Privacy Interpretation of Behavioural-based Anomaly Detection Approaches

TL;DR

This paper explores whether behavioral anomaly detection methods can interpret privacy violations, demonstrating their potential to identify privacy attacks as anomalies by analyzing deviations in user query behavior.

Contribution

It introduces the concept of 'Privacy-Anomaly Detection' and shows that behavioral approaches can detect privacy violations as anomalies, linking practical detection to formal privacy definitions.

Findings

Behavioral anomaly detection can identify privacy attacks.

Query sequence deviations indicate privacy violations.

Interactive querying is vulnerable to privacy attacks.

Abstract

This paper proposes the notion of 'Privacy-Anomaly Detection' and considers the question of whether behavioural-based anomaly detection approaches can have a privacy semantic interpretation and whether the detected anomalies can be related to the conventional (formal) definitions of privacy semantics such as k-anonymity. The idea is to learn the user's past querying behaviour in terms of privacy and then identifying deviations from past behaviour in order to detect privacy violations. Privacy attacks, violations of formal privacy definition, based on a sequence of SQL queries (query correlations) are also considered in the paper and it is shown that interactive querying settings are vulnerable to privacy attacks based on query sequences. Investigation on whether these types of privacy attacks can potentially manifest themselves as anomalies, specifically as privacy-anomalies was carried out. It is shown that in this paper that behavioural-based anomaly detection approaches have the potential to detect privacy attacks based on query sequences (violation of formal privacy definition) as privacy-anomalies.