# Mobile Device Passive Localization Based on IEEE 802.11 Probe Request Frames

Authors: Lin Sun; Sinong Chen; Zengwei Zheng; Longyang Xu
Journal: Mobile Information Systems
 (2017)

---

## Abstract

This paper presents a novel passive mobile device localization mode based on IEEE 802.11 Probe Request frames. In this approach, the listener can discover mobile devices by receiving the Probe Request frames and localize them on his walking path. The unique location of the mobile device is estimated on a geometric diagram and right-angled walking path. In model equations, site-related parameter, that is, path loss exponent, is eliminated to make the approach site-independent. To implement unique localization, the right-angled walking path is designed and the optimal location is estimated from the optional points. The performance of our method has been evaluated inside the room, outside the room, and in outdoor scenarios. Three kinds of walking paths, for example, horizontal, vertical, and slanted, are also tested.


---

## Body

## 1. Introduction

Wi-Fi is a major component for communication in mobile devices, for example, phone and tablet. Researchers take advantage of Wi-Fi signal to build indoor localization system [1, 2], life pattern analysis [3], human activity recognition [4], and so on. In indoor localization system, a mobile app has been installed in a mobile phone, reads Wi-Fi RSSI value from Wi-Fi APs, sends RSSI fingerprint, and queries location from the RSSI fingerprint database. The user himself can know his accurate position inside a building, as shown in Figure 1. This kind of localization mode is calledactive. In this paper, we present a novelpassive mobile device localization mode based on IEEE 802.11 Probe Request frames without Wi-Fi APs and reference points. The listener can discover the mobile device by receiving the Probe Request frames and localize the position of the mobile device. The listener only equipped with his mobile can secretly know where another mobile holder is, as shown in Figure 2. He can also infer the MAC address of the holder’s mobile device or look for the mobile holder with a specific MAC address. This kind of passive localization is a great challenge because there are no reference points or radio map deployed in advance. Another problem is that path loss exponent, which is an important parameter in radio propagation model, varies with different environments.Figure 1
Active Wi-Fi fingerprint localization mode.Figure 2
Mobile device passive localization mode.


## 2. Related Work

There are two basic modes in WLAN localization problems. One is to know where I am and the other is to know where you are. The former is calledactive and the latter is calledpassive [5].Active localization methods are always fingerprint-based and nonfingerprint-based. In fingerprint-based localization [2, 6], Wi-Fi APs should be deployed in advance and a fingerprint database is created to store signal feature values at each spatial coordinate. Nonfingerprint-based solutions use geometric properties of triangles to estimate the target location without development of a radio map [7]. Common metrics include received signal strength (RSS) [1], time difference of arrival (TDOA) [8], time of arrival (TOA) [9], and angle of arrival (AOA) [10]. Signals from two or three reference points must be made available to these metrics. The advantage of signal strength is that it is easy to implement; however, the parameters in radio model are site-specific. For example, it was needed to estimate path loss exponent (PLE) and other factors from the training data by regression model [1]. Time and angle of an arrival signal would suffer from multipath effect and line-of-sight (LOS) paths between the transmitter and receiver are usually obstructed by walls in indoor environments.In passive mode, Youssef et al. [11, 12] presented a device-free passive (DfP) localization method. The concept relied on the fact that RF signals were affected by changes in the environment. The monitoring stations continuously recorded signal strength or time-of-flight, which were used to construct a radio map to present the signal changes with entities movement and their locations. Like fingerprint-based localization, this method needs Wi-Fi AP and has to build a radio map in advance. Another technology is Radio Tomographic Imaging (RTI). Wilson and Patwari [13] presented a linear model for using RSS measurements to obtain images of moving objects in wireless networks.Radar-based techniques also do not require the tracked entity to carry an electronic device. Ultra-wideband (UWB) radar systems provided through-wall imaging methods [14, 15] to detect human activity [16] and track walking [17]. These systems are accurate, but very complex. Lin and Ling [18] demonstrated an alternate development of a Doppler radar with two-element receiving array for tracking human movements in indoor surveillance applications. Multiple-input multiple-output (MIMO) radar is another emerging field that takes advantage of multiple transmitters and receivers to locate objects within a spatial area [19].Table1 shows the comparison of different localization methods based on radio signal in the requirements of AP or wireless node, reference point, PLE estimation, radio map, and special hardware.Table 1
Comparison of different localization methods based on radio signal.
AP or wireless node
Reference point
PLE estimation
Radio map
Special hardware
Fingerprint
√
×
×
√
×
RSS [1]
√
×
√
×
×
TDOA [8], TOA [9], AOA [10]
×
√
×
×
√
DfP [11, 12], RTI [13]
√
×
×
√
×
Radar-based [14–19]
×
×
×
√
√
Our method
×
×
×
×
×Some researches passively monitored Wi-Fi Probe Request frame to study the device owners. Scheuner et al. [20] developed a passive Wi-Fi tracking system Probe. It processed and visualized Wi-Fi traces and supported online analysis. The cases of room utilization, person tracking, and device statistics were demonstrated. Cunche et al. [21] exploited Wi-Fi fingerprints to infer social links between devices owners.


## 3. Passive Mobile Device Localization Mode

### 3.1. Probe Request Frame Review

In Wi-Fi technology, a mobile station periodically sends Probe Request frames to discover existing 802.11 networks within its proximity. The Probe Request is sent from the mobile station to the destination layer-2 address ff:ff:ff:ff:ff:ff. The listener with a Wi-Fi network card, which supports monitor mode, can capture the Probe Request frames [22].Another piece of information required in our approach is received signal strength indication (RSSI), which can be found in radiotap header. Figure3 shows the example of a 802.11g radiotap header and Probe Request frame header received from a Xiaomi mobile phone by Wireshark, a network protocol analyzer. “SSI signal” represents RSSI in Wireshark.Figure 3
Example of a 802.11 radiotap header and Probe Request frame header.


### 3.2. Position Estimation

Log-distance path loss model [23] is a radio propagation model that predicates the path loss in indoor or indoor-to-outdoor environments, written as follows:(1)10nlg⁡dd0=P-P0,where d is the length of the path from the transmitter to the receiver and d0 is the reference distance (for example, d0=1 meter).P
=
P
T
X
-
P
R
X is path loss of distance d, where PTX is the transmitted power in dBm and PRX is the received power in dBm. n is path loss exponent, which is a measure of the influence of obstacles like partitions, walls, and doors.Letd0=1 and PTX be equal in path loss measurements; we get(2)lg⁡d=110nPRX1-PRX,where PRX1 stands for a RSSI value in radiotap header received by the passive listener, which is 1 meter from the mobile device.Figure4 shows geometric diagram of passive position estimation. The listener walks from point A to point B and then point C. RA, RB, and RC are RSSI values received on points A, B, and C, respectively. dAW, dBW, and dCW are the distances between points A, B, and C and Wi-Fi device W, respectively. According to (2), we can write(3)lg⁡dAW=110nPRX1-RA(4)lg⁡dBW=110nPRX1-RB(5)lg⁡dCW=110nPRX1-RC.n is eliminated by dividing (3) by (4) and let(6)k1=PRX1-RAPRX1-RB;then we get(7)lg⁡dAW=k1lg⁡dBW.Similarly, we divide (4) by (5) and let(8)k2=PRX1-RCPRX1-RB;we get(9)lg⁡dCW=k2lg⁡dBW.Using the Law of Cosines in a triangle, dAB, dBC, dAC, dAW, dBW, dCW, α, and β in Figure 4 should satisfy the following equations:(10)dAB2=dAW2+dBW2-2dAWdBWcos⁡αdBC2=dBW2+dCW2-2dBWdCWcos⁡βdAC2=dAW2+dCW2-2dAWdCWcos⁡α+β.dAW and dCW can be replaced by dBW using (7) and (9); (10) become(11)dBW2k1+dBW2-2dBWk1+1cos⁡α-dAB2=0dBW2k2+dBW2-2dBWk2+1cos⁡β-dBC2=0dBW2k1+dBW2k2-2dBWk1+k2cos⁡α+β-dAC2=0.In (11), k1 and k2 are known. dAB, dBC, and dAC are walking distances. dBW, α, and β are three unknown variables needed to be solved. These nonlinear equations can be solved by Newton’s method with Jacobian matrix [24, 25]. Newton’s method will converge while the initial guess is sufficiently close to the solution [26]. Fortunately, we can know where the solution lies. The initial guess of dBW can be estimated by (2) assuming n=3.5 since 2<n<6 [27], and α,β start at π/4 because 0<α,β<π/2.Figure 4
Geometric diagram of passive position estimation.


### 3.3. Least-Squares Estimation for Four Points in Walking Path

Four-point walking path(A→B→C→D) is also addressed in this section. The log-distance equation in D and triangle equations can be written as follows:(12)lg⁡dDW=110nPRX1-RD,and the Law of Cosines in ΔCWD and ΔBWD, shown in Figure 4, is also added to (10),(13)dAB2=dAW2+dBW2-2dAWdBWcos⁡αdBC2=dBW2+dCW2-2dBWdCWcos⁡βdAC2=dAW2+dCW2-2dAWdCWcos⁡α+βdCD2=dCW2+dDW2-2dCWdDWcos⁡γdBD2=dBW2+dDW2-2dBWdDWcos⁡β+γ.Let k3=PRX1-RD/PRX1-RB and replacing dDW by lg⁡dDW=k3lg⁡dBW in (13), we get(14)dBW2k1+dBW2-2dBWk1+1cos⁡α-dAB2=0dBW2k2+dBW2-2dBWk2+1cos⁡β-dBC2=0dBW2k1+dBW2k2-2dBWk1+k2cos⁡α+β-dAC2=0dBW2k2+dBW2k3-2dBWk1+k3cos⁡γ-dCD2=0dBW2+dBW2k3-2dBWk3+1cos⁡β+γ-dBD2=0.In (14), there are five equations and four unknown variables, dBW, α, β, and γ. Least-squares minimization of the residual of a set of nonlinear equations is solved by Levenberg-Marquardt method. Moré [28] presented a version of the Levenberg-Marquardt algorithm, implemented in MINPACK [29], with strong convergence properties. Also, the good initial guess yields the desired result.


### 3.4. Uniqueness of Localization

The mobile deviceW has two optional points, which are symmetric with respect to the walking path. Here we present a method to select unique location from the candidates. The scheme is to turn a corner in walking path, for example, A→C→E in Figure 5. A→C will give two candidates of the location {a,a′} and C→E will also give other two candidates of the location {b,b′}. Assume a and b are on the side of the ground truth, shown in Figure 5, the distance between a and b is shorter than other combinations,that is, {a,b′}, {a′,b}, and {a′,b′}. So we define optimal location estimation {u,v} where distance is the minimum between {a,a′} and {b,b′},(15)arg⁡minuϵa,a′,vϵb,b′du,ν.The center point between u and ν,that is, (u+v)/2, is considered as the unique location of the mobile device. In experiments, we will give the results of unique localization in detail.Figure 5
Unique localization on right-angled path.


## 3.1. Probe Request Frame Review

In Wi-Fi technology, a mobile station periodically sends Probe Request frames to discover existing 802.11 networks within its proximity. The Probe Request is sent from the mobile station to the destination layer-2 address ff:ff:ff:ff:ff:ff. The listener with a Wi-Fi network card, which supports monitor mode, can capture the Probe Request frames [22].Another piece of information required in our approach is received signal strength indication (RSSI), which can be found in radiotap header. Figure3 shows the example of a 802.11g radiotap header and Probe Request frame header received from a Xiaomi mobile phone by Wireshark, a network protocol analyzer. “SSI signal” represents RSSI in Wireshark.Figure 3
Example of a 802.11 radiotap header and Probe Request frame header.


## 3.2. Position Estimation

Log-distance path loss model [23] is a radio propagation model that predicates the path loss in indoor or indoor-to-outdoor environments, written as follows:(1)10nlg⁡dd0=P-P0,where d is the length of the path from the transmitter to the receiver and d0 is the reference distance (for example, d0=1 meter).P
=
P
T
X
-
P
R
X is path loss of distance d, where PTX is the transmitted power in dBm and PRX is the received power in dBm. n is path loss exponent, which is a measure of the influence of obstacles like partitions, walls, and doors.Letd0=1 and PTX be equal in path loss measurements; we get(2)lg⁡d=110nPRX1-PRX,where PRX1 stands for a RSSI value in radiotap header received by the passive listener, which is 1 meter from the mobile device.Figure4 shows geometric diagram of passive position estimation. The listener walks from point A to point B and then point C. RA, RB, and RC are RSSI values received on points A, B, and C, respectively. dAW, dBW, and dCW are the distances between points A, B, and C and Wi-Fi device W, respectively. According to (2), we can write(3)lg⁡dAW=110nPRX1-RA(4)lg⁡dBW=110nPRX1-RB(5)lg⁡dCW=110nPRX1-RC.n is eliminated by dividing (3) by (4) and let(6)k1=PRX1-RAPRX1-RB;then we get(7)lg⁡dAW=k1lg⁡dBW.Similarly, we divide (4) by (5) and let(8)k2=PRX1-RCPRX1-RB;we get(9)lg⁡dCW=k2lg⁡dBW.Using the Law of Cosines in a triangle, dAB, dBC, dAC, dAW, dBW, dCW, α, and β in Figure 4 should satisfy the following equations:(10)dAB2=dAW2+dBW2-2dAWdBWcos⁡αdBC2=dBW2+dCW2-2dBWdCWcos⁡βdAC2=dAW2+dCW2-2dAWdCWcos⁡α+β.dAW and dCW can be replaced by dBW using (7) and (9); (10) become(11)dBW2k1+dBW2-2dBWk1+1cos⁡α-dAB2=0dBW2k2+dBW2-2dBWk2+1cos⁡β-dBC2=0dBW2k1+dBW2k2-2dBWk1+k2cos⁡α+β-dAC2=0.In (11), k1 and k2 are known. dAB, dBC, and dAC are walking distances. dBW, α, and β are three unknown variables needed to be solved. These nonlinear equations can be solved by Newton’s method with Jacobian matrix [24, 25]. Newton’s method will converge while the initial guess is sufficiently close to the solution [26]. Fortunately, we can know where the solution lies. The initial guess of dBW can be estimated by (2) assuming n=3.5 since 2<n<6 [27], and α,β start at π/4 because 0<α,β<π/2.Figure 4
Geometric diagram of passive position estimation.


## 3.3. Least-Squares Estimation for Four Points in Walking Path

Four-point walking path(A→B→C→D) is also addressed in this section. The log-distance equation in D and triangle equations can be written as follows:(12)lg⁡dDW=110nPRX1-RD,and the Law of Cosines in ΔCWD and ΔBWD, shown in Figure 4, is also added to (10),(13)dAB2=dAW2+dBW2-2dAWdBWcos⁡αdBC2=dBW2+dCW2-2dBWdCWcos⁡βdAC2=dAW2+dCW2-2dAWdCWcos⁡α+βdCD2=dCW2+dDW2-2dCWdDWcos⁡γdBD2=dBW2+dDW2-2dBWdDWcos⁡β+γ.Let k3=PRX1-RD/PRX1-RB and replacing dDW by lg⁡dDW=k3lg⁡dBW in (13), we get(14)dBW2k1+dBW2-2dBWk1+1cos⁡α-dAB2=0dBW2k2+dBW2-2dBWk2+1cos⁡β-dBC2=0dBW2k1+dBW2k2-2dBWk1+k2cos⁡α+β-dAC2=0dBW2k2+dBW2k3-2dBWk1+k3cos⁡γ-dCD2=0dBW2+dBW2k3-2dBWk3+1cos⁡β+γ-dBD2=0.In (14), there are five equations and four unknown variables, dBW, α, β, and γ. Least-squares minimization of the residual of a set of nonlinear equations is solved by Levenberg-Marquardt method. Moré [28] presented a version of the Levenberg-Marquardt algorithm, implemented in MINPACK [29], with strong convergence properties. Also, the good initial guess yields the desired result.


## 3.4. Uniqueness of Localization

The mobile deviceW has two optional points, which are symmetric with respect to the walking path. Here we present a method to select unique location from the candidates. The scheme is to turn a corner in walking path, for example, A→C→E in Figure 5. A→C will give two candidates of the location {a,a′} and C→E will also give other two candidates of the location {b,b′}. Assume a and b are on the side of the ground truth, shown in Figure 5, the distance between a and b is shorter than other combinations,that is, {a,b′}, {a′,b}, and {a′,b′}. So we define optimal location estimation {u,v} where distance is the minimum between {a,a′} and {b,b′},(15)arg⁡minuϵa,a′,vϵb,b′du,ν.The center point between u and ν,that is, (u+v)/2, is considered as the unique location of the mobile device. In experiments, we will give the results of unique localization in detail.Figure 5
Unique localization on right-angled path.


## 4. Experiments

### 4.1. Settings

To evaluate our passive localization approach, three types of scenarios are designed:(i)
Inside the room (Figure6): this is near distance situation tested in the room.(ii)
Outside the room (Figure7): this is dividing-wall situation when the listener is outside the room.(iii)
Outdoor (Figure8): this is middle distance situation tested in the square.Figure 6
Inside the room experimental setting.Figure 7
Outside the room experimental setting.Figure 8
Outdoor experimental setting.In Figures6, 7, and 8, the letters a–c are the placements of mobile devices and numbers 1–12 are the points in the walking path of the listener. There are three kinds of walking paths, horizontal, vertical, and slanted. Table 2 shows the details.Table 2
Listener’s walking paths.
Inside the room
Outside the room
Outdoor
Horizontal
1
→
2
→
3
1
→
2
→
3
→
4
1
→
2
→
3
4
→
5
→
6
5
→
6
→
7
→
8
4
→
5
→
6
7
→
8
→
9
9
→
10
→
11
→
12
7
→
8
→
9
Vertical
7
→
4
→
1
9
→
5
→
1
7
→
4
→
1
8
→
5
→
2
10
→
6
→
2
8
→
5
→
2
9
→
6
→
3
11
→
7
→
3
9
→
6
→
3
12
→
8
→
4
Slanted
7
→
5
→
3
9
→
6
→
3
7
→
5
→
3
9
→
5
→
1
11
→
6
→
1
9
→
5
→
1
10
→
7
→
4
12
→
7
→
2Examples of the listeners include the devices based on Nokia Maemo, Android, or MAC OS. Here a MacBook is used as the listener. Three mobile devices, for example, iPad2, Nexus7, and Xiaomi Note2, are used to be discovered and passively localized. The RSSI value on each point of the path is the average of several Probe Request frames.


### 4.2. Position Evaluation Results

To evaluate passive positioning performance, the bias rateB is defined as follows:(16)B=de-dgdg,where de is estimated distances, for example, dAW, dBW, and dCW, which have been calculated in (10). dg is the ground truth for the distances dAW, dBW, and dCW.We evaluate 222 samples including 72 inside the room, 126 outside the room, and 24 outdoor in the experiment. Tables3, 4, and 5 show the average bias rate B of distances dAW, dBW, and dCW in different scenarios and walking paths. The three-point paths 1→2→3∥1→2→4∥1→3→4∥2→3→4 have been selected from 1→2→3→4 in outside the room setting and so on. From the results, there is no walking path which is obviously better than others among horizontal, vertical, and slanted paths. Fortunately, the result of outside the room is not worse than those of inside the room and outdoor, although the listener and the mobile device are obstructed by wall.Table 3
Comparison ofB inside the room.
Apple iPad2
Google Nexus7
Xiaomi Note2
Horizontal
d
A
W
24.0%
25.1%
34.2%
d
B
W
21.3%
24.3%
24.9%
d
C
W
22.8%
27.7%
19.7%
Vertical
d
A
W
27.7%
30.7%
35.1%
d
B
W
24.1%
20.5%
31.0%
d
C
W
18.2%
17.9%
33.2%
Slanted
d
A
W
20.5%
23.8%
26.2%
d
B
W
20.7%
23.7%
24.2%
d
C
W
20.0%
27.5%
22.1%Table 4
Comparison ofB outside the room.
Apple iPad2
Google Nexus7
Xiaomi Note2
Horizontal
d
A
W
21.6%
24.2%
15.4%
d
B
W
28.2%
24.5%
22.4%
d
C
W
24.8%
21.3%
21.6%
Vertical
d
A
W
26.2%
27.7%
21.1%
d
B
W
31.5%
21.2%
27.0%
d
C
W
19.2%
14.6%
26.2%
Slanted
d
A
W
19.5%
20.8%
28.1%
d
B
W
28.7%
24.6%
20.2%
d
C
W
21.4%
18.1%
25.1%Table 5
Comparison ofB in outdoor.
Apple iPad2
Google Nexus7
XiaomiNote2
Horizontal
d
A
W
17.1%
22.4%
23.8%
d
B
W
19.3%
39.2%
33.6%
d
C
W
12.3%
27.5%
21.9%
Vertical
d
A
W
29.2%
24.2%
22.4%
d
B
W
23.0%
15.7%
21.3%
d
C
W
11.6%
31.1%
23.0%
Slanted
d
A
W
25.1%
28.3%
14.3%
d
B
W
31.3%
34.2%
17.8%
d
C
W
24.4%
17.4%
15.6%We have also computed the biasδ between the estimated location point W′ and the ground truth point W, shown in Figure 4. Figure 9 shows the cumulative distribution (CDF) of localization error. 75% errors are less than 2 meters inside the room, 4 meters outside the room, and outdoor. Figure 10 shows localization error in three walking styles including 72 horizontal, 90 vertical, and 60 slanted samples. Our method gets similar performance on different walking styles.Figure 9
CDF of localization error in three scenarios.Figure 10
CDF of localization error in three walking styles.Figure11 shows the comparison of different mobiles. δ are about 1.6, 2.5, and 3.5 meters averagely inside the room, outside the room, and outdoor, respectively. The localization accuracy of Apple iPad2 and Xiaomi note2 is similar, but Google Nexus7 is the worst.Figure 11
Comparison of different mobiles.


### 4.3. Four-Point versus Three-Point Distance Estimation

Localization performance using four points in walking path is also tested by (14). Examples of four-point distance estimation is 1→2→3→4, and those of three-point distance estimation are 1→2→3, 1→2→4, 1→3→4, and 2→3→4 in outside the room setting. Figure 12 shows the bias δ result of four-point and three-point estimation. There is no obvious improvement on four-point paths, but the performance could be robust.Figure 12
Comparison between four-point and three-point estimation.


### 4.4. Performance of Unique Localization on Right-Angled Paths

The performance of unique localization on right-angled paths has been tested inside the room, outside the room, and outdoor. The right-angled paths, for example,1→4→7→8→9 in Figure 6 and 2→3→4→8→12 in Figure 7, are selected.Figure13 shows the results of the unique localization method presented in Section 3.4. Diamond symbols ⧫ in (a), (b), and (c) denote the ground truth of mobile device location. Colorful rectangles indicate the bounding path boxes in Figures 6, 7, and 8. The symbols ∗ and ∆ are two optional locations with respect to the walking path, where the optimal overlap μ,ν, defined in (15), is represented as ∗. The symmetric optional locations along the walking path are labeled in the same color. From the results, we can see that all optimal locations are correct. The localization performance on the green walk path, which is far away from ⧫, is lower.Figure 13
Unique localization results. (a) Inside the room, (b) outside the room, and (c) outdoor.
(a)
(b)
(c)


### 4.5. Path Loss Exponent Computing

After solving (11), path loss exponent n has also been computed by (4) and boxplots of the distribution inside the room, outside the room, and outdoor are shown in Figure 14. The empirical value of path loss exponent is about 2 in free space and 4–6 in buildings [27]. In our experiments, inside the room and outdoor environments are like free space without obstacles while outside the room setting is a dividing-wall scenario in buildings. Figure 14 shows that path loss exponent estimation results in our method are quite similar to the empirical value of experimental settings.Figure 14
Boxplots of path loss exponentn inside the room, outside the room, and outdoor.


### 4.6.PRX(1) Discussion

P
R
X
(
1
) is RSSI value received by the listener, which is 1 meter from a mobile Wi-Fi device. We measured PRX(1) parameter of iPad2, Nexus7, and Xiaomi Note2, as shown in Table 6.Table 6
P
R
X
(
1
) parameter for three mobile devices.
Apple iPad2
Google Nexus7
XioamiNote2
P
R
X
(
1
)
-
38 dBm
-
36 dBm
-
34 dBmP
R
X
(
1
) value might be a little different in various mobile devices of the same brand. Here we discuss the effect on distance estimation when PRX(1) varies with different mobile devices. From (2), we get the change of d with respect to PRX(1),(17)Δd=ln⁡1010ndΔPRX1.Then, the relation between the change rate of d and the change of PRX(1) is(18)Δdd=ln⁡1010nΔPRX1.Path loss exponentn is about 2-3 in free space and 4–6 in buildings [27]. Figure 15 shows the change rate Δd/d caused by the change of PRX(1) when n=2.5 and n=4.5. From the results, we can see that Δd/d are less than 10% and 19% when the deviation of PRX(1) is no more than 2 dBm in buildings and free space, respectively.Figure 15
The effect caused by the change ofPRX(1).


### 4.7. Movement Estimation Error Discussion

There might be an error in the estimation of movement distancesdAB or dBC in Figure 4. The localization error caused by movement estimation error inside and outside the room is shown in Figures 16 and 17, respectively. The testing mobile is Google Nexus7. The axes x and y in the figures are dAB and dBC in Figure 4, respectively. The colorful pixels represent the estimation error δ to the ground truth of the mobile.Figure 16
The effect caused by movement estimation error inside the room.Figure 17
The effect caused by movement estimation error outside the room.The path4→5→6 and mobile location b of Figure 6 are used for inside the room testing. The ground truth of d4→5 and d5→6 is 2 meters. The estimation of d4→5 and d5→6 is supposed to be from 1 meter to 3 meters. The path 1→2→3 and mobile location b of Figure 7 are used for outside the room testing. The ground truth of d1→2 and d2→3 is 2 meters. The estimation of d1→2 and d2→3 is supposed to be from 1 meter to 3 meters.In inside the room setting, 0.5 meters of walk estimation error will cause about 0.4 meters of mobile localization error. In outside the room setting, the estimation error ofdAB (i.e., d1→2 in Figure 7) produces less localization error than that of dBC (i.e., d2→3 in Figure 7) because path 2→3 is closer to the mobile location b than path 1→2. The localization error increases while dAB and dBC increase or decrease simultaneously. However, a small increase of the localization error is produced when one distance increases and the other decreases; that is, the sum of dAB and dBC is the same. The estimation error of point B, which is less than 0.5 meters, will cause small localization error when points A and C are fixed. The reason is that points A and C are key points to form the triangle ΔAWC.


## 4.1. Settings

To evaluate our passive localization approach, three types of scenarios are designed:(i)
Inside the room (Figure6): this is near distance situation tested in the room.(ii)
Outside the room (Figure7): this is dividing-wall situation when the listener is outside the room.(iii)
Outdoor (Figure8): this is middle distance situation tested in the square.Figure 6
Inside the room experimental setting.Figure 7
Outside the room experimental setting.Figure 8
Outdoor experimental setting.In Figures6, 7, and 8, the letters a–c are the placements of mobile devices and numbers 1–12 are the points in the walking path of the listener. There are three kinds of walking paths, horizontal, vertical, and slanted. Table 2 shows the details.Table 2
Listener’s walking paths.
Inside the room
Outside the room
Outdoor
Horizontal
1
→
2
→
3
1
→
2
→
3
→
4
1
→
2
→
3
4
→
5
→
6
5
→
6
→
7
→
8
4
→
5
→
6
7
→
8
→
9
9
→
10
→
11
→
12
7
→
8
→
9
Vertical
7
→
4
→
1
9
→
5
→
1
7
→
4
→
1
8
→
5
→
2
10
→
6
→
2
8
→
5
→
2
9
→
6
→
3
11
→
7
→
3
9
→
6
→
3
12
→
8
→
4
Slanted
7
→
5
→
3
9
→
6
→
3
7
→
5
→
3
9
→
5
→
1
11
→
6
→
1
9
→
5
→
1
10
→
7
→
4
12
→
7
→
2Examples of the listeners include the devices based on Nokia Maemo, Android, or MAC OS. Here a MacBook is used as the listener. Three mobile devices, for example, iPad2, Nexus7, and Xiaomi Note2, are used to be discovered and passively localized. The RSSI value on each point of the path is the average of several Probe Request frames.


## 4.2. Position Evaluation Results

To evaluate passive positioning performance, the bias rateB is defined as follows:(16)B=de-dgdg,where de is estimated distances, for example, dAW, dBW, and dCW, which have been calculated in (10). dg is the ground truth for the distances dAW, dBW, and dCW.We evaluate 222 samples including 72 inside the room, 126 outside the room, and 24 outdoor in the experiment. Tables3, 4, and 5 show the average bias rate B of distances dAW, dBW, and dCW in different scenarios and walking paths. The three-point paths 1→2→3∥1→2→4∥1→3→4∥2→3→4 have been selected from 1→2→3→4 in outside the room setting and so on. From the results, there is no walking path which is obviously better than others among horizontal, vertical, and slanted paths. Fortunately, the result of outside the room is not worse than those of inside the room and outdoor, although the listener and the mobile device are obstructed by wall.Table 3
Comparison ofB inside the room.
Apple iPad2
Google Nexus7
Xiaomi Note2
Horizontal
d
A
W
24.0%
25.1%
34.2%
d
B
W
21.3%
24.3%
24.9%
d
C
W
22.8%
27.7%
19.7%
Vertical
d
A
W
27.7%
30.7%
35.1%
d
B
W
24.1%
20.5%
31.0%
d
C
W
18.2%
17.9%
33.2%
Slanted
d
A
W
20.5%
23.8%
26.2%
d
B
W
20.7%
23.7%
24.2%
d
C
W
20.0%
27.5%
22.1%Table 4
Comparison ofB outside the room.
Apple iPad2
Google Nexus7
Xiaomi Note2
Horizontal
d
A
W
21.6%
24.2%
15.4%
d
B
W
28.2%
24.5%
22.4%
d
C
W
24.8%
21.3%
21.6%
Vertical
d
A
W
26.2%
27.7%
21.1%
d
B
W
31.5%
21.2%
27.0%
d
C
W
19.2%
14.6%
26.2%
Slanted
d
A
W
19.5%
20.8%
28.1%
d
B
W
28.7%
24.6%
20.2%
d
C
W
21.4%
18.1%
25.1%Table 5
Comparison ofB in outdoor.
Apple iPad2
Google Nexus7
XiaomiNote2
Horizontal
d
A
W
17.1%
22.4%
23.8%
d
B
W
19.3%
39.2%
33.6%
d
C
W
12.3%
27.5%
21.9%
Vertical
d
A
W
29.2%
24.2%
22.4%
d
B
W
23.0%
15.7%
21.3%
d
C
W
11.6%
31.1%
23.0%
Slanted
d
A
W
25.1%
28.3%
14.3%
d
B
W
31.3%
34.2%
17.8%
d
C
W
24.4%
17.4%
15.6%We have also computed the biasδ between the estimated location point W′ and the ground truth point W, shown in Figure 4. Figure 9 shows the cumulative distribution (CDF) of localization error. 75% errors are less than 2 meters inside the room, 4 meters outside the room, and outdoor. Figure 10 shows localization error in three walking styles including 72 horizontal, 90 vertical, and 60 slanted samples. Our method gets similar performance on different walking styles.Figure 9
CDF of localization error in three scenarios.Figure 10
CDF of localization error in three walking styles.Figure11 shows the comparison of different mobiles. δ are about 1.6, 2.5, and 3.5 meters averagely inside the room, outside the room, and outdoor, respectively. The localization accuracy of Apple iPad2 and Xiaomi note2 is similar, but Google Nexus7 is the worst.Figure 11
Comparison of different mobiles.


## 4.3. Four-Point versus Three-Point Distance Estimation

Localization performance using four points in walking path is also tested by (14). Examples of four-point distance estimation is 1→2→3→4, and those of three-point distance estimation are 1→2→3, 1→2→4, 1→3→4, and 2→3→4 in outside the room setting. Figure 12 shows the bias δ result of four-point and three-point estimation. There is no obvious improvement on four-point paths, but the performance could be robust.Figure 12
Comparison between four-point and three-point estimation.


## 4.4. Performance of Unique Localization on Right-Angled Paths

The performance of unique localization on right-angled paths has been tested inside the room, outside the room, and outdoor. The right-angled paths, for example,1→4→7→8→9 in Figure 6 and 2→3→4→8→12 in Figure 7, are selected.Figure13 shows the results of the unique localization method presented in Section 3.4. Diamond symbols ⧫ in (a), (b), and (c) denote the ground truth of mobile device location. Colorful rectangles indicate the bounding path boxes in Figures 6, 7, and 8. The symbols ∗ and ∆ are two optional locations with respect to the walking path, where the optimal overlap μ,ν, defined in (15), is represented as ∗. The symmetric optional locations along the walking path are labeled in the same color. From the results, we can see that all optimal locations are correct. The localization performance on the green walk path, which is far away from ⧫, is lower.Figure 13
Unique localization results. (a) Inside the room, (b) outside the room, and (c) outdoor.
(a)
(b)
(c)


## 4.5. Path Loss Exponent Computing

After solving (11), path loss exponent n has also been computed by (4) and boxplots of the distribution inside the room, outside the room, and outdoor are shown in Figure 14. The empirical value of path loss exponent is about 2 in free space and 4–6 in buildings [27]. In our experiments, inside the room and outdoor environments are like free space without obstacles while outside the room setting is a dividing-wall scenario in buildings. Figure 14 shows that path loss exponent estimation results in our method are quite similar to the empirical value of experimental settings.Figure 14
Boxplots of path loss exponentn inside the room, outside the room, and outdoor.


## 4.6.PRX(1) Discussion

P
R
X
(
1
) is RSSI value received by the listener, which is 1 meter from a mobile Wi-Fi device. We measured PRX(1) parameter of iPad2, Nexus7, and Xiaomi Note2, as shown in Table 6.Table 6
P
R
X
(
1
) parameter for three mobile devices.
Apple iPad2
Google Nexus7
XioamiNote2
P
R
X
(
1
)
-
38 dBm
-
36 dBm
-
34 dBmP
R
X
(
1
) value might be a little different in various mobile devices of the same brand. Here we discuss the effect on distance estimation when PRX(1) varies with different mobile devices. From (2), we get the change of d with respect to PRX(1),(17)Δd=ln⁡1010ndΔPRX1.Then, the relation between the change rate of d and the change of PRX(1) is(18)Δdd=ln⁡1010nΔPRX1.Path loss exponentn is about 2-3 in free space and 4–6 in buildings [27]. Figure 15 shows the change rate Δd/d caused by the change of PRX(1) when n=2.5 and n=4.5. From the results, we can see that Δd/d are less than 10% and 19% when the deviation of PRX(1) is no more than 2 dBm in buildings and free space, respectively.Figure 15
The effect caused by the change ofPRX(1).


## 4.7. Movement Estimation Error Discussion

There might be an error in the estimation of movement distancesdAB or dBC in Figure 4. The localization error caused by movement estimation error inside and outside the room is shown in Figures 16 and 17, respectively. The testing mobile is Google Nexus7. The axes x and y in the figures are dAB and dBC in Figure 4, respectively. The colorful pixels represent the estimation error δ to the ground truth of the mobile.Figure 16
The effect caused by movement estimation error inside the room.Figure 17
The effect caused by movement estimation error outside the room.The path4→5→6 and mobile location b of Figure 6 are used for inside the room testing. The ground truth of d4→5 and d5→6 is 2 meters. The estimation of d4→5 and d5→6 is supposed to be from 1 meter to 3 meters. The path 1→2→3 and mobile location b of Figure 7 are used for outside the room testing. The ground truth of d1→2 and d2→3 is 2 meters. The estimation of d1→2 and d2→3 is supposed to be from 1 meter to 3 meters.In inside the room setting, 0.5 meters of walk estimation error will cause about 0.4 meters of mobile localization error. In outside the room setting, the estimation error ofdAB (i.e., d1→2 in Figure 7) produces less localization error than that of dBC (i.e., d2→3 in Figure 7) because path 2→3 is closer to the mobile location b than path 1→2. The localization error increases while dAB and dBC increase or decrease simultaneously. However, a small increase of the localization error is produced when one distance increases and the other decreases; that is, the sum of dAB and dBC is the same. The estimation error of point B, which is less than 0.5 meters, will cause small localization error when points A and C are fixed. The reason is that points A and C are key points to form the triangle ΔAWC.


## 5. Conclusion

In this paper, we present a novel passive mobile localization mode based on IEEE 802.11 Probe Request frames without Wi-Fi APs and reference points. In this approach, a geometric diagram is designed to estimate the location of mobile device. Using this approach, nearby mobile devices can be discovered on the listener’s walking path. To solve the model equations, path loss exponent, which is a site-related parameter, is eliminated. Therefore, our method is site-independent and does not need to train the parameter which is related to the environments. The experimental results show that the errors of mobile device location are lower than 2 meters and 3.5 meters in indoor and outdoor scenarios, respectively. The performance outside the room, inside the room, and outdoor is similar, although path loss exponents are different in these three kinds of scenarios. The unique localization method on right-angled paths is successful although the walking path is far away from the mobile device. The estimation results of path loss exponents are quite similar to the empirical value of experimental settings. The effect of parameterPRX(1) is less than 20% when its deviation is no more than 2 dBm. We also analyze the localization error caused by movement estimation error inside and outside the room. The localization error is less than 0.4 meters when 0.5 meters error occurs in walk estimation generally; however, a small error increases when dAC is fixed.



---

*Source: 7821585-2017-06-19.xml*