Detecting Spies in IoT Systems using Cyber-Physical Correlation

The emerging ubiquity of IoT devices with monitoring capabilities has resulted in a growing concern for user privacy. Whereas previous research has focused on preventing an attacker from learning about user activities through analyzing data, we are concerned with the problem of attackers that utilize either hidden or compromised IoT devices to spy on users. Our work addresses the challenge of automatically identifying devices that are streaming privacy-intruding information about a user despite the presence of both encryption and a large number of wirelessly connected devices within range of the user. We present a framework for inducing a signal in the physical world and then detecting its digital footprint when devices are monitoring the user. Our approach only requires the user to have a device such as a smart phone with the ability to enter into promiscuous packet capture mode. As an example application, we have set up a hidden camera and conducted 222 trials of devices that are not recording the user along with 680 trials of the hidden camera under a wide variety of configurations. In most of the environments examined, we were able to to detect over 90% of the hidden cameras while producing less than 6% false positives. As a result, this paper provides significant evidence that our approach is feasible for detecting spying devices.