Sin Gee Teo

Third-party Software Development Kits (SDKs) are widely adopted in Android app development, to accelerate development pipelines and enhance app functionality effortlessly. However, this convenience raises substantial concerns about unauthorized access to users’ privacy-sensitive information, which could be further abused for illegitimate purposes like user tracking or monetization. Our study offers a targeted analysis of user privacy protection among Android third-party SDKs, filling a critical gap in the Android software supply chain. It focuses on two aspects of their privacy practices, including data exfiltration and behavior-policy compliance (or privacy disclosure compliance), utilizing taint analysis and large language models. It covers 158 widely used SDKs collected from two major distribution channels: the official platform and a leading third-party alternative. From these SDKs, we identified 338 instances of personal data exfiltration. On privacy disclosure compliance, our study reveals that more than 30% of the examined SDKs fail to provide a privacy policy to disclose their data handling practices. Among those that provide privacy policies, 37% of them over-collect user data, and 88% falsely claim access to sensitive data. We revisit the latest versions of the SDKs after 12 months. Our analysis demonstrates a persistent lack of improvement in these concerning trends. Based on our findings, we propose three actionable recommendations to mitigate the privacy leakage risks and enhance privacy protection for Android users. Our research not only serves as an urgent call for industry attention but also provides crucial insights for future regulatory interventions.

In heterogeneous scenarios where the data distribution amongst the Federated Learning (FL) participants is Non-Independent and Identically distributed (Non-IID), FL suffers from the well known problem of data heterogeneity. This leads the performance of FL to be significantly degraded, as the global model tends to struggle to converge. To solve this problem, we propose Differentially Private Synthetic Data Aided Federated Learning Using Foundation Models (DPSDA-FL), a novel data augmentation strategy that aids in homogenizing the local data present on the clients' side. DPSDA-FL improves the training of the local models by leveraging differentially private synthetic data generated from foundation models. We demonstrate the effectiveness of our approach by evaluating it on the benchmark image dataset: CIFAR-10. Our experimental results have shown that DPSDA-FL can improve class recall and classification accuracy of the global model by up to 26% and 9%, respectively, in FL with Non-IID issues.

Motivated by the fast advancements in artificial intelligence (AI) technologies, recent research has moved towards using machine learning and deep learning to detect and classify security attacks in computer networks. However, most prior works adopt supervised learning methods, and the performance heavily depends on the amount of labeled data used to train the detection models. Network attack detection and classification is not an exception due to the lack of labeled data, especially the attacking traffic, which is much less than the regular (legitimate) traffic. Yet, labeling network traffic is also challenging and requires specific domain expertise. This paper proposes an efficient semi-supervised learning method for the classification of network attacking traffic, known as Self-Training Mixup Decision Tree (STM-DT). STM-DT first trains a decision tree on a small amount of labeled data and then uses the obtained model to predict labels of unlabeled samples. Some noisy labels will be removed by consistency. The predicted samples will then be mixed with labeled samples using mixup to train a new decision tree, which is the final desired classifier. We evaluate STM-DT using four network traffic datasets. Experimental results demonstrate that the proposed STM-DT method achieves higher macro F1 scores over different minority labeled data percentages.

As mobile phone technology evolves quickly, people could use mobile phones to conduct business, watch entertainment shows, order food, and many more. These location-based services (LBS) require users’ mobility data (trajectories) in order to provide many useful services. Latent patterns and behavior that are hidden in trajectory data should be extracted and analyzed to improve location-based services including routing, recommendation, urban planning, traffic control, etc. While LBSs offer relevant information to mobile users based on their locations, revealing such areas can pose user privacy violation problems. An efficient privacy preservation algorithm for trajectory data must have two characteristics: utility and privacy, i.e., the anonymized trajectories must have sufficient utility for the LBSs to carry out their services, and privacy must be intact without any compromise. Literature on this topic shows many methods catering to trajectories based on GPS data. In this paper, we propose a privacy preserving method for trajectory data based on Call Detail Record (CDR) information. This is useful as a vast number of people, particularly in underdeveloped and developing places, either do not have GPS-enabled phones or do not use them. We propose a novel framework called Privacy-Preserving Trajectory Publication Framework for CDR (PPTPF) for moving object trajectories to address these concerns. Salient features of PPTPF include: (a) a novel stay-region based anonymization technique that caters to important locations of a user; (b) it is based on Spark, thus it can process and anonymize a significant volume of trajectory data successfully and efficiently without affecting LBSs operations; (c) it is a component-based architecture where each component can be easily extended and modified by different parties.