Source-linked AI summary
PowerSpy: Location Tracking using Mobile Device Power Analysis
Yan Michalevsky, Gabi Nakibly, Aaron Schulman, Gunaa Arumugam Veerapandian, Dan Boneh
TL;DR
PowerSpy asks whether permission-free aggregate power readings, despite being noisy and considered benign, can reveal a phone user’s location. It uses machine learning on power-consumption time-series and demonstrates route identification, real-time tracking, and new-route inference, motivating stronger protection for seemingly benign sensors. The approach assumes route-related variability, sufficient communication activity, and a moving phone.
Problem
Mobile platforms protect GPS and coarse location data with permissions, but aggregate power usage can be read without permission and is highly noisy.
Method
PowerSpy applies machine learning to aggregate power-consumption time-series and reference profiles to infer routes and phone locations.
Results
The system demonstrates known-route identification, real-time tracking, and new-route identification using only phone power consumption.
Takeaways & Limitations
Seemingly benign power-monitor access can leak location information, suggesting such sensors need permission protection or additional security modeling.
Takeaways & Limitations
The attack assumes sufficient power variability and communication activity, and inconsistent phone usage across rides remains difficult to assess.
Abstract
from arXiv · showhide
Modern mobile platforms like Android enable applications to read aggregate power usage on the phone. This information is considered harmless and reading it requires no user permission or notification. We show that by simply reading the phone's aggregate power consumption over a period of a few minutes an application can learn information about the user's location. Aggregate phone power consumption data is extremely noisy due to the multitude of components and applications that simultaneously consume power. Nevertheless, by using machine learning algorithms we are able to successfully infer the phone's location. We discuss several ways in which this privacy leak can be remedied.
1 Introduction
PowerSpy shows that applications can infer a phone’s location from permission-free aggregate power measurements despite substantial noise. It frames three tracking goals and develops machine-learning methods based solely on power consumption.
- Privacy threat: Applications can infer phone location from aggregate power consumption without accessing protected location indicators.The approach uses the phone’s power meter, whose readings require no special permissions, rather than signal strength or GPS.
- Signal mechanism: Phone location affects cellular-radio power through distance to base stations and obstacles such as buildings and trees.Closer phones with fewer obstacles consume less power.
- Technical challenge: Aggregate power readings are noisy because many components, applications, and phone activities consume power simultaneously.The meter cannot isolate the cellular radio’s consumption, and radio usage also varies with activity such as calls and data transmission.
- Approach: Machine learning compares power-consumption time-series so measurements lasting several minutes can reveal location and movement through uncorrelated noise.The paper uses time-series classification and pattern matching for power profiles.
- Tracking goals: The evaluation targets route distinguishability, real-time motion tracking, and inference of new routes from measured short road segments.For new routes, the attacker composes reference profiles of short segments to identify the route and final location.
- Contributions: The work contributes privacy analysis of power meters, machine-learning techniques for location inference, and discussion of defenses against the leakage.Algorithmic details appear in later sections, followed by experimental results.
2 Threat Models
The threat model assumes a background malicious application with power-data and network access but no GPS, cellular-location, or WiFi-location permissions. The attack relies on prior route knowledge and moving phones, while its broader scalability remains constrained.
- Attacker capabilities: The malicious application runs in the background without permission to access GPS, cellular identifiers, WiFi networks, or other location data.It assumes access to power data and permission to communicate with a remote server.
- Prior knowledge: The attacker pre-measures route power profiles and correlates them with the target phone’s aggregate power usage to estimate location.Reference data may also be collected after obtaining unlabeled query data for a limited likely area.
- Scope conditions: The system requires a moving phone, such as one traveling by car or bus, because a stationary phone provides only a single-location profile.Multiple adjacent locations are needed for the attack.
- Scale: The study focuses on local routes in a predetermined area rather than worldwide coverage.Worldwide scaling would require pre-measuring road-segment power profiles on a much larger scale.
- Observed capability: The system correctly identifies the chosen route and tracks the phone’s real-time position along it.This demonstrates the type of information that an apparently innocuous power meter can leak.
3 Background
Location shapes cellular signal strength and modem power, producing stable, distinctive power patterns that can leak a phone’s movement and location. However, hysteresis and aggregate measurements constrain how broadly these patterns transfer.
- Location affects signal strength and power consumption: Distance, buildings, trees, and multipath interference affect cellular signal strength at a phone’s location.Distance determines free-space path loss, while obstacles attenuate signals and reflectors create multipath interference.
- Location affects signal strength and power consumption: Poor signal conditions can increase cellular device power draw by 50% compared with good signal conditions.The phone’s transmission power amplifier increases gain as signal strength drops; the effect also occurs during packet reception.
- Power usage can reveal location: Power measurements can reveal a stable, unique pattern for a particular drive, despite being less stable across separate drives.Small signal-strength differences can trigger different cellular modes or hand-offs, producing large power differences.
- Power usage can reveal location: Power variations are similar across two same-model phones on the same path, indicating measurements can be mostly stable across devices.The experiment used two Nexus 4 phones transmitting packets over their cellular links in the same vehicle.
- Power usage can reveal location: Different smartphone models also show similar power measurements on the same ride, potentially allowing one model to serve as another’s reference.This proof of concept used Nexus 4 and Nexus 5 phones, but the paper assumes reference measurements from the victim’s same model.
- Background summary and challenges: Hysteresis means reference measurements may need the same travel direction and complicates inference from individually recorded road segments.A phone’s attached base station and signal strength can depend on how it arrived at a location.
- Background summary and challenges: Inferring location must address speed and stop differences, matching among many profiles, and ambiguity from similar locations.These are identified as significant challenges when converting noisy power-meter measurements into location estimates.
4 Route distinguishability
Route distinguishability treats power profiles as time series and classifies a new profile against known routes using time-warped similarity. Preprocessing reduces baseline differences, noise, and computational cost before matching.
- Route distinguishability: Route distinguishability classifies a new power profile among known routes using collected route-associated training profiles.Each profile is compared as a time series, and the route with the most likely matching score is selected.
- Route distinguishability: Dynamic Time Warping measures similarity between temporal sequences that are misaligned or vary in time or speed.The method computes DTW distance between the new profile and reference profiles associated with known routes.
- Route distinguishability: The selected route is the reference route with minimal DTW distance, equivalent to 1-NN classification under the DTW metric.The unclassified sequence is compared with each reference sequence before choosing the minimum-distance route.
- Route distinguishability: Each profile is normalized by subtracting its mean and dividing by its standard deviation before DTW comparison.This addresses differences in profile baselines and variability.
- Route distinguishability: Moving-average smoothing reduces noise, while downsampling by a factor of 10 reduces computational complexity.Both operations are applied before comparing the normalized profiles.
5 Real-time mobile device tracking
Real-time tracking compares measurements accumulated during a drive with reference profiles and estimates the current location from the best partial match. A motion-model check suppresses implausible jumps, while OSB accommodates noise in both sequences.
- Real-time mobile device tracking: The tracking task assumes a known route but an unknown starting point and continuously estimates the device’s location as measurements arrive.The initial location prior is uniform, and the attacker has reference power profiles collected for the route.
- Real-time mobile device tracking: Subsequence DTW compares the accumulated measurement sequence with sub-sequences of larger reference profiles and returns offsets for location estimation.The approach uses measurements collected so far rather than requiring the entire route profile.
- Real-time mobile device tracking: The estimated location is associated with the end offset of the reference profile yielding the minimal DTW distance.The sequence accumulated since the beginning of the drive is searched across all reference profiles.
- Real-time mobile device tracking: A similarity threshold separates locked and unlocked states, enabling sanity checks only after the tracker has sufficiently matched the target.When the similarity is below the threshold, the tracker becomes unlocked and stops applying the sanity check.
- Real-time mobile device tracking: If a locked estimate implies an implausibly large displacement, the tracker reuses the previous location estimate.This motion-model rule prevents a failed location match from immediately producing the new estimate.
- Tracking using Optimal Subsequence Bijection: OSB aligns sequences while allowing skipped elements in either sequence, unlike DTW’s assumption that the query contains no noise.A fixed jump cost is incurred for each skipped element, potentially improving alignment of noisy subsequences.
6 Inference of new routes
For areas with unknown future routes, the method reconstructs a route from prerecorded road-segment power profiles and estimates the final location. A particle filter extends candidate routes, weights them by profile similarity, and resamples likely paths.
- Inference of new routes: The broader task infers a route when future potential routes are not explicitly known within a defined area.The target area may be a campus, neighborhood, small town, or highway network.
- Inference of new routes: The method prerecords power profiles for all road segments and concatenates candidate segments to reconstruct the unknown route.The reconstructed route is used to estimate the phone’s final location.
- Inference of new routes: Because of cellular hand-off hysteresis, a segment’s power profile depends on the preceding road segment.This dependence is incorporated when matching segment profiles during route reconstruction.
- Inference of new routes: The problem is formalized as a hidden Markov model and solved with a particle filter.The particle filter estimates the evolving route state from observations accumulated over time.
- Inference of new routes: At each iteration, particles append a segment, choose its traversal time by minimizing DTW distance, weight the route, and resample according to normalized weights.The resampled routes become the input to the next iteration.
- Inference of new routes: Profile preprocessing normalizes measurements and zeroes values below a threshold percentile to emphasize power peaks dominated by the radio.The procedure removes noise before calculating DTW distances.
- Inference of new routes: The output contains N routes, and selecting the most frequently occurring route provides a simple best-route estimate.Resampling can produce repeated copies of the same route, motivating frequency-based selection.
- Inference of new routes: Route weights can bias results toward recently added high-weight segments because earlier segment weights diminish across iterations.The method introduces a correction to counter this route-distribution bias.
7 Experiments
Experiments evaluated route identification and real-time tracking from smartphone power profiles, including robustness to noisy events and differences across devices. Results show substantial route and destination localization accuracy, while full-route estimation was more difficult on some phones.
- Experimental setup: The PowerSpy Android application collected power, signal, battery, GPS, temperature, and cell measurements from Nexus 4, Nexus 5, and HTC devices.These recordings supported evaluations across multiple smartphone models and routes.
- Route distinguishability: The evaluation used 294 power profiles representing 36 unique routes, with cross-validation over multiple iterations.Profiles included measurements from both Nexus 4 and Nexus 5 models.
- Route distinguishability: 40% correct identification with one training profile per route exceeded 3% random guessing; 53% with two profiles exceeded 4% random guessing.These results show route classification remained above chance with limited reference data.
- Route distinguishability: 71% correct identification with five reference profiles per route exceeded 5.8% random guessing, rising to 85% with eight profiles.The study reports a higher identification rate as the number of reference profiles increased.
- Real-time mobile device tracking: 80% of online tracking errors were below 1 km, while motion-model correction increased the share below 1 km to almost 90%.On a roughly 19-kilometer route, the tracker locked onto the true location after two minutes; the correction removed large errors near the route’s end.
- Time-series alignment: Optimal Subsequence Bijection outperformed standard Subsequence-DTW most of the time in the compared real-time tracking recordings.The authors suggest further experimentation with OSB for this task.
8 Future directions
Future work targets broader device support, cleaner power inference, better profile matching, and larger datasets to test scalability and reduce prior-knowledge requirements.
- 8.1 Power consumption inference: Additional smartphone models could be supported by estimating power from voltage dynamics when direct current measurements are unavailable.This would extend the method beyond models that expose both voltage and current.
- 8.1 Power consumption inference: Isolating cellular-connectivity power could reduce noise from components such as audio, Bluetooth, and WiFi that do not directly depend on the route.
- 8.2 State of Discharge (SOD): State-of-Discharge profiles may support route distinction if better features are extracted or only a few routes are possible.The paper also identifies finer battery-statistics sampling as a potential risk for web-based attacks through the HTML5 Battery API.
- 8.1 Power consumption inference: Classification could improve by matching reference profiles to conditions such as month, time of day, and traffic, but this requires many more profiles.
- 8.1 Power consumption inference: A massive GPS-labeled power-profile dataset could test scalability and whether the approach works with substantially less prior knowledge.
9 Defenses
The paper argues that common attempts to degrade power data may not prevent tracking and proposes restricting access or excluding communication-related power components.
- 9.1 Non-defenses: Coarsening power measurements, through smoothing, downsampling, lower resolution, or lower sampling frequency, may not prevent route identification.The method reportedly works with profiles coarser than raw power data.
- 9.1 Non-defenses: Figure 9 depicts estimation errors by showing the true route in green, the estimated route in red, and corresponding distances.
- 9.1 Non-defenses: Sending voltage and current measurements over a network could be flagged to users, but malicious applications could also log power data locally.
- 9.2 Proposed defenses: Restricting measurements to processor power would exclude transceiver circuitry and communication-related signals that reveal location.
- 9.2 Proposed defenses: Requiring superuser privileges would preserve power-data access for rooted diagnostic setups while blocking ordinary application access.The trade-off is losing anonymous performance statistics from the broader install base.
- 9.2 Proposed defenses: Treating power consumption as a coarse location indicator would expose an application's potential tracking capability during installation.
10 Related work
PowerSpy extends prior sensor- and modem-based localization work by showing that an unprotected power monitor can support location inference without conventional location indicators.
- 10 Related work: Prior power-analysis attacks used high-sample-rate traces from external monitors to recover cryptographic keys, whereas PowerSpy targets smartphone location.
- 10 Related work: PowerSpy combines power analysis with smartphone energy-efficiency insights to create a privacy attack based on cellular-modem power changes.
- 10 Related work: Earlier modem-localization methods generally required signal strength plus base-station identifiers or WiFi names; PowerSpy avoids those indicators.
- 10.1 Many sensors can leak location: Other unprotected sensors, including audio status, ambient sound and light, and accelerometers, have also enabled route or location inference.
- 10.2 Other sensor leaks: The broader sensor literature also reports device fingerprinting and leakage of speech, touch gestures, and other private information.
11 Conclusion
The conclusion presents PowerSpy as a location-tracking attack using smartphone power data and formalizes new-route inference with a hidden Markov model over road segments and power observations.
- 11 Conclusion: PowerSpy enables known-route identification, real-time tracking, and new-route identification by analyzing smartphone power consumption without GPS or coarse location indicators.
- 11 Conclusion: The system was evaluated on real-world data from popular smartphones with significant mobile-market share.
- 11 Conclusion: The paper argues that seemingly benign sensors should receive permission protection or undergo stronger security modeling before third-party access.
- A Formal model of new route inference: The new-route model represents intersections and road segments as hidden states, with movement constrained to a segment until its endpoint.
- A Formal model of new route inference: Each traversed road segment produces a duration-matched power-profile observation, whose distribution can depend on the previous segment because of handoff hysteresis.
- A Formal model of new route inference: Route inference selects the route maximizing its posterior probability given the observed power profile and model parameters A, B, and Π.
B Choosing the best inferred route
The particle filter produces route hypotheses, but selecting the most frequent complete route is biased toward highly weighted final segments. Iterative majority vote instead ranks route prefixes by prevalence across successive iterations.
- The particle filter outputs Pfinal, a set of N routes whose distribution estimates routes given the device’s power profile.
- Choosing the most frequent route in Pfinal provides a simple best estimate because it has the highest probability under the route distribution.
- Pfinal is biased toward routes ending with higher-weight segments, while initial-segment weights diminish through successive iterations.
- Iterative majority vote counters this bias by ranking routes according to the prevalence of their prefixes at each iteration.
- At iteration i, Prefix[i] contains prefixes of length i ranked by prevalence among routes extending prefixes retained from the previous iteration.