TWC SBE: Medium: Collaborative: User-Centric Risk Communication and Control on Mobile Devices

风险沟通是许多网络安全机制的重要组成部分。 Android目前的风险沟通机制是基于安全警告，并且已经被证明是无效的，因为用户习惯于忽略此类警告，并倾向于同意所有提示。 这个多学科研究项目旨在为Android平台开发可用的风险沟通和控制的整体解决方案。 该项目研究了一种在多个粒度上呈现风险信息的方法，包括高级别的数字风险摘要、不同维度的中级风险摘要和详细的风险信息。 高级风险汇总通过信息集成技术计算，使用从多个来源发现的信息，例如，用户评论和应用程序源代码。 此摘要可实现主动风险沟通（例如，当用户搜索应用程序时），以便用户可以将该信息带入决策过程。 该项目还引入了一种多模式方法，除了传达风险外，还从阻止风险应用程序和确保用户真正了解风险的意义上控制风险。 该项目开发了在运行时聚合、沟通和控制应用程序所产生的风险的机制，以及个性化风险整合、沟通和控制技术的方法，以适应用户之间的差异。该项目有望在风险沟通和控制的原则和技术方面推进最先进的水平，并有可能通过与谷歌研究人员的合作影响Android应用程序生态系统。

Risk communication is an important part of many cyber security mechanisms. Android's current risk communication mechanism is based on security warnings and has been demonstrated to be ineffective because users become habituated to ignore such warnings and tend to consent to all prompts. This multi-disciplinary research project aims at developing holistic solutions to usable risk communication and control for the Android platform. This project investigates an approach that presents risk information at multiple granularities, including a high-level numerical risk summary, an intermediate-level summary of risk for different dimensions, and detailed risk information. The high-level risk summary is computed by information integration techniques, using information discovered from multiple sources, e.g., user reviews and app source code. This summary enables proactive risk communication (e.g., when the user searches for apps) so that users can take this information into the decision process. This project also introduces a multi-mode approach that, in addition to communicating risks, also controls risks in the sense of discouraging risky applications and ensuring that users truly understand the risks. The project develops mechanisms that aggregate, communicate, and control risks incurred by apps at runtime, and ways to personalize risk integration, communicate, and control techniques to accommodate differences among users.This project is expected to advance the state of the art in principles and techniques to risk communication and control, and has the potential to impact the Android app ecosystem by collaboration with Google researchers.