Electromagnetic (EM) covert channels pose significant threats to computer and communications security in air-gapped networks. Previous works exploit EM radiation from various components (e.g., video cables, memory buses, CPUs) to secretly send sensitive information. These approaches typically require the attacker to deploy highly specialized receivers near the victim, which limits their real-world impact. This paper reports a new EM covert channel, TEMPEST-LoRa, that builds on Cross-Technology Covert Communication (CTCC), which could allow attackers to covertly transmit EM-modulated secret data from air-gapped networks to widely deployed operational LoRa receivers from afar. We reveal the potential risk and demonstrate the feasibility of CTCC by tackling practical challenges involved in manipulating video cables to precisely generate the EM leakage that could readily be received by third-party commercial LoRa nodes/gateways. Experiment results show that attackers can reliably decode secret data modulated by the EM leakage from a video cable at a maximum distance of 87.5m or a rate of 21.6 kbps. We note that the secret data transmission can be performed with monitors turned off (therefore covertly).

The limited bandwidth of Wi-Fi severely confines the granularity (especially in differentiating multiple subjects) of Wi-Fi sensing, posing a significant challenge for its wide adoption. Though utilizing multiple channels to expand the effective bandwidth sounds plausible, continuous spectrum stitching towards ultra-wideband (UWB) is far from practical given various constraints (e.g., the runtime channel availability and inconsistent channel responses across a wide bandwidth). To this end, we propose UWB-Fi as a novel Wi-Fi sensing system with ultra-wide bandwidth, leveraging only discrete and irregular channel sampling. We first design a fast channel hopping scheme to perform arbitrary sampling across 4.7GHz (i.e., 2.4 to 7.1GHz) bandwidth on commodity Wi-Fi hardware without interrupting default communications. As no signal processing tool is available to handle such channel samples, we innovate in a model-based deep learning approach that translates discrete channel samples to high-dimensional spectral parameters; this method successfully avoids the bias-variance tradeoff in parameter estimation, while filtering out hardware-related offsets inherent to Wi-Fi. Through extensive evaluations, we demonstrate that UWB-Fi successfully achieves fine-granularity sensing, enabling centimeter-level resolution for indoor multi-person sensing.

The rapid increase of the data of user behaviors on the Internet brings a promising chance to better discover user preferences. Recommender systems have become a popular tool for the discovery of user preferences. One key issue is how to employ user behavior sequences to develop effective sequential recommendations, especially when behavior sequences are biased. The current sequential recommendation methods either can only mine data dependencies but ignores bias or only can learn bias but cannot mine data dependencies. To solve these problems, in this article, we propose a neural collaborative sequential learning mechanism, which learns sequential information from user behavior sequences that contain bias. We propose a neural collaborative filtering (NCF) model that fully takes advantage of all data dependencies among users, items, and biased sequential behaviors. Our sequential learning mechanism employs a self-attention mechanism to learn sequential features into an embedding space and inputs this sequential embedding into the generalized matrix factorization (GMF) model and the multilayer perceptron (MLP) model. We performed experiments on two real-world datasets and compared our model with many well-known baselines. The experimental results demonstrate that our model achieves superior performance. We also give a thorough analysis through ablation experiments and sensitivity experiments.

Abstract Malware detection is an important task for the ecosystem of mobile applications (APPs), especially for the Android ecosystem, and is vital to guarantee the user experience of Android APPs. There have been some exiting methods trying to solve the problem of malware detection, but the methods suffer from several defects, such as high time complexity and mediocre accuracy, which seriously decrease the practicability of existing methods. To solve these problems, in this study, we propose a novel Android malware detection framework, where we contribute an efficient Application Programming Interface (API) call sequences extraction algorithm and an investigation of different types of classifiers. In API call sequences extraction, we propose an algorithm for transforming the function call graph from a multigraph into a directed simple graph, which successfully avoids the unnecessary repetitive path searching. We also propose a pruning search, which further reduces the number of paths to be searched. Our algorithm greatly reduces the time complexity. We generate the transition matrix as classification features and investigate three types of machine learning classifiers to complete the malware detection task. The experiments are performed on real‐world Android Packages (APKs), and the results demonstrate that our method significantly reduces the running time and produces high detection accuracy.

Radio frequency identification (RFID)-assisted management systems have been widely applied in warehousing, logistics, retailing, etc. In these scenarios, RFID-aided applications, e.g., object tracking and human behavior sensing, rely on a high-efficiency tag reading to realize accurate analyses and timely responses. However, serious tag collisions in those large-scale RFID systems will inevitably lead to significant decreases in the tag reading rates. To meet the strict timeliness requirements of those practical applications, we aim to treat the individual reading rate for each item tag differently and focus more attention on those user-interactive ones. However, due to unpredictable user behaviors, it is impractical to infer the user-interactive tags in advance. In addition, keeping focusing on them for continuous monitoring despite user movements and multipath-prevalent environments is also challenging. To solve these problems, we propose Spotlight, the first concurrent rate-adaptive reading system in passive RFIDs. Spotlight screens the ID-agnostic user-interactive tags by proposing a multichannel feature for narrow-band RFID systems without any hardware or protocol modification and achieves rate-adaptive reading by implementing real-time MU-MIMO beamforming. Substantial experiments with 1000+ COTS RFID tags exhibit that Spotlight outperforms the commercial reader by$2.7\times $and the SDR-based reader by$6.12\times $. In addition, Spotlight first proposes the online parallel decoding method to realize concurrency among multiple users, which breaks the commercial protocol’s throughput ceiling (37%) and achieves up to 59% throughputs.

Abstract Due to its development agility, continuous delivery, scalability and other characteristics, the microservice architecture systems (MASs) have provided complex business functions to hundreds of millions of users in many application fields. The operation and maintenance governance for a large number of microservices with complex relationships is crucial to ensuring the stability and reliability of an MAS. Although this research field has received certain attention and produced some innovative results, there is a lack of systematic reviews covering the different aspects of it. In this context, the central objective of this study is to carry out a systematic literature review (SLR) in this field, in an attempt to review existing issues, discuss the main trends, and share the findings with the academia. As a result, we start from more than 500 scientific papers published from 2009 to 2021 and extract 144 most significant papers, identify that the main research directions of this field include load balancing, fault detection, and autoscaling. Subsequently, we provide a comprehensive description of these research directions, discuss them in particular detail. We also determine limitations of current work and discuss new directions worth exploring in the future. Consequently, the outcomes will assist professionals and experts in the industry as well as academic researchers to focus more on operation and maintenance governance of MASs and further improve the relevant methods and theoretical systems in this field.

Sentiment analysis is an important task in social computing and behavior analysis, and is a typical indicator of social health. It is a challenging mission to predict the sentiment of people in socially implemented Internet of Medical Things (IoMT) systems. The existing methods have several defects, and a typical defect is that most methods ignore the fact that there is much noise in IoMT systems and it is far not enough only to develop classification models for one type of data. In socially implemented IoMT systems, many methods treat the review text as plain text but ignore the potential knowledge structure. To solve those problems, in this article, we propose a novel solution, which is composed of adversarial learning and a hierarchical attention mechanism. We construct a hierarchical attention mechanism to learn the knowledge structure of a text. We propose to apply the attention mechanism both at the word level and sentence level, enabling us to learn the knowledge from each word and each sentence. We propose to use adversarial learning to learn new knowledge as non-random perturbations, which promotes the model’s robustness. We evaluate our method on several large-scale real-world datasets, covering a wide range of cases of sentiment analysis. Experimental results demonstrate that our method achieves superior performance compared to state-of-the-art methods.

Gesture detection based on radio frequency signals has gained increasing popularity in recent years due to several benefits it has brought, such as eliminating the need to carry additional devices and providing better privacy. In traditional methods, significant breakthroughs have been made to improve recognition accuracy and scene robustness, but the limited computing power of edge devices (the first-level equipment to receive signals) and the requirement of fast response for detection have not been adequately addressed. In this article, we propose a lightweight Wi-Fi gesture recognition system, referred to as WiFine, which is designed and implemented for deployment on low-end edge devices without the use of any additional high-performance services in the process. Toward these goals, we first design algorithms for phase difference selection and amplitude enhancement, respectively, to tackle the problem of data drift caused by user change. Then, we design a cross-dimension fusion method to extract features of finer granularity from information of different dimensions, thus solving the precision problem of feature granularity. Finally, we design a lightweight neural network architecture by leveraging redundancy to reduce computational cost while ensuring satisfactory recognition accuracy. Extensive experimental results show that the proposed system achieves fast recognition of various actions with an accuracy up to 96.03% in 0.19 seconds.

Optical transmission performance measurement and prediction are key Digital Twin capabilities for the optical network. Recent advances in instrumentation and models that support optical transmission performance assessment are presented. Optical network operations automation use cases enabled by a transmission performance-focused Digital Twin are described or demonstrated. These include provisioning automation, transmission performance risk mapping, optimization-based planning and control, and generalized optical margin reduction.

In this paper, we observe an acoustic covert channel by modulating capacitor squeal on the monitor's power supply unit, and then present ScreenInformer to build a covert communication within a physically isolated network system. Unlike traditional electromagnetic side channels, capacitor squeal is usually not covered by safety shielding measures. To precisely modulate the capacitor squeal, we reveal the relationships among the displayed content on the screen, voltage variation on the power unit, and the frequency of acoustic leakage. In order to improve the demodulating ability for acoustic side-channel leakage with a low signal-to-noise ratio (SNR), we design a cross-correlation demodulation algorithm for the rich harmonics of leakage. An off-the-shelf mobile phone can support ScreenIn-former for exfiltrating sensitive information under ambient noise of up to 55 dB. Our various real-world experimental results show that ScreenInformer can achieve a communication distance of up to 130 cm and a maximum throughput of 170 bps. In addition, our observed capacitor squeal is widespread, which has the potential to enable common electronic devices to have communication capability.

The research on Wi-Fi sensing has been thriving over the past decade but the process has not been smooth. Three barriers always hamper the research: 1) unknown baseband design and its influence; 2) inadequate hardware; and 3) the lack of versatile and flexible measurement software. This article tries to eliminate these barriers through the following work.First, we present an in-depth study of the baseband design of the Qualcomm Atheros AR9300 (QCA9300) NIC. We identify a missing item of the existing channel state information (CSI) model, namely, the CSI distortion, and identify the baseband filter as its origin. We also propose a distortion removal method.Second, we reintroduce both the QCA9300 and software-defined radio (SDR) as powerful hardware for research. For the QCA9300, we unlock the arbitrary tuning of both the carrier frequency and bandwidth. For SDR, we develop a high-performance software implementation of the 802.11a/g/n/ac/ax baseband, allowing users to fully control the baseband and access the complete physical-layer information.Third, we release the PicoScenes software, which supports concurrent CSI measurement from multiple QCA9300, Intel Wireless Link (IWL5300), and SDR hardware. PicoScenes features rich low-level controls, packet injection, and software baseband implementation. It also allows users to develop their own measurement plugins.Finally, we report state-of-the-art results in the extensive evaluations of the PicoScenes system, such as the >2-GHz available spectrum on the QCA9300, concurrent CSI measurement, and up to 40 and 1 kHz CSI measurement rates achieved by the QCA9300 and SDR. PicoScenes is available athttps://ps.zpj.io.

As the ultra high frequency (UHF) passive radio frequency identification (RFID) technology becomes increasingly deployed, it faces an array of new security attacks. In this paper, we consider a type of attack in which a malicious RFID reader could arbitrarily access the tags, e.g., retrieve or modify IDs or other data in the memory, via standard commands. To deal with this type of attack, we propose a physical-layer tag protection framework, namely Arbitrator2.0, that involves two operating mode, i.e., one is to passively listen on RF channels and identify unauthorized readers, the other is working as normal reader to access tag information but resilient to one-antenna eavesdropper. Our solution does not need to modify RFID tags or the underlying communication standards. In this study, we have implemented a prototype Arbitrator2.0 over the universal software radio peripheral (USRP) platform, and conducted extensive experiments to evaluate its performance. The results show that Arbitrator2.0 can effectively diminish the unauthorized access attacks and prevent eavesdropping.

Gesture detection based on WiFi signals does not require users to carry additional equipment, and can better protect the privacy of users during the detection process, so it has received widespread attention. However, the existing work does not consider the actual deployment of the platform, and ignores the requirements for the computing power of the platform and the actual reasoning delay, resulting in many methods that are not suitable for the use of edge devices. In this paper, we propose a WiFi gesture detection system, named WiRN, which is fully deployed on edge devices and does not require the participation of additional computing devices. In WiRN, We have proposed solutions to related problems. First of all, in order to solve the problem of large differences in multiple phase differences obtained in different scenarios due to over-sensitive phases and to improve the robustness and universality of the system, we propose a multi-antenna-based phase difference selection algorithm to find the most suitable phase difference. Then, we fuse the amplitude and phase difference of different dimensions and obtain more fine-grained input data to solve the problem of the inability to deploy complex neural networks to fully extract features due to the limitation of edge device computing power, so that the input data contains richer feature information. In this way, for the first time, we will improve the accuracy of network classification from the data source. We evaluated the system through a series of experiments, and the results showed that under the premise of satisfying the real-time calculation of edge devices, we achieved the same accuracy as the existing complex network by using the simplest two-layer neural network. The recognition accuracy of about 93% is achieved in different environments.

In this paper, we propose a system called R# to estimate the number of human objects using passive RFID tags but without attaching anything to human objects. The idea is based on our observation that the more human objects are present, the higher the variation in the RSS values of the tag backscattered RF signals. Thus, based on the received RF signals, the reader can estimate the number of human objects. R# includes an RFID reader and some (say 20) passive tags, which are deployed in the region that we want to monitor the number of human objects, such as the region in front of a supermarket shelf. The RFID reader periodically emits RF signals to identify all tags and the tags simply respond with their IDs via EPCglobal Class 1 Generation 2 protocol. We implemented R# using commercial Impinj H47 passive RFID tags and Impinj reader model R420. We conducted experiments in a simulated picking aisle area of the supermarket environment. The experimental results show that R# can achieve high estimation accuracy (more than 90 percent with up to ten human objects).

Smart packaging adds sensing abilities to traditional packages. This paper investigates the possibility of using RF signals to test the internal status of packages and detect abnormal internal changes. Towards this goal, we design and implement a nondestructive package testing and verification system using commodity passive RFID systems, called Echoscope. Echoscope extracts unique features from the backscatter signals penetrating the internal space of a package and compares them with the previously collected features during the check-in phase. The use of backscatter signals guarantees that there is no difference in RF sources and the features reflecting the internal status will not be affected. Compared to other nondestructive testing methods such as X-ray and ultrasound, Echoscope is much cheaper and provides ubiquitous usage. Our experiments in practical environments show that Echoscope can achieve very high accuracy and is very sensitive to various types abnormal changes.

As the Ultra High Frequency (UHF) passive Radio Frequency IDentification (RFID) technology becomes increasingly deployed, it faces an array of new security attacks. In this paper, we consider a type of attack in which a malicious RFID reader could arbitrarily modify the tags via standard commands, e.g., IDs or other data in the memory. To deal with this type of attack, we propose a physical-layer RF signal based reader authentication solution, namely Arbitrator, that involves passively listening on RF channels, analyzing the communication signals, identifying unauthorized readers and jamming the commands from such readers. Our solution does not need to modify RFID devices or the underlying communication standards, hence fully compatible with the existing RFID infrastructure. In this study, we have implemented a prototype Arbitrator over the Universal Software Radio Peripheral (USRP) platform, and conducted extensive experiments to evaluate its performance. Our results show that Arbitrator can detect unauthorized RFID readers with high accuracy, and thus effectively diminish the unauthorized access attacks.

Regular free-weight exercise helps to strengthen natural movements and stabilize muscles that are important to strength, balance, and posture of human beings. Prior works have exploited wearable sensors or RF signal changes for activity sensing, recognition, and counting, etc.. However, none of them have incorporated three key factors necessary for a practical free-weight exercise monitoring system: recognizing free-weight activities on site, assessing their qualities, and providing useful feedbacks to the bodybuilder promptly. Our FEMO system provides an integrated free-weight exercise monitoring service that incorporates all the essential functionalities mentioned above. FEMO achieves this by attaching passive RFID tags on the dumbbells and leveraging the Doppler shift profile of the reflected backscatter signals for on-site free-weight activity recognition and assessment. The rationale behind FEMO is 1) since each free-weight activity owns unique arm motions, the corresponding Doppler shift profile should be distinguishable to each other. 2) Doppler profile of each activity has a strong spatial-temporal correlation that implicitly reflects the quality of the activity. We implement FEMO with COTS RFID devices and conduct a two-week experiment. The preliminary result from 15 volunteers demonstrates that FEMO can be applied to a variety of free-weight activities, and provide valuable feedbacks for activity alignment.

Smart environments and security systems require automatic detection of human behaviors including approaching to or departing from an object. Existing human motion detection systems usually require human beings to carry special devices, which limits their applications. In this paper, we present a system called APID to detect arm reaching by analyzing backscatter communication signals from a passive RFID tag on the object. APID does not require human beings to carry any device. The idea is based on the influence of human movements to the vibration of backscattered tag signals. APID is compatible with commodity off-the-shelf devices and the EPCglobal Class-1 Generation-2 protocol. In APID an commercial RFID reader continuously queries tags through emitting RF signals and tags simply respond with their IDs. A USRP monitor passively analyzes the communication signals and reports the approach and departure behaviors. We have implemented the APID system for both single-object and multi-object scenarios in both horizontal and vertical deployment modes. The experimental results show that APID can achieve high detection accuracy.

Smart packaging adds sensing abilities to traditional packages. This paper investigates the possibility of using RF signals to test the internal status of packages and detect abnormal internal changes. Towards this goal, we design and implement a nondestructive package testing and verification system using commodity passive RFID systems, called Echoscope. Echoscope extracts unique features from the backscatter signals penetrating the internal space of a package and compares them with the previously collected features during the check-in phase. The use of backscatter signals guarantees that there is no difference in RF sources and the features reflecting the internal status will not be affected. Compared to other nondestructive testing methods such as X-ray and ultrasound, Echoscope is much cheaper and provides ubiquitous usage. Our experiments in practical environments show that Echoscope can achieve very high accuracy and is very sensitive to various types abnormal changes.

Identifying the object that attracts human visual attention is an essential function for automatic services in smart environments. However, existing solutions can compute the gaze direction without providing the distance to the target. In addition, most of them rely on special devices or infrastructure support. This paper explores the possibility of using a smartphone to detect the visual attention of a user. By applying the proposed VADS system, acquiring the location of the intended object only requires one simple action: gazing at the intended object and holding up the smartphone so that the object as well as user's face can be simultaneously captured by the front and rear cameras. We extend the current advances of computer vision to develop efficient algorithms to obtain the distance between the camera and user, the user's gaze direction, and the object's direction from camera. The object's location can then be computed by solving a trigonometric problem. VADS has been prototyped on commercial off-the-shelf (COTS) devices. Extensive evaluation results show that VADS achieves low error (about 1.5° in angle and 0.15m in distance for objects within 12m) as well as short latency. We believe that VADS enables a large variety of applications in smart environments.

Activity recognition plays an important role in human-computer interactions. Recently, Channel State Information (CSI), known as a fine-grained information capturing the properties of WiFi signal propagation, has been widely used for activity recognition in a device-free pattern. Since CSI is much sensitive to ambient changes, CSI can be used as fingerprints as human activities. However, existing approaches require tremendous overhead in the model training and suffer from failures due to environmental interferences. In this paper, we propose HAR, a CSI based human activity recognition system. HAR investigates the CSI intra-correlation structure (termed as topics) of different human activities. We leverage an unsupervised machine learning method, namely topic model, to extract action characters. Compared to prior works, HAR only requests minor manual intervention, significantly reducing manpower costs in the model training. We implement HAR using commodity WiFi devices to evaluate its performance under different environment settings. The results show that the extracted features are stable to different devices and volunteers, facilitating HAR to achieving an average matching accuracy, i.e., > 90%.

Different from online shopping, in-store shopping has few ways to collect the customer behaviors before purchase. In this paper, we present the design and implementation of an on-site Customer Behavior IDentification system based on passive RFID tags, named CBID. By collecting and analyzing wireless signal features, CBID can detect and track tag movements and further infer corresponding customer behaviors. We model three main objectives of behavior identification by concrete problems and solve them using novel protocols and algorithms. The design innovations of this work include a Doppler effect based protocol to detect tag movements, an accurate Doppler frequency estimation algorithm, an image-based human count estimation protocol and a tag clustering algorithm using cosine similarity. We have implemented a prototype of CBID in which all components are built by off-the-shelf devices. We have deployed CBID in real environments and conducted extensive experiments to demonstrate the accuracy and efficiency of CBID in customer behavior identification.

Device-free object tracking provides a promising solution for many localization and tracking systems to monitor non-cooperative objects, such as intruders, which do not carry any transceiver. However, existing device-free solutions mainly use special sensors or active RFID tags, which are much more expensive compared to passive tags. In this paper, we propose a novel motion detection and tracking method using passive RFID tags, named Twins. The method leverages a newly observed phenomenon called critical state caused by interference among passive tags. We contribute to both theory and practice of this phenomenon by presenting a new interference model that precisely explains it and using extensive experiments to validate it. We design a practical Twins based intrusion detection system and implement a real prototype by commercial off-the-shelf RFID reader and tags. Experimental results show that Twins is effective in detecting the moving object, with very low location errors of 0.75 m in average (with a deployment spacing of 0.6 m).

Physical-layer identification utilizes unique features of wireless devices as their fingerprints, providing authenticity and security guarantee. Prior physical-layer identification techniques on radio frequency identification (RFID) tags require nongeneric equipments and are not fully compatible with existing standards. In this paper, we propose a novel physical-layer identification system, GenePrint, for UHF passive tags. The GenePrint prototype system is implemented by a commercial reader, a USRP-based monitor, and off-the-shelf UHF passive tags. Our solution is generic and completely compatible with the existing standard, EPCglobal C1G2 specification. GenePrint leverages the internal similarity among pulses of tags' RN16 preamble signals to extract a hardware feature as the fingerprint. We conduct extensive experiments on over 10 000 RN16 preamble signals from 150 off-the-shelf RFID tags. The results show that GenePrint achieves a high identification accuracy of 99.68% +. The feature extraction of GenePrint is resilient to various malicious attacks, such as the feature replay attack.

Efficient and accurate tracking of device-free objects is critical for anti-intrusion systems. Prior solutions for device-free object tracking are mainly based on costly sensing infrastructures, resulting in barriers to practical applications. In this paper, we propose an accurate and efficient motion detection system, named EMoD, to track device-free objects based on cheap passive RFID tags. EMoD is the first RFID system that can estimate the moving direction as well as the current location of a device-free object by measuring critical power variation sequences of passive tags. Compared with previous solutions, the unique advantage of EMoD, i.e., the capability to estimate moving directions, enables object tracking using a much sparser tag deployment. We contribute to both theory and practice of this phenomenon by presenting the interference model that precisely explains it and using extensive experiments to validate it. We design a practical EMoD based intrusion detection system and implement a prototype by commercial off-the-shelf (COTS) RFID reader and tags. The real-world experiments results show that EMoD is effective in tracking the trajectory of moving object in various environments.

Indoor localization is of importance for many applications. Crowdsourcing individual users' measurements can provide accurate localization without costly site-survey. However, crowdsourcing based approaches suffer from the cold start problem, in which at the beginning of system deployment, there are insufficient users to contribute their measurements, resulting in inaccurate and time-inefficient localization. In this paper, we propose a hybrid indoor localization method to solve such problem, called ACIL. We first employ the inertial navigation technique to localize some core positions or paths. To tackle the inaccuracy problem, we propose an effective method that utilizes the channel state information (CSI) of wireless signals for accurate distance estimation. This method is based on a new observation: there is a ripple-like fading pattern in wireless signals upon moving objects. Leveraging this observation, our system is capable of calculating the distance of human's movement and his/her direction. We also propose a graph-matching algorithm to setup the correlation between the trajectory and floor map. With those extra obtained location information, the impact of cold start issue will be significantly mitigated, while the LBS can be guaranteed with high localization accuracy. Extensive experiments show that the effectiveness in the human localization and movement detection. Extensive experiments validate the great performance of our protocol in case of various human locations and diverse channel conditions.

In this paper, we propose a system called R# to estimate the number of human objects using passive RFID tags but without attaching anything to human objects. The idea is based on our observation that the more human objects are present, the higher the variance in the RSS values of the tag backscattered RF signal. Thus, based on the received RF signal, the reader can estimate the number of human objects. R# includes an RFID reader and some (say 20) passive tags, which are deployed in the region that we want to monitor the number of human objects, such as the region in front of a painting. The RFID reader periodically emits RF signal to identify all tags and the tags simply respond with their IDs via C1G2 standard protocols. We implemented R# using commercial Impinj H47 passive RFID tags and Impinj reader model R420. We conducted experiments in a simulated picking aisle area of the supermarket environment. The experimental results show that R# can achieve high estimation accuracy (more than 90%).

Different from online shopping, in-store shopping has few ways to collect the customer behaviors before purchase. In this paper, we present the design and implementation of an on-site Customer Behavior Identification system based on passive RFID tags, named CBID. By collecting and analyzing wireless signal features, CBID can detect and track tag movements and further infer corresponding customer behaviors. We model three main objectives of behavior identification by concrete problems and solve them using novel protocols and algorithms. The design innovations of this work include a Doppler effect based protocol to detect tag movements, an accurate Doppler frequency estimation algorithm, a multi-RSS based tag localization protocol, and a tag clustering algorithm using cosine similarity. We have implemented a prototype of CBID in which all components are built by off-the-shelf devices. We have deployed CBID in real environments and conducted extensive experiments to demonstrate the accuracy and efficiency of CBID in customer behavior identification.

Although fingerprint based localization is promising for indoor applications, its accuracy still remains a huge challenge. Most of existing approaches rely on the Radio Signal Strength (RSS) to generate fingerprints. However, merely using RSS is unable to accurately localize objects since such an one-dimensional fingerprint will be seriously influenced by the interference and multi-path effect in the indoor environment. In this paper, we propose a new localization approach based on multidimensional Wi-Fi fingerprint. Instead of only using RSS to construct fingerprint, we employ RSS, transmitted power, and channel information to construct an integrated fingerprint. The extended fingerprint enables fine-grained localization and tracking services. We also deign a cosine similarity based matching algorithm and enhanced particle filter mechanism to achieve accurate localization and tracking. Extensive experiment and implementation results show that the new fingerprint and proposed algorithms can achieve an accuracy within two meters in 90% of testing points, while demonstrating a good adaptability to complex indoor environments.

Device-free based object tracking provides a promising solution for many localization and tracking systems to monitor non-cooperative objects which do not carry any transceiver such as intruders. However, existing device-free solutions mainly use sensors and active RFID tags, which are much more expensive compared to passive tags. In this paper, we propose a novel motion detection and tracking method using passive RFID tags, named Twins. The method leverages a phenomenon called critical state caused by interference among passive tags. We theoretically explain this phenomenon via an interference model and conduct extensive experiment to validate it. We design a practical Twins based intrusion detection system and implement a real prototype with commercial off-the-shelf reader and tags. Experimental results show that Twins is effective in detecting the moving object, with low location errors of 0.75m in average.

Crowd counting, which count or accurately estimate the number of human beings within a region, is critical in many applications, such as guided tour, crowd control and marketing research and analysis. A crowd counting solution should be scalable and be minimally intrusive (i.e., device-free) to users. Image-based solutions are device-free, but cannot work well in a dim or dark environment. Non-image based solutions usually require every human being carrying device, and are inaccurate and unreliable in practice. In this paper, we present FCC, a device-Free Crowd Counting approach based on Channel State Information (CSI). Our design is motivated by our observation that CSI is highly sensitive to environment variation, like a frog eye. We theoretically discuss the relationship between the number of moving people and the variation of wireless channel state. A major challenge in our design of FCC is to find a stable monotonic function to characterize the relationship between the crowd number and various features of CSI. To this end, we propose a metric, the Percentage of nonzero Elements (PEM), in the dilated CSI Matrix. The monotonic relationship can be explicitly formulated by the Grey Verhulst Model, which is used for crowd counting without a labor-intensive site survey. We implement FCC using off-the-shelf IEEE 802.11n devices and evaluate its performance via extensive experiments in typical real-world scenarios. Our results demonstrate that FCC outperforms the state-of-art approaches with much better accuracy, scalability and reliability.

Locating objects labeled with RFID tags is an important issue which should be addressed in many applications, such as warehouse management, goods management in supermarket and finding of lost objects. Some existing works use large numbers of reference tags which involve lots of manpower to deploy them. Others achieve high accuracy, but rely on sophisticated equipments which are hardly available in large scale to the industry. This work exploits the radiation pattern of existing directional panel antenna which is steerable and derives angle-of-arrival (AoA) information from the energy reflected by the target tag when the antenna is rotating. We use Commercial Off-The-Shelf (COTS) equipments and get median position accuracy of 29cm in our preliminary experiment.

Comparing to well protected data frames, Wi-Fi management frames (MFs) are extremely vulnerable to various attacks. Since MFs are transmitted without encryption or authentication, attackers can easily launch various attacks by forging the MFs. In a collaborative environment with many Wi-Fi sniffers, such attacks can be easily detected by sensing the anomaly RSS changes. However, it is quite difficult to identify these spoofing attacks without assistance from other nodes. By exploiting some unique characteristics (e.g., rapid spatial decorrelation, independence of Txpower, and much richer dimensions) of 802.11n Channel State Information (CSI), we design and implement CSITE, a prototype system to authenticate the Wi-Fi management frames on PHY layer merely by one station. Our system CSITE, built upon off-the-shelf hardware, achieves precise spoofing detection without collaboration and in-advance fingerprint. Several novel techniques are designed to address the challenges caused by user mobility and channel dynamics. To verify the performances of our solution, we conduct extensive evaluations in various scenarios. Our test results show that our design significantly outperforms the RSS-based method. We observe about 8 times improvement by CSITE over RSS-based method on the falsely accepted attacking frames.

Numerous indoor localization techniques have been proposed recently to meet the intensive demand for location-based service. Fingerprint-based approach is one of most popular and inexpensive solution. In terms of constructing the fingerprint database, there have to be a synchronized measurement for both indoor space(eg by labor-intensive site-survey or sensor-based crowd sensing) and fingerprint space, by this means the fingerprints database is established. It is the indoor space measurement hinders the usability of fingerprint-based localization system. In this work, we propose a sensor-free crowds ensing indoor localization scheme, protocol. The main contribution of our protocol is that we don't need indoor space measurement. Floor plan and RSS samples temporal sequence is the only requirement. The core of our method is a graph matching based manifold alignment process, which automatically finds the best correspondence between floor plan and wireless fingerprint transition structure. With no more need of indoor space measurement, the system deployment complexity and cost are significantly reduced. We implement our protocol at AP-end and deploy it in a 2000m^2 office environment. The evaluation has shown that our protocol can handle complex environment mapping and achieve high localization & tracking accuracy.

As a large scale real sensor network system, GreenOrbs reveals that locating sensor nodes in the forest still faces great challenges because of volatile and fluctuating environmental factors. In this paper, we present a novel localization scheme, EARL, which provides accurate reference nodes and good ranging quality. We exam the range quality along routing paths by taking complex environmental factors into account, such as forest density, temperature and humidity. To improve localization accuracy, we use power scanning technique to judge the accuracy reference nodes and further calibrate the bad nodes through reverse-localization. To overcome the error propagation, we assign different weights to the range measurement according to the ranging quality. We implemented our localization scheme in GreenOrbs testbed, and evaluate through extensive experiments. The results demonstrate that EARL outperforms the current localization approaches with better accuracy. The localization accuracy achieved by our method is around 20% higher than best existing methods.