this paper, we propose a Mainchain-Free Sharding architecture, MFSChain, featuring an adaptive sharding mechanism based on hierarchical clustering. This mechanism improves shard model performance by eliminating the need for mainchain aggregation (i.e., shard-level global models). We also introduce the Federated Learning State Tree (FLS-Tree) for client management and state migration without a mainchain, alongside a lightweight storage scheme, LiFLS-Tree. Through theoretical analysis and extensive simulations, we demonstrate that MFSChain outperforms traditional blockchain and sharding architectures. Specifically, MFSChain reduces client waiting time by 17% and 24%, increases average model accuracy by 2.5% to 10% compared to traditional global models, and boosts throughput by$464 \times$while reducing transaction processing latency by 99%.

Non-invasive continuous glucose monitoring for diabetes patients remains challenging despite ongoing interest. This paper presents CGMM, a novel non-invasive wireless glucose monitoring system integrated into wearable devices. It features a specially designed metasurface that couples with the wearable's antenna and tissue fluid beneath the skin, amplifying frequency response changes caused by subtle glucose concentration variations. To address individual tissue variability and optimize the passive metasurface design, we develop a tunable metasurface and a one-shot calibration method to obtain the impedance for optimal resonance in glucose sensing environments with unknown parameters. The calibrated impedance is then used for the inverse design and fabrication of an economical passive metasurface. We implement prototypes of CGMM and conduct extensive experimental evaluations. In human experiments involving ten participants using the prototype with LibreVNA, the overall performance is quantified with relative errors ranging from -5.02% to 6.93% and an RMSE of 9.65 mg/dL.

Diffractive neural networks (NNs) have garnered attention for directly implementing wireless signal processing at the physical layer. However, they are limited by a constrained weight learning space and activation functions, which restricts their data processing capabilities. To address this, we propose an RF circuit-based weighted diffraction NN (WDNN) that rivals digital NNs in processing ability. We design a weighted asymmetric RF coupler unit that, when stacked into a network, enables diffractive propagation with arbitrary connection weights. Additionally, an activation module is introduced that utilizes RF amplifiers operating in their nonlinear regions. We validate the effectiveness of the proposed WDNN through three tasks: 32-level amplitude modulated (AM) signal decoding, 31-class angle of arrival (AoA) estimation, and 2-class Wi-Fi based fall detection. After training, WDNN achieves the accuracy of 98.5%, 93.7%, and 90.8% in the AM decoding, AoA estimation, and fall detection tasks, respectively; while the diffractive NN SOTA achieves only 21.6%, 16.9%, and 63.3%. We also implement the prototypes of WDNN and SOTA, and real-world experimental results demonstrate that our method achieves an average accuracy improvement of up to 76.85% across various tasks compared to SOTA.

Bluetooth-based location services have experienced significant growth over the past decades. RSSI-based techniques using beacons only provide meters-level accuracy. Angular-based approaches rely on customized antenna arrays, introducing high costs and limited usability. In 2020, Bluetooth Special Interest Group (Bluetooth SIG) released version 5.1, integrating Angle of Arrival (AoA) estimation to enable direction finding capabilities, which has the potential to improve localization across various fields, including logistics and industry. However, more than 4.1 billion devices (68% of the total) still do not support the direction finding feature. To address this issue and ensure backward compatibility, we proposed Bridge, a solution that leverages an additional trigger node (referred to as Trigger) to make the direction finding feature compatible with all Bluetooth devices without requiring modifications to existing hardware or firmware. The Trigger mimics communication behaviors with both locators and targets simultaneously by sending a nesting packet. Subsequently, processes and algorithms are delicately designed to estimate AoA. Bridge also supports large-scale deployment through dynamic packet flow switching, enabling it to handle concurrent targets and manage handover with a consistent operation pattern. We implemented and evaluated Bridge in real-world scenarios. The system achieved an average localization error of 33.4cm while extending the direction-finding feature to 10 target devices of different Bluetooth versions, indicating the effectiveness of Bridge.

BLE direction finding provides high-accuracy localization based on Angle-of-Arrival (AoA), but this feature is only available on BLE 5.1+ devices. Billions of existing Bluetooth devices are excluded from direction finding indoor localization systems. We present Bridge that enables direction finding for all Bluetooth versions without any hardware or firmware modifications. Bridge introduces a novel Trigger that mimics communication behaviors of both locators and targets, allowing the locator to extract AoA information from originally unsupported devices. We implement Bridge on COTS direction finding system and evaluate it on 10+ BLE devices, achieving a median localization error of 33.4cm.

Bluetooth Low Energy (BLE) direction finding, a feature introduced in BLE version 5.1, enables precise localization through Angle of Arrival (AoA) estimation. However, this advancement introduces new risk to BLE direction finding based localization system. Specifically, the AoA estimation based on phase sampling of constant-tone-extension (CTE) is susceptible to the signal injection attack. This paper presents SaDiF, a feasible spoofing attack mechanism to mislead the locators into mistaking the positioning result as a continuous path. By eavesdropping on BLE packets and injecting attack signals containing pre-designed disturbing phase shift, SaDiF subtly alters the AoA estimation without detection, thus interfere the localization results. Moreover, SaDiF address the challenges posed by hardware imperfections by proposing an injection timing optimization to improve attack robustness. Extensive experiments demonstrates the effectiveness of SaDiF in successfully attacking multiple BLE targets in real-time scenarios. In conclusion, our findings reveal critical security risks in BLE direction finding feature and provide insights into strengthening its defenses.

This paper presents MODepth, a multi-frame monocular depth estimation system based on the controlled motion of an optical image stabilization (OIS) module. By actively injecting acoustic signals, we induce regular translational movements of the OIS lens, resulting in controllable camera pose changes and simplifying inter-frame pose estimation. Leveraging multi-frame images captured under OIS-controlled lens movements, we design a high-precision depth estimation network, MODNet, and introduce the principal point offset estimation module and pose estimation modules to fully exploit geometric information across frames. To validate the effectiveness of our approach, we collect a new dataset MODdata with 1100 samples in nearly 220 indoor scenarios and benchmark our model as an OIS-based multi-frame depth estimation method, comparing it to ground truth obtained from a depth sensor and other state-of-the-art monocular depth estimation algorithms. Our method achieves competitive or superior performance compared to fully supervised baselines, reaching an RMSE of 0.439, which outperforms all evaluated methods, demonstrating that self-supervised fine-tuning with OIS-induced parallax is a viable alternative to ground-truth supervision. Code and dataset are available at: https://github.com/liangjindeamo-yuer/MODEPTH

Speech-based interaction systems are widely used in mobile devices like smartphones. With advances in deep neural networks, tasks such as speech emotion recognition (SER) enhance these systems user-friendliness. However, deploying SER models on mobile devices is challenging due to their complexity and computational demands. While pruning can reduce complexity, it often compromises accuracy, and hardware accelerators like FPGAs are difficult to integrate into mobile devices. This paper proposes Amser+, a real-time speech emotion recognition framework using signal compression and task offloading. Amser+utilizes logarithmic Mel-filter bank coefficients (Fbank) and singular value decomposition (SVD) for feature extraction and compression. The compressed signal is only 6.25% of the original size, achieving 2.24× faster transfer rates and 55.35% energy savings compared to raw audio transmission. Despite the compression, the features preserve key audio information for text and emotion recognition, performed server-side. Experiments show a WER of 4.68% (Librispeech), 10.69% (CommonVoice), and 72.85% emotion recognition accuracy (IEMOCAP).

Quick Response (QR) codes have become increasingly popular for screen-camera communication due to their swift readability and widespread smartphone use. Nevertheless, they are vulnerable to privacy invasions from unauthorized photography. Addressing this, we propose a novel Moiré encryption technique-based secure screen-camera communication system, named MoiréComm. The Moiré encryption can enhance security by using distinct spatial frequency patterns for camouflage. The original QR code is revealed as a Moiré pattern only when the camera in a designated position, e.g., directly in front and 30 cm from the screen. From any other positions, only the camouflaged QR code can be seen. Decryption schemes are customized for different scenarios. The multi-frame approach achieves a decryption success of over 98.6% within 13.2 frames in handheld scenarios. Conditional generative adversarial network (cGAN)-based decryption method decodes the Moiré QR code images with a 98.8% success rate in 0.02 s within three frames and is also applicable in handheld scenarios. For fixed screen-camera setups, our fast decryption scheme achieves 99.4% success within two frames, with average 0.4 s latency. Significantly, the decryption rate plunges to 0% for surveillance cameras displaced by 20$^\circ$or more than$\ge$10 cm from the target position, demonstrating MoiréComm's resilience against attacks.

Wearable devices, including smartwatches, are increasingly popular among consumers due to their user-friendly services. However, transmitting sensitive data like social media messages and payment QR codes via commonly used low-power Bluetooth exposes users to privacy breaches and financial losses. This study introducesTouchHBC, a secure and reliable communication scheme leveraging a smartwatch's built-in electrodes. This system establishes a touch-based human communication system utilizing a laptop's leakage current. As the transmitting device, the laptop modulates this current via the CPU. Simultaneously, the smartwatch, equipped with built-in electrodes, captures the current traversing the human body and decodes it. The modulation and decoding processes involve techniques such as amplitude modulation, variational mode decomposition, channel estimation, and retransmission mechanisms.TouchHBCfacilitates communication between laptops and smartwatches. Real-world tests demonstrate that our prototype achieves a throughput of$19.83bps$. Moreover,TouchHBCoffers the potential for enhanced interaction, including improved gaming experiences through vibration feedback and secure touch login for smartwatch applications by synchronizing with a laptop. Furthermore, the system can be integrated with high-throughput communication protocols such as Bluetooth, enhancing its scalability while maintaining a strong foundation of security.

Various characteristics of mobile applications (apps) and associated in-app services can reveal potentially-sensitive user information; however, privacy concerns have prompted third-party apps to restrict access to data related to mobile app usage. This paper outlines a novel approach to extracting detailed app usage information by analyzing electromagnetic (EM) signals emitted from mobile devices during app-related tasks. The proposed system, MagSpy, recovers user privacy information from magnetometer readings that do not require access permissions. This EM leakage becomes complex when multiple apps are used simultaneously and is subject to interference from geomagnetic signals generated by device movement. To address these challenges, MagSpy employs multiple techniques to extract and identify signals related to app usage. Specifically, the geomagnetic offset signal is canceled using accelerometer and gyroscope sensor data, and a Cascade-LSTM algorithm is used to classify apps and in-app services. MagSpy also uses CWT-based peak detection and a Random Forest classifier to detect PIN inputs. A prototype system was evaluated on over 50 popular mobile apps with 30 devices. Extensive evaluation results demonstrate the efficacy of MagSpy in identifying in-app services (96% accuracy), apps (93.5% accuracy), and extracting PIN input information (96% top-3 accuracy).

Air writing technology enhances text input for IoT, VR, and AR devices, offering a spatially flexible alternative to physical keyboards. Addressing the demand for such innovation, this paper presents MagicWrite, a novel system utilizing acoustic-based 1D tracking, which is suitable for mobile devices with existing speaker and microphone infrastructure. Compared to 2D or 3D tracking of the finger, 1D tracking eliminates the need for multiple microphones and/or speakers and is more universally applicable. However, challenges emerge when using 1D tracking for recognizing handwritten letters due to trajectory loss and inter-user writing variability. To address this, we develop a general conversion technique that transforms image-based text datasets (e.g., MNIST) into 1D tracking trajectory data, generating artificial datasets of tracking traces (referred to asTrackMNISTs) to bolster system robustness and scalability. These tracking datasets facilitate the creation of personalized user databases that align with individual writing habits. Combined with a kNN classifier, our proposed MagicWrite ensures high accuracy and robustness in text input recognition while simultaneously reducing computational load and energy consumption. Extensive experiments validate that our proposed MagicWrite achieves exceptional classification accuracy for unseen users and inputs in five languages, marking it as a robust solution for air writing.

Acoustic tracking technology, leveraging the ubiquitous presence of speakers and microphones in commercial off-the-shelf (COTS) mobile devices, has become a versatile tool across various applications. However, current phase-based acoustic tracking methods encounter significant limitations in tracking fast movements, thereby restricting their practical utility. This paper identifies three practical challenges to enable fast hand motion tracking using acoustic signals: 1) high mobility, 2) low signal-to-noise ratio (SNR), and 3) variations in hardware frequency response. The high mobility introduces Doppler shift and phase ambiguity which is the primary cause of failure in fast movement tracking, while the latter two factors can further impair the tracking performance in practical scenarios involving high mobility. To address the high mobility issue, we effectively compensate the Doppler shift in the Channel Impulse Response (CIR) for better selection of channel taps and then propose a novel phase derivative approach to mitigate the phase ambiguity. To enhance the real-world robustness, we integrate multiple algorithms including an SNR enhancement algorithm inspired by time-domain beamforming and a hardware frequency response compensation approach that addresses both amplitude and phase distortions. Additionally, an LSTM-based distance reconstruction algorithm is further implemented to correct residual phase noise. Implemented on Android platforms under the name SwiftTrack+, our system demonstrates superior performance in tracking fast movements. Through extensive evaluations, SwiftTrack+ proves its efficacy across diverse scenarios, significantly broadening the scope and reliability of acoustic tracking applications.

Visible light communication (VLC) is considered a solution to the scarcity of radio frequency communication resources due to its abundant spectrum resources and rapid intensity modulation capability. It has a wide range of applications in indoor positioning and intelligent transport systems. For example, in Connected and Autonomous Vehicle scenarios, VLC uses traffic lights to warn vehicles at different distances in abnormal situations, thus preventing potential traffic accidents. To facilitate fast, long-range VLC communication in such one-to-many communication scenarios, current systems typically use optical cameras or digital micro-mirror devices as receivers. However, there are several challenges associated with these devices. Optical cameras have a limited sampling rate, resulting in reduced effective throughput. Other receivers, such as digital micro-mirror devices, are relatively costly, which hinders their widespread use. In this paper, we propose a novel, low-cost, and high-speed VLC scheme. We use a low-cost material called Polymer-Dispersed Liquid Crystal as the measurement matrix, reducing the cost by 99% compared to digital micro-mirror devices. We implement hierarchical coding based on compressive sensing to reduce data redundancy and thus improve communication throughput. Empirical experiments conducted using four pho-to diodes at the receiver show a 120% improvement in overall throughput compared to existing one-to-many VLC systems.

With the increase in motor vehicles, more convenient and accurate interactions are expected while retaining a high standard of safe driving. However, complex and dynamic vehicle environments challenge sensing tasks such as breathing monitor and hand gesture recognition. In this paper, we propose DASIV, which utilizes the highly directional nature of ultrasonic signals to achieve fine-grained directional acoustic sensing in vehicle environments. Due to air nonlinearity, the system enables synchronized directional acoustic communication to transmit information (e.g., navigation) to the driver without affecting other passengers. By optimizing the frequency of the Frequency Modulated Continuous Wave (FMCW) signals, DASIV avoids mutual interference between the sensing and communication signals and achieves breathing detection and hand gesture recognition for the driver. Specifically, the system extracts breathing-induced weak thoracic bullying through the signal phase, captures and analyses breathing patterns using bandpass and Gaussian filters, and develops a breathing model. Then, the system defines 10 interaction hand gestures to meet daily interaction needs, uses spectral features to mine complex and fast hand movement features, and proposes a hand gesture recognition model. Extensive experiments in real environments show that DASIV achieves high-precision breathing monitor (Pearson correlation coefficient of 0.89) and hand gesture recognition (Precision of 91.7%).

This paper introduces a novel multi-directional speaker, named MuDiS, which utilizes a parametric array to generate highly focused sound beams in multiple directions. The system capitalizes on air nonlinearity to reproduce sound from ultrasounds, successfully overcoming challenges inherent in traditional parametric arrays, such as transducer size and wavefront shape. It supports three important features simultaneously: independent beams, wide-angle digital steering, and unintended leakage suppression. To address these challenges, we designed a specialized cell structure that connects ultrasonic transducers, redirecting an approximately omnidirectional wavefront with optimal interspacing. An optimization-based algorithm is developed to minimize unintended leakages, and a nonlinear distortion reduction scheme is proposed to enhance sound quality. The paper showcases a prototype demonstrating the system's capabilities as a multidirectional speaker with a wide sound projection angle. Experimental results validate the effectiveness of our approach. The proposed multi-beam projection system rivals the performance of commercially available single-beam projection directional speakers, and improved steering angle and sound fidelity compared to multi-beamforming performance using traditional parametric arrays.

Microwave ovens have become an essential cooking appliance owing to their convenience and efficiency. However, microwave ovens suffer from uneven distribution of energy, which causes prolonged delays, unpleasant cooking experiences, and even safety concerns. Despite significant research efforts, current solutions remain inadequate. In this paper, we first conduct measurement studies to understand the energy distribution for 10 microwave ovens and show their energy distribution in both 2D and 3D is very skewed, with notably lower energy levels at the center of the microwave cavity, where food is commonly placed. To tackle this challenge, we propose a novel methodology to enhance the performance of microwave ovens. Our approach begins with the development of a measurement driven model of a microwave oven. We construct a detailed 3D model in the High Frequency Structure Simulator (HFSS) and use real temperature measurements from a microwave to derive critical parameters relevant to the appliance's functionality (e.g., operating frequency, waveguide specifications). We then develop a novel approach that optimizes the design and placement of a low-cost passive metasurface for a given heating objective. Using extensive experiments, we demonstrate the efficacy of our approach across diverse food, optimization objectives, and microwave ovens.

Global Navigation Satellite System (GNSS) is extensively utilized for outdoor positioning and navigation. However, achieving high-precision indoor positioning is challenging due to the significant attenuation of GNSS signals indoors. To address this issue, we propose an innovative indoor GNSS positioning system called GPMS, which uses passive metasurface technology to redirect GNSS signals from outdoors into indoor spaces. These passive metasurfaces are strategically optimized for indoor coverage by steering and scattering the GNSS signals across a wide range of incident angles. We further develop a novel localization algorithm that can determine which metasurface the signal goes through and localize the user using the set of metasurfaces as anchor points. A distinct advantage of our localization algorithm is that it can be implemented on existing mobile devices without any hardware modifications. We implement the prototype of GPMS, and deploy six metasurfaces in two indoor environments, a 10×50 m2 office floor and a 15×20 m2 lecture room, to evaluate system performance. In terms of coverage, our GPMS increases the C/N0 from 9.1 dB-Hz to 23.2 dB-Hz and increases the number of visible satellites from 3.6 to 21.5 in the office floor. In terms of indoor positioning accuracy, our proposed system decreases the absolute positioning error from 30.6 m to 3.2 m in the office floor, and from 11.2 m to 2.7 m in the lecture room, demonstrating the feasibility and benefits of metasurface-assisted GNSS for indoor positioning.

Eavesdropping on human sound is one of the most common but harmful ways to threaten personal privacy. As one of the most essential accessories, headsets have been widely used in common online conversations, such as online calls, video meetings, etc. The metal coil vibration patterns of headset speakers/microphones have been proven to be highly correlated with the speaker-produced/microphone-received sound content. This paper presents an online conversation eavesdropping system, RFSpy, which uses only one RFID tag attached on a headset to alternately sense the metal coil vibrations of headset speaker and microphone for eavesdropping on speaker-produced and microphone-received sound. In some accessible scenarios, such as meeting rooms, offices, etc., assuming attackers secretly attach a small, battery-free RFID tag under one ear cushion of an eavesdropped user's headset without being noticed. Meanwhile, RFID readers are camouflaged as decorations placed in/out of rooms to transmit and receive RF signals. When the eavesdropped user talks with other users online by using the headset, RFSpy first activates the RFID tag attached on the headset to capture the metal coil vibration patterns of headset speaker and microphone upon RF signals. Then, RFSpy reconstructs sound spectrograms from the RF signal-based vibration patterns for not only trained words but also untrained (i.e., out-of-vocabulary) words by utilizing a designed Sound Spectrogram Reconstruction (SSR) network. Finally, RFSpy converts the sound spectrograms to conversation content through a sound recognition API. Extensive experiments in real environments demonstrate that RFSpy can eavesdrop on online conversations with out-of-vocabulary (OOV) words effectively.

Acoustic imaging is attractive due to its ability to work under occlusion, different lighting conditions, and privacy-sensitive environments. Existing acoustic imaging methods require large transceiver arrays or device movement, which makes it challenging to use in many scenarios. In this paper, we develop a novel acoustic imaging system for low-cost devices with few speakers and microphones without any device movement. To achieve this goal, we leverage a 3D-printed passive acoustic metasurface to significantly enhance the diversity of the measurement data, thereby improving the imaging quality. Specifically, we jointly design the transmission signal, transceivers' beamforming weights, metasurface, and imaging algorithm to minimize the imaging reconstruction error in an end-to-end manner. We further develop a scheme to dynamically adapt the imaging resolution based on the distance to the target. We implement a system prototype. Using extensive experiments, we show that our system yields high-quality images across a wide range of scenarios.

The demand for ultra-high-resolution imaging in mobile phone photography is continuously increasing. However, the image resolution of mobile devices is typically constrained by the size of the CMOS sensor. Although deep learning-based super-resolution (SR) techniques have the potential to overcome this limitation, existing SR neural network models require large computational resources, making them unsuitable for real-time SR imaging on current mobile devices. Additionally, cloud-based SR systems pose privacy leakage risks. In this paper, we propose M3Cam, an innovative and lightweight SR imaging system for mobile phones. M3Cam can ensure high-quality 16× SR image (4× in both height and width) visualization with almost negligible latency. In detail, we utilize an optical image stabilization (OIS) module for lens control and introduce a new modality of data, namely gyroscope readings, to achieve high-precision and compact optical flow estimation modules. Building upon this concept, we design a multi-frame-based SR model utilizing the Swin Transformer. Our proposed system can generate a 16× SR image from four captured low-resolution images in real-time, with low computational load, low inference latency, and minimal reliance on runtime RAM. Through extensive experiments, we demonstrate that our proposed multi-modal optical flow model significantly enhances pixel alignment accuracy between multiple frames and delivers outstanding 16× SR imaging results under various shooting scenarios. Code and dataset are available at: https://github.com/liangjindeamo-yuer/M3CAM

The convenient text input system is a pain point for devices such as AR glasses, and it is difficult for existing solutions to balance portability and efficiency. This paper introduces HandPad, the system that turns the hand into an on-the-go touchscreen, which realizes interaction on the hand via human capacitance. HandPad achieves keystroke and handwriting inputs for letters, numbers, and Chinese characters, reducing the dependency on capacitive or pressure sensor arrays. Specifically, the system verifies the feasibility of touch point localization on the hand using the human capacitance model and proposes a handwriting recognition system based on Bi-LSTM and ResNet. The transfer learning-based system only needs a small amount of training data to build a handwriting recognition model for the target user. Experiments in real environments verify the feasibility of HandPad for keystroke (accuracy of 100%) and handwriting recognition for letters (accuracy of 99.1%), numbers (accuracy of 97.6%) and Chinese characters (accuracy of 97.9%).

Cyber-theft of trade secrets has become a serious business threat. Digital watermarking is a popular technique to help identify the source of the file leakage, whereby a unique watermark for each insider is hidden in sensitive files. However, malicious insiders may use smartphones to photograph the secret file displayed on screens to remove the embedded hidden digital watermarks due to the optical noises introduced during photographing. To identify the leakage source despite suchscreen-photo-based leakage attacks, we leverage Moiré pattern, an optical phenomenon resulted from the optical interaction between electronic screens and cameras. As such, we presentmID, a new watermark-like technique that can create a carefully crafted Moiré pattern on the photo when it is taken towards the screen. We design patterns that appear to be natural yet can be linked to the identity of the leaker. We implementedmIDand evaluated it with 7 display devices and 6 smartphones from various manufacturers and models. The results demonstrate thatmIDcan achieve an average bit error rate (BER) of$0.2\%$and can successfully identify an ID with an average accuracy of$98\%$, with little influence from the type of display devices, cameras, IDs, and ambient lights.

Air-gapped networks achieve security by using physical isolation to keep the computers and network from the Internet. However, magnetic covert channels based on CPU utilization have been proposed to help secret data to exfiltrate from the Faraday-cage and the air gap. Despite the success of such covert channels, they suffer from the high risk of being detected by the transmitter computer and the challenge of installing malware into such a computer. In this article, we proposeMagView++, where sensitive information is embedded in other data such as video and can be transmitted over the internal network. When any computer uses the data such as playing the video, the sensitive information will leak through the magnetic signals. The “separation” of information embedding and leaking, combined with the fact that the data can be exfiltrated from any computer in a distributed manner, overcomes these limitations. We demonstrate that CPU utilization for video decoding can be effectively controlled by changing the video frame type, reducing the quantization parameter, and changing the timestamp of the frame, without video quality degradation. We prototypeMagView++and achieve 8.9 bps throughput with 0.0057 BER when using a smartphone as the receiver, and 59 bps throughput with 0.0025 BER when using a dedicated devices with high sampling rate as the receiver. Experiments under various environments are conducted to show the robustness ofMagView++. Limitations and possible countermeasures are also discussed.

The rising demand for utilizing fine-grained data in deep-learning (DL) based intelligent systems presents challenges for the collection and transmission abilities of real-world devices. Deep compressive sensing, which employs deep learning algorithms to compress signals at the sensing stage and reconstruct them with high quality at the receiving stage, provides a state-of-the-art solution for the problem of large-scale fine-grained data. However, recent works have proven that fatal security flaws exist in current deep learning methods and such instability is universal for DL-based image reconstruction methods. In this article, we assess the security risks introduced by deep compressive sensing in the widely used computer vision system in the face of adversarial example attacks and poisoning attacks. To implement the security inspection in an unbiased and complete manner, we develop a comprehensive methodology and a set of evaluation metrics to manage all potential combinations of attack methods, datasets (application scenarios), categories of deep compressive sensing models, and image classifiers. The results demonstrate that deep compressive sensing models unknown to adversaries can protect the computer vision system from adversarial example attacks and poisoning attacks, whereas the ones exposed to adversaries can cause the system to become more vulnerable.

Motivated by many potential applications that could be enabled by acoustic motion tracking, in this paper we systematically examine the factors that limit the accuracy of acoustic tracking in practical scenarios. We identify three main challenges: (i) high mobility, (ii) low SNR, and (iii) hardware frequency response. We further show that the last two issues may exacerbate the performance issue under high mobility. We develop effective approaches to address the issues. In particular, to address high mobility, we tackle phase wrap-around using the derivative of the phase; we further estimate the Doppler shift under diverse scenarios and compensate the Doppler in channel impulse response (CIR). To address low SNR, we use a novel approach to estimate the phase shift between consecutive time intervals to effectively support time-domain beamforming and increase SNR. To tackle the uneven frequency response, we show that it is important to estimate and compensate the phase as well as the amplitude of the frequency response. Our extensive evaluation shows that each of our techniques is effective and putting them together significantly enhances the accuracy of acoustic motion tracking in general scenarios.

Low Earth Orbit (LEO) satellite communication is essential for wireless communication. While manufacturing and launching LEO satellites have become efficient and cost-effective, ground stations remain expensive due to complex designs for handling severe path losses and precise beam tracking. Hence, it is important to develop low cost and high-performance ground stations for widespread adoption of LEO satellite communication. Towards realizing this goal, we design a passive metasurface-enhanced LEO ground station system, named PMSat, combining metasurface's fine-grained beamforming capability with a small-size phased array's adaptive steering and focusing. For uplink, we jointly optimize the phase array codebook and uplink metasurface phase profile, and realize electronic steering by switching the codeword. We further jointly optimize the downlink metasurface phase profile to improve the focusing performance and enhance the received signal strength (RSS) over a wide range of incident angles. Our PMSat prototype consists of a single passive metasurface with 21 × 21 elements for uplink and 22 × 22 for downlink, along with 1 × 4 receiving and 1 × 4 transmitting phased array antennas. The effectiveness of our proposed PMSat is validated through extensive experiments, and results demonstrate that the optimized metasurface improves the SNR by 8.32 dB and 16.57 dB for uplink and downlink, respectively.

Smart devices are proliferating in every aspect of our lives, providing convenience but also exposing us to the risk of information leakage at any moment. Attackers can monitor the user and infer private information such as the personality and preferences by stealing the behavior information. In this paper, we investigated the potential threat of information stealing via the leakage current of laptop and electrodes in wearable devices (e.g. smart watches and bracelets). Specifically, the leakage current in the laptop adapter can flow from the metal casing into the human body and be collected by electrodes in wearable devices when the user is using a laptop with a metal casing (e.g. MacBook). We verified the correlation between leakage current and working states of the laptop, where different operations corresponding to different CPU instructions can generate different leakage currents. Based on this, we propose LeakThief, the system consists of three components, leakage current detection, application operation detection and application recognition. The experiments in real-world environment demonstrated that the proposed system is able to recognize 10 common applications with high accuracy, including launching-based (97.5%) and in-application operation-based recognition (83.8%).

Over the past years, smart ecology has attracted much attention, especially for smart home applications. As a key component, monitoring appliances performs significant impact. However, appliances under monitoring usually contain smart modules such as WiFi or Bluetooth, which are limited to traditional appliances. Existing approaches such as distributed sensing, energy disaggregation, and infrastructure-mediated sensing, require the installation of external hardware or have a limited sensing range. In this study, we developed AUDIOSENSE to leverage the acoustic signal generated by the power supply to monitor electrical appliances throughout the house remotely from a single point. In realizing AUDIOSENSE, we proposed an optimized Variation Mode Decomposition scheme to extract the frequency components, as well as a data augmentation scheme to improve generalizability and enable multi-label classification. In experiments, AUDIOSENSE achieved mAP values of 99.3% in multi-label classification.

Unauthorized covert voice recording brings a remarkable threat to privacy-sensitive scenarios, such as confidential meetings and private conversations. Due to the miniaturization and disguise characteristics, hidden voice recorders are difficult to be noticed in their surroundings. In this paper, we present DeHiREC, the first proof-of-concept system that can detect offline hidden voice recorders from their electromagnetic radiations (EMR). We first characterize the unique patterns of the emanated EMR signals and then locate the EMR source, i.e., the analog-to-digital converter (ADC) module embedded in the mixed signal system-on-chips (MSoCs). Since these unintentional EMR signals can be extremely noisy and weak, accurately detecting them can be challenging. To address this challenge, we first design an EMR Catalyzing method to stimulate the EMR signals actively and then employ an adaptive-folding algorithm to improve the signal-to-noise ratio (SNR) of the sensed EMRs. Once the sensed EMR variation corresponds to our active stimulation, we can determine that there exists a hidden voice recorder. We evaluate the performance of DeHiREC on 13 commercial voice recorders under various impacts, including interference from other devices. Experimental results reveal that DeHiREC is effective in detecting all 13 voice recorders and achieves an overall success rate of 92.17% and a recall rate of 86.14% at a distance of 0.2 m.

The efficiency of human-computer interaction is greatly hindered by the small size of the touch screens on mobile devices, such as smart phones and watches. This has prompted widespread interest in handwriting recognition systems, which can be divided into active and passive systems. Active systems require additional hardware devices to perceive movements of handwriting or the tracking accuracy is not adequate for handwriting recognition. Passive methods use the acoustic signal of pen rubbing and are susceptible to environmental noise (above 60$dB$). This paper presents a novel handwriting recognition system based on vibration signals detected by the built-in accelerometer of smartphones. The proposed scheme is implemented in three stages: signal segmentation, signal recognition, and word suggestion.VibWriteris highly resistant to interferences since the normal environmental noise (below 70$dB$) will not cause the vibration of the accelerometer. Extensive experiments demonstrated the efficacy of the system in terms of accuracy in letter recognition (75.3%), word recognition (86.4%) and number recognition (79%) in a variety of writing positions under a variety of environmental conditions.

Mobile devices have emerged as the most popular platforms to access information. However, they have also become a major concern of privacy violation and previous researches have demonstrated various approaches to infer user privacy based on mobile devices. In this paper, we study the electromagnetic (EM) emission of a laptop that could be harvested by a commercial-off-the-shelf (COTS) mobile device, e.g., a smartphone. We proposeMagAttack, which exploits the electromagnetic side channel of a laptop to guess user activities, i.e., application launching and application operation. The key insight ofMagAttackis that applications are discrepant in essence due to the different compositions of instructions, which can be reflected on the CPU power consumption, and thus the corresponding EM emissions.MagAttackis challenging since that EM signals are noisy due to the dynamics of applications and the limited sampling rate of the built-in magnetometers in COTS mobile devices. We overcome these challenges and convert noisy coarse-grained EM signals to robust fine-grained features. We implementMagAttackon both an iOS and an Android smartphone without any hardware modification, and evaluate its performance with 30 popular applications, 30 YouTube videos, and 50 top websites in China. The results demonstrate thatMagAttackcan recognize aforementioned 30 applications with an average accuracy of 98.6 percent, and identify which video out of the 30 candidates being played with an average accuracy of 97.5 percent and visiting which website among the 50 candidates with an average accuracy of 90.4 percent.

Near-field communication (NFC) technology emerges as a vital role with appealing benefits for users to improve mobile device’s functionality. Although today’s most smartphones and smartwatches come with NFC support, other mobile devices (e.g., PC and laptops) and IoT devices that don’t equip with dedicated radio modules cannot take advantage of wide-scale NFC capability. We design and developMagneComm+, an NFC-like implementation scheme without dedicated hardware and propose a novel near-field communication protocol that is applicable to almost all mobile devices and IoT devices. The key idea is to utilize the electromagnetic induction (EMI) signal emitted from the computing devices (e.g., CPUs) and captured by magnetometers on mobile devices for communication. We tackle challenges indata encoding/decoding,preamble detection,retransmission and error correction,multi-transmitter, andfull-duplexschemes, to efficiently generate and reliably receive EMI signal with the hardware available on devices. We prototypeMagneComm+on both between laptops and smartphones, as well as between two laptops with an external magnetometer. Extensive evaluation results show that ourMagneComm+supports around$10~cm$10cmcommunication distance with average110 bps(bit per second) data rate on the normal-speed mode, and maximum17.28 kbpson the full-speed mode.

Quick response (QR) codes have been widely used in mobile applications, especially mobile payments, such as Alipay, WeChat, PayPal, etc due to their convenience and the pervasive built-in cameras on smartphones. Recently, however, attacks against QR codes have been reported and attackers can capture a QR code of the victim and replay it to achieve a fraudulent transaction or intercept private information, just before the original QR code is scanned. In this study, we enhance the security of a QR code by identifying its authenticity. We propose ScreenID, which embeds a QR code with information of the screen which displays it, thereby the QR code can reveal whether it is reproduced by an adversary or not. In ScreenID, PWM frequency of screens is exploited as the unique screen fingerprint. To improve the estimation accuracy of PWM frequency, ScreenID incorporates a model for the interaction between the camera and screen in the temporal and spatial domains. Extensive experiments demonstrate that ScreenID can differentiate screens of different models, types, and manufacturers and thus improve the security of QR codes.

Multi-frame super-resolution methods can generate high resolution images by combining multiple captures of the same scene; however, the performance of merged results are susceptible to degradation due to a lack of precision in image registration. In this study, we sought to develop a robust multi-frame super resolution method (called OISSR) for use on smartphone cameras with a optical image stabilizer (OIS). Acoustic injection is used to alter the readings from the built-in MEMS gyroscope to control the lens motion in the OIS module (note that the image sensor is fixed). We employ a priori knowledge of the induced lens motion to facilitate optical flow estimation with sub-pixel accuracy, and the output high-precision pixel alignment vectors are utilized to merge the multiple frames to reconstruct the final super resolution image. Extensive experiments on a OISSR prototype implemented on a Xiaomi 10Ultra demonstrate the high performance and effectiveness of the proposed system in obtaining the quadruple enhanced resolution imaging.

Optical image stabilizers (OIS) are widely used in digital cameras to counteract motion blur caused by camera shakes in capturing videos and photos. In this paper, we sought to expand the applicability of the lens-shift OIS technology for metric depth estimation, i.e., let a RGB camera to achieve the similar function of a time-of-flight (ToF) camera. Instead of having to move the entire camera for depth estimation, we propose DoCam, which controls the lens motion in the OIS module to achieve 3D reconstruction. After controlling the lens motion by altering the MEMS gyroscopes readings through acoustic injection, we improve the traditional bundle adjustment algorithm by establishing additional constraints from the linearity of the lens control model for high-precision camera pose estimation. Then, we elaborate a dense depth reconstruction algorithm to compute depth maps at real-world scale from multiple captures with micro lens motion (i.e., ≤ 3 mm). Extensive experiments demonstrate that our proposed DoCam can enable a 2D color camera to estimate high-accuracy depth information of the captured scene by means of controlling lens motion in the OIS. DoCam is suitable for a variety of applications that require depth information of the scenes, especially when only a single color camera is available and located at a fixed position.

Nowadays, the market of 3D human posture tracking has extended to a broad range of application scenarios. As current mainstream solutions, vision-based posture tracking systems suffer from privacy leakage concerns and depend on lighting conditions. Towards more privacy-preserving and robust tracking manner, recent works have exploited commodity radio frequency signals to realize 3D human posture tracking. However, these studies cannot handle the case where multiple users are in the same space. In this paper, we present a mmWave-based multi-user 3D posture tracking system, m3Track, which leverages a single commercial off-the-shelf (COTS) mmWave radar to track multiple users' postures simultaneously as they move, walk, or sit. Based on the sensing signals from a mmWave radar in multi-user scenarios, m3Track first separates all the users on mmWave signals. Then, m3Track extracts shape and motion features of each user, and reconstructs 3D human posture for each user through a designed deep learning model. Furthermore. m3Track maps the reconstructed 3D postures of all users into 3D space, and tracks users' positions through a coordinate-corrected tracking method, realizing practical multi-user 3D posture tracking with a COTS mmWave radar. Experiments conducted in real-world multi-user scenarios validate the accuracy and robustness of m3Track on multi-user 3D posture tracking.

This study reveals that on-board hardware modules leak electromagnetic (EM) emissions whenever audio or camera data is accessed, and proposes Magdefender scheme that explores the possibility of using the magnetometer built into mobile devices to detect eavesdropping instances by malicious apps and even the unscrupulous phone vendors. However, the target EM signals generated by accessing multimedia data is weak and tends to be buried beneath other noisy EM signals from apps running in the foreground. It is also subject to the external interference from geomagnetic signals generated by the device movement. To cope with the challenges, we adopt a generative adversarial networks (GAN) based model to facilitate the extraction of target EM signals indicating the occurrence of eavesdropping from the overall magnetometer readings. We also develop a neural network-based classifier with triplet loss embedding to identify the EM signals from the camera and/or microphones. Empirical results demonstrate the efficacy of MagDefenderin recognizing instances of eavesdropping on cameras/microphones data, with average accuracy of 97.3% when applied to the trained devices, and average 91.5% on unseen mobile devices.

Technology abuse among adolescents refers to the problematic use of technology devices, and the negative impact it can have on lifestyle and one's physical and mental health. This paper reports on in-depth interviews with 15 dyads of adolescent patients, their parents, and four experts with the objective of unraveling the issue of technology abuse. We conducted qualitative analysis aimed at unpacking the contextual factors affecting technology abuse, and differences between adolescents and their parents pertaining to this issue. Our discussions led us to formulate solutions to technology abuse: (1) motivating adolescents by sending timely reminders and providing interactive micro-incentives; (2) promoting communication between adolescents and their parents by sharing usage data related to device usage; and (3) incorporating social supports to complement parental support, while fulfilling the adolescent's social needs. This paper provides valuable insights into the design of technological solutions aimed at mediating technology abuse.

With the widespread use of smart devices, device authentication has received much attention. One popular method for device authentication is to utilize internally measured device fingerprints, such as device ID, software or hardware-based characteristics. In this article, we propose DeMiCPU , a stimulation-response-based device fingerprinting technique that relies on externally measured information, i.e., magnetic induction (MI) signals emitted from the CPU module that consists of the CPU chip and its affiliated power-supply circuits. The key insight of DeMiCPU is that hardware discrepancies essentially exist among CPU modules and thus the corresponding MI signals make promising device fingerprints, which are difficult to be modified or mimicked. We design a stimulation and a discrepancy extraction scheme and evaluate them with 90 mobile devices, including 70 laptops (among which 30 are of totally identical CPU and operating system) and 20 smartphones. The results show that DeMiCPU can achieve 99.7% precision and recall on average, and 99.8% precision and recall for the 30 identical devices, with a fingerprinting time of 0.6~s. The performance can be further improved to 99.9% with multi-round fingerprinting. In addition, we implement a prototype of DeMiCPU docker, which can effectively reduce the requirement of test points and enlarge the fingerprinting area.

Federated learning enables distributed model training over various computing nodes, e.g., mobile devices, where instead of sharing raw user data, computing nodes can solely commit model updates without compromising data privacy. The quality of federated learning relies on the model updates contributed by computing nodes training with their local data. However, with various factors (e.g., training data size, mislabeled data samples, skewed data distributions), the model update qualities of computing nodes can vary dramatically, while inclusively aggregating low-quality model updates can deteriorate the global model quality. To achieve efficient federated learning, in this paper, we propose a novel framework namedFAIR, i.e.,Federated leArning with qualIty awaReness. Particularly,FAIRintegrates three major components: 1) learning quality estimation: we adopt the model aggregation weight (learned in the third component) to reversely quantify the individual learning quality of nodes in a privacy-preserving manner, and leverage the historical learning records to infer the next-round learning quality; 2) quality-aware incentive mechanism: within the recruiting budget, we model a reverse auction problem to stimulate the participation of high-quality and low-cost computing nodes, and the method is proved to be truthful, individually rational, and computationally efficient; and 3) auto-weighted model aggregation: based on the gradient descent method, we devise an auto-weighted model aggregation algorithm to automatically learn the optimal aggregation weights to further enhance the global model quality. Based on real-world datasets and learning tasks, extensive experiments are conducted to demonstrate the efficacy ofFAIR.

Federated learning enables distributed learning in a privacy-protected manner, but two challenging reasons can affect learning performance significantly. First, mobile users are not willing to participate in learning due to computation and energy consumption. Second, with various factors (e.g., training data size/quality), the model update quality of mobile devices can vary dramatically, inclusively aggregating low-quality model updates can deteriorate the global model quality. In this paper, we propose a novel system named FAIR, i.e., Federated leArning with qualIty awaReness. FAIR integrates three major components: 1) learning quality estimation: we leverage historical learning records to estimate the user learning quality, where the record freshness is considered and the exponential forgetting function is utilized for weight assignment; 2) quality-aware incentive mechanism: within the recruiting budget, we model a reverse auction problem to encourage the participation of high-quality learning users, and the method is proved to be truthful, individually rational, and computationally efficient; and 3) model aggregation: we devise an aggregation algorithm that integrates the model quality into aggregation and filters out non-ideal model updates, to further optimize the global learning model. Based on real-world datasets and practical learning tasks, extensive experiments are carried out to demonstrate the efficacy of FAIR.

Quick response (QR) codes have been widely used in mobile applications due to its convenience and the pervasive built-in cameras on smartphones. Recently, however, attacks against QR codes have been reported that attackers can capture a QR code of the victim and replay it to achieve a fraudulent transaction or intercept private information, just before the original QR code is scanned. In this study, we enhance the security of a QR code by identifying its authenticity. We propose SCREENID, which embeds a QR code with information of the screen which displays it, thereby the QR code can reveal whether it is reproduced by an adversary or not. In SCREENID, PWM frequency of screens is exploited as the unique screen fingerprint. To improve the estimation accuracy of PWM frequency, SCREENID incorporates a model for the interaction between the camera and screen in the temporal and spatial domains. Extensive experiments demonstrate that SCREENID can differentiate screens of different models, types, and manufacturers, thus improve the security of QR codes.

Text input systems based on device-free finger tracking technologies have attracted considerable attention in the use scenarios of mobile and the Internet-of-Things (IoT) devices. Issues pertaining to 2D tracking have prompted interest in using 1D finger trajectories for the recognition of handwritten letters. Nonetheless, 1D tracking imposes two major challenges: (i) Trajectory information loss from 2D to 1D; and (ii) Inter-user diversity in writing traits. These challenges could possibly be overcome by collecting a large training dataset for every user; however, this would impose an unacceptable burden on users. This paper presents a text input system with multi-language support without training using acoustic-based 1D finger tracking technology. We developed a novel data augmentation scheme, in which the handwritten image dataset MNISTs are used to create artificial datasets (called TrackMNISTs). We compensate for the trajectory information loss of 1D by creating personal dataset (from TrackMNIST) to match the writing habits of individual users. The proposed data augmentation mechanism is also applicable to multilingual letter recognition. In experiments, MagicInput achieved outstanding classification accuracy on unseen users: 10 digits (98.3%), 26 uppercase/lowercase English letters (97.8%/95.3%), 49 Japanese characters (91.4%), and the 30 commonly used Chinese characters (93.8%).

With the increasing integration of humans and the cyber world, user authentication becomes critical to support various emerging application scenarios requiring security guarantees. Existing works utilize Channel State Information (CSI) of WiFi signals to capture single human activities for non-intrusive and device-free user authentication, but multi-user authentication remains a challenging task. In this paper, we present a multi-user authentication system, MultiAuth, which can authenticate multiple users with a single commodity WiFi device. The key idea is to profile multipath components of WiFi signals induced by multiple users, and construct individual CSI from the multipath components to solely characterize each user for user authentication. Specifically, we propose a MUltipath Time-of-Arrival measurement algorithm (MUTA) to profile multipath components of WiFi signals in high resolution. Then, after aggregating and separating the multipath components related to users, MultiAuth constructs individual CSI based on the multipath components to solely characterize each user. To identify users, MultiAuth further extracts user behavior profiles based on the individual CSI of each user through time-frequency analysis, and leverages a dual-task neural network for robust user authentication. Extensive experiments involving 3 simultaneously present users demonstrate that MultiAuth is accurate and reliable for multi-user authentication with 87.6% average accuracy and 8.8% average false accept rate.

The efficiency of human-computer interaction is greatly hindered by the small size of the touchscreens on mobile devices, such as smart phones and watches. This has prompted widespread interest in handwriting recognition systems, which can be divided into active and passive systems. Active systems require additional hardware devices to perceive movements of handwriting or the tracking accuracy is not adequate for hand-writing recognition. Passive methods use the acoustic signal of pen rubbing and are susceptible to environmental noise (above 60dB). This paper presents a novel handwriting recognition system based on vibration signals detected by the built-in accelerometer of smart phones. VibWriter is highly resistant to interference since the normal environmental noise will not cause the vibration of the accelerometer. Extensive experiments demonstrated the efficacy of the system in terms of accuracy in letter recognition (76.15%) and word recognition (88.14%) when dealing with words of various lengths written by various users in a variety of writing positions under a variety of environmental conditions.

Various characteristics of mobile applications (apps) and associated in-app services have been used reveal potentially-sensitive user information; however, privacy concerns have prompted third-party apps to rigorously restrict access to data related to mobile app usage. This paper outlines a novel approach to the extraction of detailed app usage information based on analysis of the electromagnetic (EM) signals emitted from mobile devices when executing app-related tasks. Note that this type of EM leakage becomes high-complex when multiple apps are used simultaneously and is subject to interference from geomagnetic signals generated by device movement. This paper proposes a deep learning-based multi-label classification system to identify apps and in-app services based on magnetometer readings. The proposed MAGTHIEF system uses accelerometer and gyroscope data to cancel out the offset in geomagnetic signals followed by an elaborate deep region convolution neural network (DRCNN) to differentiate among multiple apps and the corresponding inapp services. Experiments on 50 apps demonstrated the efficacy of MAGTHIEF in identifying multiple apps and in-app services, achieving high average macro F1 scores of 0.87 and 0.95, respectively. MAGTHIEF also achieved time duration accuracy of 89.5% in recognizing app trajectory in the real-world scene.

Trade secrets such as intellectual properties are the inherent values for firms. Although companies have exploited strict access management policies and isolated their networks from the public Internet, trade secrets are still vulnerable to side-channel attacks. Side-channels can reveal the computing processes of computers in forms of various physical signals such as light, electromagnetism, and even heat. Such side-channels can bypass the isolation mechanism and therefore bring about severe threats. However, existing side-channels can only perform well within a short-distance (e.g., less than 1 meter) due to the high attenuation of signals. In this paper, we seek to utilize the built-in power lines in a building and construct a power side-channel that enables remote, i.e., cross-outlet attack against trade secrets. To this end, we investigate the power factor correction (PFC) module inside the power supply units of commodity computers and find that the PFC signals observed from an outlet can precisely reveal the power consumption information of all the connected devices, even from the outlets in adjacent rooms. Based upon this insight, we design and implement OutletSpy, a power side-channel attack that can infer application launching from a remote outlet and therefore enjoys the stealthiness property. We validate and evaluate OutletSpy with a dataset under different background APPs, time variations and different locations. The experiment results show OutletSpy can infer the application launching with 98.25% accuracy.

Understanding the nature of user-device interactions (e.g., who is using the device and what he/she is doing with it) is critical to many applications including time management, user profiles, and privacy protection. However, in scenarios where mobile devices are shared among family members or multiple employees in a company, conventional account-based statistics are not meaningful. This poses an even bigger problem when dealing with sensitive data. Moreover, fingerprint readers and front-facing cameras were not designed to continuously identify users. In this study, we developed MagPrint, a novel approach to fingerprint users based on unique patterns in the electromagnetic (EM) signals associated with the specific use patterns of users. Initial experiments showed that time-varying EM patterns are unique to individual users. They are also temporally and spatially consistent, which makes them suitable for fingerprinting. MagPrint has a number of advantages over existing schemes: i) Non-intrusive fingerprinting, ii) implementation using a small and easy-to-deploy device, and iii) high accuracy thanks to the proposed classification algorithm. In experiments involving 30 users, MagPrint achieves 94.3% accuracy in classifying users from these traces, which represents an 10.9% improvement over the state-of-the-art classification method.

Air-gapped networks achieve security by using the physical isolation to keep the computers and network from the Internet. However, magnetic covert channels based on CPU utilization have been proposed to help secret data to escape the Faraday-cage and the air-gap. Despite the success of such cover channels, they suffer from the high risk of being detected by the transmitter computer and the challenge of installing malware into such a computer. In this paper, we propose MagView, a distributed magnetic cover channel, where sensitive information is embedded in other data such as video and can be transmitted over the air-gapped internal network. When any computer uses the data such as playing the video, the sensitive information will leak through the magnetic covert channel. The "separation" of information embedding and leaking, combined with the fact that the covert channel can be created on any computer, overcomes these limitations. We demonstrate that CPU utilization for video decoding can be effectively controlled by changing the video frame type and reducing the quantization parameter without video quality degradation. We prototype MagView and achieve up to 8.9 bps throughput with BER as low as 0.0057. Experiments under different environment are conducted to show the robustness of MagView. Limitations and possible countermeasures are also discussed.

Quick response (QR) codes have been widely used in mobile applications, due to its convenience and the pervasive built-in cameras on smartphones. Recently, however, QR codes have been reported suffering attacks for being sniffed just before the QR code is scanned, which lead to financial loss. In this study, we propose ScreenID, for enhancing the QR code security by identifying its authenticity, which embeds a QR code with information of unique screen fingerprint - PWM frequency. PWM frequencies are adjusted to different values by screen manufacturers, therefore can successfully differentiate screens. To improve the estimation accuracy of PWM frequency, ScreenID incorporates a model for the interaction between the camera and screen in the temporal and spatial domains. Extensive experiments demonstrate that ScreenID can differentiate screens of different models, types and manufacturers and thus improve the security of QR codes.

With increasing private and sensitive data stored in mobile devices, secure and effective mobile-based user authentication schemes are desired. As the most natural way to contact with mobile devices, finger touches have shown potentials for user authentication. Most existing approaches utilize finger touches as behavioral biometrics for identifying individuals, which are vulnerable to spoofer attacks. To resist attacks for on-touch user authentication on mobile devices, this paper exploits physical characters of touching fingers by investigating active vibration signal transmission through fingers, and we find that physical characters of touching fingers present unique patterns on active vibration signals for different individuals. Based on the observation, we propose a behavior-irrelevant on-touch user authentication system, TouchPass, which leverages active vibration signals on smartphones to extract only physical characters of touching fingers for user identification. TouchPass first extracts features that mix physical characters of touching fingers and behavior biometrics of touching behaviors from vibration signals generated and received by smartphones. Then, we design a Siamese network-based architecture with a specific training sample selection strategy to reconstruct the extracted signal features to behavior-irrelevant features and further build a behavior-irrelevant on-touch user authentication scheme leveraging knowledge distillation. Our extensive experiments validate that TouchPass can accurately authenticate users and defend various attacks.

Mobile devices have emerged as the most popular platforms to access information. However, they have also become a major concern of privacy violation and previous researches have demonstrated various approaches to infer user privacy based on mobile devices. In this paper, we study a new side channel of a laptop that could be harvested by a commercial-off-the-shelf (COTS) mobile device, eg, a smartphone. We propose MagAttack, which exploits the electromagnetic (EM) side channel of a laptop to infer user activities, i.e., application launching and application operation. The key insight of MagAttack is that applications are discrepant in essence due to the different compositions of instructions, which can be reflected on the CPU power consumption, and thus the corresponding EM emissions. MagAttack is challenging since that EM signals are noisy due to the dynamics of applications and the limited sampling rate of the built-in magnetometers in COTS mobile devices. We overcome these challenges and convert noisy coarse-grained EM signals to robust fine-grained features. We implement MagAttack on both an iOS and an Android smartphone without any hardware modification, and evaluate its performance with 13 popular applications and 50 top websites in China. The results demonstrate that MagAttack can recognize aforementioned 13 applications with an average accuracy of 98.6%, and figure out the visiting operation among 50 websites with an average accuracy of 84.7%.

With the widespread use of smart devices, device authentication has received much attention. One popular method for device authentication is to utilize internally-measured device fingerprints, such as device ID, software or hardware-based characteristics. In this paper, we propose DeMiCPU, a stimulation-response-based device fingerprinting technique that relies on externally-measured information, i.e., magnetic induction (MI) signals emitted from the CPU module that consists of the CPU chip and its affiliated power supply circuits. The key insight of DeMiCPU is that hardware discrepancies essentially exist among CPU modules and thus the corresponding MI signals make promising device fingerprints, which are difficult to be modified or mimicked. We design a stimulation and a discrepancy extraction scheme and evaluate them with 90 mobile devices, including 70 laptops (among which 30 are of totally identical CPU and operating system) and 20 smartphones. The results show that DeMiCPU can achieve 99.1% precision and recall on average, and 98.6% precision and recall for the 30 identical devices, with a fingerprinting time of 0.6 s. In addition, the performance can be further improved to 99.9% with multi-round fingerprinting.

Our current project involves the development of a wristband-mounted sensor that is meant to function as an alcohol use monitoring system. This paper focuses on the degree to which physical activity influences ethanol concentrations in the vapor secreted from the skin through collecting data from seven recruited participants when they conducting one designated activity, which could presumably affect the accuracy of detection results. We proposes a preliminary design of building a personal alcohol tracking system that can improve the reliability and affordability of current transdermal ethanol tracking devices to accommodate potential interferences presented in daily life and be intuitive to be used to raise the awareness of alcohol use.

Smart speakers allow users to interact with home appliances using voice commands and are becoming increasingly popular. While voice-based interface is intuitive, it is insufficient in many scenarios, such as in noisy or quiet environments, for users with language barriers, or in applications that require continuous motion tracking. Motion-based control is attractive and complementary to existing voice-based control. However, accurate and reliable room-scale motion tracking poses a significant challenge due to low SNR, interference, and varying mobility. To this end, we develop a novel recurrent neural network (RNN) based system that uses speakers and microphones to realize accurate room-scale tracking. Our system jointly estimates the propagation distance and angle-of-arrival (AoA) of signals reflected by the hand, based on AoA-distance profiles generated by 2D MUSIC. We design a series of techniques to significantly enhance the profile quality under low SNR. We feed the profiles in a recent history to our RNN to estimate the distance and AoA. In this way, we can exploit the temporal structure among consecutive profiles to remove the impact of noise, interference and mobility. Using extensive evaluation, we show our system achieves 1.2--3.7~cm error within 4.5~m range, supports tracking multiple users, and is robust against ambient sound. To our knowledge, this is the first acoustic device-free room-scale tracking system.

Quick response (QR) codes are becoming pervasive due to their rapid readability and the popularity of smartphones with built-in cameras. QR codes are also gaining importance in the retail sector as a convenient mobile payment method. However, researchers have concerns regarding the security of QR codes, which leave users susceptible to financial loss or private information leakage. In this study, we addressed this issue by developing a novel QR code (called mQRCode), which exploits patterns presenting a specific spatial frequency as a form of camouflage. When the targeted receiver holds a camera in a designated position (e.g., directly in front at a distance of 30 cm from the camouflaged QR code), the original QR code is revealed in form of a Moire pattern. From any other position, only the camouflaged QR code can be seen. In experiments, the decryption rate of mQRCode was > 98.6% within 10.2 frames via a multi-frame decryption method. The decryption rate for cameras positioned 20° off axis or > 10cm away from the designated location dropped to 0%, indicating that mQRCode is robust against attacks.

Quick response (QR) codes are becoming pervasive due to their rapid readability and the popularity of smartphones with built-in cameras. QR codes are also gaining importance in the retail sector as a convenient mobile payment method. However, researchers have concerns regarding the security of QR codes, which leave users susceptible to financial loss or private information leakage. In this study, we address this issue by developing a novel QR code (called mQR code), which exploits patterns presenting a specific spatial frequency as a form of camouflage. When the targeted receiver holds a camera in a designated position (e.g., directly in front at a distance of 30 cm from the camouflaged QR code), the original QR code is revealed in form of a Moiré pattern. From any other position, only the camouflaged QR code can be seen. In experiments, the decryption rate of mQR codes is $> 98%$. The decryption rate for cameras positioned $20\degree$ off axis or $> 10cm$ from the designated location drops to $0%$, indicating that any attackers will be unable to steal a usable image.

NarrowBand-IoT (NB-IoT) is a radio access technology standardized by 3GPP to support a large set of use cases associated with the rapid deployment of massive machine-type communications. NB-IoT facilitates the connection of devices in inaccessible areas, extends battery life, and reduces device complexity. Unfortunately, the opacity of the underlying schema (i.e., the way that these benefits are achieved) makes it very difficult for most users and developers to manage deployment scenarios. In this study, we built an embedded system comprising a Raspberry Pi with an NB module, referred to as NBPilot, which interacts with NB networks to identify essential signalling messages transmitted by a Qualcomm NB modem. This system gives researchers and developers an unprecedented understanding of network behaviour as well as the ability to adjust them to their particular requirements. We employed the-state-of-art machine learning techniques for modeling and the analysis of NB performance. The efficacy of the proposed NBPilot system was established by applying it to a metropolitan NB-IoT network with over 2,000 NB sites for the collection and testing of data trace as well as the validation of a cellular station prior to going online.

Near-field communication (NFC) plays a crucial role in the operation of mobile devices to enhance applications such as payment, social networks, private communication, gaming, and etc. Despite of the convenience, existing NFC standards like ISO-13157 require additional hardware (e.g., loop antenna and dedicated chip) and thereby hindering their wide-scale applications. In this work, we seek to propose a novel near-field communication protocol, MagneComm, which utilizes Magnetic Induction (MI) signals emitted from CPUs and captured by magnetometers on mobile devices for communication. Since CPUs and magnetometers are readily available components in mobile devices, MagneComm eliminates the requirement for special hardware and complements existing near-field communication protocols by providing additional bandwidth. We systematically analyze the characteristics of magnetic signals of CPUs and facilitate MagneComm with one-way communication, full-duplex communication, and multi-transmitter schemes in accordance with the hardware availability on devices. We prototype MagneComm on both laptops and smartphones. Extensive evaluation results show that MagneComm achieves up to 110bps within 10cm.

Next generation devices, such as virtual reality (VR), augmented reality (AR), and smart appliances, demand a simple and intuitive way for users to interact with them. To address such needs, we develop a novel acoustic based device-free tracking system, called Strata, to enable a user to interact with a nearby device by simply moving his finger. In Strata, a mobile (e.g., smartphone) transmits known audio signals at inaudible frequency, and analyzes the received signal reflected by the moving finger to track the finger location. To explicitly take into account multipath propagation, the mobile estimates the channel impulse response (CIR), which characterizes signal traversal paths with different delays. Each channel tap corresponds to the multipath effects within a certain delay range. The mobile selects the channel tap corresponding to the finger movement and extracts the phase change of the selected tap to accurately estimate the distance change of a finger. Moreover, it estimates the absolute distance of the finger based on the change in CIR using a novel optimization framework. We then combine the absolute and relative distance estimates to accurately track the moving target. We implement our tracking system on Samsung Galaxy S4 mobile phone. Through micro-benchmarks and user studies, we show that our system achieves high tracking accuracy and low latency without extra hardware.

Data pertaining to the availability of parking slots is crucial to the efficient operation of systems designed to monitor the state of parking spaces. Outdoor parking systems have been developed using wireless sensors, Internet of Things (IoT) technology, and cameras. Unfortunately, interference from electromagnetic fields complicates the tuning of parameters for detection algorithms and limits accuracy to only 90 percent. In this study, we investigated these problems by collecting data from magnetic sensors, light sensors, and LoRa wireless modules used in the detection transient events (car arrivals and departures) over a period of 13 months. This led to the design an adaptive occupancy detection system using a variety of sensors, which can be deployed with only minimal calibration.

Network measurement remains a missing piece in today's software packet processing platforms. Sketches provide a promising building block for filling this void by monitoring every packet with fixed-size memory and bounded errors. However, our analysis shows that existing sketch-based measurement solutions suffer from severe performance drops under high traffic load. Although sketches are efficiently designed, applying them in network measurement inevitably incurs heavy computational overhead.

This paper proposes a novel routing protocol, DM+, to achieve distributed spatial multiplexing gain in wireless mesh networks. It lets multiple nodes simultaneously send and receive different streams over each hop. To realize this goal, we propose an optimization framework that jointly optimizes spatial multiplexing, routing, and rate limits while taking into account wireless interference. We further design and implement a practical routing protocol that (i) enforces the optimized multiplexed routes, (ii) synchronizes transmissions from different senders, (iii) encodes and decodes analog signals to support simultaneous transmissions, and (iv) compensates for the frequency offset incurred over a multihop path. Using QualNet simulation and USRP implementation, we show it significantly out-performs state-of-the-art shortest path routing and opportunistic routing protocols. To our knowledge, this is the first routing protocol and prototype that achieves distributed spatial multiplexing in a real multihop network.

No abstract available.

A mouse has been one of the most successful user interfaces due to its intuitive use. As more devices are equipped with displays and offer rich options for users to choose from, a traditional mouse that requires a surface to operate is no longer sufficient. While different types of air mice are available in the market, they rely on accelerometers and gyroscopes, which significantly limit the accuracy and ease of use.

Fingerprinting the Operating System (OS) running on a device based on its traffic has several applications, such as NAT detection, policy enforcement in enterprise networks, and billing for shared access in mobile networks. In this paper, we propose to utilize several features in TCP/IP headers for OS identification, and use real traffic traces to evaluate the accuracy of fingerprinting. Our trace-driven study shows that several techniques that successfully fingerprint desktop OSes are not effective for fingerprinting mobile devices. Therefore, we propose new features for fingerprinting OSes on mobile devices. We also consider NAT/tethering detection, an important application of OS fingerprinting. We use the presence of multiple OSes from the same IP address along with TCP timestamp, clock frequency, and boot time to detect tethering. Evaluation shows that our approach effectively detects tethering and outperforms existing schemes.

Networks are constantly generating an enormous amount of rich diverse information. Such information creates exciting opportunities for network analytics. However, a major challenge to enable effective network analytics is the presence of missing data, measurement errors, and anomalies. Despite significant work in network analytics, fundamental issues remain: (i) the existing works do not explicitly account for anomalies or measurement noise, and incur serious performance degradation under significant noise or anomalies, and (ii) they assume network matrices have low-rank structure, which may not hold in reality.

Customer care calls serve as a direct channel for a service provider to learn feedbacks from their customers. They reveal details about the nature and impact of major events and problems observed by customers. By analyzing the customer care calls, a service provider can detect important events to speed up problem resolution. However, automating event detection based on customer care calls poses several significant challenges. First, the relationship between customers' calls and network events is blurred because customers respond to an event in different ways. Second, customer care calls can be labeled inconsistently across agents and across call centers, and a given event naturally give rise to calls spanning a number of categories. Third, many important events cannot be detected by looking at calls in one category. How to aggregate calls from different categories for event detection is important but challenging. Lastly, customer care call records have high dimensions (e.g., thousands of categories in our dataset). In this paper, we propose a systematic method for detecting events in a major cellular network using customer care call data. It consists of three main components: (i) using a regression approach that exploits temporal stability and low-rank properties to automatically learn the relationship between customer calls and major events, (ii) reducing the number of unknowns by clustering call categories and using L1norm minimization to identify important categories, and (iii) employing multiple classifiers to enhance the robustness against noise and different response time. For the detected events, we leverage Twitter social media to summarize them and to locate the impacted regions. We show the effectiveness of our approach using data from a large cellular service provider in the US.

Users around the world have embraced new generation of mobile devices such as the smartphones at a remarkable rate. These devices are equipped with powerful communication and computation capabilities and they enable a wide range of exciting location-based services, e.g., location based ads, content prefetching etc. Many of these services can benefit from a better understanding of the smartphone user mobility, which may differ significantly from the general user mobility. Hence, previous works on understanding user mobility models and predicting user mobility may not directly apply to smartphone users. To overcome this, in this paper we analyze data from two popular location based social networks, where the users are real smartphone users and the places they check-in represent the typical locations where they use their smartphone applications. Specifically, we analyze how individual users move across different locations. We identify several factors that affect user mobility and their relative significance. We then leverage these factors to perform individual mobility prediction. We further show that our mobility prediction yields significant benefit to two important location based applications: content prefetching and shared ride recommendation.

Rate adaptation in WiFi networks has received significant attention recently. However, most existing work focuses on selecting the rate to maximize throughput. How to select a data rate to minimize energy consumption is an important yet under-explored topic. This problem is becoming increasingly important with the rapidly increasing popularity of MIMO deployment, because MIMO offers diverse rate choices (e.g., the number of antennas, the number of streams, modulation, and FEC coding) and selecting the appropriate rate has significant impact on power consumption.

This paper proposes VideoFountain, a novel service that deploys kiosks at popular venues to store and transmit digital media to users' personal devices using Wi-Fi access points, which may not have Internet connectivity. We leverage mobile users to deliver content to these kiosks. A key component in this design is an in-depth understanding of user mobility. We gather real mobility traces from two largest location-based social networks (Foursquare and Gowalla) and analyze both macroscopic and microscopic human mobility in different cities. Based on the insights we gain, we study several algorithms to determine the initial placement of content and design routing algorithms to optimize the content delivery. We further consider several practical issues, such as how to incentivize users to forward content, how to manage copyrights, how to ensure security, and how to achieve service discovery. We demonstrate the feasibility of VideoFountain using trace-driven simulations.

Wireless multicarrier communication systems transmit data by spreading it over multiple subcarriers and are widely used today owing to their robustness to multipath fading, high spectrum efficiency, and ease of implementation. In this paper, we use real measurements to show there is significant frequency diversity in Wi-Fi channels, and propose a series of techniques to explicitly harness such frequency diversity. In particular, we leverage the Channel State Information (CSI), which captures the SNR on each subcarrier to (i) map symbols to subcarriers according to their importance, (ii) effectively recover partially corrupted FEC groups and facilitate FEC decoding, and (iii) develop MAC-layer FEC to offer different degrees of protection to the symbols according to their error rates at the PHY layer. We further develop a rate adaptation approach that works together with these optimization schemes. Our trace-driven simulation and testbed experiments based on USRP clearly demonstrate the effectiveness of our approaches.

We present VCD, a novel system for enabling high-bandwidth content distribution in vehicular networks. In VCD, a vehicle opportunistically communicates with nearby access points (APs) to download the content of interest. To fully take advantage of such transient contact with APs, we proactively push content to the APs that the vehicles will likely visit in the near future. In this way, vehicles can enjoy the full wireless capacity instead of being bottle-necked by the Internet connectivity, which is either slow or even unavailable. We develop a new algorithm for predicting the APs that will soon be visited by the vehicles. We then develop a replication scheme that leverages the synergy among (i) Internet connectivity (which is persistent but has limited coverage and low bandwidth), (ii) local wireless connectivity (which has high bandwidth but transient duration), (iii) vehicular relay connectivity (which has high bandwidth but high delay), and (iv) mesh connectivity among APs (which has high bandwidth but low coverage). We demonstrate the effectiveness of VCD system using trace-driven simulation and Emulab emulation based on real taxi traces. We further deploy VCD in two vehicular networks: one using 802.11b and the other using 802.11n, to demonstrate its effectiveness.

Localization is a fundamental operation for many wireless networks. While GPS is widely used for location determination, it is unavailable in many environments either due to its high cost or the lack of line of sight to the satellites (e.g., indoors, under the ground, or in a downtown canyon). The limitations of GPS have motivated researchers to develop many localization schemes to infer locations based on measured wireless signals. However, most of these existing schemes focus on localization in static wireless networks. As many wireless networks are mobile (e.g., mobile sensor networks, disaster recovery networks, and vehicular networks), we focus on localization in mobile networks in this paper. We analyze real mobility traces and find that they exhibit temporal stability and low-rank structure. Motivated by this observation, we develop three novel localization schemes to accurately determine locations in mobile networks: (i) Low Rank based Localization (LRL), which exploits the low-rank structure in mobility, (ii) Temporal Stability based Localization (TSL), which leverages the temporal stability, and (iii) Temporal Stability and Low Rank based Localization (TSLRL), which incorporates both the temporal stability and the low-rank structure. These localization schemes are general and can leverage either mere connectivity (i.e., range-free localization) or distance estimation between neighbors (i.e., range-based localization). Using extensive simulations and testbed experiments, we show that our new schemes significantly outperform state-of-the-art localization schemes under a wide range of scenarios and are robust to measurement errors.

An opportunistic network is a type of challenged network that has attracted a great deal of attention in recent years. While a number of schemes have been proposed to facilitate data dissemination in opportunistic networks, there is an implicit assumption that each participating peer behaves collaboratively. Consequently, these schemes may be vulnerable if there are uncooperative or malicious peers in the network. In this study, we identify five types of non-collaborative behavior, namely free rider, black hole, supernova, hypernova, and wormhole behavior, in opportunistic networks. We also evaluate the impacts of the five types of behavior on the data transmission performance of three widely used routing schemes. Using simulations as well as real-world traces of network mobility, we show that the data forwarding performance degrades significantly as the number of non-collaborative peers, except wormholes, increases. Moreover, we find that the three compared routing schemes can benefit from wormhole behavior, especially when the network connectivity is poor and the buffer size is limited.

The objective of YushanNet is to provide a reliable and robust system for hiker tracking in Yushan National Park, Taiwan. The aggregated information can help national parks to provide various services to tourists, and the collected hiking traces can provide more precise information to professional rescue teams if there are hikers lost in the mountains. YushanNet is a delay and disruption tolerant system. In the system, each hiker is required to carry a matchbox-size device, which consists of a ZigBee-based mote and a GPS receiver, and the device records its hiking trace, along with encounter information with other devices. Then, the recorded data is disseminated in the network in a store-carry-and-forward fashion, until it reaches one of the base stations along the trail. In this demo, we will present the design, implementation, and deployment of the YushanNet system, and we will demonstrate the system using a small-scale network scenario.

Energy efficiency and positional accuracy are often contradictive goals. We propose to decrease power consumption without sacrificing significant accuracy by developing an energy-aware localization that adapts the sampling rate to target's mobility level. In this paper, an energy-aware adaptive localization system based on signal strength fingerprinting is designed, implemented, and evaluated. Promising to satisfy an application's requirements on positional accuracy, our system tries to adapt its sampling rate to reduce its energy consumption. The contribution of this paper is three-fold. (1) We have developed a model to predict the positional error of a real working positioning engine under different mobility levels of mobile targets, estimation error from the positioning engine, processing and networking delay in the location infrastructure, and sampling rate of location information. (2) In a real test environment, our energy-saving method solves the mobility estimation error problem by utilizing additional sensors on mobile targets. The result is that we can improve the prediction accuracy by as much as 37.01%. (3) We implemented our energy-saving methods inside a working localization infrastructure and conducted performance evaluation in a real office environment. Our performance results show as much as 49.76 % reduction in power consumption

Wi-Fi based indoor location systems have been shown to be both cost-effective and accurate, since they can attain meter-level positioning accuracy by using existing Wi-Fi infrastructure in the environment. However, two major technical challenges persist for current Wi-Fi based location systems, instability in positioning accuracy due to changing environmental dynamics, and the need for manual offline calibration during site survey. To address these two challenges, three environmental factors (people, doors, and humidity) that can interfere with radio signals and cause positioning inaccuracy are identified. Then, we have proposed a sensor-assisted adaptation method that employs RFID sensors and environment sensors to adapt the location systems automatically to the changing environmental dynamics. The proposed adaptation method performs online calibration to build multiple context-aware radio maps under various environmental conditions. Experiments were performed on the sensor-assisted adaptation method. The experimental results show that the proposed adaptive method can avoid adverse reduction in positioning accuracy under changing environmental dynamics.

Personal experience computing is about computing support for recording, storing, retrieving, editing, analyzing, and sharing of personal experiences. In this paper, we present our design, implementation and evaluation of a mobile authoring tool called mProducer. mProducer enables a user to generate personal experience content using a mobile device anytime, anywhere. To address challenges in both limited system resources and user interface constraints on a mobile device, mProducer provides several innovative system techniques and UI designs. (1) The Storage Constrained Uploading (SCU) algorithm uploads large multimedia data to remote servers, in order to alleviate the problem of limited storage on a mobile device. (2) Sensor-Assisted Automated Editing utilizes a tilt sensor on the mobile device to automate the detection and removal of blurry frames resulting from excessive amount of camera shaking. This sensor-based solution requires small processing overhead, and it is considered a good alternative to computational-expensive image processing techniques for detecting shaking artifacts. (3) Map-based content management interface incorporates a GPS receiver on a mobile device to record location meta-data for each recording captured by a user, and enables easy, intuitive content navigation on a small screen. (4) Keyframe-based editing enables a user to edit content using only keyframes. We have conducted user studies to evaluate overall editing experience, user satisfaction in the editing quality, task performance time, ease-of-use, and learnability. The results of user studies have shown that keyframe-based editing works best with a storyboard interface. In general, users have found mProducer to be both fun and easy to use on a mobile device.