2022
Autores
Mendes, R; Cunha, M; Vilela, JP; Beresford, AR;
Publicação
COMPUTER SECURITY - ESORICS 2022, PT I
Abstract
The multitude of applications and security configurations of mobile devices requires automated approaches for effective user privacy protection. Current permission managers, the core mechanism for privacy protection in smartphones, have shown to be ineffective by failing to account for privacy's contextual dependency and personal preferences within context. In this paper we focus on the relation between privacy decisions (e.g. grant or deny a permission request) and their surrounding context, through an analysis of a real world dataset obtained in campaigns with 93 users. We leverage such findings and the collected data to develop methods for automated, personalized and context-aware privacy protection, so as to predict users' preferences with respect to permission requests. Our analysis reveals that while contextual features have some relevance in privacy decisions, the increase in prediction performance of using such features is minimal, since two features alone are capable of capturing a relevant effect of context changes, namely the category of the requesting application and the requested permission. Our methods for prediction of privacy preferences achieved an F1 score of 0.88, while reducing the number of privacy violations by 28% when compared to the standard Android permission manager.
2025
Autores
Mendes, R; Vilela, P;
Publicação
Encyclopedia of Cryptography, Security and Privacy, Third Edition
Abstract
[No abstract available]
2025
Autores
Queiroz, S; Vilela, JP; Ng, BKK; Lam, C; Monteiro, E;
Publicação
ITU Journal on Future and Evolving Technologies
Abstract
2025
Autores
Cunha, M; Mendes, R; de Montjoye, YA; Vilela, JP;
Publicação
SCIENTIFIC REPORTS
Abstract
The widespread availability of wireless networking, such as Wi-Fi, has led to the pervasiveness of always connected mobile devices. These devices are provided with several sensors that allow the collection of large amounts of data, which pose a threat to personal privacy. It is well known that Wi-Fi connectivity information (e.g. BSSID) can be used for inferring user locations. This has caused the imposition of limitations to the access to such data in mobile devices. However, other sources of information about wireless connectivity are available, such as the Received Signal Strength Indicator (RSSI). In this work, we show that RSSI can be used to infer the presence of a user at common locations throughout time. This information can be correlated with other features, such as the hour of the day, to further learn semantic context about such locations with a prediction performance above 90%. Our analysis shows the privacy implications of inferring user locations through Wi-Fi RSSI, but also emphasizes the fingerprinting risk that results from the lack of protection when accessing RSSI measurements.
2025
Autores
Gomes, C; Mendes, R; Vilela, JP;
Publicação
2025 IEEE 10TH EUROPEAN SYMPOSIUM ON SECURITY AND PRIVACY, EUROS&P
Abstract
Federated Learning (FL), a distributed learning mechanism where data is decentralized across multiple devices and periodic gradient updates are shared, is an alternative to centralized training that aims to address privacy issues arising from raw data sharing. Despite the expected privacy benefits, prior research showcases the potential privacy leakage derived from overfitting, exploited by passive attacks. However, limited attention has been given to understanding and defending against active threats that increase model leakage by interfering with the training process, instead of relying on overfitting. This work addresses this gap by introducing Active Attribute Inference (AAI*), a novel active attack that encodes sensitive attribute information by making any targeted training sample leave a distinguishable footprint on the gradient of maliciously modified neurons [8]. Results, using two real-world datasets, show that it is possible to successfully encode sensitive information incurring a small error in terms of neuron activation. More importantly, on a practical scenario, AAI. can improve upon a state-of-theart approach by achieving over 90% of restricted ROC AUC, therefore increasing model leakage. To defend against such active attacks, this work introduces several attack detection strategies tailored for different levels of the defender's knowledge. Including the novel White-box Attack Detection Mechanism (WADM*) that detects abnormal changes in weights distribution, and two black-box strategies based on the monitorization of model performance. Results show that the detection rate can be 100% on both datasets. Remarkably, WADM. reduces any attack to random guessing while preserving model utility, offering significant improvements over existing defenses, particularly when clients are non-IID. By proposing active attacks against well-generalized models and effective countermeasures, this research contributes to a better understanding of privacy in FL systems.
2025
Autores
Maia, DVDA; Vilela, JP; Curado, M;
Publicação
2025 IEEE WIRELESS COMMUNICATIONS AND NETWORKING CONFERENCE, WCNC
Abstract
The increasing number of connected and autonomous vehicles generates an even greater demand for efficient content delivery in vehicular networks. Estimating the popularity of content is an important task to proactively cache and distribute content throughout the networks to add value to users' experiences and reduce network congestion. This paper presents a novel approach for predicting popular content on vehicular networks based on a Federated Learning-Adversarial Autoencoder model and anonymised data. Unlike prior works that relied on users' raw features, our model protects user privacy through data anonymisation. This allows us to learn from the hidden patterns of content popularity and deliver popular content without compromising user privacy. Experiments showed that our approach exceeded traditional collaborative filtering and deep learning methods in terms of accuracy and robustness, even with sparse data.
The access to the final selection minute is only available to applicants.
Please check the confirmation e-mail of your application to obtain the access code.