In current Android architecture, users have to decide whether an app is safe to use or not. Expert users can make savvy decisions to avoid unnecessary private data breach. However, the majority of regular users are not technically capable or do not care to consider privacy implications to make safe decisions. To assist the technically incapable crowd, we propose a permission control framework based on crowdsourcing. At its core, our framework runs new apps under probation mode without granting their permission requests up-front. It provides recommendations on whether to accept or not the permission requests based on decisions from peer expert users. To seek expert users, we propose an expertise rating algorithm using a transitional Bayesian inference model. The recommendation is based on aggregated expert responses and their confidence level. As a complete framework design of the system, this thesis also includes a solution for Android app risks estimation based on behaviour analysis. To eliminate the negative impact from dishonest app owners, we also proposed a bot user detection to make it harder to utilize false recommendations through bot users to impact the overall recommendations. This work also covers a multi-view permission notification design to customize the app safety notification interface based on users' need and an app recommendation method to suggest safe and usable alternative apps to users.

In this dissertation, I explore the ways in which theories and concepts of face-to-face interaction and disclosure management can be used to understand the construction of privacy on an intercollegiate sport team. The purpose of this research was to examine how team members talked to each other about themselves, and how they managed the personal information shared. Erving Goffman's model of social interaction and his concepts of "face" and "supportive work" frame the analyses of this study. Through semi-structured interviews and direct observations of the members of an NCAA Division III women's basketball team, I discovered the team's rules and the development of their communication norms, which were most salient during discussions involving the players' tattoos and two unanticipated team meetings. It was important to the players of this team that they were a close-knit group who got along well and supported each other. The players questioned the commitment level of a player who disrupted the team's closeness by breaking a rule or norm and refused to make amends for her discretion. My findings suggest that the team members negotiated how to demonstrate their commitment to the team and to each other by performing supportive and remedial work through disclosure during these two meetings. Even under those specific circumstances, a player maintained some amount of autonomy by controlling the depth of her personal information that she shared. Interestingly, the players did not indicate an experienced loss of control over their personal information after they shared it with other team members at the meetings due to the team's negotiation of information boundary management. Additionally, I found that the symmetry and reciprocity of disclosure differed between player-to-player and player-to-coach interactions.

This thesis investigates two research problems in analyzing floating car data (FCD): automated segmentation and privacy. For the former, we design an automated segmentation method based on the social functions of an area to enhance existing traffic demand analysis. This segmentation is used to create an extension of the traditional origin-destination matrix that can represent origins of traffic demand. The methods are then combined for interactive visualization of traffic demand, using a floating car dataset from a ride-hailing application. For the latter, we investigate the properties in FCD that may lead to privacy leaks. We present an attack on a real-world taxi dataset, showing that FCD, even though anonymized, can potentially leak privacy. / Graduate

Research Doctorate - Doctor of Philosophy (PhD) / The rapid pace of growth in the field of human genetics has left researchers with many new challenges in the area of security and privacy. To encourage participation and foster trust towards research, it is important to ensure that genetic databases are adequately protected. This task is a particularly challenging one for statistical agencies due to the high prevalence of categorical data contained within statistical genetic databases. The absence of natural ordering makes the application of traditional Statistical Disclosure Control (SDC) methods less straightforward, which is why we have proposed a new noise addition technique for categorical values. The main contributions of the thesis are as follows. We provide a comprehensive analysis of the trust relationships that occur between the different stakeholders in a genetic data warehouse system. We also provide a quantifiable model of trust that allows the database manager to granulate the level of protection based on the amount of trust that exists between the stakeholders. To the best of our knowledge, this is the first time that trust has been applied in the SDC context. We propose a privacy protection framework for genetic databases which is designed to deal with the fact that genetic data warehouses typically contain a high proportion of categorical data. The framework includes the use of a clustering technique which allows for the easier application of traditional noise addition techniques for categorical values. Another important contribution of this thesis is a new similarity measure for categorical values, which aims to capture not only the direct similarity between values, but also some sense of transitive similarity. This novel measure also has possible applications in providing a way of ordering categorical values, so that more traditional SDC methods can be more easily applied to them. Our analysis of experimental results also points to a numerical attribute phenomenon, whereby we typically have high similarity between numerical values that are close together, and where the similarity decreases as the absolute value of the difference between numerical values increases. However, some numerical attributes appear to not behave in a strictly `numerical' way. That is, values which are close together numerically do not always appear very similar. We also provide a novel noise addition technique for categorical values, which employs our similarity measure to partition the values in the data set. Our method - VICUS - then perturbs the original microdata file so that each value is more likely to be changed to another value in the same partition than one from a different partition. The technique helps to ensure that the perturbed microdata file retains data quality while also preserving the privacy of individual records.

Research Doctorate - Doctor of Philosophy (PhD) / Due to advances in information processing technology and storage capacity, nowadays huge amount of data is being collected for various data analyses. Data mining techniques, such as classification, are often applied on these data to extract hidden information. During the whole process of data mining the data get exposed to several parties and such an exposure potentially leads to breaches of individual privacy. This thesis presents a comprehensive noise addition technique for protecting individual privacy in a data set used for classification, while maintaining the data quality. We add noise to all attributes, both numerical and categorical, and both to class and non-class, in such a way so that the original patterns are preserved in a perturbed data set. Our technique is also capable of incorporating previously proposed noise addition techniques that maintain the statistical parameters of the data set, including correlations among attributes. Thus the perturbed data set may be used not only for classification but also for statistical analysis. Our proposal has two main advantages. Firstly, as also suggested by our experimental results the perturbed data set maintains the same or very similar patterns as the original data set, as well as the correlations among attributes. While there are some noise addition techniques that maintain the statistical parameters of the data set, to the best of our knowledge this is the first comprehensive technique that preserves the patterns and thus removes the so called Data Mining Bias from the perturbed data set. Secondly, re-identification of the original records directly depends on the amount of noise added, and in general can be made arbitrarily hard, while still preserving the original patterns in the data set. The only exception to this is the case when an intruder knows enough about the record to learn the confidential class value by applying the classifier. However, this is always possible, even when the original record has not been used in the training data set. In other words, providing that enough noise is added, our technique makes the records from the training set as safe as any other previously unseen records of the same kind. In addition to the above contribution, this thesis also explores the suitability of pre-diction accuracy as a sole indicator of data quality, and proposes technique for clustering both categorical values and records containing such values.

<p>When individuals access services online they are often required to disclose excessive amounts of personally identifiable information, with little to no transparency on how the information is used. One of the goals of the EU research project PrimeLife is to help people regain control of their private sphere in today's networked world. As part of PrimeLife a software prototype, named the PRIME Core, is being developed that contains a number of different privacy enhancing technologies. This thesis describes the implementation and integration of a privacy-friendly secure logging module into the PRIME Core. The logging module's purpose is to provide transparency logging to the PRIME Core, giving individuals access to a detailed log of how their disclosed personally identifiable information is used, in a secure and privacy friendly manner.</p><p>The thesis resulted in a privacy-friendly secure logging module being implemented into the PRIME Core. The client for the logging module still lacks features to be suitable for use by the Data Track. Further research is needed to make the implementation mitigate the risks posed by memory and disk forensics.</p>

The development of web technology has led to the emergence of web aggregation, a service that collects existing web data and turns them into more useful information. We review the development of both comparison and relationship aggregation and discuss their impacts on various stakeholders. The aggregator’s capability of transparently extracting web data has raised challenging issues in database and privacy protection. Consequently, new regulations are introduced or being proposed. We analyze the interactions between aggregation and related policies and provide our insights about the implications of new policies on the development of web aggregation. / Singapore-MIT Alliance (SMA)

Thesis (Ph.D.)--RAND Graduate School, 2007. / Includes bibliographical references.

With the growth in social, political and economic importanceof the Internet, it has been recognized that the underlyingtechnology of the next generation Internet must not only meetthe many technical challenges but must also meet the socialexpectations of such a pervasive technology. As evidence ofthe strategic importance of the development of the Internet,the European Union has adopted a communication to the Counciland the European Parliament focusing on the next generationInternet and the priorities for action in migrating to the newInternet protocol IPv6 andalso a new Directive (2002/58/EC) on'processing of personal data and protection of privacy in theelectronic communication sector'. The Data Protection Directiveis part of a package of proposals for initiatives which willform the future regulatory framework for electroniccommunications networks and services. The new Directive aims toadapt and update the existing Data ProtectionTelecommunications Directive (97/66/EC) to take account oftechnological developments. However, it is not well undersoodhow this policy and the underlying Internet technology can bebrought into alignment. This dissertation builds upon the results of my earlierlicentiate thesis by identifying three specific, timely, andimportant privacy areas in the next generation Internet: uniqueidentifiers and observability, privacy enhanced location basedservices, and legal aspects of data traffic. Each of the three areas identified are explored in the eightpublished papers that form this dissertation. The paperspresent recommendations to technical standarization bodies andregulators concerning the next generation Internet so that thistechnology and its deployment can meet the specific legalobligations of the new European Union data protectiondirective.

Wireless sensor networks (WSN) are an attractive solution for a plethora of communication applications, such as unattended event monitoring and tracking. One of the looming challenges that threaten the successful deployment of these sensor networks is source-location privacy, especially when they are used to monitor sensitive objects. In order to enhance source location privacy in sensor networks, we propose the use of an opportunistic routing scheme and we examine four different approaches. In opportunistic routing, each sensor transmits the packet over a dynamic path to the destination. Every packet from the source can therefore follow a different path toward the destination, making it difficult for an adversary to backtrack hop-by-hop to the origin of the sensor communication. Through theoretical analysis, we attempt to justify the use of opportunistic routing for the source-location problem. Moreover, simulations have been conducted in order to evaluate the performance of all the proposed schemes, in terms of source-location privacy.