Suhendry Effendy

A0095694L

Summary Airshark: Detecting Non-WiFi RF Devices using Commodity WiFi Hardware

This paper addresses the problem on detecting non-WiFi devices using commodity WiFi hardware. With a simple experiment they shows that a good quality WiFi link can be interefed by non-WiFi devices (e.g. analog phone, Bluetooth devices, videocam, microwave, ZigBee, etc.). Thus, this motivate them to develop a system (called Airshark) to detect non-WiFi devices such that it is easy to implement using only commodity hardware without requiring any additional spectrum analyzer hardware to help network administrator or the WiFi device to detect and handle situation where there is interference from non-WiFi devices. Airshark is a software-only solution which able to handle multiple simultaneously active RF device detection in real-time, allowing the WiFi node to take immediate remedial steps to mitigate interference from non-WiFi devices. Airshark assumes that typically only 20 MHz spectrum snapshots are available for its use in each channel measurement attempt. This limitation is caused by the limited ability of commodity WiFi card hardware, and it implies that Airshark cannot continuously observe the entire behavior of many non-WiFi frequency hoppers. To detect non-WiFi device, it first extracts feature from the signal. It uses 7 features: frequency and bandwidth, spectral signatures, duty cycle, pulse signatures, inter-pulse timing signatures, pulse spread and device specific features. Before Airshark can identify a new RF device, these features have to be recorded for training. It employs a decision tree based classifier to do the detection. This classifier model is chosen over SVM because it needs low memory and processing requirements. The paper presents some experimental results. In a single device detection test, Airshark is able to detect with accuracy 98% for RSSI values as low as -80 dBm and with RSSI -80 dBm the accuracy drops down. In a multiple device detection test, Airshark is able to detect with accuracy of more than 91% with RSSI values as low as -80 dBm and for higher RSSI values ( 60 dBm), the detection accuracy is 96%. Overall Airshark seems reasonably accurate. In their experiment, they also show that Airshark has a very low false positive rate. The average FPR observed in their experiment is 1.3%, and for higher RSSI ( -80 dBm) the average is 0.068%. The limitation of Airshark is it cant detect multiple devices of a same type and it cant determine the location of detected devices. Because it uses commodity WiFi hardware, its only able to detect a limited view of spectrum, but this is more about trade-off between cost and functionality rather than a limitation.

In the paper, they mention several things about their future work on this research. Theyre going to develop a system which uses Airshark to be able to detect multiple devices of a same type. Another possible application is to physically locate the interfering devices, using multiple Airshark nodes and some triangulation method.

-oOo-