Mobile Device Passive Localization Based on IEEE 802.11 Probe Request Frames

This paper presents a novel passive mobile device localization mode based on IEEE 802.11 Probe Request frames. In this approach, the listener can discover mobile devices by receiving the Probe Request frames and localize them on his walking path. The unique location of the mobile device is estimated on a geometric diagram and right-angled walking path. In model equations, site-related parameter, that is, path loss exponent, is eliminated to make the approach site-independent. To implement unique localization, the right-angled walking path is designed and the optimal location is estimated from the optional points. The performance of our method has been evaluated inside the room, outside the room, and in outdoor scenarios.Three kinds of walking paths, for example, horizontal, vertical, and slanted, are also tested.


Introduction
Wi-Fi is a major component for communication in mobile devices, for example, phone and tablet.Researchers take advantage of Wi-Fi signal to build indoor localization system [1,2], life pattern analysis [3], human activity recognition [4], and so on.In indoor localization system, a mobile app has been installed in a mobile phone, reads Wi-Fi RSSI value from Wi-Fi APs, sends RSSI fingerprint, and queries location from the RSSI fingerprint database.The user himself can know his accurate position inside a building, as shown in Figure 1.This kind of localization mode is called active.In this paper, we present a novel passive mobile device localization mode based on IEEE 802.11Probe Request frames without Wi-Fi APs and reference points.The listener can discover the mobile device by receiving the Probe Request frames and localize the position of the mobile device.The listener only equipped with his mobile can secretly know where another mobile holder is, as shown in Figure 2.He can also infer the MAC address of the holder's mobile device or look for the mobile holder with a specific MAC address.This kind of passive localization is a great challenge because there are no reference points or radio map deployed in advance.Another problem is that path loss exponent, which is an important parameter in radio propagation model, varies with different environments.

Related Work
There are two basic modes in WLAN localization problems.One is to know where I am and the other is to know where you are.The former is called active and the latter is called passive [5].
Active localization methods are always fingerprint-based and nonfingerprint-based.In fingerprint-based localization [2,6], Wi-Fi APs should be deployed in advance and a fingerprint database is created to store signal feature values at each spatial coordinate.Nonfingerprint-based solutions use geometric properties of triangles to estimate the target location without development of a radio map [7].Common metrics include received signal strength (RSS) [1], time difference of arrival (TDOA) [8], time of arrival (TOA) [9], and angle of arrival (AOA) [10].Signals from two or three reference points must be made available to these metrics.The advantage of signal strength is that it is easy to implement; however, the parameters in radio model are site-specific.For  example, it was needed to estimate path loss exponent (PLE) and other factors from the training data by regression model [1].Time and angle of an arrival signal would suffer from multipath effect and line-of-sight (LOS) paths between the transmitter and receiver are usually obstructed by walls in indoor environments.
In passive mode, Youssef et al. [11,12] presented a devicefree passive (DfP) localization method.The concept relied on the fact that RF signals were affected by changes in the environment.The monitoring stations continuously recorded signal strength or time-of-flight, which were used to construct a radio map to present the signal changes with entities movement and their locations.Like fingerprint-based localization, this method needs Wi-Fi AP and has to build a radio map in advance.Another technology is Radio Tomographic Imaging (RTI).Wilson and Patwari [13] presented a linear model for using RSS measurements to obtain images of moving objects in wireless networks.
Radar-based techniques also do not require the tracked entity to carry an electronic device.Ultra-wideband (UWB) radar systems provided through-wall imaging methods [14,15] to detect human activity [16] and track walking [17].These systems are accurate, but very complex.Lin and Ling [18] demonstrated an alternate development of a Doppler radar with two-element receiving array for tracking human movements in indoor surveillance applications.Multiple-input multiple-output (MIMO) radar is another emerging field that takes advantage of multiple transmitters and receivers to locate objects within a spatial area [19].
Table 1 shows the comparison of different localization methods based on radio signal in the requirements of AP or wireless node, reference point, PLE estimation, radio map, and special hardware.

Passive Mobile Device Localization Mode
network card, which supports monitor mode, can capture the Probe Request frames [22].
Another piece of information required in our approach is received signal strength indication (RSSI), which can be found in radiotap header.Figure 3 shows the example of a 802.11g radiotap header and Probe Request frame header received from a Xiaomi mobile phone by Wireshark, a network protocol analyzer."SSI signal" represents RSSI in Wireshark.

Position Estimation.
Log-distance path loss model [23] is a radio propagation model that predicates the path loss in indoor or indoor-to-outdoor environments, written as follows: where  is the length of the path from the transmitter to the receiver and  0 is the reference distance (for example,  0 = 1 meter). =  TX −  RX is path loss of distance , where  TX is the transmitted power in dBm and  RX is the received power in dBm. is path loss exponent, which is a measure of the influence of obstacles like partitions, walls, and doors.
Let  0 = 1 and  TX be equal in path loss measurements; we get where  RX (1) stands for a RSSI value in radiotap header received by the passive listener, which is 1 meter from the mobile device.Figure 4 shows geometric diagram of passive position estimation.The listener walks from point  to point  and then point .  ,   , and   are RSSI values received on points , , and , respectively.  ,   , and   are the distances between points , , and  and Wi-Fi device , respectively.According to (2), we can write lg lg  is eliminated by dividing (3) by ( 4) and let then we get Similarly, we divide (4) by ( 5) and let we get lg   =  2 lg   .
Using the Law of Cosines in a triangle,   ,   ,   ,   ,   ,   , , and  in Figure 4 should satisfy the following equations: and   can be replaced by   using ( 7) and ( 9); (10) become In (11),  1 and  2 are known.  ,   , and   are walking distances.  , , and  are three unknown variables needed to be solved.These nonlinear equations can be solved by Newton's method with Jacobian matrix [24,25].Newton's method will converge while the initial guess is sufficiently close to the solution [26].Fortunately, we can know where the solution lies.The initial guess of   can be estimated by (2) assuming  = 3.5 since 2 <  < 6 [27], and ,  start at /4 because 0 < ,  < /2.

Least-Squares Estimation for Four Points in Walking Path.
Four-point walking path ( →  →  → ) is also addressed in this section.The log-distance equation in  and triangle equations can be written as follows: and the Law of Cosines in ΔCWD and ΔBWD, shown in Figure 4, is also added to (10), Let  3 = ( RX (1) −   )/( RX (1) −   ) and replacing   by lg   =  3 lg   in (13), we get In ( 14), there are five equations and four unknown variables,   , , , and .Least-squares minimization of the residual of a set of nonlinear equations is solved by Levenberg-Marquardt method.Moré [28] presented a version of the Levenberg-Marquardt algorithm, implemented in MINPACK [29], with strong convergence properties.Also, the good initial guess yields the desired result.

Uniqueness of Localization.
The mobile device  has two optional points, which are symmetric with respect to the walking path.Here we present a method to select unique location from the candidates.The scheme is to turn a corner in walking path, for example,  →  →  in Figure 5.  →  will give two candidates of the location {,   } and  →  will also give other two candidates of the location {,   }.
Assume  and  are on the side of the ground truth, shown in Figure 5, the distance between  and  is shorter than other combinations, that is, {,   }, {  , }, and {  ,   }.So we define optimal location estimation {, V} where distance is the minimum between {,   } and {,   }, The center point between  and ], that is, ( + V)/2, is considered as the unique location of the mobile device.In experiments, we will give the results of unique localization in detail.

Settings.
To evaluate our passive localization approach, three types of scenarios are designed: (i) Inside the room (Figure 6): this is near distance situation tested in the room.
(ii) Outside the room (Figure 7): this is dividing-wall situation when the listener is outside the room.
(iii) Outdoor (Figure 8): this is middle distance situation tested in the square.
In Figures 6, 7, and 8, the letters - are the placements of mobile devices and numbers 1-12 are the points in the walking path of the listener.There are three kinds of walking paths, horizontal, vertical, and slanted.Table 2 shows the details.
Examples of the listeners include the devices based on Nokia Maemo, Android, or MAC OS.Here a MacBook is   used as the listener.Three mobile devices, for example, iPad2, Nexus7, and Xiaomi Note2, are used to be discovered and passively localized.The RSSI value on each point of the path is the average of several Probe Request frames.

Position Evaluation Results.
To evaluate passive positioning performance, the bias rate  is defined as follows: where   is estimated distances, for example,   ,   , and   , which have been calculated in (10).  is the ground truth for the distances   ,   , and   .We evaluate 222 samples including 72 inside the room, 126 outside the room, and 24 outdoor in the experiment.Tables 3, 4, and 5 show the average bias rate  of distances   ,   , and   in different scenarios and walking paths.The threepoint paths  2 → 3 → 4 have been selected from 1 → 2 → 3 → 4 in outside the room setting and so on.From the results, there is no walking path which is obviously better than others among horizontal, vertical, and slanted paths.Fortunately, the result of outside the room is not worse than those of inside the room and outdoor, although the listener and the mobile device are obstructed by wall.
We have also computed the bias  between the estimated location point   and the ground truth point , shown in Figure 4. Figure 9 shows the cumulative distribution (CDF) of localization error.75% errors are less than 2 meters inside the room, 4 meters outside the room, and outdoor.Figure 10 shows localization error in three walking styles including 72 horizontal, 90 vertical, and 60 slanted samples.Our method gets similar performance on different walking styles.
Figure 11 shows the comparison of different mobiles. are about 1.6, 2.5, and 3.5 meters averagely inside the room, outside the room, and outdoor, respectively.The localization  also tested by (14).Examples of four-point distance estimation is 1 → 2 → 3 → 4, and those of three-point distance estimation are 1 → 2 → 3, 1 → 2 → 4, 1 → 3 → 4, and 2 → 3 → 4 in outside the room setting.Figure 12 shows the bias  result of four-point and three-point estimation.There is no obvious improvement on four-point paths, but the performance could be robust.

Performance of Unique Localization on Right-Angled
Paths.The performance of unique localization on rightangled paths has been tested inside the room, outside the room, and outdoor.The right-angled paths, for example, 1 → 4 → 7 → 8 → 9 in Figure 6 and 2 → 3 → 4 → 8 → 12 in Figure 7, are selected.
Figure 13 shows the results of the unique localization method presented in Section 3.4.Diamond symbols ⧫ in (a), (b), and (c) denote the ground truth of mobile device location.Colorful rectangles indicate the bounding path boxes in Figures 6, 7, and 8.The symbols * and  are two optional locations with respect to the walking path, where the optimal overlap {, ]}, defined in (15), is represented as * .The symmetric optional locations along the walking path are labeled in the same color.From the results, we can see that all optimal locations are correct.The localization performance on the green walk path, which is far away from ⧫, is lower.

Path Loss Exponent
Computing.After solving (11), path loss exponent  has also been computed by ( 4) and boxplots of the distribution inside the room, outside the room, and outdoor are shown in Figure 14.The empirical value of path loss exponent is about 2 in free space and 4-6 in buildings [27].In our experiments, inside the room and outdoor environments are like free space without obstacles while outside the room setting is a dividing-wall scenario in buildings.Figure 14 shows that path loss exponent estimation results in our method are quite similar to the empirical value of experimental settings.measured  RX (1) parameter of iPad2, Nexus7, and Xiaomi Note2, as shown in Table 6. RX (1) value might be a little different in various mobile devices of the same brand.Here we discuss the effect on distance estimation when  RX (1) varies with different mobile devices.From (2), we get the change of  with respect to  RX (1), Δ = ln 10 10 Δ RX (1) .
Then, the relation between the change rate of  and the change of  RX (1) is Path loss exponent  is about 2-3 in free space and 4-6 in buildings [27].Figure 15 shows the change rate Δ/ caused by the change of  RX (1) when  = 2.5 and  = 4.5.From the results, we can see that Δ/ are less than 10% and 19% when the deviation of  RX (1) is no more than 2 dBm in buildings and free space, respectively.4, respectively.The colorful pixels represent the estimation error  to the ground truth of the mobile.The path 4 → 5 → 6 and mobile location  of Figure 6 are used for inside the room testing.The ground truth of  4→5 and  5→6 is 2 meters.The estimation of  4→5 and  5→6 is supposed to be from 1 meter to 3 meters.The path 1 → 2 → 3 and mobile location  of Figure 7 are used for outside the room testing.The ground truth of  1→2 and  2→3 is 2 meters.The estimation of  1→2 and  2→3 is supposed to be from 1 meter to 3 meters.
In inside the room setting, 0.5 meters of walk estimation error will cause about 0.4 meters of mobile localization error.In outside the room setting, the estimation error of   (i.e.,  1→2 in Figure 7) produces less localization error than that of   (i.e.,  2→3 in Figure 7) because path 2 → 3 is closer to the mobile location  than path 1 → 2. The localization error increases while   and   increase or decrease simultaneously.However, a small increase of the localization error is produced when one distance increases and the other decreases; that is, the sum of   and   is the same.The estimation error of point , which is less than 0.5 meters, will cause small localization error when points  and  are fixed.The reason is that points  and  are key points to form the triangle Δ.

Conclusion
In this paper, we present a novel passive mobile localization mode based on IEEE 802.11Probe Request frames without Wi-Fi APs and reference points.In this approach, a geometric diagram is designed to estimate the location of mobile device.Using this approach, nearby mobile devices can be discovered on the listener's walking path.To solve the model equations, path loss exponent, which is a site-related parameter, is eliminated.Therefore, our method is site-independent and does not need to train the parameter which is related to the environments.The experimental results show that the errors of mobile device location are lower than 2 meters and 3.5 meters in indoor and outdoor scenarios, respectively.The performance outside the room, inside the room, and outdoor is similar, although path loss exponents are different in these three kinds of scenarios.The unique localization method on right-angled paths is successful although the walking path is far away from the mobile device.The estimation results of path loss exponents are quite similar to the empirical value of experimental settings.The effect of parameter  RX (1) is less than 20% when its deviation is no more than 2 dBm.We also analyze the localization error caused by movement estimation error inside and outside the room.The localization error is less than 0.4 meters when 0.5 meters error occurs in walk estimation generally; however, a small error increases when   is fixed.

Figure 3 :Figure 4 :
Figure 3: Example of a 802.11 radiotap header and Probe Request frame header.

Figure 6 :
Figure 6: Inside the room experimental setting.

Figure 7 :
Figure 7: Outside the room experimental setting.

Figure 9 :Figure 10 :
Figure 9: CDF of localization error in three scenarios.

Figure 12 :
Figure 12: Comparison between four-point and three-point estimation.

Figure 16 :Figure 17 :
Figure 16: The effect caused by movement estimation error inside the room.

Table 1 :
Comparison of different localization methods based on radio signal.

Table 3 :
Comparison of B inside the room.

Table 4 :
Comparison of B outside the room.
4.3.Four-Point versus Three-Point Distance Estimation.Localization performance using four points in walking path is

Table 5 :
Comparison of B in outdoor.

Table 6 :
RX (1) parameter for three mobile devices.There might be an error in the estimation of movement distances   or   in Figure4.The localization error caused by movement estimation error inside and outside the room is shown in Figures16 and 17, respectively.The testing mobile is Google Nexus7.The axes  and  in the figures are   and   in Figure