Non-Cooperative 802.11 Mac Layer Fingerprinting And Tracking Of Mobile Devices

Abstract

This archive contains the datasets used for the experiments in the paper "Non-cooperative 802.11 MAC layer fingerprinting and tracking of mobile devices", namely: Glimps 2015 dataset (mac_info collection): A collection of 122,989 Probe Request frames captured by 8 monitoring stations at the Glimps music festival in Ghent, Belgium (10 - 12 December 2015). To minimize overhead, each monitoring station individually stored only one Probe Request per unique MAC. The dataset was used to show that the high entropy in Probe Requests can be used to deanonymize devices that use MAC address randomization. Only the source MAC and Information Elements (IEs) were captured for this purpose. Research center 2016 dataset (mac_research collection): A complete collection of all management and control frames (including Radiotap headers) observed at our research lab from 28 January to 8 Febuary 2016. This dataset was used to calculate the "stability" and "variability" of Probe Request IEs (see our paper for more details on these metrics). Transmission rate datasets (mac_research_0 - mac_research_4 collections): Observations of mobile devices when actively instigated for extra transmissions. These observations were used in the paper to calculate the effectiveness of the various stimulus frame techniques. This dataset should only be used to verify the results in the paper. The other datasets could be used for related experiments. All datasets were anonymized by applying the following rules: The 3 least significant bytes of each MAC address were uniquely and consistently mapped to a different value, with exception of "ff:ff:ff" and "00:00:00". The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID. The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial / model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector). The datasets are provided as MongoDB collections with the following document format: _id: ObjectID of the document info_length: Length of the binary blob info: Binary blob of the Radiotap frame (mac_research) or only the Information Elements (mac_info) mac_addr: Transmitter of the frame To install the dataset, execute the command "mongorestore --gzip -d anonymized ./anonymized" after extracting the .tar.xz file. A .pcap format of the mac_info (wrapped in a dummy Radiotap frame) and mac_research datasets is additionally provided at crawdad.org. The mac_info dataset can be visually explored on https://wicability.net/datasets (Glimps 2015 dataset).