From Cluttered to Clustered: Addressing Privacy Threat Explosion through Automated Clustering

Threat modeling methods and tools that involve the systematic and structured elicitation of privacy threats often lead to extensive threat lists, especially when applied to complex systems comprised of many elements — a phenomenon described as 'threat explosion'. Grouping and merging these lists of fine-grained threats is a costly and time-consuming matter, yet often desired in support of threat management, i.e. follow up, prioritization, mitigation, etc. In this paper, we explore different strategies for automatically clustering threats at the basis of similarity or other relations. In particular, we propose three overall strategies for automated clustering: (1) location-based, where threats are clustered based on their location in the given system, (2) threat type-based, where threats are grouped if they are of the same type, and (3) description-based, where threats are clustered based on similarity in their name or textual description. In addition, we define a number of strategies that combine location- and threat type-based strategies. We then perform an exploratory experiment in the case study of DP-3T, a COVID-19 contact tracing protocol used extensively during the pandemic. In this experiment, we apply the automated clustering strategies to a list comprised of 358 generated LINDDUN threats, of which 125 were manually established as relevant and documented. Through manual clustering and grouping, this led to the definition of 43 clusters. We compare the performance of the automated strategies in how well they approximate this expert clustering. Our results indicate that the clustering strategies, and especially description-based clustering techniques that apply NLP, lead to clusters similar to the manually established expert baseline. This study underscores the promise of automated techniques in reducing the manual effort that is required in the overall management of threats after the first elicitation phase.