Real-time Analysis of Privacy-(un)aware IoT Applications
Real-time Analysis of Privacy-(un)aware IoT Applications
复制标题
DOI：
10.2478/popets-2021-0009
复制
发表时间：
2019-11
影响因子：
--
通讯作者：
Leonardo Babun;Z. Berkay Celik;P. Mcdaniel;A. Uluagac
中科院分区：
文献类型：
--
作者：
Leonardo Babun;Z. Berkay Celik;P. Mcdaniel;A. Uluagac
摘要摘要：用户信任物联网应用程序来控制和自动化他们的智能设备。这些应用程序必须访问敏感数据才能实现其功能。然而，用户缺乏对其敏感数据如何使用的可见性，并且经常盲目信任应用程序开发人员。在本文中，我们介绍了IoTWATcH，这是一种动态分析工具，可以实时揭示物联网应用程序的隐私风险。我们通过全面的物联网隐私调查来设计和构建IoTWATcH，以满足用户的隐私需求。IoTWATCH分四个阶段运作：（a）它为用户提供了一个界面，在应用程序安装时指定他们的隐私偏好，（B）它向应用程序的源代码添加了额外的逻辑，以在运行时收集物联网数据及其接收者，（c）它使用自然语言处理（NLP）技术来构建一个模型，将物联网应用程序数据分类为直观的隐私标签，以及（d）当用户的偏好与隐私标签不匹配时，其通知用户，从而向用户暴露敏感数据泄漏。我们在真实的物联网应用上实施并评估了IoTWATcH。具体来说，我们分析了540个物联网应用程序来训练NLP模型并评估其有效性。IoTWATcH在将物联网应用数据分类为隐私标签时，平均准确率为94.25%，应用执行的延迟仅为105 ms。
Abstract Abstract: Users trust IoT apps to control and automate their smart devices. These apps necessarily have access to sensitive data to implement their functionality. However, users lack visibility into how their sensitive data is used, and often blindly trust the app developers. In this paper, we present IoTWATcH, a dynamic analysis tool that uncovers the privacy risks of IoT apps in real-time. We have designed and built IoTWATcH through a comprehensive IoT privacy survey addressing the privacy needs of users. IoTWATCH operates in four phases: (a) it provides users with an interface to specify their privacy preferences at app install time, (b) it adds extra logic to an app’s source code to collect both IoT data and their recipients at runtime, (c) it uses Natural Language Processing (NLP) techniques to construct a model that classifies IoT app data into intuitive privacy labels, and (d) it informs the users when their preferences do not match the privacy labels, exposing sensitive data leaks to users. We implemented and evaluated IoTWATcH on real IoT applications. Specifically, we analyzed 540 IoT apps to train the NLP model and evaluate its effectiveness. IoTWATcH yields an average 94.25% accuracy in classifying IoT app data into privacy labels with only 105 ms additional latency to an app’s execution.