SaTC: CORE: Medium: Collaborative: Defending against Compromise and Manipulation of Mobile Communities

今天的许多移动服务都建立了移动社区，用户可以分享他们宝贵的经验和数据。例如交通事故(Waze)、餐馆评论(Yelp、FourSquare)、匿名社交网络(Whisper、Yak Yak)，甚至约会(Tinder、Bumble)。不幸的是，新的威胁可能会危害和操纵这些社区，使用轻量级软件来模拟移动设备。研究人员展示了攻击者如何窃听移动网络流量，学习他们的模式，并编写软件来模拟运行该应用程序的移动设备。这将现有的攻击放大了好几个数量级，并允许资源有限的攻击者使用他们控制的数百万台模拟设备来淹没移动社区。这些设备很难检测到，会完全瘫痪整个移动系统，或者为了攻击者的个人利益而操纵它们。初步工作表明，对谷歌的众包交通导航应用Waze的这种攻击，使得对大量用户群体的细粒度GPS级跟踪成为可能。类似的漏洞也适用于Yelp、Tinder、Uber和其他网站，后果从操纵/审查内容、窃取金钱激励到完全瘫痪服务。本提案中描述的工作旨在更好地了解软件仿真设备对移动社区的威胁，并探索针对它们的系统防御措施。研究人员将使用三种正交方法开发防御系统，检测大规模攻击，并将其影响限制在单个行为不当的设备上：a)基于基础设施的集中式解决方案，使用聚合用户数据中的隐藏模式对移动设备进行身份验证；b)硬件解决方案，使用平台API提取设备特定的传感器数据，并将其与已知的硬件数据模型进行比较；以及c)应用程序级解决方案，基于用户行为(点击流)和物理移动性跟踪的分析，使用无监督学习来自动检测设备中的相似性群集。

Many of today's mobile services build mobile communities of users who share their valuable experiences and data. Examples include traffic incidents (Waze), restaurant reviews (Yelp, FourSquare), anonymous social networks (Whisper, Yik Yak), and even dating (Tinder, Bumble). Unfortunately, new threats can compromise and manipulate these communities, using lightweight software to mimic mobile devices. The researchers have shown how attackers can eavesdrop on mobile network traffic, learn their patterns, and write software to emulate mobile devices running the application. This amplifies existing attacks by multiple orders of magnitude, and allows attackers with limited resources to overwhelm mobile communities using millions of emulated devices under their control. These devices are difficult to detect, and completely cripple entire mobile systems, or manipulate them for the attacker's personal gain. Preliminary work showed that such an attack on Waze, Google's crowdsourced traffic navigation application, enabled fine grained GPS-level tracking of large user populations. Similar vulnerabilities apply to Yelp, Tinder, Uber, and others, with consequences ranging from manipulating/censoring content, theft of monetary incentives, to completely crippling the service.The work described in this proposal seeks a better understanding of the threat of software-emulated devices to mobile communities, and explores systematic defenses against them. The researchers will develop defenses that detect large-scale attacks and limit their impact to that of single misbehaving devices, using three orthogonal approaches: a) a centralized infrastructure-based solution, that uses hidden patterns in aggregate user data to authenticate mobile devices; b) hardware solutions that extracts device-specific sensor data using platform APIs, and compares them to known models of hardware data models; and c) application-level solutions that use unsupervised learning to automatically detect similarity clusters in devices, based on analysis of user behavior (clickstreams) and physical mobility trace.