Large-scale Detection of Privacy Leaks for BAT Browsers Extensions in China

Zhao, Yufei; He, Longtao; Li, Zhoujun; Yang, Liqun; Dong, Hao; Li, Chao; Wang, Yu

doi:10.1109/tase.2019.00-19

Cited by 6 publications

(5 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the previous work [39], it has been found that the extensions divulge the users' privacy. However, due to Baidu browser stopping service and the UC browser users are few, we continue to analyze the 360 browser which accounts for more users, and collect and sort out 16,547 extensions of three (QQ browser, 360 secure browser, and 360 speed browser) for six months, from May 2019 to October 2019.…”

Section: Data Collection and Analysismentioning

confidence: 98%

“…China has a considerable browser market [6], [7], but there are only a few works for extension privacy leakage detection [39]. Although the kernel of Chinese mainstream browsers and that of Chrome are the same, the description of the extensions in the Chinese mainstream browsers and the classification of these extensions according to their functions are quite different due to the differences of languages(most English in Chrome, Chinese in China browser).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Privacy Model: Detect Privacy Leakage for Chinese Browser Extensions

Zhao

Yang

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

The wide use of browser extensions brings the privacy leakage problem. The previous works detected private data transmission to find privacy leakage in Chrome or Firefox, but the real challenge is to determine whether the transmission is reasonable because the privacy data that existed in transmission does not absolutely mean leaking. To this end, we establish a privacy model for each extension, which contains the sensitive information permitted to be used and servers authorized to communicate with. In order to evaluate the effectiveness of the proposed method, we develop a dynamic browser extension privacy detection framework. It first builds privacy models for extensions and records all network traffic when accessing test pages. Then, the leakage results are presented according to the strict privacy leakage judgment rules. In this paper, the experiments are conducted in a real environment, and our work is verified by 34,095 extensions which are collected from 3 mainstream browsers in China from November 2019 to August 2020. There is a total of 2,983 extensions that exist privacy leakage. We further conduct a comprehensive analysis of the results including calculating the precision, recall, accuracy, and F1 score for each type of leakage, and show the information leaked by different extension categories and the malicious domain name that collecting the users' privacy, as well as the results changing of detection over time.

show abstract

Section: Data Collection and Analysismentioning

confidence: 98%

Section: Introductionmentioning

confidence: 99%

Privacy Model: Detect Privacy Leakage for Chinese Browser Extensions

Zhao

Yang

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Wireless Communications and Mobile Computing the rationality of such behaviors. Those studies try to figure out whether the behavior is necessary for the app to provide its service [17,18]. In those studies, privacy leak indicates the functionality-irrelevant private data transmission.…”

Section: Privacy Leakmentioning

confidence: 99%

Statistical Feature-Based Personal Information Detection in Mobile Network Traffic

Zhao

Chen

Wei

2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

With the popularity of smartphones, mobile applications (apps) have penetrated the daily life of people. Although apps provide rich functionalities, they also access a large amount of personal information simultaneously. As a result, privacy concerns are raised. To understand what personal information the apps collect, many solutions are presented to detect privacy leaks in apps. Recently, the traffic monitoring-based privacy leak detection method has shown promising performance and strong scalability. However, it still has some shortcomings. Firstly, it suffers from detecting the leakage of personal information with obfuscation. Secondly, it cannot discover the privacy leaks of undefined type. Aiming at solving the above problems, a new personal information detection method based on traffic monitoring is proposed in this paper. In this paper, statistical features are designed to depict the occurrence patterns of personal information in the traffic, including local patterns and global patterns. Then a detector is trained based on machine-learning algorithms to discover potential personal information with similar patterns. Since the statistical features are independent of the value and the type of personal information, the trained detector is capable of identifying various types of privacy leaks and obfuscated privacy leaks. As far as we know, this is the first work that detects personal information based on statistical features. Finally, the experimental results show that the proposed method could achieve better performance than the state-of-the-art.

show abstract

“…Recently, a few studies further assess the rationality of such behaviors. In other words, those studies try to figure out whether the behavior is necessary for the app to provide its service [16,17]. In those studies, privacy leak indicates the functionality-irrelevant private data transmission.…”

Section: Privacy Leakmentioning

confidence: 99%

“…The category "others" in Fig. 6 includes 11 types of number of users, i.e., 5,7,8,10,11,13,14,17,39,41,43. As Fig.…”

Section: Analysis On False Predictionmentioning

confidence: 99%

Statistical Feature-based Personal Information Detection in Mobile Network Traffic

Chen¹,

Wei²

2021

Preprint

View full text Add to dashboard Cite

With the popularity of smartphones, mobile applications (apps) have penetrated the daily life of people. Although apps provide rich functionalities, they also access a large amount of personal information simultaneously. As a result, privacy concerns are raised. To understand what personal information the apps collect, many solutions are presented to detect privacy leaks in apps. Recently, the traffic monitoring-based privacy leak detection method has shown promising performance and strong scalability. However, it still has some shortcomings. Firstly, it suffers from detecting the leakage of personal information with obfuscation. Secondly, it cannot discover the privacy leaks of undefined type. Aiming at solving the above problems, a new personal information detection method based on traffic monitoring is proposed in this paper. In this paper, statistical features of personal information are designed to depict the occurrence patterns of personal information in the traffic, including local patterns and global patterns. Then a detector is trained based on machine learning algorithms to discover potential personal information with similar patterns. Since the statistical features are independent of the value and type of personal information, the trained detector is capable of identifying various types of privacy leaks and obfuscated privacy leaks. As far as we know, this is the first work that detects personal information based on statistical features. Finally, the experimental results show that the proposed method could achieve better performance than the state-of-the-art.

show abstract

Large-scale Detection of Privacy Leaks for BAT Browsers Extensions in China

Cited by 6 publications

References 11 publications

Privacy Model: Detect Privacy Leakage for Chinese Browser Extensions

Privacy Model: Detect Privacy Leakage for Chinese Browser Extensions

Statistical Feature-Based Personal Information Detection in Mobile Network Traffic

Statistical Feature-based Personal Information Detection in Mobile Network Traffic

Contact Info

Product

Resources

About