Our work demonstrates a new set of silent reconnaissance attacks, which leverages the presence of commodity WiFi devices to track users inside private homes and offices, without compromising any WiFi network, data packets, or devices. We show that just by sniffing existing WiFi signals, an adversary can accurately detect and track movements of users inside a building. This is made possible by our new signal model that links together human motion near WiFi transmitters and variance of multipath signal propagation seen by the attacker sniffer outside of the property. The resulting attacks are cheap, highly effective, and yet difficult to detect. We implement the attack using a single commodity smartphone, deploy it in 11 realworld offices and residential apartments, and show it is highly effective. Finally, we evaluate potential defenses, and propose a practical and effective defense based on AP signal obfuscation.

Abstract-Dynamic spectrum management can drastically improve the performance of wireless networks struggling under increasing user demands. However, performing efficient spectrum allocation is a complex and difficult process. Current proposals make the problem tractable by simplifying interference constraints as conflict graphs, but they face potential performance degradation from inaccurate interference estimation. In this paper, we show that conflict graphs, if optimized properly, can produce spectrum allocations that closely match those derived from the physical interference model. Thus we propose PLAN, a systematic framework to produce conflict graphs based on physical interference characteristics. PLAN first applies an analytical framework to derive the criterion for identifying conflicting neighbors, capturing the cumulative effect of interference. PLAN then applies a local conflict adjustment algorithm to address heterogeneous interference conditions and improve spectrum allocation efficiency. Through detailed analysis and experimental evaluations, we show that PLAN builds a conflict graph to effectively represent the complex interference conditions and allow the reuse of efficient graph-based spectrum allocation solutions. PLAN also significantly outperforms the conventional graph model based solutions.

Abstract-Demand-driven spectrum allocation can drastically improve performance for WiFi access points struggling under increasing user demands. While their frequency agility makes cognitive radios ideal for this challenge, performing adaptive spectrum allocation is a complex and difficult process. In this work, we propose FLEX, an efficient spectrum allocation architecture that efficiently adapts to dynamic traffic demands. FLEX tunes network-wide spectrum allocation by access points coordinating with peers, minimizing network resets through local adaptations. Through detailed analysis and experimental evaluation, we show that FLEX converges quickly, provides users with proportional-fair spectrum usage and significantly outperforms existing spectrum allocation proposals.

Abstract-Cognitive radios can significantly improve spectrum efficiency by using locally available spectrum. The efficiency, however, depends heavily on their transceiver design. In particular, being able to use non-contiguously aligned spectrum bands simultaneously is a critical requirement. Prior work in this area requires a control channel so that transmitter/receiver pairs can synchronize on their spectrum usage patterns. However, this approach can suffer from high cost and control congestion. In this paper, we propose an in-band solution for informing receivers the spectrum usage patterns. By judiciously designing packet preambles, we embed the spectrum usage patterns in each data packet. Using the legacy 802.11 preamble structure, we focus on choosing the appropriate preamble sequences to maintain reliable packet detection in the presence of noise and interference. We verify our design using simulation and show that it can lead to reliable packet transmissions comparable to those of contiguous spectrum usage. We also identify the impact of interference on our design and propose refinements to choose the preamble sequence using information on the interference.

No abstract