Turning the Tide on Dark Pools? Towards Multi-Stakeholder Vulnerability Notifications in the Ad-Tech Supply Chain
<|reference_start|>Turning the Tide on Dark Pools? Towards Multi-Stakeholder Vulnerability Notifications in the Ad-Tech Supply Chain: Online advertising relies on a complex and opaque supply chain that involves multiple stakeholders, including advertisers, publishers, and ad-networks, each with distinct and sometimes conflicting incentives. Recent research has demonstrated the existence of ad-tech supply chain vulnerabilities such as dark pooling, where low-quality publishers bundle their ad inventory with higher-quality ones to mislead advertisers. We investigate the effectiveness of vulnerability notification campaigns aimed at mitigating dark pooling. Prior research on vulnerability notifications has primarily focused on single-stakeholder scenarios, and it is unclear whether vulnerability notifications can be effective in the multi-stakeholder ad-tech supply chain. We implement an automated vulnerability notification pipeline to systematically evaluate the responsiveness of various stakeholders, including publishers, ad-networks, and advertisers to vulnerability notifications by academics and activists. Our nine-month long multi-stakeholder notification study shows that notifications are an effective method for reducing dark pooling vulnerabilities in the online advertising ecosystem, especially when targeted towards ad-networks. Further, the sender reputation does not impact responses to notifications from activists and academics in a statistically different way. In addition to being the first notification study targeting the online advertising ecosystem, we are also the first to study multi-stakeholder context in vulnerability notifications.<|reference_end|>
@article{vekaria2024turning,
    title={Turning the Tide on Dark Pools? Towards Multi-Stakeholder Vulnerability
  Notifications in the Ad-Tech Supply Chain},
    author={Yash Vekaria (1), Rishab Nithyanand (2), Zubair Shafiq (1) ((1)
  University of California, Davis, (2) University of Iowa)},
    journal={arXiv preprint arXiv:2406.06958},
    year={2024},
    archivePrefix={arXiv},
    eprint={2406.06958},
    primaryClass={cs.CR cs.CY cs.MA cs.NI cs.SI}
}