thanorequalto10.Outofthese12worsecasesin9casestheinferredkeyisinthesamecolumnastheactualkeyandin7casestheinferredkeyisnexttotheactualkeyinthesamecolumn.Thissuggeststhatphysicalproximitydecreasesinferenceaccuracy.4Figure2:Thedistributionofthreepairsoffeaturesextractedfromthedeviceorientationdataoverdifferentdigitkeys.Eachpairhasonevaluefortheupperlobeofthepatternandoneforthelowerlobe.Thehorizontalandverticalcentersofeachboxrepresentthemeansofonefeaturepairwhileitswidthandlengthrepresentthestandarddeviations.Thedigitsaroundtheboxesaretheircorrespondingkeys.SizeoftrainingdatasetThesmallertherequiredtrainingdatasettheeasieritisfortheattacker.Weexam-inedtheconvergenceofthemeanandstandarddeviationofthefeaturesusedinclassicationasthetrainingsetsizeincreases.Figure4showsthatAUBandALBforonekeyconvergedecentlyafter5keystrokes.Figure4:Therelationshipbetweenthemeansofsigna-turesandthesizeofthetrainingset.5DiscussionsFactorsaffectingaccuracyrateThemotionofthesmartphoneduringkeystrokeisaffectedbymanyfac-torssuchasthetypingforcetheresistanceforceoftheholdinghandtheoriginalorientationofthedeviceandthelocationwherethesupportinghandholdsthedevice.Amongthesefactorsonlythelastonemayhavesigni-cantimpactonTouchLoggerbecauseitmaychangethepivotpointsofthedevice.Howeverourevaluationsug-geststhatauserusuallysupportshissmartphoneatthesamelocation.ThedatasetspresentedinSection4arecollectedfromthesameuseronmultipledayswheretheuserheldhisdeviceinhisnaturallywayeachtimeratherthanstrivingtobeconsistent.ApplicationtootherdevicesWebelievethatTouchLoggercanbeappliedtootherdevices.Particu-larlyweexpectTouchLoggertoperformevenbetterondeviceswithlargerscreenssuchastabletcomputers.OthermotionsensorsTouchLoggerusesdatainde-viceorientationeventswhicharemainlyderivedfromtheaccelerometer.Wecouldtryothersensorsthatcap-turemotion.GyroscopeforinstancemeasurestherateofrotationaroundtheXYandZaxisesanditsoutputcanbeeasilyconvertedtodeviceorientationthroughin-tegral.Cameracouldalsobeusedtodetectmotion.5ActualkeyResultbyinferring0123456789064-610-12--8-1-86.3--13.7-----28.34.268.84.2-2.13.14.26.2-318--70--6--64-108-722-8--58448-60-412-6--1.97.5-1.977.4--11.372-4-1614-568-8--10--15--75-9---3.8-3.811.5--80.8Table1:Distributionofinferenceresults.32171.5outof449keystrokesarecorrectlyinferred.6RelatedworksKeyloggingbasedonsidechannelsResearchershavestudiedkeystrokeinferencebasedonsidechannelssuchassound211electromaganeticwave8andtim-ing74.Sincetheseattacksexploitcharacteristicsofphysicalkeyboardstheybecomeineffectiveonsmart-phoneswithsoftkeyboards.Attacksusingsensorsonsmartphone3raisestheawarenessofprivacyattacksonsmartphonesensors.Be-sidestheobviousprivacyconcernovertheGPSsensorresearchershaveshownattacksusingthecamera9andmicrophone10.Tothebestofourknowledgethispa-peristhersttoshowtheprivacyrisksofmotionsensors.7ConclusionWeinvestigatedtheuseofmotionasasidechanneltoinferkeystrokesonsoftkeyboardonsmartphones.Weobservedthatduetodifferentpositionsofkeysonasoftkeyboardtypin.