[Paper Review] ZKSENSE: a Privacy-Preserving Mechanism for Bot Detection in Mobile Devices

Panagiotis Papadopoulos, Iñigo Querejeta Azurmendi+4 more|arXiv (Cornell University)|Nov 18, 2019

User Authentication and Security Systems35 references6 citations

TL;DR

ZKSENSE is a zero-knowledge proof-based system that enables continuous, privacy-preserving humanness verification on mobile devices using motion sensor data. It achieves 91% accuracy in detecting bots with only 3 seconds of latency and minimal battery usage, outperforming traditional CAPTCHAs in both efficiency and privacy.

ABSTRACT

Recent studies show that 20.4% of the internet traffic originates from automated agents. To identify and block such ill-intentioned traffic, mechanisms that verify the humanness of the user are widely deployed across the internet. CAPTCHA is the most popular among such mechanisms. Original CAPTCHAs require extra user effort (e.g., solving mathematical or image-based puzzles), which severely harms user's experience, especially on mobile, and provide only sporadic verification of their humanness. More recent solutions like Google's reCAPTCHA v3 leverage attestation data (e.g., user behavioral data, device fingerprints) shared with a remote server, thus raising significant privacy concerns. To address all of the above, we present ZKSENSE: the first zero knowledge proof-based humanness attestation system designed for mobile devices. Contrary to state-of-the-art systems, ZKSENSE assesses humanness continuously on the background in a privacy preserving way. ZKSENSE achieves that by classifying the motion sensor outputs of the mobile device based on a model trained by using both publicly available sensor data and data collected from a small group of volunteers. The classification result is enclosed in a zero knowledge proof of humanness that can be safely shared with an attestation service such as Privacy Pass. We implement ZKSENSE as an Android service to demonstrate its effectiveness and practicability. In our evaluation, we show that ZKSENSE verifies the humanness of the users asynchronously, on the background, without degrading their experience or jeopardizing user privacy, while it achieves 91% accuracy across a variety of attack scenarios. On a two years old Samsung S9, each attestation takes around 3 seconds in total (when visual CAPTCHAs need 9.8 seconds) and consumes a negligible amount of battery.

Motivation & Objective

• To address the limitations of traditional CAPTCHAs, which degrade user experience due to high cognitive load and sporadic verification.
• To overcome privacy risks in modern attestation systems like reCAPTCHA v3 that rely on remote collection of behavioral and device fingerprint data.
• To design a system that continuously verifies user humanness in the background without compromising user privacy.
• To enable practical deployment on mobile devices with minimal performance and battery overhead.
• To demonstrate the feasibility of using zero-knowledge proofs to securely attest to human-like behavior from sensor data.

Proposed method

• ZKSENSE trains a motion classification model using publicly available sensor data and data from a small group of volunteers to distinguish human from bot-like motion patterns.
• The system continuously analyzes motion sensor outputs from the mobile device in the background to assess humanness.
• A zero-knowledge proof is generated to cryptographically attest to the classification result, ensuring no raw sensor data is revealed.
• The zero-knowledge proof is verifiable by a remote attestation service such as Privacy Pass without exposing underlying behavioral patterns.
• The system is implemented as an Android service to ensure real-world practicality and integration with existing privacy-preserving frameworks.
• The proof generation process is optimized to run efficiently on mobile hardware, achieving low latency and minimal energy consumption.

Experimental results

Research questions

• RQ1 Can continuous, background humanness verification be achieved on mobile devices without degrading user experience?
• RQ2 Can zero-knowledge proofs be effectively used to attest to human-like behavior from motion sensor data while preserving user privacy?
• RQ3 How does the system perform in diverse bot attack scenarios in terms of accuracy and efficiency?
• RQ4 What is the performance overhead in terms of latency and battery consumption on real mobile devices?
• RQ5 Can the system be practically deployed on commodity mobile hardware with acceptable resource usage?

Key findings

• ZKSENSE achieves 91% accuracy in detecting bot-like behavior across a variety of attack scenarios, demonstrating strong robustness.
• Each attestation takes approximately 3 seconds on a two-year-old Samsung S9, significantly faster than the 9.8 seconds required for visual CAPTCHAs.
• The system consumes a negligible amount of battery, making it suitable for long-term background operation.
• The zero-knowledge proof mechanism ensures that no raw sensor data or behavioral patterns are exposed during verification.
• The system is deployable as an Android service, confirming its practicality and compatibility with existing privacy-preserving infrastructures.
• ZKSENSE enables asynchronous, continuous humanness verification without interrupting user interaction, enhancing both security and usability.