SaTC: CORE: Medium: Collaborative: Defending against Compromise and Manipulation of Mobile Communities

今天的许多移动服务都建立了移动社区，让用户分享他们宝贵的经验和数据。例子包括交通事故（Waze），餐馆评论（Yelp, FourSquare），匿名社交网络（Whisper, Yik Yak），甚至约会（Tinder, Bumble）。不幸的是，新的威胁可以破坏和操纵这些社区，使用轻量级软件模拟移动设备。研究人员展示了攻击者如何窃听移动网络通信，了解其模式，并编写软件来模拟运行该应用程序的移动设备。这将现有的攻击放大了多个数量级，并允许攻击者利用有限的资源，利用他们控制下的数百万个模拟设备来压倒移动社区。这些设备很难被检测到，并且完全破坏了整个移动系统，或者为了攻击者的个人利益而操纵它们。初步研究表明，对b谷歌的众包交通导航应用程序Waze的这种攻击，可以对大量用户群体进行精细的gps级跟踪。类似的漏洞也适用于Yelp、Tinder、Uber和其他公司，其后果包括操纵/审查内容、窃取金钱奖励，甚至完全瘫痪服务。本提案中描述的工作旨在更好地理解软件模拟设备对移动社区的威胁，并探索针对它们的系统防御。研究人员将开发检测大规模攻击的防御措施，并使用三种正交方法将其影响限制在单个行为不端的设备上：a)基于集中基础设施的解决方案，该解决方案使用聚合用户数据中的隐藏模式来验证移动设备；b)硬件解决方案，使用平台api提取特定于设备的传感器数据，并将其与硬件数据模型的已知模型进行比较；c)应用级解决方案，使用无监督学习，基于用户行为（点击流）和物理移动跟踪的分析，自动检测设备中的相似性集群。

Many of today's mobile services build mobile communities of users who share their valuable experiences and data. Examples include traffic incidents (Waze), restaurant reviews (Yelp, FourSquare), anonymous social networks (Whisper, Yik Yak), and even dating (Tinder, Bumble). Unfortunately, new threats can compromise and manipulate these communities, using lightweight software to mimic mobile devices. The researchers have shown how attackers can eavesdrop on mobile network traffic, learn their patterns, and write software to emulate mobile devices running the application. This amplifies existing attacks by multiple orders of magnitude, and allows attackers with limited resources to overwhelm mobile communities using millions of emulated devices under their control. These devices are difficult to detect, and completely cripple entire mobile systems, or manipulate them for the attacker's personal gain. Preliminary work showed that such an attack on Waze, Google's crowdsourced traffic navigation application, enabled fine grained GPS-level tracking of large user populations. Similar vulnerabilities apply to Yelp, Tinder, Uber, and others, with consequences ranging from manipulating/censoring content, theft of monetary incentives, to completely crippling the service.The work described in this proposal seeks a better understanding of the threat of software-emulated devices to mobile communities, and explores systematic defenses against them. The researchers will develop defenses that detect large-scale attacks and limit their impact to that of single misbehaving devices, using three orthogonal approaches: a) a centralized infrastructure-based solution, that uses hidden patterns in aggregate user data to authenticate mobile devices; b) hardware solutions that extracts device-specific sensor data using platform APIs, and compares them to known models of hardware data models; and c) application-level solutions that use unsupervised learning to automatically detect similarity clusters in devices, based on analysis of user behavior (clickstreams) and physical mobility trace.