Device Identification

Question 1

What is the definition of device identification in wireless networks?

Answer 1

The ability to uniquely identify a user or device based on a unique ID such as MAC address, IMEI or MEID for mobile phones.

Question 2

What are some of the goals and applications of device identification?

Answer 2

Authentication, localization, tracking, navigation, intrusion detection, and new application domains like smart healthcare or autonomous UAV.

Question 3

What are the two main categories of device identification methods in wireless networks?

Answer 3

Passive and active identification methods.

Question 4

What is the difference between passive and active device identification methods?

Answer 4

Passive methods are based on observing the communication traffic of the target device to extract features that distinguish the device or its components. Active methods generate targeted traffic with the target device and then observe its behavior.

Question 5

What are some examples of device identification characteristics in different layers?

Answer 5

Signal intelligence, modulation errors, packet contents, or behavior.

Question 6

How is the classification of the characteristics (fingerprints) usually done?

Answer 6

Using a standard classifier, such as the nearest neighbor classifier.

Question 7

What are some examples of device identification use cases?

Answer 7

Authentication, tracking, intrusion detection, and new application domains.

Question 8

What are some examples of passive and active attackers of different power levels, and their capabilities and goals?

Answer 8

Passive attackers only observe the communication traffic of the target device, while active attackers generate targeted traffic with the target device and then observe its behavior.

Question 9

What are some real life device identification scenarios?

Answer 9

Wardriving, counting visitors, traffic load, and UAV detection.

Question 10

What are some examples of passive identification techniques by packet evaluation and signal intelligence?

Answer 10

Packet evaluation looks at the content of the packets, while signal intelligence looks at the properties of the signals.

Question 11

What are some examples of passive identification: statistical approaches?

Answer 11

Using statistical classification and regression models on RF features, such as non-parametric features of complex IQ signals of ZigBee devices.

Question 12

What are some examples of passive identification: transient-based approaches?

Answer 12

Using the time between the start of ramping up to full power before a new transmission, called the transient signal, to identify devices.

Question 13

What are some examples of passive identification: modulation-based approaches?

Answer 13

Using modulation-based errors to identify devices, such as frequency offset, sync correlation, I/Q origin offset, and magnitude/phase offset.

Question 14

What are some examples of passive identification: other signal-based approaches?

Answer 14

Using RSS-based, permutation-entropy-based, or other methods to identify devices based on signal characteristics.

Question 15

What are some examples of passive identification: positioning-based identification?

Answer 15

Using the relative signal power and CSI to locate and track devices in space.

Question 16

What are some examples of passive identification: approaches not using packet content?

Answer 16

These approaches are independent of the protocol and the data, and only rely on the signal properties.

Question 17

What are some examples of passive identification: approaches using behavior?

Answer 17

These approaches use the statistical analysis of the rate at which data link layer frames are transmitted by a device, which depends on the specific driver.

Question 18

What are some examples of passive identification: approaches using scrambler-seeds?

Answer 18

These approaches use the pseudo-random bitstring added on top of the data stream to ensure certain properties of the signal, and exploit the predictability of the scrambler state.

Question 19

What are some examples of passive identification: approaches using identifiers?

Answer 19

These approaches use the device identifiers, such as MAC, IMEI, or WPS UUID, to make devices addressable and identifiable.

Question 20

What are some examples of passive identification: approaches using information elements (IEs)?

Answer 20

These approaches use the optional or mandatory IEs in Wi-Fi packets, which hint at the capabilities or features of the devices.

Question 21

What is the purpose of MAC randomization in wireless networks?

Answer 21

To prevent device tracking by changing the MAC address periodically.

Question 22

What is the main challenge of MAC randomization in wireless networks?

Answer 22

It is not part of any specification and different vendors implement it differently.

Question 23

What are some examples of active device identification attacks that exploit MAC randomization in wireless networks?

Answer 23

AP impersonation, Bluetooth correlation, WiFi-based IMSI collector.

Question 24

What is the name of the bit in the first byte of the MAC address that indicates whether the MAC address is global or local?

Answer 24

The universal/local bit.

Question 25

What is the name of the field in the Wi-Fi frame header that contains the first seven feedback bits of the scrambler state?

Answer 25

The scrambler init field.

Question 26

What is the name of the technique that uses the ramp-up time of the signal from channel noise to full power to identify wireless devices?

Answer 26

Transient-based identification.

Question 27

What is the name of the list that contains the SSIDs of the networks that a device has previously connected to or prefers to connect to?

Answer 27

The preferred network list.

Question 28

What is the name of the attack that listens to directed probe requests by the target device and impersonates an access point using a SSID that was observed?

Answer 28

The Karma attack.

Question 29

What are some examples of passive identification techniques by packet evaluation and signal intelligence?

Answer 29

Packet evaluation looks at the content of the packets, while signal intelligence looks at the properties of the signals.

Question 30

What are some examples of passive identification: statistical approaches?

Answer 30

Using statistical classification and regression models on RF features, such as non-parametric features of complex IQ signals of ZigBee devices.

Question 31

What are some examples of passive identification: transient-based approaches?

Answer 31

Using the time between the start of ramping up to full power before a new transmission, called the transient signal, to identify devices.

Question 32

What are some examples of passive identification: modulation-based approaches?

Answer 32

Using modulation-based errors to identify devices, such as frequency offset, sync correlation, I/Q origin offset, and magnitude/phase offset.

Question 33

What are some examples of passive identification: other signal-based approaches?

Answer 33

Using RSS-based, permutation-entropy-based, or other methods to identify devices based on signal characteristics.

Question 34

What are some examples of passive identification: positioning-based identification?

Answer 34

Using the relative signal power and CSI to locate and track devices in space.

Question 35

What are some examples of passive identification: approaches not using packet content?

Answer 35

These approaches are independent of the protocol and the data, and only rely on the signal properties.

Question 36

What are some examples of passive identification: approaches using behavior?

Answer 36

These approaches use the statistical analysis of the rate at which data link layer frames are transmitted by a device, which depends on the specific driver.

Question 37

What are some examples of passive identification: approaches using scrambler-seeds?

Answer 37

These approaches use the pseudo-random bitstring added on top of the data stream to ensure certain properties of the signal, and exploit the predictability of the scrambler state.

Question 38

What are some examples of passive identification: approaches using identifiers?

Answer 38

These approaches use the device identifiers, such as MAC, IMEI, or WPS UUID, to make devices addressable and identifiable.

Question 39

What are some examples of passive identification: approaches using information elements (IEs)?

Answer 39

These approaches use the optional or mandatory IEs in Wi-Fi packets, which hint at the capabilities or features of the devices.

Question 40

What is the difference between passive and active device identification methods in wireless networks?

Answer 40

Passive methods are based on observing the communication traffic of the target device to extract features that distinguish the device or its components. Active methods generate targeted traffic with the target device and then observe its behavior.