Probe Request Based Device Identification Attack and Defense

Abstract

Wi-Fi network has an open nature so that it needs to face greater security risks compared to wired network. The MAC address represents the unique identifier of the device, and is easily obtained by an attacker. Therefore MAC address randomization is proposed to protect the privacy of devices in a Wi-Fi network. However, implicit identifiers are used by attackers to identify user’s device, which can cause the leakage of user’s privacy. We propose device identification based on 802.11ac probe request frames. Here, a detailed analysis on the effectiveness of 802.11ac fields is given and a novel device identification method based on deep learning whose average f1-score exceeds 99% is presented. With a purpose of preventing attackers from obtaining relevant information by the device identification method above, we design a novel defense mechanism based on stream cipher. In that case, the original content of probe request frame is hidden by encrypting probe request frames and construction of probe request is reserved to avoid the finding of attackers. This defense mechanism can effectively reduce the performance of the proposed device identification method whose average f1-score is below 30%. In general, our research on attack and defense mechanism can preserve device privacy better.

A Systematic Review of Wi-Fi and Machine Learning Integration with Topic Modeling Techniques

“…In fact, only 53 articles contain the words "probe", "mac addr", or "randomized", with a total 597 of citations (for an average of 11.3 citations for each paper). Moreover, several of them focuses on studying the real effects of MAC randomization [93,94] or device de-anonymization [95,96]. There are in the literature some works that leverage PRs, e.g., in crowd detection [97] and behavior [98] or device classification [99], but we believe that there is still room for improvement.…”

Public Wireless Packets Anonymously Hurt You

“…2) Frame-field attacks: Here, an attacker learns the information fields in the frames that are generally sent in the clear to classify and subsequently fingerprint devices [11]. There are flags, client capability information, Manufacturer names, frame-type, etc., which possess the potential of being part of a fingerprint.…”

“…al [15] do a widespread evaluation of existing frameworks for security pit-holes in probe requests. Probe-request-based device identification on IEEE 802.11ac is reduced considerably after the application of stream cipher-based encryption [11]. They test the solution with Two Dell OptiPlex 3600 mini Workstation are used as a client device and AP.…”

“…They test the solution with Two Dell OptiPlex 3600 mini Workstation are used as a client device and AP. We notice that Diffie-hellman key exchange takes 2.4−2.6s, while transmission of the encrypted packet needs 0.4 − 0.6s [11].…”

“…Most of the existing related works suggest flaws in randomization [1] [2] [5] [6] or suggest inferring insights [10] [4] [9] from the transmitted public data in the packets. Encryptionbased defense of WiFi 5 packets is suggested by [11], but as we discuss later in this paper, such solutions are not feasible due to resource constraints. To the best of our knowledge, none of current work give a global view on the privacy issues in the design of public wireless packets itself.…”