SaTC: CORE: Small: Collaborative: A Multi-Layer Learning Approach to Mobile Traffic Filtering

移动生态系统已成为各种滥用行为的诱人目标。例如，许多移动应用程序会泄露敏感的用户信息，如电子邮件地址和位置，这是一个隐私问题。其次，攻击者例行公事地将恶意软件伪装在看似合法的移动应用程序中发动攻击，这构成了安全威胁。第三，许多移动应用和网站推送侵入性和不良广告，如自动播放和弹出窗口，这会损害可用性。该项目的目标是通过对移动设备上的网络流量进行实时设备过滤来防御移动生态系统中的这些滥用行为。该项目利用机器学习进行多层网络流量分析。它提取特征并训练学习模型来产生过滤规则，这些规则可以应用于设备上。由于资源有限、对数据包负载缺乏可见性以及受影响的应用程序可能受到附带损害，在移动设备上进行过滤尤其具有挑战性。所使用的过滤方法被设想为通用的(即，适用于所有应用程序)、自动的(与当前手动维护隐私相关数据的做法相比)、自适应的(针对不断变化的威胁)和以用户为中心(即，按用户定制)，同时利用用户之间的协作。总体框架将在针对移动生态系统中以下滥用场景的三个案例研究中得到验证：(I)侵入性广告(Ii)隐私泄露(Iii)恶意广告。该项目旨在增强移动生态系统的可用性、私密性和安全性，并将为移动数据透明的政策和实践提供信息。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The mobile ecosystem has become an attractive target for various types of abuses. For instance, many mobile applications leak sensitive user information, such as email addresses and location, which is a privacy issue. Second, attackers routinely disguise malware in seemingly legitimate mobile apps to launch attacks, which poses security threats. Third, many mobile apps and sites push intrusive und undesirable ads, such as auto-play and pop-ups, which harm usability. The objective of this project is to defend against these abuses in the mobile ecosystem through real-time on-device filtering of network traffic on a mobile device.The project performs multi-layer network traffic analysis with help of machine learning. It extracts features and train learning models to produce filtering rules, which can be applied on the device. Filtering on the mobile device is particularly challenging due to limited resources, lack of visibility into packet payload, and potential collateral damage on the affected apps. The filtering approach used is envisioned as universal (i.e., applicable across all apps), automated (compared to the current practice of manually maintained privacy related data), adaptive (to the ever-changing threats), and user-centric (i.e., customized per user) while leveraging collaboration among users. The general framework will be validate in three case studies against the following abuse scenarios in the mobile ecosystem: (i) intrusive ads (ii) privacy leaks (iii) malvertising. This project is excepted to enhance the usability, privacy, and security of the mobile ecosystem and will inform policies and practices on mobile data transparency.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.