Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle

YU Peihou; XU Tianchen; SUN Wenqian; CHEN Yunfang; YU Le; ZHANG Wei

doi:10.11959/j.issn.2096-109x.2024084

您当前的位置：

首页 >

文章列表页 >

Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle

Papers | 更新时间：2025-02-06

- Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle
- Chinese Journal of Network and Information Security Vol. 10, Issue 6, Pages: 109-122(2024)
- 作者机构：
  
  南京邮电大学计算机学院，江苏南京 210023
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62202406)
- DOI：10.11959/j.issn.2096-109x.2024084
  CLC： TP309.2
- Received：23 May 2024，
  
  Revised：2024-10-10，
  
  Published：25 December 2024
- 稿件说明：
移动端阅览
余佩厚, 徐天辰, 孙雯倩, 等. "最小必要"原则视角检测移动应用程序的隐私合规性[J]. 网络与信息安全学报, 2024, 10(6): 109-122.

YU P H, XU T C, SUN W Q, et al. Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 109-122.
余佩厚, 徐天辰, 孙雯倩, 等. "最小必要"原则视角检测移动应用程序的隐私合规性[J]. 网络与信息安全学报, 2024, 10(6): 109-122. DOI： 10.11959/j.issn.2096-109x.2024084.

YU P H, XU T C, SUN W Q, et al. Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 109-122. DOI： 10.11959/j.issn.2096-109x.2024084.

摘要

为了满足法律法规对个人数据隐私保护的要求，移动应用程序开发商常以隐私政策的形式向用户披露其对用户个人数据的收集行为。如何精准理解这些冗长且复杂的法律文件，研究人员提出了一系列基于自然语言处理（natural language processing

NLP）的方法分析隐私政策文本并进行合规性检测。然而，目前的研究大多针对的是“透明、公开、合法”等原则，对“最小必要”原则进行检测的研究尚存在空白。为此，提出了一种基于数据收集的“最小必要”原则视角对应用程序进行自动化合规性检测方法MNPD（minimum necessary principle detection）。通过多标签文本分类模型对待测App进行服务类型上的分类，确定不同类别App的“最小必要”信息范围；构造提示词指导大语言模型从隐私政策文本中提取出该App在基本业务功能模式下的数据

收集行为，转化为隐私声明三元组并进行规范化；最后，通过合规性检测模型对待测App进行文本表述上的一致性检测以及“最小必要”原则检测。实验结果表明，所提方法对华为应用市场获取的101个“在线影音类”App自动化分析结果达到了86.20%的

1分数。

Abstract

To comply with legal requirements for personal data privacy protection

mobile App developers typically disclose their data collection practices to users through privacy policies. Researchers have proposed various methods using natural language processing (NLP) techniques to analyze privacy policy texts and perform compliance checks. However

most existing studies focus on principles like transparency

openness

and legality

leaving a gap in the evaluation of the ‘minimum necessary’ principle. For this purpose

a framework called MNPD (minimum necessary principle detection) was proposed for automated compliance checking of applications from the perspective of the ‘minimum necessary’ principle. Initially

a multi-label text classification model categorized the target App based on its service type to determine the range of ‘minimum necessary information’ for different App categories. Then

prompt words were constructed to guide the large language model in extracting data collection practices of the App under its basic business functionality mode

transforming them into privacy statement triples and standardizing them. Finally

the compliance checking model conducted consistency checks on the text representation of the target App and evaluated its adherence to the ‘minimum necessary’ principle. The experimental results show that the proposed method achieves 86.20% F1 score in the automated analysis of 101 ‘Online Audio-Visual’ Apps obtained from Huawei’s application market.

关键词

Keywords

references

中华人民共和国工业和信息化部 . 2023年前三季度互联网和相关服务业运行情况 [EB ] . 2023 .

Ministry of Industry and Information Technology of the People's Republic of China . Operation status of the internet and related services in the first three quarters of 2023 [EB ] . 2023 .

VOIGT P , VON DEM BUSSCHE A . The EU general data protection regulation (GDPR) A Practical Guide [M ] . Berlin : Springer International Publiging 2017 , 10 ( 3152676 ): 10 .

GOLDMAN E . An introduction to the California consumer privacy act (CCPA) [N ] . Santa Clara Univ. Legal Studies Research Paper , 2020 .

中华人民共和国个人信息保护法 [J ] . 中华人民共和国全国人民代表大会常务委员会公报 , 2021 , ( 6 ): 1117 - 1125 .

Personal Information protection law of the People's Republic of China [J ] . Gazette of the Standing Committee of the National People's Congress of the People's Republic of China , 2021 , ( 6 ): 1117 - 1125 .

国家市场监督管理总局 . 信息安全技术移动互联网应用程序(App)收集个人信息基本要求 : GB/T 41391-2022 [S ] . 北京 : 中国标准出版社 , 2022 .

State Administration for Market Regulation . Information security technology-basic requirements for collecting of personal information in mobile Internet applications : GB/T 41391-2022 [S ] . Beijing : Standards Press of China , 2022 .

ANDOW B , MAHMUD S Y , WANG W , et al . PolicyLint: investigating internal privacy policy contradictions on google play [C ] // 28th USENIX Security Symposium (USENIX Security 19). 2019 : 585 - 602 .

BUI D , YAO Y , SHIN K G , et al . Consistency analysis of data-usage purposes in mobile Apps [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2021 : 2824 - 2843 .

AMOS R , ACAR G , LUCHERINI E , et al . Privacy policies over time: Curation and analysis of a million-document dataset [C ] // Proceedings of the Web Conference 2021 . 2021 : 2165 - 2176 .

AHMAD W U , CHI J , LE T , et al . Intent classification and slot filling for privacy policies [J ] . arXiv preprint arXiv: 2101.00123 , 2021 .

BUI D , SHIN K G , CHOI J M , et al . Automated extraction and presentation of data practices in privacy policies [J ] . Proc Priv Enhancing Technol , 2021 , 2 : 88 - 110 .

BROWN T , MANN B , RYDER N , et al . Language models are few-shot learners [J ] . Advances in Neural Information Processing Systems , 2020 , 33 : 1877 - 1901 .

CHOWDHERY A , NARANG S , DEVLIN J , et al . Palm: scaling language modeling with pathways [J ] . arXiv Preprint arXiv: 2204.02311 , 2022 .

OpenAI . GPT-4 technical report [R ] . 2023 .

WILSON S , SCHAUB F , RAMANATH R , et al . Crowdsourcing annotations for websites' privacy policies: can it really work [C ] // Proceedings of the 25th International Conference on World Wide Web . 2016 : 133 - 143 .

李昕 , 唐鹏 , 张西珩 , 等 . 面向GDPR隐私政策合规性的智能化检测方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 6 ): 127 - 139 .

LI X , TANG P , ZHANG X H , et al . GDPR-oriented intelligent checking method of privacy policies compliance [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 6 ): 127 - 139 .

LIU F , RAMANATH R , SADEH N , et al . A step towards usable privacy policy: automatic alignment of privacy statements [C ] // Proceedings of COLING 2014 , the 25th International Conference on Computational Linguistics : Technical Papers . 2014 : 884 - 894 .

PEDDINTI S T , BILOGREVIC I , TAFT N , et al . Reducing permission requests in mobile Apps [C ] // Proceedings of the Internet Measurement Conference . 2019 : 259 - 266 .

JANA S , ERLINGSSON Ú , ION I . Apples and oranges: detecting least-privilege violators with peer group analysis [J ] . arXiv Preprint arXiv: 1510.07308 , 2015 .

ZHOU L , WEI C , ZHU T , et al . {POLICYCOMP}: counterpart comparison of privacy policies uncovers overbroad personal data collection practices [C ] // 32nd USENIX Security Symposium (USENIX Security 23). 2023 : 1073 - 1090 .

SHANAHAN M , MCDONELL K , REYNOLDS L . Role play with large language models [J ] . Nature , 2023 : 1 - 6 .

LOGAN IV R L , BALAŽEVIĆ I , WALLACE E , et al . Cutting down on prompts and parameters: simple few-shot learning with language models [J ] . arXiv Preprint arXiv: 2106.13353 , 2021 .

WEI J , WANG X , SCHUURMANS D , et al . Chain-of-thought prompting elicits reasoning in large language models [J ] . Advances in Neural Information Processing Systems , 2022 , 35 : 24824 - 24837 .

TANG C , LIU Z , MA C , et al . PolicyGPT: automated analysis of privacy policies with large language models [J ] . arXiv preprint arXiv: 2309.10238 , 2023 .

WILSON S , SCHAUB F , DARA A A , et al . The creation and analysis of a website privacy policy corpus [C ] // Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics . 2016 : 1330 - 1340 .

LIU S , ZHAO B , GUO R , et al . Have you been properly notified? automatic compliance analysis of privacy policy text with GDPR article 13 [C ] // Proceedings of the Web Conference 2021 . 2021 : 2154 - 2164 .

SUN Y , WANG S H , LI Y , et al . ERNIE: enhanced representation through knowledge integration [J ] . arXiv Preprint arXiv:1904. 09223 , 2019 .

KOJIMA T , GU S S , REID M , et al . Large language models are zero-shot reasoners [J ] . Advances in Neural Information Processing Systems , 2022 , 35 : 22199 - 22213 .

XU L , HU H , ZHANG X , et al . CLUE: a Chinese language understanding evaluation benchmark [J ] . arXiv Preprint arXiv: 2004.05986 , 2020 .

ZHOU D , SCHÄRLI N , HOU L , et al . Least-to-most prompting enables complex reasoning in large language models [J ] . arXiv Preprint arXiv: 2205.10625 , 2022 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

AutoVulnFix: LLM-driven intelligent search and adaptive vulnerability repair system

Bidirectional privacy authorization for large models based on private set intersection

mmDefender: enhancing large language model with multimodal multilingual adversarial training

Survey on automated vulnerability mining techniques for IoT device firmware

Instruction and demonstration-based secure service attribute generation mechanism for textual data

Related Author

Han Hao

Wu Zicheng

Zhao Xinjian

Ding Yixin

WANG Yuanyuan

FENG Haokang

WU Xuguang

HAN Yiliang

Related Institution

State Grid Jiangsu Electric Power Co., Ltd.

Nanjing University of Aeronautics and Astronautics

College of Cryptography Engineering, Engineering University of PAP

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

State Grid Laboratory of Power Cyber-Security Protection and Monitoring Technology, China Electric Power Research Institute

⁰