大规模用户隐私风险量化研究

信息安全研究 ›› 2019, Vol. 5 ›› Issue (9): 778-788.

大规模用户隐私风险量化研究

孟小峰,朱敏杰,刘俊旭

中国人民大学信息学院

收稿日期:2019-09-06 出版日期:2019-09-15 发布日期:2019-09-06
通讯作者: 孟小峰
作者简介:孟小峰（1964-）男，博士，教授，博士生导师，CCF会士，主要研究领域为数据库理论与系统，大数据管理系统，大数据隐私保护，大数据融合与智能，大数据实时分析，社会计算等。 xfmeng@ruc.edu.cn 朱敏杰（1993-）女，硕士研究生，主要研究方向为大数据隐私保护。 minjaezhu@163.com 刘俊旭（1995-）女，博士生，主要研究领域为隐私保护。 junxu_liu@ruc.edu.cn

Quantitative Research on Privacy Risk of LargeScale Mobile Users

Received:2019-09-06 Online:2019-09-15 Published:2019-09-06

摘要/Abstract

摘要： 移动应用程序的日益繁多使得移动互联网服务提供商有机会收集到大规模的用户数据，然而其数据收集和使用的不规范使移动用户面临着极其严峻的隐私风险问题.如何分析用户隐私风险状况并进行隐私保护成为当前亟待解决的重要问题.基于移动应用程序的权限分析方法，提出一种用户隐私风险量化模型.该模型首先通过39个敏感权限识别移动应用程序内个人隐私数据收集状况，并以此为数据泄露源，考虑数据泄露的可能性及数据的隐私危害程度.然后，利用3000万移动设备上的移动应用程序数据，进一步构建隐私风险量化模型.最后，基于该模型分析单个用户的隐私风险值分布，并进一步研究各用户群体的隐私风险趋势，从而构建中国隐私风险指数体系，以区域隐私风险指数、人群隐私风险指数、行为隐私风险指数分别反映不同属性用户群体面临隐私风险的差异.

关键词: 大数据隐私, 移动应用程序, 风险量化, 权限分析, 中国隐私风险指数

Abstract: The increasing number of mobile applications have given mobile Internet service providers the opportunity to collect large amounts of user data. However, the unreasonable and abnormal collection and use of data have made mobile users face extremely serious privacy risk. How to analyze the status of user privacy risk and protect user privacy have become an urgent issue. Based on the permission analysis of mobile applications, this paper proposes a novel user privacy risk quantification model. This model first identifies the personal privacyrelated data collection of mobile applications through 39 privacy permissions which are considered as leakage data source, then consider the possibility of data leakage and the privacy hazard degree of data. This model is further constructed with the assist of application usage data of 30 million mobile devices. Finally, the distribution of privacy risks of individual users is analyzed. Then through analyzing the average user privacy risk value of each user group, the China privacy risk index is formulated to reflect the differences in privacy risks among various user groups, including the regional privacy risk index, the population privacy risk index, and the behavioral privacy risk index.

Key words: big data privacy, mobile application, risk quantification, permission analysis, the China privacy risk index

孟小峰朱敏杰刘俊旭. 大规模用户隐私风险量化研究[J]. 信息安全研究, 2019, 5(9): 778-788.

参考文献

[1] 中国消费者协会. App个人信息泄露情况调查报告[EB/OL].2018-08-29[2019-06-09]. http://www.cca.org.cn/jmxf/detail/28180.html. [2] Slavin R, Wang X, Hosseini M B, et al. Toward a Framework for Detecting Privacy Policy Violations in Android Application Code[C]//Proceedings of the 38th International Conference on Software Engineering. New York, NY, USA: ACM, 2016: 25–36. [3] Yu L, Luo X, Liu X, et al. Can We Trust the Privacy Policies of Android Apps?[C]//2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). 2016: 538–549. [4] Enck W, Ongtang M, Mcdaniel P. On Lightweight Mobile Phone Application Certification[C]//Proceedings of the 16th ACM Conference on Computer and Communications Security. New York, NY, USA: ACM, 2009: 235–245. [5] Hamed A, Kaffel Ben Ayed H. Privacy risk assessment and users’ awareness for mobile apps permissions[C]//2016: 1–8. [6] Hamed A, Ayed H K-B, Machfar D. Assessment for Android apps permissions a proactive approach toward privacy risk[C]//2017 13th International Wireless Communications and Mobile Computing Conference (IWCMC). 2017: 1465–1470. [7] Wei M, Gong X, Wang W. Claim What You Need: A Text-Mining Approach on Android Permission Request Authorization[C]//2015 IEEE Global Communications Conference (GLOBECOM). 2015: 1–6. [8] 张贤贤, 王浩宇, 郭耀, 等. 基于众包和机器学习的移动应用隐私评级研究[J]. 计算机科学与探索, 2018, 12(08): 1238–1251. [9] Felt A P, Chin E, Hanna S, et al. Android permissions demystified[J]. Proceedings of the 18th ACM conference on Computer and communications security - CCS ’11, 2011: 627. [10] Au K W Y, Zhou Y F, Huang Z, et al. PScout: Analyzing the Android Permission Specification[C]//Proceedings of the 2012 ACM Conference on Computer and Communications Security. New York, NY, USA: ACM, 2012: 217–228. [11] Rosen S, Qian Z, Mao Z M. AppProfiler: A Flexible Method of Exposing Privacy-related Behavior in Android Applications to End Users[C]//Proceedings of the Third ACM Conference on Data and Application Security and Privacy. New York, NY, USA: ACM, 2013: 221–232. [12] Enck W, Gilbert P, Chun B-G, et al. TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones[J]. ACM Transactions on Computer Systems (TOCS), 2010, 32(2): 5. [13] Le A, Varmarken J, Langhoff S, et al. AntMonitor: A System for Monitoring from Mobile Devices[C]//Proceedings of the 2015 ACM SIGCOMM Workshop on Crowdsourcing and Crowdsharing of Big (Internet) Data. New York, NY, USA: ACM, 2015: 15–20. [14] Zang J, Dummit K, Graves J, et al. Who Knows What About Me? A Survey of Behind the Scenes Personal Data Sharing to Third Parties by Mobile Apps[J]. Technology Science, 2015. [15] COMMISSION NATIONALE DE L’INFORMATIQUE ET DES LIBERTÉS. Publication : EBIOS — Expression des Besoins et Identification des Objectifs de Sécurité[EB/OL]. ANSSI, [2019-03-05]. https://www.ssi.gouv.fr/guide/ebios-2010-expression-des-besoins-et-identification-des-objectifs-de-securite/. [16] Mylonas A, Theharidou M, Gritzalis D. Assessing Privacy Risks in Android: A User-Centric Approach[C]//Risk Assessment and Risk-Driven Testing. Springer, Cham, 2013: 21–37.