The rise in popularity of Internet of Things (IoT) devices has opened doors for privacy and security breaches in Cyber-Physical systems like smart homes, smart vehicles, and smart grids that affect our daily existence. IoT systems are also a source of big data that gets shared via cloud. IoT systems in a smart home environment have sensitive access control issues since they are deployed in a personal space. The collected data can also be of highly personal nature. Therefore, it is critical to build access control models that govern who, under what circumstances, can access which sensed data or actuate a physical system. Traditional access control mechanisms are not expressive enough to handle such complex access control needs, warranting the incorporation of new methodologies for privacy and security. In this paper, we propose the creation of the PALS system, that builds upon existing work in attribute based access control model, captures physical context collected from sensed data (attributes), and performs dynamic reasoning over these attributes and context driven policies using Semantic Web technologies to execute access control decisions. Reasoning over user context, details of information collected by cloud service provider and device type our mechanism generates as a consequent access control decisions. Our system’s access control decisions are supplemented by another sub-system that detects intrusions into smart home systems based on both network and behavioral data. The combined approach serves to determine indicators that a smart home system is under attack, as well as limit what data breach such attacks can achieve.

Context-sensitive access control has been a research topic within mobile computing for more than a decade. Much of the work has focused on modeling context and representing policies. Choosing an appropriate policy for a user, however, remains a challenging goal. Creating usable mobile access control solutions have been researched from a users permission control perspective. We present a study carried out with subjects using their personal mobile devices that captures individualized policies through an iterative user feedback process. Policy precision, also referred to as "Violation Metric" (VM), was used to decide when all necessary policies had been captured. The feedback process used a hierarchical context ontology to represent user-context and gathered contextual-situations in which a policy would be applicable. The study also investigated the feasibility of using the VM measure to determine completion of the capture process for the users personalized access control policies, that handles their mobile privacy and security needs. Using an appropriate predefined policy is shown to have lesser user impact when trying to personalize access control policies for users.

System calls provide an interface to the services made available by an operating system. As a result, any functionality provided by a software application eventually reduces to a set of fixed system calls. Since system calls have been used in literature, to analyze program behavior we made an assumption that analyzing the patterns in calls made by a mobile application would provide us insight into its behavior. In this paper, we present our preliminary study conducted with 534 mobile applications and the system calls made by them. Due to a rising trend of mobile applications providing multiple functionalities, our study concluded, mapping system calls to functional behavior of a mobile application was not straightforward. We use Weka tool with manually annotated application behavior classes and system call features in our experiments, to show that using such features achieves mediocre F1-measure at best. Thus leading to the conclusion that system calls were not sufficient features for mobile application behavior classification.

Contemporary smartphones are capable of generating and transmitting large amounts of data about their users. Recent advances in collaborative context modeling combined with a lack of adequate permission model for handling dynamic context sharing on mobile platforms have led to the emergence of a new class of mobile applications that can access and share embedded sensor and context data. Most of the time such data is used for providing tailored services to the user but it can lead to serious breaches of privacy. We use Semantic Web technologies to create a rich notion of context. We also discuss challenges for context aware mobile platforms and present approaches to manage data flow on these devices using semantically rich fine-grained context-based policies that allow users to define their privacy and security need using tools we provide.

There are ongoing security and privacy concerns regarding mobile platforms that are being used by a growing number of citizens. Security and privacy models typically used by mobile platforms use one-time permission acquisition mechanisms. However, modifying access rights after initial authorization in mobile systems is often too tedious and complicated for users. User studies show that a typical user does not understand permissions requested by applications or are too eager to use the applications to care to understand the permission implications. For example, the Brightest Flashlight application was reported to have logged precise locations and unique user identifiers, which have nothing to do with a flashlight application's intended functionality, but more than 50 million users used a version of this application which would have forced them to allow this permission. Given the penetration of mobile devices into our lives, a fine-grained context-dependent security and privacy control approach needs to be created. We have created Mithril as an end-to-end mobile access control framework that allows us to capture access control needs for specific users, by observing violations of known policies. The framework studies mobile application executables to better inform users of the risks associated with using certain applications. The policy capture process involves an iterative user feedback process that captures policy modifications required to mediate observed violations. Precision of policy is used to determine convergence of the policy capture process. Policy rules in the system are written using Semantic Web technologies and the Platys ontology to define a hierarchical notion of context. Policy rule antecedents are comprised of context elements derived using the Platys ontology employing a query engine, an inference mechanism and mobile sensors. We performed a user study that proves the feasibility of using our violation driven policy capture process to gather user-specific policy modifications. We contribute to the static and dynamic study of mobile applications by defining 'application behavior' as a possible way of understanding mobile applications and creating access control policies for them. Our user study also shows that unlike our behavior-based policy, a 'deny by default' mechanism hampers usability of access control systems. We also show that inclusion of crowd-sourced policies leads to further reduction in user burden and need for engagement while capturing context-based access control policy. We enrich knowledge about mobile 'application behavior' and expose this knowledge through the Mobipedia knowledge-base. We also extend context synthesis for semantic presence detection on mobile devices by combining Bluetooth, low energy beacons and Nearby Messaging services from Google.

In order to secure vital personal and organizational system we require timely intelligence on cybersecurity threats and vulnerabilities. Intelligence about these threats is generally available in both overt and covert sources like the National Vulnerability Database, CERT alerts, blog posts, social media, and dark web resources. Intelligence updates about cybersecurity can be viewed as temporal events that a security analyst must keep up with so as to secure a computer system. We describe CyberTwitter, a system to discover and analyze cybersecurity intelligence on Twitter and serve as a OSINT (Open-source intelligence) source. We analyze real time information updates, in form of tweets, to extract intelligence about various possible threats. We use the Semantic Web RDF to represent the intelligence gathered and SWRL rules to reason over extracted intelligence to issue alerts for security analysts.

According to recent media reports, there has been a surge in the number of devices that are being connected to the Internet. The Internet of Things (IoT), also referred to as Cyber-Physical Systems, is a collection of physical entities with computational and communication capabilities. The storage and computing power of these devices is often limited and their designs currently focus on ensuring functionality and largely ignore other requirements, including security and privacy concerns. We present the design of a framework that allows IoT devices to capture, represent, reason with, and enforce information sharing policies. We use Semantic Web technologies to represent the policies, the information to be shared or protected, and the IoT device context. We discuss use-cases where our design will help in creating an "intelligent" IoT device and ensuring data security and privacy using context-sensitive information sharing policies.

In the past few years, the Internet of Things has started to become a reality; however, its growth has been hampered by privacy and security concerns. One promising approach is to use Semantic Web technologies to mitigate privacy concerns in an informed, flexible way. We present CARLTON, a framework for managing data privacy for entities in a Physical Web deployment using Semantic Web technologies. CARLTON uses context-sensitive privacy policies to protect privacy of organizational and personnel data. We provide use case scenarios where natural language queries for data are handled by the system, and show how privacy policies may be used to manage data privacy in such scenarios, based on an ontology of concepts that can be used as rule antecedents in customizable privacy policies.

As of 2016, there are more mobile devices than humans on earth. Today, mobile devices are a critical part of our lives and often hold sensitive corporate and personal data. As a result, they are a lucrative target for attackers, and managing data privacy and security on mobile devices has become a vital issue. Existing access control mechanisms in most devices are restrictive and inadequate. They do not take into account the context of a device and its user when making decisions. In many cases, the access granted to a subject should change based on the context of a device. Such fine-grained, context-sensitive access control policies have to be personalized too. In this paper, we present a system i.e. Mithril that uses policies represented in Semantic Web technologies and captured using user feedback, to handle access control on mobile devices. We present an iterative feedback process to capture user specific policy. We also present a policy violation metric that allows us to decide when the capture process is complete.

The number of mobile applications (apps) in major app stores exceeded one million in 2013. While app stores provide a central point for storing app metadata, they often impose restrictions on the access to this information thus limiting the potential to develop tools to search, recommend, and analyze app information. A few projects have circumvented these limitations and managed to create a dataset with a substantial number of apps. However, accessing this information, especially for the purpose of an integrated view, is difficult as there is no common standard for publishing data. We present Mobipedia, an effort to gather this information from various sources and publish it as RDF Linked Data. We describe the status of Mobipedia, which currently has information on more than one million apps that has been extracted from a number of unstructured and semi-structured sources. This paper describes the ontology used to model information, the process for fact extraction, and an overview of applications facilitated by Mobipedia.

We present Mobipedia, an integrated knowledge base with information about 1 million mobile applications (apps) such as their category, meta-data (author, reviews, rating, release date), permissions and libraries used, and similar apps. The goal of Mobipedia is to integrate unstructured and semi-structured data about mobile apps from publicly available data sources and publish it as Linked Data using RDF. We describe the extraction process for facts, access mechanisms to the knowledge base, and an overview of applications facilitated by Mobipedia.

Capturing, maintaining, and using context information helps mobile applications provide better services and generates data useful in specifying information sharing policies. Obtaining the full benefit of context information requires a rich and expressive representation that is grounded in shared semantic models. We summarize some of our past work on representing and using context models and briefly describe Triveni, a system for cross-device context discovery and enrichment. Triveni represents context in RDF and OWL and reasons over context models to infer additional information and detect and resolve ambiguities and inconsistencies. A unique feature, its ability to create and manage "contextual groups" of users in an environment, enables their members to share context information using wireless ad-hoc networks. Thus, it enriches the information about a user's context by creating mobile ad hoc knowledge networks.

Wearable computing devices like Google Glass are at the forefront of technological evolution in smart devices. The ubiquitous and oblivious nature of photography using these devices has made people concerned about their privacy in private and public settings. The Face-Block 3 project protects the privacy of people around Glass users by making pictures taken by the latter, Privacy-Aware. Through sharing of privacy policies, users can choose whether or not to be included in pictures. However, the current privacy model of FaceBlock only permits simple constraints such as allow versus disallow pictures. In this paper, we present an extended context-aware privacy model represented using OWL ontologies and SWRL rules. We also describe use cases of how this model can help FaceBlock to generate Privacy-Aware Pictures depending on context and privacy needs of the user.

Proceedings of the 12th Annual International Conference on Mobile Systems, Applications, and Services

Our individual privacy is incresingly at risk in a world full of smart mobile devices. The situation will only get worse with the rise of an Internet of Things. One way to address this problem is through the use of systems that better understand their context and and whose information gathering and sharing behaviours can be controlled or inuenced by context-aware policies. We illustrate the the problem and an approach to address it through recent work on FaceBlock, 1 , a project that protects the privacy of people around Google Glass users by making pictures taken by the latter, Privacy-Aware. Through sharing of privacy policies, users can choose whether or not to be included in pictures.

Mobile devices can better manage user privacy if they continuously model a user's context, but doing so can result in high energy consumption. The energy costs can be reduced by reasoning about what context information is known, what additional information is needed, how accurate it must be and how to efficiently acquire it. We model the sensors and their data properties, accuracy levels and energy costs in an RDF knowledge base supported by an OWL ontology. We describe a method to manage privacy on smartphones in an energy efficient manner by selecting the best choice sensor for maintaining the user's context information. Sensor selection is done by COntext MANager miDDleware (COMANDD), which maintains a context model and answers queries about it. Context requests are served by capability matching, accuracy level matching and selection of lowest energy cost sensor for reporting context data. A context change detection function is used to decide when the context should be updated.

We describe a method to carry out energy efficient privacy preservation on a mobile smartphone. Our work is based on a study of an Android smartphone's component-wise energy consumption pattern and is based on a three-fold approach to ensure efficient execution of privacy policies, based on user and app context modeled using semantic web technologies.