Defending against Sybil Devices in Crowdsourced Mapping Services

By Gang Wang, Bolun Wang, Tianyi Wang, A. Nika, Haitao Zheng, Ben Y. Zhao. 2015

98 citations recorded by the source corpus.

Real-time crowdsourced maps such as Waze provide timely updates on traffic, congestion, accidents and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based Sybil devices that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. We propose a new approach to defend against Sybil devices based on co-location edges, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, co-location edges combine to form large proximity graphs that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and discuss how they can be used to dramatically reduce the impact of attacks against crowdsourced mapping services.

Subfields: Information Systems, Sociology and Political Science, Transportation

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Sociology and Political Science

In Transportation

Citations in the corpus

Prio: Private, Robust, and Scalable Computation of Aggregate Statistics (2017, background): “These centralized caches of private user data pose severe security and privacy risks: motivated attackers may steal and disclose clients’ sensitive information [84,117], cloud services may misuse the clients’ information for profit [112], and intelligence agencies may appropriate the data for target”
Biscotti: A Ledger for Private and Secure Peer-to-Peer Machine Learning (2018, background): “ required that public key infrastructure exists which validates the identity of users [12], but prior sybil work has shown that relying on public key infrastructure for user validation is insufﬁcient [52, 53]. Privacy-preserving ML. Cheng et al. recently proposed the use of TEEs and privacy-preservi”
A Survey on Security, Privacy, and Trust in Mobile Crowdsourcing (2018, background): “example, some MCS applications collect GPS fixes or cellular network IDs, from which a user’s location and his/her physical activities can be inferred [114].”
A Survey of Physics-Based Attack Detection in Cyber-Physical Systems (2018, background): “Sybil attacks can be particularly problematic in crowdsourced sensor data such as routing services like Waze [110].”