CRII: SaTC: Improving the Usability and Effectiveness of Security and Privacy Settings in Mobile Apps

CRII：SaTC：提高移动应用程序中安全和隐私设置的可用性和有效性

• 批准号: 1850479
• 负责人: Yuan Tian
• 金额: $ 17.5万
• 依托单位: University of Virginia Main Campus
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-06-01 至 2021-05-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1850479&HistoricalAwards=false
• 关键词: CRII; SaTC; Improving; Usability; Effectiveness

Mobile users hold people's sensitive information such as passwords, locations, and health information. Users are permitted to control the use of some of this information by configuring their privacy settings in the apps they use. These settings, however, are often difficult to locate and understand, even in popular apps such as Facebook. Moreover, the settings are often set to share user data by default, exposing personal data without users' explicit consent. The goal of the project is to develop an automatic tool to identify the security and privacy settings embedded in mobile apps, to identify usability and security problems in using the settings and controlling privacy, and to develop a single, centralized method of presenting and enforcing user settings such that users do not need to hunt for settings and controls to protect their privacy. The outcome of the research will improve the security and privacy of mobile consumers. To accomplish the goal, the project combines techniques from program analysis, human-computer interaction, and machine learning. The investigation will include empirical studies to understand users' perspectives on existing security and privacy settings, and test the specific usability problems with currently available settings. The research will also develop a method for identifying and extracting security and privacy settings through natural language processing and program analysis. Using these insights, the research will enable a usable centralized interface for people to configure their security and privacy settings. This work will provide insights for building usable security and privacy settings for mobile platforms, as well as for emerging platforms in the Internet of Things. This project will engage a diverse group of undergraduate and graduate students to develop their interest and expertise in cybersecurity, privacy, and methods for user control.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

移动用户保留人们的敏感信息，例如密码，位置和健康信息。允许用户通过在使用的应用程序中配置其隐私设置来控制某些信息的使用。但是，即使在诸如Facebook之类的流行应用程序中，这些设置通常也很难找到和理解。此外，设置通常设置为默认情况下共享用户数据，从而未经用户的明确同意而公开个人数据。该项目的目的是开发一种自动工具来识别移动应用程序中嵌入的安全性和隐私设置，以确定使用设置和控制隐私时的可用性和安全性问题，并开发出一种集中的，一种集中的方法来展示和强制用户设置，以使用户不需要寻找设置和控制以保护其隐私。研究的结果将改善移动消费者的安全性和隐私性。为了实现目标，该项目结合了程序分析，人类计算机互动和机器学习的技术。调查将包括经验研究，以了解用户对现有安全性和隐私设置的看法，并测试当前可用设置的特定可用性问题。该研究还将开发一种通过自然语言处理和程序分析来识别和提取安全和隐私设置的方法。使用这些见解，该研究将使人们能够配置其安全性和隐私设置。这项工作将提供有关移动平台以及物联网中新兴平台的可用安全性和隐私设置的见解。该项目将吸引各种各样的本科生和研究生，以发展其在网络安全，隐私和用户控制方法方面的兴趣和专业知识。该奖项反映了NSF的法定任务，并被认为是值得通过基金会的知识分子优点和更广泛的审查标准通过评估来获得支持的。

项目成果

Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queries

• 发表时间: 2019-08
• 期刊: ArXiv
• 作者: Fnu Suya;Jianfeng Chi;David Evans;Yuan Tian

OAUTHLINT: An Empirical Study on OAuth Bugs in Android Applications

• DOI: 10.1109/ase.2019.00036
• 发表时间: 2019-11
• 期刊: 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)
• 作者: Tamjid Al Rahat;Yu Feng;Yuan Tian

Read Between the Lines: An Empirical Measurement of Sensitive Applications of Voice Personal Assistant Systems

• DOI: 10.1145/3366423.3380179
• 发表时间: 2020-04
• 期刊: Proceedings of The Web Conference 2020
• 作者: F. H. Shezan;Hang Hu;Jiamin Wang;Gang Wang;Yuan Tian

TKPERM: Cross-platform Permission Knowledge Transfer to Detect Overprivileged Third-party Applications

• DOI: 10.14722/ndss.2020.24287
• 发表时间: 2020
• 作者: F. H. Shezan;Kaiming Cheng;Zhen Zhang;Yinzhi Cao;Yuan Tian

Understanding and Mitigating Accuracy Disparity in Regression

• 发表时间: 2021-02
• 期刊: ArXiv
• 作者: Jianfeng Chi;Yuan Tian;Geoffrey J. Gordon;Han Zhao