Advancing Wireless Link Signaturesfor Location Distinction ∗

Junxing Zhang† Mohammad H. Firooz‡ Neal Patwari‡ Sneha K. Kasera†

†School of ComputingUniversity of Utah, Salt Lake City, USA{junxing, kasera}@cs.utah.edu

‡Dept. of Electrical & Computer EngineeringUniversity of Utah, Salt Lake City, USA{firooz, npatwari}@ece.utah.edu

ABSTRACTLocation distinction is the ability to determine when a de-vice has changed its position. We explore the opportunity touse sophisticated PHY-layer measurements in wireless net-working systems for location distinction. We first comparetwo existing location distinction methods - one based onchannel gains of multi-tonal probes, and another on channelimpulse response. Next, we combine the benefits of thesetwo methods to develop a new link measurement that wecall the complex temporal signature. We use a 2.4 GHz linkmeasurement data set, obtained from CRAWDAD [10], toevaluate the three location distinction methods. We findthat the complex temporal signature method performs sig-nificantly better compared to the existing methods. We alsoperform new measurements to understand and model thetemporal behavior of link signatures over time. We inte-grate our model in our location distinction mechanism andsignificantly reduce the probability of false alarms due totemporal variations of link signatures.

Categories and Subject DescriptorsC.2.3 [Computer Communication Networks]: NetworkOperations - Network Monitoring; C.4 [Performance ofSystems]: Design Studies

General TermsDesign, Measurement, Performance

KeywordsPHY, Radio Channel, Multipath, Motion Detection

∗This research was supported in part by ONR/ARL MURIgrant #W911NF-07-1-0318, NSF Career Award #0748206,and a Technology Commercialization Project grant from theUniversity of Utah Research Foundation.

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies arenot made or distributed for profit or commercial advantage and that copiesbear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.MobiCom’08, September 14–19, 2008, San Francisco, California, USA.Copyright 2008 ACM 978-1-60558-096-8/08/09 ...$5.00.

1. INTRODUCTIONLocation distinction in a wireless network is the ability

to detect, at one or more receivers, when a transmitter haschanged its position. Unlike localization or location esti-mation, location distinction does not attempt to determinewhere a transmitter is, instead, it detects when that locationis different from past locations of the transmitter. Locationdistinction has the following critical advantages comparedto localization: (i) Localization suffers from the inaccura-cies caused by the multipath channel. Location distinctioncan thrive in the multipath channel [11]. (ii) Location dis-tinction is more sensitive to motion. A change in locationof less than a meter can be robustly detected by a locationdistinction algorithm. A localization algorithm may not beable to determine location to within a meter of accuracy, andthus will be unable to reliably detect a meter of motion. (iii)Location distinction needs less coverage. A localization sys-tem must have at least three access points or base stationswithin range of a transmitter in order to locate it. A loca-tion distinction algorithm, in many scenarios, can reliablydetermine a change in position with only one access pointor base station in range [11]. Location distinction is criti-cal in many wireless network situations and applications [4,6, 11]. In surveillance systems, video cameras, laser beams,and pressure detectors are employed to monitor any loca-tion change of valuable assets or to tract the movement of asuspicious personnel. In warehouses, radio frequency iden-tification (RFID) tags are widely utilized for inventory andphysical security. Here, location distinction is critical in pro-viding a warning so that more resources can be focused onmoving objects. In sensor networks, numerous systems havebeen designed to sense the infrared or acoustic signals fromthe objects of interest for location or detection purposes.Furthermore, in wireless local area networks, location dis-tinction can be exploited to efficiently locate wireless nodes,detect identity theft, and provide physical evidence.

Location distinction methods based on wireless physicallink characteristics, also known as link signatures or finger-prints in the existing literature, are attracting growing at-tention. In the last few years, researchers have proposed theuse of the following three different wireless link signatures.

Received Signal Strength (RSS): RSS is a measurement ofthe power present in a received radio signal. In [4], Fariaet al have proposed to measure RSS of signals generated bya host in a WLAN at multiple wireless receivers. A tuple,constructed by aggregating RSS values at different receiversis used as a signalprint of the transmitter. Transmitters at

26

different locations produce different signalprints because ofdifferences in signal decay characteristics between the trans-mitters and the receivers. Multiple receivers make the RSSbased technique more robust by dealing with the temporalvariations of RSS and its non-isotropic behavior.

Channel Gains of Multi-tonal Probes: A radio link froma transmitter to a receiver is composed of many paths thatare caused by reflections, diffractions, and scattering of radiowaves. The multipath characteristics are different at differ-ent locations. When a multi-tonal probe is transmitted froma transmitter to a receiver, the different carrier waves expe-rience different gains in the wireless channel. A vector ofthese channel gains can serve as a link signature [6] becausetransmitters at different locations, due to unique multipathcharacteristics, will produce different vectors.

Temporal Channel Impulse Response: The temporal chan-nel impulse response of a link is the superposition of theimpulse responses, each one representing a single path inthe link multipath. Each impulse is delayed by the pathdelay, and multiplied by the amplitude and phase of thatpath. Transmitters at different locations produce differentchannel impulse responses due to unique multipath charac-teristics [11].

Being based on the rich multipath characteristics of awireless link, the last two link signatures are expected toperform better than the simpler RSS-based signature. Infact, Patwari and Kasera [11] have shown that compared tolocation distinction based on the temporal channel impulseresponse, the RSS-based method has a consistently lowerdetection rate and a higher false alarm rate. In this paper,our goal is to explore the opportunity to further advance lo-cation distinction techniques in wireless networks. Towardsthis goal, we first compare the methods based on channelgains of multi-tonal probes and the temporal channel im-pulse response. We find that when the number of carrierwaves is small, the temporal channel impulse response hasa higher probability of detection (of location change) butwhen the number of carrier waves is large, the multi-tonalsignature has a higher probability of detection. Next, weuse the strengths of these two multipath based methods todevelop a new signature that we call a complex temporal sig-nature. We use a 2.4 GHz channel measurement data set,obtained from CRAWDAD [10], to evaluate the two existingmultipath based, and our new, link signatures. We find thatthe complex temporal method exhibits the highest perfor-mance in terms of high detection rate and low false alarmrate.

None of the past research on location distinction has eval-uated the temporal behavior of link signatures. A locationdistinction mechanism that does not consider the temporalchanges in link behavior can increase the probability of falsealarms. In this paper, we use measurements of the complextemporal signatures to develop and model temporal profilesof links. We model the temporal behavior using a K-stateMarkov chain such that link signatures measured in onestate are very similar to each other, while those measuredbelonging to different states of the Markov chain are notice-ably different from each other. We integrate our Markovmodel in our location distinction mechanism. We find thatour integrated location distinction significantly reduces theprobability of false alarms.

The rest of this paper is organized as follows. The twoexisting multipath-based link signatures are described and

compared in Section 2. In Section 3, we refine the existingmethods to develop a new link signature. An frameworkfor evaluating location distinction methods is outlined inSection 4. We extensively evaluate all the link signatures inSection 5. We present our temporal behavior measurementsand results in Section 6. Section 7 summarizes the relatedwork on wireless link signatures. We conclude the paper andindicate directions for future work in Section 8.

2. A COMPARISON OF MULTIPATH-BASED LINK SIGNATURES

In this section, we describe and qualitatively compare twoexisting multipath-based link signatures and metrics for lo-cation distinction. We start with an overview of multipathchannel response and then describe the multiple tone and thetemporal channel impulse response methods. We define thelink signature and the location distinction evaluation metricunder each method. We end this section by comparing thetwo methods and discussing the benefits of each method.

2.1 Multipath Channel ResponseBoth link signatures in [6] and [11] are functions of the

multipath channel response. The wireless channel from thetransmitter to the receiver consists of multiple paths causedby reflections, diffractions, and scattering of the radio waves.Essentially, the received signal contains multiple time-delayed,attenuated, and phase-shifted copies of the original signal.Because these multipath characteristics in the channel re-sponse change considerably at different locations, measure-ments of the channel are a good “signature” or “fingerprint”of the link and can be used for identification purposes.

The impulse response of a time-variant multi-path fadingchannel can be written as follows:

h(t, τ ) =

L(t)X

l=1

αl(t)ejφl(t)δ(τ − τl(t)) (1)

where h(t, τ ) is the impulse response of the channel at timet to a signal at time t − τ . It is assumed that there areL(t) paths between the transmitter and receiver, and τl(t)is the delay of the lth path, αl(t) is its gain, and φl(t) isits phase shift. In a short period of time, for example, for apacket duration, it is reasonable to consider the channel asa time-invariant filter with the following impulse response:

h(τ ) =L

X

l=1

αlejφlδ(τ − τl) (2)

When channel response is represented in the time domainas h(t), it is called the channel impulse response (CIR). ItsFourier transform H(f) = F {h(τ )} represents the channelresponse in the frequency domain, and is the channel fre-quency response. By sending s(t) through the channel, thereceiver receives:

r(t) = s(t) ∗ h(t) =L

X

l=1

αlejφls(t − τl) (3)

The received signal is the convolution of the sent signal andthe channel response in the time domain. In the frequencydomain, it is simply the product of the transmitted signaland the channel frequency response.

R(f) = S(f)H(f) (4)

27

In order to create a link signature independent of the trans-mitted signal S(f), the channel response must be recoveredfrom the received signal. One of the following two methodscan be used,

H(f) =1

Ps

S∗(f)R(f) =1

Ps

|S(f)|2H(f) (5)

H(f) =R(f)

S(f)(6)

where Ps is the power of the sent signal inside the band.Note that the first expression assumes that |S(f)|2 is ap-proximately constant for the given modulation scheme, andthe second expression assumes that S(f) is non-zero in theband of interest. The recovered channel response can berepresented in either the time domain as h(t) or in the fre-quency domain as H(f). Various functions of either couldbe used to represent the channel response. There are alsovaried signals that can be used to measure the channel re-sponse. These factors may lead to a variety of multipathchannel-based link signatures.

2.2 Multiple Tone ProbingIn [6], multiple tone probing is used to generate a mul-

tipath channel-based link signature. The critical feature ofthis method is that it measures frequency response, and inparticular, complex attenuation at multiple frequencies. Wefirst show how this method measures samples of the complexfrequency response of the channel, and then relate how thesimilarity of a signature and a history of past measurementsis quantified.

2.2.1 SignatureIn this method K carrier waves are simultaneously trans-

mitted to the receiver. The transmitted signal in the timedomain and frequency domain are given as,

s(t) =

KX

κ=1

ej2πfκt (7)

S(f) =K

X

κ=1

δ(f − fκ) (8)

where fκ is the carrier frequency of the κth carrier wave.Note that carrier frequencies fκ should be separated by anamount greater than channel coherence bandwidth. Eachcarrier wave is attenuated by the channel complex gain atits center frequency, as indicated by (4). Thus the receivedsignal is given in the frequency domain as,

R(f) =

KX

κ=1

H(fκ)δ(f − fκ) (9)

where H(fκ) is the complex gain at fκ.The vector of these gains {H(fκ)} is used as the multiple

tone signature. The nth recorded multiple tone signature ofthe link between transmitter i and receiver j is

h(n)i,j = [H(n)(f1), . . . , H

(n)(fK)]T . (10)

Although a special multiple tone signal is used in [6], wenote that the identical channel frequency response could bemeasured with an arbitrary signal if S(f) was known at thereceiver, because complex channel gains {H(fκ)} could be

calculated using (6) at any frequencies fκ for which S(fκ) 6=0.

2.2.2 MetricIn the multiple tone probing method of [6], the N th mul-

tiple tone signature h(N) is compared with each previouslymeasured signature in the history Hi,j using a measure calledthe correlation statistic. The average correlation statistic isgiven by

sigEval(h(N),Hi,j) =1

N − 1

N−1X

n=1

|T (n)| (11)

where T (n) is the correlation of the nth and the Nth mea-surements,

T (n) =

P

κ H(n)(fκ)H(N)(fκ)∗

Kγ(n)A

(12)

where γ(n)A is average squared magnitude of the elements of

h(n)i,j : γ

(n)A = ‖h(n)

i,j ‖2/K.The correlation statistic in (11) is a measure of similar-

ity. If the correlation is low, then the Nth signature is verydifferent from those in the history. In contrast, if the corre-lation is high, then the new measurement is very similar tothose in the history.

2.3 Temporal CIR SignatureIn the temporal link signature method in [11], the link sig-

nature is measured in the time domain. One main differencebetween this method and the multiple tone probing methodis its estimation of the impulse response as a function oftime delay, and in particular, the magnitude of the impulseresponse. We first show how the temporal link signature iscomputed, and then describe the metric used to quantify itsdistances from a history of past measurements.

2.3.1 SignatureIn [11], an unmodulated direct-sequence spread-spectrum

(DS-SS) signal is sent from a transmitter. In other words,a known pseudo-noise (PN) code signal is transmitted ass(t). Because S(f) of a PN code signal is approximately flatwithin the band, the channel response H(f) is recoveredfrom (5).

The temporal impulse response h(t) is then obtained bycalculating F

−1 {H(f)}, the inverse Fourier transform ofH(f). Noting that random phase shifts occur between mea-surements of h(t), the link signature is taken in [11] to be themagnitude of the temporal impulse response. The nth sam-pled link signature measurement of the link between trans-mitter i and receiver j is then,

h(n)i,j = [|h(n)(0)|, . . . , |h(n)(STr)|]T (13)

where Tr is the sampling interval at the receiver and S + 1is the number of samples.

Although a PN code signal is used in [11], again, an ar-bitrary transmitted signal with S(f) known at the receiver,could be used to estimate H(f) and thus h(t).

2.3.2 MetricIn the temporal link signature, the difference between the

N th signature h(N) and those in the history Hi,j is givenas the minimum normalized Euclidean distance between the

28

new signature and any signature in the history set. Thedefinition is given in the Equation (14) below.

sigEval(h(N),Hi,j) =1

σi,j

minh∈Hi,j

‖h − h(N)‖`2 (14)

where σi,j is the normalization factor,

σi,j =1

(N − 1)(N − 2)

X

g,h∈Hi,j

‖h − g‖`2 (15)

Note that the distance in (14) is divided by the averagedistance between historic signatures σi,j as defined in (15)in order to normalize to the normal temporal variations inthe radio channel.

The metric in (14) indicates the difference between a newmeasurement and the stored history measurements. WhensigEval(h(N),Hi,j) is low, it indicates that the new mea-surement is very similar to the history; when it is high, itis very different. Both methods [11] and [6] quantify re-lationships between measurements, but are opposite in theinterpretation of the metric. This will be discussed again inSection 4.

2.4 DiscussionThe link signatures in the multiple tone probing method

and in the temporal link signature method both make mea-surements of the multipath channel and use them to quanti-tatively identify a link. The work of [6] and [11] use partic-ular signals to enable channel measurement, but both canbe used with arbitrary transmitted signals. Thus it is ofclear interest to compare the two methods prior to makingimprovements to them in Section 3. While a quantitativecomparison is made in Section 5, this section discusses qual-itatively the merits of the two approaches.

The temporal link signature measures a band-limited ver-sion of the channel impulse response in (2). In the time do-main, each multipath contributes an impulse at a particulartime delay. If a change in the channel occurs, for example,because of a person walking by, it is likely that the changeoccurs to a single path. Because multiple paths are largelyorthogonal in the time domain, a change in the phase ofone path can affect only a small portion of the time-delayedsamples, and the feature vector remains mostly stationaryover time.

However, the channel frequency response is sensitive toeach multipath. Since an impulse in the time domain is aconstant in the frequency domain, a change to a single pathmay change the entire multiple tone link signature. For thisreason, a temporal signature can be more robust againstsmall changes in multipath. Note that if the transmittermoves position, that all multipath are likely to change, andboth temporal and multiple tone link signatures will changedramatically.

Importantly, the multiple tone link signature is a com-plex measurement, while the temporal link signature is areal-valued measurement. The inclusion of phase informa-tion in the multiple tone signature effectively increases therichness of the measurement space. The temporal link sig-nature, with only magnitude information, does not retainsome identifiable information about a link captured by thechannel phase response, and thus we would expect it to losesome ability to uniquely identify links.

3. INNOVATIVE METHODSIn this section we propose improvements to the link sig-

natures described in Section 2. First, for the multiple tonelink signature, we propose a new metric which improves itsrobustness to changing received powers. Second, we presenta new superior link signature method which we call the com-plex temporal link signature, that combines the strength ofthe two signatures described in Section 2, and show thata simple metric is robust to uninformative, random phaseshifts and can thus accurately quantify the distance betweentwo measured link signatures.

3.1 Refined Metric for Multiple ToneSignatures

The refined metric for the multiple tone signature is in-spired by a close study of the original correlation statistic.Our evaluation in Section 5.1.1 demonstrates that this newmetric indeed improves the signature performance.

3.1.1 Normalized MetricWe denote this new metric as the normalized metric. We

can view the normalized metric as the result of normalizingeach multiple tone signature to its magnitude before thecalculation of the correlation statistic. Specifically,

h̃(n)i,j =

h(n)i,j

‖h(n)i,j ‖

(16)

Plugging this into (12), the new T (n) is given by

T (n) =

P

κ H(n)(fκ)H(N)(fκ)∗

‖h(n)i,j ‖‖h(N)‖

. (17)

This is equivalent to the following,

T (n) =1

K

X

κ

H(n)(fκ)q

γ(n)A

H(N)(fκ)∗√γE

(18)

where γE = 1K‖h(N)‖2. This representation of (17) shows

that each channel frequency response is normalized to thesquare root of its average power.

The correlation statistic, given by (11), is then used to

quantify the difference between the Nth link signature andthe recorded history.

3.1.2 DiscussionThe new normalized metric allows the multiple tone prob-

ing method to be robust to differences in the received powerbetween the new channel signature h(N) and the signaturesin the history. In the original metric in (12), the statistic

T n is normalized only to the power in signature h(n)i,j in the

history, not to the power of the new signature h(N).Consider the scenario in which the new signature h(N) has

a significantly larger magnitude because it is from anothertransmitter closer to the receiver than the original trans-mitter. In this case, the original T n will have a very highvariance, and even though it would have zero mean, thecorrelation statistic may often exceed the threshold due tothe high variance. This would lead to frequent missed de-tections, since we distinguish different locations based onlow correlation. In the new definition of T n in (17), an-other nearby transmitter would not increase the variance of

29

T n, and thus we would consistently measure low correlationstatistic.

3.2 Complex Temporal SignatureFinally, we present a new link signature method we call

the complex temporal signature method, which combines thebest features of both the temporal link signature method andthe multiple tone probing method. As mentioned in Section2.4:

• The temporal link signature has the advantage of oper-ating in the time domain which de-correlates multipathat different delays;

• The multiple tone link signature has the advantageof using a complex-valued signature which preservesphase information

This section presents the complex temporal signature, whichincorporates phase information into a time-domain channelrepresentation. We discuss the problem of random phaseshifts, which are a result of clock and frequency shifts, ratherthan changes in the channel. Finally, we show that a newφ2 difference can be used to eliminate the effects of ran-dom phase shifts when quantifying distance between com-plex temporal link signatures.

3.2.1 Enhance The SignatureAs indicated, we change the definition of the link signature

to be the vector of the complex value of the channel impulseresponse,

h(n)i,j = [h(n)(0), . . . , h(n)(STr)]

T , (19)

where, again, Tr is the sampling rate and S+1 is the numberof samples. This signature is the inverse Fourier transformof H(f), which is calculated from (5). Compared to (13),the magnitude of each gain is not taken, so the complex linksignature retains phase information in a manner similar tothe multiple tone link signature.

3.2.2 Issue: Phase ChangesAs phase changes are preserved in the complex tempo-

ral link signature, phase differences between two link sig-natures can be used as part of the metric which quantifiesthe difference between them. However, this can be problem-atic because some phase changes in the link signature havenothing to do with any changes in the link. The authorsin [6] have noted that, although they tried to minimize thetemporal variations of link signatures by conducting experi-ments during a time of no activity in the building, they en-countered difficulty discriminating between channel responsephase and oscillator drift. They worked around the problemby comparing the magnitude of the gain, but we want tooffer an solution here.

In particular, in typical wireless communications links,the lack of time and frequency synchronization causes phasechanges between link signature measurements. Recall thatthe phase of the received signal is ϕ+2πft, where ϕ is the ini-tial phase of the transmitted signal. If the clock of the trans-mitter is not synchronized very well with that of the receiver,the phase of the received signal will change by 2πf∆t, where∆t is the time offset between the two clocks. This 2πf∆twill be an unknown phase at the transmitter. Another causeof phase change is the fact that two wireless devices (trans-mitter and receiver) will always have slightly different carrier

frequencies fTx and fRx. In this case, the phase differencebetween two measurements will be 2π(fTx − fRx)t. Eventhe most accurate clocks will have a phase that cycles manytimes per second, and any given measurement will have arandom phase.

The random phase shift due to lack of synchronizationaffects the entire duration of the link signature. In otherwords, in a completely static channel, if the first measuredcomplex temporal link signature was h, then the next com-plex temporal link signature would be measured as ejφh. Anexample from measurements in Figure 1 shows these chang-ing phase shifts among five measured complex temporal linksignatures as rotations in the complex plane.

−1.5 −1 −0.5 0 0.5 1 1.5x 104

−1.5

−1

−0.5

0

0.5

1

1.5x 104

real part value

imag

inar

y pa

rt va

lue

signature1signature2signature3signature4signature5

Figure 1: Phase shifts in signatures of a sample link

3.2.3 Calculating Distance Among Phase ShiftBecause these phase shifts φ are not due to the channel, we

must ignore them when calculating the difference betweensignatures. Intuitively, we should determine the phase shiftφ, and then multiply the shifted complex link signature bye−φ, essentially, rotating the two signatures to align in thecomplex phase plane, and then calculate their difference. Inthis section, we introduce a φ2 difference to perform thisalignment and measure the distance between two signatureswithout being affected by random phase shifts.

We intuitively understand that the proper difference asone involving a rotation of one link signature to align withthe other, prior to calculating a distance. Consider this in-tuitive difference given two complex temporal link signa-tures h and g. We represent this shift-removed differencewith a new φ2 difference. It is defined as ‖g − h‖φ2 =minφ∈(0,2π) ‖gejφ − h‖`2, where ‖·‖`2 indicates the Euclideandistance. Simplifying, we have:

‖g − h‖2φ2 = min

φ∈(0,2π)‖gejφ − h‖2

`2

= minφ∈(0,2π)

(gejφ − h)∗(gejφ − h)

= ‖g‖2 + ‖h‖2 − 2 maxφ∈(0,2π)

<(g∗ejφh)

= ‖g‖2 + ‖h‖2 − 2‖g∗h‖ (20)

where the function <() returns the real part of a complexnumber. This derivation shows that the φ2 difference, whichminimizes the random phase shift between two measure-

30

ments before calculating distance, can be efficiently and ex-plicitly calculated using simple vector operations.

4. FRAMEWORK FOR LOCATIONDISTINCTION

In this section, we outline a step-by-step decision and es-timation framework for using link signatures for locationdistinction. This framework is similar to the one used byPatwari et al in [11]. Different signatures and metrics in-troduced in the previous two sections can be fitted into thisframework for performance evaluation.

1. For a given transmitter i and a receiver j where i 6= j, ahistory of N −1 link signatures is measured and stored

as Hi,j = {h(n)i,j }N−1

n=1 .

2. The N th signature h(N) at j from an unknown trans-mitter in the neighborhood of j is then taken, and anevaluation criterion ei,j = sigEval(h(N),Hi,j) is com-puted. The function sigEval() uses different signaturemetrics to compare the N th measurement against thehistory. These metrics have been defined in the previ-ous two sections.

3. Next, ei,j is compared to a threshold γ. When ei,j sat-isfies certain conditional relationship with γ, the newsignature is determined to be from a different transmit-ter and a location change is detected. The conditionalrelationship is either greater than or less than, depend-ing on the evaluation metric in use. For the correlationmetrics, it is less than. For the distance metrics, it isgreater than.

4. When ei,j does not satisfy certain conditional relation-ship with γ, the new signature is determined to be

from the same transmitter, i.e. h(N) = h(N)i,j , and we

include it in Hi,j . For constant memory usage, theoldest measurement in Hi,j is then discarded. The al-gorithm returns to step 2 until enough measurementshave been collected.

5. For performance evaluation, we wish to find out theprobability of false alarm PFA and probability of de-tection PD of the different location distinction meth-ods. We first define the null and alternate hypotheses:H0 and H1.

H0 : ei,j = e(N)i,j

H1 : ei,j = ei−i′,j

where e(N)i,j is the difference between the N th mea-

surement of a link and the history of the same linkand ei−i′,j is the difference between the N th measure-ment of a link and the history of a different link. Wetreat ei,j as a random variable and denote its condi-tional density functions under the above two events asfei,j

(x|H0) and fei,j(x|H1). We calculate PFA and PD

as given in [5]:

PFA =

Z ∞

x=γ

fei,j(x|H0)dx

PD =

Z ∞

x=γ

fei,j(x|H1)dx

The above framework uses a single receiver. We can alsoextend it to a multi-receiver collaborative framework. Forthe multi-receiver case, we need to run the first step at eachreceiver, and calculate the mean ei,j in the second step. Be-cause we use similar multi-receiver framework as defined inour previous paper[11], we leave out details here for brevity.However, we will present the results from the multi-receivercollaborative framework in Section 5.

5. QUANTITATIVE COMPARISONS OFLINK SIGNATURES

In this section, we compare the performances of multi-ple tone probing, temporal channel impulse response, andthe complex temporal link signatures using a data set ofmeasured radio channels, obtained from CRAWDAD [10].These measurements of this data set are reported to havebeen recorded in an office environment among a set of 44different node locations. The data set contains five mea-surements of the channel for each pair of the 44 nodes. Thefirst four measurements are used in these evaluations to formthe channel history, while the fifth is used as a test measure-ment. In other words, N = 5 and the history is composed ofmeasurements n = 1, . . . , 4. We use the data set to comparelocation distinction both when a transmitter has actuallychanged its position, and when it has not. For the casewhen the transmitter has not moved, we test the fifth mea-surement on link (i, j) against the measurement history ofthis link. For the case when the transmitter has moved, weconsider all triplets (i, k, j) with i 6= k 6= j, where k is thenew transmitter location, and (i, j) is the original link. Foreach triple, the fifth measurement in the new link (k, j) iscompared with the history of the link (i, j). As describedin Section 4, we quantify the performance of each link sig-nature by computing the probability of detection and theprobability of false alarm. We use the receiver operatingcharacteristic (ROC) plot, that shows how the probabilityof detection varies with the probability of false alarm, todisplay the performance of each link signature.

5.1 Direct Measurement Evaluation5.1.1 Multiple Tone Performance

We first evaluate the performance of the multiple toneprobing method with both the original and the normalizedmetric using the measurement data set. When the corre-lation statistic is measured for a transmitter that has notchanged location compared the history (H0) it is referred toas an auto-correlation statistic. In contrast, when the cor-relation statistic is measured for a transmitter at a differentlocation (H1) it is referred to as a cross-correlation statistic.

The cross-correlation values of the original metric moti-vate our new metric. Using the original metric of (12), thesecross-correlation values are very high in magnitude, as highas 70. Comparatively, using the normalized metric in (17),the cross-correlation values are reliably below 1. This exper-imental result validates the discussion in Section 3.1.2 whichmotivated our normalized metric.

The ROC curves comparing the two metrics are shown inFigure 2. They show that without the normalized metric,the multiple tone method must accept a very high probabil-ity of false alarm in order to perform location distinction.Yet with the normalized metric, multiple tone probing per-forms well even at low probability of false alarm.

31

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 100.10.20.30.40.50.60.70.80.9

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

OriginalNormalized

Figure 2: ROC curves of comparing performance oforiginal and the normalized metrics in the multipletone probing method.

5.1.2 Comparison of Multiple Tone and TemporalLink Signatures

Next, in this section, we compare the temporal link sig-nature with the multiple tone probing link signature (usingthe normalized metric). Figure 3 shows the comparison re-sults. Both ROC curves of the temporal link signature andthe multiple tone signature are displayed. Since it is possi-ble to change the number of tones K used by the multipletone probing method, more than one multiple tone curve isdepicted, each with the K indicated. The result shows thegeneral improvement in the multiple tone probing methodas K increases.

The temporal link signature has better detection perfor-mance than the multiple tone probing method when K islow, but performs worse than the multiple tone probingwhen K = 25 and 50. The trend of Figure 3 suggests increas-ing tone numbers improves the performance of the multipletone signature. When the tone number increases from 3, 5,7, 10, 15, until 25, we see better and better ROC curves.There are, however, diminishing returns as K is increased.This situation is related to the coherence bandwidth, becausethe K tones are taken from a constant bandwidth. As Kincreases, the spacing between fκ decreases. When differenttones are not separated enough, the channel gains {H(fκ)}κ

will be correlated and thus including them in the signaturewill not provide as much distinction capability. The originalMultiple Tone Probing explicitly requires the tones to beseparated by an amount greater than the channel coherencebandwidth [6]. It also explains why the 25-tone signatureperforms almost as well as the 50-tone signature. The lat-ter signature may have tones too closely spaced that don’tactually improve performance.

5.1.3 Complex Temporal PerformanceNext, we evaluate the new complex temporal signature

method described in Section 3.2. Again, we compare theperformance of the three methods, multiple tone probing(with normalized metric), temporal link signature, and com-plex temporal link signature, using ROC curves. These ROCcurves are shown in Figure 4. In Figure 4(a), the curves lookvery close because the full range of both PFA and PD are

0 0.1 0.2 0.3 0.40.6

0.7

0.8

0.9

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

Tmpl CIR50 tone25 tone15 tone10 tone7 tone5 tone3 tone

Figure 3: Comparison of the temporal link signa-ture with the normalized multiple tone signaturesof various tone numbers

PFA points 0.04 0.06 0.08Temporal PD 0.8517 0.9066 0.928550-Tone PD 0.8888 0.9486 0.9651Complex PD 0.9467 0.9633 0.9744

Table 1: Compare detection rates of three best sig-natures under given false alarm rates

given. Figure 4(b) zooms in to the relevant low PFA andhigh PD regions, to provide more information.

To provide a specific quantitative comparison at someprospective operating points, we set particular values of thefalse alarm rate and show the possible detection performanceof the three methods in Table 1.

In comparison, the complex temporal link signature sig-nificantly outperforms both the multiple tone probing andtemporal link signature methods. The ‘missed detection’rate of the complex temporal link signature method, thatis, 1 − PD, is cut in third compared to the temporal linksignature method, and cut in about half compared to the50-tone probing method. The complex temporal link sig-nature performs especially well when false alarm rates arelow. As an exception, the multiple tone probing has a veryslightly higher detection rate, as barely seen in Figure 4(a),than the complex temporal link signature when the falsealarm rate becomes higher than 15%. It appears that cer-tain phase changes in the measurements cannot be detectedby the complex temporal link signature. This situation how-ever is very rare in our measurements and it does not occurwhen measurements from multiple receivers are used as de-scribed in the next subsection.

5.2 Multiple Receiver PerformanceIn both [4] and [11], the robustness of the location dis-

tinction methods is higher when multiple receivers are usedto jointly detect a change in transmitter location. We nowperform a similar evaluation of a multiple-receiver frame-work for both the improved multiple tone signature and thecomplex temporal signature.

For the multiple receiver framework, we consider all pos-sible combinations of transmitters and receivers. Let therebe n devices (n=44 in the experimental set up) and m re-

32

(a)

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

Temporal CIR50 toneComplex Temporal

(b)0 0.02 0.04 0.06 0.08 0.10.9

0.92

0.94

0.96

0.98

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

Temporal CIR50 toneComplex Temporal

Figure 4: Comparison of the complex temporal signature, temporal link signature, and multiple tone probingmethod with normalized metric, showing (a) ROC curves, and (b) zoom-in of ROC curves.

(a)

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

one receivertwo receiversthree receivers

(b)0 0.02 0.04 0.06 0.08 0.10.9

0.92

0.94

0.96

0.98

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

one receivertwo receiversthree receivers

Figure 5: The multiple receiver improvement of the normalized multiple tone signature. (a) ROC curve and(b) larger view of 0 ≤ PFA ≤ 0.1 and 0.9 ≤ PD ≤ 1.

(a)

0 0.2 0.4 0.6 0.8 10

0.2

0.4

0.6

0.8

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

one receivertwo receiversthree receivers

(b)0 0.02 0.04 0.06 0.08 0.10.9

0.92

0.94

0.96

0.98

1

Probability of False Alarm

Prob

abilit

y of

Det

ectio

n

one receivertwo receiversthree receivers

Figure 6: The multiple receiver improvement of the complex temporal signature. (a) ROC curve and (b)larger view of 0 ≤ PFA ≤ 0.1 and 0.9 ≤ PD ≤ 1.

33

ceivers in the joint detection setup (m=2, 3 in this set up).We choose m receivers out of n devices, choose one transmit-ter out of the n−m non-receivers, and one other transmitterout of the remaining n − m − 1 devices. There are a totalof (n

m)(n − m)(n − m − 1) possibilities. For these possi-ble transmitter/receiver setups, we calculate the false alarmprobability PFA and the detection probability PD.

5.2.1 Improved Multiple ToneThe ROC curves of the two-receiver and three-receiver al-

gorithms are generated for the improved multiple tone sig-nature. They are compared with the one-receiver curve inFigure 5. The overall ROC plot shows the improving trendof the performance from the one-receiver to the two-receiverand then to the three-receiver. The larger view shows thefirst improvement is bigger than the second improvement.

5.2.2 Complex TemporalNext, Figure 6 shows the changes in the performance of

the complex temporal signature due to the increased numberof receivers. The trend is that performance improves withthe number of receivers and the difference in improvementincrements are consistent with the previous figure. Whencomparing two figures, especially comparing the larger viewsof the two figures, it is clear that the complex temporal sig-nature outperforms the multiple tone probing method con-sistently in all cases.

6. TEMPORAL BEHAVIOR OF LINKSIGNATURES

So far, we have focused mostly on the spatial behavior ofthe wireless links. Due to external factors such as movementof people and that of objects, especially metallic objects, themultipath characteristics of a link can change with time.A link can thus be in different distinct states. A locationdistinction mechanism that does not consider the temporalchanges in link behavior can significantly increase the prob-ability of false alarms. In order to build a comprehensiveand accurate location distinction mechanism we must care-fully consider the changes in the temporal behavior of links.Unfortunately, the measurement data that we have used inthe previous sections [10] only contains a history of four sig-natures per link that were obtained in close time proximity.Motivated by the lack of data on the temporal behavior oflink signatures, we perform a measurement campaign to ob-tain new data and model the temporal behavior of wirelesslink signatures. We then integrate our model in our locationdistinction mechanism. In this section, we first describe ourmeasurement campaign. We measure the complex tempo-ral link signature only because, as shown in Section 5.1.3, itperforms the best among the three signatures we evaluatein this paper. Next, we develop a Markov model from themeasurement data. Last, we evaluate the performance ofour integrated location distinction mechanism.

6.1 Measurement CampaignWe measure the temporal behavior of wireless links in a

typical university building that houses department offices,research labs, classrooms, conference rooms, and other edu-cational facilities. We use a direct-sequence spread-spectrum(DS-SS) transmitter and receiver (Sigtek model ST-515) forour measurement campaign. The transmitter sends a DS-SS

signal, an unmodulated pseudo noise signal with a 40 MHzchip rate, a 1024 code-length, and a central frequency of 2443MHz. The receiver recovers channel responses and recordsresponse vectors comprising 600 complex temporal impulseresponses. Each impulse response is a vector of 100 complexnumbers. We choose four different transmitter/receiver lo-cation pairs for this campaign. In the first pair, the receiveris in a large research lab and the transmitter is located in anearby room (LOC B). Both rooms are adjacent to a hall-way. The same research lab holds the receiver in the secondpair, but the transmitter is instead placed in a small officethat is separated from the hallways by other rooms (LOCA). In the third pairs, the receiver is in a small research laband the transmitter is in a conference room (LOC C). Fi-nally, we have the transmitter and receiver placed on twodifferent floors (LOC D). The two locations are horizontallyclose but vertically separated by a combination of floor andceiling. Our choice of transmitter and receiver locations al-lows us to obtain data under varying conditions especiallyin terms of varying movement of objects.

6.2 Models

−2 −1 0 1 22x 104

−2

−1

0

1

22 x 104

Isomap 2D Embedding X Coordinate

Isom

ap 2

D Em

bedd

ing

Y Co

ordi

nate

Figure 7: Isomap 2D embedding coordinates for aset of link signatures over time.

Analysis of our measurement sets show that the link sig-natures measured on a link change over time, and that thesedifferent measurements appear to fall into different states.Within a small number of states, these link signatures arevery similar to each other, and each state produces notice-ably different link signatures.

In order to quantify the inter-state and intra-state dis-tances, we use non-linear dimensionality reduction1 to re-duce the 100 dimension vectors to just 1-2 dimensions. Inparticular, we apply the well-known Isomap algorithm ofTenenbaum et al [12] to the complex link signature mea-surements. As an example, we plot in Figure 7 a 2-D em-bedding of one set of 333 complex link signature measure-ments. The results clearly show three separate groups ofmeasured data2. We see that within each group, measured

1Non-linear dimensionality reduction is generally used instatistics to visualize high dimensional data.2Note that this is our only data set that contains threestates.

34

link signatures vary in a cyclical manner. In different groups,measured link signatures are noticeably different, and thusappear separately.

6.2.1 Markov modelWe model the groups of link signatures as a K-state Markov

chain where each group is considered to be a state of theMarkov chain. Then, we use the following procedure tocalculate the transition probabilities between states. Thisprocedure uses the 1-D embedding of the Isomap algorithm.Figure 8 shows the temporal behavior of the 1-D embeddingfor data set from LOC A. This figure indicates a strong peri-odic sinusoid-like temporal pattern. While the channel is indifferent states, the signal has different amplitudes. In fact,this signal is like an amplitude modulation (AM) signal, asinusoid which carries information as its amplitude.

0 1000 2000 3000−1.5

−1

−0.5

0

0.5

1

1.5x 106

Time Sequence

Isom

ap 1

D Em

bedd

ing

Valu

es

Figure 8: Isomap 1D embedding coordinates for aset of link signatures over time.

We use an AM demodulator to capture the envelope ofthe pattern. In the AM demodulator, the squared one-dimensional embedding signal is passed to a low-pass filterto track the ‘envelope’ or amplitude of the 1-D embeddingsignal. The envelope is shown in Figure 9 together with thesquared embedding values.

Figure 9 quantifies when the Markov chain switches be-tween states. Since there are two states (LOC A data set),we detect a transition when the envelope exceeds a thresh-old. Each time that it changes from below to above, or aboveto below the threshold, we have a state change. From thetotal number of state changes, and the number of times weare in a state, we calculate the state transition probabilitiesand the limiting probabilities of the Markov chain. For thefour measurement sets, one each from the four links (LOCA - LOC D), we list these probabilities in Table 23.

Given the Markov chain representation of the temporalbehavior of link signatures, we evaluate the following twodistinct types of false alarms.

1. Same-State False Alarm (SSFA): A link signature ismeasured in state i while there exists in the historysome other signatures of state i, however, the new mea-surement is far enough away from the measurements

3The measurement set used in Figure 7 did not have enoughmeasurements to determine the Markov chain parameters.

0 1000 2000 30000

1

2

3

4

5x 1011

Time Sequence

valu

es

0.5*(embedding)2envelopeenvelope mean

Figure 9: Squared 1D embedding coordinates andthe envelope

Location π1 π2 P12 P21

LOCA 0.5030 0.4970 0.0170 0.0168LOCB 0.8562 0.1438 0.0256 0.0043LOCC 0.5272 0.4728 0.0126 0.0113LOCD 0.5678 0.4322 0.0402 0.0306

Table 2: Probabilities of states and transitions atfour different locations.

in the history that they are detected as different, thusa false alarm is raised.

2. Different-State False Alarm(DSFA): A link signature ismeasured in state i, but no signature previously mea-sured in state i exists in the history. Because link sig-natures from states j 6= i are very different from thosemeasured in state i, this new measurement does notmatch any in the history, and a false alarm is raised.

As in Section 4, we store a finite history of links signaturesfor each link. Let N be the total buffer size for saving thishistory of link signatures of a link across all states. Everytime we record a new link signature, to place it in the his-tory, it must replace one of the existing measurements in thehistory. In this paper, we compare two buffer replacementpolicies:

• Policy 1 : The history has a first-in first-out (FIFO)replacement policy. The new measurement replacesthe oldest measurement in the history. Policy 1 is thepolicy that was considered by [11].

• Policy 2 : The history is subdivided into K separateFIFO buffers, one for each state in the Markov chain.When a new measurement is made, we estimate towhich state it belongs, and it replaces the oldest mea-surement within that state’s buffer.

Other replacement policies are also possible but we do notevaluate those in this paper. Here, we show how Policy 1and Policy 2 differ in the probability of a DSFA.

First, consider Policy 2. Assuming that each state’s bufferis initialized with some measurements from that state, when

35

a new link signature is measured from any of the K states,it cannot experience a DSFA. This is by definition, sincethe DFSA occurs only when in a state for which no pastlink signatures exist in the history. Since Policy 2 keepssome measurements from each of the K states, this will nothappen, as long as we have previously established the Kpossible states which the link may experience.

In contrast, consider Policy 1. Since the history does notdiscriminate between link signatures measured at differentstates, it is possible that FIFO buffer will not currently holdat least one measurement from each of the K states. In thiscase, if the Markov chain travels to a state without any mea-surements in the FIFO buffer, then the new measurementwill trigger a DSFA. In this section, we quantify the proba-bility of DFSA when using Policy 1. Because the probabilityof DFSA under Policy 2 is zero, this section quantifies theimprovement in the false alarm rate. This improvement, inPolicy 2, is achieved by making the replacement policy bet-ter matched to the physical model underlying the changesover time experienced by link signatures.

In this paper, we attempt to eliminate DSFAs by dividingthe single N -length FIFO into K FIFOs each with lengthN/K. While in state i, the receiver will insert measuredlink signatures into FIFO i. To calculate the probability ofDFSA using Policy 1, we note that the DFSA error occurswhen the Markov chain enters state i when all link signaturesin the history were to be measured outside of state i. Wethen use analysis of Markov chain models to calculate theprobability of DSFA, first for the case of a K = 2 stateMarkov chain, and then for the general K > 2 case.

6.2.2 Two-state Markov Chain Model

1 2

P21

P12

1-P12

1-P21

Figure 10: A 2-state Markov chain

For K = 2, we can exactly evaluate the probability ofDFSA in Policy 1. Figure 10 shows a two-state Markovchain and its transition probabilities. It can be seen thatthe probability of DSFA given that we are entering state 1is the probability that we started in state 2 N time unitsago, and that we stayed in state 2 for N consecutive timeunits. Conversely, the probability of DSFA given that we areentering state 2 is the probability that we started in state 1N time units ago, and stayed in state 1 for N consecutivetime units. This means that,

P [DSFA] = π2PN22P12 + π1P

N11P21 (21)

where π1 = P12/(P21 + P12), and π2 = P21/(P21 + P12).

6.2.3 K > 2 State Markov ChainsGenerally we can use Markov chain models to analyze the

probability of DSFA when using Policy 1. In particular, ifwe denote Xn to be the state at time n, then we define thetime to return to state i (commonly called the hitting time),

Ti = minn>0

{Xn = i|X0 = i}, (22)

that is, the first time n when we return to state i given thatwe were at state i at time 0. A standard Markov chain the-oretical result is that E[Ti] = 1/πi. We are interested inparticular about P [Ti > N ] – this is the probability uponreturn to state i that we will have a DSFA error. Whilethe exact probability is difficult to write in general, we cangenerally approximate it for large N . For this, we assumethat the tail of the probability mass function (pmf) of Ti isgeometric. (This is exact in the K = 2 case.) The comple-mentary CDF of a geometric pmf with mean 1/πi is

P [Ti > N ] = (1 − πi)N+1.

Thus the probability of a DSFA, using the law of total prob-ability, is

P [DSFA] =X

i

πiP [Ti > N ] ≈X

i

πi(1 − πi)N+1. (23)

6.3 ResultsUsing the link measurements described in Section 6.2, we

have used this Markov chain analysis to compute the prob-ability of DSFA as a function of the length N of the FIFO.We use the transition probabilities listed in Table 2, and cal-culate P [DSFA] from (21). The results are given in Figure11 for all four measured links. As we expect, the probabilityof DSFA decreases exponentially with the length of the his-tory. However, if either factor P22 = 1−P12 or P11 = 1−P21

is very close to 1, the rate of convergence is very slow. Inour measurements, these probabilities are in fact very closeto one. At N = 10, the probability of DSFA is in the rangeof 0.6% to 2.5%, which are very significant error rates. Evenwith a history length N = 100, the DSFA is in the range of0.11% to 0.36%. This high of a false alarm rate would likelybe unacceptable to a user.

20 40 60 80 1000

0.005

0.01

0.015

0.02

0.025

0.03

0.035

FIFO Size N

P[DS

FA]

LOCALOCBLOCCLOCD

Figure 11: The probability of different-state falsealarm (DSFA) for four different measured links.

By using Policy 2, as discussed above, we would see vir-tually no DSFA errors. The multiple FIFO buffers, eachmatched to a particular state, provide a reliable way to sig-nificantly reduce false alarms experienced by a location dis-tinction algorithm. The accuracy of the temporal modelis affected by the propagation environment. The measure-ments of this campaign are taken in an environment withmoderate dynamics. In buildings with more motion suchas shopping malls we expect more sophisticated models are

36

needed to obtain good distinction performance. We considerthe further investigation in temporal modeling as one of ourfuture works.

7. RELATED WORKThere has been a vast amount of research on localization

or location estimation (e.g., [2, 9, 15, 14]). Unlike localiza-tion or location estimation, the objective of location distinc-tion is only to distinguish one link signature from another,and not to map the signature to a particular physical co-ordinate. Localization techniques such as time of arrival(TOA), time difference of arrival (TDOA), and angle of ar-rival (AOA) may not be effective or efficient at discriminat-ing locations. For instance, a TOA based localization canhave the following two shortcomings. First, the transmittermay not be suitably synchronized with the receiver. Sec-ond, when only one receiver is employed the TOA basedlocalization cannot uniquely determine the location of thetransmitter. Location distinction schemes, such as ours, canalleviate or completely avoid these problems.

Faria et al [4] proposed using RSS-based signalprints toprevent impersonation in wireless local area networks. Al-though this method uses the RSS measure that is readilyavailable in commodity wireless cards, it fails to capture therich multipath characteristics of wireless channels. Patwariet al [11] proposed the use of temporal channel impulse re-sponse, that captures the multipath characteristics of wire-less channels, as a link signature for location distinction. Liet al [6] proposed the use of complex channel gains by multi-tonal probes, that also captures multipath effects, for secur-ing wireless systems. Our work enhances the existing workon location distinction using link signatures in the followingsignificant ways. First, we compare the two multipath-basedscheme both qualitatively and quantitatively. No such com-parison has been made in the existing work. Second, weenhance the Li [6] method with a new metric. Third, wedevelop a new link signature based on the strengths of thetwo multipath-based schemes. We also, very importantly,measure and develop a Markov chain model for the tempo-ral behavior of link signatures and integrate this model inour location distinction mechanism.

There is a growing interest in exploiting physical charac-teristics of wireless channels for network security (e.g., [1,7]). Although security is one application area in which ourlink signature measurements and location distinction mech-anisms can be applied, the contributions of this paper aremore general than addressing a specific security threat. Theapplication of our location distinction methodology to spe-cific security scenarios will be an interesting enhancement ofour research.

8. CONCLUSIONSIn this paper, we compared two existing multipath-based

location distinction methods. We also improved the multi-ple tone probing method. We then used the strengths of thetwo existing methods to develop a new link signature. Ourextensive measurement results showed that the new link sig-nature consistently outperforms the existing signatures evenafter the existing signatures are enhanced with our proposedimprovements. We performed a measurement campaign tounderstand and model the temporal behavior of link signa-tures. We integrated our model in our location distinction

mechanism to reduce the probability of false alarms. In thefuture, we plan to apply our methodology to more data sets.We also propose to build our methodology on the GNU ra-dio platform. We believe that link signatures will continueto evolve especially with the development of SDR [8, 3, 13],ultra-wideband, and other new wireless technologies.

9. REFERENCES[1] B. Azimi-Sadjadi, A. Kiayias, A. Mercado, and

B. Yener. Robust key generation from signal envelopesin wireless networks. In CCS ’07: Proceedings of the14th ACM conference on Computer andcommunications security, pages 401–410, New York,NY, USA, 2007. ACM.

[2] P. Bahl and V. N. Padmanabhan. RADAR: anin-building RF-based user location and trackingsystem. In IEEE INFOCOM 2000, pages 775–784,2000.

[3] V. Bose, M. Ismert, M. Wellborn, and J. Guttag.Virtual radios. IEEE JSAC, 17(4):591–602, April 1999.

[4] D. B. Faria and D. R. Cheriton. Radio-layer security:Detecting identity-based attacks in wireless networksusing signalprints. In Proc. 5th ACM Workshop onWireless Security (WiSe’06), pages 43–52, Sept. 2006.

[5] S. M. Kay. Fundamentals of Statistical SignalProcessing. Prentice Hall, New Jersey, 1993.

[6] Z. Li, W. Xu, R. Miller, and W. Trappe. Securingwireless systems via lower layer enforcements. InProc. 5th ACM Workshop on Wireless Security(WiSe’06), pages 33–42, Sept. 2006.

[7] M. G. Madiseh, M. L. McGuire, S. W. Neville, andA. A. B. Shirazi. Secret key extraction in ultrawideband channels for unsynchronized radios. In 6thAnnual Conference on Communication Networks andServices Research (CNSR2008), May 2008.

[8] J. Mitola. The software radio architectuer. IEEECommunications Magzine, 33(5):26–38, May 1995.

[9] L. M. Ni, Y. Liu, Y. C. Lau, and A. P. Patil.Landmarc: indoor location sensing using active rfid.Wirel. Netw., 10(6):701–710, 2004.

[10] N. Patwari and S. K. Kasera. CRAWDAD utah CIRmeasurements.http://crawdad.cs.dartmouth.edu/meta.php?name=utah/CIR.

[11] N. Patwari and S. K. Kasera. Robust locationdistinction using temporal link signatures. In ACMIntl. Conf. on Mobile Computing Networking(Mobicom’07), Sept. 2007.

[12] J. B. Tenenbaum, V. de Silva, and J. C. Langford. Aglobal geometric framework for nonlineardimensionality reduction. Science, 290:2319–2323, Dec2000.

[13] D. L. Tennenhouse and V. G. Bose. Asoftware-oriented approach to wireless signalprocessing. In Mobile Computing and Networking,pages 37–47, 1995.

[14] K. Whitehouse, C. Karlof, and D. Culler. A practicalevaluation of radio signal strength for ranging-basedlocalization. SIGMOBILE Mob. Comput. Commun.Rev., 11(1):41–52, 2007.

[15] K. Yao and F. Lorenzelli. Localization in sensornetworks. ST Journal of Research, 4(1):80–96, 2007.

37