PrivacyProxy：利用众包和现场流量分析来检测和减少信息泄漏
PrivacyProxy: Leveraging Crowdsourcing and In Situ Traffic Analysis to Detect and Mitigate Information Leakage
摘要：
许多智能手机应用程序传输个人身份信息（PII），通常在用户不知情的情况下。为了解决这个问题，我们提出了PrivacyProxy，一个监控出站网络流量并生成应用程序特定签名以表示共享的敏感数据的系统。PrivacyProxy使用基于人群的方法，通过匿名组合来自同一应用程序的不同用户的签名，以自适应和可扩展的方式检测可能的PII。此外，我们不观察用户的网络流量，而是依赖于散列签名。我们提出了PrivacyProxy的设计和实施，并评估它与实验室研究，现场部署，用户调查，并与以前的工作进行比较。我们的现场研究表明，PrivacyProxy可以自动检测PII，F1得分为0.885。PrivacyProxy在500个最受欢迎的应用程序的对照实验中也获得了0.759的F1分数。F1得分也提高到0.866，其中40个应用程序最初具有最多的误报，并添加了额外的训练数据。我们还显示，使用PrivacyProxy的性能开销在8.6%到14.2%之间，略高于使用标准未修改的VPN，大多数用户报告对电池寿命或网络没有明显的影响。
英文摘要：
Many smartphone apps transmit personally identifiable information (PII), often without the users knowledge. To address this issue, we present PrivacyProxy, a system that monitors outbound network traffic and generates app-specific signatures to represent sensitive data being shared. PrivacyProxy uses a crowd-based approach to detect likely PII in an adaptive and scalable manner by anonymously combining signatures from different users of the same app. Furthermore, we do not observe users network traffic and instead rely on hashed signatures. We present the design and implementation of PrivacyProxy and evaluate it with a lab study, a field deployment, a user survey, and a comparison against prior work. Our field study shows PrivacyProxy can automatically detect PII with an F1 score of 0.885. PrivacyProxy also achieves an F1 score of 0.759 in our controlled experiment for the 500 most popular apps. The F1 score also improves to 0.866 with additional training data for 40 apps that initially had the most false positives. We also show performance overhead of using PrivacyProxy is between 8.6% to 14.2%, slightly more than using a standard unmodified VPN, and most users report no perceptible impact on battery life or the network.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
