PaperlayerView exact revision on arXiv

Source-linked AI summary

6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices

Amit Kumar Sikder, Hidayet Aksu, A. Selcuk Uluagac

arXiv:1706.10220v1cs.CR

TL;DR

Permission-based sensor management leaves many sensors accessible, creating opportunities for attackers to misuse sensor data. 6thSense models sensor behavior in user-activity contexts and applies machine-learning detectors. The authors report accuracy and F-Score above 96%, with minimal system-resource overhead.

  • Problem

    Permission-based controls cover only some sensors, while attackers can use other sensors to trigger malware, leak information, or steal information.

    Source: §1 · pp. 1–2

  • Method

    6thSense monitors sensor data in real time and learns activity-specific sensor patterns to distinguish benign from malicious use using machine-learning detectors.

    Source: §1 · p. 2

  • Results

    Accuracy and F-Score exceed 96%, and the evaluation reports minimal system-resource overhead.

    Source: §1 · p. 2

  • Takeaways & Limitations

    6thSense is presented as a context-aware approach covering device sensors and evaluated against three sensor-based threats.

    Source: §8 · p. 13, §9 · p. 14

    The evaluated sensor-based attacks were constructed in a lab environment; the paper notes there were no real sensor-based malware in the wild at the time of writing.

    Source: §8 · p. 13

Abstract

from arXiv · show

Sensors (e.g., light, gyroscope, accelerotmeter) and sensing enabled applications on a smart device make the applications more user-friendly and efficient. However, the current permission-based sensor management systems of smart devices only focus on certain sensors and any App can get access to other sensors by just accessing the generic sensor API. In this way, attackers can exploit these sensors in numerous ways: they can extract or leak users' sensitive information, transfer malware, or record or steal sensitive information from other nearby devices. In this paper, we propose 6thSense, a context-aware intrusion detection system which enhances the security of smart devices by observing changes in sensor data for different tasks of users and creating a contextual model to distinguish benign and malicious behavior of sensors. 6thSense utilizes three different Machine Learning-based detection mechanisms (i.e., Markov Chain, Naive Bayes, and LMT) to detect malicious behavior associated with sensors. We implemented 6thSense on a sensor-rich Android smart device (i.e., smartphone) and collected data from typical daily activities of 50 real users. Furthermore, we evaluated the performance of 6thSense against three sensor-based threats: (1) a malicious App that can be triggered via a sensor (e.g., light), (2) a malicious App that can leak information via a sensor, and (3) a malicious App that can steal data using sensors. Our extensive evaluations show that the 6thSense framework is an effective and practical approach to defeat growing sensor-based threats with an accuracy above 96% without compromising the normal functionality of the device. Moreover, our framework costs minimal overhead.

1 Introduction

Sensor-rich devices enable useful applications, but permission-based controls leave many sensors accessible and existing protections do not cover the range of sensor-based threats. 6thSense models sensor use in the context of user activities; its evaluation reports strong detection results across three threat types.

1 Introduction

  • Sensor misuse can trigger malware, leak sensitive information, steal information from nearby devices, or transfer malware.The paper evaluates 6thSense against three sensor-based threat types using data from 50 real users.Source: §1 · pp. 1–2
  • Android permission controls cover only a few sensors, while other sensors, including motion sensors, can be accessed through the generic sensor API.Existing solutions also leave threats uncovered, including attacks that use sensors as side channels to activate malware.Source: §1 · pp. 1–2
  • 6thSense is a context-aware intrusion detection system that learns sensor patterns for user activities and uses machine-learning detectors to identify malicious sensor behavior.The detectors include Markov Chain, Naive Bayes, and LMT.Source: §1 · p. 2
  • Accuracy and F-Score exceed 96%, with minimal system-resource overhead reported for 6thSense.The evaluation used real-user data and tested three sensor-based threats.Source: §1 · p. 2

2 Related Work

Prior work identifies information threats involving many sensors, but proposed protections remain incomplete or limited in scope. 6thSense is presented as a context-aware approach covering all device sensors and three types of sensor-based threats.

2 Related Work

  • Motion, light, audio, camera, and GPS sensors can expose inputs or surroundings, transfer malicious code, trigger malware, or support other attacks.Examples include inferring smartphone keystrokes from motion or light readings and using light to transfer malicious code.Source: §2 · pp. 2–3
  • Prior defenses include sensor-access controls, audio-channel policies, and application trust or vulnerability checks, but they do not provide comprehensive sensor-threat coverage.The described approaches include Semadroid, AuDroid, and DARKLY.Source: §2 · p. 3
  • The paper says 6thSense covers all device sensors and addresses three sensor-based threat types, whereas prior solutions have narrower testing or sensor coverage.The authors note there is no directly comparable work.Source: §2 · p. 3

3 Background: Sensor Management in Smart Devices

Android sensor access relies on SDK and hardware-abstraction layers, while most sensor files do not require permissions. This leaves access to many sensors outside explicit user approval.

3 Background: Sensor Management in Smart Devices

  • Because one task may use multiple sensors, protecting only one sensor does not secure information flows between sensors and Apps.The paper connects this gap with risks such as information leakage and eavesdropping.Source: §3 · pp. 3–4
  • Apps request sensor access through the SDK API, which can multiplex multiple Apps registered to the same sensor; the HAL connects sensor hardware with device drivers.Most sensors need no permission for access to their associated files.Source: §3 · p. 4
  • Explicit user permission applies to camera, microphone, and GPS, but accepting an App's permission can also leave it access to sensors that require no permission.The paper identifies this access model as a source of potential malicious attacks.Source: §3 · pp. 3–4

4 Adversary Model and Assumptions

The threat model covers three malicious uses of sensors, and the design treats sensor behavior as dependent on user activity. Its assumptions also address sampling differences, rapid processing, and real-time monitoring.

4.1 Adversary Model

  • 6thSense considers three threats: triggering a malicious App through a sensor, leaking information through a sensor, and stealing information after inferring device mode.These are the sensor-based threats considered and evaluated in the paper.Source: §4.1 · p. 4

4.2 Design Assumptions and Features

  • Sensors are modeled as activity-dependent: different tasks activate different sensor sets, whose joint context helps distinguish normal activities from malicious ones.For example, walking with a phone in hand may activate light and motion sensors, while walking with it in a pocket may activate proximity instead.Source: §4.2 · p. 4
  • Adaptive sampling groups sensor data over a time period rather than relying on each sensor's individual sampling frequency.The stated purpose is to mitigate possible processing errors arising from different sensor frequencies.Source: §4.2 · p. 4
  • The design uses simple, fast machine-learning algorithms for real-time processing and monitors all sensors in real time.The paper states that real-time monitoring mitigates the possibility of data tampering or false data injection.Source: §4.2 · p. 5

5 Detection Techniques: Theoretical Foundation

6thSense uses machine-learning models to distinguish normal from malicious sensor behavior, choosing techniques for their resource needs and modeling capabilities. The section describes Markov Chain and Naive Bayes approaches alongside alternative classifiers.

5 Detection Techniques: Theoretical Foundation

  • The section frames these methods as machine-learning approaches for separating normal from malicious smart-device behavior.Markov Chain and Naive Bayes are presented alongside alternative algorithms.Source: §5 · p. 5

5.1 Markov Chain-Based Detection

  • Markov Chain models sensor-condition transitions; 6thSense estimates transition probabilities from benign-user data to distinguish normal from malicious activity.The authors cite modest computation requirements as an advantage for resource-limited devices.Source: §5.1 · p. 5, §5 · p. 5

5.2 Naive Bayes Based Detection

  • Naive Bayes treats sensor conditions as conditionally independent, while activity probabilities depend on their combined conditions.The independence assumption means one sensor’s condition does not affect another’s; sensors can still jointly indicate an activity.Source: §5.2 · pp. 5–6

5.3 Alternative Detection Techniques

  • Alternative classifiers include PART, logistic regression, Multilayer Perceptron, and decision trees J48, LMT, and Hoeffding Tree.PART provides a common rule-based model across activities, while Multilayer Perceptron was chosen to distinguish nonlinear relationships.Source: §5.3 · p. 6

6 6thSense Framework

6thSense collects sensor data during user activities, processes it into training matrices, and analyzes those matrices with machine-learning detection techniques. The framework’s output indicates whether the device state is malicious or benign.

6.1 Data Collection Phase

  • Nine sensors are monitored per second across nine typical daily activities, with each activity-second represented by 1,024 state-information values.The activities include walking, talking, interacting, video calling, and driving.Source: §6.1 · p. 7

6.2 Data Processing Phase

  • Processing averages each data-oriented sensor’s readings per second, converts changes into binary conditions, and merges these with logical sensor states sampled every five seconds.The resulting reorganized data are merged into training matrices.Source: §6.2 · pp. 7–8

6.3 Data Analysis Phase

  • Markov Chain uses transition probabilities to distinguish normal from malicious activity; Naive Bayes scores test sessions against known activities over a configurable five-minute interval.For Markov Chain, 75% of collected data train the transition matrix; Naive Bayes detects malicious activity when no known benign activity exceeds a threshold.Source: §6.3 · p. 8
  • Alternative classifiers are trained and tested using WEKA’s 10-fold cross-validation.The analysis phase applies machine-learning detection techniques to the matrices generated during processing.Source: §6.3 · p. 8

7 Performance Evaluation of 6thSense

6thSense was evaluated on real-user activity data and three sensor-based attack scenarios, using multiple performance measures. The Markov Chain detector performed best with a threshold of three consecutive malicious states, reaching over 98% accuracy without false positives.

7 Performance Evaluation of 6thSense

  • Evaluations covered three sensor-based threats, and the framework’s impact on device performance was measured.The scenarios involve sensor-triggered applications, information leakage, and data theft.Source: §7 · pp. 8–9, §7.1 · p. 9

7.1 Training Environment

  • The training environment used a Samsung Galaxy S5 Duos and data from 50 participants across nine activities, including generic and user-related tasks.Generic activities included sleeping and driving; user-related activities included walking with the phone, gaming, browsing, and calls.Source: §7.1 · p. 9

7.2 Dataset

  • The evaluation used a 75/25 split of benign data for training and testing, with malicious data included in testing.The Markov Chain model learned state transitions; other machine-learning approaches used 10-fold cross-validation.Source: §7.2 · p. 9

7.3 Performance Metrics

  • The evaluation considered recall, false-negative rate, specificity, false-positive rate, accuracy, and F-score.F-score reflects performance by considering recall and specificity.Source: §7.3 · p. 10

7.4 Evaluation of Markov Chain-Based Detection

  • With three consecutive malicious states as the threshold, Markov Chain detection achieves accuracy over 98% without false positives.Accuracy and F-score exceed 98% at this threshold; the ROC discussion reports that false positives appear beyond the stated operating point.Source: §7.4 · pp. 10–11, Figure 3 · p. 11

7.5 Evaluation of Naive Bayes-based Detection

The comparison favors LMT on accuracy and F-score, while Naive Bayes offers higher recall and lower FNR; 6thSense also has low reported resource overhead, with power use affected by data collection and storage.

7.5 Evaluation of Naive Bayes-based Detection

  • At a 60% threshold, Naive Bayes achieves 95% accuracy and 82% F-score; at 55%, FNR is zero but FPR is high.The reported ROC relation also shows TPR reaching 1 when FPR exceeds 0.3.Source: §7.5 · p. 11, Figure 4 · p. 11

7.6 Evaluation of Alternative Detection Techniques

  • LMT achieves 0.9997 accuracy and 0.964 F-score, outperforming the other alternative algorithms reported.PART reaches 0.99 accuracy and 0.7899 F-score; Multilayer Perceptron reaches 0.9991 accuracy and 0.8196 F-score, but has 0.3056 FPR.Source: §7.6 · p. 12, Table 5 · p. 12

7.7 Comparison

  • LMT provides the highest accuracy and F-score among the tested approaches, while Markov Chain and LMT have lower FPR than Naive Bayes.The comparison uses three consecutive malicious states for Markov Chain, a 60% threshold for Naive Bayes, and LMT for the alternative machine-learning approach.Source: §7.7 · p. 12, Table 6 · p. 12

7.8 Performance Overhead

  • With data saved for later analysis, power use is 16.62 mW for one minute and rises to 178.33 mW for ten seconds; without saving, it falls to 72.35 mW.The authors suggest real-time analysis without on-device storage as a way to reduce power use.Source: §7.8 · pp. 12–13

8 Discussion and Limitations

6thSense monitors sensors in real time using user activities as context, averaging readings over one second to temper transient changes. Its evaluation includes lab-constructed adversaries, while the discussion describes coverage across sensors and a context-aware attacker scenario.

Features and Benefits

  • One-second sensor averages mitigate transient changes in device ambiance, while real-time monitoring distinguishes 6thSense from solutions using stored or app-used data.For example, a person walking past the phone can briefly change light and motion readings, which other readings over the second compensate for.Source: §8 · p. 13
  • The framework models user activities and treats sensor conditions together as a device state, extending monitoring to sensors beyond permission-imposed ones.The authors state that targeting one sensor can produce behavior that differs from normal user activity and is detectable in this context-aware model.Source: §8 · p. 13

Application Level Detection

  • The authors identify combining sensor-level and application-level detection, or adding online training, as possible extensions.They describe these as potential directions rather than evaluated capabilities.Source: §8 · p. 13

Sensor-based threats in real-life settings

  • The evaluated sensor-based adversaries were constructed in a lab environment.The authors note that real sensor-based malware was not known to be in the wild at the time of writing.Source: §8 · p. 13

Context-aware Malicious App

  • The discussion says a context-aware malicious app can be detected, and that an attacker would need to behave like a benign app continuously to outperform 6thSense.The example is an app that learns sensor conditions for an activity such as sleeping and records video stealthily.Source: §8 · p. 14

9 Conclusion

6thSense applies machine-learning detection to sensor-based attacks and reports accuracy above 95% across evaluations involving real users and three threat types. The authors identify broader metrics, devices, and resource trade-offs as future work.

9 Conclusion

  • Above 95% accuracy was achieved with Markov Chain, Naive Bayes, and LMT on real devices with 50 individuals.The evaluation covered information leakage, eavesdropping, and malware triggering via sensors, with minimal overhead.Source: §9 · p. 14
  • 6thSense uses machine-learning techniques to distinguish malicious from benign device activity and was evaluated against three sensor-based threats.The conclusion identifies information leakage, eavesdropping, and triggering malware via sensors.Source: §9 · p. 14
  • Future work will examine additional metrics, smartwatch efficacy, and trade-offs among frequency, accuracy, and battery use.The authors state that other performance metrics, including a Precision Recall Curve, remain to be studied.Source: §9 · p. 14

A.1 Markov Chain-Based Detection

The Markov Chain detector represents sensor conditions as time-varying states and uses observed state transitions to assess sensor activity. 6thSense modifies the general model to evaluate the probability of a transition rather than predict the next state.

A.1 Markov Chain-Based Detection

  • Each sensor’s changing or unchanged condition is binary, so n sensors yield 2^n possible states.A state combines the conditions of all sensors at a given time; with 10 sensors, the passage gives 1,024 states.Source: §A.1 · p. 17
  • Observed transitions between states form the Markov Chain transition probability matrix.The model defines p_ij as the probability of being in state j at time t+1 given state i at time t.Source: §A.1 · p. 17
  • The general Markov Chain computes the probability of a sequence of states using an initial state distribution and transition probabilities.The passage describes a sequence X1, X2, …, XT and a starting probability for each state.Source: §A.1 · p. 18
  • Unlike the general model, 6thSense evaluates the probability of a transition between two states instead of predicting the next state.Transitions are observed over time to construct the model’s probabilities.Source: §A.1 · pp. 17–18

A.2 Naive Bayes Based Detection

The Naive Bayes detector models sensor conditions as conditionally independent given an activity, while using their combined conditions to estimate that activity. It aggregates per-second probabilities and applies a configurable threshold to identify malicious activity.

A.2 Naive Bayes Based Detection

  • Naive Bayes assumes that a sensor condition in a task has no influence on another feature in that event.The paper applies this conditional-independence assumption to sensor conditions while modeling users’ activity as a combination of sensors.Source: §A.2 · p. 18
  • Under conditional independence, the joint probability of two sensor events given a task factors into their separate conditional probabilities.The paper states that the task probability still depends on the conditions of all sensors together.Source: §A.2 · p. 18
  • The model uses conditional probabilities to classify sensor dataset X among a set of user activities, then uses the result to distinguish benign activity from attacks.The activity set contains m user activities, and the calculated conditional probability is used for the benign-or-malicious decision.Source: §A.2 · p. 18
  • Sensor data is divided into one-second intervals, and each interval’s activity probability contributes to an expected value.The passage labels the per-interval probabilities p1, p2, …, pn and their corresponding values a1, a2, …, an.Source: §A.2 · p. 18
  • When interval values are equally likely, the expected value is a simple average; a result below the configurable threshold indicates malicious activity.The threshold is used to assess whether the calculated value supports the inferred user activity.Source: §A.2 · p. 18
Loading 1706.10220v1…