Research of potential data leaks in information and communication systems

Оlexander Zadereyko, Olena Trofymenko, Yuliia Prokop, Nataliia Loginova, Anastasiia Dyka, Serhii Kukharenko

Abstract


This article discusses the problem of ensuring the protection of user data in information systems. It is shown that classic information systems are represented by stationary and mobile communication devices focused on data exchange with digital space. The fundamental principles of user data exchange in the digital space are considered. It has been established that leading technology IT corporations collect data from user communication devices. It is shown that the organization of data collection is carried out by redirecting the DNS traffic of the communication device to the DNS servers of IT corporations, followed by its encryption using the DoH protocol. This makes it impossible for authorized services and departments of national states to control the users’ DNS traffic and ensures the monopoly position of IT corporations in the global digital market for collecting and analyzing user data. It is shown that the collection of user data is carried out with the aim of further monetization and influencing decisions made by users. DNS traffic of devices for communication with the digital space of the Internet is fixed. An audit of the recorded DNS traffic was performed, and as a result, specialized Internet resources were identified to be responsible for collecting and processing user data. It has been proved that the identified specialized Internet resources belong to IT corporations. Methods of identification of communication devices in digital space were considered. It is shown that the identification of communication devices is based on the collection of a unique set of data from each communication device. Based on each unique data set, a digital fingerprint of the communication device is formed, which is used for its further identification in the digital space. These approaches allow organizing protection against user data collection in information systems. Software and hardware implementations for protection against data collection from communication devices are proposed. It has been experimentally established that the combined use of the proposed software and hardware models provides the most effective protection against data collection from communication devices and does not affect the functionality of information systems.

Keywords


data leaks; digital space; DNS queries; DNS servers; communication device; data collection

Full Text:

PDF

References


General Data Protection Regulation (EU GDPR). Available at: https://gdpr-text.com/en/ (accessed 4.08.2022).

Toscano, J. Data Privacy Issues Are the Root of Our Big Tech Monopoly Dilemma. Available at: https://www.forbes.com/sites/joetoscano1/2021/12/01/data-privacy-issues-are-the-root-of-our-big-tech-monopoly-dilemma/?sh=cd05cdb3cfd7 (accessed 4.08.2022).

Gugelmann, D. On Data and Privacy Leakage in Web Traffic. Doctoral Thesis. 2015. 186 p. DOI: 10.3929/ethz-a-010615756

Trofymenko, O., Dubovoy, Y. Evolution of glances at information changes in the era of information support. Comparative analytical law, 2017, vol. 1, pp. 189-192.

Zimmerman, S., Thorpe, A., Fox, C., Kruschwitz, U. Privacy Nudging in Search: Investigating Potential Impacts. Proceedings of the 2019 Conference on Human Information Interaction and Retrieval, 2019, pp. 283-287. DOI: 10.1145/3295750.3298952.

Google: a sinister trait. Available at: https://eurasia.film/2019/08/google-v-tvoej-golove/ (accessed 4.08.2022).

Esteve, A. The business of personal data: Google, Facebook, and privacy issues in the EU and the USA. International Data Privacy Law, 2017, vol. 7(1), pp. 36-47. DOI: 10.1093/idpl/ipw026.

ISO/IEC 2382:2015 Information technology – Vocabulary. Available at: https://iso.org/standard/63598.html (accessed 4.08.2022).

Kolisnyk, M.Vulnerability analysis and method of selection of communication protocols for information transfer in Internet of Things systems. Radioelectronic and Computer Systems, 2021, vol. 1(97), pp. 133-149. DOI: 10.32620/reks.2021.1.12.

Bobrovnikova, K., Lysenko, S., Savenko, B., Gaj, P., Savenko, O. Technique for IoT malware detection based on control flow graph analysis. Radioelectronic and Computer Systems, 2022, vol. 1(101), pp. 141-153. DOI: 10.32620/reks.2022.1.11.

Rivera, S., Gurbani, V.K., Lagraa, S., Iannillo, A.K., State, R. Leveraging eBPF to preserve user privacy for DNS, DoT, and DoH queries. Proceedings of the 15th International Conference on Availability, Reliability and Security (ARES'20), 2020, vol. 78, pp. 1-10. DOI: 10.1145/3407023.3407041.

Bumanglag, K., Kettani, H. On the Impact of DNS Over HTTPS Paradigm on Cyber Systems.3rd International Conference on Information and Computer Technologies (ICICT), San Jose, CA, USA, 2020, pp. 494-499. DOI: 10.1109/ICICT50521.2020.00085.

Charanjeet, S. How to Enable DNS Over HTTPS in Chrome, Firefox, Edge, Brave & More? Fossbytes, 2020. Available at: https://fossbytes.com/how-to-enable-dns-over-https-on-chrome-firefox-edge-brave/ (accessed 4.08.2022).

Imana, B., Korolova, A., Heidemann, J.S. Institutional privacy risks in sharing DNS data. Proceedings of the Applied Networking Research Workshop (ANRW ’21), Virtual Event, USA, 2021, pp. 69-75. DOI: 10.1145/3472305.3472324.

Chang, D., Chen, J.Q., Li, Z., Li, X. Hide and Seek: Revisiting DNS-based User Tracking. 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), Genoa, Italy, 2022, pp. 188-205. DOI: 10.1109/EuroSP53844.2022.00020.

Siby, S.D., Juárez, M., Díaz, C., Vallina-Rodriguez, N., Troncoso, C. Encrypted DNS -> Privacy? A Traffic Analysis Perspective. ArXiv, 2020, vol. abs/1906.09682, pp. 1-21. DOI: 10.14722/ndss.2020.24301.

Liu, Y. Computer Method Research on Risk Control Identification System Based on Deep Learning. 2021 IEEE International Conference on Advances in Electrical Engineering and Computer Applications (AEECA), Dalian, China, 2021, pp. 561-565. DOI: 10.1109/AEECA52519.2021.9574442.

Gai, V., Ephode, I., Barinov, R., Polyakov, I., Golubenko, V., Andreeva, O. Model and Algorithms for User Identification by Network Traffic. Proceedings of the 31st International Conference on Computer Graphics and Vision, 2021, vol. 2, pp. 1-11. DOI: 10.20948/graphicon-2021-3027-1017-1027.

Zadereyko, A., Troyanskiy, A., Loginova, N., Trofimenko, E. The implementation of depersonalization algorithm of digital images. 2nd International IEEE Conference Advanced information and communication technologies-2017 (AICT-2017), 2017, pp. 56-61.

Zadereyko, O., Prokop, Y., Trofymenko, O., Loginova, N., Plachinda, О. Development of an algorithm to protect user communication devices against data leaks. Eastern-European Journal of Enterprise Technologies, 2021, vol. 1/2 (109), pp. 24-34. DOI: 10.15587/1729-4061.2021.225339.

Zadereyko, O., Trofymenko, O., Loginova, N. Algorithm of user’s personal data protection against data leaks in Windows 10 OS. Informatyka, Automatyka, Pomiary w Gospodarce i Ochronie Środowiska, Lublin, 2019, vol. 9, pp. 41-44.

Natesan, S., Gupta, M., Iyer, L., Sharma, D. Detection of Data Leaks from Android Applications. Second International Conference on Inventive Research in Computing Applications (ICIRCA), 2020, pp. 326-332. DOI: 10.1109/ICIRCA48905.2020.9183066.

Naseri, M., Borges, N., Zeller, A., Rouvoy, R. Accessi Leaks: Investigating Privacy Leaks Exposed by the Android Accessibility Service. Proceedings on Privacy Enhancing Technologies, 2019, vol. 2, pp. 291-305. DOI: 10.2478/popets-2019-0031.

NoRoot Firewall. Available at: https://play.google.com/store/apps/details?hl=en&id=app.greyshirts.firewall (accessed 4.08.2022).

Windows Firewall Control. Available at: https://binisoft.org/wfc(accessed 4.08.2022).

Wireshark. Available at: https://www.wireshark.org/(accessed 4.08.2022).

Kewate, N. A Review on AWS - Cloud Computing Technology. International Journal for Research in Applied Science and Engineering Technology, 2022, vol. 10, pp. 258-263. DOI: 10.22214/ijraset.2022.39802.

Nawrocki, M., Koch, M., Schmidt, T., Wählisch, M. Transparent Forwarders: An Unnoticed Component of the Open DNS Infrastructure. Proceedings of the International Conference on emerging Networking Experiments and Technologies: CoNEXT’21, ACM, New York, NY, USA, 2021, pp. 454-462. DOI: 10.1145/3485983.3494872.

Jin, Y., Kakoi, K., Yamai, N., Kitagawa, N., Tomoishi, M. A Client Based Anomaly Traffic Detection and Blocking Mechanism by Monitoring DNS Name Resolution with User Alerting Feature. 2018 International Conference on Cyberworlds (CW), 2018, pp. 351-356. DOI: 10.1109/CW.2018.00070.

Kizza, J.M. Cloud Computing Technology and Security. Guide to Computer Network Security, 2020, pp. 477-502. DOI: 10.1007/978-3-030-38141-7_22.

Ouda, A., Yousif, A., Hasan, A., Hassan M., Shyaa M. The impact of cloud computing on network security and the risk for organization behaviors. Webology, 2022, vol. 19, no. 1, pp. 195-206. DOI: 10.14704/web/v19i1/web19015.

Shahana, P. Impact and Implications of Big Data Analytics in Cloud Computing Platforms. International Journal for Research in Applied Science and Engineering Technology, 2022, vol. 10, no. 5, pp. 4661-4666. DOI: 10.22214/ijraset.2022.43407.

Acquah, A. Managing Digitalization Challenges with Amazon Web Services. Available at: https://www.theseus.fi/bitstream/handle/10024/750296/Acquah_masters_thesis_2022.pdf (accessed 4.08.2022).

Cloud security monitoring. Available at: https://habr.com/ru/company/cisco/blog/466103/ (accessed 4.08.2022).

Karagiannis, Ch., Vergidis, K. Digital Evidence and Cloud Forensics: Contemporary Legal Challenges and the Power of Disposal. Information, 2021, vol. 12(5), no. 181, pp. 1-18. DOI: 10.3390/info12050181.

Liang, J., Kim, Y. Evolution of Firewalls: Toward Securer Network Using Next Generation Firewall. IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC-2022), pp. 0752-0759. DOI: 10.1109/CCWC54503.2022.9720435.

Tudosi, A., Balan, D., Potorac, A. Secure network architecture based on distributed firewalls. International Conference on Development and Application Systems (DAS-2022), pp. 85-90. DOI: 10.1109/DAS54948.2022.9786092.

Tupsamudre, H. New Methods to Hide Windows Scheduled Tasks. Available at: https://www.researchgate.net/publication/361444433_New_Methods_to_Hide_Windows_Scheduled_Tasks (accessed 4.08.2022).




DOI: https://doi.org/10.32620/reks.2022.4.05

Refbacks

  • There are currently no refbacks.