SaTC: CORE: Medium: Collaborative: Defending against Compromise and Manipulation of Mobile Communities

当今的许多移动的服务建立了用户的移动的社区，这些用户共享他们宝贵的经验和数据。例如交通事故（Waze）、餐馆评论（Yelp、FourSquare）、匿名社交网络（Whisper、Yik Yak），甚至约会（Tinder、Bumble）。 不幸的是，新的威胁可能会危害和操纵这些社区，使用轻量级软件来模仿移动的设备。 研究人员已经展示了攻击者如何窃听移动的网络流量，学习他们的模式，并编写软件来模拟运行应用程序的移动的设备。这将现有的攻击放大了几个数量级，并允许资源有限的攻击者使用其控制下的数百万台模拟设备来淹没移动的社区。这些设备很难被检测到，并完全削弱整个移动的系统，或操纵它们为攻击者的个人利益。 初步工作表明，对Waze（谷歌的众包交通导航应用程序）的这种攻击能够对大量用户群体进行细粒度的GPS级跟踪。类似的漏洞也适用于Yelp、Tinder、Uber和其他公司，其后果包括操纵/审查内容、窃取金钱奖励，甚至完全瘫痪服务。本提案中描述的工作旨在更好地了解软件仿真设备对移动的社区的威胁，并探索针对它们的系统防御。研究人员将使用三种正交方法开发检测大规模攻击并将其影响限制在单个行为不端设备上的防御措施：a）基于基础设施的集中式解决方案，使用聚合用户数据中的隐藏模式来验证移动的设备; B）硬件解决方案，使用平台API提取特定于设备的传感器数据，并将其与硬件数据模型的已知模型进行比较;以及c）基于对用户行为（点击流）和物理移动性跟踪的分析，使用无监督学习来自动检测设备中的相似性集群的应用级解决方案。

Many of today's mobile services build mobile communities of users who share their valuable experiences and data. Examples include traffic incidents (Waze), restaurant reviews (Yelp, FourSquare), anonymous social networks (Whisper, Yik Yak), and even dating (Tinder, Bumble). Unfortunately, new threats can compromise and manipulate these communities, using lightweight software to mimic mobile devices. The researchers have shown how attackers can eavesdrop on mobile network traffic, learn their patterns, and write software to emulate mobile devices running the application. This amplifies existing attacks by multiple orders of magnitude, and allows attackers with limited resources to overwhelm mobile communities using millions of emulated devices under their control. These devices are difficult to detect, and completely cripple entire mobile systems, or manipulate them for the attacker's personal gain. Preliminary work showed that such an attack on Waze, Google's crowdsourced traffic navigation application, enabled fine grained GPS-level tracking of large user populations. Similar vulnerabilities apply to Yelp, Tinder, Uber, and others, with consequences ranging from manipulating/censoring content, theft of monetary incentives, to completely crippling the service.The work described in this proposal seeks a better understanding of the threat of software-emulated devices to mobile communities, and explores systematic defenses against them. The researchers will develop defenses that detect large-scale attacks and limit their impact to that of single misbehaving devices, using three orthogonal approaches: a) a centralized infrastructure-based solution, that uses hidden patterns in aggregate user data to authenticate mobile devices; b) hardware solutions that extracts device-specific sensor data using platform APIs, and compares them to known models of hardware data models; and c) application-level solutions that use unsupervised learning to automatically detect similarity clusters in devices, based on analysis of user behavior (clickstreams) and physical mobility trace.