User Privacy Leakage in Location-based Mobile Ad Services

The online advertising ecosystem leverages its massive data collection capability to learn the properties of users for targeted ad deliveries. Many Android app developers include ad libraries in their apps as a way of monetization. These ad libraries contain advertisements from the sell-side platforms, which collect an extensive set of sensitive information to provide more relevant advertisements for their customers. Existing efforts have investigated the increasingly pervasive private data collection of mobile ad networks over time. However, there lacks a measurement study to evaluate the scale of privacy leakage of ad networks across different geographical areas. In this work, we present a measurement study of the potential privacy leakage in mobile advertising services conducted across different locations. We develop an automated measurement system to intercept mobile traffic at different locations and perform data analysis to pinpoint data collection behaviors of ad networks at both the app-level and organization-level. With 1,100 popular apps running across 10 different locations, we perform extensive threat assessments for different ad networks. Meanwhile, we explore the ad-blockers’ behavior in the ecosystem of ad networks, and whether those ad-blockers are actually capturing the users’ private data in the meantime of blocking the ads. We find that: the number of location-based ads tends to be positively related to the population density of locations, ad networks collect different types of data across different locations, and ad-blockers can block the private data leakage

CyberGuarder: a virtualization security assurance architecture for green cloud computing

Cloud Computing, Green Computing, Virtualization, Virtual Security Appliance, Security Isolation

Internet Service Providers' and Individuals' Attitudes, Barriers, and Incentives to Secure IoT

Internet of Things (IoT) play a vital role in securing IoT. However, encouraging them to do so is hard. Our study investigates ISPs’ and individuals’ attitudes towards the security of IoT, the obstacles they face, and their incentives to keep IoT secure, drawing evidence from Japan. Due to the complex interactions of the stakeholders, we follow an iterative methodology where we present issues and potential solutions to our stakeholders in turn. For ISPs, we survey 27 ISPs in Japan, followed by a workshop with representatives from government and 5 ISPs. Based on the findings from this, we conduct semi-structured interviews with 20 participants followed by a more quantitative survey with 328 participants. We review these results in a second workshop with representatives from government and 7 ISPs. The appreciation of challenges by each party has lead to findings that are supported by all stakeholders. Securing IoT devices is neither users’ nor ISPs’ priority. Individuals are keen on more interventions both from the government as part of regulation and from ISPs in terms of filtering malicious traffic. Participants are willing to pay for enhanced monitoring and filtering. While ISPs do want to help users, there appears to be a lack of effective technology to aid them. ISPs would like to see more public recognition for their efforts, but internally they struggle with executive buy-in and effective means to communicate with their customers. The majority of barriers and incentives are external to ISPs and individuals, demonstrating the complexity of keeping IoT secure and emphasizing the need for relevant stakeholders in the IoT ecosystem to work in tandem

Name anomaly detection for ICN

International audience—Information leakages are one of the main security threats in today's Internet. As ICN is expected to become the core architecture for Future Internet, it is therefore mandatory to prevent this threat. This paper proves that some ICN configuration prevents information leakages via Data packets and shows that it is an open problem to prevent interest packets from carrying encoded crucial information in their names. Assuming that names in ICN will follow the current URL format commonly used in the Internet, we get the statistics of web URL based on extensive crawling experiments of main internet organizations. Then we propose a simple filtering technique based on these statistics for firewall to detect anomalous names in ICN. The experiment shows that our filtering technique recognizes 15% of names in our dataset as malicious. As the false positive rate is still high for this filter to be used in a real world operation, this work is an important step for detecting anomalous names and preventing information-leakage in ICN

Privacy-preserving smart nudging system: resistant to traffic analysis and data breach

A solution like Green Transportation Choices with IoT and Smart Nudging (SN) is aiming to resolve urban challenges (e.g., increased traffic, congestion, air pollution, and noise pollution) by influencing people towards environment-friendly decisions in their daily life. The essential aspect of this system is to construct personalized suggestion and positive reinforcement for people to achieve environmentally preferable outcomes. However, the process of tailoring a nudge for a specific person requires a significant amount of personal data (e.g., user's location data, health data, activity and more) analysis. People are willingly giving up their private data for the greater good of society and making SN system a target for adversaries to get people's data and misuse them. Yet, preserving user privacy is subtly discussed and often overlooked in the SN system. Meanwhile, the European union's General data protection regulation (GDPR) tightens European Unions's (EU) already stricter privacy policy. Thus, preserving user privacy is inevitable for a system like SN. Privacy-preserving smart nudging (PPSN) is a new middleware that gives privacy guarantee for both the users and the SN system and additionally offers GDPR compliance. In the PPSN system, users have the full autonomy of their data, and users data is well protected and inaccessible without the participation of the data owner. In addition to that, PPSN system gives protection against adversaries that control all the server but one, observe network traffics and control malicious users. PPSN system's primary insight is to encrypt as much as observable variables if not all and hide the remainder by adding noise. A prototype implementation of the PPSN system achieves a throughput of 105 messages per second with 24 seconds end-to-end latency for 125k users on a quadcore machine and scales linearly with the number of users