Smart home assistants, such as the Google Home and Amazon Echo, are becoming increasingly common in modern households [29]. Thanks to their convenience, low cost, and wide range of functions, these devices continue to expand their role in performing everyday tasks. With the growing purchase and use of these smart assistants worldwide comes questions concerning end-user privacy. In this work, we investigate the extent to which smart assistants leak information through a type of attack called Voice Command Fingerprinting (VCF). In this attack, an adversary eavesdrops on a smart speaker's encrypted traffic and attempts to infer the voice command spoken by the victim. Since most data in transit is encrypted via Transport Layer Security (TLS), this attack utilizes side-channel information such as packet size, direction, and timestamps to infer the voice command based on patterns, bypassing the need for decryption. By analyzing this information, a mapping of traffic flow patterns to voice commands can be created.
Deep learning (DL) models have proven effective in fingerprinting attacks, such as Website Fingerprinting (WF) [23] and VCF [30]. However, supervised deep learning models generally rely on largescale datasets for training. Previous works in VCF have collected their data manually [13], resulting in small datasets that would not be sufficient for training DL models. Wang et al., in the most recent work related to VCF [30], were able to automate the data collection process, resulting in a large-scale dataset. This paper proposes a more streamlined approach to automate the process while also reliably removing erroneous samples with minimal human interaction.
Most of the recent work in WF is focused on Tor, which has fixed 512-byte cells that greatly limit the value of packet size information [19,23]. VCF data, however, typically runs over TLS connections that reveal fine-grained packet sizes to an eavesdropper. To account for this, we design a new ensemble model, SHAME, that captures packet direction, time, and packet size.
The contributions of this work are:
(1) We design and develop an automated data collection system for smart assistants to generate large-scale datasets. We subsequently use this system to collect an open-source dataset of 10 dynamic, and 10 static voice commands for Amazon Alexa devices [11] [30] attack. Reported as mean accuracy with ± standard deviation over ten runs.
Table (1) shows the SHAME model's results compared to the highest scores the DeepVC Fingerprinting model was able to achieve for each dataset. When evaluating the DeepVC attack, we use the author provided code with some modifications 4 . Compared to DeepVC, our proposed SHAME model is seen to reduce the error in classifying Google Home traffic by 0.17%, achieving an almost perfect accuracy in classifying the testing samples. More significantly, the SHAME model saw a reduction in error of 2.5% when tested against Amazon Alexa traffic. Furthermore, the SHAME model has proven to greatly outperform DeepVC, reducing the error rate by 11.9%, when dynamic questions are introduced into the dataset. This could indicate that the SHAME model can generalize dynamic questions, likely thanks to our timing and directional information.
There are multiple elements of our SHAME attack that allow it to outperform the DeepVC attack. First, the architecture for our CNN models is slightly better than that of DeepVC. We compare each constituent DeepVC model with our tuned DF CNN in Appendix A and see that our model performs approximately 1% better when evaluated against Wang et al. 's Alexa dataset. Next, DeepVC ensembles multiple DL networks using a weighted sum of each model's prediction vectors. This method of joining the models limits the amount of information each model may contribute to the final classification, and it allows a poor prediction from one model to negatively affect the final output. The SHAME approach of ensembling by training a new MLP network allows for more complex classification using all the information extracted by each model. Finally, our inclusion of models trained using timing information provides a further advantage over DeepVC, as packet timing characteristics can contain critical information for correctly identifying some samples.
Fingerprinting Defense. A top priority, now knowing the severity of VCF, is to develop a plausible defense that does not introduce aggressive overhead or delays. Wang et al. [30] presented a defense that implements adaptive padding [22] and differential privacy [31]. The authors achieved an impressive reduction of attack accuracy down to 28.42%. However, it seems improbable that the organizations producing these devices would willingly expend the additional bandwidth required to implement such defenses.
Real-world Evaluation. Current evaluations have considered VCF under the scope of a fairly limited number of commands. It is unclear how performance scales as the world size is increased to more closely match the real-world scope of such devices. Fortunately, the world size of VCF is relatively small when compared to other domains such as WF. Furthermore, this attack needs to be considered in the context of probable real-world attack pipelines. Sivanathan et al. [25] demonstrated that Smart Home Assistants could be identified relatively reliably by attacks outside the local network. However, the impact of errors at this stage of the real-world VCF attack pipeline has yet to be fully explored.
Data Freshness. Another question still undetermined is how voice command traffic changes over time. More specifically, the traffic fingerprint of a voice command may change due to changes in the response content (as is the case for "dynamic" questions) and potentially as an effect of API changes. Research in the WF domain has demonstrated that traffic fingerprints can change over relatively short periods, significantly reducing the performance of models trained on the previous "stale" dataset [12]. While we believe that VCF traffic is likely to remain "fresh" for longer periods, it is unclear to what extent this claim is true.
Uniqueness of Assistant Brands. Intriguingly, Amazon Alexa traffic seems to be consistently less finger-printable than Google devices. This may be due to slight variations in how Amazon devices communicate with the server, imperfections in the current collection of Alexa traffic, or that Amazon has implemented a subtle undisclosed defense. This oddity has proven consistent throughout the academic literature, yet it remains unclear why this is the case. Lastly, crossover effectiveness between a SHAME model trained on a specific smart assistant being reused for attacking a different branded smart assistant is unknown.
It is evident that VCF attacks on smart assistants such as Amazon Echo and Google Home are not only possible but can be done quickly and accurately with standard hardware by an adversary. The current assumption is that traffic patterns of commands infrequently change, leading to trivial exploitation, but these assumptions need to be validated by future works. Our research finds a significant risk to every consumer that owns a smart assistant, unknowingly disclosing private information about your personal life, device usage, and daily routine. We further examine the performance of the attack models for DF and DeepVC when they are evaluated separately from their respective ensembled models. Table 2 presents the individual model performance using the Packet Direction x Size input representation. This representation is the same used by the original DeepVC model. Our results show that our tuned DF CNN model is superior to the various DeepVC models when compared like-for-like. The DF CNN achieves a small performance lead of 0.9% compared to the DeepVC CNN model against their Alexa dataset. When comparing our tuned DF CNN model with the DeepVC CNN model, we see that our model has many more trainable parameters. The DF CNN includes two additional convolutional layers that all use smaller kernel sizes. This leads to a more gradual refinement of the features layer-by-layer and is compensated for by the additional feature extraction layers. Furthermore, the usage of spatial dropout after our convolutional layers ensures that the model does not become over-dependent upon any one feature map. These elements combined produce a slightly more effective detector model.
Modifications include changes to be compatible with Tensorflow 2.x so as to run on our system, the ability to load our dataset file formats, and an increased input data dimension size for their CNN model.