Tracking the Trackers: Towards Understanding the Mobile Advertising and Tracking Ecosystem
Narseo Vallina-Rodriguez1,2 Srikanth Sundaresan3 Abbas Razaghpanah4 Rishab Nithyanand4 Mark Allman1 Christian Kreibich1,5 Phillipa Gill6 1ICSI, 2IMDEA Networks, 3Samsara, 4Stony Brook University, 5Lastline, 6UMass
Abstract
Third-party services form an integral part of the mobile ecosystem: they allow app developers to add features such as performance analytics and social network integration, and to monetize their apps by enabling user tracking and targeted ad delivery. At present users, researchers, and regulators all have at best limited understanding of this third-party ecosystem. In this paper we seek to shrink this gap. Using data from users of our ICSI Haystack app we gain a rich view of the mobile ecosystem: we identify and characterize domains associated with mobile advertising and user tracking, thereby taking an important step towards greater transparency. We furthermore outline our steps towards a public catalog and census of analytics services, their behavior, their personal data collection processes, and their use across mobile apps.
中文速览
移动应用生态里充斥着大量第三方广告与追踪服务（Advertising and Tracking Services, ATS），但用户、研究者和监管者对这些服务究竟有哪些、如何运作几乎一无所知。研究者借助 ICSI Haystack——一款在用户真实设备上运行的 Android 应用，通过 VPN 权限在本地捕获并分析网络流量——对690名真实用户产生的近180万条流量记录展开分析，提出了一套结合商业域名分类系统与网页关键词爬取的自动分类方法，从1732款应用中识别出280个与广告追踪相关的域名，其中75个此前未被主流屏蔽列表收录。结果显示，60%的受监测应用至少连接一个ATS域名，20%连接5个以上，Crashlytics 和 Facebook Graph API 的渗透率均超过20%，且后者因流量完全走 TLS 加密并复用非追踪域名而难以被传统广告拦截手段识别。这项研究为构建移动追踪生态的公开目录提供了基础，有助于提升透明度、保护用户隐私，并为监管机构评估潜在的法律合规问题（如针对儿童应用的 COPPA 条款）提供了实证依据。
原文 arXiv:1609.07190;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1609.07190v2