{"id":"https://openalex.org/W4399397059","doi":"https://doi.org/10.1145/3639475.3640102","title":"Alexa, is the skill always safe? Uncover Lenient Skill Vetting Process and Protect User Privacy at Run Time","display_name":"Alexa, is the skill always safe? Uncover Lenient Skill Vetting Process and Protect User Privacy at Run Time","publication_year":2024,"publication_date":"2024-04-14","ids":{"openalex":"https://openalex.org/W4399397059","doi":"https://doi.org/10.1145/3639475.3640102"},"language":"en","primary_location":{"id":"doi:10.1145/3639475.3640102","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3639475.3640102","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3639475.3640102","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 46th International Conference on Software Engineering: Software Engineering in Society","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3639475.3640102","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016129684","display_name":"Tu Le","orcid":"https://orcid.org/0000-0002-1621-0331"},"institutions":[{"id":"https://openalex.org/I204250578","display_name":"University of California, Irvine","ror":"https://ror.org/04gyf1771","country_code":"US","type":"education","lineage":["https://openalex.org/I204250578"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tu Le","raw_affiliation_strings":["University of California, Irvine, Irvine, CA, United States of America"],"raw_orcid":"https://orcid.org/0000-0002-1621-0331","affiliations":[{"raw_affiliation_string":"University of California, Irvine, Irvine, CA, United States of America","institution_ids":["https://openalex.org/I204250578"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065014409","display_name":"Dongfang Zhao","orcid":"https://orcid.org/0009-0005-5742-5119"},"institutions":[{"id":"https://openalex.org/I4210119109","display_name":"Indiana University Bloomington","ror":"https://ror.org/02k40bc56","country_code":"US","type":"education","lineage":["https://openalex.org/I4210119109","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dongfang Zhao","raw_affiliation_strings":["Indiana University Bloomington, Bloomington, IN, United States of America"],"raw_orcid":"https://orcid.org/0009-0005-5742-5119","affiliations":[{"raw_affiliation_string":"Indiana University Bloomington, Bloomington, IN, United States of America","institution_ids":["https://openalex.org/I4210119109"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087208213","display_name":"Zihao Wang","orcid":"https://orcid.org/0009-0009-7620-4142"},"institutions":[{"id":"https://openalex.org/I4210119109","display_name":"Indiana University Bloomington","ror":"https://ror.org/02k40bc56","country_code":"US","type":"education","lineage":["https://openalex.org/I4210119109","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zihao Wang","raw_affiliation_strings":["Indiana University Bloomington, Bloomington, IN, USA"],"raw_orcid":"https://orcid.org/0009-0009-7620-4142","affiliations":[{"raw_affiliation_string":"Indiana University Bloomington, Bloomington, IN, USA","institution_ids":["https://openalex.org/I4210119109"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066976667","display_name":"XiaoFeng Wang","orcid":"https://orcid.org/0000-0002-0607-4946"},"institutions":[{"id":"https://openalex.org/I4210119109","display_name":"Indiana University Bloomington","ror":"https://ror.org/02k40bc56","country_code":"US","type":"education","lineage":["https://openalex.org/I4210119109","https://openalex.org/I592451"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"XiaoFeng Wang","raw_affiliation_strings":["Indiana University Bloomington, Bloomington, IN, United States of America"],"raw_orcid":"https://orcid.org/0000-0002-0607-4946","affiliations":[{"raw_affiliation_string":"Indiana University Bloomington, Bloomington, IN, United States of America","institution_ids":["https://openalex.org/I4210119109"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100716458","display_name":"Yuan Tian","orcid":"https://orcid.org/0000-0002-6435-564X"},"institutions":[{"id":"https://openalex.org/I161318765","display_name":"University of California, Los Angeles","ror":"https://ror.org/046rm7j60","country_code":"US","type":"education","lineage":["https://openalex.org/I161318765"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yuan Tian","raw_affiliation_strings":["University of California, Los Angeles, Los Angeles, CA, United States of America"],"raw_orcid":"https://orcid.org/0000-0002-6435-564X","affiliations":[{"raw_affiliation_string":"University of California, Los Angeles, Los Angeles, CA, United States of America","institution_ids":["https://openalex.org/I161318765"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"34","last_page":"45"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10270","display_name":"Blockchain Technology Applications and Security","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9957000017166138,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vetting","display_name":"Vetting","score":0.987951934337616},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.763320803642273},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.6120882034301758},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.44668421149253845},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.4080502986907959},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.3601419925689697},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11658266186714172}],"concepts":[{"id":"https://openalex.org/C2777230681","wikidata":"https://www.wikidata.org/wiki/Q7923820","display_name":"Vetting","level":2,"score":0.987951934337616},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.763320803642273},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.6120882034301758},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44668421149253845},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.4080502986907959},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3601419925689697},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11658266186714172}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3639475.3640102","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3639475.3640102","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3639475.3640102","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 46th International Conference on Software Engineering: Software Engineering in Society","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3639475.3640102","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3639475.3640102","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3639475.3640102","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 46th International Conference on Software Engineering: Software Engineering in Society","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.6600000262260437,"display_name":"Quality Education","id":"https://metadata.un.org/sdg/4"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4399397059.pdf"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W1582774210","https://openalex.org/W2102460407","https://openalex.org/W2508433864","https://openalex.org/W2798906453","https://openalex.org/W2899225656","https://openalex.org/W2916032017","https://openalex.org/W2921394285","https://openalex.org/W2933426098","https://openalex.org/W2946864464","https://openalex.org/W2947292651","https://openalex.org/W2983277367","https://openalex.org/W3006816054","https://openalex.org/W3096559598","https://openalex.org/W3112086075","https://openalex.org/W3128281363","https://openalex.org/W3139099451","https://openalex.org/W3200074315","https://openalex.org/W4225093391","https://openalex.org/W4361021419","https://openalex.org/W4385412341"],"related_works":["https://openalex.org/W3137893487","https://openalex.org/W2588786532","https://openalex.org/W2169930420","https://openalex.org/W2108865840","https://openalex.org/W2802914690","https://openalex.org/W4248793399","https://openalex.org/W3120410482","https://openalex.org/W2980021769","https://openalex.org/W2769878339","https://openalex.org/W3129671051"],"abstract_inverted_index":{"Voice":[0],"personal":[1],"assistant":[2],"(VPA)":[3],"platforms":[4],"(e.g.,":[5],"Amazon":[6,115],"Alexa)":[7],"allow":[8],"developers":[9,29,189,192],"to":[10,25,36,45,61,81,97,105,144,155,175,194],"deploy":[11],"their":[12,33,98],"voice":[13,49],"apps":[14],"on":[15,56,187],"third-party":[16],"servers.":[17],"However,":[18],"this":[19,132],"strategy":[20,91],"introduces":[21],"unexpected":[22],"privacy":[23,94],"risks":[24],"VPA":[26,181],"customers.":[27],"Malicious":[28],"can":[30],"dynamically":[31],"change":[32],"app's":[34],"behaviors":[35,162],"circumvent":[37],"the":[38,68,93,106,123,157,160,177],"platform's":[39],"vetting":[40,90,178],"process.":[41],"This":[42],"paper":[43],"aims":[44],"systematically":[46],"analyze":[47],"Alexa's":[48],"app":[50],"ecosystem":[51],"(i.e.,":[52],"Alexa":[53],"skills),":[54],"focusing":[55],"behavior":[57,64],"manipulation":[58],"(also":[59],"referred":[60],"as":[62],"skill":[63,89,107,112,119,124,152,161,188],"change).":[65],"We":[66,100,127],"identify":[67],"root":[69],"causes":[70],"of":[71,131,159],"malicious":[72],"skills":[73,182],"getting":[74],"published":[75],"and":[76,92,190],"propose":[77,149],"a":[78,111,118,150,171,185],"defense":[79],"solution":[80],"effectively":[82],"protect":[83],"users.":[84],"First,":[85],"we":[86,148],"uncover":[87],"Amazon's":[88],"issues":[95],"relevant":[96],"vetting.":[99],"reveal":[101],"that,":[102],"in":[103,140],"addition":[104],"certification":[108],"process":[109,179],"before":[110],"gets":[113],"published,":[114],"also":[116],"deploys":[117],"monitoring":[120,133,153],"scheme":[121,134],"after":[122],"is":[125],"published.":[126],"further":[128],"discover":[129],"limitations":[130],"that":[135],"have":[136],"not":[137],"been":[138],"explored":[139],"previous":[141],"research.":[142],"Lastly,":[143],"address":[145],"these":[146],"issues,":[147],"run-time":[151],"approach":[154],"check":[156],"consistency":[158],"when":[163],"users":[164],"interact":[165],"with":[166],"skills.":[167],"Our":[168],"findings":[169],"suggest":[170],"call":[172],"for":[173,180],"action":[174],"improve":[176],"without":[183],"placing":[184],"burden":[186],"help":[191],"adhere":[193],"policies.":[195]},"counts_by_year":[{"year":2025,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}