User-controllable learning of security and privacy policies

Studies have shown that users have great difficulty specifying their security and privacy policies in a variety of application domains. While machine learning techniques have successfully been used to refine models of user preferences, such as in recommender systems, they are generally configured as "black boxes" that take control over the entire policy and severely restrict the ways in which the user can manipulate it. This article presents an alternative approach, referred to as user-controllable policy learning. It involves the incremental manipulation of policies in a context where system and user refine a common policy model. The user regularly provides feedback on decisions made based on the current policy. This feedback is used to identify (learn) incremental policy improvements which are presented as suggestions to the user. The user, in turn, can review these suggestions and decide which, if any, to accept. The incremental nature of the suggestions enhances usabilit...

• Type: Conference
• Year: 2008
• Where: CCS
• Authors: Patrick Gage Kelley, Paul Hankes Drielsma, Norman M. Sadeh, Lorrie Faith Cranor
• Keywords: CCS 2008, Common Policy, Policy, Security Privacy, User