Network/Computer Security Workshop, May 06

The Robustness of Localization Algorithms to Signal Strength

AttacksA Comparative Study

Yingying Chen, Konstantinos Kleisouris, Yingying Chen, Konstantinos Kleisouris, Xiaoyan Li, Wade Trappe, and Richard P. Xiaoyan Li, Wade Trappe, and Richard P.

MartinMartin

Dept. of Computer ScienceDept. of Computer Science

Wireless Information Network LaboratoryWireless Information Network Laboratory

Rutgers UniversityRutgers University

May 16May 16thth, 2006, 2006

Network/Computer Security Workshop, May 06

Background

Localizing sensor nodes is the building block Localizing sensor nodes is the building block for high-level applications:for high-level applications:

Tracking, monitoring, and geometric-based Tracking, monitoring, and geometric-based routingrouting

Location-based services become more prevalentLocation-based services become more prevalent

Received Signal Strength (RSS)Received Signal Strength (RSS) is an is an attractive basis for indoor localization attractive basis for indoor localization algorithms:algorithms:

Reuse the existing communication infrastructureReuse the existing communication infrastructure

802.11, 802.15.4, Bluetooth support the 802.11, 802.15.4, Bluetooth support the technologytechnology

Tremendous cost savingTremendous cost saving

Network/Computer Security Workshop, May 06

Motivation

Localization infrastructure became the target Localization infrastructure became the target of malicious attacks of malicious attacks (non-conventional (non-conventional security threats)security threats)

Important to understand how localization is Important to understand how localization is affected by affected by non-cryptographic attacksnon-cryptographic attacks

Study the Study the susceptibilitysusceptibility of RSS-based of RSS-based localization algorithms to signal strength localization algorithms to signal strength attacks:attacks:

Unanticipated power losses and gainsUnanticipated power losses and gains

Attacks to the transmitting device or Attacks to the transmitting device or individual landmarks.individual landmarks.

Network/Computer Security Workshop, May 06

Goal

Study the behavior of RSS-based localization Study the behavior of RSS-based localization algorithms to signal strength attacksalgorithms to signal strength attacks

Generate Generate attack detectionattack detection mechanisms for mechanisms for localization algorithmslocalization algorithms

Improve the current algorithms to Improve the current algorithms to tolerant tolerant attacksattacks

Develop Develop attack resistantattack resistant algorithms algorithms

Network/Computer Security Workshop, May 06

High Level Results

The The average performanceaverage performance of all the of all the algorithms in response to an attack is about algorithms in response to an attack is about the samethe same

General rule of thumbGeneral rule of thumb: easy to conduct : easy to conduct attack by 15 dB and cause the localization attack by 15 dB and cause the localization error of 20-30 feeterror of 20-30 feet

Need to makeNeed to make localization localization more robustmore robust to to signal strength attackssignal strength attacks

Preliminary work shows possibility of Preliminary work shows possibility of attack attack detectiondetection

Network/Computer Security Workshop, May 06

Outline

Background and motivationBackground and motivation

RF-based localization algorithmsRF-based localization algorithms

Conducting signal strength attacksConducting signal strength attacks

Measuring attack susceptibilityMeasuring attack susceptibility

Experimental studyExperimental study

Analysis and discussionAnalysis and discussion

ConclusionConclusion

Related workRelated work

Future researchFuture research

Network/Computer Security Workshop, May 06

Summary of Algorithms under Study

Area-basedArea-based Point-basedPoint-based

1.Simple Point Matching 1.Simple Point Matching (SPM)(SPM)

2. Area Based 2. Area Based Probability (ABP)Probability (ABP)

3. Bayesian Networks 3. Bayesian Networks (BN)(BN)

4. RADAR (R1)4. RADAR (R1)

5. Averaged RADAR (R2)5. Averaged RADAR (R2)

6. Gridded RADAR (GR)6. Gridded RADAR (GR)

7. Highest Probability (P1)7. Highest Probability (P1)

8. Averaged Highest Probability 8. Averaged Highest Probability (P2)(P2)

9. Gridded Highest Probability 9. Gridded Highest Probability (GP)(GP)

• Offline and online phases (attack during online)• Matching vs. signal to distance

Network/Computer Security Workshop, May 06

A Generalized Localization Model

Physical Space(D)

Signal Space(R)F

G

S1

S2

Sn

: a single point or a region

Network/Computer Security Workshop, May 06

Outline

Background and motivationBackground and motivation

RF-based localization algorithmsRF-based localization algorithms

Conducting signal strength attacksConducting signal strength attacks

Measuring attack susceptibilityMeasuring attack susceptibility

Experimental studyExperimental study

Analysis and discussionAnalysis and discussion

ConclusionConclusion

Related workRelated work

Future researchFuture research

Network/Computer Security Workshop, May 06

Signal Strength Attacks

Materials – easy to Materials – easy to accessaccessAttacks – simple to Attacks – simple to perform with low costperform with low costLinear relationship -Linear relationship -linear attack modellinear attack modelTwo approaches:Two approaches:

Attack on the Attack on the entire set of entire set of landmarkslandmarksAttack on a single Attack on a single landmarklandmark

Network/Computer Security Workshop, May 06

Outline

Background and motivationBackground and motivation

RF-based localization algorithmsRF-based localization algorithms

Conducting signal strength attacksConducting signal strength attacks

Measuring attack susceptibilityMeasuring attack susceptibility

Experimental studyExperimental study

Analysis and discussionAnalysis and discussion

ConclusionConclusion

Related workRelated work

Future researchFuture research

Network/Computer Security Workshop, May 06

Attack Susceptibility Metrics

Estimator distance errorEstimator distance error

Estimator precisionEstimator precision

HölderHölder metricsmetricsRelates the magnitude of the perturbation in Relates the magnitude of the perturbation in signal space to its effect on the localization signal space to its effect on the localization results: results:

Network/Computer Security Workshop, May 06

Outline

Background and motivationBackground and motivation

RF-based localization algorithmsRF-based localization algorithms

Conducting signal strength attacksConducting signal strength attacks

Measuring attack susceptibilityMeasuring attack susceptibility

Experimental studyExperimental study

Analysis and discussionAnalysis and discussion

ConclusionConclusion

Related workRelated work

Future researchFuture research

Network/Computer Security Workshop, May 06

Experimental Setup (CoRE and Industrial Lab)

-- Floor plan: Floor plan: 200ft x 80ft (16000 200ft x 80ft (16000 ftft22))

- Deployment of - Deployment of 4 landmarks4 landmarks

(somewhat co-linear)(somewhat co-linear)

- - 115 training points, 170 testing 115 training points, 170 testing pointspoints

-- Floor plan: Floor plan: 225ft x 144ft (32400 225ft x 144ft (32400 ftft22))

- Deployment of - Deployment of 5 landmarks5 landmarks (more evenly distributed)(more evenly distributed)- - 115 training points, 138 testing points115 training points, 138 testing points

Network/Computer Security Workshop, May 06

Error AnalysisCoRE - all landmarks attenuation attack (10/15/25 dB)

Network/Computer Security Workshop, May 06

Error AnalysisAll landmarks amplification attack (10 dB)

CoRE Industrial Lab

Network/Computer Security Workshop, May 06

Linear ResponseAttenuation Attack - All landmarks; Landmark 1, 2 and 3 All landmarks: ~ 1.55 ft/dB, single landmark: ~ 0.64 ft/dB

Network/Computer Security Workshop, May 06

Worst-case ErrorCoRE: attenuation attack

BN, R1, R2: 4ft/dBP1, P2: 3ft/dBABP, GP, GR, SPM: 2ft/dB Exception: SPM ~ 0.61

Network/Computer Security Workshop, May 06

Precision Study: Example of Localization Results in CoRE

Normal Attenuation attack (25dB) Landmark 1

SP

MA

BP

BN

Network/Computer Security Workshop, May 06

Conclusion

Localization errorLocalization error of all algorithms scales of all algorithms scales similarly under attacksimilarly under attack

With single exception of Bayesian Networks With single exception of Bayesian Networks algorithm to individual landmark attacksalgorithm to individual landmark attacks

The The average susceptibilityaverage susceptibility to an attack is to an attack is essentially identicalessentially identical

In order to In order to lessen the worst-case effectlessen the worst-case effect of a of a potential attack, desirable to employ algorithms potential attack, desirable to employ algorithms that perform averagingthat perform averaging

Network/Computer Security Workshop, May 06

Conclusion (cont.)Degraded gracefullyDegraded gracefully: linear scaling in localization : linear scaling in localization error to attackserror to attacks

No algorithm No algorithm “collapses”“collapses” in response to an attack in response to an attack

All landmarks attack: 1.3-1.8 ft/dBAll landmarks attack: 1.3-1.8 ft/dB

Single landmark attack: 0.5-0.8 ft/dBSingle landmark attack: 0.5-0.8 ft/dB

Rule of thumb:Rule of thumb: easy to attack by 15 dB, cause easy to attack by 15 dB, cause localization error of 20-30 ftlocalization error of 20-30 ft

Precision increasedPrecision increased for all three area-based for all three area-based algorithms:algorithms:

A decrease and a spatial-shift in the returned area – A decrease and a spatial-shift in the returned area – biasbias is introduced is introduced ABP ABP significantly shranksignificantly shrank the returned areas in response the returned areas in response to large changes in signal strength – to large changes in signal strength – attack detectionattack detection

Network/Computer Security Workshop, May 06

Related WorkCategory of localization algorithms:Category of localization algorithms:

Range-basedRange-based [hightower01design, GPS, nissanka00 ][hightower01design, GPS, nissanka00 ], , range-free range-free [shang03, niculescu01aps],[shang03, niculescu01aps], scene matchingscene matching [youssef03localization,roos02stat, battiti02stat, bahl00][youssef03localization,roos02stat, battiti02stat, bahl00]AggregateAggregate [dohertyl01, shang03][dohertyl01, shang03] or singularor singular (only refer to (only refer to landmarks)landmarks)

Non-cryptographic attacks affect localization:Non-cryptographic attacks affect localization:Wormhole attacksWormhole attacks [hu03packet][hu03packet] – shorten the distance – shorten the distance between two nodesbetween two nodesCompromised nodesCompromised nodes [zang05robust];[zang05robust]; compromised compromised landmarkslandmarks [liu05attack][liu05attack]

Pursue for secure localization algorithmsPursue for secure localization algorithmsDistance bounding protocol Distance bounding protocol [[Capkun05Capkun05]] to upper-bound to upper-bound the distance between two nodesthe distance between two nodesHidden and mobile base stations Hidden and mobile base stations [Capkun06][Capkun06] to verify to verify location estimatelocation estimateUse directional antenna and distance bounding Use directional antenna and distance bounding [lazos05][lazos05] to achieve securityto achieve securityRobust statistical methods Robust statistical methods [zang05robust][zang05robust] to achieve to achieve reliable localizationreliable localization

Network/Computer Security Workshop, May 06

Future Research

Study different Study different attack modelsattack models::Attacks performed by the directional antennaAttacks performed by the directional antenna

Develop Develop attack detectionattack detection mechanisms for mechanisms for RF-based localization algorithmsRF-based localization algorithms

Extend the current algorithms to Extend the current algorithms to tolerant tolerant attacksattacks

Derive Derive attack resistantattack resistant algorithms algorithms

Goal:Goal: adversaries can not affect adversaries can not affect localization !localization !

Network/Computer Security Workshop, May 06

Thank youThank you

& &

QuestionsQuestions