Research Article  Open Access
Lin Sun, Sinong Chen, Zengwei Zheng, Longyang Xu, "Mobile Device Passive Localization Based on IEEE 802.11 Probe Request Frames", Mobile Information Systems, vol. 2017, Article ID 7821585, 10 pages, 2017. https://doi.org/10.1155/2017/7821585
Mobile Device Passive Localization Based on IEEE 802.11 Probe Request Frames
Abstract
This paper presents a novel passive mobile device localization mode based on IEEE 802.11 Probe Request frames. In this approach, the listener can discover mobile devices by receiving the Probe Request frames and localize them on his walking path. The unique location of the mobile device is estimated on a geometric diagram and rightangled walking path. In model equations, siterelated parameter, that is, path loss exponent, is eliminated to make the approach siteindependent. To implement unique localization, the rightangled walking path is designed and the optimal location is estimated from the optional points. The performance of our method has been evaluated inside the room, outside the room, and in outdoor scenarios. Three kinds of walking paths, for example, horizontal, vertical, and slanted, are also tested.
1. Introduction
WiFi is a major component for communication in mobile devices, for example, phone and tablet. Researchers take advantage of WiFi signal to build indoor localization system [1, 2], life pattern analysis [3], human activity recognition [4], and so on. In indoor localization system, a mobile app has been installed in a mobile phone, reads WiFi RSSI value from WiFi APs, sends RSSI fingerprint, and queries location from the RSSI fingerprint database. The user himself can know his accurate position inside a building, as shown in Figure 1. This kind of localization mode is called active. In this paper, we present a novel passive mobile device localization mode based on IEEE 802.11 Probe Request frames without WiFi APs and reference points. The listener can discover the mobile device by receiving the Probe Request frames and localize the position of the mobile device. The listener only equipped with his mobile can secretly know where another mobile holder is, as shown in Figure 2. He can also infer the MAC address of the holder’s mobile device or look for the mobile holder with a specific MAC address. This kind of passive localization is a great challenge because there are no reference points or radio map deployed in advance. Another problem is that path loss exponent, which is an important parameter in radio propagation model, varies with different environments.
2. Related Work
There are two basic modes in WLAN localization problems. One is to know where I am and the other is to know where you are. The former is called active and the latter is called passive [5].
Active localization methods are always fingerprintbased and nonfingerprintbased. In fingerprintbased localization [2, 6], WiFi APs should be deployed in advance and a fingerprint database is created to store signal feature values at each spatial coordinate. Nonfingerprintbased solutions use geometric properties of triangles to estimate the target location without development of a radio map [7]. Common metrics include received signal strength (RSS) [1], time difference of arrival (TDOA) [8], time of arrival (TOA) [9], and angle of arrival (AOA) [10]. Signals from two or three reference points must be made available to these metrics. The advantage of signal strength is that it is easy to implement; however, the parameters in radio model are sitespecific. For example, it was needed to estimate path loss exponent (PLE) and other factors from the training data by regression model [1]. Time and angle of an arrival signal would suffer from multipath effect and lineofsight (LOS) paths between the transmitter and receiver are usually obstructed by walls in indoor environments.
In passive mode, Youssef et al. [11, 12] presented a devicefree passive (DfP) localization method. The concept relied on the fact that RF signals were affected by changes in the environment. The monitoring stations continuously recorded signal strength or timeofflight, which were used to construct a radio map to present the signal changes with entities movement and their locations. Like fingerprintbased localization, this method needs WiFi AP and has to build a radio map in advance. Another technology is Radio Tomographic Imaging (RTI). Wilson and Patwari [13] presented a linear model for using RSS measurements to obtain images of moving objects in wireless networks.
Radarbased techniques also do not require the tracked entity to carry an electronic device. Ultrawideband (UWB) radar systems provided throughwall imaging methods [14, 15] to detect human activity [16] and track walking [17]. These systems are accurate, but very complex. Lin and Ling [18] demonstrated an alternate development of a Doppler radar with twoelement receiving array for tracking human movements in indoor surveillance applications. Multipleinput multipleoutput (MIMO) radar is another emerging field that takes advantage of multiple transmitters and receivers to locate objects within a spatial area [19].
Table 1 shows the comparison of different localization methods based on radio signal in the requirements of AP or wireless node, reference point, PLE estimation, radio map, and special hardware.
Some researches passively monitored WiFi Probe Request frame to study the device owners. Scheuner et al. [20] developed a passive WiFi tracking system Probe. It processed and visualized WiFi traces and supported online analysis. The cases of room utilization, person tracking, and device statistics were demonstrated. Cunche et al. [21] exploited WiFi fingerprints to infer social links between devices owners.
3. Passive Mobile Device Localization Mode
3.1. Probe Request Frame Review
In WiFi technology, a mobile station periodically sends Probe Request frames to discover existing 802.11 networks within its proximity. The Probe Request is sent from the mobile station to the destination layer2 address ff:ff:ff:ff:ff:ff. The listener with a WiFi network card, which supports monitor mode, can capture the Probe Request frames [22].
Another piece of information required in our approach is received signal strength indication (RSSI), which can be found in radiotap header. Figure 3 shows the example of a 802.11g radiotap header and Probe Request frame header received from a Xiaomi mobile phone by Wireshark, a network protocol analyzer. “SSI signal” represents RSSI in Wireshark.
3.2. Position Estimation
Logdistance path loss model [23] is a radio propagation model that predicates the path loss in indoor or indoortooutdoor environments, written as follows:where is the length of the path from the transmitter to the receiver and is the reference distance (for example, meter).
is path loss of distance , where is the transmitted power in dBm and is the received power in dBm. is path loss exponent, which is a measure of the influence of obstacles like partitions, walls, and doors.
Let and be equal in path loss measurements; we getwhere stands for a RSSI value in radiotap header received by the passive listener, which is 1 meter from the mobile device.
Figure 4 shows geometric diagram of passive position estimation. The listener walks from point to point and then point . , , and are RSSI values received on points , , and , respectively. , , and are the distances between points , , and and WiFi device , respectively. According to (2), we can write is eliminated by dividing (3) by (4) and letthen we getSimilarly, we divide (4) by (5) and letwe getUsing the Law of Cosines in a triangle, , , , , , , , and in Figure 4 should satisfy the following equations: and can be replaced by using (7) and (9); (10) becomeIn (11), and are known. , , and are walking distances. , , and are three unknown variables needed to be solved. These nonlinear equations can be solved by Newton’s method with Jacobian matrix [24, 25]. Newton’s method will converge while the initial guess is sufficiently close to the solution [26]. Fortunately, we can know where the solution lies. The initial guess of can be estimated by (2) assuming since [27], and start at because .
3.3. LeastSquares Estimation for Four Points in Walking Path
Fourpoint walking path is also addressed in this section. The logdistance equation in and triangle equations can be written as follows:and the Law of Cosines in ΔCWD and ΔBWD, shown in Figure 4, is also added to (10),Let and replacing by in (13), we getIn (14), there are five equations and four unknown variables, , , , and . Leastsquares minimization of the residual of a set of nonlinear equations is solved by LevenbergMarquardt method. Moré [28] presented a version of the LevenbergMarquardt algorithm, implemented in MINPACK [29], with strong convergence properties. Also, the good initial guess yields the desired result.
3.4. Uniqueness of Localization
The mobile device has two optional points, which are symmetric with respect to the walking path. Here we present a method to select unique location from the candidates. The scheme is to turn a corner in walking path, for example, in Figure 5. will give two candidates of the location and will also give other two candidates of the location . Assume and are on the side of the ground truth, shown in Figure 5, the distance between and is shorter than other combinations, that is, , , and . So we define optimal location estimation where distance is the minimum between and ,The center point between and , that is, , is considered as the unique location of the mobile device. In experiments, we will give the results of unique localization in detail.
4. Experiments
4.1. Settings
To evaluate our passive localization approach, three types of scenarios are designed:(i)Inside the room (Figure 6): this is near distance situation tested in the room.(ii)Outside the room (Figure 7): this is dividingwall situation when the listener is outside the room.(iii)Outdoor (Figure 8): this is middle distance situation tested in the square.
In Figures 6, 7, and 8, the letters – are the placements of mobile devices and numbers 1–12 are the points in the walking path of the listener. There are three kinds of walking paths, horizontal, vertical, and slanted. Table 2 shows the details.

Examples of the listeners include the devices based on Nokia Maemo, Android, or MAC OS. Here a MacBook is used as the listener. Three mobile devices, for example, iPad, Nexus, and Xiaomi Note, are used to be discovered and passively localized. The RSSI value on each point of the path is the average of several Probe Request frames.
4.2. Position Evaluation Results
To evaluate passive positioning performance, the bias rate is defined as follows:where is estimated distances, for example, , , and , which have been calculated in (10). is the ground truth for the distances , , and .
We evaluate 222 samples including 72 inside the room, 126 outside the room, and 24 outdoor in the experiment. Tables 3, 4, and 5 show the average bias rate of distances , , and in different scenarios and walking paths. The threepoint paths have been selected from in outside the room setting and so on. From the results, there is no walking path which is obviously better than others among horizontal, vertical, and slanted paths. Fortunately, the result of outside the room is not worse than those of inside the room and outdoor, although the listener and the mobile device are obstructed by wall.



We have also computed the bias between the estimated location point and the ground truth point , shown in Figure 4. Figure 9 shows the cumulative distribution (CDF) of localization error. 75% errors are less than 2 meters inside the room, 4 meters outside the room, and outdoor. Figure 10 shows localization error in three walking styles including 72 horizontal, 90 vertical, and 60 slanted samples. Our method gets similar performance on different walking styles.
Figure 11 shows the comparison of different mobiles. are about 1.6, 2.5, and 3.5 meters averagely inside the room, outside the room, and outdoor, respectively. The localization accuracy of Apple iPad and Xiaomi note is similar, but Google Nexus is the worst.
4.3. FourPoint versus ThreePoint Distance Estimation
Localization performance using four points in walking path is also tested by (14). Examples of fourpoint distance estimation is , and those of threepoint distance estimation are , , , and in outside the room setting. Figure 12 shows the bias result of fourpoint and threepoint estimation. There is no obvious improvement on fourpoint paths, but the performance could be robust.
4.4. Performance of Unique Localization on RightAngled Paths
The performance of unique localization on rightangled paths has been tested inside the room, outside the room, and outdoor. The rightangled paths, for example, in Figure 6 and in Figure 7, are selected.
Figure 13 shows the results of the unique localization method presented in Section 3.4. Diamond symbols ⧫ in (a), (b), and (c) denote the ground truth of mobile device location. Colorful rectangles indicate the bounding path boxes in Figures 6, 7, and 8. The symbols and are two optional locations with respect to the walking path, where the optimal overlap , defined in (15), is represented as . The symmetric optional locations along the walking path are labeled in the same color. From the results, we can see that all optimal locations are correct. The localization performance on the green walk path, which is far away from ⧫, is lower.
(a)
(b)
(c)
4.5. Path Loss Exponent Computing
After solving (11), path loss exponent has also been computed by (4) and boxplots of the distribution inside the room, outside the room, and outdoor are shown in Figure 14. The empirical value of path loss exponent is about 2 in free space and 4–6 in buildings [27]. In our experiments, inside the room and outdoor environments are like free space without obstacles while outside the room setting is a dividingwall scenario in buildings. Figure 14 shows that path loss exponent estimation results in our method are quite similar to the empirical value of experimental settings.
4.6. Discussion
is RSSI value received by the listener, which is 1 meter from a mobile WiFi device. We measured parameter of iPad, Nexus, and Xiaomi Note, as shown in Table 6.

value might be a little different in various mobile devices of the same brand. Here we discuss the effect on distance estimation when varies with different mobile devices. From (2), we get the change of with respect to ,Then, the relation between the change rate of and the change of is
Path loss exponent is about 23 in free space and 4–6 in buildings [27]. Figure 15 shows the change rate caused by the change of when and . From the results, we can see that are less than 10% and 19% when the deviation of is no more than 2 dBm in buildings and free space, respectively.
4.7. Movement Estimation Error Discussion
There might be an error in the estimation of movement distances or in Figure 4. The localization error caused by movement estimation error inside and outside the room is shown in Figures 16 and 17, respectively. The testing mobile is Google Nexus7. The axes and in the figures are and in Figure 4, respectively. The colorful pixels represent the estimation error to the ground truth of the mobile.
The path and mobile location of Figure 6 are used for inside the room testing. The ground truth of and is 2 meters. The estimation of and is supposed to be from 1 meter to 3 meters. The path and mobile location of Figure 7 are used for outside the room testing. The ground truth of and is 2 meters. The estimation of and is supposed to be from 1 meter to 3 meters.
In inside the room setting, 0.5 meters of walk estimation error will cause about 0.4 meters of mobile localization error. In outside the room setting, the estimation error of (i.e., in Figure 7) produces less localization error than that of (i.e., in Figure 7) because path is closer to the mobile location than path . The localization error increases while and increase or decrease simultaneously. However, a small increase of the localization error is produced when one distance increases and the other decreases; that is, the sum of and is the same. The estimation error of point , which is less than 0.5 meters, will cause small localization error when points and are fixed. The reason is that points and are key points to form the triangle .
5. Conclusion
In this paper, we present a novel passive mobile localization mode based on IEEE 802.11 Probe Request frames without WiFi APs and reference points. In this approach, a geometric diagram is designed to estimate the location of mobile device. Using this approach, nearby mobile devices can be discovered on the listener’s walking path. To solve the model equations, path loss exponent, which is a siterelated parameter, is eliminated. Therefore, our method is siteindependent and does not need to train the parameter which is related to the environments. The experimental results show that the errors of mobile device location are lower than 2 meters and 3.5 meters in indoor and outdoor scenarios, respectively. The performance outside the room, inside the room, and outdoor is similar, although path loss exponents are different in these three kinds of scenarios. The unique localization method on rightangled paths is successful although the walking path is far away from the mobile device. The estimation results of path loss exponents are quite similar to the empirical value of experimental settings. The effect of parameter is less than 20% when its deviation is no more than 2 dBm. We also analyze the localization error caused by movement estimation error inside and outside the room. The localization error is less than 0.4 meters when 0.5 meters error occurs in walk estimation generally; however, a small error increases when is fixed.
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this paper.
Acknowledgments
This work was supported by Hangzhou Science and Technology Development Plan Project (no. 20150432B17) and Zhejiang Provincial Natural Science Foundation of China (under Grant no. LY17F020008).
References
 N. Chang, R. Rashidzadeh, and M. Ahmadi, “Robust indoor positioning using differential WiFi access points,” IEEE Transactions on Consumer Electronics, vol. 56, no. 3, pp. 1860–1867, 2010. View at: Publisher Site  Google Scholar
 Z. Yang, C. Wu, and Y. Liu, “Locating in fingerprint space: wireless indoor localization with little human intervention,” in Proceedings of the 18th Annual International Conference on Mobile Computing and Networking (Mobicom '12), pp. 269–280, August 2012. View at: Publisher Site  Google Scholar
 J. Rekimoto, T. Miyaki, and T. Ishizawa, “LifeTag: WiFibased continuous location logging for life pattern analysis[C]//LoCA,” 2007, 2007: 3549. View at: Google Scholar
 A. AlvarezAlvarez, J. M. Alonso, and G. Trivino, “Human activity recognition in indoor environments by means of fusing information extracted from intensity of WiFi signal and accelerations,” Information Sciences, vol. 233, pp. 162–182, 2013. View at: Publisher Site  Google Scholar
 G. Deak, K. Curran, and J. Condell, “A survey of active and passive indoor localisation systems,” Computer Communications, vol. 35, no. 16, pp. 1939–1954, 2012. View at: Publisher Site  Google Scholar
 A. Haeberlen, E. Flannery, A. M. Ladd et al., “Practical robust localization over largescale 802.11 wireless networks,” in Proceedings of the 10th Annual International Conference on Mobile Computing and Networking (MobiCom '04), pp. 70–84, ACM, Philadelphia, Pa, USA, October 2004. View at: Publisher Site  Google Scholar
 H. Liu, H. Darabi, P. Banerjee, and J. Liu, “Survey of wireless indoor positioning techniques and systems,” IEEE Transactions on Systems, Man and Cybernetics, vol. 37, no. 6, pp. 1067–1080, 2007, Part C (Applications and Reviews). View at: Publisher Site  Google Scholar
 X. Li, K. Pahlavan, M. Latvaaho et al., “Comparison of indoor geolocation methods in DSSS and OFDM wireless LAN systems,” in Proceedings of the 52nd Vehicular Technology Conference (IEEEVTS Fall VTC 2000), 6, pp. 3015–3020, IEEE, 2000. View at: Google Scholar
 S. A. Golden and S. S. Bateman, “Sensor measurements for WiFi location with emphasis on timeofarrival ranging,” IEEE Transactions on Mobile Computing, vol. 6, no. 10, 2007. View at: Publisher Site  Google Scholar
 D. Niculescu and B. Nath, “Ad hoc positioning system (APS) using AOA,” in Proceedings of the 22nd Annual Joint Conference on the IEEE Computer and Communications Societies (INFOCOM '03), vol. 3, pp. 1734–1743, IEEE, San Francisco, CA, USA, April 2003, INFOCOM 2003. View at: Publisher Site  Google Scholar
 M. Youssef, M. Mah, and A. Agrawala, “Challenges: devicefree passive localization for wireless environments,” in Proceedings of the 13th Annual ACM International Conference on Mobile Computing and Networking (MobiCom'07), pp. 222–229, ACM, Montréal, Québec, Canada, September 2007. View at: Publisher Site  Google Scholar
 M. Seifeldin, A. Saeed, A. E. Kosba, A. ElKeyi, and M. Youssef, “Nuzzer: a largescale devicefree passive localization system for wireless environments,” IEEE Transactions on Mobile Computing, vol. 12, no. 7, pp. 1321–1334, 2013. View at: Publisher Site  Google Scholar
 J. Wilson and N. Patwari, “Radio tomographic imaging with wireless networks,” IEEE Transactions on Mobile Computing, vol. 9, no. 5, pp. 621–632, 2010. View at: Publisher Site  Google Scholar
 Y. Yunqiang and A. E. Fathy, “Seethroughwall imaging using Ultra Wideband shortpulse radar system,” in Proceedings of the 2005 IEEE Antennas and Propagation Society International Symposium and USNC/URSI Meeting, 3, pp. 334–337, IEEE, Washington, DC, USA, July 2005. View at: Publisher Site  Google Scholar
 A. R. Hunt, “A wideband imaging radar for throughthewall surveillance,” in Defense and Security, pp. 590–596, International Society for Optics and Photonics, 2004. View at: Google Scholar
 C.P. Lai and R. M. Narayanan, “Throughwall imaging and characterization of human activity using ultrawideband (UWB) random noise radar,” in Defense and Security, pp. 186–195, International Society for Optics and Photonics, 2005. View at: Publisher Site  Google Scholar
 P. Van Dorp and F. C. A. Groen, “Human walking estimation with radar,” IEE ProceedingsRadar, Sonar and Navigation, vol. 150, no. 5, pp. 356–365, 2003. View at: Google Scholar
 A. Lin and H. Ling, “Doppler and directionofarrival (DDOA) radar for multiplemover sensing,” IEEE Transactions on Aerospace and Electronic Systems, vol. 43, no. 4, pp. 1496–1509, 2007. View at: Publisher Site  Google Scholar
 A. M. Haimovich, R. S. Blum, and L. J. Cimini, “MIMO radar with widely separated antennas,” IEEE Signal Processing Magazine, vol. 25, no. 1, pp. 116–129, 2008. View at: Publisher Site  Google Scholar
 J. Scheuner, G. Mazlami, D. Schöni et al., “Probr  a generic and passive WiFi tracking system,” in Proceedings of the 2016 IEEE 41st Conference on Local Computer Networks (LCN), pp. 495–502, IEEE, Dubai, United Arab Emirates, November 2016. View at: Publisher Site  Google Scholar
 M. Cunche, M.A. Kaafar, and R. Boreli, “Linking wireless devices using information contained in WiFi probe requests,” Pervasive and Mobile Computing, vol. 11, pp. 56–69, 2014. View at: Publisher Site  Google Scholar
 M. Cunche, “I know your MAC address: targeted tracking of individual using WiFi,” Journal of Computer Virology and Hacking Techniques, vol. 10, no. 4, pp. 219–227, 2014. View at: Publisher Site  Google Scholar
 T. S. Rappaport, Wireless Communications: Principles And Practice[M], Prentice Hall PTR, New Jersey, 1996.
 A. H. Sherman, “On Newtoniterative methods for the solution of systems of nonlinear equations,” SIAM Journal on Numerical Analysis, vol. 15, no. 4, pp. 755–771, 1978. View at: Publisher Site  Google Scholar  MathSciNet
 C. T. Kelley, Solving Nonlinear Equations with Newton's Method, Society for Industrial and Applied Mathematics, 2003. View at: MathSciNet
 G. K. Smyth, “Optimization and nonlinear equations,” in Wiley StatsRef: Statistics Reference Online, 1997. View at: Google Scholar
 C. Phillips, D. Sicker, and D. Grunwald, “A survey of wireless path loss prediction and coverage mapping methods,” IEEE Communications Surveys & Tutorials, vol. 15, no. 1, pp. 255–270, 2013. View at: Publisher Site  Google Scholar
 J. J. Moré, “The levenbergmarquardt algorithm: implementation and theory,” in Numerical Analysis, pp. 105–116, Springer, Berlin, Heidelberg, Germany, 1978. View at: Google Scholar  MathSciNet
 J. J. Moré, B. S. Garbow, and K. E. Hillstrom, “User guide for MINPACK1[R],” Tech. Rep., 1980, CMP00068642. View at: Google Scholar
Copyright
Copyright © 2017 Lin Sun et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.