TWC SBE: TTP Option: Medium: Collaborative: EPICA: Empowering People to Overcome Information Controls and Attacks

TWC SBE：TTP 选项：中：协作：EPICA：赋予人们克服信息控制和攻击的能力

• 批准号: 1664786
• 负责人: Marshini Chetty
• 金额: $ 19.48万
• 依托单位: Princeton University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-10-14 至 2019-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1664786&HistoricalAwards=false
• 关键词: TWC; SBE; TTP; Option; Medium; TWC; SBE; TTP; Option; Medium

This project studies the security of representative personalized services, such as search engines, news aggregators, and on-line targeted advertising, and identifies vulnerabilities in service components that can be exploited by pollution attacks to deliver contents intended by attackers.This project also develops defense-in-depth countermeasures against pollution attacks. These include new server-side mechanisms to prevent the various cross-site-request-forgery schemes that allow an attacker to insert actions. The defense mechanisms also include a distributed data collection, measurement and analysis framework to detect anomalies in browsing behaviors and information contents that are indicative of pollution of user profiles or population preferences. The new information analysis techniques use machine learning and natural language processing to identify differences (e.g., missing information) that are significant or important to a user. The project also develops tools to alert users and guide them to understand and repair profiles, and studies regulatory models to incentivize the industry to adopt a more transparent practice.This project develops an evaluation framework to facilitate the development and adoption of technologies. The evaluation plan includes user studies involving real, diverse user groups on the Internet.To transition technologies to practice, this project makes the tools freely available, and deploys data collection and measurement systems on the Internet. This project also educates users about pollution attacks and engages with users to improve the usability of the tools.

该项目研究了代表性的个性化服务的安全性，例如搜索引擎，新闻集合器和在线目标广告，并确定了服务组件中可以通过污染攻击来利用的服务组件中的漏洞，以提供攻击者的目的。该项目还开发了针对污染攻击的防御对抗对抗。其中包括新的服务器端机制，以防止各种跨站点重试计划，允许攻击者插入动作。防御机制还包括分布式数据收集，测量和分析框架，以检测浏览行为和信息内容的异常，这些框架表明用户概况或人口偏好污染。新的信息分析技术使用机器学习和自然语言处理来识别对用户重要或重要的差异（例如缺少信息）。该项目还开发了提醒用户的工具，并指导他们了解和维修配置文件，并研究监管模型，以激励该行业采用更透明的实践。该项目开发了一个评估框架，以促进技术的开发和采用。评估计划包括涉及Internet上真正多样化的用户组的用户研究。要练习过渡技术，该项目可以免费提供工具，并在Internet上部署数据收集和测量系统。该项目还向用户教育污染攻击并与用户接触以提高工具的可用性。