The broadcast nature of wireless media makes WLANs easily attacked by rogue Access Points (APs) . Rogue AP attacks can potentially cause severe privacy leakage and financial loss. Hardware fingerprinting is the state-of-the-art technology to detect rogue APs since an attacker would find it difficult to set up a rogue AP with specific hardware fingerprints. However, existing hardware fingerprints not only depend on the AP but also depend on the client, significantly limiting their application scenarios. In this work, we investigate two novel client-agnostic fingerprints, which can be extracted using commercial off-the-shelf WiFi devices, to detect rogue APs. One is the power amplifier non-linearity fingerprint and the other is the frame interval distribution fingerprint . These two fingerprints remain consistent over time and space for the same AP but vary across different APs even with the same brand, model, and firmware. We use the fingerprint similarity between the candidate AP and the authorized AP for device authentication in typical indoor environments. We have also proposed a threshold-improved authentication scheme to improve the robustness of our system in dynamic environments. Our schemes can be implemented without modifying the infrastructural APs and can work well with new clients without rebuilding the fingerprint database. We evaluate our scheme in both in-lab and field scenarios, by analyzing 18 million WiFi packets. Results show that our scheme achieves an overall 96.55% positive detection rate and a 4.31% false alarm rate. Moreover, the threshold-improved authentication scheme can further reduce the false alarm rate by 13.0%-44.8% for dynamic environments.

Channel State Information (CSI)-based wireless sensing has recently attracted extensive attention from both academia and industry. However, it is still challenging and time-consuming to develop a CSI-based sensing application due to the use of complex signal processing algorithms and the requirements of accuracy and responsiveness. In this paper, we present TinyCSI, a rapid development framework for CSI-based sensing applications. With TinyCSI, developers only need to write a main script to determine the CSI collection settings and a callback function to process the collected CSI signals using the well-abstracted Matlab/C-based library, without dealing with the connection/transmission details of the sensing nodes. To achieve fast performance tuning, TinyCSI also provides three working modes for different deployment requirements: a remote mode for fast iteration of the sensing algorithms and their parameters, an efficient mode for making full use of computing resources and improving sensing responsiveness, and a standalone mode for offline running sensing systems on individual nodes. We implement three representative demos and conduct real-world user studies to show the workflows and benefits of TinyCSI. Experimental results show that TinyCSI helps reduce the lines of code significantly compared to the original implementation. More importantly, the efficient mode can generate an optimal computing resource allocation solution and significantly improve the sensing responsiveness.

The broadcast nature of wireless medium makes WLANs easily be attacked by rogue Access Points (APs). Rogue AP attacks can potentially cause severe privacy leakage and financial lost. Hardware fingerprinting is the state-of-the-art technology to detect rogue APs, since an attacker would find it difficult to set up a rogue AP with specific hardware fingerprints. However, existing hardware fingerprints not only depend on the AP, but also depend on the client, significantly limiting their applicable scenarios. In this work, we investigate two novel client-agnostic fingerprints, which can be extracted using commercial off-the-shelf WiFi devices, to detect rogue APs. One is the power amplifier non-linearity fingerprint and the other is the frame interval distribution fingerprint. These two fingerprints remain consistent over time and space for the same AP but vary across different APs even with the same brand, model and firmware. We use the fingerprint similarity between the candidate AP and the authorized AP for device authentication. Our scheme can be implemented without modifying the infrastructural APs and can work well with new clients without rebuilding the fingerprint database. We evaluate our scheme in both in-lab and field scenarios, by analyzing 12 million WiFi packets. Results shows that our scheme achieves an overall 96.55% positive detection rate and a 4.31% false alarm rate.

Indoor intrusion detection (IID) is an essential technology to enable various important applications. Recently, an extensive amount of research has been carried out to develop device-free intrusion detection systems based on the WiFi signal due to its ubiquitous existence and minimum privacy disclosure. However, existing WiFi-based intrusion detection systems typically suffer from false alarms caused by pets, limiting their usage in practice. In this article, we propose PetFree to revisit the IID problem with careful consideration of pet interference. PetFree uses fine-grained channel state information (CSI) of WiFi signals to detect whether there is a human or a pet in the monitoring area. The basic idea of PetFree is to use the effective interference height (EIH) differences between humans and pets. We propose a novel CSI-EIH model to characterize the relationship between CSI measurements and the EIH of the target. Based on this model, PetFree manages to achieve accurate pet identification using only a single WiFi link. We implement and evaluate PetFree extensively with commodity WiFi devices in three different indoor scenarios. Results show that PetFree achieves an overall 93.7% intrusion detection rate and decreases the false alarm rate caused by home pets to 6.5%, significantly outperforming the state-of-the-art approach.