ZiFi: Wireless LAN Discovery via ZigBee Interference Signatures

Ruogu Zhou1, Yongping Xiong2, Guoliang Xing1

Limin Sun2, Jian Ma3

1Michigan State University2Chinese Academy of Sciences3Nokia Research Center, China

Mobile WiFi Access

• WiFi usage from mobile users is soaring– AT&T public WiFi: 85.5 mi connections in 2009, 121.2 mi in

the first half 2010, 300% up from Q1 2009 to Q1 of 2010 [1]

• Growth of WiFi hotspots has fell behind– 5.2% up from Q1 to Q2 of 2010 [2]

• Reality of urban WiFi coverage for mobile users– Long uncovered periods, poor association success rate…– High power consumption due to active scan or listening

2[1] http://attpublicpolicy.com/wireless/the-summer%E2%80%99s-hottest-hotspot/[2] JiWire Q2 2010 Mobile Audience Insights Report

• Predict WiFi availability by contexts – Location, cellular towers, BT contact patterns– Reliance on historical info

• Discover through out-of-band signaling– Significant modification to WiFi infrastructure

WiFi Discovery: State of the Art

3WiFi Access Point (AP)WiFi Access Point (AP)

Motivation for a New Approach• Many mobile devices have multiple interfaces

– 802.11 b/g/n and Bluetooth– ZigBee for industrial/home automation

• Most these radios share the open 2.4GHz band– Significant interference between different radios– Ex: WiFi interferes 12 of total 16 ZigBee channels

• Can we turn the curse into blessing?– Detect WiFi through unique interference signatures

on ZigBee/BT receivers4

• Low-power radio remains active– Sample wireless signals via Received Signal Strength

(RSS) indicator– Identify unique features of WiFi RSS samples

• Activate WiFi interface if WiFi hotspot detected

Basic Idea

5

BT/ZigBeeWiFi

RSS samples

TM

ZigBee sensor

RSS Features of WiFi Signals • Signal magnitude varies significantly• Frame duration and inter-arrival gap vary with

apps and 802.11 versions• Resemblance with signals of other RF sources

6RSS samples

magnitudeduration gap

802.11 Beacons as WiFi Signature

Beacons broadcasted at the lowest rateAll WiFi APs periodically broadcast beacons

Beacon period is unknown!– Default 102.4 ms, typically 100 – 200 ms

Low SNR: up to 103 data frames bw beacons!False positives and negativesNoise/data frames may also exhibit periodicityBeacons may become aperiodic due to contentions

7

ZiFi System Architecture

8

RSS Sampling & Shaping

RSS Sampling & Shaping

Common Multiple Folding

Common Multiple Folding

Beacon DetectorBeacon DetectorWiFi

Access Point

ZigBee radio WiFi radio

Mobile Device

threshold

100

amplify periodic signals

Basic Idea of Folding• Amplify a signal of period P in N samples• Total number of additions is N-P, N>104

• Folding on many periods is expensive!

9

1 2 3 4 5 6 7 1 2 3

folding

An example of folding on period 3

321

8 9

7 8 9

64 5

Common Multiple Folding• Key observation: folding on period P can be computed from folding on Q if Q mod P = 0

• 6+9 additions for folding on 6 and 3 separately• 6+3 additions for folding on 6 first, then on 3

10

folding on period 6 folding on period 3

RSS sample index

121110987

654321987

321

121110

654

Apply This Idea Recursively • Fold on LCM of a period set and then partition• Encode the process by a tree

– A node represents a period set and its LCM– Children’ period sets are partition of parent’s set

11

(2,3,….,9,10)2520

(2,3,4,6,8,9)72

(5,7,10)70

(3,6,9)18

(8,4,2)8

(7) (5,10)10

(3,6)6

(9)9

(3)

(4,2)4

(2) (5)

# of additions N-2520

2520-72 2520-70

72-18 70-772-8 70-10

18-6 18-9

6-3

8-4 8-2 10-5

Example:Folding N samples on periods (2,3,….9,10)

Opt CM tree is a binary tree!

Challenges of Using Beacons as WiFi Signature

Beacon period is unknown!– Default 102.4 ms, typically 100 – 200 ms

Low SNR: up to 103 data frames bw beacons!False positives and negatives

Noise/data frames may also exhibit periodicityBeacons may become aperiodic due to contentions

12

ZiFi System Architecture

13

RSS sampling & shaping

RSS sampling & shaping

Common Multiple Folding

Common Multiple Folding

Beacon DetectorBeacon DetectorWiFi

Access Point

ZigBee radio WiFi radio

Mobile Device

beacons?

thresholdpeaks caused by data framespeaks caused by data frames

beacons?

Modeling FP and FN Rates• Derive FP/FN rate based on 802.11 CSMA model

– FP rate = Prob. (max. folding result ≥ λ | no beacons)– FN rate = Prob. (max. folding result < λ | beacons)

14

scheduled beacon TX time

actual beacon TX time X1+X2

)()Prob( 20

1

FNfXXRateFN

withinbeaconsProb)( bFN Tf

Evaluation Test-bed• Test-bed consists of 4 802.11g APs, 4 netbooks,

2 TelosB motes, and a Nokia N73 phone.

15MiniSD based

ZigBee module MiniSD based

ZigBee module USB based

TelosB mote USB based

TelosB mote

Evaluation Metrics

16

WiFi client running traffic generator D-ITG

WiFi access point

ZiFi node

• Detection delay, accuracy, impact of ZigBee interference, computation/energy overhead

Detection Delay• Beacon period = 98.3 ms• Error rate = FP rate + FN rate

17

Avg. error rate < 5% when delay >786 msAvg. error rate < 5% when delay >786 ms

Detection Accuracy• ZiFi-opt: choose opt threshold using FP bound• ZiFi-α: threshold fixed to α

– High α low FP rate, high FN rate– Low α low FN rate, high FP rate

18

ZiFi-0.6

ZiFi-0.9

Conclusions

• ZiFi: a novel system to detecting WiFi hotspots using ZigBee radio – A novel Digital Signal Processing algorithm to

amplifying beacons in interference signals – A beacon detector to improving stochastic

detection performance• Evaluation on Linux netbooks and a Nokia N73

smartphone

19