Non-cooperative 802.11 MAC layer fingerprinting and tracking of mobile devices

This archive contains the datasets used for the experiments in the paper "Non-cooperative 802.11 MAC layer fingerprinting and tracking of mobile devices", namely: Glimps 2015 dataset (mac_info collection): A collection of 122,989 Probe Request frames captured by 8 monitoring stations at the Glimps music festival in Ghent, Belgium (10 - 12 December 2015). To minimize overhead, each monitoring station individually stored only one Probe Request per unique MAC. The dataset was used to show that the high entropy in Probe Requests can be used to deanonymize devices that use MAC address randomization. Only the source MAC and Information Elements (IEs) were captured for this purpose. Research center 2016 dataset (mac_research collection): A complete collection of all management and control frames (including Radiotap headers) observed at our research lab from 28 January to 8 Febuary 2016. This dataset was used to calculate the "stability" and "variability" of Probe Request IEs (see our paper for more details on these metrics). Transmission rate datasets (mac_research_0 - mac_research_4 collections): Observations of mobile devices when actively instigated for extra transmissions. These observations were used in the paper to calculate the effectiveness of the various stimulus frame techniques. This dataset should only be used to verify the results in the paper. The other datasets could be used for related experiments. All datasets were anonymized by applying the following rules: The 3 least significant bytes of each MAC address were uniquely and consistently mapped to a different value, with exception of "ff:ff:ff" and "00:00:00". The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID. The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial / model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector). The datasets are provided as MongoDB collections with the following document format: _id: ObjectID of the document info_length: Length of the binary blob info: Binary blob of the Radiotap frame (mac_research) or only the Information Elements (mac_info) mac_addr: Transmitter of the frame To install the dataset, execute the command "mongorestore --gzip -d anonymized ./anonymized" after extracting the .tar.xz file. A .pcap format of the mac_info (wrapped in a dummy Radiotap frame) and mac_research datasets is additionally provided at crawdad.org. The mac_info dataset can be visually explored on https://wicability.net/datasets (Glimps 2015 dataset).

搜集汇总

背景与挑战

背景概述

该数据集专注于非协作802.11 MAC层指纹识别与移动设备追踪，包含多个子集，如Glimps 2015数据集用于展示探测请求高熵如何辅助去匿名化MAC地址随机化设备，以及研究实验室2016数据集用于计算信息元素的稳定性和变异性。所有数据经过匿名化处理，格式为MongoDB集合，适用于无线网络安全研究和设备指纹分析。