Can Machine Learning Break Wi-Fi Privacy? A Study on MAC Address Randomization Marta Puig⋆ , Costas Michaelides⋆ , Lucia Pintor† , Boris Bellalta⋆ , and Francesc Wilhelmi⋆
arXiv:2606.25788v1 [cs.NI] 24 Jun 2026
⋆
Universitat Pompeu Fabra, Barcelona, Spain † University of Cagliari, Cagliari, Italy
Abstract—Medium Access Control (MAC) address randomization has been widely adopted during the IEEE 802.11 network discovery phase as a countermeasure against passive tracking. This paper exposes vulnerabilities in these privacy protocols by demonstrating that devices remain identifiable using Machine Learning (ML)-based fingerprinting. To study the potential tracking capabilities of a passive attacker, we evaluate different eavesdropping scenarios and configurations. To this end, we extract unencrypted hardware specifications from Probe Frames, which we combine with the Inter-Probe Frame Arrival Time (IFAT) and Simulated Received Signal Strength Indication (SRSSI) signals. A core contribution of this paper is the bitwise decomposition of the High Throughput (HT) capabilities information field, which improves device identification accuracy. We evaluate this de-randomization approach using three unsupervised clustering algorithms (K-Means, DBSCAN, and OPTICS) across a dataset of 22 devices from six manufacturers. Our results show that DBSCAN, when using decomposed HT capabilities information and three SRSSI measurements, achieves a global accuracy up to 89.6%. This suggests that the existing MAC randomization solutions are insufficient and underscores the need for enhancing privacy within Wi-Fi standardization. Index Terms—IEEE 802.11, MAC address randomization, privacy, machine learning, Wi-Fi
I. I NTRODUCTION Wi-Fi clients, or Stations (STAs), discover available networks using two methods: passive scanning, where they listen for Beacon frames, or active scanning, which involves transmitting Probe Request frames and receiving Probe Response frames from nearby Access Points (APs). A critical vulnerability of active discovery is that its management frames are transmitted entirely unencrypted, making them a primary target for passive eavesdropping and device tracking [1]. To mitigate third-party tracking, vendors such as Apple (starting from iOS 8) and Microsoft (starting from Windows 10) introduced their own Medium Access Control (MAC) address randomization mechanisms before formal standardization. However, while this uncoordinated randomization improved privacy, it introduced new risks that broke basic 802.11 operations. Finally, the IEEE formally addressed MAC address randomization in the 802.11aq amendment for Probe Requests during the pre-association stage [1]. Despite randomization, Probe Requests still contain static header fields that can be used to track a given user. Moreover, temporal information can be extracted from Inter-Probe Frame Arrival Time (IFAT) Corresponding author: [email protected].
and spatial information can be derived from the Received Signal Strength Indication (RSSI), which further contribute to passively fingerprinting users even when the MAC address is randomized [2]. Prior fingerprinting methodologies generally exploit individual feature categories, including protocol header information, temporal behavior, and spatial signal characteristics, as summarized in Table I. While some previous works relied on the Sequence Number (SN), we omit it from our work because it no longer increments predictably across different bursts. To explore the combined effect of the remaining features, the present work builds upon the dataset presented in [6], [7]. Since the original dataset lacks environmental context, RSSI values are simulated here. In particular, we propose a framework that integrates IEs, IFAT, and Simulated Received Signal Strength Indication (SRSSI) features to assess the robustness of MAC address randomization against unsupervised Machine Learning (ML) clustering. In a real-world eavesdropping scenario, an attacker aims to determine which randomized MACs belong to the same device. Therefore, we use unsupervised clustering to group Probe Requests based on the information they carry, without needing any prior knowledge of the network. The evaluation was conducted on 22 heterogeneous devices from six manufacturers under four feature configurations and four device density levels (5, 10, 15, and 22 devices). Overall, we show that current MAC randomization solutions are not enough, highlighting the need for further improvements to Wi-Fi standards. Specifically: We show that the bitwise decomposition of High Throughput (HT) capabilities information into subfields leads to a higher separation among devices, making it easier for the attacker to track them. • We show that the IFAT feature introduces variance and degrades clustering performance across three unsupervised algorithms (K-Means, DBSCAN, and OPTICS). • We show that having access to spatial information (simulated in this paper) improves de-randomization accuracy with respect to header-only features. •
The remainder of the paper is structured as follows: Section II describes the proposed methodology. Section III details the experimental setup. Section IV presents the results and discussion. Section V concludes the paper.
TABLE I R EPRESENTATIVE PRIOR ART ON MAC DE - RANDOMIZATION . F EATURE COLUMNS : SN = S EQUENCE N UMBER (SN), IE = I NFORMATION E LEMENT (IE), T = T IMING , R = RSSI.
Linear
Proven SN leak
Matte et al. [4]
×
×
✓
×
Laboratory (1 channel). Labeled (Simulated): 120k frames; simulated randomization.
D2
77.2% Accuracy
Praharenka et al. [5]
×
×
✓
×
Isolated (3 channels). Labeled (True): Manual labeling in a controlled environment.
NB/RF/SVM
94.5% / 93.2% / 90.4% Accuracy
Pintor et al. [6], [7]
×
✓
×
×
Isolated (3 channels). Labeled (True): Single-device captures merged into 12 scenarios.
DBSCAN
7.5% Average Error
Cifuentes-Urtubey et al. [8]
✓
✓
×
×
Conference venue (1 channel). Unlabeled: Real-world MobiCom 2023 traffic.
Heuristics
45% reduction in MAC IDs
Pérez-Hernández et al. [9]
×
✓
×
✓
Building (1 channel). Unlabeled: Ground truth via manual counting.
K-Means
98% Counting Accuracy
This work
×
✓
✓
✓
Isolated (1 channel). Labeled (True): Single-device captures merged into 3 scenarios.
DBSCAN
89.6% Global Accuracy
II. P ROPOSED M ETHODOLOGY The proposed methodology consists of three blocks: Data Description and Preparation (Section II-A), Clustering Algorithms (Section II-B), and Evaluation Metrics (Section II-C). A. Data Description and Preparation As previously mentioned, the dataset provided by [6] was utilized for this research. This dataset consists of 20minute captures from 22 different devices under six distinct operational modes. Among all possible configurations, only captures in “Mode S” (screen inactive, Wi-Fi enabled, powersaving disabled) were considered. Analyzing the dataset more deeply, we observed a significant variance in the number of frames transmitted. Despite all devices being captured under the same conditions, certain devices broadcast considerably more frames within those 20 minutes, ranging from 5 frames (Device U) to over 1,200 frames (Device C). Table II lists all the devices, identified by a letter, alongside the number of transmitted Probe Frames, observed Physical Layer (PHY), standard mode, and the hexadecimal HT capability information. It should be noted that these PHY types are the protocol functionalities advertised by the devices during the network discovery phase, and do not necessarily represent their overall hardware capabilities. Moreover, some devices exhibited two distinct HT capability information values because they used different PHY configurations during the capture. Consequently, there are two values in the Probe Frames count, one for each configuration. Next, we describe the different pieces of information considered for MAC address de-randomization. 1) Static Characteristics (Decomposed HT Capabilities): Among the IEs present in Probe Requests, the HT capabilities field (IE 45) consists of 28 bytes. Within this IE, the HT capabilities information accounts for 2 bytes, which is a 16bit hexadecimal value (e.g., 0x01ad) that encodes 802.11
0
1
2–3
4
5
6
7
8–9
10
11
12
13
14
15
L-SIG TXOP
Laboratory (3 channels). Labeled (True): Specific devices with known OS.
40 MHz Intolerant
×
Reserved
×
DSSS/CCK 40
✓
Max A-MSDU
✓
HT-del. BA
Freudiger [3]
Rx STBC
Result
Tx Space-Time Block Coding (STBC)
Algorithm
Short GI 20
Environment & Dataset
Short GI 40
R
HT Greenfield
T
SM Power Save
IE
Channel Width
SN
Low Density Parity Check (LDPC)
Work
Fig. 1. Bitwise structure of the 16-bit HT capabilities information field. The first row indicates the bit positions and the second row, the subfields [10].
hardware features. In prior work, all 28 bytes were converted into decimal values, summed together, and treated as a single feature [7]. However, instead of doing this, we take only the HT capabilities information, the A-MPDU parameters, and the HT extended capabilities. One of the contributions of this work is to demonstrate that decomposing the HT capabilities information adds granularity to the feature space, favoring derandomization through clustering. Fig. 1 presents the bitwise representation of the HT capabilities information. 2) Temporal Characteristics: IFAT: Moving to timing features, it has been demonstrated that IFAT characterizes the transmission behavior of a device [4]. In this work, the IFAT is computed as the time difference between two consecutive Probe Requests from the same MAC address: IFATn = Timestampn − Timestampn−1 .
(1)
Frames are first grouped into bursts, which are consecutive frames that share the same source MAC address and for which the elapsed time between frames is below 1 second. Although
TABLE II D EVICES WITH THE NUMBER OF TRANSMITTED P ROBE F RAMES AND OBSERVED W I -F I PHY TYPES ID Model B Xiaomi Redmi 4 E Xiaomi Mi A2 Lite J Xiaomi Redmi 5 Plus A Samsung Galaxy M31 C Samsung Galaxy S4 D Huawei P8 Lite G Huawei P20 H Samsung Gal. S6 Edge+ I Samsung Galaxy S7 K Samsung Galaxy J6 L Google Pixel 3a M Apple iPhone XS Max N Apple iPhone 6 O OnePlus Nord Q Huawei P10 R Honor 9 S Xiaomi Redmi Note 7 T Xiaomi Redmi Note 9S U Apple iPhone XR V Google Pixel 3a W Apple iPhone 12 X Apple iPhone 7
Number of PHY Standard Probe Requests
HT Capabilities Information
129
4&6
b/g
NaN
115
4&6
b/g
NaN
123, 42
4&6
b/g
0x016e, NaN
45
4
b
0x012d
1236
4
b
0x102d
6
4
b
0x102c
617 12
4 4
b b
0x0121 0x1163
28
4
b
0x1163
34
4
b
0x0021
54
4
b
NaN
2, 19
4
b
0x002d, 0x402d
27
4
b
0x4021
62
4
b
0x01ad
98 287 64
4 4 4
b b b
0x01ad 0x0021 0x012d
17
4
b
0x01ad
5
4
b
0x002d
27
4
b
NaN
539
4
b
0x402d
7
4
b
0x402d
original values using Log-Normal Shadowing Model (LNSM) with dynamic variance that depends on the distance from the STA to the sniffer. Using a fixed variance would be unrealistic because, in real-world scenarios, signal fluctuations depend on environmental conditions and vary with distance due to phenomena such as multipath, reflections, and shadowing. Therefore, we compute a signal decay based on a path loss index and use random Gaussian noise N (0, σ(d)2 ), where the dynamic variance σ(d) is determined by applying a cubic function based on the device’s distance (σ(d) = ad3 + bd2 + cd + e). The specific coefficients (a = −0.0493, b = 0.3938, c = −0.5599, e = 0.4745) are derived from [11]’s indoor experiment (collected from a 15 × 10 hall). We assume that the signal captured from a given frame remains fixed during its entire transmission duration. To simulate spatial characteristics, device positions are uniformly distributed within a circular area with a radius of 5 meters, and the Euclidean distance between the device and the sniffer is computed. Because a 5-meter radius simulates an area of 10-meter diameter, this scenario actually fits within the physical dimension of [11]’s 15-by-10 meter experiment hall. However, as a limitation, these coefficients represent a specific environment and do not generalize to all spatial contexts. Assuming that devices remain static, three experimental configurations are evaluated: without RSSI (Scenario 1), a single central sniffer (Scenario 2), and three sniffers arranged in a triangular topology (Scenario 3). 4) Normalization: Feature standardization is required before unsupervised clustering due to the varying scales and units (e.g., dBm, milliseconds, and binary flags) in the dataset. Without normalization, high-range variables like RSSI would dominate the model, minimizing the contribution of smallerrange or binary variables like the HT capabilities subfields. B. Clustering Algorithms
Note: Some devices exhibited two different HT capabilities information fields during the capture, resulting in two distinct Probe Request counts.
Probe Requests that belong to the same burst are transmitted only a few tens of milliseconds apart, the complete burst transmission lasts only a few hundred milliseconds. However, the active scanning process of a STA may involve probing across multiple channels [5], causing the inter-burst time to span several seconds or, in some cases, minutes. Once the bursts are identified, the mean IFAT is computed and assigned uniformly to all frames, including the first one, ensuring that every frame has an associated value. 3) Spatial Characteristics (Simulated RSSI): As captured frames lack environmental context (they were extracted by filtering RSSI), new RSSI values are simulated to replace the
Three unsupervised clustering algorithms are evaluated: KMeans, DBSCAN, and OPTICS. On the one hand, K-Means has a lower computational complexity, O(knT ) (Algorithm 1), where k is the number of clusters, n is the number of samples, and T is the number of iterations. However, it requires the number of clusters to be predefined. This limitation is addressed by DBSCAN (Algorithm 2), which automatically identifies clusters. Moreover, it does not force all samples into clusters; samples with uncertain assignments can instead be treated as outliers. Moreover, DBSCAN assumes that clusters exhibit similar densities. Since devices may generate different numbers of Probe Frames, OPTICS is also considered (Algorithm 3), as it better handles clusters with varying densities. Both DBSCAN and OPTICS have a worst-case computational complexity of O(n2 ) [12]. C. Evaluation Metrics Unsupervised clustering performance is assessed using four metrics: Global Accuracy, Precision, Recall, and Individual Device Accuracy. Although the clustering algorithms used are
Algorithm 1 K-Means Algorithm
Algorithm 3 OPTICS Algorithm
Require: Dataset X, number of clusters k Ensure: Cluster assignments L and centroids C 1: Randomly initialize the centroids C = {c1 , c2 , . . . , ck } 2: Initialize an empty labels array L = {l1 , l2 , . . . , ln } 3: repeat 4: for each data point xi ∈ X do 5: Calculate the distance of xi to all centroids cj ∈ C 6: Assign xi to the closest centroid cj ∈ C 7: Update label li = j 8: end for 9: for each cluster j ∈ {1, . . . , k}P do 10: Update centroids cj ← |S1j | xi ∈Sj xi 11: end for 12: until centroids do not change or maximum iterations reached 13: return L, C
Require: Dataset X, maximum radius ϵmax , minimum points smin , Ensure: Cluster assignments L 1: Compute core dist[p] for all p ∈ X 2: Initialize arrays: reach ← ∞, processed ← 0, L ← −1 3: Initialize list Order ← [] 4: cluster id ← 0 5: while there exists p ∈ X where processed[p] = 0 do 6: p ← unprocessed point with the minimum reach value 7: processed[p] ← 1 8: Append p to Order 9: if core dist[p] ≤ ϵmax then 10: for each unprocessed neighbor q within ϵmax do 11: new reach ← max(core dist[p], Distance(p, q)) 12: reach[q] ← min(reach[q], new reach) 13: end for 14: end if 15: end while 16: for each p ∈ Order do 17: if reach[p] > ϵ and core dist[p] ≤ ϵ then // New cluster 18: cluster id ← cluster id + 1 19: L[p] ← cluster id 20: else if reach[p] ≤ ϵ then 21: L[p] ← cluster id // Current cluster 22: end if 23: end for 24: return L
Algorithm 2 DBSCAN Algorithm Require: Dataset X, radius ϵ, minimum points smin Ensure: Cluster assignment L 1: cluster id ← 0 2: Compute ϵ-neighborhood N [p] for all p ∈ X 3: core point ← {p ∈ X | |N [p]| ≥ smin } 4: Initialize L[p] ← −1 for all p ∈ X 5: for each p ∈ core point where L[p] = −1 do 6: L[p] ← cluster id 7: Initialize stack S ← [p] 8: while S is not empty do 9: q ← S.pop() 10: if q ∈ core point then 11: for each n ∈ N [q] where L[n] = −1 do 12: L[n] ← cluster id 13: S.push(n) 14: end for 15: end if 16: end while 17: cluster id ← cluster id + 1 18: end for 19: return L
where TP stands for True Positives, FP for False Positives, and M for the total number of devices. • Recall: The ratio of correctly clustered Probe Requests to the total number of Probe Requests actually transmitted by that device. Just as with precision, the final recall is the unweighted mean of the recall scores across all devices. M
Recall =
unsupervised, we evaluate their performance using metric associated with supervised learning. This was possibly due to the availability of ground-truth labels in the dataset, which allows us to directly compare the unsupervised cluster assignments against the true device identities. The metrics are defined as follows: Global Accuracy: The ratio of correctly classified Probe Requests to the total number of Probe Requests in the dataset. • Individual Accuracy: Follows the same principle as global accuracy, but for each specific device. • Precision: The ratio of Probe Requests correctly assigned to a device to the total number of Probe Requests assigned to that device’s mapped cluster. The final metric is the unweighted mean of the precision scores across all devices. This ensures that every device contributes equally to the final score, regardless of its number of Probe Requests.
•
M
Precision =
1 X TPi , M i=1 TPi + FPi
(2)
1 X TPi , M i=1 TPi + FNi
(3)
where FN stands for False Negatives. Because the clusters generated by unsupervised algorithms are not labeled, it is necessary to map the predicted clusters to the corresponding ground-truth labels in the dataset. This is achieved using the Hungarian algorithm, which efficiently finds the assignment that maximizes the number of correct matches without requiring the evaluation of all possible permutations [13]. It should be noted that outlier samples labeled as -1 by DBSCAN and OPTICS are excluded from the contingency matrix used for the cluster-to-label mapping. Because -1 samples are not part of any cluster, including these instances disrupts the algorithm’s ability to find the optimal mapping. However, these outliers are included in the computation of all evaluation metrics, since any Probe Requests labeled as -1 represent a mistake of the algorithm to assign them to their correct device cluster. III. E XPERIMENTAL S ETUP This section outlines the experimental configurations used to evaluate the clustering performance. Before doing so, we first justify the features selected using a feature importance analysis.
A. Feature Importance Analysis Feature importance is analyzed using an Random Forest (RF), which evaluates the contribution of temporal, spatial, and protocol-level features. Specifically, it focuses on three key comparisons to justify the decomposition of HT capabilities information, the impact of temporal information (IFAT), and the influence of spatial information (RSSI). While not shown here for the sake of space, the results consistently showed the great importance of specific HT capabilities subfields. Additionally, IFAT was revealed as one of the top three most important features. Finally, when RSSI values were incorporated, whether using one or three signals, they always reached the highest position in the feature hierarchy. Based on the feature importance results obtained from the RF models across miscellaneous scenarios, a final set of features was selected for the unsupervised clustering stage. The ones that consistently showed zero importance, such as channel, rates, ext_rates, and vht_caps, were excluded from the final feature set. Nevertheless, special consideration was given to the ssid field. Although it often returned a near-zero importance score (because most Probe Requests in the dataset used wildcard Service Set Identifiers (SSIDs)), it was retained. This decision was driven by the fact that some devices still broadcast specific SSIDs, which can serve as an additional feature that could improve the identification of devices that share similar HT specifications. Additionally, the derived feature oui_from_mac is obtained from the first 24 bits of the resolved MAC address to serve as an extra vendor identifier alongside oui. The final consolidated feature set used for clustering includes: Temporal markers: time and time_diff (IFAT). • Hardware identifiers: Decomposed HT subfields (or raw ht_caps), htex_caps, and ampdu. • Vendor information: oui and oui_from_mac. • Spatial information: Simulated RSSI (single/tri-sniffer). •
B. Scenarios and Configurations Using the feature set justified above, we construct 12 distinct experimental configurations. Specifically, three spatial scenarios with different feature sets were considered to reflect different levels of an eavesdropper’s infrastructure and physical tracking capabilities: Scenario 1 (Without RSSI): Passive attack relying solely on Frame headers and IFAT timing. • Scenario 2 (Single-Sniffer, SRSSI): One monitoring node providing a single RSSI per Frame. • Scenario 3 (Multi-Sniffer, Multi-Simulated Received Signal Strength Indication (MSRSSI)): Three nodes in a triangular topology providing three RSSI values per Frame. •
Within each scenario, four distinct setups are tested to evaluate the contribution of specific features: •
Raw/Decomposed Feature Representation: Comparing the use of the raw Hexadecimal ht_caps string against the decomposed binary subfields.
TABLE III E XPERIMENTAL CONFIGURATIONS : SPATIAL SCENARIOS AND FEATURE SETUPS .
Spatial Scenario Scenario
1
2
3
Feature Setup
Description
ID
Description
Without RSSI
S1.1 S1.2 S1.3 S1.4
Raw ht_caps, w/o IFAT Raw ht_caps, w/ IFAT Decomposed subfields, w/o IFAT Decomposed subfields, w/ IFAT
Single-sniffer
S2.1 S2.2 S2.3 S2.4
Raw ht_caps, w/o IFAT Raw ht_caps, w/ IFAT Decomposed subfields, w/o IFAT Decomposed subfields, w/ IFAT
Multi-sniffer
S3.1 S3.2 S3.3 S3.4
Raw ht_caps, w/o IFAT Raw ht_caps, w/ IFAT Decomposed subfields, w/o IFAT Decomposed subfields, w/ IFAT
TABLE IV H YPERPARAMETER CONFIGURATIONS FOR THE UNSUPERVISED CLUSTERING ALGORITHMS . Algorithm
Hyperparameter
Configured Value
K-Means DBSCAN DBSCAN OPTICS OPTICS
Clusters (k) min samples Epsilon (ϵ) min samples Steepness (ξ)
5, 10, 15, or 22 (Dataset dependent) 5 Dynamic (Optimised) 5 0.2
With/Without Temporal Information: Evaluating the models both with and without the IFAT. So in total, there are 12 experimental configurations illustrated in Table III. Each configuration is evaluated across four device densities (5, 10, 15, and 22 devices). For the 5, 10, and 15 devices, five random subsets of devices are generated without replacement, and results are averaged across these iterations. For the 22-device case, the full dataset is used, so only a single result is obtained, and no averaging is required. •
IV. R ESULTS AND D ISCUSSION This section presents the evaluation of the proposed unsupervised clustering algorithms (K-Means, DBSCAN, and OPTICS) across three spatial configurations and different device densities. Next, we analyze the individual accuracy per device, and finally, we summarize the main challenges identified during the evaluation and potential directions for future work. A. Clustering Performance Table IV summarizes the specific parameter configurations used to evaluate these algorithms. 1) Scenario 1 (Without RSSI): Scenario 1 evaluates the baseline clustering performance, where the assumption is that only the Probe Frame header and temporal information are available. Because they must rely entirely on the fingerprint
of the device, this scenario is susceptible to possible hardware collisions when devices from the same manufacturer are present in the same environment. The overall results of this scenario across different device densities are illustrated in Fig. 2. It was observed that decomposing HT capabilities information into individual subfields consistently improved clustering performance compared to using the raw hexadecimal representation. The impact of this decomposition was most noticeable in K-Means, where average accuracy increased significantly, though its performance still progressively decreased as the number of devices increased and the feature space became more crowded. DBSCAN demonstrated greater robustness under these decomposed setups, yielding an average global accuracy of 88.28%. In contrast, OPTICS generally underperformed in comparison to both K-Means and DBSCAN. Regarding temporal data, IFAT often improved cluster separation for K-Means. Conversely, IFAT negatively affected DBSCAN’s performance, as the algorithm interprets this temporal variability as noise, which weakens density consistency and can fragment otherwise stable clusters. 2) Scenario 2 (SRSSI): Scenario 2 introduces spatial information into the clustering environment by simulating a single RSSI value. As a spatial feature, RSSI cannot give the exact device’s position, but it can provide an estimated distance, which could be advantageous to the clustering models. The clustering performance under this second scenario is illustrated in Fig. 3. The addition of this spatial data improved the performance of all three clustering algorithms compared to scenario 1. The necessity of decomposing the HT capabilities information remains evident even with the inclusion of spatial data. With the decomposed setup, DBSCAN demonstrated strong robustness and achieved the highest overall performance, reaching an accuracy of 88.60% for 22 devices. KMeans also benefited from the inclusion of SRSSI in less crowded environments, but it failed to maintain this improvement as the number of devices increased. On the other hand, OPTICS showed only slight improvements, exhibiting a performance significantly inferior to the other two algorithms. For DBSCAN, the inclusion of IFAT remained unfavorable, as it introduced noise despite the better separation provided by HT capabilities information decomposition and SRSSI. 3) Scenario 3 (MSRSSI): Scenario 3 introduces a more robust spatial configuration into the clustering environment by simulating three RSSI values from three different sniffers. Adding two additional RSSI values provides more spatial information to better determine the physical location of the Probe Frame in the space. The effect of incorporating RSSI measurements from three spatially separated sniffers on clustering accuracy is detailed in Fig. 4. Consequently, the inclusion of multi-sniffer RSSI measurements achieved the best performance in the three scenarios. The use of three RSSI signals allows the algorithms to more effectively cluster Probe Frames originating from the same physical space independently of the randomized MAC address or devices with identical HT capabilities information. Even with the inclusion of three RSSI signals, decomposing the HT capabilities information
TABLE V P ER - DEVICE ACCURACY UNDER S3.3 (22 DEVICES , DBSCAN). S HADING : ≥80% , 50–79% , 1–49% , 0% . T HE THIRD COLUMN FOR EACH DEVICE INDICATES THE NUMBER OF MATCHED / TOTAL P ROBE R EQUESTS .
Device
Acc.
A B C D E G H I J K L
88.9% 100.0% 100.0% 100.0% 0.0% 100.0% 100.0% 100.0% 44.2% 82.4% 0.0%
Matched/Total Device 40/45 129/129 1236/1236 6/6 0/115 617/617 12/12 28/28 73/165 28/34 0/54
M N O Q R S T U V W X
Acc.
Matched/Total
90.5% 100.0% 14.5% 100.0% 100.0% 100.0% 70.6% 0.0% 0.0% 100.0% 0.0%
19/21 27/27 9/62 98/98 287/287 64/64 12/17 0/5 0/27 539/539 0/7
from a raw 16-bit hexadecimal string to individual subfields remains critical to obtain high accuracy. In the 22-device environment, DBSCAN reported an accuracy of 89.60% with decomposed HT capabilities information, which corresponds to a 22.85% increase compared to not using decomposition. K-Means achieved better results than in scenarios 1 and 2, but it still failed to correctly cluster approximately 40% of the Probe Frames in the 22-device environment. OPTICS also showed its best performance in this scenario, but its overall accuracy remained significantly inferior to DBSCAN. Fig. 5 presents global accuracy, precision, and recall for the 22-device environment under S3.3. DBSCAN achieves 72.4% precision and 66.5% recall, substantially ahead of K-Means (61.6% and 62.2%) and OPTICS (30.4% and 24.5%).
B. Individual Device Analysis While setup S3.3 (Decomposed subfields, w/o IFAT) achieved a high global accuracy of 89.6% using DBSCAN, this result can be misleading. Because devices do not transmit the same number of Probe Frames, this class imbalance has an impact on individual identification accuracy (Table V). Devices with very few samples are frequently misclustered; for example, sparse transmitters like devices O and T are often absorbed by dominant devices like Q. Consequently, extreme minority classes (such as U, V, and X) exhibit 0% individual accuracy. Due to their sparse data, these Probe Frames are easily absorbed into the closest dominant neighboring clusters. Devices L and V overlap and cluster with device B, while device U is absorbed by device W. Beyond sparse data, the clustering task is further complicated when a single device broadcasts two different HT capabilities information values. This is seen with devices J and M, where the use of multiple signatures makes it nearly impossible to achieve 100% individual accuracy. By splitting their Probe Frames across different configurations, their maximum accuracies were limited to 44.2% and 90.5%, respectively.
Accuracy (%)
Raw HT capabilities information 100 90 80 70 60 50 40 30 20 10 0
84
80
80 72
81
80
79
82
80
58
62
49
53
54
58 46 55
46
45 40
26 23
13
5
4
10 15 Number of Devices
22
Decomposed HT capabilities information 100 90 80 70 60 50 40 30 20 10 0
90
90
87 78 86 68
87
87
84
86 75
70 64
63 53
51 51
50
62
36 38 22
5
5
K-Means DBSCAN OPTICS K-Means (IFAT) DBSCAN (IFAT) OPTICS (IFAT)
28
10 15 Number of Devices
22
Fig. 2. Clustering accuracy vs. device count for Scenario 1 (without RSSI). Left: raw hexadecimal HT capabilities information (S1.1, S1.2). Right: bitwisedecomposed HT capabilities information (S1.3, S1.4). Solid lines: without IFAT; dashed lines: with IFAT.
Accuracy (%)
Raw HT capabilities information 100 90 80 70 60 50 40 30 20 10 0
93
93 86
84
89
87
84
83
64 68 64
54
51 46
51 46
31
62
48
47 48
43
38
30
5
10 15 Number of Devices
22
Decomposed HT capabilities information 100 90 80 70 60 50 40 30 20 10 0
92 87
95
92 92
90
90
89
88
87
64 63
46
29
64
56 56 50 53
54 54
62
39
K-Means DBSCAN OPTICS K-Means (IFAT) DBSCAN (IFAT) OPTICS (IFAT)
28
5
10 15 Number of Devices
22
Fig. 3. Clustering accuracy vs. device count for Scenario 2 (single-sniffer RSSI). Left: raw HT capabilities information (S2.1, S2.2). Right: decomposed HT capabilities information (S2.3, S2.4). Solid: no IFAT; dashed: with IFAT.
C. Key findings and future directions The individual analysis revealed three primary challenges that limit obtaining higher accuracy: Low-frequency transmitters: Devices that transmit very few bursts of Probe Frames do not generate sufficiently dense regions to be considered clusters. • Absence of HT capabilities information: Devices that do not broadcast HT capabilities information provide less identifying information, forcing algorithms to rely on weaker secondary features or spatial proximity. • Multiple HT capabilities information signatures: Individual devices can alternate HT capabilities information over time, making it difficult to cluster all their Probe Frames into a single device entity. •
Future work could include extending this study to newer Wi-Fi standards such as Very High Throughput (VHT), High Efficiency (HE), and Extremely High Throughput (EHT). Additionally, temporal models such as Long Short-Term Memory (LSTM) networks could be investigated to better capture
user mobility and changes in device behavior in real-world scenarios. V. C ONCLUSIONS The main objective of this study was to evaluate the tracking capabilities of an eavesdropper to expose the vulnerabilities of Wi-Fi MAC address randomization. Our findings demonstrate that the information inherent in Probe Requests is sufficient to bypass such a privacy measure using Machine Learningbased fingerprinting. By evaluating static, temporal, and spatial features across three clustering algorithms, we found that decomposing the raw hexadecimal HT capabilities information into 16-bit individual subfields is critical for accurate device separation. Furthermore, while IFAT introduced noise for density-based algorithms, the integration of simulated spatial data (RSSI) from a multi-sniffer architecture significantly improved identification. Overall, DBSCAN was shown to be the most robust model with a global accuracy of 89.6% across 22 devices. These insights can serve as a reference for future Wi-Fi standards to enhance privacy protocols.
Accuracy (%)
Raw HT capabilities information 100 90 80 70 60 50 40 30 20 10 0
92
Decomposed HT capabilities information 100 90 80 70 60 50 40 30 20 10 0
89 83
92 68 73
68 82
71
78
56 58 57
73
82 77
72 66
72
64
51 52
54
43
5
10 15 Number of Devices
22
95
93
90
81 93 81
90 93
74
89
88 78
78
71 59 59
64
73
60
64
59
62
56 43
5
10 15 Number of Devices
K-Means DBSCAN OPTICS K-Means (IFAT) DBSCAN (IFAT) OPTICS (IFAT)
22
Percentage (%)
Fig. 4. Clustering accuracy vs. device count for Scenario 3 (multi-sniffer RSSI). Left: raw HT capabilities information (S3.1, S3.2). Right: decomposed HT capabilities information (S3.3, S3.4). Solid: no IFAT; dashed: with IFAT.
100
89.6 72.4 58.9
61.6
62.2
66.5
63.5
50
30.4
24.5
0 K-Means
DBSCAN Accuracy
Precision
OPTICS Recall
Fig. 5. Global accuracy, precision, and recall for all three algorithms under setup S3.3 (22 devices, decomposed HT capabilities information, three RSSI signals, no IFAT).
ACKNOWLEDGMENT This work was supported by the following projects: TRUE Wi-Fi PID2024-155470NB-I00 (MICIU/AEI/10,13039/501100011033/FEDER,UE), ICREA Academia 2024 (00077 AGAUR), MdM CEX2021001195-M (MICIU/AEI/10.13039/501100011033), and by NextGenerationEU (Italian NRRP, Mission 4, Component 2, Investment 1.2, CUP F23C25000440006). R EFERENCES [1] J. Henry, B. Hart, B. Gupta, and M. Smith, Wi-Fi 7 In Depth: Your Guide to Mastering Wi-Fi 7, the 802.11be Protocol, and Their Deployment. Pearson Education (Cisco Press), 2024. [2] M. Vanhoef, C. Matte, M. Cunche, L. S. Cardoso, and F. Piessens, “Why MAC Address Randomization is not Enough: An Analysis of Wi-Fi Network Discovery Mechanisms,” in Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, ser. ASIA CCS ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 413–424. [3] J. Freudiger, “How talkative is your mobile device? an experimental study of Wi-Fi probe requests,” in Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks, ser. WiSec ’15. New York, NY, USA: Association for Computing Machinery, 2015. [4] C. Matte, M. Cunche, F. Rousseau, and M. Vanhoef, “Defeating MAC Address Randomization Through Timing Attacks,” in Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks, ser. WiSec ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 15–20.
[5] W. Praharenka and I. Nikolaidis, “Identifying device type from cross channel probe request behavior,” in Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, ser. WiSec ’21. New York, NY, USA: Association for Computing Machinery, 2021, p. 392–394. [6] L. Pintor and L. Atzori, “A dataset of labelled device Wi-Fi probe requests for MAC address de-randomization,” Computer Networks, vol. 205, p. 108783, 2022. [7] L. Pintor, “Advancements in Wi-Fi-Based Passenger Counting and Crowd Monitoring: Techniques and Applications,” Ph.D. dissertation, Università degli Studi di Cagliari, 2024, ph.D. dissertation. [Online]. Available: https://hdl.handle.net/11584/394767 [8] F. Cifuentes-Urtubey and R. Kravets, “Poster: Can You Find Me?: Linking Devices Despite Wi-Fi MAC Randomization at MobiCom 2023,” in Proceedings of the 30th Annual International Conference on Mobile Computing and Networking, ser. ACM MobiCom ’24. New York, NY, USA: Association for Computing Machinery, 2024, p. 1668–1670. [9] A. Pérez-Hernández, M. N. Barreras-Martı́n, J. A. Becerra, M. J. Madero-Ayora, and P. Aguilera, “De-Randomization of MAC Addresses Using Fingerprints and RSSI With ML for Wi-Fi Analytics,” IEEE Access, vol. 12, pp. 150 857–150 868, 2024. [10] IEEE Standards Association, “IEEE P802.11n™/D11.0 Draft STANDARD for Information Technology— Telecommunications and information exchange between systems— Local and metropolitan area networks— Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications Amendment 5: Enhancements for Higher Throughput,” Institute of Electrical and Electronics Engineers, IEEE Draft Standard IEEE P802.11n/D11.0, jun 2009. [11] X. Jiuqiang, W. Liu, F. Lang, Y. Zhang, and C. Wang, “Distance measurement model based on RSSI in WSN,” Wireless Sensor Network, vol. 2, pp. 606–611, 01 2010. [12] scikit-learn, “Clustering,” https://scikitlearn.org/stable/modules/clustering.html, scikit-learn, 2026, accessed: 2026-05-08. [13] J. Gil-Aluja, The Hungarian assignment algorithm. Boston, MA: Springer US, 1998, pp. 148–158.