Information Flow Investigations (CMU-CS-13-118)

Information-flow analysis has largely ignored the setting where the analyst has neither control over nor a complete model of the analyzed system. We formalize such limited information flow investigations and study it in three domains: (1) the determination of what third-party web trackers do with the information they collect, (2) the identification of copyright violators, and (3) the detection of insiders leaking data. We use a common framework based on information flow analysis to relate these three problems while pushing beyond traditional information flow analysis. Viewing these seemingly disparate problems in a common framework allows us to identify the assumptions underlying analyses used for these problems and to show where each area could benefit from the other. Our systematic study leads to practical advice for improving work on tracking web trackers, a previously unformalized area.