As the Internet of Things (IoT) continues to grow, smartphones have become an integral part of IoT systems. However, with the increasing amount of personal information stored on smartphones, users' privacy is at risk of being compromised by malicious attackers. Malware detection engines are commonly installed on smartphones to defend against these attacks, but new attacks that can evade these defenses may still emerge. In this paper, we present EavesDroid, a new side-channel attack on Android smartphones that allows an unprivileged attacker to accurately infer fine-grained user behaviors (e.g. viewing messages, playing videos) through the on-screen operations. Our attack relies on the correlation between user behaviors and the return values of system calls. The fact that these return values are affected by many factors, resulting in fluctuation and misalignment, makes the attack more challenging. Therefore, we build a CNN-GRU classification model, apply min-max normalization to the raw data and combine multiple features to identify the fine-grained user behaviors. A series of experiments on different models and systems of Android smartphones show that, EavesDroid can achieve an accuracy of 98% and 86% for already considered user behaviors in test set and real-world settings. To prevent this attack, we recommend malware detection, obfuscating return values or restricting applications from reading vulnerable return values.

翻译：随着物联网（IoT）的持续发展，智能手机已成为物联网系统的重要组成部分。然而，随着智能手机中存储的个人信息日益增多，用户隐私面临被恶意攻击者窃取的风险。尽管智能手机普遍安装了恶意软件检测引擎以抵御此类攻击，但能够规避这些防御的新型攻击仍可能出现。本文提出EavesDroid，一种针对Android智能手机的新型侧信道攻击方法，使得无特权的攻击者能够通过屏幕操作精确推断细粒度用户行为（如查看消息、播放视频等）。该攻击利用了用户行为与系统调用返回值之间的相关性。由于这些返回值受多种因素影响而产生波动与错位，攻击实施更具挑战性。为此，我们构建了CNN-GRU分类模型，对原始数据采用最小-最大归一化处理，并结合多特征融合以识别细粒度用户行为。针对不同型号和系统的Android智能手机开展系列实验表明，EavesDroid在测试集和真实场景下对已知用户行为识别的准确率分别达到98%和86%。为防御此类攻击，我们建议采用恶意软件检测、对返回值进行混淆处理，或限制应用程序读取易泄露的返回值。