ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic

By Jingjing Ren, Ashwin Rao, Martina Lindorfer, Arnaud Legout, David R. Choffnes. 2015

265 citations recorded by the source corpus.

It is well known that apps running on mobile devices extensively track and leak users' personally identifiable information (PII); however, these users have little visibility into PII leaked through the network traffic generated by their devices, and have poor control over how, when and where that traffic is sent and handled by third parties. In this paper, we present the design, implementation, and evaluation of ReCon: a cross-platform system that reveals PII leaks and gives users control over them without requiring any special privileges or custom OSes. ReCon leverages machine learning to reveal potential PII leaks by inspecting network traffic, and provides a visualization tool to empower users with the ability to control these leaks via blocking or substitution of PII. We evaluate ReCon's effectiveness with measurements from controlled experiments using leaks from the 100 most popular iOS, Android, and Windows Phone apps, and via an IRB-approved user study with 92 participants. We show that ReCon is accurate, efficient, and identifies a wider range of PII than previous approaches.

Subfields: Artificial Intelligence, Information Systems, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Privacy & Security

In Signal Processing

Citations in the corpus

Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis (2017, background): “…and dynamic analysis requires heavy instrumentation , and is thus more likely to be used by app stores than by end users, researchers have recently proposed a more lightweight alternative: identifying privacy leaks on the network layer through traffic interception [24], [27], [34], [35], [39].”
The Long-Standing Privacy Debate: Mobile Websites vs Mobile Apps (2017, methodology): “Thus, our final dataset consists of 116 apps along with their associated mobilefriendly web counterpart, making it larger than datasets explored in similar manually investigative studies([31]: 50 apps, [45]: 100 apps , [66]: 110 apps).”
FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic (2020, methodology): “We collected three of the datasets as part of our prior work [40, 51, 52, 53].”
Security and Privacy Challenges of Large Language Models: A Survey (2024, unknown): “The overarching goal is to enhance the reliability and utility of LLMs through comprehensive exploration and resolution of these vulnerabilities and offer pathways for future research toward secure and privacy-preserving LLM systems.”