GyrosFinger: Fingerprinting Drones for Location Tracking Based on the Outputs of MEMS Gyroscopes

Drones are widely used for various purposes such as delivery, aerial photography, and surveillance. Considering the increasing drone-related services, tracking the locations of drones can cause security threats such as escaping from drone surveillance, disturbing drone-related services, and capturing drones. For wirelessly monitoring the status of drones, telemetry is used, and this status information contains various data such as latitude and longitude, calibrated sensor outputs, and sensor offsets. Because most of the telemetry implementation supports neither authentication nor encryption, an attacker can obtain the status information of the drones by using an appropriate wireless communication device such as software-defined radio. While the attacker knows the locations of the drones from the status information, this information is not sufficient for tracking drones because the status information does not include any identity information that can bind the identity of the drone with its location. In this article, we propose a fingerprinting method for drones in motion for the binding of the identity of the drone with its location. Our fingerprinting method is based on the sensor outputs included in the status information, i.e., the offsets of micro-electro mechanical systems (MEMS) gyroscope, an essential sensor for maintaining the attitude of drones. We found that the offsets of MEMS gyroscopes are different from each other because of manufacturing mismatches, and the offsets of five drones obtained through their telemetry are distinguishable and constant during their flights. To evaluate the performance of our fingerprinting method on a larger scale, we collected the offsets from 70 stand-alone MEMS gyroscopes to generate fingerprints. Our experimental results show that, when using the offsets of three and two axes calculated from 128 samples of the raw outputs per axis as fingerprints, the F-scores of the proposed method reach 98.78% and 94.47%, respectively. The offsets collected after a month are also fingerprinted with F-scores of 96.58% and 78.45% under the same condition, respectively. The proposed fingerprinting method is effective, robust, and persistent. Additionally, unless the MEMS gyroscope is not replaced, our fingerprinting method can be used for drone tracking even when the target drones are flying.

[1]  Gabi Nakibly,et al.  Gyrophone: Recognizing Speech from Gyroscope Signals , 2014, USENIX Security Symposium.

[2]  Akhilesh Tyagi,et al.  Characterizing Composite User-Device Touchscreen Physical Unclonable Functions (PUFs) for Mobile Device Authentication , 2015, TrustED@CCS.

[3]  Chrisil Arackaparambil,et al.  On the reliability of wireless fingerprinting using clock skews , 2010, WiSec '10.

[4]  He Wang,et al.  MoLe: Motion Leaks through Smartwatch Sensors , 2015, MobiCom.

[5]  Patrick Traynor,et al.  (sp)iPhone: decoding vibrations from nearby keyboards using mobile phone accelerometers , 2011, CCS '11.

[6]  Jorge Guajardo,et al.  MEMS Gyroscopes as Physical Unclonable Functions , 2016, CCS.

[7]  Adam J. Aviv,et al.  Practicality of accelerometer side channels on smartphones , 2012, ACSAC '12.

[8]  Nikita Borisov,et al.  Tracking Mobile Web Users Through Motion Sensors: Attacks and Defenses , 2016, NDSS.

[9]  Hao Chen,et al.  TouchLogger: Inferring Keystrokes on Touch Screen from Smartphone Motion , 2011, HotSec.

[10]  Parimal Hemchandra Kopardekar.  Safely Enabling Low-Altitude Airspace Operations: Unmanned Aerial System Traffic Management (UTM) , 2015 .

[11]  Dina Hadziosmanovic,et al.  On the Feasibility of Device Fingerprinting in Industrial Control Systems , 2013, CRITIS.

[12]  Jana Dittmann,et al.  AR.Drone: security threat analysis and exemplary attack to track persons , 2012, Electronic Imaging.

[13]  Gabi Nakibly,et al.  Mobile Device Identification via Sensor Fingerprinting , 2014, ArXiv.

[14]  Sharon Lozano.  First Steps Toward Drone Traffic Management , 2015 .

[15]  Triet Vo Huu,et al.  Inferring User Routes and Locations Using Zero-Permission Mobile Sensors , 2016, 2016 IEEE Symposium on Security and Privacy (SP).

[16]  Ramesh Karri,et al.  Sensor physical unclonable functions , 2010, 2010 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST).

[17]  Guevara Noubir,et al.  Single-stroke language-agnostic keylogging using stereo-microphones and domain specific machine learning , 2014, WiSec '14.

[18]  Xiang-Yang Li,et al.  Wireless Device Authentication Using Acoustic Hardware Fingerprints , 2015, BigCom.

[19]  Joseph A Marty.  Vulnerability Analysis of the MAVLink Protocol for Command and Control of Unmanned Aircraft , 2013 .

[20]  Hao Chen,et al.  On the Practicality of Motion Based Keystroke Inference Attack , 2012, TRUST.

[21]  Romit Roy Choudhury,et al.  Tapprints: your finger taps have fingerprints , 2012, MobiSys '12.

[22]  Ross J. Anderson,et al.  PIN skimmer: inferring PINs through the camera and microphone , 2013, SPSM '13.

[23]  Wenyuan Xu,et al.  AccelPrint: Imperfections of Accelerometers Make Smartphones Trackable , 2014, NDSS.

[24]  Tamal Mukherjee,et al.  Simulation of Manufacturing Variations in a Z-axis CMOS-MEMS Gyroscope , 2002 .

[25]  Feng Hao,et al.  Stealing PINs via mobile sensors: actual risk versus user perception , 2016, International Journal of Information Security.

[26]  Mani B. Srivastava,et al.  From Pressure to Path: Barometer-based Vehicle Tracking , 2015, BuildSys@SenSys.

[27]  Zhi Xu,et al.  TapLogger: inferring user inputs on smartphone touchscreens using on-board motion sensors , 2012, WISEC '12.

[28]  Raphael Spreitzer,et al.  PIN Skimming: Exploiting the Ambient-Light Sensor in Mobile Devices , 2014, SPSM@CCS.

[29]  Jun Han,et al.  ACComplice: Location inference using accelerometers on smartphones , 2012, 2012 Fourth International Conference on Communication Systems and Networks (COMSNETS 2012).

[30]  Feng Hao,et al.  TouchSignatures: Identification of user touch actions and PINs based on mobile sensor data via JavaScript , 2016, J. Inf. Secur. Appl..

[31]  Jun Han,et al.  ACCessory: password inference using accelerometers on smartphones , 2012, HotMobile '12.

[32]  Mani Mina,et al.  Device Identification via Analog Signal Fingerprinting: A Matched Filter Approach , 2006, NDSS.

[33]  A. Mawardi,et al.  Design of microresonators under uncertainty , 2005, Journal of Microelectromechanical Systems.

[34]  Nikita Borisov,et al.  Do You Hear What I Hear?: Fingerprinting Smart Devices Through Embedded Acoustic Components , 2014, CCS.

[35]  Xiangyu Liu,et al.  Acoustic Fingerprinting Revisited: Generate Stable Device ID Stealthily with Inaudible Sound , 2014, CCS.