论文标题
CANARYTRAP：在线社交网络上通过第三方应用程序检测数据滥用
CanaryTrap: Detecting Data Misuse by Third-Party Apps on Online Social Networks
论文作者
论文摘要
在线社交网络支持第三方应用程序的充满活力的生态系统，可访问大量用户的个人信息。尽管最近发生了几起备受瞩目的事件，但缺乏在线社交网络上系统地检测第三方应用程序滥用数据的方法。我们建议CanaryTrap检测与第三方应用程序共享的数据的滥用。 CanaryTrap将HoneyToken与用户帐户相关联，然后在与第三方应用程序共享后通过不同的频道来监视其无法识别的使用。我们设计和实施CanaryTrap，以调查Facebook上与第三方应用程序共享的数据的滥用。具体来说，我们通过安装第三方应用程序共享与Facebook帐户相关的电子邮件地址。然后，我们监视接收到的电子邮件，并使用Facebook的广告透明度工具来检测对共享HoneyToken的任何未知的使用。我们部署了CanaryTrap来监视1,024个Facebook应用程序，发现了多个滥用与Facebook上的第三方应用程序共享数据的案例，包括勒索软件，垃圾邮件，垃圾邮件和有针对性的广告。
Online social networks support a vibrant ecosystem of third-party apps that get access to personal information of a large number of users. Despite several recent high-profile incidents, methods to systematically detect data misuse by third-party apps on online social networks are lacking. We propose CanaryTrap to detect misuse of data shared with third-party apps. CanaryTrap associates a honeytoken to a user account and then monitors its unrecognized use via different channels after sharing it with the third-party app. We design and implement CanaryTrap to investigate misuse of data shared with third-party apps on Facebook. Specifically, we share the email address associated with a Facebook account as a honeytoken by installing a third-party app. We then monitor the received emails and use Facebook's ad transparency tool to detect any unrecognized use of the shared honeytoken. Our deployment of CanaryTrap to monitor 1,024 Facebook apps has uncovered multiple cases of misuse of data shared with third-party apps on Facebook including ransomware, spam, and targeted advertising.
