Catching Hackers by Watching Watts: A Measurement Study of Power-Only Attack Detection on Consumer IoT Devices

Abstract

Security analysis of consumer Internet of Things (IoT) devices is increasingly constrained by limited visibility into encrypted traffic and closed firmware, which motivates the exploration of observable and privacy-preserving external signals. Prior work has shown that adversarial activity can induce measurable changes in device power usage, indicating that power-based intrusion detection is feasible, yet its stability and reliability under realistic operating conditions remain unclear.

We address this gap through a systematic measurement study of 33 commercial IoT devices, collecting per-second power traces and complete background traffic logs during idle operation and realistic active use under denial of service (DoS) and reconnaissance attacks.

Our analysis shows that power usage provides clear separation between benign and adversarial behavior in stable idle states, while legitimate activity introduces masking that varies across devices. We identify four behavioral regimes that describe how activity suppresses or alters attack-related increments and analyze power stability and background traffic characteristics to explain the observed differences in detection strength.

Our findings provide the first systematic large-scale characterization of when power-based detection remains reliable and when it degrades, highlighting the physical and network conditions that govern its robustness in realistic deployments.