ViCLOUD: Measuring Vagueness in Cloud Service Privacy Policies and Terms of Services

Kotal, Anantaa; Joshi, Karuna Pande; Joshi, Anupam

doi:10.1109/cloud49709.2020.00023

Cited by 6 publications

(7 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Privacy in data sharing has been heavily discussed in the past decade. Organizations are invested in finding secure, automated solutions to collecting and sharing data [25], [24]. However, organizations are still sceptical about sharing their data for use in research.…”

Section: Related Workmentioning

confidence: 99%

PriveTAB

Kotal

Piplai

Chukkapalli

et al. 2022

Proceedings of the 2022 ACM on International Workshop on Security and Privacy Analytics

Self Cite

View full text Add to dashboard Cite

Machine Learning has increased our ability to model large quantities of data efficiently in a short time. Machine learning approaches in many application domains require collecting large volumes of data from distributed sources and combining them. However, sharing of data from multiple sources leads to concerns about privacy. Privacy regulations like European Union's General Data Protection Regulation (GDPR) have specific requirements on when and how such data can be shared. Even when there are no specific regulations, organizations may have concerns about revealing their data. For example in cybersecurity, organizations are reluctant to share their network-related data to permit machine learning-based intrusion detectors to be built. This has, in particular, hampered academic research. We need an approach to make confidential data widely available for accurate data analysis without violating the privacy of the data subjects. Privacy in shared data has been discussed in prior work focusing on anonymization and encryption of data.An alternate approach to make data available for analysis without sharing sensitive information is by replacing sensitive information with synthetic data that behave as original data for all analytical purposes. Generative Adversarial Networks (GANs) are one of the well-known models to generate synthetic samples that can have the same distributional characteristics as the original data. However, modeling tabular data using GAN is a non-trivial task. Tabular data contain a mix of categorical and continuous variables and require specialized constraints as described in the CTGAN model.In this paper, we propose a framework to generate privacypreserving synthetic data suitable for release for analytical purposes. The data is generated using the CTGAN approach, and so is analytically similar to the original dataset. To ensure that the generated data meet the privacy requirements, we use the principle of t-closeness. We ensure that the distribution of attributes in the released dataset is within a certain threshold distance from the real dataset. We also encrypt sensitive values in the final released

show abstract

Section: Related Workmentioning

confidence: 99%

PriveTAB

Kotal

Piplai

Chukkapalli

et al. 2022

Proceedings of the 2022 ACM on International Workshop on Security and Privacy Analytics

Self Cite

View full text Add to dashboard Cite

show abstract

“…As we show, it also limits the effectiveness of creating knowledge graphs and thus, policy management on these documents. Previous works [28], [42] There is a significant body of work that identifies lexical indicators that contribute to ambiguity in natural language (like English) [5], [16], [44]. Previous studies also identify and alleviate ambiguity in other natural language documents that are lexically similar to policy documents.…”

Section: Background and Related Workmentioning

confidence: 99%

“…There are different approaches to identifying ambiguity in Natural Language [5], [16], [44]. Previous works on other technical documents define different linguistic properties of a document that affect its ambiguity [17], [28], [42]. In this section, we define 8 measurable features of a policy document that contribute to its ambiguity.…”

Section: Measurable Properties Of Policiesmentioning

confidence: 99%

“…This requires text segmentation and text classification, and the quality of text in a natural language document can affect the performance of these processes [40]. Kotal et al [28] identified that privacy policies often have ambiguities and complex sentence constructions that make them harder to understand. Our approach uses linguistic properties beyond the ones described by those authors to measure the ambiguity of a policy.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

The Effect of Text Ambiguity on creating Policy Knowledge Graphs

Kotal

Joshi

2021

2021 IEEE Intl Conf on Parallel &Amp; Distributed Processing With Applications, Big Data &Amp; Cloud Computing, Sustainable Com

Self Cite

View full text Add to dashboard Cite

A growing number of web and cloud-based products and services rely on data sharing between consumers, service providers, and their subsidiaries and third parties. There is a growing concern around the security and privacy of data in such large-scale shared architectures. Most organizations have a human-written privacy policy that discloses all the ways that data is shared, stored, and used. The organizational privacy policies must also be compliant with government and administrative regulations. This raises a major challenge for providers as they try to launch new services. Thus they are moving towards a system of automatic policy maintenance and regulatory compliance. This requires extracting policy from text documents and representing it in a semi-structured, machine-processable framework. The most popular method to this end is extracting policy information into a Knowledge Graph (KG). There exists a significant body of work that converts text descriptions of regulations into policies expressed in languages such as OWL and XACML and is grounded in the control-based schema by using NLP approaches. In this paper, we show that the NLP-based approaches to extract knowledge from written policy documents and representing them in enforceable Knowledge Graphs fail when the text policies are ambiguous. Ambiguity can arise from lack of clarity, misuse of syntax, and/or the use of complex language. We describe a system to extract features from a policy document that affect its ambiguity and classify the documents based on the level of ambiguity present. We validate this approach using human annotators. We show that a large number of documents in a popular privacy policy corpus (OPP-115) are ambiguous. This affects the ability to automatically monitor privacy policies. We show that for policies that are more ambiguous according to our proposed measure, NLP-based text segment classifiers are less accurate.

show abstract

“…The privacy policy should be unambiguous and easy to read. In the previous work by our group Kotal et al (2020) , we studied trends in privacy policies of popular e-services and developed a metric to measure the vagueness in such policies. We used the same model to measure the textual quality of privacy policies for organizations that collect, store, and/or use patient data related to COVID.…”

Section: Introductionmentioning

confidence: 99%

A Policy-Driven Approach to Secure Extraction of COVID-19 Data From Research Papers

et al. 2021

Self Cite

View full text Add to dashboard Cite

The entire scientific and academic community has been mobilized to gain a better understanding of the COVID-19 disease and its impact on humanity. Most research related to COVID-19 needs to analyze large amounts of data in very little time. This urgency has made Big Data Analysis, and related questions around the privacy and security of the data, an extremely important part of research in the COVID-19 era. The White House OSTP has, for example, released a large dataset of papers related to COVID research from which the research community can extract knowledge and information. We show an example system with a machine learning-based knowledge extractor which draws out key medical information from COVID-19 related academic research papers. We represent this knowledge in a Knowledge Graph that uses the Unified Medical Language System (UMLS). However, publicly available studies rely on dataset that might have sensitive data. Extracting information from academic papers can potentially leak sensitive data, and protecting the security and privacy of this data is equally important. In this paper, we address the key challenges around the privacy and security of such information extraction and analysis systems. Policy regulations like HIPAA have updated the guidelines to access data, specifically, data related to COVID-19, securely. In the US, healthcare providers must also comply with the Office of Civil Rights (OCR) rules to protect data integrity in matters like plasma donation, media access to health care data, telehealth communications, etc. Privacy policies are typically short and unstructured HTML or PDF documents. We have created a framework to extract relevant knowledge from the health centers’ policy documents and also represent these as a knowledge graph. Our framework helps to understand the extent to which individual provider policies comply with regulations and define access control policies that enforce the regulation rules on data in the knowledge graph extracted from COVID-related papers. Along with being compliant, privacy policies must also be transparent and easily understood by the clients. We analyze the relative readability of healthcare privacy policies and discuss the impact. In this paper, we develop a framework for access control decisions that uses policy compliance information to securely retrieve COVID data. We show how policy compliance information can be used to restrict access to COVID-19 data and information extracted from research papers.

show abstract

ViCLOUD: Measuring Vagueness in Cloud Service Privacy Policies and Terms of Services

Cited by 6 publications

References 15 publications

PriveTAB

PriveTAB

The Effect of Text Ambiguity on creating Policy Knowledge Graphs

A Policy-Driven Approach to Secure Extraction of COVID-19 Data From Research Papers

Contact Info

Product

Resources

About