ZiFi: Wireless LAN Discovery via ZigBee Interference Signatures

1. ZiFi: Wireless LAN Discovery via ZigBee Interference Signatures Ruogu Zhou1, Yongping Xiong2, Guoliang Xing1 Limin Sun2, Jian Ma31Michigan State University 2Chinese Academy of Sciences 3Nokia Research Center, China

2. Mobile WiFi Access • WiFi usage from mobile users is soaring • AT&T public WiFi: 85.5 mi connections in 2009, 121.2 mi in the first half 2010, 300% up from Q1 2009 to Q1 of 2010 [1] • Growth of WiFi hotspots has fell behind • 5.2% up from Q1 to Q2 of 2010 [2] • Reality of urban WiFi coverage for mobile users • Long uncovered periods, poor association success rate… • High power consumption due to active scan or listening [1] http://attpublicpolicy.com/wireless/the-summer%E2%80%99s-hottest-hotspot/ [2] JiWire Q2 2010 Mobile Audience Insights Report 2

3. WiFi Discovery: State of the Art • Predict WiFi availability by contexts • Location, cellular towers, BT contact patterns • Reliance on historical info • Discover through out-of-band signaling • Significant modification to WiFi infrastructure 3 WiFi Access Point (AP) WiFi Access Point (AP)

4. Motivation for a New Approach • Many mobile devices have multiple interfaces • 802.11 b/g/n and Bluetooth • ZigBee for industrial/home automation • Most these radios share the open 2.4GHz band • Significant interference between different radios • Ex: WiFi interferes 12 of total 16 ZigBee channels • Can we turn the curse into blessing? • Detect WiFi through unique interference signatures on ZigBee/BT receivers 4

5. Basic Idea • Low-power radio remains active • Sample wireless signals via Received Signal Strength (RSS) indicator • Identify unique features of WiFi RSS samples • Activate WiFi interface if WiFi hotspot detected BT/ZigBee WiFi TM RSS samples ZigBee sensor

6. RSS Features of WiFi Signals • Signal magnitude varies significantly • Frame duration and inter-arrival gap vary with apps and 802.11 versions • Resemblance with signals of other RF sources gap duration magnitude RSS samples

7. 802.11 Beacons as WiFi Signature • Beacons broadcasted at the lowest rate • All WiFi APs periodically broadcast beacons • Beacon period is unknown! • Default 102.4 ms,typically 100 – 200 ms • Low SNR: up to 103 data frames bw beacons! • False positives and negatives • Noise/data frames may also exhibit periodicity • Beacons may become aperiodic due to contentions

8. ZiFi System Architecture WiFi radio ZigBee radio Mobile Device Beacon Detector Common Multiple Folding RSS Sampling & Shaping WiFi Access Point amplify periodic signals threshold 100

9. Basic Idea of Folding • Amplify a signal of period P in N samples • Total number of additions is N-P, N>104 • Folding on many periods is expensive! 3 2 1 6 5 4 folding 7 8 9 3 5 1 4 6 2 7 8 9 3 1 2 An example of folding on period 3

10. Common Multiple Folding • Key observation: folding on period P can be computed from folding on Q if QmodP = 0 • 6+9 additions for folding on 6 and 3 separately • 6+3 additions for folding on 6 first, then on 3 folding on period 6 folding on period 3 3 2 1 6 5 4 RSS sample index 6 3 5 2 4 1 9 8 7 12 9 11 8 10 7 12 11 10

11. Apply This Idea Recursively • Fold on LCM of a period set and then partition • Encode the process by a tree • A node represents a period set and its LCM • Children’ period sets are partition of parent’s set # of additions N-2520 (2,3,….,9,10) 2520 2520-70 2520-72 Example: Folding N samples on periods (2,3,….9,10) (2,3,4,6,8,9) 72 (5,7,10) 70 72-18 72-8 70-7 70-10 (3,6,9) 18 (8,4,2) 8 (7) (5,10) 10 18-6 8-4 8-2 18-9 10-5 Opt CM tree is a binary tree! (3,6) 6 (9) 9 (2) (4,2) 4 (5) 6-3 (3)

12. Challenges of Using Beacons as WiFi Signature  • Beacon period is unknown! • Default 102.4 ms,typically 100 – 200 ms • Low SNR: up to 103 data frames bw beacons! • False positives and negatives • Noise/data frames may also exhibit periodicity • Beacons may become aperiodic due to contentions

13. ZiFi System Architecture WiFi radio ZigBee radio Mobile Device Beacon Detector Common Multiple Folding RSS sampling & shaping WiFi Access Point beacons? threshold peaks caused by data frames beacons?

14. Modeling FP and FN Rates • Derive FP/FN rate based on 802.11 CSMA model • FP rate = Prob. (max. folding result ≥ λ| no beacons) • FN rate = Prob. (max. folding result < λ| beacons) detector threshold

15. Evaluation Test-bed • Test-bed consists of 4 802.11g APs, 4 netbooks, 2 TelosB motes, and a Nokia N73 phone. MiniSD based ZigBee module USB based TelosB mote

16. Evaluation Metrics • Detection delay, accuracy, impact of ZigBee interference, computation/energy overhead ZiFi node WiFi client running traffic generator D-ITG WiFi access point

17. Detection Delay • Beacon period = 98.3 ms • Error rate = FP rate + FN rate Avg. error rate < 5% when delay >786 ms

18. Detection Accuracy • ZiFi-opt: choose opt threshold using FP bound • ZiFi-α: threshold fixed to α • High α  low FP rate, high FN rate • Low α  low FN rate, high FP rate ZiFi-0.6 ZiFi-0.9

19. Conclusions • ZiFi: a novel system to detecting WiFi hotspots using ZigBee radio • A novel Digital Signal Processing algorithm to amplifying beacons in interference signals • A beacon detector to improving stochastic detection performance • Evaluation on Linux netbooks and a Nokia N73 smartphone