Reconfigurable Intelligent Surfaces (RIS) can significantly enhance Wi-Fi performance by reshaping RF propagation, but controlling them effectively remains a major challenge. Existing approaches rely on either RSSI or CSI feedback, yet neither can simultaneously deliver high performance and broad deployability. We introduce WiMirror, the first 802.11-compliant and highly effective algorithm for real-time RIS control in Wi-Fi networks. WiMirror leverages the Compressed Beamforming Report (CBR) in modern 802.11 standards, which retains essential channel information absent in RSSI, while eliminating the deployment barrier of CSI-based, chip-specific solutions. We design an efficient modeling and estimation framework capable of accurately inferring the RIS reflection angles toward the client using the compressed channel information embedded in CBRs. Extensive experimental results show that WiMirror achieves near-optimal performance with minimal measurement overhead, outperforming state-of-the-art RSSI- and CSI-based methods in both accuracy and efficiency.

Efficient inference for on-device Large Language Models (LLMs) remains challenging due to limited hardware resources and the high cost of the prefill stage, which processes the full input context to construct Key-Value (KV) caches. We present SparKV, an adaptive KV loading framework that combines cloud-based KV streaming with on-device computation. SparKV models the cost of individual KV chunks and decides whether each chunk should be streamed or computed locally, while overlapping the two execution paths to reduce latency. To handle fluctuations in wireless connectivity and edge resource availability, SparKV further refines offline-generated schedules at runtime to rebalance communication and computation costs. Experiments across diverse datasets, LLMs, and edge devices show that SparKV reduces Time-to-First-Token by 1.3×-5.1× with negligible impact on response quality, while lowering per-request energy consumption by 1.5× to 3.3×, demonstrating its robustness and practicality for real-world on-device deployment.

Cloud-fog Federated Learning (FL) is promising for collaborative model training in large-scale edge networks. In cloud-fog FL with constrained communication resources, selecting high-quality client models for aggregation is critical to boost the global model. However, the clients in real world hold multimodal and heterogeneous data, while existing selection strategies rarely consider the imbalance of communication cost and model convergence rates across modalities, thus seriously degrading the efficiency of model aggregation. Moreover, most previous multimodal fusion methods require aligned multimodal samples. However, the data of modality-heterogeneous clients may be isolated and unaligned in FL, so these previous methods cannot be applied to such scenarios, thereby hindering the knowledge fusion across various modalities. To address the above issues, we propose a cloud-fog FL system named COOL, which achievesunimodal aggregationat the fog layer andmultimodal fusionat the cloud layer. First, we propose a Modality-aware Online Client Selection (MOCS) strategy to assist unimodal aggregation. Unlike previous selection strategies, MOCS realizes the dynamic selection budget allocation for various modalities by monitoring the convergence gap of modalities, thus striking the performance balance among modality-heterogeneous clients. Second, to overcome the limitation of previous methods that require aligned multimodal data, we propose a Multimodal Fusion strategy with Feature Synthesis (MFFS). MFFS realizes multimodal fusion with isolated samples via adaptive feature synthesis and cross-modal attention training, thus building a more powerful multimodal predictor while preserving the client data privacy. Finally, experimental results demonstrate that COOL has superior performance compared to the existing algorithms.

As the adoption of LiDAR expands across various fields such as autonomous driving, robotics, and smart cities, the demand for adaptive scanning capabilities to better capture dynamic and complex scenes becomes paramount. Current LiDAR technologies, limited by fixed uniform scan patterns, struggle to prioritize critical areas, resulting in reduced perception accuracy and performance inefficiencies. This paper introduces SmartLiDAR, an advanced LiDAR system that enhances scanning efficiency and performance by adaptively optimizing scan focus through an intelligent, software-defined micro-mirror controller. Unlike traditional systems, SmartLiDAR dynamically adjusts its scan pattern based on environmental characteristics and application-specific requirements, concentrating sample points on key objects without increasing power consumption or scan time. SmartLiDAR achieves this by integrating a novel quadratic micro-mirror controller, an adaptive algorithm for generating fine-grained attention map with prioritized scan focus, and a carefully designed optimization algorithm that maps attention maps to practical scanning patterns. We prototype SmartLiDAR by building a software-defined LiDAR using commercially available optical components and FPGA. Our experimental results demonstrate that SmartLiDAR significantly enhances resolution in regions of interest by 3x and increases average object detection precision by up to 16.11%. Additionally, SmartLiDAR maintains negligible extra energy consumption and processing latency, making it suitable for real-time applications, such as autonomous vehicles.

Intracortical brain-computer interfaces (iBCIs) promise to sense brain activity at an unprecedented scale and resolution. However, unlocking this potential for practical, untethered applications remains an unsolved challenge. The major barrier is the significant wireless bandwidth required to stream high-resolution brain signals. Existing approaches rely on extensive on-device processing, which is severely constrained by the limited resources of iBCI devices, the complexity of brain signals, and the dynamic nature of neural activity. This paper introduces Neuralite, a wireless iBCI system that integrates high-fidelity brain signal models and effective brain sensing mechanisms within an efficient server-driven streaming framework. By thoroughly characterizing brain signal variability, Neuralite adaptively optimizes streaming under dynamic neural conditions, minimizing bandwidth consumption without imposing excessive burdens on resource-constrained iBCI devices. Experimental results demonstrate that Neuralite significantly reduces bandwidth consumption while preserving neural decoding precision across key iBCI components and representative applications.

In recent years, there has been a significant amount of research focused on predicting resources in order to enhance the performance of cloud systems. Many researchers believe that the more accurate the prediction, the more effective resource management will be in ensuring reliable performance. However, our study in this paper demonstrates that there is a gap between resource demand prediction and system performance. Furthermore, our experiment results have demonstrated that the accurate and fine-grained prediction helps to achieve a more reliable and efficient system performance, especially in CPU utilization rate.

Conventional approaches to analyzing industrial control systems have relied on either white-box analysis or black-box fuzzing. However, white-box methods rely on sophisticated domain expertise, while black-box methods suffers from state explosion and thus scales poorly when analyzing real ICS involving a large number of sensors and actuators. To address these limitations, we propose XAI-based gray-box fuzzing, a novel approach that leverages explainable AI and machine learning modeling of ICS to accurately identify a small set of actuators critical to ICS safety, which result in significant reduction of state space without relying on domain expertise. Experiment results show that our method accurately explains the ICS model and significantly speeds-up fuzzing by 64x when compared to conventional black-box methods.

IoT uplink performance is crucial for a wide variety of IoT applications such as health sensing and industrial control, which demand reliable delivery of sensor data to the cloud. However, due to the limited transmission power budget imposed on many power-constrained IoT devices, IoT uplinks are highly susceptible to cross-technology interference (CTI) caused by coexisting networks. Previous approaches to mitigating CTI have relied on MAC/PHY designs. They suffer from poor performance and limited generality in the presence of wideband CTI sources such as Wi-Fi and RF jammer, which transmit aggressively on large spectrum chunks using diverse radio technologies.

Wi-Fi sensing systems leverage wireless signals from widely deployed Wi-Fi devices to realize sensing for a broad range of applications. However, current Wi-Fi sensing systems heavily rely on the channel state information (CSI) to learn the signal propagation characteristics, while the availability of CSI is highly dependent on specific Wi-Fi chipsets. Through a city-scale measurement, we discover that the availability of CSI is extremely limited in operational Wi-Fi devices. In this work, we propose a new wireless sensing system called BeamSense that exploits the compressed beamforming reports (CBR). Due to the extensive support of transmit beamforming in operational Wi-Fi devices, CBR is commonly accessible and hence enables a ubiquitous sensing capability. BeamSense adopts a novel multi-path estimation algorithm that can efficiently and accurately map bidirectional CBR to a multi-path channel based on intrinsic fingerprints. We implement BeamSense on several prevalent models of Wi-Fi devices and evaluated its performance with microbenchmarks and three representative Wi-Fi sensing applications. The results show that BeamSense is capable of enabling existing CSI-based sensing algorithms to work with CBR with high sensing accuracy and improved generalizability.

Video cameras have been widely deployed at city-scale for security surveillance. However, under poor light condition and limited video resolution, it is often impossible to determine the identity of a pedestrian by using computer vision alone. Motivated by the fast and continuous penetration of smartphones, in this paper, we explore the feasibility of augmenting video cameras to ‘see’ the identities of smartphones (e.g., MAC addresses, cellular IDs, or even phone numbers) carried by pedestrians. We develop IDCam–a system that integrates a video camera with a smart antenna array, which leverages spatial-domain sensing of smartphone’s sleep-talk (i.e., the packets transmitted by apps while the phone’s screen is off) to match the angles of smartphone’s packets and pedestrians in the video, enabling passive identity linking without the cooperation of target. Experiment results show that IDCam accurately links visual and wireless identities in a complex deployment environment with tens of pedestrians and intensive multipath signal propagation.

Narrowband Internet of Things (NB-IoT) standardized by the 3GPP has attracted significant attention since its appearance. It provides extended coverage, high capacity, reduced device processing complexity, and low-power consumption to meet the requirements of a wide range of IoT applications. In particular, NB-IoT is expected to bring IoT devices prolonged lifetime up to ten years. Radio access (RA) plays a key role in the total power consumption of NB-IoT devices. Specifically, the enhanced coverage levels (ECLs) configure the user equipment (UE) with different random-access resources and power consumption during packet transmissions. In this article, we examine the ECL selection strategies for reducing the power consumption of NB-IoT. We develop two testbeds to conduct extensive field measurements related to ECL selection. Based on the measurement results, we analyze the key issues in the ECL selection process. Then, we propose an adaptive RA approach for UE, which includes two novel strategies for predictive ECL selection and opportunistic packet transmission. Evaluations show that, with the configuration of ECL selected by our adaptive approach, the UE can reduce the radio power consumption up to 36% while maintaining the same block error rate (BLER) during uploading under real-world settings.

Recent years have witnessed the increasing penetration of wireless charging base stations in the workplace and public areas, such as airports and cafeterias. Such an emerging wireless charging infrastructure has presented opportunities for new indoor localization and identification services for mobile users. In this paper, we present QID, the first system that can identify a Qi-compliant mobile device during wireless charging in real-time. QID extracts features from the clock oscillator and control scheme of the power receiver and employs light-weight algorithms to classify the device. QID adopts a 2-dimensional motion unit to emulate a variety of multi-coil designs of Qi, which allows for fine-grained device fingerprinting. Our results show that QID achieves high recognition accuracy. With the prevalence of public wireless charging stations, our results also have important implications for mobile user privacy.

Narrowband-Internet of Things (NB-IoT) is an emerging cellular communication technology designed for low-power wide-area applications. Cell selection determines the channel of user device and hence is an important issue in cellular networks. In this article, we make the first attempt to examine and optimize the cell selection in NB-IoT networks by field measurement. We conduct measurements at 30 different locations which involve five typical application scenarios of NB-IoT. Two kinds of NB-IoT modules and two network operators are also involved in the measurements. We find four potential issues on the cell selection of the User Equipment (UE) through the measurements. We propose an adaptive cell selection approach to optimize the cell selection of UE. The simulation test based on real-world measurement data shows that the cell selected by the adaptive approach can improve the coverage level and reduce the power consumption for UE.

Low-power wide-area network technologies such as long-range wide-area network (LoRaWAN) are promising for collecting low-rate monitoring data from geographically distributed sensors, in which timestamping the sensor data is a critical system function. This article considers a synchronization-free approach to timestamping LoRaWAN uplink data based on signal arrival time at the gateway, which well matches LoRaWAN’s one-hop star topology and releases bandwidth from transmitting timestamps and synchronizing end devices’ clocks at all times. However, we show that this approach is susceptible to a frame delay attack consisting of malicious frame collision and delayed replay. Real experiments show that the attack can affect the end devices in large areas up to about 50,000, m 2 . In a broader sense, the attack threatens any system functions requiring timely deliveries of LoRaWAN frames. To address this threat, we propose a LoRaTS gateway design that integrates a commodity LoRaWAN gateway and a low-power software-defined radio receiver to track the inherent frequency biases of the end devices. Based on an analytic model of LoRa’s chirp spread spectrum modulation, we develop signal processing algorithms to estimate the frequency biases with high accuracy beyond that achieved by LoRa’s default demodulation. The accurate frequency bias tracking capability enables the detection of the attack that introduces additional frequency biases. We also investigate and implement a more crafty attack that uses advanced radio apparatuses to eliminate the frequency biases. To address this crafty attack, we propose a pseudorandom interval hopping scheme to enhance our frequency bias tracking approach. Extensive experiments show the effectiveness of our approach in deployments with real affecting factors such as temperature variations.

Due to the low power of electromagnetic radiation (EMR), EM convert channel has been widely considered as a short-range attack that can be easily mitigated by shielding. This paper overturns this common belief by demonstrating how covert EM signals leaked from typical laptops, desktops and servers are decoded from hundreds of meters away, or penetrate aggressive shield previously considered as sufficient to ensure emission security. We achieve this by designing EMLoRa – a super resilient EM covert channel that exploits memory as a LoRa-like radio. EMLoRa represents the first attempt of designing an EM covert channel using state-of-the-art spread spectrum technology. It tackles a set of unique challenges, such as handling complex spectral characteristics of EMR, tolerating signal distortions caused by CPU contention, and preventing adversarial detectors from demodulating covert signals. Experiment results show that EMLoRa boosts communication range by 20x and improves attenuation resilience by up to 53 dB when compared with prior EM covert channels at the same bit rate. By achieving this, EMLoRa allows an attacker to circumvent security perimeter, breach Faraday cage, and localize air-gapped devices in a wide area using just a small number of inexpensive sensors. To countermeasure EMLoRa, we further explore the feasibility of uncovering EMLoRa's signal using energy- and CNN-based detectors. Experiments show that both detectors suffer limited range, allowing EMLoRa to gain a significant range advantage. Our results call for further research on the countermeasure against spread spectrum-based EM covert channels.

Recent years have seen a widespread deployment of NB-IoT networks for massive machine-to-machine communication in the emerging 5G era. Unfortunately, the key aspects of NB-IoT networks, such as radio access performance and power consumption have not been well-understood due to lack of effective tools and closed nature of operational cellular infrastructure. In this paper, we develop NB-Scope - the first hardware NB-IoT diagnostic tool that supports fine-grained fusion of power and protocol traces. We then conduct a large-scale field measurement study consisting of 30 nodes deployed at over 1,200 locations in 4 regions during a period of three months. Our in-depth analysis of the collected 49 GB traces showed that NB-IoT nodes yield significantly imbalanced energy consumption in the wild, up to a ratio of 75:1, which may lead to short battery lifetime and frequent network partition. Such a high performance variance can be attributed to several key factors including diverse network coverage levels, long tail power profile, and excessive control message repetitions. We then explore the optimization of NB-IoT base station settings on a software-defined eNodeB testbed, and suggest several important design aspects that can be considered by future NB-IoT specifications and chipsets.

Low-power wide-area network technologies such as LoRaWAN are promising for collecting low-rate monitoring data from geographically distributed sensors, in which timestamping the sensor data is a critical system function. This paper considers a synchronization-free approach to timestamping LoRaWAN uplink data based on signal arrival time at the gateway, which well matches LoRaWAN’s one-hop star topology and releases bandwidth from transmitting timestamps and synchronizing end devices’ clocks at all times. However, we show that this approach is susceptible to a frame delay attack consisting of malicious frame collision and delayed replay. Real experiments show that the attack can affect the end devices in large areas up to about 50, 000 m2. In a broader sense, the attack threatens any system functions requiring timely deliveries of LoRaWAN frames. To address this threat, we propose a LoRaTS gateway design that integrates a commodity LoRaWAN gateway and a low-power software-defined radio receiver to track the inherent frequency biases of the end devices. Based on an analytic model of LoRa’s chirp spread spectrum modulation, we develop signal processing algorithms to estimate the frequency biases with high accuracy beyond that achieved by LoRa’s default demodulation. The accurate frequency bias tracking capability enables the detection of the attack that introduces additional frequency biases. Extensive experiments show the effectiveness of our approach.

Recent years have seen a widespread deployment of NB-IoT networks for massive machine-to-machine communication in the emerging 5G era. Unfortunately, the key aspects of NB-IoT networks, such as radio access performance and power consumption have not been well-understood due to lack of effective tools and closed nature of operational cellular infrastructure. In this paper, we develop NB-Scope - the first hardware NB-IoT diagnostic tool that supports fine-grained fusion of power and protocol traces. We then conduct a large-scale field measurement study consisting of 30 nodes deployed at over 1,200 locations in 3 regions during a period of three months. Our in-depth analysis of the collected 49 GB traces showed that NB-IoT nodes yield significantly imbalanced energy consumption in the wild, up to a ratio of 75:1, which may lead to short battery lifetime and frequent network partition. Such a high performance variance can be attributed to several key factors including diverse network coverage levels, long tail power profile, and excessive control message repetitions. We then explore the optimization of NB-IoT base station settings on a software-defined eNodeB testbed, and suggest several important design aspects that can be considered by future NB-IoT specifications and chipsets.

Driving while distracted or losing alertness significantly increases the risk of traffic accident. The emerging Internet of Things (IoT) systems for smart driving hold the promise of significantly reducing road accidents. In particular, detecting unsafe hand motions and warning the driver using smart sensors can improve the driver’s alertness and skill. However, due to the impact of the vehicle’s movement and the significant variation across different driving environments, detecting the position of the driver’s hand is challenging. This article presents SafeWatch—a system based on smartwatches and smartphones that detects the driver’s unsafe behaviors in a real-time manner. SafeWatch infers driver’s hand position based on several important features, such as the posture of the driver’s forearm and the vibration on the smartwatch. SafeWatch employs a novel adaptive training algorithm that keeps updating the training data set at run-time based on inferred hand positions in certain driving conditions. The evaluation with 75 real driving trips from six subjects shows that SafeWatch has a high accuracy over 97.0% for both recall and precision in detection of the unsafe hand positions when the condition lasts for more than 6.0 s , as well as over 97.1% recall and over 91.0% precision in detection of the unsafe hand movements when it lasts for more than 2.5 s . The relative position of the hand to the steering wheel also reveals some detailed driving habits, like the type of steering method.

The design trade-offs of transceiver hardware are crucial to the performance of wireless systems. In this paper, we present an in-depth study to characterize the surprisingly notable systemic impacts of low-pass filter (LPF) design, which is a small yet indispensable component used for shaping spectrum and rejecting interference. Using a bottom-up approach, we examine how signal-level distortions caused by the trade-off of LPF design propagate to the upper-layers of wireless communication, reshaping bit error patterns and degrading link performance of today's 802.11 systems. Moreover, we propose a novel algorithm that harnesses LPF defects for improving video streaming, which substantially enhances video quality in mobile environments.

LoRa is an emerging low-power wide-area network technology. Existing studies have focused on LoRa's communication performance. Differently, we study two physical properties of LoRa, i.e., its performance in timing the signal propagation and the transmitters' frequency traits. Signal timing is a basis for implementing clock synchronization, ranging, and advanced physical (PHY) layer techniques such as concurrent decoding. However, LoRa end devices do not provide PHY-layer timestamping that is needed for accurate timing. We propose a SoftLoRa design that integrates a low-power software-defined radio receiver with a LoRa transceiver to provide PHY-layer access. Experiments show that SoftLoRa achieves microseconds timing accuracy over one kilometer and in a multistory building with strong signal attenuation.

Design of clock synchronization for networked nodes faces a fundamental trade-off between synchronization accuracy and universality of heterogeneous platforms, because a high synchronization accuracy generally requires platform-dependent hardware-level network packet timestamping. This paper presents TouchSync, a new indoor clock synchronization approach for wearables that achieves millisecond accuracy while preserving universality in that it uses standard system calls only, such as reading system clock, sampling sensors, and sending/receiving network messages. The design of TouchSync is driven by a key finding from our extensive measurements that the skin electric potentials (SEPs) induced by powerline radiation are salient, periodic, and synchronous on a same wearer and even across different wearers. TouchSync integrates the SEP signal into the universal principle of Network Time Protocol and solves an integer ambiguity problem by fusing the ambiguous results in multiple synchronization rounds to conclude an accurate clock offset between two synchronizing wearables. With our shared code, TouchSync can be readily integrated into any wearable applications. Extensive evaluation based on our Arduino and TinyOS implementations shows that TouchSync's synchronization errors are below 3 and 7 milliseconds on the same wearer and between two wearers 10 kilometers apart, respectively.

With the prevalence of personal Bluetooth devices, potential breach of user privacy has been an increasing concern. To date, sniffing Bluetooth traffic has been widely considered an extremely intricate task due to Bluetooth's indiscoverable mode, vendor-dependent adaptive hopping behavior, and the interference in the open 2.4 GHz band. In this paper, we present BlueEar-a practical Bluetooth traffic sniffer. BlueEar features a novel dual-radio architecture where two Bluetooth-compliant radios coordinate with each other on learning the hopping sequence of indiscoverable Bluetooth networks, predicting adaptive hopping behavior, and mitigating the impacts of RF interference. We built a prototype of BlueEar to sniff on Bluetooth classic traffic. Experiment results show that BlueEar can maintain a packet capture rate higher than 90% consistently in real-world environments, where the target Bluetooth network exhibits diverse hopping behaviors in the presence of dynamic interference from coexisting 802.11 devices. In addition, we discuss the privacy implications of the BlueEar system, and present a practical countermeasure that effectively reduces the packet capture rate of the sniffer to 20%. The proposed countermeasure can be easily implemented on Bluetooth master devices while requiring no modification to slave devices such as keyboards and headsets.

In current routing algorithms based on encounter history in Delay-Tolerant Networks (DTNs), packets are always forwarded to nodes with highest probability to reach destination node. However, to the best of our knowledge, no analytical node transient contact pattern detection to achieve high performance, is reported in the literature. In this letter, DTN-Knca - a novel routing which detects frequently encountered nodes' transient contact patterns by correlation analysis is proposed. The trace-driven simulations demonstrate the higher throughput of DTN-Knca in comparison to the state-of-the-art DTN typical routing algorithms based on the encounter history knowledge.

The rapid proliferation of wireless video cameras has raised serious privacy concerns. In this paper, we propose a stimulating-and-probing approach to detecting wireless spy cameras. The core idea is to actively alter the light condition of a private space to manipulate the spy camera's video scene, and then investigates the responsive variations of a packet flow to determine if it is produced by a wireless camera. Following this approach, we develop Blink and Flicker -- two practical systems for detecting wireless spy cameras. Blink is a lightweight app that can be deployed on off-the-shelf mobile devices. It asks the user to turn on/off the light of her private space, and then uses the light sensor and the wireless radio of the mobile device to identify the response of wireless cameras. Flicker is a robust and automated system that augments Blink to detect wireless cameras in both live and offline streaming modes. Flicker employs a cheap and portable circuit, which harnesses daily used LEDs to stimulate wireless cameras using human-invisible flickering. The time series of stimuli is further encoded using FEC to combat ambient light and uncontrollable packet flow variations that may degrade detection performance. Extensive experiments show that Blink and Flicker can accurately detect wireless cameras under a wide range of network and environmental conditions.

The design trade-offs of transceiver hardware are crucial to the performance of wireless systems. In this paper, we present an in-depth study to characterize the surprisingly notable systemic impacts of low-pass filter (LPF) design, which is a small yet indispensable component used for shaping spectrum and rejecting interference. Using a bottom-up approach, we examine how signal-level distortions caused by the trade-off of LPF design propagate to the upper-layers of wireless communication, reshaping bit error patterns and degrading link performance of today's 802.11 systems. Moreover, we propose a novel algorithm that harnesses LPF defects for improving video streaming, which substantially enhances video quality in mobile environments.

Design of clock synchronization for networked nodes faces a fundamental trade-off between synchronization accuracy and universality for heterogeneous platforms, because a high synchronization accuracy generally requires platform-dependent hardware-level network packet timestamping. This paper presents TouchSync, a new indoor clock synchronization approach for wearables that achieves millisecond accuracy while preserving universality in that it uses standard system calls only, such as reading system clock, sampling sensors, and sending/receiving network messages. The design of TouchSync is driven by a key finding from our extensive measurements that the skin electric potentials (SEPs) induced by powerline radiation are salient, periodic, and synchronous on a same wearer and even across different wearers. TouchSync integrates the SEP signal into the universal principle of Network Time Protocol and solves an integer ambiguity problem by fusing the ambiguous results in multiple synchronization rounds to conclude an accurate clock offset between two synchronizing wearables. With our shared code, TouchSync can be readily integrated into any wearable applications. Extensive evaluation based on our Arduino and TinyOS implementations shows that TouchSync's synchronization errors are below 3 and 7 milliseconds on the same wearer and between two wearers 10 kilometers apart, respectively.

Tracking heart rate for fitness using wrist-type wearables is challenging, because of the significant noise caused by intensive wrist movements. In this paper, we present FitBeat - a lightweight system that enables accurate heart rate tracking on wrist-type wearables during intensive exercises. Unlike existing approaches that rely on computation- intensive signal processing, FitBeat integrates and augments standard filter and spectral analysis tool, which achieves comparable accuracy while significantly reducing computational overhead. FitBeat integrates contact sensing, motion sensing and simple spectral analysis algorithms to suppress various error sources. We implement FitBeat on a COTS smartwatch, and evaluate the performance of FitBeat for typical workouts of different intensities, including walking, running and riding. Experimental results involving 10 subjects show that the average error of FitBeat is around 4 beats per minute, which improves heart rate accuracy of the default heart rate tracker of Moto 360 by 10x.

With the prevalence of personal Bluetooth devices, potential breach of user privacy has been an increasing concern. To date, sniffing Bluetooth traffic has been widely considered an extremely intricate task due to Bluetooth's indiscoverable mode, vendor-dependent adaptive hopping behavior, and the interference in the open 2.4 GHz band. In this paper, we present BlueEar -a practical Bluetooth traffic sniffer. BlueEar features a novel dual-radio architecture where two Bluetooth-compliant radios coordinate with each other on learning the hopping sequence of indiscoverable Bluetooth networks, predicting adaptive hopping behavior, and mitigating the impacts of RF interference. Experiment results show that BlueEar can maintain a packet capture rate higher than 90% consistently in real-world environments, where the target Bluetooth network exhibits diverse hopping behaviors in the presence of dynamic interference from coexisting Wi-Fi devices. In addition, we discuss the privacy implications of the BlueEar system, and present a practical countermeasure that effectively reduces the packet capture rate of the sniffer to 20%. The proposed countermeasure can be easily implemented on the Bluetooth master device while requiring no modification to slave devices like keyboards and headsets.

The pursuit of high speed wireless communication is pushing wireless networks toward wider channels. Narrowband interference and frequency- selective fading significantly impact the performance of broadband wireless communication. To cope with the harsh channel conditions, orthogonal frequency division multiplexing (OFDM), which divides a band of spectrum into numerous subcarriers that carry data in parallel, is widely adopted. Because subcarriers experience different channel qualities in a wide band of spectrum, different modulation schemes may be used for different subcarriers. This paper exploits the modulation scheme diversity as rich information to assist data transmission. In this paper, we propose encoding each modulation scheme with a bit pattern that occurs frequently when allocating data bits to subcarriers. If the bits to be allocated on a subcarrier match the bit pattern defined on the subcarrier, the receiver is informed by the transmitter through subcarrier nulling. Because the bit pattern usually consists of more bits than that can be represented by a modulation symbol in low-density modulation schemes, the total transmission time is shortened. Further, detecting a null subcarrier is more reliable than decoding a modulation symbol. Therefore, the known bits represented by the selected bit patterns help improve decoding performance. Through experiments on USRP1 we show that the throughput is increased due to shortened transmission time and reduced bit error rates.

Wireless sensor networks (WSNs) are increasingly deployed for mission-critical applications such as emergency management and health care, which impose stringent requirements on the communication performance of WSNs. To support these applications, it is crucial to model and measure the effect of wireless interference, which is the major factor that limits WSN performance. Accurate modeling and measurement of interference faces two key challenges. First, as shown in our experimental results, interference yields considerable spatial and temporal variations of WSN performance, which poses a major challenge for measurement at rum-time. Second, in the unlicensed band, the communication of WSN is interfered by coexisting wireless devices such as smartphones and laptops equipped with 802.11 radios, which lead to cross-technology interference that are difficult to characterize due to the heterogeneous PHY. To tackle these challenges, this paper presents a novel accuracy-aware approach to interference modeling and measurement for WSNs. First, we propose a new regression-based interference model and analytically characterize its accuracy based on statistics theory. Second, we develop a novel protocol called accuracy-aware interference measurement for measuring the proposed interference model with assured accuracy at run time. Third, building on interference modeling, we propose an algorithm that accurately forecasts the performance of WSNs in the presence of cross-technology interference. Our extensive experiments on a testbed of 17 TelosB motes show that the proposed approaches achieve high accuracy of interference modeling and WSN performance forecasting with significantly lower overhead than state-of-the-art approaches.

Prior studies show that repairing partially corrupted packets, instead of retransmitting them in their entirety, holds potential in improving the performance of 802.11 networks. However, the efficiency of existing packet recovery approaches is severely limited by various overhead associated to redundant transmission and repeated channel contention. In this paper, we propose CodeRepair, a practical coding-based protocol that recovers partially corrupted 802.11 packets without these pains. The design of CodeRepair is based on two novel ideas. First, CodeRepair pushes the limit of 802.11 PHY to piggyback parities in the padded bits of OFDM, obviating the need of transmitting extra information for error correction. Second, CodeRepair corrects errors at the PHY layer, which is significantly more efficient than traditional link-layer approaches. This is due to the fact that a single coded bit usually affects the decoding of a group of data bits in 802.11 convolutional code. As a result, CodeRepair can salvage a partially corrupted packet by correcting a small number of erroneous coded bits using the padded parities. To reduce computational cost of error recovery, CodeRepair employs single parity code for correcting coded bit errors. We propose several techniques to augment the error correcting capability of single parity code without compromising its computation efficiency. Our evaluation shows that CodeRepair recovers an average of 34% partially corrupted packets, and improves the end-to-end link goodput by 59% on lossy 802.11 links.

Despite the widespread use of Bluetooth technology, identity management of Bluetooth devices remains a significant challenge because the MAC address and name of Bluetooth device are easy to forge. In this paper, we present BlueID - a practical system that identifies Bluetooth devices by fingerprinting their clocks. Previous approaches to clock fingerprinting exclusively rely on the timestamps carried by packet headers, which can be easily spoofed by hacking the user-space device driver. In comparison, BlueID performs clock fingerprinting based on the temporal feature of Bluetooth frequency hopping, which is impossible to forge without a customized baseband. Due to the proprietary nature of chipset firmware that implements baseband on commodity Bluetooth devices, BlueID will significantly raise the bar of identity spoofing. Moreover, BlueID employs simple yet efficient techniques to detect and differentiate low power Bluetooth transmissions from a distance, making it suitable for mobile applications like energy efficient localization and tracking. BlueID is implemented on a low cost wireless development platform and extensively evaluated based on 56 commodity devices. We show that BlueID can detect Bluetooth radios from 100m away, and identify different devices with high accuracy, short delay, and low computational overhead. Although this paper focuses on Bluetooth, the design of BlueID is general and can be applied to other frequency hopping based wireless systems.

The increasing availability of inexpensive off-the-shelf 802.11 hardware has made it possible to deploy access points (APs) densely to ensure the coverage of complex enterprise environments such as business and college campuses. However, dense AP deployment often leads to increased level of wireless contention, resulting in low system throughput. A promising approach to address this issue is to enable the transmission concurrency of exposed terminals in which two senders lie in the range of one another but do not interfere each other's receiver. However, existing solutions ignore the rate diversity of 802.11 and hence cannot fully exploit concurrent transmission opportunities in a WLAN. In this paper, we presentTRACK-TransmissionRateAdaptation forColliding linKs, a novel protocol for harnessing exposed terminals with a rate adaptation approach in enterprise WLANs. Using measurement-based channel models, TRACK can optimize the bit rates of concurrent links to improve system throughput while maintaining link fairness. Our extensive experiments on a testbed of 17 nodes show that TRACK improves system throughput by up to 67% and 35% over 802.11 CSMA and conventional approaches of harnessing exposed terminals.

Error correction is a fundamental problem in wireless system design as wireless links often suffer high bit error rate due to the effects of signal attenuation, multipath fading and interference. This paper presents a new cross-layer solution called LEAD to improve the performance of existing channel decoders. While the traditional wisdom of cross-layer design is to exploit physical layer information at upper-layers, LEAD represents a paradigm shift in that it leverages upper-layer protocol signatures to improve the performance of physical layer channel decoding. The approach of LEAD is motivated by two key insights. First, channel codes can correct more errors when the values of some bits, which we refer to as {\em pilots}, are known before decoding. Second, some header fields of upper-layer protocols are often fixed or highly biased toward certain values. These distinctive bit pattern signatures can thus be exploited as pilots to assist channel decoding. To realize this idea, we first characterize bit bias in real-life network traffic, and develop an efficient algorithm to extract pilot bits with assured prediction accuracy. We then propose a decoding framework to allow existing channel decoders to effectively exploit extracted pilots. We implement LEAD on GNURadio/USRP platform and evaluate its performance by replaying real-life packet traces on a testbed of 12 USRP links. Our results show that LEAD significantly improve wireless link performance, while incurring very low overhead. Specifically, LEAD reduces more than 90\% bit errors for 48.9\% packets, and improves the end-to-end link throughput by 1.43x to 1.93x over existing error correction schemes.

Recent research shows that significant energy saving can be achieved in mobility-enabled wireless sensor networks (WSNs) that visit sensor nodes and collect data from them via short-range communications. However, a major performance bottleneck of such WSNs is the significantly increased latency in data collection due to the low movement speed of mobile base stations. To address this issue, we propose a rendezvous-based data collection approach in which a subset of nodes serve as rendezvous points that buffer and aggregate data originated from sources and transfer to the base station when it arrives. This approach combines the advantages of controlled mobility and in-network data caching and can achieve a desirable balance between network energy saving and data collection delay. We propose efficient rendezvous design algorithms with provable performance bounds for mobile base stations with variable and fixed tracks, respectively. The effectiveness of our approach is validated through both theoretical analysis and extensive simulations.

Wireless Sensor Networks (WSNs) are increasingly available for mission-critical applications such as emergency management and health care. To meet the stringent requirements on communication performance, it is crucial to understand the complex wireless interference among sensor nodes. Recent empirical studies suggest that the packet-level interference model, also referred to as the packet reception ratio (PRR) versus SINR model or PRR-SINR model, offers significantly improved realism than other simplistic models such as the disc model. However, as shown in our experimental results, the PRR-SINR model yields considerable spatial and temporal variations in reality, which poses a major challenge for accurate measurement at run time. This paper presents a novel accuracy-aware approach to interference modeling and measurement for WSNs. First, we propose a new regression-based PRR-SINR model and analytically characterize its accuracy based on statistics theory. Second, we develop a novel protocol called accuracy-aware interference measurement (AIM) for measuring the proposed PRR-SINR model with assured accuracy at run time. AIM also adopts new clock calibration and in-network aggregation techniques to reduce the overhead of interference measurement. Our extensive experiments on a 17-node testbed of TelosB motes show that AIM achieves high accuracy of PRR-SINR modeling with significantly lower overhead than state of the art approaches.

Recent years have witnessed the increasing adoption of ZigBee technology for performance-sensitive applications such as wireless patient monitoring in hospitals. However, operating in unlicensed ISM bands, ZigBee devices often yield unpredictable throughput and packet delivery ratio due to the interference from ever increasing WiFi hotspots in 2.4 GHz band. Our empirical results show that, although WiFi traffic contains abundant white space, the existing coexistence mechanisms such as CSMA are surprisingly inadequate for exploiting it. In this paper, we propose a novel approach that enables ZigBee links to achieve assured performance in the presence of heavy WiFi interference. First, based on statistical analysis of real-life network traces, we present a Pareto model to accurately characterize the white space in WiFi traffic. Second, we analytically model the performance of a ZigBee link in the presence of WiFi interference. Third, based on the white space model and our analysis, we develop a new ZigBee frame control protocol called WISE, which can achieve desired trade-offs between link throughput and delivery ratio. Our extensive experiments on a testbed of 802.11 netbooks and 802.15.4 TelosB motes show that, in the presence of heavy WiFi interference, WISE achieves 4× and 2× performance gains over B-MAC and a recent reliable transmission protocol, respectively, while only incurring 10.9% and 39.5% of their overhead.

Interference modeling is crucial for the performance of numerous WSN protocols such as congestion control, link/channel scheduling, and reliable routing. In particular, understanding and mitigating interference becomes increasingly important for Wireless Sensor Networks (WSNs) as they are being deployed for many data-intensive applications such as structural health monitoring. However, previous works have widely adopted simplistic interference models that fail to capture the wireless realities such as probabilistic packet reception performance. Recent studies suggested that the physical interference model (i.e., PRR-SINR model) is significantly more accurate than existing interference models. However, existing approaches to physical interference modeling exclusively rely on the use of active measurement packets, which imposes prohibitively high overhead to bandwidth-limited WSNs. In this paper, we propose the passive interference measurement (PIM) approach to tackle the complexity of accurate physical interference characterization. PIM exploits the spatiotemporal diversity of data traffic for radio performance profiling and only needs to gather a small amount of statistics about the network. We evaluate the efficiency of PIM through extensive experiments on both a 13-node and a 40-node testbeds of TelosB motes. Our results show that PIM can achieve high accuracy of PRR-SINR modeling with significantly lower overhead compared with the active measurement approach.

Multi-channel design has received significant attention for low-power wireless networks (LWNs), such as 802.15.4-based wireless sensor networks, due to its potential of mitigating interference and improving network capacity. However, recent studies reveal that the number of orthogonal channels available on commodity wireless platforms is small, which significantly hinders the performance of existing multi-channel protocols. A promising solution is to explore the use of partially overlapping channels for communications. However, this approach faces several key challenges such as increased inter-channel interference and significantly higher overhead of channel measurement. In this paper, we systematically study the inter-channel interference and its impact on link capacity and the performance of multi-channel protocols in LWNs. First, we develop empirical models for characterizing inter-channel signal attenuation based on experiments on TelosB motes. We then propose a novel measurement algorithm which can significantly reduce the overhead of multi-channel interference measurement by exploiting the spectral power density (SPD) of the transmitter. Finally, we apply our interference models to both link capacity analysis and channel assignment protocols. Our extensive experiments on a testbed of 30 TelosB motes show that our interference measurement algorithm has an average error of 2.95%. Our results also demonstrate that multi-channel protocols for LWNs can significantly benefit from using overlapping channels.

In this paper, we study the problem of minimizing the number of data replicas for delay-bounded queries in wireless ad hoc networks. We focus our attention on step-by-step expanding ring search, which provides an upper bound on query delay to any expanding ring based search strategies. We analyze the probabilistic behavior of query delay, and develop an analytical approach to approximate the minimum number of data replicas for delay bounded data query in wireless ad hoc networks. We validate our analysis through extensive simulations.

Mobile Ad Hoc Networks have inherently dynamic topologies. Due to the distributed, multi-hop nature of these networks, random mobility of nodes affects not only the availability of radio links between particular node pairs, but also impedes the reliability of communication paths. Therefore, to optimize the performance of existing network protocols, it is important to be able to give an accurate prediction of the future link status within a random mobility environment. In this paper, a novel approach is introduced to derive analytical expression of link availability for mobile ad hoc networks. By a rough estimation of the initial distance between two nodes, the prediction algorithm presented in this paper is able to accurately estimate link availability for a given short period of time. Simulation results are reported to verify the correctness of our approach.