![](bg7.png)
nal viewpoint. They must be taken into account by
the fingerprinting method.
One difference between the fingerprinter and the
fingerprintee is the location. One attacker that would
be able to localize precisely both the fingerprintee and
the fingerprinter could distinguish the decoy frames
and remove them when replaying his victim’s traffic.
Nevertheless, accurate localization is not easy. For
example, Haeberlen et al. need at least a minute of
traffic from the devicesto analyze their signal strength
in (Haeberlen et al., 2004). We do not provide as
many opportunities to determine the fingerprinter lo-
calization, as we only inject a few frames as decoy
frames. Another strategy for an attacker would be to
identify the source of the packets by performing phys-
ical layer fingerprinting. However, this requires signal
analyzers, and as we mentioned in Section 2.1, such
attackers are out of the scope of this paper.
7 RELATED WORK
Driver or NIC fingerprinting exploit differencesin im-
plementation of the standard. Franklin et al. use the
active scanning period to fingerprint passively drivers
(Franklin et al., 2006). This procedure lacks precise
timing definition in 802.11 standard about the fre-
quency of probe requests in a specific channel, and the
time needed to cycle through the different channels.
Driver implementations then vary. Bratus et al. de-
velop an activemethod to fingerprint the driveror NIC
(Bratus et al., 2008). They send non-standard frames
and chart the responses in decision trees. These meth-
ods do not intend to differentiate two different devices
using the same driver or NIC. They are good candi-
dates to the Diversity approach.
For unique devices fingerprinting, two ways are
envisioned: using the clock characteristics, or global
traffic characteristics. Desmond et al. follow the
work of (Jana and Kasera, 2008) and (Arackaparam-
bil et al., 2010) on APs (Desmond et al., 2008). They
discuss the possibility to enhance time skew to de-
vices by clustering probe requests inter-arrival time.
They remark slight time variations that depend on
the time skew. However, gathering a sufficient num-
ber of frames for a good time skew estimation takes
more than an hour. Neumann et al. propose to iden-
tify unique devices using the frame inter-arrival time
(Neumann et al., 2012). This reveals global traffic
characteristics that depend on a mix of wireless cards,
driver features, and on the application generating the
data.
Physical layer fingerprinting exploits the charac-
teristics of the radio transceivers that sends and re-
ceives data in 802.11 devices. They also have unique
characteristics, often based on minute hardware im-
perfections. Hall et al. establish a transient-based ap-
proach that extracts the transient portion of the signal
(Hall et al., 2004). Brik et al. develop a modulation-
based approach that extracts features from the part of
the signal that has been modulated, i.e., the data (Brik
et al., 2008). These two approaches require dedicated
and expensivesignal analyzer whereas we rely on off-
the-shelf devices. Danev et al. have considered the
ease with which an attacker is able to forge physical
layer fingerprints (Danev et al., 2010). They found
that transient-based techniques are more difficult to
reproduce.
The work of Prigent et al. focus on TCP/IP stack
identification (Prigent et al., 2010). Using fingerprint
deception, they modify the signatures of the finger-
printees as we do in Diversity. However, their goal
is opposite: instead of better identifying the devices,
they want to hide the true identities of the fingerprint-
ees to be less appealing to attackers.
Castelluccia and Mutaf use frame injection and
identity spoofing as we do in the anti-forgery system
(Castelluccia and Mutaf, 2005). They build a pairing
protocol, in which two devices agree on a n-bit secret
sending n packets with the source field set to one of
their two identities (depending on the desired bit 0 or
1). The devices need to be shaken to achieve spatial
indistinguishability. An eavesdropper cannot retrieve
the secret since she cannot figure out which device
actually sent the packet.
Finally, the 802.11w amendment targeted the pro-
tection of management frames, so one can argue that
fingerprinting is less needed. However, Ahmad and
Tadakamadla found that 802.11w is still vulnerable
to some known attacks, in addition to three new ones
(Ahmad and Tadakamadla, 2011). In common, theses
attacks leverage the ability to spoof MAC addresses.
More generally, we believe that as long as it is pos-
sible to spoof MAC addresses, fingerprinting will be
useful. We also stress that fingerprinting can be used
with legacy devices.
8 CONCLUSIONS
Fingerprinting has a limited accuracy in the case
where devices are similar. We designed a generic
approach called Diversity that, given a fingerprinting
method, improves the identification of unique devices
even if they have equivalent {machine, NIC model,
driver}. This approach does not need a shared secret
between the fingerprinter and the fingerprintee. We
implemented and evaluated it against a dataset com-
Improving802.11FingerprintingofSimilarDevicesbyCooperativeFingerprinting
385