More Like this

1. Linking Personally Identifiable Information from the Dark Web to the Surface Web: A Deep Entity Resolution Approach

   https://doi.org/10.1109/ICDMW51313.2020.00072  

   Lin, Fangyu; Liu, Yizhi; Ebrahimi, Mohammadreza; Ahmad-Post, Zara; Hu, James Lee; Xin, Jingyu; Samtani, Sagar; Li, Weifeng; Chen, Hsinchun (November 2020, International Conference on Data Mining Workshops (ICDMW))

   null (Ed.)

   The information privacy of the Internet users has become a major societal concern. The rapid growth of online services increases the risk of unauthorized access to Personally Identifiable Information (PII) of at-risk populations, who are unaware of their PII exposure. To proactively identify online at-risk populations and increase their privacy awareness, it is crucial to conduct a holistic privacy risk assessment across the internet. Current privacy risk assessment studies are limited to a single platform within either the surface web or the dark web. A comprehensive privacy risk assessment requires matching exposed PII on heterogeneous online platforms across the surface web and the dark web. However, due to the incompleteness and inaccuracy of PII records in each platform, linking the exposed PII to users is a non-trivial task. While Entity Resolution (ER) techniques can be used to facilitate this task, they often require ad-hoc, manual rule development and feature engineering. Recently, Deep Learning (DL)-based ER has outperformed manual entity matching rules by automatically extracting prominent features from incomplete or inaccurate records. In this study, we enhance the existing privacy risk assessment with a DL-based ER method, namely Multi-Context Attention (MCA), to comprehensively evaluate individuals’ PII exposure across the different online platforms in the dark web and surface web. Evaluation against benchmark ER models indicates the efficacy of MCA. Using MCA on a random sample of data breach victims in the dark web, we are able to identify 4.3% of the victims on the surface web platforms and calculate their privacy risk scores. 

   more » « less
2. A Study on Personal Identifiable Information Exposure on the Internet

   Ningning Wu; Robinson Tamilselvan; Talha Tayyab (December 2022, The 2022 International Conference on Computational Science and Computational Intelligence)

   Abstract—Personal Identifiable Information (PII) is any information that permits the identity of an individual to be directly or indirectly inferred. It should be protected against random access. This paper studies the extent of PII exposure on the Internet. It is hoped that the results of this study can help raise the Internet users’ awareness on privacy protection. 

   more » « less
3. Not Your Average App: A Large-scale Privacy Analysis of Android Browsers

   https://doi.org/10.56553/popets-2023-0003  

   Pradeep, Amogh; Feal, Álvaro; Gamba, Julien; Rao, Ashwin; Lindorfer, Martina; Vallina-Rodriguez, Narseo; Choffnes, David (January 2023, Proceedings on Privacy Enhancing Technologies)

   The transparency and privacy behavior of mobile browsers has remained widely unexplored by the research community. In fact, as opposed to regular Android apps, mobile browsers may present contradicting privacy behaviors. On the one end, they can have access to (and can expose) a unique combination of sensitive user data, from users’ browsing history to permission-protected personally identifiable information (PII) such as unique identifiers and geolocation. However, on the other end, they also are in a unique position to protect users’ privacy by limiting data sharing with other parties by implementing ad-blocking features. In this paper, we perform a comparative and empirical analysis on how hundreds of Android web browsers protect or expose user data during browsing sessions. To this end, we collect the largest dataset of Android browsers to date, from the Google Play Store and four Chinese app stores. Then, we developed a novel analysis pipeline that combines static and dynamic analysis methods to find a wide range of privacy-enhancing (e.g., ad-blocking) and privacy-harming behaviors (e.g., sending browsing histories to third parties, not validating TLS certificates, and exposing PII---including non-resettable identifiers---to third parties) across browsers. We find that various popular apps on both Google Play and Chinese stores have these privacy-harming behaviors, including apps that claim to be privacy-enhancing in their descriptions. Overall, our study not only provides new insights into important yet overlooked considerations for browsers’ adoption and transparency, but also that automatic app analysis systems (e.g., sandboxes) need context-specific analysis to reveal such privacy behaviors. 

   more » « less
4. Protecting Personally Identifiable Information (PII) in Critical Infrastructure Data Using Differential Privacy

   https://doi.org/10.1109/HST47167.2019.9032942  

   Alnemari, Asma; Raj, Rajendra K.; Romanowski, Carol J.; Mishra, Sumita (November 2019, 2019 IEEE International Symposium on Technologies for Homeland Security (HST))

   In critical infrastructure (CI) sectors such as emergency management or healthcare, researchers can analyze and detect useful patterns in data and help emergency management personnel efficaciously allocate limited resources or detect epidemiology spread patterns. However, all of this data contains personally identifiable information (PII) that needs to be safeguarded for legal and ethical reasons. Traditional techniques for safeguarding, such as anonymization, have shown to be ineffective. Differential privacy is a technique that supports individual privacy while allowing the analysis of datasets for societal benefit. This paper motivates the use of differential privacy to answer a wide range of queries about CI data containing PII with better privacy guarantees than is possible with traditional techniques. Moreover, it introduces a new technique based on Multipleattribute Workload Partitioning, which does not depend on the nature of the underlying dataset and provides better protection for privacy than current differential privacy approaches. 

   more » « less
5. Privacy Leak Classification from Mobile Devices

   Shuba, A.; Bakopoulou, E; Markopoulou, A (June 2018, In Proc. of SPAWC (19th IEEE Int’l Workshop in Signal Processing Advances in Wireless Communications)

   Mobile devices have access to personal, potentially sensitive data, and there is a growing number of mobile apps that have access to it and often transmit this personally identifiable information (PII) over the network. In this paper, we present an approach for detecting such PII “leaks” in network packets going out of the device, by first monitoring network packets on the device itself and then applying classifiers that can predict with high accuracy whether a packet contains a PII leak and of which type. We evaluate the performance of our classifiers using datasets that we collected and analyzed from scratch. We also report preliminary results that show that collaboration among users can further improve classification accuracy, thus motivating crowdsourcing and/or distributed learning of privacy leaks. 

   more » « less