by Kejia Zhang

PowerSpy: Location Tracking using Mobile Device Power Analysis

Yan Michalevsky, Aaron Schulman, etc.Stanford University

Published in USENIX Security '15

by Kejia Zhang

Background Tracking phones is valuable GPS, base statuion/WiFi connectivity

Need permission to access Power consumption

Free to access Android:

• /sys/class/power_supply/battery/voltage_now• /sys/class/power_supply/battery/current_now

by Kejia Zhang

Background Location ~ Signal strength

Distance to base station Obstacles

Signal strength dominating power consumption

Location ~ Power Consumption

by Kejia Zhang

by Kejia Zhang

Background Two Nexus 4 on same route

by Kejia Zhang

Background Nexus 4 and Nexus 5 on same route

by Kejia Zhang

Works of this paper Main idea

Knowing location by reading power consumption

Difficulty Power consumption affected by

• Components• Applications• Activities

Can only read aggregate power consumption

Solution Machine learning sees through noise

by Kejia Zhang

Problem definition Route distinguish

Known• Power profiles of all possible routes

Learn • Which route is taken

Real-time tracking Known

• Which route is taken• Route’s power profile

Learn• Victim’s location

by Kejia Zhang

Problem definition New route inference

Known• Power profiles of many road segments

Learn• Victim’s (arbitrary) route

by Kejia Zhang

Settings Attacker

Only access to aggregate power consumption

Communicate with remote server Prior knowledge of area power profiles

Victim Moving by a car Generate low traffic to keep connected

by Kejia Zhang

Settings Hysteresis

Different direction to a location may cause different signal strength

Hysteresis algorithm decides when to hand off to a new base station

Attacker can only use the same travel direction as a power reference

by Kejia Zhang

Route distinguish Known

Power profiles of all possible routes Each power profile is a time series

Learn Which route is taken

Difficulty Different rides on same route vary in speed Applications and activities add noise

by Kejia Zhang

Route distinguish Dynamic Time Warping

Measure similarity of two time series that are misaligned in time

Time Warping

by Kejia Zhang

Route distinguish DTW

Best alignment

by Kejia Zhang

Route distinguish DTW

Dynamic Programming

cell(i,j) = local_distance(i,j) + MIN(cell(i-1,j), cell(i-1,j-1), cell(i, j-1))

by Kejia Zhang

Route distinguish Choose the route with shortest DTW

distance

by Kejia Zhang

Route distinguish Normalizing power profile (see through

noise)

iixx'

by Kejia Zhang

Real-time tracking Known

Which route is taken Route’s power profile

Learn Victim’s location

Use Subsequence DTW algorithm Search a sub-sequence in a larger sequence

by Kejia Zhang

New route inference Known

Power profiles of many road segments Maybe crowd sourcing

Learn Victim’s (arbitrary) route

by Kejia Zhang

New route inference Road segment

Denote by intersections (x, y) A device must

• Complete a segment once it starts• Can’t change direction meanwhile

(x, y) is not (y, x)

by Kejia Zhang

by Kejia Zhang

New route inference Model the problem as Hidden Markov

Model State set Q

Transition probability matrix A

Output distribution B={Bo,xy}• Bo,xy : probability of yielding a power profile o while

traversing segment (x, y) Initial state distribution Π={πxy}

• πxy : probability to start with segment (x, y)

by Kejia Zhang

New route inference Model the problem as Hidden Markov

Model Given

• Power profile O• A, B and Π

Find• Route T={sab, sbc, …} such that p{T | O} is

maximized

by Kejia Zhang

New route inference Matching route with particle filter

(Monte Carlo approximation) Pi: Sample set of N routes

by Kejia Zhang

New route inference Matching route with particle filter

Output the route occurs most in Pfinal

by Kejia Zhang

Experiments PowerSpy android application

Run on Nexus 4, Nexus 5, HTC Diminishing effects of certain activities

by Kejia Zhang

Experiments Route distinguish

by Kejia Zhang

Experiments Real-time tracking

by Kejia Zhang

Experiments New route

inference Training set: 13

intersections and 35 road segments

Pre-recording seesions were done by Nexus 4

by Kejia Zhang

Experiments New route inference

Transition probability marix A• Uniformly distributed

Output distribution B• Depend on distance between test and record

profiles Initial state distribution Π

• Starting location is known

by Kejia Zhang

Experiments New route inference

Nexus 4 #1, Nexus 5, HTC desire• Normal number of applications

Nexus 4 #2 • Large number of applications

by Kejia Zhang

Experiments New route inference

by Kejia Zhang

Experiments New route inference

by Kejia Zhang

Experiments New route inference