Acoustic Fingerprinting Revisited: Generate Stable Device ID Stealthy with Inaudible Sound

• Existing device IDs can be blocked or permission-restricted, while newer hardware fingerprints were not yet stable or accurate enough for real-world use.Source: §1 · p. 1
• The method fingerprints smartphones using speaker frequency response, with uniqueness, robustness, and stealth as its goals.Source: §1 · pp. 1–2
• It uses high-frequency sound and a carefully controlled frequency pattern to make stimulation unnoticeable while reducing noise and speaker nonlinearity effects.Source: §1 · p. 2
• Feature extraction and matching use self-correlation and cross-correlation rather than complex machine-learning algorithms.Source: §1 · p. 2
• The prototype produced a very stable device ID with negligible false positive and false negative rates.Source: §1 · p. 2

2.1 Application Scenarios

• Self-fingerprinting identifies the phone running an app, while cross-fingerprinting identifies another phone whose app periodically plays crafted audio.Source: §2.1 · p. 2
• The proposed fingerprint can support cookie replacement, indoor tracking, and tracking stolen smartphones.Source: §2.1 · p. 2

2.2 Assumptions

• The method assumes audio playback, microphone recording, and sending the preprocessed feature to a server; microphone access is its only necessary permission.Playback is described as requiring no permission; the paper also describes a way to bypass Internet permission.Source: §2.2 · p. 2

3.1 Three Goals to Be Achieved

• A cookie substitute should distinguish devices, remain consistent across times and scenarios, and be unnoticeable to device owners.Source: §3.1 · p. 3

3.2 Our Key Techniques

• The key technique records a phone speaker responding to high-frequency audio with a special pattern.Source: §3.2 · p. 3

3.2.1 Be Stealthy with High Frequency Audio

• High-frequency sound supports stealth because people are less sensitive to frequencies above the range they readily hear.The passage notes that people can hear little below 200 Hz or above 15 kHz at phone-generated sound levels.Source: §3.2.1 · p. 3

3.2.2 Be Unique with High Frequency Audio

• Speaker frequency responses are similar at low frequencies but differ substantially at high frequencies, providing individual variation for fingerprints.Source: §3.2.2 · p. 3

3.2.3 Be Robust with Controlled Stimulus Patterns

• A controlled audio-wave pattern is intended to make fingerprints more robust to random and nonlinear factors and less vulnerable to noise.The paper attributes robustness to controlled stimulation in a frequency range little interfered with by the environment.Source: §3.2.3 · p. 4

4.1 Stimulation Generation

• The phone actively plays synthetic sound and records its microphone response, using a 14–21 kHz cosine-wave series with 100 Hz spacing as stimulation.The PCM input sample rate is 44,100 Hz.Source: §4.1 · p. 4

4.2 Feature Generation

• The feature uses the recording spectrum divided by the input to estimate frequency response, with the recording spectrum calculated by FFT.Division can be omitted because input magnitudes are constant across frequency points and the response is normalized later.Source: §4.2 · p. 4
• The measured response represents the whole acoustic chain, treated as an amplified or diminished version of the speaker response because other chain components contribute little variance.The media, microphone, and chip are regarded as flat systems over the frequency range.Source: §4.2 · p. 4
• The feature retains magnitudes at effective frequency points, excluding gaps containing only noise and omitting phase because it is easily affected by the environment.The representation is a vector of 71 effective magnitudes, chosen partly to preserve sufficient signal-to-noise ratio.Source: §4.2 · p. 4

4.3 Feature Matching

• Matching compares feature vectors by distance; a sufficiently close vector is assigned to an existing device profile, otherwise a new profile is created.The experiment uses brute-force nearest-vector search and a distance threshold of 0.7; the authors note this search becomes impractical at very large scale and propose fuzzy search alternatives.Source: §4.3 · p. 5

5.1 Experiment Setting

• The experiment uses normal office noise and allows classmates’ conversation to emulate common conditions and assess noise levels in the high-frequency range.The setup collects 60 response-feature sets per emulated phone, totaling 3,000 vectors.Source: §5.1 · p. 5

5.2 Metrics

• Feature distance is defined as Euclidean distance between N-dimensional feature vectors, while similarity measures how likely two features came from the same phone.The vectors are denoted p and q, with components p0 through pN−1 and q0 through qN−1.Source: §5.2 · p. 5

5.1 Experiment Setting

• Figure 5 presents the experiment equipment; the setup modifies a Samsung Galaxy S3 with a pluggable speaker interface for testing 50 OEM speakers from one assembly line.The evaluation focuses on speakers from the same phone model.Source: Figure 5 · p. 5, §5.1 · p. 5

5.2 Metrics

• A false positive is one phone being recognized as another, a false negative is failure to find a database match for a phone already represented, and entropy is log2 of the distinguishable-set size.The distinguishable set contains elements that can all be distinguished from one another by the produced feature.Source: §5.2 · p. 5

5.3.1 Distribution of similarity

• The maximum simcorr similarity is below the minimum simself similarity, creating a gap used to classify a new feature by its nearest-neighbor similarity.A value to the right of the gap is treated as the same device; otherwise, the feature is treated as coming from an unknown device.Source: §5.3.1 · pp. 5–6

5.3.2 Distribution Fitness

• Both same-phone and different-phone distances fit a lognormal distribution among the 20 continuous distributions tested.The fitted parameters are µ = −3.17698, σ = 0.546804 for one distribution and µ = −0.457726, σ = 0.178714 for the other; the supplied passages do not identify which parameter pair belongs to which distribution.Source: §5.3.2 · p. 6

5.3.3 Scale

• The fitted simcorr parameters converge to constants as device quantity increases, supporting the authors’ assumption that the model applies at large scale.The authors infer from this convergence that error rate does not increase with device quantity.Source: §5.3.3 · p. 6

5.3.4 Error Rate Analysis

• Lowering α increases false positives, while raising it increases false negatives; the authors tune α to balance the two rates.The overall error is defined as the sum of false-positive and false-negative rates.Source: §5.3.4 · pp. 6–7
• At α = 0.69, the estimated error rate is around 1.55*10−4; two samples yield around 1.41*10−8 at α = 0.68, and three samples yield 1.23*10−12.The single-sample threshold balances false-positive and false-negative rates; the authors describe repeated samples as independent.Source: §5.3.4 · p. 7

5.4 Stability

• Across hourly samples, within-phone similarity showed no obvious decrease and similarity between two phones showed no obvious increase, supporting long-term stability.The test sampled two speakers, collecting 60 feature vectors per phone.Source: §5.4 · p. 7

5.5 Interference

• The scheme worked in office and street environments but failed in the metro test, where noise spanned the sampled frequencies.The tested high-frequency range was 14–21 kHz; office and street noise was outside that effective band, while metro noise overwhelmed the broadcast signal.Source: §5.5 · p. 8
• At α = 0.7, the required SNR is 10 dB in the effective frequency band.The SNR calculation assumes little correlation between signal and noise and zero expected mean noise; noise power is counted only at the effective frequency points.Source: §5.5 · p. 8

5.6 Entropy

• The analysis treats the error rate as determining distinguishable device count, with approximately 1/error_rate devices distinguishable at that error rate.The authors state that entropy is at least log2N bits to distinguish N devices in a round of identification.Source: §5.6 · p. 9
• The authors estimate 12.6 bits of entropy with one feature vector, 26 bits with two, and 39.6 bits with three.They derive entropy as −log2(error_rate), treating approximately 1/error_rate devices as distinguishable.Source: §5.6 · p. 9

6. APPLICATION

• The paper presents the device ID as useful beyond cookie replacement, including stolen-phone tracking and indoor applications.The applications section describes tracing and self-destruction, location relay, and indoor tracking.Source: §6 · p. 9, §6.1 · p. 9, §6.2 · p. 9

6.1 Stolen phone tracing and self-destruction

• A speaker-based ID can support stolen-phone checks after resets or reflashing because software changes cannot alter the hardware-based identifier.System vendors could test the ID discreetly and check it against a stolen-phone database; changing the hardware would require costly parts, time, and skills.Source: §6.1 · p. 9

6.2 Location information broadcast and relay

• Phones can relay location through specially crafted sound: nearby devices cross-fingerprint the signal, retrieve a location associated with its ID, and rebroadcast their identity.The scenario starts with one conference-room phone sharing GPS-derived location information through a server database.Source: §6.2 · p. 9

6.3 Indoor tracking

• In supermarkets, microphones can capture phones’ periodically broadcast IDs and use microphone locations to infer shoppers’ routes and associate IDs with purchases.The proposed scenario triggers inaudible sound broadcasts when a user enters the store.Source: §6.3 · p. 9

7.1 Interference from background noises

• The method may fail to extract unique IDs in environments saturated with high-power noise, such as train stations or crowded restaurants.The authors suggest spread-spectrum modulation across frequencies from 14 kHz to 21 kHz, followed by filtering and de-spreading, as a possible adaptation for low-SNR conditions.Source: §7.1 · pp. 9–10

7.2 Device ID for smart phones of different models or from different manufacturers

• Evaluation covered 50 OEM Samsung Galaxy S3 speakers from one assembly line, while cross-manufacturer differentiation was assumed rather than tested.That assumption was supported by previous work [19]; the authors propose combining other hardware or device information if it fails.Source: §7.2 · p. 10

7.3 Detection of audio fingerprinting operation

• Code analysis may detect fingerprinting operations, but detection remains very hard when those operations also serve an application’s original function.The authors note that an app could disguise the processing as equalizer work while requesting microphone permission for another legal use.Source: §7.3 · p. 10

Software Fingerprint

• Software fingerprints use browser configuration, operating-system and application information, or network-protocol implementation differences to distinguish devices.Examples include user-agent strings, installed fonts and plugins, TCP initial window size, and IP header ID sequence generation.Source: §8 · p. 10

Hardware Fingerprint

• Hardware fingerprinting studies exploit differences in wireless NIC signals, accelerometer data, and camera patterns, though RF fingerprints lack a direct user-tracer link for Internet tracking.Accelerometer-based differentiation is described as coarse precision and requiring no active stimulation.Source: §8 · p. 10
• An earlier speaker-based scheme [19] did not establish its scale, evaluate cepstral-feature robustness, or propose a practical way to hide identification from users.Playing audible music as stimulation could attract users’ attention.Source: §8 · p. 10

Location Stealing

• Prior location-stealing work inferred position from public Android information, accelerometers, phone-carrying patterns, or probabilistic methods without GPS.Source: §8 · p. 10

9. CONCLUSION

• Speaker response curves differ between individual smartphones, enabling applications to generate distinct identities from those curves.Source: §9 · p. 10
• The authors characterize the identity as stable for long-term tracking and sufficiently high in entropy to cover phones worldwide.The conclusion says entropy is calculated from the size of the distinguishable-device pool, based on error rates derived from similarity distributions.Source: §9 · p. 10
• The scheme is reported to work in commonly encountered settings except those with annoying high-power noise, while narrow-range broadcasts may expose device location.Source: §9 · p. 10