To preserve people privacy and prevent device (and people) tracking, WiFi MAC address randomization is been introduced by an ever increasing number of operating systems. Accordingly, mobile devices make use of different virtual addresses over time so that not a single fixed factory address is used that may identify a specific user. This has the consequence that it is not even possible to extract anonymous information on people mobility by analyzing WiFi traffic traces, which would be useful for many purposes (e.g., counting the number of people in a mass transport vehicle).To address this issue, in this paper we propose a novel MAC address de-randomization algorithm which groups specific messages (i.e., the Probe Requests) generated by the same physical device. With respect to past works, we consider a combination of the features that have been previously considered in isolation, which are associated to the content and length of the optional fields conveyed in the sent frames and the rate at which the frames are numbered over time. These features are then used by density-based clustering algorithms (i.e., DBSCAN, OPTICS, HDBSCAN) to group frames sent by the same device. Additionally, we consider the presence of pseudo-random MAC addresses, which are those that do not change every frame but only when the emitting device switches on and off the WiFi interface. To this, we have developed an heuristic to detect these sequences of frames so as to improve the algorithm efficacy. Experiments have been initially performed in a controlled environment where we reached an accuracy close to 96%. Then, experiments in a real scenario have been conducted where the people taking the bus when moving in an urban area have been counted; in such a scenario an average accuracy of 75% has been obtained.
