FlowIntent：从用户意图到网络流量映射的隐私泄漏检测
FlowIntent: Detecting Privacy Leakage from User Intention to Network Traffic Mapping
摘要：
移动设备的指数增长引发了对敏感数据泄露的担忧。在本文中，我们第一次尝试从用户的角度来识别可疑的位置相关的HTTP传输流，通过回答这个问题：传输是用户的意图？与以前主要依赖于一组给定的可疑主机名的网络级检测方案相比，我们的方法可以更好地适应应用程序市场的快速增长和不断演变的泄漏模式。另一方面，与现有的系统级检测方案相比，建立在程序污点分析，其中所有敏感的传输被视为非法的，我们的方法更好地满足用户的需求，更容易部署。特别是，我们的概念验证实现（FlowIntent）捕获了TaintDroid（Android平台上最先进的动态污点分析系统）遗漏的敏感传输。使用从20，000多个应用程序中收集的1002个位置共享实例进行评估表明，我们的方法在检测非法位置传输方面达到了约91%的准确率。
英文摘要：
The exponential growth of mobile devices has raised concerns about sensitive data leakage. In this paper, we make the first attempt to identify suspicious location-related HTTP transmission flows from the user's perspective, by answering the question: Is the transmission user-intended? In contrast to previous network-level detection schemes that mainly rely on a given set of suspicious hostnames, our approach can better adapt to the fast growth of app market and the constantly evolving leakage patterns. On the other hand, compared to existing system-level detection schemes built upon program taint analysis, where all sensitive transmissions as treated as illegal, our approach better meets the user needs and is easier to deploy. In particular, our proof-of-concept implementation (FlowIntent) captures sensitive transmissions missed by TaintDroid, the state-of-the-art dynamic taint analysis system on Android platforms. Evaluation using 1002 location sharing instances collected from more than 20,000 apps shows that our approach achieves about 91% accuracy in detecting illegitimate location transmissions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
