CRII: SaTC: Improving the Usability and Effectiveness of Security and Privacy Settings in Mobile Apps

移动用户持有用户的敏感信息，如密码、位置和健康信息。用户可以通过在他们使用的应用程序中配置他们的隐私设置来控制其中一些信息的使用。然而，这些设置通常很难定位和理解，即使在Facebook等流行应用程序中也是如此。此外，这些设置通常默认设置为共享用户数据，在未经用户明确同意的情况下暴露个人数据。该项目的目标是开发一种自动工具来识别嵌入移动应用程序中的安全和隐私设置，识别使用设置和控制隐私时的可用性和安全性问题，并开发一种单一的、集中的方法来呈现和执行用户设置，这样用户就不需要寻找设置和控制来保护他们的隐私。研究结果将提高移动消费者的安全性和隐私性。为了实现这一目标，该项目结合了程序分析、人机交互和机器学习等技术。调查将包括实证研究，以了解用户对现有安全和隐私设置的看法，并测试当前可用设置的具体可用性问题。该研究还将开发一种通过自然语言处理和程序分析来识别和提取安全和隐私设置的方法。利用这些见解，该研究将为人们提供一个可用的集中界面来配置他们的安全和隐私设置。这项工作将为移动平台以及物联网新兴平台构建可用的安全和隐私设置提供见解。该项目将吸引不同群体的本科生和研究生，培养他们在网络安全、隐私和用户控制方法方面的兴趣和专业知识。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Mobile users hold people's sensitive information such as passwords, locations, and health information. Users are permitted to control the use of some of this information by configuring their privacy settings in the apps they use. These settings, however, are often difficult to locate and understand, even in popular apps such as Facebook. Moreover, the settings are often set to share user data by default, exposing personal data without users' explicit consent. The goal of the project is to develop an automatic tool to identify the security and privacy settings embedded in mobile apps, to identify usability and security problems in using the settings and controlling privacy, and to develop a single, centralized method of presenting and enforcing user settings such that users do not need to hunt for settings and controls to protect their privacy. The outcome of the research will improve the security and privacy of mobile consumers. To accomplish the goal, the project combines techniques from program analysis, human-computer interaction, and machine learning. The investigation will include empirical studies to understand users' perspectives on existing security and privacy settings, and test the specific usability problems with currently available settings. The research will also develop a method for identifying and extracting security and privacy settings through natural language processing and program analysis. Using these insights, the research will enable a usable centralized interface for people to configure their security and privacy settings. This work will provide insights for building usable security and privacy settings for mobile platforms, as well as for emerging platforms in the Internet of Things. This project will engage a diverse group of undergraduate and graduate students to develop their interest and expertise in cybersecurity, privacy, and methods for user control.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.