by Kejia Zhang
PowerSpy: Location Tracking using Mobile Device Power Analysis
Yan Michalevsky, Aaron Schulman, etc.Stanford University
Published in USENIX Security '15
by Kejia Zhang
Background Tracking phones is valuable GPS, base statuion/WiFi connectivity
Need permission to access Power consumption
Free to access Android:
• /sys/class/power_supply/battery/voltage_now• /sys/class/power_supply/battery/current_now
by Kejia Zhang
Background Location ~ Signal strength
Distance to base station Obstacles
Signal strength dominating power consumption
Location ~ Power Consumption
by Kejia Zhang
by Kejia Zhang
Background Two Nexus 4 on same route
by Kejia Zhang
Background Nexus 4 and Nexus 5 on same route
by Kejia Zhang
Works of this paper Main idea
Knowing location by reading power consumption
Difficulty Power consumption affected by
• Components• Applications• Activities
Can only read aggregate power consumption
Solution Machine learning sees through noise
by Kejia Zhang
Problem definition Route distinguish
Known• Power profiles of all possible routes
Learn • Which route is taken
Real-time tracking Known
• Which route is taken• Route’s power profile
Learn• Victim’s location
by Kejia Zhang
Problem definition New route inference
Known• Power profiles of many road segments
Learn• Victim’s (arbitrary) route
by Kejia Zhang
Settings Attacker
Only access to aggregate power consumption
Communicate with remote server Prior knowledge of area power profiles
Victim Moving by a car Generate low traffic to keep connected
by Kejia Zhang
Settings Hysteresis
Different direction to a location may cause different signal strength
Hysteresis algorithm decides when to hand off to a new base station
Attacker can only use the same travel direction as a power reference
by Kejia Zhang
Route distinguish Known
Power profiles of all possible routes Each power profile is a time series
Learn Which route is taken
Difficulty Different rides on same route vary in speed Applications and activities add noise
by Kejia Zhang
Route distinguish Dynamic Time Warping
Measure similarity of two time series that are misaligned in time
Time Warping
by Kejia Zhang
Route distinguish DTW
Best alignment
by Kejia Zhang
Route distinguish DTW
Dynamic Programming
cell(i,j) = local_distance(i,j) + MIN(cell(i-1,j), cell(i-1,j-1), cell(i, j-1))
by Kejia Zhang
Route distinguish Choose the route with shortest DTW
distance
by Kejia Zhang
Route distinguish Normalizing power profile (see through
noise)
iixx'
by Kejia Zhang
Real-time tracking Known
Which route is taken Route’s power profile
Learn Victim’s location
Use Subsequence DTW algorithm Search a sub-sequence in a larger sequence
by Kejia Zhang
New route inference Known
Power profiles of many road segments Maybe crowd sourcing
Learn Victim’s (arbitrary) route
by Kejia Zhang
New route inference Road segment
Denote by intersections (x, y) A device must
• Complete a segment once it starts• Can’t change direction meanwhile
(x, y) is not (y, x)
by Kejia Zhang
by Kejia Zhang
New route inference Model the problem as Hidden Markov
Model State set Q
Transition probability matrix A
Output distribution B={Bo,xy}• Bo,xy : probability of yielding a power profile o while
traversing segment (x, y) Initial state distribution Π={πxy}
• πxy : probability to start with segment (x, y)
by Kejia Zhang
New route inference Model the problem as Hidden Markov
Model Given
• Power profile O• A, B and Π
Find• Route T={sab, sbc, …} such that p{T | O} is
maximized
by Kejia Zhang
New route inference Matching route with particle filter
(Monte Carlo approximation) Pi: Sample set of N routes
by Kejia Zhang
New route inference Matching route with particle filter
Output the route occurs most in Pfinal
by Kejia Zhang
Experiments PowerSpy android application
Run on Nexus 4, Nexus 5, HTC Diminishing effects of certain activities
by Kejia Zhang
Experiments Route distinguish
by Kejia Zhang
Experiments Real-time tracking
by Kejia Zhang
Experiments New route
inference Training set: 13
intersections and 35 road segments
Pre-recording seesions were done by Nexus 4
by Kejia Zhang
Experiments New route inference
Transition probability marix A• Uniformly distributed
Output distribution B• Depend on distance between test and record
profiles Initial state distribution Π
• Starting location is known
by Kejia Zhang
Experiments New route inference
Nexus 4 #1, Nexus 5, HTC desire• Normal number of applications
Nexus 4 #2 • Large number of applications
by Kejia Zhang
Experiments New route inference
by Kejia Zhang
Experiments New route inference
by Kejia Zhang
Experiments New route inference