inference attack

{{short description|Data mining technique}}

An Inference Attack is a data mining technique performed by analyzing data in order to illegitimately gain knowledge about a subject or database.[http://research.microsoft.com/~jckrumm/Publications%202007/inference%20attack%20refined02%20distribute.pdf "Inference Attacks on Location Tracks" by John Krumm] A subject's sensitive information can be considered as leaked if an adversary can infer its real value with a high confidence.http://www.ics.uci.edu/~chenli/pub/2007-dasfaa.pdf "Protecting Individual Information Against

Inference Attacks in Data Publishing" by Chen Li, Houtan Shirani-Mehr, and Xiaochun Yang This is an example of breached information security. An Inference attack occurs when a user is able to infer from trivial information more robust information about a database without directly accessing it.[http://andromeda.rutgers.edu/~gshafer/raman.pdf "Detecting Inference Attacks Using Association Rules" by Sangeetha Raman, 2001] The object of Inference attacks is to piece together information at one security level to determine a fact that should be protected at a higher security level.{{Cite web |url=http://databases.about.com/od/security/l/aainference.htm |title="Database Security Issues: Inference" by Mike Chapple |access-date=2007-10-23 |archive-date=2007-10-13 |archive-url=https://web.archive.org/web/20071013190215/http://databases.about.com/od/security/l/aainference.htm |url-status=dead }}

While inference attacks were originally discovered as a threat in statistical databases,{{cite book|author=V. P. Lane|title=Security of Computer Based Information Systems|url=https://books.google.com/books?id=dkJdDwAAQBAJ&pg=PR11|date=8 November 1985|publisher=Macmillan International Higher Education|isbn=978-1-349-18011-0|pages=11–}} today they also pose a major privacy threat in the domain of mobile and IoT sensor data. Data from accelerometers, which can be accessed by third-party apps without user permission in many mobile devices,{{cite journal|last1=Bai|first1=Xiaolong|last2=Yin|first2=Jie|last3=Wang|first3=Yu-Ping|title=Sensor Guardian: prevent privacy inference on Android sensors|journal=EURASIP Journal on Information Security|volume=2017|issue=1|year=2017|issn=2510-523X|doi=10.1186/s13635-017-0061-8|doi-access=free}} has been used to infer rich information about users based on the recorded motion patterns (e.g., driving behavior, level of intoxication, age, gender, touchscreen inputs, geographic location).{{cite conference |title=Privacy implications of accelerometer data: a review of possible inferences |last1=Kröger |first1=Jacob Leon |last2=Raschke |first2=Philip |date=January 2019 |publisher=ACM, New York |book-title=Proceedings of the International Conference on Cryptography, Security and Privacy |pages=81–87 |doi=10.1145/3309074.3309076|doi-access=free }}

Highly sensitive inferences can also be derived, for example, from eye tracking data,{{cite book|last1=Liebling|first1=Daniel J.|last2=Preibusch|first2=Sören|title=Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing: Adjunct Publication |chapter=Privacy considerations for a pervasive eye tracking world|year=2014|pages=1169–1177|doi=10.1145/2638728.2641688|isbn=9781450330473 |s2cid=3663921 }}{{cite book|last1=Kröger|first1=Jacob Leon|last2=Lutz|first2=Otto Hans-Martin|last3=Müller|first3=Florian|title=Privacy and Identity Management. Data for Better Living: AI and Privacy |chapter=What Does Your Gaze Reveal About You? On the Privacy Implications of Eye Tracking|series=IFIP Advances in Information and Communication Technology |volume=576|year=2020|pages=226–241|issn=1868-4238|doi=10.1007/978-3-030-42504-3_15|isbn=978-3-030-42503-6 |doi-access=free}} smart meter data{{cite book|last1=Clement|first1=Jana|last2=Ploennigs|first2=Joern|last3=Kabitzsch|first3=Klaus|title=Ambient Assisted Living |chapter=Detecting Activities of Daily Living with Smart Meters|series=Advanced Technologies and Societal Change |year=2014|pages=143–160|issn=2191-6853|doi=10.1007/978-3-642-37988-8_10|isbn=978-3-642-37987-1 }}{{cite journal|last1=Sankar|first1=Lalitha|last2=Rajagopalan|first2=S.R.|last3=Mohajer|first3=Soheil|last4=Poor|first4=H.V.|title=Smart Meter Privacy: A Theoretical Framework|journal=IEEE Transactions on Smart Grid|volume=4|issue=2|year=2013|pages=837–846|issn=1949-3053|doi=10.1109/TSG.2012.2211046|s2cid=13471323 }} and voice recordings (e.g., smart speaker voice commands).{{cite book|last1=Kröger|first1=Jacob Leon|last2=Lutz|first2=Otto Hans-Martin|last3=Raschke|first3=Philip|title=Privacy and Identity Management. Data for Better Living: AI and Privacy |chapter=Privacy Implications of Voice and Speech Analysis – Information Disclosure by Inference|series=IFIP Advances in Information and Communication Technology |volume=576|year=2020|pages=242–258|issn=1868-4238|doi=10.1007/978-3-030-42504-3_16|isbn=978-3-030-42503-6 |doi-access=free}}