Non-cooperative 802.11 MAC layer fingerprinting and tracking of mobile devices
收藏资源简介：
This archive contains the datasets used for the experiments in the paper "Non-cooperative 802.11 MAC layer fingerprinting and tracking of mobile devices", namely: Glimps 2015 dataset (mac_info collection): A collection of 122,989 Probe Request frames captured by 8 monitoring stations at the Glimps music festival in Ghent, Belgium (10 - 12 December 2015). To minimize overhead, each monitoring station individually stored only one Probe Request per unique MAC. The dataset was used to show that the high entropy in Probe Requests can be used to deanonymize devices that use MAC address randomization. Only the source MAC and Information Elements (IEs) were captured for this purpose. Research center 2016 dataset (mac_research collection): A complete collection of all management and control frames (including Radiotap headers) observed at our research lab from 28 January to 8 Febuary 2016. This dataset was used to calculate the "stability" and "variability" of Probe Request IEs (see our paper for more details on these metrics). Transmission rate datasets (mac_research_0 - mac_research_4 collections): Observations of mobile devices when actively instigated for extra transmissions. These observations were used in the paper to calculate the effectiveness of the various stimulus frame techniques. This dataset should only be used to verify the results in the paper. The other datasets could be used for related experiments. All datasets were anonymized by applying the following rules: The 3 least significant bytes of each MAC address were uniquely and consistently mapped to a different value, with exception of "ff:ff:ff" and "00:00:00". The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID. The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial / model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector). The datasets are provided as MongoDB collections with the following document format: _id: ObjectID of the document info_length: Length of the binary blob info: Binary blob of the Radiotap frame (mac_research) or only the Information Elements (mac_info) mac_addr: Transmitter of the frame To install the dataset, execute the command "mongorestore --gzip -d anonymized ./anonymized" after extracting the .tar.xz file. A .pcap format of the mac_info (wrapped in a dummy Radiotap frame) and mac_research datasets is additionally provided at crawdad.org. The mac_info dataset can be visually explored on https://wicability.net/datasets (Glimps 2015 dataset).
本归档包含论文《非协作式802.11 MAC层指纹识别与移动设备追踪》实验所用的全部数据集，具体如下： 1. Glimps 2015数据集（mac_info采集集）：2015年12月10日至12日，在比利时根特市Glimps音乐节现场，由8个监测站点捕获的122989条探测请求（Probe Request）帧集合。为降低采集开销，每个监测站点仅为每个唯一MAC地址存储一条探测请求帧。该数据集用于验证：探测请求帧中的高熵信息可用于反制采用MAC地址随机化的设备的匿名性。本次采集仅捕获了源MAC地址与信息元素（Information Elements，IEs）。 2. Research center 2016数据集（mac_research采集集）：2016年1月28日至2月8日，于本研究实验室捕获的所有管理帧与控制帧的完整集合（包含Radiotap头部）。该数据集用于计算探测请求帧信息元素的“稳定性”与“可变性”（相关指标的详细说明参见本文）。 3. 传输速率数据集（mac_research_0至mac_research_4采集集）：针对主动触发额外传输的移动设备的观测数据。本数据集仅可用于复现论文中的相关结果，用于验证各类触发帧技术的有效性；其余数据集则可用于开展相关拓展实验。 所有数据集均通过以下规则完成匿名化处理： - 每个MAC地址的最低3个有效字节将被统一且唯一地映射至其他数值，广播地址“ff:ff:ff”与全零地址“00:00:00”除外。 - 除通配符（空）SSID外，SSID信息元素的SSID字段将被替换为字符串"Hidden"。 - 厂商特定WPS信息元素将根据其负载中包含的敏感信息（如设备序列号/型号、UUID等）生成哈希值进行替换，并同步更新该信息元素的长度。需注意：Wireshark将无法解析包含此类匿名化处理后的WPS信息元素的探测请求帧，因此若需对WPS信息元素之后的内容进行进一步解析，需手动完成（例如使用Scapy工具或修改Wireshark协议解析器）。 本数据集以MongoDB采集集形式提供，单条文档的格式如下： - `_id`：文档的ObjectID - `info_length`：二进制数据块的长度 - `info`：Radiotap帧（对应mac_research数据集）或仅信息元素（对应mac_info数据集）的二进制数据块 - `mac_addr`：该帧的发送方地址 数据集安装步骤如下：先解压.tar.xz格式的归档文件，随后执行命令`mongorestore --gzip -d anonymized ./anonymized`完成导入。此外，还在crawdad.org提供了mac_info数据集（封装于虚拟Radiotap帧中）与mac_research数据集的.pcap格式副本。Glimps 2015数据集可通过https://wicability.net/datasets 进行可视化探索。
