The development of Internet of Things (IoT) in the last years provide a tremendous playground for attackers. Large attack campaigns against or using IoT devices highlight the underlying risk they convey. In this paper, we are particularly interested by IoT services that are provided through cloud-based applications.

Although such services that are accessed by Internet leverages de facto relevant practices for security, like encryption, we propose a technique to demonstrate that private information about the user behavior still leaks out. In a nutshell, we aim at decomposing a single user command into atomic actions.