Collaborative Research: SaTC: CORE: Medium: Understanding and Combatting Impersonation Attacks and Data Leakage in Online Advertising

在线广告网络跟踪人们访问哪些网站以及他们在这些网站上做了什么。广告网络执行这样的跟踪以开发对人们在他们的设备上的活动的全面理解，以便销售与这些活动相关的广告。 不幸的是，广告网络将来自不同设备的联合收割机信息组合成对给定个人的单一理解的方式是不安全的，并且可以允许互联网上的恶意方了解关于用户的敏感信息，诸如他们访问了什么网站、他们购买了什么产品或者他们访问了什么酒店。该项目的新贡献是识别这种对用户隐私的新威胁，识别广告网络何时通过其设备跟踪用户的方法，以及开发工具来帮助人们了解广告网络知道并保留哪些信息。 该项目更广泛的意义和重要性在于，它将如何帮助保护人们的隐私，同时也教育他们了解在线跟踪的普遍性和特殊性，使他们能够对自己的在线活动做出更明智的决定。识别和应对广告网络隐私威胁需要对广告网络、Web浏览器和测量方法进行调查。该项目将通过三项相互关联的调查来改善用户隐私。该项目将：1）定义并列举一种新的隐私威胁，这种威胁源于广告网络在设备上关联用户活动的努力，包括系统化地了解这种威胁的全部攻击面和对互联网上用户隐私的影响。2)开发一套强大的统计方法，根据观察到的广告行为检测广告网络何时将设备连接在一起，从而了解广告网络如何独立于环境或计算平台跟踪用户。 3)创建一套工具，用于教育和授权用户了解广告网络所做的数据和推断，以及广告网络是否尊重数据删除请求。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Online advertising networks track which websites people visit and what they do on those websites. Ad networks perform such tracking to develop a comprehensive understanding of people's activity across their devices in order to sell advertisements related to those activities. Unfortunately, the way ad networks combine information from different devices into a singular understanding of a given person is insecure and can allow a malicious party on the Internet to learn sensitive information about the user such as what websites they visit, what products they purchased, or what hotels they visited. This project's novel contributions are the identification of this new kind of threat to user privacy, ways of identifying when ad networks track users across their devices, and developing tools to help people understand what information ad networks know and retain about them. The project's broader significance and importance are how it will help protect people's privacy while also educating them on the pervasiveness and specificity of online tracking, allowing them to make more informed decisions about their online activities.Identifying and combating ad network privacy threats requires an investigation of ad networks, web browsers, and measurement methods. This project will improve user privacy via three interconnected investigations. The project will: 1) Define and enumerate a new class of privacy threat stemming from ad networks' efforts to correlate user activity across devices, including systematizing an understanding of this threat's full attack surface and impact on user privacy across the Internet. 2) Develop a suite of robust statistical methods to detect when ad networks link devices together based on observed advertising behaviors that will enable understanding how ad networks track users independent of environment or computing platform. 3) Create a set of tools that will educate and empower users to understand what data and inferences ad networks have made, and if ad networks are respecting data deletion requests.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.