User's Private Information Research Articles

A Survey of Privacy Protection and Network Security in User On-Demand Anonymous Communication

In an untrusted Internet environment, there is a large amount of user privacy information being vulnerable to various attacks, and it is an important security concern for users on how to protect their privacy, and to further provide the anonymity guarantee. Recently, most privacy-sensitive users prefer anonymous communication to protect their private information from eavesdropping by attackers. Each user has different privacy protection demands for anonymous communication. However, anonymous communication methods cannot meet the various anonymity needs of users. Hence, the user on-demand anonymous communication is proposed, which can dynamically adjust the anonymity level according to a user’s anonymity needs. However, the defense capabilities against attacks are insufficient in the existing user on-demand anonymous communication. Some malicious users in the network employ anonymous communication to hide their identities and attack the Internet. Moreover, the existing user on-demand anonymous communication is weak against traffic classification attacks based on machine learning. Therefore, this paper investigates its progresses and defects in privacy protection and network security. User on-demand anonymous communication is mainly composed of the user side and the transmission side. We separately investigate privacy protection and network security of user on-demand anonymous communication from the user side and the transmission side. By surveying various identity anonymity of users on the user side and the hierarchical anonymous transmission on the transmission side, we find two kinds of serious attacks in user on-demand anonymous communication, i.e., abuse of anonymous communication and traffic classification attacks based on machine learning. To solve the above security issues, we suggest the balancing mechanism of anonymous communication and behavior tracking which is used to prevent anonymous abuse, and the secure defense mechanism which is used to resist traffic classification attacks. To inspire follow-up research, we identify some open problems and emphasize future trends concerning user on-demand anonymous communication.

Social network analysis of law information privacy protection of cybersecurity based on rough set theory

PurposeThe purpose of this paper is to solve the problem of information privacy and security of social users. Mobile internet and social network are more and more deeply integrated into people’s daily life, especially under the interaction of the fierce development momentum of the Internet of Things and diversified personalized services, more and more private information of social users is exposed to the network environment actively or unintentionally. In addition, a large amount of social network data not only brings more benefits to network application providers, but also provides motivation for malicious attackers. Therefore, under the social network environment, the research on the privacy protection of user information has great theoretical and practical significance.Design/methodology/approachIn this study, based on the social network analysis, combined with the attribute reduction idea of rough set theory, the generalized reduction concept based on multi-level rough set from the perspectives of positive region, information entropy and knowledge granularity of rough set theory were proposed. Furthermore, it was traversed on the basis of the hierarchical compatible granularity space of the original information system and the corresponding attribute values are coarsened. The selected test data sets were tested, and the experimental results were analyzed.FindingsThe results showed that the algorithm can guarantee the anonymity requirement of data publishing and improve the effect of classification modeling on anonymous data in social network environment.Research limitations/implicationsIn the test and verification of privacy protection algorithm and privacy protection scheme, the efficiency of algorithm and scheme needs to be tested on a larger data scale. However, the data in this study are not enough. In the following research, more data will be used for testing and verification.Practical implicationsIn the context of social network, the hierarchical structure of data is introduced into rough set theory as domain knowledge by referring to human granulation cognitive mechanism, and rough set modeling for complex hierarchical data is studied for hierarchical data of decision table. The theoretical research results are applied to hierarchical decision rule mining and k-anonymous privacy protection data mining research, which enriches the connotation of rough set theory and has important theoretical and practical significance for further promoting the application of this theory. In addition, combined the theory of secure multi-party computing and the theory of attribute reduction in rough set, a privacy protection feature selection algorithm for multi-source decision table is proposed, which solves the privacy protection problem of feature selection in distributed environment. It provides a set of effective rough set feature selection method for privacy protection classification mining in distributed environment, which has practical application value for promoting the development of privacy protection data mining.Originality/valueIn this study, the proposed algorithm and scheme can effectively protect the privacy of social network data, ensure the availability of social network graph structure and realize the need of both protection and sharing of user attributes and relational data.

Adaptive Group-Based Zero Knowledge Proof-Authentication Protocol in Vehicular Ad Hoc Networks

Vehicular Ad Hoc Networks (VANETs) are a particular subclass of mobile ad hoc networks that raise a number of security challenges, notably from the way users authenticate the network. Authentication technologies based on existing security policies and access control rules in such networks assume full trust on Roadside Unit (RSU) and authentication servers. The disclosure of authentication parameters enables user's trace-ability over the network. VANETs' trusted entities (e.g. RSU) can utilize such information to track a user traveling behavior, violating user privacy and anonymity. In this paper, we proposed a novel, light-weight, Adaptive Group-based Zero Knowledge Proof-Authentication Protocol (AGZKP-AP) for VANETs. The proposed authentication protocol is capable of offering various levels of users' privacy settings based on the type of services available on such networks. Our scheme is based on the Zero-Knowledge-Proof (ZKP) crypto approach with the support of trade-off options. Users have the option to make critical decisions on the level of privacy and the amount of resources usage they prefer such as short system response time versus the number of private information disclosures. Furthermore, AGZKP-AP is incorporated with a distributed privilege control and revoking mechanism that render user's private information to law enforcement in case of a traffic violation.

Robust Energy Management of Residential Nanogrids via Decentralized Mean Field Control

Energy management systems (EMS) are viable techniques to reduce the customers billing cost as well as enhancing the grid reliability and efficiency. Uncertainty and information privacy of users are serious concerns in designing EMS of a residential nanogrid with renewable energy resources. This paper addresses a decentralized energy management algorithm for day-ahead scheduling of residential nanogrids using the concept of Mean Field (MF). The aim of each user is to find its optimal demand strategy by minimizing an objective function consisting of energy consumption cost, battery degradation cost, and cost of user discomfort while meeting a suite of constraints. The strategy of a user affects the objective functions of other users through the electricity price; such interaction among the users is hence modeled as a game problem. Each user, without any information exchange with other users, sends its electricity demand to the utility company. The utility company broadcasts the aggregated demand as a common information of the grid (MF term) to all users. The robustness of the algorithm in presence of uncertainties in decision making of the clients and non-residential load prediction error is analytically verified. In particular, it is shown that the algorithm converges to $\epsilon$ -Nash equilibrium point of the game and $\epsilon$ uniformly converges to its minimum value as the population size of the users goes to infinity. Simulation results show the advantages of the proposed method.

F-PAD: Private Attribute Disclosure Risk Estimation in Online Social Networks

In online social networks, users always expect to share some information for benefits (e.g., personalized services) while hiding the others for privacy. Unfortunately, the hidden information is likely to be predicted by various powerful inference attacks with the rapid advances in machine learning. Then, what is the risk that a user's private information could be disclosed? What countermeasures can be taken to fight against the privacy violation for the user? To tackle these issues, this article proposes a general Framework for Private Attribute Disclosure estimation (F-PAD) including three steps: 1) private attribute prediction; 2) disclosure model training; 3) disclosure risk estimation. Not like most prior risk estimation studies focusing on one specific attack model and private attribute, F-PAD can estimate disclosure risk for individual users in terms of disclosure probability and risk level within a high confidence given a basket of potential inference attack models; furthermore, F-PAD can adapt to various attributes (e.g., gender, age) and offer countermeasures to help users lower the risk. Extensive experiment studies on two real social network datasets, Facebook and Book-Crossing, have verified the effectiveness of F-PAD in ‘current city’, ‘gender’ and ‘age’ disclosure risk estimation.

Privacy-aware friend finding in social network based on thumbs-up data

Social network has provided a promising way for massive users to share their ideas and communicate with each other. A key issue in social network is to find out the prospective friends of users so as to extend the users’ social cycles. Fortunately, users’ thumbs-up data on web news or blogs have become an important evaluation basis in friend finding. Typically, through analyzing the thumbs-up data from different users, we can find out the friends or neighbors of a user. However, the thumbs-up data are often sensitive to users as they can disclose the private information of users, which violate the civil privacy-protection laws enacted by governments. In view of this challenge, we introduce the Simhash technique in information retrieval domain into social network and further bring forth a privacy-aware prospective friend-finding solution in social network based on the sensitive thumbs-up data. At last, we conduct a range of experiments based on well-known Movielens dataset. Experimental data demonstrate the advantages of our solution.

Internet of Things based real-time electric vehicle load forecasting and charging station recommendation

Electric vehicles (EVs) are emerging as a favorable strategy to meet the increasing environmental concerns and energy insufficiency, and this trend is expected to grow in the near future. However, the inadequate charging infrastructure is becoming a major barrier to the wide acceptance of EVs. Deployment of this infrastructure is expected to maximize the adoption of EVs to facilitate users’ range anxiety. Therefore, connectivity between the charging stations (CS) is mandatory. Understanding the real-time status of CSs can provide valuable information to users such as availability of charging provisions, reserves and the time to reach the CS. The intent of this paper is to provide a better EV charging system by utilizing the advantages of the Internet of Things (IoT) technology. The IoT paradigm offers the present facilities a real-time interactional view of the physical world by a variety of sensors and broadcasting tools. This research article proposes a real-time server-based forecasting application: i) to provide scheduling management to avoid waiting time; and ii) to provide a real-time CS recommendation for EVs with an economic cost and reduced charging time. In addition, the proposed scheme avoids third-party intervention and protects EV user privacy and complex information exchange between the user and CS. The end users can easily use the CS based on their requirements. This synergetic application is built up through the PHP programming language in the Linux UBUNTU 16.04 LTS operating system, and all relevant information is processed and managed through Cloud Structured Query Language (CSQL) from a Google cloud platform. The effectiveness of this application is also validated through a low-cost test system using LTC 4150, ESP 8266 Wi-Fi module and Arduino.

An Anonymous Network Website Fingerprinting Attack Method Based on Wavelet Transformation

The anonymous network in protecting user privacy information, but also for the use of criminals, for its illegal acts, and increase the cover monitoring, tracking and obstacle of the government organs forensics, Aiming at the problem of anonymous network, this paper proposes a website fingerprinting attack method for TOR anonymous network. Wavelet transform is introduced to deal with the traffic generated by visiting the website. SVM algorithm is used to learn and generate classifiers, establish fingerprint feature library, and then compare the data generated by the target visiting website with the feature library to confirm its visiting website. In this way, the experimental results show that the average recognition accuracy of target visited websites is 96.7% under all known features of websites, which is superior to literature [17].

Privacy-preserving and sparsity-aware location-based prediction method for collaborative recommender systems

With the rapid growth of public cloud offerings, how to design effective prediction models that provide appropriate recommendations for potential users has become more and more important. In dynamic cloud environment, both of user behaviors and service performance are sensitive to contextual information, such as geographic location information. In addition, the increasing number of attacks and security threats also brought the problem that how to protect critical information assets such as sensitive data, cloud resources and communication in a more effective and secure manner. In view of these challenges, we propose a privacy-preserving and sparsity-aware location-based prediction method for collaborative recommender systems. Specifically, our method is designed as a three-phase process: Firstly, two privacy-preserving mechanisms, i.e., a randomized data obfuscation technique and a region aggregation strategy are presented to protect the private information of users and deal with the data sparsity problem. Then a location-aware latent factor model based on tensor factorization is applied to explore the spatial similarity relationships between services. Finally, predictions are made based on both global and spatial nearest neighbors. Experiments are designed and conducted to validate the effectiveness of our proposal. The experimental results show that our method achieves decent prediction accuracy on the premise of privacy preservation.

BL0K: A New Stage of Privacy-Preserving Scope for Location-Based Services.

Location-based services present an inherent challenge of finding the delicate balance between efficiency when answering queries and maintaining user privacy. Inevitable security issues arise as the server needs to be informed of the query location to provide accurate responses. Despite the many advancements in localization security in wireless sensor networks, servers can still be infected with malicious software. It is now possible to ensure queries do not generate any fake responses that may appear real to users. When a fake response is used, there are mechanisms that can be employed so that the user can identify the authenticity of the query. For this reason, this paper proposes Bloom Filter 0 Knowledge (BL0K), which is novel phase privacy method that preserves the framework for location-based service (LBS) and combines a Bloom filter and the Zero knowledge protocol. The usefulness of these methods has been shown for securing private user information. Analysis of the results demonstrated that BL0K performance is decidedly better when compared to the referenced approaches using the privacy entropy metric.

Cryptojacking injection: A paradigm shift to cryptocurrency-based web-centric internet attacks

ABSTRACTCrypto-mining attacks have emerged as a new generation of web-based attacks which have seen cybercriminals eschew the infamous crypto ransomware. The watering hole attack vector has by far been the most widely employed attack methodology but it faces the task of luring the victim to the infected web resources. However, cryptojacking injection presents a paradigm shift to web-based crypto-mining attacks in that it eliminates the need for a pivotal third-party such as the exploitable web server. Thus, instead of attacking credit card and other private information of e-commerce users, attackers seek to maliciously abuse a victim’s CPU to generate cryptocurrency. In this paper, we investigate and evaluate cryptojacking injection – a state-of-the-art web-centric attack vector in the crypto-mining attacks landscape. We formulate an attack model based on finite state machines which depicts the various breaches of confidentiality, integrity and availability in the web system as the attack progresses. We show how this new attack vector attacks some of the core components of e-commerce (URL, HTTP and HTML) to generate Monero crypto currency from benign web users. We evaluate our modeling approach with a series of experiments with two attack scenarios using different operating systems. Results show that the attack is indeed cross-platform and feasible on any operating system of a browser-capable device. We analyze the generated network traffic during the attack and draw features such as URLs and the parsed files, the associated cryptographic hashes, and the IP addresses of the crypto-mining domains. These, together with host-based features such as exhaustive CPU usage can be used as indicators of compromise and subsequently act as feed into intrusion detection systems.

RobustTrust – A Pro-Privacy Robust Distributed Trust Management Mechanism for Internet of Things

In the promising time of the Internet, connected things have the ability to communicate and share information. The Internet of Things (IoT) cannot be implemented unless the security-related concerns have been resolved. Sharing information among different devices can compromise the private information of users. Thus, a suitable mechanism is needed to exclude the risk of malicious and compromised nodes. As follows, trust has been proposed in the literature as a useful technology to maintain users' security. Prior studies have proposed diverse trust management mechanisms to achieve adequate trust. The approach of cross-domain trust management is neglected that requires enormous considerations to address the difficulties related to cross-domain communication. In this paper, a cross-domain robust distributed trust management (RobustTrust) system is proposed, which makes a device fit for assessing trust towards different devices locally. In this system, the trust is divided into three components of security that help IoT nodes to become robust against compromised and malicious devices/nodes. The novelty of the proposed mechanism can be summarized in these aspects: A highly scalable trust mechanism, multiple components of evaluation to enhance robustness against attacks, and use of recommendations along with the feedback to build knowledge. Furthermore, the proposed mechanism is event-driven that helps nodes to evaluate trust more effectively as well as enhance the system efficiency. The proposed work is compared with the available trust evaluation schemes by concentrating on various attributes, such as trustworthiness, usability, and accuracy among others. The RobustTrust is validated by the extensive simulations considering absolute trust value's performance, the accuracy of trust estimation, and several potential attacks.

Olympus: Sensor Privacy through Utility Aware Obfuscation

Abstract Personal data garnered from various sensors are often offloaded by applications to the cloud for analytics. This leads to a potential risk of disclosing private user information. We observe that the analytics run on the cloud are often limited to a machine learning model such as predicting a user’s activity using an activity classifier. We present Olympus, a privacy framework that limits the risk of disclosing private user information by obfuscating sensor data while minimally affecting the functionality the data are intended for. Olympus achieves privacy by designing a utility aware obfuscation mechanism, where privacy and utility requirements are modeled as adversarial networks. By rigorous and comprehensive evaluation on a real world app and on benchmark datasets, we show that Olympus successfully limits the disclosure of private information without significantly affecting functionality of the application.

GANs Based Density Distribution Privacy-Preservation on Mobility Data

With the development of mobile devices and GPS, plenty of Location-based Services (LBSs) have emerged in these years. LBSs can be applied in a variety of contexts, such as health, entertainment, and personal life. The location based data that contains significant personal information is released for analysing and mining. The privacy information of users can be attacked from the published data. In this paper, we investigate the problem of privacy-preservation of density distribution on mobility data. Different from adding noises into the original data for privacy protection, we devise the Generative Adversarial Networks (GANs) to train the generator and discriminator for generating the privacy-preserved data. We conduct extensive experiments on two real world mobile datasets. It is demonstrated that our method outperforms the differential privacy approach in both data utility and attack error.

The Extent of Smartphones Users to Adopt the Use of Cloud Storage

Recently, technology has witnessed a rapid progress and dominates all aspects of life systematically. Smartphones are devices that users can depend on managing and storing data. Moreover, they are used to save, update and secure the private information of users by using Cloud Storage such as iCloud, Dropbox and Google Drive. This study presents and adjusts the Technology Acceptance Model (TAM) specifically, perceived ease of use, usefulness, attitude toward usage and behavioral intention. Additionally, the study used Cornbach Alpha Correlation and Regression analysis in public universities, particularly in the University of Sulaimani. The study aims to recognize the major elements that have impact on using cloud storage and to what extent the user depends on electronic devices in the academic field and to identify the factors and crucial effect on the users to use electronic device easily, improve their capability and attract to use the specific technology. The results of this study confirmed that some TAM constructs direct and indirect effect on university academics, employees and students’ behavioral intention to use cloud storage (Dropbox, iCloud and Google drive). However, the results regression analysis shows whenever users used the cloud storage easily perceived usefulness decreased the performance of job consequently. On the other hand, it went up the desirability to use the specific technology and own conscious scheme to execute for future.

Research on Network Privacy Protection Mechanism Based on Trust Agent in Big Data Environment

The problem of personal information and behavioral privacy disclosure in the big data environment has aroused great concern in the whole society. This paper analyzes the user privacy leakage problem in the big data environment supported by cloud computing, proposes a privacy protection mechanism based on trust agent model, and studies the specific method and implementation path of using distributed trust routing and private cloud to realize privacy protection, and its core is to prevent users from leaking real private information through the localization and virtualization of privacy data. It also discusses the problem of user privacy information being corrupted by active privacy data pollution.

Research on information security and privacy protection model based on consumer behavior in big data environment

SummaryIn the big data era, information security is becoming more and more important. The recent scandal of the data privacy on Facebook sounded the warning bell for us. Based on the utility theory, this paper proposes that the disclosure behavior of consumer personal information is mainly influenced by two factors, which are perceived risk and perceived benefit, respectively. When consumers make decisions, they weigh the risks and benefits. If the income is greater than the risk, the consumer is willing to provide the information on the website and vice versa. This paper analyzes the serious threats to the safety and privacy of commercial big data and proposes a multi‐level security protection theoretical model for business information security and privacy protection from the perspective of business big data security. The security functions and core technologies of each layer are described in detail, which provide a useful and in‐depth theoretical exploration for practical engineering. Finally, based on the privacy protection of large data and the principle of RBAC, a model of user privacy information security system is proposed.

Secure multi-label data classification in cloud by additionally homomorphic encryption

In many applications, an instance is associated with a set of labels. Nevertheless, traditional classification algorithm generally assumes an instance has a label, and cannot be suitable for multi-label instance classification. Multi-label learning is thus put forward to predict the associated labels for instance with multiple unclassified labels. Nowadays, many multi-label learning approaches have been proposed, unfortunately, all of the existing multi-label learning approaches did not consider the issue of protecting the sensitive information of private instances. In this paper, we propose a scheme for secure multi-label classification over encrypted data in cloud. Our scheme can outsource the multi-label classification task to the cloud servers which dramatically reduce the storage and computation burden of data owner and data users. Based on the theoretical proof, our scheme can protect the privacy information of data owner and data users, the cloud servers cannot learn anything useful about the input data and output multi-label classification results. Additionally, we analyze our computation complexity and communication overheads in detail, and leverage simulation experiments to evaluate the computation time of our proposed scheme.

PKI Validation and Encryption Scheme for Secure UTM Online Payment System

Online payment system have recently emerged as one of the available payment methods in purchase of goods and services over the Internet. However the acceptance of this system by users is not fully achieved because of concern about the system security and how its manages the privacy of user information. One of the most challenging issues associated with online payment system is securing the communication between the client and payment gateway. PKI validation and encryption scheme is designed to handle problem of sending transaction as plaintext between clients and UTM online payment system and to authorize the clients that sent the transaction to the payment gateway. The scheme are proposed to increase the level of security in UTM online payment system. To test the performance of PKI validation and encryption scheme, several simulation are conducted together with the comparison with other algorithm.

Auction-Based Cloud Service Pricing and Penalty with Availability on Demand

Availability is one of the main concerns of cloud users, and cloud providers always try to provide higher availability to improve user satisfaction. However, higher availability results in higher provider costs and lower social welfare. In this paper, taking into account both the users’ valuation and desired availability, we design resource allocation, pricing and penalty mechanisms with availability on demand. Considering two scenarios: public availability in which the desired availabilities of all users are public information, and private availability in which the desired availabilities are private information of users, and, analyzing the possible behaviours of users, we design a truthful deterministic mechanism with 2-approximation in public availability scenario and a universal truthful mechanism with 1 1 + γ approximation in private availability scenario, where γ is the backup ratio of resources with the highest availability. The experiment results show that our mechanisms significantly improve the social welfare compared to the mechanism without considering availability demand of users.