“最小必要”原则视角检测移动应用程序的隐私合规性

余佩厚; 徐天辰; 孙雯倩; 陈云芳; 于乐; 张伟

doi:10.11959/j.issn.2096-109x.2024084

您当前的位置：

首页 >

文章列表页 >

“最小必要”原则视角检测移动应用程序的隐私合规性

学术论文 | 更新时间：2025-02-06

- “最小必要”原则视角检测移动应用程序的隐私合规性
- Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle
- 网络与信息安全学报 2024年10卷第6期页码：109-122
- 作者机构：
  
  南京邮电大学计算机学院，江苏南京 210023
- 作者简介：
  
  [ "余佩厚（2000- ），男，安徽滁州人，南京邮电大学硕士生，主要研究方向为隐私合规。" ]
  [ "徐天辰（2000- ），男，江苏盐城人，南京邮电大学硕士生，主要研究方向为隐私合规、自然语言处理。" ]
  [ "孙雯倩（2000- ），女，江苏连云港人，南京邮电大学硕士生，主要研究方向为隐私合规。" ]
  [ "陈云芳（1976- ），男，江苏镇江人，博士，南京邮电大学副教授，主要研究方向为人工智能算法、特定应用领域的功能分析、使用智能系统的应用开发。" ]
  [ "于乐（1990- ），男，江苏扬州人，博士，南京邮电大学教授、博士生导师，主要研究方向为移动应用安全与隐私合规检测、物联网和车联网协议逆向。" ]
  [ "张伟（1973- ），男，江苏泰兴人，博士，南京邮电大学教授、博士生导师，主要研究方向为智能感知与认知、隐私保护与人工智能安全。" ]
- 基金信息：
  
  国家自然科学基金(62202406)
- DOI：10.11959/j.issn.2096-109x.2024084
  中图分类号： TP309.2
- 收稿：2024-05-23，
  
  修回：2024-10-10，
  
  纸质出版：2024-12-25
- 稿件说明：
移动端阅览
余佩厚, 徐天辰, 孙雯倩, 等. "最小必要"原则视角检测移动应用程序的隐私合规性[J]. 网络与信息安全学报, 2024, 10(6): 109-122.

YU P H, XU T C, SUN W Q, et al. Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 109-122.
余佩厚, 徐天辰, 孙雯倩, 等. "最小必要"原则视角检测移动应用程序的隐私合规性[J]. 网络与信息安全学报, 2024, 10(6): 109-122. DOI： 10.11959/j.issn.2096-109x.2024084.

YU P H, XU T C, SUN W Q, et al. Detecting privacy compliance of mobile applications from the perspective of the "minimum necessary" principle[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 109-122. DOI： 10.11959/j.issn.2096-109x.2024084.

摘要

为了满足法律法规对个人数据隐私保护的要求，移动应用程序开发商常以隐私政策的形式向用户披露其对用户个人数据的收集行为。如何精准理解这些冗长且复杂的法律文件，研究人员提出了一系列基于自然语言处理（natural language processing

NLP）的方法分析隐私政策文本并进行合规性检测。然而，目前的研究大多针对的是“透明、公开、合法”等原则，对“最小必要”原则进行检测的研究尚存在空白。为此，提出了一种基于数据收集的“最小必要”原则视角对应用程序进行自动化合规性检测方法MNPD（minimum necessary principle detection）。通过多标签文本分类模型对待测App进行服务类型上的分类，确定不同类别App的“最小必要”信息范围；构造提示词指导大语言模型从隐私政策文本中提取出该App在基本业务功能模式下的数据

收集行为，转化为隐私声明三元组并进行规范化；最后，通过合规性检测模型对待测App进行文本表述上的一致性检测以及“最小必要”原则检测。实验结果表明，所提方法对华为应用市场获取的101个“在线影音类”App自动化分析结果达到了86.20%的

1分数。

Abstract

To comply with legal requirements for personal data privacy protection

mobile App developers typically disclose their data collection practices to users through privacy policies. Researchers have proposed various methods using natural language processing (NLP) techniques to analyze privacy policy texts and perform compliance checks. However

most existing studies focus on principles like transparency

openness

and legality

leaving a gap in the evaluation of the ‘minimum necessary’ principle. For this purpose

a framework called MNPD (minimum necessary principle detection) was proposed for automated compliance checking of applications from the perspective of the ‘minimum necessary’ principle. Initially

a multi-label text classification model categorized the target App based on its service type to determine the range of ‘minimum necessary information’ for different App categories. Then

prompt words were constructed to guide the large language model in extracting data collection practices of the App under its basic business functionality mode

transforming them into privacy statement triples and standardizing them. Finally

the compliance checking model conducted consistency checks on the text representation of the target App and evaluated its adherence to the ‘minimum necessary’ principle. The experimental results show that the proposed method achieves 86.20% F1 score in the automated analysis of 101 ‘Online Audio-Visual’ Apps obtained from Huawei’s application market.

关键词

Keywords

references

中华人民共和国工业和信息化部 . 2023年前三季度互联网和相关服务业运行情况 [EB ] . 2023 .

Ministry of Industry and Information Technology of the People's Republic of China . Operation status of the internet and related services in the first three quarters of 2023 [EB ] . 2023 .

VOIGT P , VON DEM BUSSCHE A . The EU general data protection regulation (GDPR) A Practical Guide [M ] . Berlin : Springer International Publiging 2017 , 10 ( 3152676 ): 10 .

GOLDMAN E . An introduction to the California consumer privacy act (CCPA) [N ] . Santa Clara Univ. Legal Studies Research Paper , 2020 .

中华人民共和国个人信息保护法 [J ] . 中华人民共和国全国人民代表大会常务委员会公报 , 2021 , ( 6 ): 1117 - 1125 .

Personal Information protection law of the People's Republic of China [J ] . Gazette of the Standing Committee of the National People's Congress of the People's Republic of China , 2021 , ( 6 ): 1117 - 1125 .

国家市场监督管理总局 . 信息安全技术移动互联网应用程序(App)收集个人信息基本要求 : GB/T 41391-2022 [S ] . 北京 : 中国标准出版社 , 2022 .

State Administration for Market Regulation . Information security technology-basic requirements for collecting of personal information in mobile Internet applications : GB/T 41391-2022 [S ] . Beijing : Standards Press of China , 2022 .

ANDOW B , MAHMUD S Y , WANG W , et al . PolicyLint: investigating internal privacy policy contradictions on google play [C ] // 28th USENIX Security Symposium (USENIX Security 19). 2019 : 585 - 602 .

BUI D , YAO Y , SHIN K G , et al . Consistency analysis of data-usage purposes in mobile Apps [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2021 : 2824 - 2843 .

AMOS R , ACAR G , LUCHERINI E , et al . Privacy policies over time: Curation and analysis of a million-document dataset [C ] // Proceedings of the Web Conference 2021 . 2021 : 2165 - 2176 .

AHMAD W U , CHI J , LE T , et al . Intent classification and slot filling for privacy policies [J ] . arXiv preprint arXiv: 2101.00123 , 2021 .

BUI D , SHIN K G , CHOI J M , et al . Automated extraction and presentation of data practices in privacy policies [J ] . Proc Priv Enhancing Technol , 2021 , 2 : 88 - 110 .

BROWN T , MANN B , RYDER N , et al . Language models are few-shot learners [J ] . Advances in Neural Information Processing Systems , 2020 , 33 : 1877 - 1901 .

CHOWDHERY A , NARANG S , DEVLIN J , et al . Palm: scaling language modeling with pathways [J ] . arXiv Preprint arXiv: 2204.02311 , 2022 .

OpenAI . GPT-4 technical report [R ] . 2023 .

WILSON S , SCHAUB F , RAMANATH R , et al . Crowdsourcing annotations for websites' privacy policies: can it really work [C ] // Proceedings of the 25th International Conference on World Wide Web . 2016 : 133 - 143 .

李昕 , 唐鹏 , 张西珩 , 等 . 面向GDPR隐私政策合规性的智能化检测方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 6 ): 127 - 139 .

LI X , TANG P , ZHANG X H , et al . GDPR-oriented intelligent checking method of privacy policies compliance [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 6 ): 127 - 139 .

LIU F , RAMANATH R , SADEH N , et al . A step towards usable privacy policy: automatic alignment of privacy statements [C ] // Proceedings of COLING 2014 , the 25th International Conference on Computational Linguistics : Technical Papers . 2014 : 884 - 894 .

PEDDINTI S T , BILOGREVIC I , TAFT N , et al . Reducing permission requests in mobile Apps [C ] // Proceedings of the Internet Measurement Conference . 2019 : 259 - 266 .

JANA S , ERLINGSSON Ú , ION I . Apples and oranges: detecting least-privilege violators with peer group analysis [J ] . arXiv Preprint arXiv: 1510.07308 , 2015 .

ZHOU L , WEI C , ZHU T , et al . {POLICYCOMP}: counterpart comparison of privacy policies uncovers overbroad personal data collection practices [C ] // 32nd USENIX Security Symposium (USENIX Security 23). 2023 : 1073 - 1090 .

SHANAHAN M , MCDONELL K , REYNOLDS L . Role play with large language models [J ] . Nature , 2023 : 1 - 6 .

LOGAN IV R L , BALAŽEVIĆ I , WALLACE E , et al . Cutting down on prompts and parameters: simple few-shot learning with language models [J ] . arXiv Preprint arXiv: 2106.13353 , 2021 .

WEI J , WANG X , SCHUURMANS D , et al . Chain-of-thought prompting elicits reasoning in large language models [J ] . Advances in Neural Information Processing Systems , 2022 , 35 : 24824 - 24837 .

TANG C , LIU Z , MA C , et al . PolicyGPT: automated analysis of privacy policies with large language models [J ] . arXiv preprint arXiv: 2309.10238 , 2023 .

WILSON S , SCHAUB F , DARA A A , et al . The creation and analysis of a website privacy policy corpus [C ] // Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics . 2016 : 1330 - 1340 .

LIU S , ZHAO B , GUO R , et al . Have you been properly notified? automatic compliance analysis of privacy policy text with GDPR article 13 [C ] // Proceedings of the Web Conference 2021 . 2021 : 2154 - 2164 .

SUN Y , WANG S H , LI Y , et al . ERNIE: enhanced representation through knowledge integration [J ] . arXiv Preprint arXiv:1904. 09223 , 2019 .

KOJIMA T , GU S S , REID M , et al . Large language models are zero-shot reasoners [J ] . Advances in Neural Information Processing Systems , 2022 , 35 : 22199 - 22213 .

XU L , HU H , ZHANG X , et al . CLUE: a Chinese language understanding evaluation benchmark [J ] . arXiv Preprint arXiv: 2004.05986 , 2020 .

ZHOU D , SCHÄRLI N , HOU L , et al . Least-to-most prompting enables complex reasoning in large language models [J ] . arXiv Preprint arXiv: 2205.10625 , 2022 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

AutoVulnFix: 大语言模型驱动的智能搜索自适应漏洞修复系统

基于隐私集合求交的大模型双向隐私授权

mmDefender: 基于多模态多语言对抗训练的大语言模型增强方法

物联网设备固件自动化漏洞挖掘技术研究综述

基于指令与描述的文本数据安全业务属性生成机制