Centroid Localization of Uncooperative Nodes in Wireless Networks Using a Relative Span Weighting Method

—Increasingly ubiquitous wireless technologies require novel localization techniques to pinpoint the position of an uncooperative node, whether the target be a malicious device engaging in a security exploit or a low-battery handset in the middle of a critical emergency. Such scenarios necessitate that a radio signal source be localized by other network nodes efﬁciently, using minimal information. We propose two new algorithms for estimating the position of an uncooperative transmitter, based on the received signal strength (RSS) of a single target message at a set of receivers whose coordinates are known. As an extension to the concept of centroid localization, our mechanisms weigh each receiver’s coordinates based on the message’s relative RSS at that receiver, with respect to the span of RSS values over all receivers. The weights may decrease from the highest RSS receiver either linearly or exponentially. Our simulation results demonstrate that for all but the most sparsely populated wireless networks, our exponentially weighted mechanism localizes a target node within the regulations stipulated for emergency services location accuracy.


I. INTRODUCTION
Given the pervasiveness of cellphones and other wireless devices, compounded with the associated expectation of permanent connectivity, it is perhaps not surprising that the abrupt dashing of such presumptions makes headline news.A recent spate of cases in Canada have highlighted the tragic consequences of failing to locate the source of an emergency 911 cellphone call.In one incident, a New Year's Eve reveler lost in a snowstorm in the middle of the British Columbia woods called 911 for help, but the police were only able to find the teen over 12 hours later, after he had perished [1].In September 2008, the body of a badly beaten man in Alberta was located four days after his ill-fated call for help [2].A more recent case had two children lost in snowy conditions who were lucky to survive when discovered several hours after their initial 911 call [3].These and similar events have spurred the Canadian Radio-television Telecommunications Commission (CRTC) to regulate the same wireless Enhanced 911 (E911) provisions [4] as the Federal Communications Commission (FCC) in the U.S. [5] Under Phase II of the FCC and CRTC plans, localization efforts based on a handset device (handset-based) must yield a location accuracy of 50 meters in 67% of cases and 150 meters 95% of the time.Network-based localization, where other nodes (whether base stations or other handsets within range) estimate the position of a device, must accurately reveal a target location within 100 meters 67% of the time and within 300 meters in 95% of cases.
Self-localization achieved with handset-based techniques can produce granular results.For example with the Global Positioning System (GPS), a precision of ten meters may be achieved [6].But self-localization is not feasible in all scenarios.An uncooperative node is one that cannot be relied upon to determine its coordinates, for example a defective sensor, a malicious device engaging in a security exploit or a low-battery handset in a critical situation.A malicious node broadcasting an attack message cannot be expected to cooperate with efforts to uncover its position.In other situations, a malfunctioning device or one whose battery is nearly drained may be unable to compute and report its coordinates to other nodes.Network-based localization schemes are thus essential in order to fill the gap.A large body of location estimation literature already exists, much of it centered on self-localization.With GPS technology becoming more affordable, highly performing and well adept at filling the handset-based requirements, we focus our efforts on networkbased localization and the inherently more complex scenarios it addresses.
In a sufficiently densely populated wireless network, the source location of a given message may be approximated from the coordinates of receiving devices, assuming an omnidirectional propagation pattern.We propose two localization algorithms that estimate a transmitting node's position as the weighted average of receiver coordinates, assuming a single message is received from the target node.We compute a received signal strength (RSS) span as the difference between the maximum and minimum RSS values for the transmitted message over all receivers.We assign greater weight to the receiver coordinates whose RSS value is closer to the maximum of the RSS span and thus closer to the transmitter.Conversely, lesser weight is ascribed to receivers with lower RSS values, as they are deemed farther from the transmitter.We describe a relative span weighted localization (RWL) mechanism, where the concept of weighted moving average is adapted to provide a linear mapping between the weight assigned to a receiver's coordinates and the relative placement of its RSS value within the overall RSS span.We further propose an exponential variation of RWL, dubbed relative span exponential weighted localization (REWL).This approach is conceptually related to an exponential moving average and relies on an exponential weight correspondence between a receiver's coordinates and its relative situation within the RSS span.We evaluate the RWL and REWL algorithms using simulated RSS reports featuring a variety of node densities, number of receivers, and amount of signal shadowing representative of environmentbased RSS fluctuations.We also test our localization mechanisms with RSS values harvested from an outdoor field experiment.We find that the exponentially weighted variation achieves better results and that, except for cases with a small number of receivers and a large amount of signal shadowing, our mechanism meets the E911 mandated location accuracy requirements.
Section II provides an overview of existing work in wireless node localization.Section III outlines the centroid localization schemes on which our new algorithms are based.Section IV describes our linearly and exponentially weighted location estimation mechanisms.Section V evaluates the performance of both algorithms using simulated and experimental RSS values.Section VI concludes the paper.

II. RELATED WORK
The problem of wireless node localization may be approached from one of two main directions: device-based (also known as handset-based) and network-based.Device-based self-localization involves a node seeking to learn its own position, occasionally with the help of other trusted devices within radio range.For example, the use of GPS can be seen as a device-based approach, since a node uses information supplied by a set of satellites in order to determine its coordinates.In techniques based on time of arrival (TOA), a device may situate its position with respect the known locations of other nodes by correlating arrival time of received messages and thus determining its distance to each node.A large proportion of the localization techniques proposed for sensor networks assume a device-based approach.For example, the three/two neighbor algorithm proposed by Barbeau et al. [7] allows for a sensor of unknown position to estimate its location from the coordinates of neighboring nodes, based on their respective TOA-approximated distances.While device-based mechanisms can achieve high localization accuracy, they are unsuitable for positioning attackers or uncooperative nodes.Given that such devices may supply erroneous location information, either willfully or accidentally, they must be located by other network nodes using measurements that cannot easily be forged.
The concept of triangulation was first introduced by Frisius [8] for map surveying and locating far-off geographical points.In more recent years, this approach has also served as a network-based technique to localize a transmitting device using two receivers of known coordinates and the transmission's angle of arrival.A significant drawback of the triangulation method is the necessity that receivers be equipped with directional antennas, so that the angle at which an incoming transmission originates may be measured.Without this specialized hardware, triangulation is not feasible.
We focus our research efforts on network-based location estimation mechanisms that assume the more commonly available omnidirectional antennas.In existing work, such schemes typically yield results in either open-form, where a target node is localized to an estimated area in Euclidean space, or in closed-form, where the coordinates of a single point are determined.
Open-form solutions may be constructed as the intersection of rings, or annuli, around the receivers of a particular message, as suggested by Barbeau and Robert [9], as well as Chong Liu et al. [10].In such mechanisms, the minimum and maximum distances between a transmitter and each receiver are approximated from a signal path loss propagation model, such as the log-normal shadowing model [11].However, the effective isotropic radiated power (EIRP) must be known, which may not be feasible in an attack message scenario.In hyperbolic position bounding, first described by Laurendeau and Barbeau [12], the EIRP is assumed to be unknown, and hyperbolic areas are computed from an estimated distance difference range between a transmitter and each pair of receivers.The intersection of constructed hyperbolic areas suggest a candidate area for the location of a transmitter.While openform solutions may localize a node within an area with a suitable degree of granularity for certain types of applications, other scenarios may require a more precise localization result.
Closed-form solutions abound in the literature as well.The time difference of arrival (TDOA) approach translates the difference in arrival times of a given message at two receivers into a distance difference, and plots a hyperbola with the receiver coordinates as foci.Multiple receiver pairs yield multiple hyperbolas, with a transmitter location determined at the common intersecting point.With this technique, the clocks at receiving devices must be synchronized with nanosecond precision, otherwise a common intersecting point may not exist.Even highly correlated GPS clocks may exhibit up to one microsecond of clock drift between receivers [13].At the speed of light, a one microsecond drift translates into a distance difference of 300 meters, resulting in a margin of location error greater than the FCC regulations for E911 location accuracy.The RSS values of a given message may be used to estimate a set of transmitter-receiver (T-R) distances using a least squares approach, as suggested by Zhong et al. [14] and Bo-Chieh Liu et al. [15], [16].Disadvantages of these schemes include their reliance upon a nearly-ideal radio propagation environment, with little signal noise, as well as the availability of multiple transmitted messages so that the signal fluctuations can be averaged out.Even in a moderately shadowed environment, such approaches may fail to yield any solution.
In the realm of sensor networks, centroid localization (CL) has been suggested as an efficient closed-form method that never fails to produce a solution.The original incarnation of CL is described by Bulusu et al. [17], and localizes the transmitting source of a message to the (x, y) coordinates obtained from averaging the coordinates of all receiving devices within range.Weighted centroid localization (WCL), as proposed by Blumenthal et al. [18], assigns a weight to each of the receiver coordinates, as inversely proportional to either the known T-R distance or the link quality indicator available in ZigBee/IEEE 802.15.4 sensor networks [19].Behnke and Timmermann [20] extend the WCL mechanism for use with normalized values of the link quality indicator.Schuhmann et al. [21] conduct an indoor experiment to determine a set of fixed parameters for an exponential inverse relation between T-R distances and the corresponding weights used with WCL.Orooji and Abolhassani [22] suggest a T-R distance-weighted averaged coordinates scheme, where each receiver's coordinates is inversely weighted according to its distance from the transmitter.But this approach assumes that the receivers are closely co-located and that the T-R distance to at least one of the receivers is known a priori.

III. CENTROID LOCALIZATION
We outline the centroid localization approaches on which our novel algorithms are based, and introduce the notation used throughout the description of our mechanisms.
Notation.The estimated coordinates of the transmitter we are striving to locate are denoted as p = ( x, y).Each receiver R i is situated at a point of known coordinates p i = (x i , y i ).
For the sake of simplicity in our algorithm descriptions, we depict operations on receiver points p i .In fact, two separate calculations occur.The approximated x coordinate is computed from all the receiver x i coordinates, and y is calculated from the y i coordinates.
Given a set of known points p i in a Euclidian space, for example a number of receivers within radio range of a target transmitter to be localized, Bulusu et al. [17] approximate the location p of a node from the centroid of the known points p i as follows: where n represents the number of points.
In the simple CL approach, all points are assumed to be equally near the target node.Blumenthal et al. [18] argue that some points are more likely than others to be close to target node.Their WCL scheme aims to improve localization accuracy by assigning greater weight to those points which are estimated to be closer to the target and less weight to the farther points.The weighted centroid is thus computed as: with where d i is the known distance between the target node and point p i , and the exponent g influences the degree to which remote points participate in estimating the target location p. Values of g are determined manually, with Blumenthal et al. and Schuhmann et al. [21] promoting different optimal values, depending on the experimental setting.
IV. RELATIVE SPAN WEIGHTED LOCALIZATION Assuming an uncooperative node, we cannot presume to know a priori the set of T-R distances d i or the optimal value of g in a given outdoor environment.Further, we cannot estimate values of d i from the log-normal shadowing model, as the transmitter EIRP may not be known.We therefore introduce the concept of relative span weighted localization in order to estimate the location of a transmitter with minimal information available at a set of receivers.Our approach adapts the concept of moving average from a weighting method over time and applies it to WCL in the space domain.But rather than ascribing weights according to known or approximated T-R distances, we weigh each receiver coordinates according to the relative placement of its RSS value within the span of all RSS reports for a given transmitted message.The receiver coordinates may be weighted linearly or exponentially.
Definition 1: Minimal/Maximal RSS.Let R be the set of all receivers within range of a given message M T originating from an uncooperative transmitter T .Let Υ denote the set of RSS values measured at each receiver R i ∈ R for message M T , such that: Then we define the minimal and maximal RSS values, V min and V max , for message M T , as the smallest and largest RSS values in Υ: Definition 2: RSS Span.Let the minimal and maximal RSS values for a message M T be as stated in Definition 1.We define the RSS span V ∆ for this message at a set of receivers R as the maximal range in RSS values over all receivers: We describe two relative span weighted localization algorithms, both computing a weighted centroid as defined in Equation ( 2), but with novel approaches for computing the weights assigned to each receiver coordinates.

A. Linearly Weighted Localization
The RWL algorithm computes a centroid of receiver coordinates, each weighted linearly according to the relative position of the receiver's RSS value within the RSS span.
Algorithm 1: RWL Algorithm.The relative span weighted localization (RWL) algorithm estimates a transmitter's coordinates p as the weighted centroid of all receiver coordinates p i , as defined for WCL in Equation ( 2), but with a linearly increasing weight assigned to each receiver according to its presumed proximity to the transmitter.Given the RSS values in Υ, as found in Definition 1, and the RSS span V ∆ determined according to Definition 2, the weight w i of each receiver R i is computed from the relative placement of its RSS value υ i in the RSS span, as follows: The relative span weighted centroid thus becomes: where n = |R|.

B. Exponentially Weighted Localization
Exponentially weighted moving averages (EMAs) have been used for a variety of forecasting applications, for example in Muir [23], to predict future values based on past observations, with more weight exponentially ascribed to more recent data.A weighting factor λ is used as a parameter to control the proportion of weight assigned to recent observations with respect to past ones.
According to [24], the EMA at time t is stated as: where λ is the weighting factor, Z t is an observation at time t and EM A 0 is the average of historical observation values.
Roberts [25] expands the EMA equation as follows: where n is the number of observations.We adapt the EMA concept from rating observations over time for the purpose of weighting receiver coordinates over the space domain.While EMA favors more recent observations in time with a weighting factor of λ, we bolster receivers that are likely to be closer to a transmitter and thus feature higher RSS values.In addition, rather than increasing the weighting factor exponent by one for each observation in time, we correlate the exponent with the relative position of each receiver's RSS value within the RSS span.
Algorithm 2: REWL Algorithm.The relative span exponentially weighted localization (REWL) algorithm estimates a transmitter's coordinates p as the weighted centroid of all receiver coordinates p i , as defined for WCL in Equation ( 2), but with exponential weight assigned to each receiver according to a weighting factor λ. Given the RSS values in Υ as found in Definition 1, the weight w i of each receiver R i is computed from the relative placement of its RSS value υ i in the RSS span, as follows: The relative span exponentially weighted centroid thus becomes: where n = |R|.

C. Example
Figure 1 compares the relative weights assigned to a set of receivers with a RSS span V ∆ of 15 dBm, given the RWL and REWL weight assignments, assuming three different values for the weighting factor λ. The REWL algorithm with λ = 0.10, equivalent to a smoothing factor of 10%, represents the flattest of the exponential curves and thus the closest to the constant weighting approach of simple CL.Less weight is assigned to receivers closest to the transmitter and more weight to those farthest, when compared to the linear RWL method.With λ = 0.20, the nearest receivers are ascribed far greater weight than under the RWL scheme, and the mid-RSS receivers are given much less importance.A weight factor of λ = 0.15 strikes a balance between the two, with the highest RSS receivers assigned slightly more weight than with RWL, the mid-RSS receivers somewhat less, while the lowest still contribute marginally to estimating the transmitter location.

V. PERFORMANCE EVALUATION
We evaluate the performance of the RWL and REWL algorithms using simulated RSS values and experimental ones harvested from an outdoor field experiment.

A. Simulation Results
We ran the RWL and REWL mechanisms on simulations featuring a variety of node densities and number of receivers.For each of 10 000 executions, we generate a random transmitter position within a 1000 × 1000 m 2 simulation grid.We define our node densities as the number of nodes per 100 × 100 m 2 .For every node density d ∈ {0.25, 0.50, 0.75, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10}, we position d nodes per 100 × 100 m 2 in uniformly distributed positions on our simulation grid.For each node, we compute a RSS value based on the log-normal shadowing model [11], with a random amount of signal shadowing generated along a Gaussian probability distribution.We assume two different radio propagation environments with path loss constants obtained from outdoor experiments.For the 2.4 GHz WiFi/802.11gfrequency, we use propagation values measured by Liechty et al. [26], [27], where a signal shadowing standard deviation is measured at nearly σ = 6 dBm.For the 5.8 GHz frequency, licensed for vehicular networks [28], we make use of the constants determined by Durgin et al. [29], with a signal shadowing standard deviation close to σ = 8 dBm.Similar experiments by Schwengler and Gilbert corroborate the amount of signal shadowing commonly experienced at this frequency [30].Our setup allows us to gauge the performance of relative span weighted localization based on propagation environments featuring different amounts of signal fluctuations.Once our simulated nodes are positioned, we determine which ones can be used as receivers.We set all receiver sensitivity to -90 dBm, and the nodes that feature a RSS value above the sensitivity are deemed within range of the transmitter and thus become receivers.The non-receiver nodes are subsequently ignored as out of range.
Table I shows the average number of receivers for each node density, over all our simulated executions, given each radio propagation environment.Figure 2 depicts an example simulation grid, with a transmitter at 2.4 GHz, a number of nodes generated with density of one node per 100 × 100 m 2 , and receivers within range of the transmitter.It should be noted that some nodes may be located closer to the transmitter and yet be out of range.This is due to the different amounts of signal shadowing generated for each node.So while one node may be physically closer to the transmitter, if it experiences a large amount of negative shadowing, its RSS value may fall below the receiver sensitivity and thus be deemed undetectable.
For each execution, we use the known coordinates of all receivers to compute a possible position for the transmitter, according to four algorithms: the maximum RSS receiver method, where a transmitter is assumed to be at exactly the receiver position with the highest RSS value; the CL approach, as set out by Bulusu et al. in Equation (1); the RWL algorithm using Equation (3); and the REWL algorithm as set forth in Equation ( 4), given three different values for the weighting factor λ ∈ {0.10, 0.15, 0.20}.We assess the performance of each mechanism according to its location accuracy, computed as the Euclidian distance between the estimated position p and the actual transmitter location, averaged over all executions.
Our results are deemed accurate within ±3 meters in a 95% confidence interval.Figures 3 and 4 plot the average location error for each tested algorithm, given all defined node densities, for frequencies 2.4 GHz and 5.8 GHz respectively.We find that while higher densities consistently yield greater location accuracy, a larger amount of signal shadowing results in higher location errors.For example, for all densities, the REWL algorithm, with the 2.4 GHz frequency and σ = 6 dBm, yields a location error consistently less than 75 meters, while the same mechanism at the 5.8 GHz frequency and σ = 8 dBm reaches an error of 105 meters.For both frequencies and all node densities, the REWL algorithm with weighting factor of 15% (λ = 0.15) achieves optimal results.The same observations can be made when nodes are generated by absolute numbers of receivers rather than node densities.Figures 5 and 6 demonstrate the location errors computed with each algorithm with fixed numbers of receivers, given the 2.4 GHz and 5.8 GHz frequencies respectively.Again, with similar numbers of receivers, the least shadowed environment produces lower location errors.As with the tests involving different node densities, the REWL mechanism with λ = 0.15 performs better than the other algorithms for all numbers of receivers.In order to gauge the performance of REWL (λ = 0.15) for a single frequency and different levels of environmental shadowing, we executed the algorithm at 2.4 GHz with three separate amounts of shadowing generated on the simulated RSS values: σ ∈ {6, 8, 10} dBm.As Figure 7 reveals, higher levels of shadowing have a significant impact on location error, with an error increase of roughly 50% for every 2 dBm of additional signal shadowing standard deviation, for each node density.
We assessed the performance of each algorithm, and in particular the REWL (λ = 0.15) mechanism, when compared to the E911 regulations for location accuracy.Figures 8 and 9 show the location error cumulative probability distribution for each algorithm, given four receivers, for the 2.4 GHz and 5.8 GHz frequencies respectively.While every method evaluated meets the E911 requirements at 2.4 GHz with moderate signal shadowing (σ = 6 dBm), none of the mechanisms succeed with 5.8 GHz and a larger amount of shadowing (σ = 8 dBm).However, even in the latter case, the REWL approach with λ = 0.15 is nearly adequate.The REWL algorithm, with λ = 0.15, was evaluated for different node densities, with the two different frequencies.Given the smaller amount of signal shadowing found at 2.4 GHz, REWL meets the E911 location accuracy requirements for every node density, as seen in Figure 10.For larger amounts of shadowing at 5.8 GHz, only the smallest node density of 0.25 per 100 × 100 m 2 fails to meet the E911 standard, as shown in Figure 11.Even in a heavily shadowed environment, higher node densities can accurately localize a Orooji et al. [22] simulate a cluster of seven cells, each featuring a base station with a one kilometer radius, in order to compute the location of a mobile station.A very small amount of signal shadowing σ ∈ {1, 2} dBm is taken into account.Even though their proposed T-R distance-weighted method assumes a known distance to one of the base stations, the mean location error is 48 meters, with 95% of executions resulting in a location error less than 103 meters.Our RWL and REWL (λ = 0.15) algorithms for 2.4 GHz with eight receivers yield an average 37 and 34 meter location error respectively.RWL locates a transmitter within 100 meters 98% of the time, while REWL does so in 99% of cases.Thus over a similarly sized simulation grid, our RWL and REWL mechanisms consistently yield more accurate results.

B. Experimental Results
We conducted an outdoor field experiment with four desktop receivers statically arranged in the corners of a rectangular area 80 × 110 m 2 in size.Each receiver collected the RSS values of packets transmitted by a laptop from each of ten separate locations.Only the messages simultaneously received by the four desktops were retained.The localization algorithms were executed on each message, and the average location errors for each transmitter location are depicted in Figure 12.The location error for each algorithm averaged over all transmitter locations can be found in Table II.We find that the RWL and REWL mechanisms perform far better than the maximum RSS receiver and CL approaches, with a gain in location accuracy of up to 40%.On average, the RWL, REWL with λ = 0.15, and REWL with λ = 0.20 mechanisms perform equally well, with no algorithm emerging as clearly superior to the others.This may be due to our small experimental data set (approximately 400 messages), when compared to simulation results obtained over 10 000 executions.While our simulations also found consistently similar results between the RWL and REWL mechanisms, the larger amount of simulated data allows us to draw more fine-tuned conclusions.

VI. CONCLUSION
We propose a wireless network-based localization mechanism for estimating the position of an uncooperative transmitting device, whether it be a malfunctioning sensor, an attacker engaging in a security exploit or a low-battery cellphone in a critical emergency.We extend the concept of weighted centroid localization and describe two additional receiver coordinate weighting mechanisms, one linear and the other exponential, that assume no knowledge of the T-R distances nor of the transmitter EIRP.We adapt the concept of moving averages based on observations over time to the space domain.We ascribe linear and exponential weights to each receiver coordinates, based on the relative positioning of the receiver's RSS value relative to the RSS span over all receivers.
We tested our relative span weighted localization algorithms with simulated and experimental RSS values, using two frequencies featuring different amounts of signal shadowing.We found that our algorithms yield lower location errors than the existing centroid localization method.As expected, the location accuracy increases as more nodes participate in the localization effort.For example with REWL (λ = 0.15) at 2.4 GHz, one node per 100×100 m 2 localizes a transmitter within 44 meters, while ten nodes per 100×100 m 2 do so in less than ten meters.Yet the location accuracy decreases as the amount of signal shadowing between different receivers increases, with an average decrease of approximately 50% for every 2 dBm of additional signal shadowing standard deviation.We conclude that the exponential variation of our relative span weighted localization algorithm achieves a location accuracy that meets the FCC regulations for Enhanced 911, for all densities with moderate amounts of signal shadowing and for all but the smallest node densities with extensive shadowing.
Future directions for this work include exploring possible improvements to location accuracy by taking signal shadowing into account at each receiver location.Also, more extensive experiments can be conducted to assess our algorithms with greater volumes of packets under different conditions, including mobility.

Fig. 4 .
Fig. 4. Algorithm Location Error by Node Density for 5.8 GHz

15 Fig. 5 .
Fig. 5. Algorithm Location Error by Number of Receivers for 2.4 GHz

TABLE I AVERAGE
NUMBER OF RECEIVERS PER NODE DENSITY