NoMoATS: Towards Automatic Detection of Mobile Tracking
NoMoATS: Towards Automatic Detection of Mobile Tracking
复制标题
DOI：
10.2478/popets-2020-0017
复制
发表时间：
2020-04
影响因子：
--
通讯作者：
A. Shuba;A. Markopoulou
中科院分区：
文献类型：
--
作者：
A. Shuba;A. Markopoulou
摘要今天的移动应用程序使用第三方广告和跟踪(A&T)库，这可能会对隐私构成威胁。通过使用手动管理的过滤器列表(例如，EasyList)以及最近使用的机器学习方法，最先进的检测和阻止传出的A&T HTTP/S请求。过滤器列表和分类器的主要瓶颈是它们依赖专家和社区来检查流量并手动创建过滤器列表规则，然后使用这些规则来阻止流量或标记地面真实数据集。我们提出了NoMoATS-一个通过将手动创建过滤规则的艰巨任务减少到更容易和可扩展的标记A&T库的任务来消除这一瓶颈的系统。我们的系统利用堆栈跟踪分析来自动标记哪些网络请求是由A&T库生成的。使用NoMoATS，我们收集并标记了一个新的移动流量数据集。我们使用该数据集训练决策树分类器，可以在移动设备上实时应用，平均F-Score达到93%。我们展示了我们的自动标签和我们的分类器都发现了去往数百个不同主机的数千个请求，这些请求以前没有被流行的过滤器列表检测到。据我们所知，我们的系统是第一个(1)自动标记哪些移动网络请求参与A&T，而只需要手动标签库的目的，(2)应用设备上的机器学习分类器，它以URL的粒度运行，可以检查所有应用程序的连接，不仅检测广告，还可以跟踪。
Abstract Today’s mobile apps employ third-party advertising and tracking (A&T) libraries, which may pose a threat to privacy. State-of-the-art detects and blocks outgoing A&T HTTP/S requests by using manually curated filter lists (e.g. EasyList), and recently, using machine learning approaches. The major bottleneck of both filter lists and classifiers is that they rely on experts and the community to inspect traffic and manually create filter list rules that can then be used to block traffic or label ground truth datasets. We propose NoMoATS – a system that removes this bottleneck by reducing the daunting task of manually creating filter rules, to the much easier and scalable task of labeling A&T libraries. Our system leverages stack trace analysis to automatically label which network requests are generated by A&T libraries. Using NoMoATS, we collect and label a new mobile traffic dataset. We use this dataset to train decision tree classifiers, which can be applied in real-time on the mobile device and achieve an average F-score of 93%. We show that both our automatic labeling and our classifiers discover thousands of requests destined to hundreds of different hosts, previously undetected by popular filter lists. To the best of our knowledge, our system is the first to (1) automatically label which mobile network requests are engaged in A&T, while requiring to only manually label libraries to their purpose and (2) apply on-device machine learning classifiers that operate at the granularity of URLs, can inspect connections across all apps, and detect not only ads, but also tracking.