Research On User Privacy Security Based On Smartphone Sensors

With the popularity of the Mobile Internet,smartphone is not only a tool for making calls,but also for tasks such as social networking,e-finance,and online shopping.Therefore,the leakage of user privacy information has always been an important topic in the study of network security.Currently,two major mobile operating systems,Android and i OS,allow applications to freely read motion sensor data without user permission.In recent years,research has shown that user's input content can be inferred by collecting smartphone built-in sensor data,thereby posing a significant threat to user's privacy security.This thesis focuses on user's privacy security issues based on smartphone built-in motion sensors such as accelerometers,gyroscopes,and direction sensors.Aiming at the problem that the accuracy of the PIN inferring based on the time domain feature of sensor data is low in the existing research,this thesis proposes a novel algorithm for frequency domain feature extraction of sensor data—an improved MFCC algorithm.Based on this,a general framework for PIN inference based on time-domain and frequency-domain features is constructed.The framework collects keystroke data through the built-in motion sensor of the smartphone and preprocesses it,uses the improved MFCC algorithm to extract frequency domain features,and combines the time domain features together to train the multilayer perceptron model,and then infer the user PIN code.Finally,this thesis designs and implements a prototype system and verifies the feasibility of the framework.The main work of this article is as follows:(1)Analyze the security mechanism of the smartphone's built-in sensor in the Android and iOS operating systems,and study the security control mechanism of the motion sensor.The theory and algorithm of data acquisition,preprocessing,feature extraction,model training and other stages in machine learning are studied,and several classification algorithms that will be used in this paper are analyzed.(2)In the aspect of sensor data collection,this thesis proposes a cross-platform multi-terminal mobile sensor data acquisition method based on Web and Node JS.This method can use the acquisition program that is running through the smartphone browser to transfer the sensor data in real time to the background server and storage.In order to solve the data discrepancy caused by the different sampling rates of sensors under different platforms,this thesis uses the cubic spline interpolation algorithm to do smooth filter preprocessing on the sensor data to obtain a consistent data sample.(3)In feature extraction,this thesis proposes an improved MFCC algorithm to extract the frequency domain features of motion sensor data.The algorithm considers that both the motion sensor signal and the speech signal have the same characteristics of frequency domain energy distribution and strong signal specificity.According to the motion sensor signal characteristics,remove the pre emphasis and Hamming window in the original MFCC algorithm,and deduces the Mel formula of bending motion sensor signal in 0-4k Hz frequency range,then extract the frequency characteristics from motion sensor signal.(4)In terms of model training,this thesis builds a classification model based on multilayer perceptron algorithms in neural networks.We choose Re LU as activation function,Adam as optimization algorithm,and use backpropagation algorithm to train.(5)Designed and implemented the prototype system of PIN inference based on the combination of time domain and frequency domain features.The system consists of a sensor data acquisition system,a machine learning inference system,and a PIN inference concept verification program.Under the platform of Android and i OS,we can collect data samples of motion sensors when PIN code is typed,and use different hyperparameters to training multilayer perceptron model iterately to get the best result,and to achieve PIN code inference in XSS simulation attack environment.In this thesis,10 K samples were collected through random invitation in the campus for training.The test results show that the accuracy of at most four-time PIN inference under the i OS and Android platform reached 94.34% and 91.28% respectively,which is better than the existing research's four-time accuracy of 43%-71.6%.(6)For the security risk that the PIN is inferred through the motion sensor may lead to privacy leakage,this paper proposes a defensive measure based on noise injection,which is based on adding programmable adaptive noise in sensor data to resist privacy stealing based on motion sensors.Tests have shown that the accuracy of PIN identification after the introduction of this defensive measure is reduced to 19.3%.Further,this thesis also discusses the security improvement in the aspects of operating system design,application development,and user use.