Intelligent mining of App’s potential data sharing behavior

Liu Fanjia; Chen Yuxin; Wang Yangde; Tang Peng; Qiu Weidong

doi:10.11959/j.issn.2096-109x.AQ26003

您当前的位置：

首页 >

文章列表页 >

Intelligent mining of App’s potential data sharing behavior

Papers | 更新时间：2026-07-15

- Intelligent mining of App’s potential data sharing behavior
- Chinese Journal of Network and Information Security Vol. 12, Issue 3, Pages: 64-77(2026)
- 作者机构：
  
  上海交通大学计算机学院（网络空间安全学院、密码学院），上海 200240
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.AQ26003
  CLC： TP393.0
- Received：08 January 2026，
  
  Revised：2026-04-28，
  
  Published：25 June 2026
- 稿件说明：
移动端阅览
刘凡嘉, 陈裕鑫, 王杨德, 等. App潜在数据共享行为智能挖掘[J]. 网络与信息安全学报, 2026, 12(3): 64-77.

Liu Fanjia, Chen Yuxin, Wang Yangde, et al. Intelligent mining of App’s potential data sharing behavior[J]. Chinese Journal of Network and Information Security, 2026, 12(3): 64-77.
刘凡嘉, 陈裕鑫, 王杨德, 等. App潜在数据共享行为智能挖掘[J]. 网络与信息安全学报, 2026, 12(3): 64-77. DOI： 10.11959/j.issn.2096-109x.AQ26003.

Liu Fanjia, Chen Yuxin, Wang Yangde, et al. Intelligent mining of App’s potential data sharing behavior[J]. Chinese Journal of Network and Information Security, 2026, 12(3): 64-77. DOI： 10.11959/j.issn.2096-109x.AQ26003.

摘要

移动应用软件成为人们日常生活的重要组成部分，同时也带来了数据隐私安全风险。一些软件将用户数据通过后台分享给第三方，或者从第三方获得用户数据，进行精准的个性化推荐。这种数据共享渠道具有隐蔽性，在当前监管体系下难以被有效追踪。针对这一问题，设计了一种自动化检测App之间潜在数据共享行为的智能挖掘方案。该方案构建了基于自动化测试的检测框架，通过模拟用户行为，利用关键词注入用户偏好数据，收集个性化推荐界面截图；引入基于人工智能模型的信息提取和关联性分析技术，利用光学字符识别模型、多模态视觉大模型和大语言模型，完成对App截图中的文本信息和图像内容的智能提取和理解，实现对关键词和图像内容描述之间的关联性判断；对30个App完成了用户偏好注入，建立了含8 700张截图的数据集，获得了1 466条数据共享行为证据。在30个App中，有23个检出存在向第三方提供数据的行为，有29个存在从第三方接收数据并进行个性化推荐的行为。构建了App数据共享行为的网络结构，为App数据共享行为的自动化检测提供了新的解决方案。

Abstract

Mobile App have become an essential part of people's daily lives

but they also brought about security risks to data privacy. Some Apps share user data with third parties in the background or obtain user data from third parties to deliver personalized recommendations. Due to the stealthiness of this data sharing channel

it is difficult to be effectively tracked under the current regulatory system. In response to this issue

an intelligent mining solution was designed and implemented to automatically detect potential data sharing behaviors between Apps. The detection framework was constructed based on automated testing

which injects user preference data with keywords by simulating user behavior

and then collects screenshots of personalized recommendation interfaces. Information extraction and correlation analysis technologies based on AI models were introduced

using optical character recognition models

multimodal visual large models

and large language models to complete the intelligent extraction and understanding of text information and image content in App screenshots

and to make judgments on the correlation between keywords and image content descriptions. The injection of user preference data was performed on 30 Apps

resulting in a dataset of 8 700 screenshots

and yielding 1 466 pieces of evidence of data sharing. Among the 30 Apps

23 were found to provide data to third parties

and 29 were found to receive data from third parties and engage in personalized recommendations. A network structure of App data sharing behavior was constructed

providing a new solution for the automated detection of App data sharing behavior.

关键词

Keywords

references

中央网络安全和信息化委员会办公室 . APP违法违规收集使用个人信息专项治理报告（2019） [R ] . 2020 .

Office of the Central Cyberspace Affairs Commission . Report on the special governance of illegal and violative collection and use of personal information by Apps(2019) [R ] . 2020 .

The European Parliament and Council of the European Union . Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Directiverepealing 95/46/EC (General Data Protection Regulation) [EB ] . 2016 .

中国人大网 . 《中华人民共和国个人信息保护法》 [EB ] . 2021 .

The Website of the National People's Congress of China . The Personal Information Protection Law of the People's Republic of China [EB ] . 2021 .

Quermann N , Degeling M . Data sharing in mobile apps: user privacy expectations in Europe [C ] // Proceedings of the 2020 IEEE European Symposium on Security and Privacy Workshops (EuroSPW) . Piscataway : IEEE Press , 2020 : 107 - 119 .

Wang Z H , Li Z Y , Xue M H , et al . Exploring the eastern frontier: a first look at mobile app tracking in China [C ] // Passive and Active Measurement . Cham : Springer , 2020 : 314 - 328 .

Zang J , Dummit K , Graves J , et al . Who knows what about Me? a survey of behind the scenes personal data sharing to third parties by mobile apps [J ] . Technology Science , 2015 , 30 : 2 .1.

Jin H J , Liu M Y , Dodhia K , et al . Why are they collecting my data: inferring the purposes of network traffic in mobile apps [J ] . Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies , 2018 , 2 ( 4 ): 1 - 27 .

Binns R , Zhao J , Van Kleek M , et al . Measuring third-party tracker power across web and mobile [J ] . ACM Transactions on Internet Technology , 2018 , 18 ( 4 ): 1 - 22 .

Razaghpanah A , Nithyanand R , Vallina-Rodriguez N , et al . Apps, trackers, privacy, and regulators: a global study of the mobile tracking ecosystem [C ] // Proceedings 2018 Network and Distributed System Security Symposium . Internet Society , 2018 .

王竹 , 贺坤 , 王新宇 , 等 . Android设备中基于流量特征的隐私泄露评估方案 [J ] . 通信学报 , 2020 , 41 ( 2 ): 155 - 164 .

Wang Z , He K , Wang X Y , et al . Traffic characteristic based privacy leakage assessment scheme for Android device [J ] . Journal on Communications , 2020 , 41 ( 2 ): 155 - 164 .

Fan M , Yu L , Chen S , et al . An empirical evaluation of GDPR compliance violations in Android mHealth apps [C ] // Proceedings of the 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE) . Piscataway : IEEE Press , 2020 : 253 - 264 .

Guamán D S , Del Alamo J M , Caiza J C . GDPR compliance assessment for cross-border personal data transfers in Android apps [J ] . IEEE Access , 2021 , 9 : 15961 - 15982 .

李昕 , 唐鹏 , 张西珩 , 等 . 面向GDPR隐私政策合规性的智能化检测方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 6 ): 127 - 139 .

Li X , Tang P , Zhang X H , et al . GDPR-oriented intelligent checking method of privacy policies compliance [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 6 ): 127 - 139 .

张西珩 , 李昕 , 唐鹏 , 等 . 基于知识图谱的隐私政策合规性检测与分析 [J ] . 网络与信息安全学报 , 2024 , 10 ( 6 ): 151 - 163 .

Zhang X H , Li X , Tang P , et al . Privacy policy compliance detection and analysis based on knowledge graph [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 6 ): 151 - 163 .

Xiao J M , Chen S Z , He Q , et al . An Android application risk evaluation framework based on minimum permission set identification [J ] . Journal of Systems and Software , 2020 , 163 : 110533 .

Ren J J , Rao A , Lindorfer M , et al . ReCon: revealing and controlling PII leaks in mobile network traffic [C ] // Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services . New York : ACM , 2016 : 361 - 374 .

Enck W , Gilbert P , Han S , et al . TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones [J ] . ACM Transactions on Computer Systems , 2014 , 32 ( 2 ): 1 - 29 .

Liu Y , Liao L J , Song T . Static tainting extraction approach based on information flow graph for personally identifiable information [J ] . Science China Information Sciences , 2020 , 63 ( 3 ): 132104 .

王新宇 , 牛犇 , 李凤华 , 等 . APP隐私泄露风险评估与保护方案 [J ] . 通信学报 , 2019 , 40 ( 5 ): 13 - 23 .

Wang X Y , Niu B , Li F H , et al . Risk assessing and privacy-preserving scheme for privacy leakage in APP [J ] . Journal on Communications , 2019 , 40 ( 5 ): 13 - 23 .

Shuba A , Markopoulou A . NoMoATS: towards automatic detection of mobile tracking [J ] . Proceedings on Privacy Enhancing Technologies , 2020 , 2020( 2 ): 45 - 66 .

Gálvez R , Moonsamy V , Diaz C . Less is More: a privacy-respecting Android malware classifier using federated learning [J ] . Proceedings on Privacy Enhancing Technologies , 2021 , ( 4 ): 96 - 116 .

Arzt S , Rasthofer S , Fritz C , et al . FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps [J ] . ACM SIGPLAN Notices , 2014 , 49 ( 6 ): 259 - 269 .

Bakopoulou E , Shuba A , Markopoulou A . Exposures exposed: a measurement and user study to assess mobile data privacy in context [PP ] . arXiv Preprint , 2022 , arXiv: 2008.08973 .

Van Kleek M , Liccardi I , Binns R , et al . Better the devil you know: exposing the data sharing practices of smartphone apps [C ] // Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems . New York : ACM , 2017 : 5208 - 5220 .

Wu J R , Nan Y H , Xing L Y , et al . Leaking the privacy of groups and more: understanding privacy risks of cross-app content sharing in mobile ecosystem [C ] // Proceedings 2024 Network and Distributed System Security Symposium . Internet Society , 2024 .

韩震 , 石磊 , 赵彦霖 . 考虑不同使用场景的APP用户隐私交换行为 [J ] . 系统管理学报 , 2022 , 31 ( 2 ): 353 - 361 .

Han Z , Shi L , Zhao Y L . Privacy exchange behavior of APP Users’Considering different usage scenarios [J ] . Journal of Systems Management , 2022 , 31 ( 2 ): 353 - 361 .

广东省消委会消费维权网 . 广东省消委会发布“常见类型App非必要个人信息收集情况”调查结果，呼吁经营者依法规范收集使用消费者个人信息 [EB ] . 2021 .

Website for Consumer Rights Protection of Guangdong Province Consumer Council . The Consumer Council of Guangdong Province has released the results of a survey on the collection of non-essential personal information by common types of Apps, calling on operators to collect and use consumers' personal information in accordance with the law and in a standardized manner [EB ] . 2021 .

Li C X , Liu W W , Guo R Y , et al . PP-OCRv3: more attempts for the improvement of ultra lightweight OCR system [PP ] . arXiv Preprint , 2022 , arXiv: 2206- 01300 .

PaddlePaddle . PP-OCRv4技术报告 [EB ] . 2025 .

PaddlePaddle . PP-OCRv4 technical report [EB ] . 2025 .

Chen Z , Wu J N , Wang W H , et al . Intern VL: scaling up vision foundation models and aligning for generic visual-linguistic tasks [C ] // Proceedings of the 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2024 : 24185 - 24198 .

Du Z X , Qian Y J , Liu X , et al . GLM: general language model pretraining with autoregressive blank infilling [C ] // Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . Kerrville : Association for Computational Linguistics 2022 : 320 - 335 .

Zeng A H , Liu X , Du Z X , et al . GLM-130B: an open bilingual pre-trained model [C ] // Proceedings of the Eleventh International Conference on Learning Representations . Kigali : ICLR , 2023 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Bidirectional privacy authorization for large models based on private set intersection

Research on searchable encryption scheme based on enhanced PIR

Differential privacy protection method for localization of ADS-B message positioning data oriented to LBS

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Secure aggregation for semi-decentralized federated learning under heterogeneous data

Related Author

YANG Shuai

HAN Yiliang

WU Xuguang

FENG Haokang

WANG Yuanyuan

TANG Liang

MA Limin

YANG Hongyu

Related Institution

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

College of Cryptography Engineering, Engineering University of PAP

College of Computer Science，Beijing Information Science and Technology University

Beijing Academy of Educational Science

School of Computer Science and Technology, Jilin University

⁰