Privacy Attacks Research Articles

Managing privacy of sensitive attributes using fuzzy-based data transformation methods in privacy preserving data mining environment

When we extract personal, sensitive and business information in data mining applications, then certain problems occurs. Privacy attack occurs due to the misuse of individual information. In centralised database environment, data transformation methods in fuzzy-based data in the field of privacy preserving clustering are proposed in this paper. In first case, a fuzzy data transformation method is proposed and different experiments are conducted by changing the fuzzy membership functions such as Z-shaped fuzzy membership function, Triangular fuzzy membership function, Gaussian fuzzy membership function to transform the original dataset. In second case, a hybrid method is proposed as a combination of fuzzy data transformation approach which is specified in first case and random rotation perturbation (RRP). The experimental outcome verified that the hybrid approach permits finest results for every member functions.

Target Defense Against Link-Prediction-Based Attacks via Evolutionary Perturbations

In social networks, by removing some target-sensitive links, privacy protection might be achieved. However, some hidden links can still be re-observed by link prediction methods on observable networks. In this paper, the conventional link prediction method named Resource Allocation Index (RA) is adopted for privacy attacks. Several defense methods are proposed, including heuristic and evolutionary approaches, to protect targeted links from RA attacks via evolutionary perturbations. This is the first time to study privacy protection on targeted links against link-prediction-based attacks. Some links are randomly selected from the network as targeted links for experimentation. The simulation results on six real-world networks demonstrate the superiority of the evolutionary perturbation approach for target defense against RA attacks. Moreover, transferring experiments show that, although the evolutionary perturbation approach is designed to against RA attacks, it is also effective against other link-prediction-based attacks.

Conditional adjacency anonymity in social graphs under active attacks

Social network data is typically made available in a graph format, where users and their relations are represented by vertices and edges, respectively. In doing so, social graphs need to be anonymised to resist various privacy attacks. Among these, the so-called active attacks, where an adversary has the ability to enrol sybil accounts in the social network, have proven difficult to counteract. In this article, we provide an anonymisation technique that successfully thwarts active attacks while causing low structural perturbation. We achieve this goal by introducing (k, Gamma _{G,ell })-adjacency anonymity: a privacy property based on (k,ell )-anonymity that alleviates the computational burden suffered by anonymisation algorithms based on (k,ell )-anonymity and relaxes some of its assumptions on the adversary capabilities. We show that the proposed method is efficient and establish tight bounds on the number of modifications that it performs on the original graph. Experimental results on real-life and randomly generated graphs show that when compared to methods based on (k,ell )-anonymity, the new method continues to provide protection from equally capable active attackers while introducing a much smaller number of changes in the graph structure.

Adversaries or allies? Privacy and deep learning in big data era

SummaryDeep learning methods have become the basis of new AI‐based services on the Internet in big data era because of their unprecedented accuracy. Meanwhile, it raises obvious privacy issues. The deep learning–assisted privacy attack can extract sensitive personal information not only from the text but also from unstructured data such as images and videos. In this paper, we proposed a framework to protect image privacy against deep learning tools, along with two new metrics that measure image privacy. Moreover, we propose two different image privacy protection schemes based on the two metrics, utilizing the adversarial example idea. The performance of our solution is validated by simulations on two different datasets. Our research shows that we can protect the image privacy by adding a small amount of noise that has a humanly imperceptible impact on the image quality, especially for images of complex structures and textures.

Near Field Communication (NFC) Technology Security Vulnerabilities and Countermeasures

Nowadays; the adoption of Internet of things (IoT) technologies and applications in everyday is rising. IoT technology such as Near Field Communication (NFC) is vastly adopted due to its short range frequencies, making it a good candidate for token based security access control applications such as door systems and attendance systems. However, due to the miniature size of NFC tags; its clear text contents and unprotected communication channel between tag-reader-database; NFC technology is prone to security attacks such as the man in the middle; denial of services (DOS) and etc. These attacks lead to leakage of user critical data which could impact any organization adopting NFC applications and technologies. In this paper; NFC vulnerability, causing both security and privacy attacks studies in depth. By focusing on attacks such as DOS and data corruptions; existing risk assessment models are evaluated using Analytical Hierarchy Process (AHP) approach. Best practice in mitigating these attacks is presented as well. A case study on an existing NFC access control application is then used to demonstrate the effectiveness of best practice solutions proposed.  Â

Privacy-Preserving Authentication in Wireless IoT: Applications, Approaches, and Challenges

Wireless IoT is a promising area in which large quantities of data and information are collected, exchanged, and stored constantly. While these data and information are utilized for good purposes in wireless IoT, great risks arise in that attackers are seeking to exploit the merits of this new technology for their own benefits. In such a resource-constrained environment, devices are easily exposed to various attacks. Confidential private information is as valuable as it is vulnerable. It is difficult for end users to trust wireless IoT and to adopt related applications due to the lack of satisfactory privacy-preserving mechanisms, which has become the major obstacle for the adoption and popularization of wireless IoT. In this article, we first introduce the classical application scenarios of wireless IoT, along with related security and privacy attack models. We then present a brief overview of privacy-preserving schemes of wireless IoT. Based on the classification of application scenarios, we further present recent advances in privacy-preserving mechanisms in wireless IoT. Finally, we discuss open issues and future research directions for these application scenarios in wireless IoT.

Network Location Privacy Protection Based on Game Theory

The purpose of this paper is to protect the privacy of vehicles and passengers. In recent years, with the rapid development of vehicle networking, the location privacy of vehicle networking involves sensitive information about vehicles as well as passengers. It is of great theoretical and practical significance to put forward the privacy protection of vehicle network location. This paper is based on identity concealment, fuzzy method, cryptography and information theory. The goal is to fully protect the privacy of the vehicle's networked location. Using the technical methods of game theory as a means, and the mechanism of vehicle location privacy protection in typical applications and the game model of vehicle network attack and defense are studied. This paper introduces some common privacy protection methods, such as pseudonym transformation method, elliptic fuzzy method and so on. Establish the model and evaluation method of vehicle location privacy attack and defense strategy based on measurement. By analyzing the application scenarios, service quality and other factors and establishing the theoretical model of car network location privacy protection based on game theory, a privacy protection method based on game theory is proposed. The innovation of this paper is that the game theory is applied to the privacy protection of the Internet of vehicles. Thus, we can get the best guessing strategy of the enemy and the best privacy protection mechanism between location quality of service and privacy protection trade-off.

Restricted Sensitive Attributes-based Sequential Anonymization (RSA-SA) approach for privacy-preserving data stream publishing

Data streams have become a widely-adopted data representation format in many real-world applications. This data streaming may be published for different scientific research, mining, or analysis purposes. However, such streams may contain personal-specific data that could be considered as sensitive about individuals. This makes the privacy preserving of data streams against privacy disclosure attacks, while maintaining their utilization, is a real challenge. Some studies have considered privacy-preserving publishing over data streams with only Single Sensitive Attribute, in which they do not protect the published streams from all possible privacy attacks. In this paper, we propose a novel Restricted Sensitive Attributes-based Sequential Anonymization (RSA-SA) approach for privacy-preserving data stream publishing. Besides, two new privacy restrictions are introduced to restrict the published Sensitive Attributes values: Semantic-diversity and Sensitivity-diversity. RSA-SA can protect the sensitive values of the published data streams against the related privacy attacks, including the attribute disclosure, skewness, similarity, and sensitivity attacks. In addition, RSA-SA handles data streams that have either single or multiple sensitive attributes with minimum information loss and delay time. Thus, the data utility of the published data streams is efficiently maintained to provide more accurate mining and analytical results, where robust invulnerability to privacy attacks is sustained.

An adaptive energy aware strategy based on game theory to add privacy in the physical layer for cognitive WSNs

The expansion of big data and the evolution of Internet of Things (IoT) technologies will play an important role in the feasibility of Smart City initiatives. In this IoT network infrastructure Cognitive Wireless Sensor Networks (WSNs), as a network of nodes that work in a cooperative way to sense the spectrum and control the environment surrounding them, are one of the main technologies. Security and privacy appear as key aspects for the development of new applications and services. In this work we propose a novel artificial noise generation strategy based on game theory in order to improve the security against privacy attacks in CWSNs. Artificial noise generation consists in introducing interferences in the spectrum in order to mask the real information. The decision whether or not to introduce artificial noise is modeled through a light non-cooperative game designed for low-resources networks that balance security enhancement and energy consumption. We show, using several simulations, that even with a cognitive attacker our strategy has reduced the information obtained by the attacker (Secrecy Outage Probability) to a value under 10%. The overhead (energy consumption and spectrum occupancy) of the strategy has also been deeply analyzed. All possible cases our approach provides better results, in the ratio energy consumption - security, than not using the strategy or using a random noise generation strategy. Also, although the saturation of the radio spectrum is strongly affected, the reliability of the network is maintained in 95% of application packages received. Therefore, we can conclude that an improvement of the privacy in the physical layer is obtained, taking into account energy consumption and maintaining levels of spectrum saturation suitable for the application proposes.

Anomaly detection in ad-hoc networks based on deep learning model: A plug and play device

Ad-hoc network is a temporary self-organizing network that needs no fixed infrastructure. So it has been applied extensively in many areas requesting temporary communication such as military field, emergency disaster relief and road traffic. While, due to the feature of self-organization and wireless communication channels, ad-hoc network is more vulnerable to various attacks compared to the traditional network. In this paper, we proposed a plug and play device to detect Denial of Service (DoS) and privacy attacks. This device mainly includes capture tool and deep learning detection model. Capture tool is used to grab packets in ad-hoc networks, deep learning detection model is used for detecting attacks. An alarm will be triggered if the detected result is attack. In this way, we can avoid the detected attack to spreading out in larger scale. The proposed method can be used as the second line of dense to issue the early-warning signal. In the experiment, first, we use Deep neural network (DNN) detection model to detect DoS attacks; next, we use DNN, Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) detection model to detect XSS and SQL attacks. The results show that these detection models can achieve very high Accuracy, Precision, Recall and F1−score. In addition, the time efficiency among the CNN, the LSTM and the DNN is in acceptable range. It proofs that the proposed method can be effectively applied for attack detection. It is important to note that the proposed method can be extended to all other attacks with little modification in ad-hoc networks.

A Privacy Preserving Scheme for Nearest Neighbor Query.

In recent years, location privacy concerns that arise when using the nearest neighbor query services have gained increasing attention, as such services have become pervasive in mobile social networks devices and the IoT environments. State-of-the-art privacy preservation schemes focus on the obfuscation of the location information, which has suffered from various privacy attacks and the tradeoff of the quality of service. By noticing the fact that the user’s location could be replaced by their surrounding wireless sensor infrastructures in proximity, in this paper, we propose a wireless sensor access point-based scheme for the nearest neighbor query, without using the location of the user. Then, a noise-addition-based method that preserves user’s location privacy was proposed. To further strengthen the adaptability of the approach to real-world environments, several performance-enhancing methods are introduced, including an R-tree-based Noise-Data Retrieval Algorithm (RNR), and a nearest neighbor query method based on our research. Both performance and security evaluations are conducted to validate our approach. The results show the effectiveness and the practicality of our work.

A Triggered Delay-based Approach against Cache Privacy Attack in NDN

Content caching is one of the most significant features of Named Data Networking (NDN) that improves the performance. However, this feature makes the cache vulnerable to attacks that determine the recent cache access pattern. In cache privacy attack, an attacker can probe request and determine if the received content is cached or not, by simply observing the time difference between the requested and the received data. Existing solutions apply delay whenever the data is accessed from the cache. These approaches mitigate attack to some extent but compromise the performance of NDN. To overcome this issue, a counter scheme has been proposed in this article that detects the attack pattern at the gateway router itself and triggers the countermeasure in case of attack. The triggered-based approach delays the data accessed from the cache, only when the attack is detected instead of each time when the data is accessed from the cache. The proposed approach has been compared with an approach that induces a random delay in case of the cache hit. The results prove that the triggered delay-based approach is better than the random delay approach in terms of average delay.

D2D Opportunistic Local Content Dissemination Sans Location Sharing

In this paper, we consider the problem of local content dissemination among mobile users via decentralized device-to-device (D2D) communication, where the concerned contents have relevance only within a geographic span centered at their respective location of creation. This has several potential applications, for example, advertising and sharing contents specific to an event. To this end, we propose a scheme for locality-bounded content and information dissemination (LUCID) leveraging opportunistic D2D communications. Unlike other existing works, LUCID innovates by not requiring users to share locations of the centers of localities and, thereby, provides a natural defense against possible location privacy attacks. In this paper, we theoretically characterize the behavior of LUCID for different locality sizes. Moreover, we investigate the extent to which an individual user can attempt to infer the location of a center of a locality, and discuss why that is difficult to achieve. Finally, we also consider an alternative version of LUCID where locations are partially shared. Results of simulation-based performance evaluation indicate that, when compared to an optimal scheme, LUCID can deliver contents to about two-third of the relevant users without requiring any location sharing.

K-Anonymity Versus L-Diversity: A Comparative Analysis on Data Anonymization Techniques

The main aim of data publishing is to make the data utilized by the researchers, scientists and data analysts to process the data by analytics and statistics which in turn useful for decision making. This data in its original form may contain some person-specific information, which should not be disclosed while publishing the data. So, privacy of such individuals should be preserved. Hence, privacy preserving data publishing plays a major role in providing privacy for person-specific data. The data should be published in such a way that, there should not be any technical way for adversary to infer the information of specific individuals. This paper provides overview on popular privacy preserving techniques. In this study, a honest effort shows that, concepts behind these techniques are analyzed and justified with suitable examples, drawbacks and vulnerability of these techniques towards privacy attacks are narrated.

Protecting privacy for distance and rank based group nearest neighbor queries

This paper proposes a novel approach to safeguarding location privacy for GNN (group nearest neighbor) queries. Given the locations of a group of dispersed users, the GNN query returns the location that minimizes the total or the maximal distance for all group users. The returned location is typically a meeting place such as a cinema or coffee shop where the group would like to meet. In our work, we highlight the challenges for private GNN queries and propose a general framework that have two key features: (i) it ensures privacy in a decentralized manner and (ii) can compute an optimal location for GNN query that maximizes the group’s overall preference for the meeting place. To mask their precise locations, we assume that user locations are given as regions to a location-based service provider (LSP). The LSP computes then a set of candidate answers (i.e., meeting places) for the GNN query. We identify two privacy attacks on the user locations, the distance intersection attack and the rank disclosure attack. These attacks are possible when the answer of a GNN query is determined from the candidate answers in a straightforward manner. We develop private filters that prevent these attacks and compute the GNN from the retrieved candidate answers. Our decentralized approach ensures that neither the users nor the LSP can learn the location of any group member. Our algorithms compute from the candidate set an optimal meeting place given the group members’ imprecise locations. Our key insight to an efficient computation is to prune the meeting places that cannot be GNNs given the locations of the group members within the search region. A comprehensive experimental evaluation shows the effectiveness of our approach to answering private GNN queries.

Ghost Riders: Sybil Attacks on Crowdsourced Mobile Mapping Services

Real-time crowdsourced maps, such as Waze provide timely updates on traffic, congestion, accidents, and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based Sybil devices that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. To defend against Sybil devices, we propose a new approach based on co-location edges, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, co-location edges combine to form large proximity graphs that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and how they can be used to dramatically reduce the impact of the attacks. We have informed Waze/Google team of our research findings. Currently, we are in active collaboration with Waze team to improve the security and privacy of their system.

Privacy and user awareness on Facebook

Users’ privacy on social media platforms continues to be important as users face numerous threats to their personal data. Social media sites such as Facebook store large amounts of users’ personal data which make such sites prime targets for hackers. Research has shown that users have been subjected to privacy attacks in which hacked personal data are sold to online marketers. These incidents have prompted the need to protect users’ privacy against data theft by third parties. We investigated the privacy risks that social media users on Facebook face when online. The privacy awareness of regular users of Facebook was evaluated through the observation of their online activities. Facebook was selected as a case study because it is the largest and most popular social media platform in South Africa. A sample group of Facebook users was selected for this study based on their activeness (or frequency of posting, uploaded or liking) on the site. Findings indicate that users’ personal data can be obtained as they are publicly available on Facebook. The implication of this finding is that users lack adequate awareness on protection tools designed to protect their personal data, and as a result, they risk losing their data and privacy.
 Significance:
 
 This study serves as an assessment tool for the privacy and security features of the social media site Facebook. This assessment tool can help users of social media sites to evaluate their own behaviour and usage patterns on Facebook. It can also assist social media site designers in considering the effectiveness of current measures, which are designed to ensure that the privacy and safety of users are protected.

Social Engineering Attacks and Countermeasures in the New Zealand Banking System: Advancing a User-Reflective Mitigation Model

Social engineering attacks are possibly one of the most dangerous forms of security and privacy attacks since they are technically oriented to psychological manipulation and have been growing in frequency with no end in sight. This research study assessed the major aspects and underlying concepts of social engineering attacks and their influence in the New Zealand banking sector. The study further identified attack stages and provided a user-reflective model for the mitigation of attacks at every stage of the social engineering attack cycle. The outcome of this research was a model that provides users with a process of having a reflective stance while engaging in online activities. Our model is proposed to aid users and, of course, financial institutions to re-think their anti-social engineering strategies while constantly maintaining a self-reflective assessment of whether they are being subjected to social engineering attacks while transacting online.

Accurate filtering of privacy-sensitive information in raw genomic data

Sequencing thousands of human genomes has enabled breakthroughs in many areas, among them precision medicine, the study of rare diseases, and forensics. However, mass collection of such sensitive data entails enormous risks if not protected to the highest standards. In this article, we follow the position and argue that post-alignment privacy is not enough and that data should be automatically protected as early as possible in the genomics workflow, ideally immediately after the data is produced. We show that a previous approach for filtering short reads cannot extend to long reads and present a novel filtering approach that classifies raw genomic data (i.e., whose location and content is not yet determined) into privacy-sensitive (i.e., more affected by a successful privacy attack) and non-privacy-sensitive information. Such a classification allows the fine-grained and automated adjustment of protective measures to mitigate the possible consequences of exposure, in particular when relying on public clouds. We present the first filter that can be indistinctly applied to reads of any length, i.e., making it usable with any recent or future sequencing technologies. The filter is accurate, in the sense that it detects all known sensitive nucleotides except those located in highly variable regions (less than 10 nucleotides remain undetected per genome instead of 100,000 in previous works). It has far less false positives than previously known methods (10% instead of 60%) and can detect sensitive nucleotides despite sequencing errors (86% detected instead of 56% with 2% of mutations). Finally, practical experiments demonstrate high performance, both in terms of throughput and memory consumption.

An automatic RFID reader-to-reader delegation protocol for SCM in cloud computing environment

Radio frequency identification (RFID) technology enables unique identification and tracking of the tag attached to an object. Widespread usage of RFID technologies in supply chain management (SCM) has drawn attention for developing security protocols to protect data stored in the tag. In SCM objects move from one place/department to another, the same RFID readers are not used throughout the supply chain. So, current reader delegates its access right to the new reader. When an object is moved inside the organization, delegation takes place between the readers. Many of the existing delegation protocols use trusted third party (TTP), which is practically difficult to incorporate or requires a keyed hash function/symmetric key encryption to be executed in the RFID tag, whereas tags are computationally intensive. Our work aims to simplify the delegation process by removing the usage of a TTP as well as eliminating reader-to-reader communication which avoids fixing the reader sequence in advance. Also, it preserves the security and privacy requirements for cloud-based applications. The proposed protocol withstands many attacks like tracing attack, tag impersonation attack, reader impersonation attack, and privacy attack. The proposed protocol not only resists the above-mentioned attacks but also achieves mutual authentication, anonymity property, and forward/backward secrecy. The proposed protocol is analyzed formally using GNY logic, which ensures that the protocol achieves mutual authentication. Performance analysis is carried out and it shows that our protocol is relatively better than the existing related schemes with respect to tag computation and communication cost.