Alexa, are you listening to me? An analysis of Alexa voice service network traffic

With approximately 8.2 million Echo family devices sold since 2014, Amazon controls 70% of the intelligent personal assistant market. Amazon's Alexa Voice Service (AVS) provides voice control services for Amazon's Echo product line and various home automation devices such as thermostats and security cameras. In November 2017, Amazon expanded Alexa services into the business intelligent assistant market with Alexa for Business. As corporations integrate Alexa into their corporate networks, it is important that information technology security stakeholders understand Alexa's audio streaming network behavior in order to properly implement security countermeasures and policies. This paper contributes to the intelligent personal assistant knowledge domain by providing insight into Amazon Voice Services behavior by analyzing the network traffic of two Echo Dots over a 21-day period. The Echo Dots were installed in a private residence, and at no time during the experiment did family members or house guests purposely interact with the Echos. All recorded audio commands were inadvertent. Using a k-mean cluster analysis, this study established a quantifiable AVS network signature. Then, by comparing that AVS signature and logged Alexa audio commands to the 21-day network traffic dataset, this study confirmed disabling the Echo's microphone, with the on/off button, prohibits audio recording and streaming to Alexa Voice Service. With 30-38% of Echo Dots' spurious audio recordings were human conversations, these findings support the Echo Dot recorded private home conversations and not all audio recordings are properly logged the Alexa Application. While further Alexa network traffic studies are needed, this study offers a network signature capable of identifying AVS network traffic.