Collaborative Research: SaTC: CORE: Medium: Understanding and Combatting Impersonation Attacks and Data Leakage in Online Advertising

在线广告网络跟踪人们访问哪些网站以及他们在这些网站上做了什么。广告网络执行这样的跟踪，以全面了解人们在其设备上的活动，以便销售与这些活动相关的广告。不幸的是，广告网络将来自不同设备的信息组合成对特定人的单一理解的方式是不安全的，可能会允许互联网上的恶意方了解用户的敏感信息，如他们访问的网站、购买的产品或访问的酒店。该项目的新贡献是识别这种对用户隐私的新威胁，识别广告网络何时通过他们的设备跟踪用户的方法，以及开发工具来帮助人们了解广告网络知道和保留关于他们的哪些信息。该项目更广泛的意义和重要性在于，它将如何帮助保护人们的隐私，同时还将教育他们了解在线跟踪的普遍性和特殊性，使他们能够对其在线活动做出更明智的决定。识别和打击广告网络隐私威胁需要对广告网络、网络浏览器和测量方法进行调查。该项目将通过三个相互关联的调查来改善用户隐私。该项目将：1)定义和列举一类新的隐私威胁，这些威胁源于广告网络将用户在不同设备上的活动关联起来的努力，包括系统化地了解这种威胁的全部攻击面以及对整个互联网上用户隐私的影响。2)开发一套稳健的统计方法，基于观察到的广告行为来检测广告网络何时将设备链接在一起，这将使您能够理解广告网络如何独立于环境或计算平台跟踪用户。3)创建一套工具，教育和增强用户了解广告网络做出了什么数据和推断，以及广告网络是否尊重数据删除请求。该奖项反映了NSF的法定使命，并已通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Online advertising networks track which websites people visit and what they do on those websites. Ad networks perform such tracking to develop a comprehensive understanding of people's activity across their devices in order to sell advertisements related to those activities. Unfortunately, the way ad networks combine information from different devices into a singular understanding of a given person is insecure and can allow a malicious party on the Internet to learn sensitive information about the user such as what websites they visit, what products they purchased, or what hotels they visited. This project's novel contributions are the identification of this new kind of threat to user privacy, ways of identifying when ad networks track users across their devices, and developing tools to help people understand what information ad networks know and retain about them. The project's broader significance and importance are how it will help protect people's privacy while also educating them on the pervasiveness and specificity of online tracking, allowing them to make more informed decisions about their online activities.Identifying and combating ad network privacy threats requires an investigation of ad networks, web browsers, and measurement methods. This project will improve user privacy via three interconnected investigations. The project will: 1) Define and enumerate a new class of privacy threat stemming from ad networks' efforts to correlate user activity across devices, including systematizing an understanding of this threat's full attack surface and impact on user privacy across the Internet. 2) Develop a suite of robust statistical methods to detect when ad networks link devices together based on observed advertising behaviors that will enable understanding how ad networks track users independent of environment or computing platform. 3) Create a set of tools that will educate and empower users to understand what data and inferences ad networks have made, and if ad networks are respecting data deletion requests.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.