An Information Extraction Attack against On-Line Social Networks

Millions of people use On-line social networks (OSNs) every day and privacy of sensitive personal information is a major concern. Although OSNs provide policies and mechanisms to allow users to control who can view their data, these efforts may not be sufficient under various privacy attacks. In this paper, we study the disclosure of private information concealed on a social network under an information extraction attack. The novelty of this attack is that it combines web search with information extraction and data mining techniques to discover private information that is hidden on a social network by considering web pages outside of the given social network. We also define a quantitative measure of the risk of privacy disclosure under this and other similar attacks, given the privacy policy and protection mechanism of a social network website. We show that with some public information of a victim from a social network, it is not too difficult for the adversary to utilize this attack to find other private information of the victim hidden on the social network. Our results call for further study of the strength of privacy protection mechanisms of online social networks, and the development of new and more effective protection methods.