1

POWERSPYLOCATION TRACKING USING MOBILE DEVICE POWER ANALYSIS

Yan Michalevsky(1), Gabi Nakibly(2), Dan Boneh(1) and Aaron Schulman(1)

(1) Stanford University, (2) National Research and Simulation Center, Rafael Ltd.

Presented byBrad Holliday

2

SMARTPHONE LOCATION ≈ OWNER LOCATION

3

ACCESSING LOCATION Even coarse location based on cellular network information

Requires Permissions

4

READING VOLTAGE AND CURRENT

Does Not Require Permissions

/sys/class/power_supply/battery/voltage_now/sys/class/power_supply/battery/current_now

5

POWER USAGE CAN REVEAL LOCATION

Power = f (Signal Strength)

Threat Model

6

SIGNAL STRENGTH DEPENDS ON GEOGRAPHY AND ENVIRONMENT

7

SIGNAL STRENGTH STABILITY

Signal strength profiles measured on two different days are stable

8

POWER PROFILE CONSISTENCY

Two Phones Same Model,

Same Drive

Different Models, Same Drive

9

WHAT CAN WE ACHIEVE BY THAT?

1. Route distinguishability

3. New route inference

2. Real-time motion tracking

10

RELATED WORK Power analysis = powerful side channel

High sample rate power traces for externally connected power monitors to recover private encryption keys from a cryptographic system

KOCHER, P., JAFFE, J., AND JUN, B. Differential power analysis. In Advances in Cryptology – CRYPTO’99 (1999), Springer, pp. 388–397.

Relationship between signal strength and power consumption in smartphones

Bartendr: demonstrated that paths of signal strength measurements are stable across several drives

SCHULMAN, A., SPRING, N., NAVDA, V., RAMJEE, R., DESHPANDE, P., GRUNEWALD, C., PADMANABHAN, V. N., AND JAIN, K. Bartendr: a practical approach to energy-aware cellular data scheduling. MOBICOM (2010)

11

1. ROUTE DISTINGUISHABILITY Collection of power consumption profiles

Each power profile is a time-series

Classifier based on time series comparison using Dynamic Time Warping (DTW)

Profiles have different baselines and variability, so clean up prior to DTW

Normalization: Calculate mean and subtract it, and divide the result by the standard deviation

Smoothing: using a moving average filter to reduce noise Down sample: by a factor of 10 to reduce computational

complexity

12

DYNAMIC TIME WARPING

Euclidian Distance DTW Distance

13

A CLASSIFICATION PROBLEM Compute the DTW distance between the new power profile

and all reference profiles

Select the known route that yields the minimal distance

14

DISTINGUISH BETWEEN ROUTES RESULTS

UniqueRoutes

# Ref.Profiles/Route

# TestRoutes

Success%

RandomGuess %

8 10 55 85 13

17 5 119 71 6

17 4 136 68 6

21 3 157 61 5

25 2 182 53 4

29 1 211 40 3

15

2. REAL-TIME TRACKING 1. A window of received samples is a subsequence of the

reference power profile

2. Infer location from reference profile

3. Route is known

3 Approaches Tracking via Dynamic Time Warping (DTW)

Improved tracking via a motion model

Tracking using Optimal Subsequence Bijection (OSB)

16

IMPROVED TRACKING USING A SIMPLE MOTION MODEL ALGORITHM

locked false //Are we locked on target?

while target moving do

loc[i], score estimateLocation()

d getDistance(loc[i], loc[i – 1])

if locked and d > MAX_DISP then

loc[i] loc [i – 1] //Resume previous estimate

end if

if score > THRESHOLD then

locked true

end if

end while

17

OPTIMAL SUBSEQUENCE BIJECTION Similar to DTW

DTW assumes the reference profile contains no noise

OSB deals with noise in either the reference profile or target sequence

Can skip elements in either sequence

18

REAL-TIME MOBILE DEVICE TRACKING RESULTS

19

3. NEW ROUTE INFERENCE Future potential routes are not explicitly known

Goal: Identify the final location after it traverses and unknown route

Assumption: Know the general area

Pre-record power profiles of all road segments

Given the power profile of the tracked device, reconstruct the unknown route

20

HYSTERESIS Hysteresis algorithm is used to decide when to hand-off to

a new base station

When a signal strength threshold is reached it will hand-off to a new station

Results: Two phones in the same location can be attached to two different base stations

21

PARTICLE FILTER

22

INFERENCE OF NEW ROUTES RESULTS

Random Frequent Alg. 3 Combined

Nexus 4 #1 33% 65% 48% 80%

Nexus 4 #2 31% 48% 56% 72%

Nexus 5 20% 33% 32% 55%

HTC Desire 22% 40% 41% 65%

23

PAPER STRENGTHS Proof of concept

Novel approach

Successful results

Machine learning is powerful

24

PAPER WEAKNESSES Too much “pre” information and assumption required

Too many variables

Device typeCellular service providerApplications likely to be used by the target

Requires variability in targets power consumption

25

FINAL THOUGHTS

POWER CONSUMPTION ≈ LOCATION