![](bg8.png)
sufficient battery power. The most opportune periods
for performing sync can also be determined from the
inferred knowledge that is built on previous usage ac-
tivity.
Within the proxy service there would also need to
exist a background service that performs necessary
transformations of activity data into existing knowl-
edge and existing knowledge into inferred knowledge.
Similar to the client application, this transformation
service should take advantage of periods that are de-
termined to be most opportunistic to perform these
transformations so that the user’s experience is un-
affected. From these transformations, validation of
intercepted network requests should become more ef-
ficient during more active periods.
8 CONCLUSION AND FUTURE
WORK
In this paper we proposed an ontology by examining
previous research and analyzing the most widely used
mobile operating systems for common attributes. The
ontology we propose can be used to enforce secu-
rity and privacy policies on a mobile device using a
knowledge based approach. The key difference in the
ontology we propose here compared with previous re-
search is that it focuses on enforcement of policies as
opposed to detection of security vulnerabilities as was
the primary focus of the related work we identified.
Additionally the ontology we propose along with how
it can be enforced does not require modification to the
operating system. Our ontology also focuses on pri-
vacy concerns as well as security concerns.
For elements in the ontology such as activity and
existing knowledge, we recognize that personal data
and sensing components would have to be made avail-
able to the enforcing application. The determination
of possible policy violations can be performed locally
at the mobile device, or via a cloud service. We are
working on implementing such a cloud enforcement
service based on the proposed ontology. We take this
approach because it may consume less resources for
policy enforcement compared with the local enforce-
ment approach. Furthermore, with most modern mo-
bile operating systems implementing sandboxing con-
trols, any enforcing application that lived locally on
the mobile device would need to violate the sandbox-
ing mechanism to inspect data being leaked from the
device to enforce the user’s defined privacy and secu-
rity policies. Therefore, a cloud based enforcement
service is more feasible, which will be our focus in
future work.
REFERENCES
Ball, J. (2014). Angry birds and ’leaky’ phone apps
targeted by nsa and gchq for user data. http://
www.theguardian.com/world/2014/jan/27/nsa-gchq-
smartphone-app-angry-birds-personal-data.
Beji, S. and El Kadhi, N. (2009a). A knowledge based pro-
cess proposal for mobile security. In Developments in
eSystems Engineering (DESE), 2009 Second Interna-
tional Conference on, pages 166–172.
Beji, S. and El Kadhi, N. (2009b). Security ontology pro-
posal for mobile applications. In Mobile Data Man-
agement: Systems, Services and Middleware, 2009.
MDM ’09. Tenth International Conference on, pages
580–587.
Foursquare (2014). About foursquare. https://
foursquare.com/about.
Ju An WangGuo, Michael M.Camargo, J. (2010). An on-
tological approach to computer system security. In-
formation Security Journal: A Global Perspective,
19(2):61 – 73.
Krupp, B., Sridhar, N., and Zhao, W. (2013). A frame-
work for enhancing security and privacy on unmod-
ified mobile mobile operating systems. In The First
International Workshop on Mobile Cloud and Social
Computing.
Krupp, B., Zhao, W., and Sridhar, N. (2014). Tell me
the truth! what is your intent with my mobile data?
Technical Report TR-CSU-ECE-1411, Electrical and
Computer Engineering, Cleveland State University.
Panagiotopoulos, I., Seremeti, L., Kameas, A., and
Zorkadis, V. (2010). Proact: An ontology-based
model of privacy policies in ambient intelligence en-
vironments. In Informatics (PCI), 2010 14th Panhel-
lenic Conference on, pages 124–129.
Symantec (2014). Norton mobile insight discovers
facebook privacy leak. http://www.symantec.com/
connect/blogs/norton-mobile-insight-discovers-
facebook-privacy-leak.
Tsoumas, B. and Gritzalis, D. (2006). Towards an ontology-
based security management. In Advanced Information
Networking and Applications, 2006. AINA 2006. 20th
International Conference on, volume 1, pages 985–
992.
Twitter (2014). New tweets per second record, and
how! https://blog.twitter.com/2013/new-tweets-per-
second-record-and-how.
Uszok, A., Bradshaw, J., Jeffers, R., Suri, N., Hayes, P.,
Breedy, M., Bunch, L., Johnson, M., Kulkarni, S.,
and Lott, J. (2003). Kaos policy and domain services:
toward a description-logic approach to policy repre-
sentation, deconfliction, and enforcement. In Policies
for Distributed Systems and Networks, 2003. Proceed-
ings. POLICY 2003. IEEE 4th International Workshop
on, pages 93–96.
Woo, S., On, J., and Lee, M. (2013). Behavior ontology:
A framework to detect attack patterns for security. In
Advanced Information Networking and Applications
Workshops (WAINA), 2013 27th International Confer-
ence on, pages 738–743.
AnOntologyforEnforcingSecurityandPrivacyPoliciesonMobileDevices
295