Identifying Personal Information in Internet Traffic

Abstract

Users today access a multitude of online services-among the most popular of which are online social networks (OSNs)-via both web sites and dedicated mobile applications (apps), using a range of devices (traditional PCs, tablets, and smartphones) that are connected via a variety of networks. The resulting infrastructure makes these services conveniently available anytime and anywhere, enabling them to become an integral part of daily life. As a consequence, users explicitly and implicitly provide a wealth of Personal Information (PI) that reflects several aspects of their life. Service providers monetize this information by selling to third parties (e.g., advertisers). Unfortunately, today, it remains difficult for end users to fully understand the amount and nature of the collected data.Our goal in this paper is to bring visibility into PI collected when accessing online services such as online social networks. This is a major challenge because PI is transferred in a proprietary way by each service. We develop a novel method that can automatically discover various types of PI carried within protocol fields of network traffic; the method includes techniques to filter out potential "containers" that do not actually carry PI and extend the set of containers initially found with additional ones. We evaluate the false positive/negative rates of our proposed method and show examples of interesting findings, including what kind of web sites or apps are more likely to transmit PI and which types of PI are most commonly collected.

Static tainting extraction approach based on information flow graph for personally identifiable information

“…Herein, we apply our proposed approach to the dataset and evaluate its performance by comparing it with the baseline approach [3]. We then present interesting findings on the users' PII via an in-depth analysis of the discovered SKs and values.…”

“…A more serious offense is the trading of personal information to third parties by a few malicious applications without the users' permission. However, users are usually not mostly notified that their PII has been surreptitiously collected by malicious applications [3,4]. Therefore, users cannot inspect the information collected by the application and prevent privacy leaks.…”

“…These approaches do not effectively prevent PII transmission to the network because static analysis does not perform real-time detection of privacy leaks and dynamic analysis requires heavy instrumentation. Recently, an alternative has been proposed in which PII is identified on the network layer through traffic interception [3,[12][13][14][15].…”

“…Meanwhile, some data that are encrypted and obfuscated in the massive network traffic also interfere with the identification reliability. However, previous studies have used simple string matching methods with regular expressions, lexicon lists, and keyword semantics to identify the possible PII values [3]. In these approaches, PII requires a stable format that can be distinguished from other values, which can either be expressed by regular expressions (e.g., email) [17] or be summarized in a limited lexicon (e.g., city).…”

Goal-Driven Exploration for Android Applications

“…Dynamic execution is a popular technique used for auditing [34,37,66,72] and validating [18,45,60,33] mobile apps. For example, a security auditor often monitors the network traffic generated by an app to ensure that user-sensitive info is sent encrypted over the network [45,60] and that it is sent to recognized third-party servers only [18,33]. It is common for the auditor to know which part of the app is responsible for the functionality of interest, but dynamically triggering that functionality is still a challenging task.…”