安卓应用隐私合规检测方法研究

Research on detection of Android application privacy compliance

近年来,移动应用超范围收集用户隐私信息,强制索取敏感权限等现象屡见不鲜。业界现有的隐私合规检测产品因缺乏对隐私政策的分析从而产生较高的误报率和漏报率。针对国内现行合规要求,设计并实现了一套大规模的半自动化合规检测框架。通过对现有应用市场中1941款应用进行实证评估,检测到52款典型违法违规移动应用。实验结果表明,该方法实用性强,拓展性高,具有广泛的应用前景。

In recent years,it is common for mobile applications to collect user privacy information in excess of the scope and abuse sensitive permissions.The existing privacy compliance detection products in the industry lack the analysis of privacy policies,resulting in high false positive and false negative.This study designs and implements a large-scale semi-automated compliance detection framework to address the current compliance requirements in China.The system extracts permission phrases through automated analysis of privacy policies and identifies sensitive permission calls through hybrid program analysis,ultimately achieving consistent compliance detection of privacy policies and permission calls.The empirical evaluation of 1941 applications in the existing application market detects 52 typical illegal and non-compliant mobile applications.The experimental results show that the method is practical and highly scalable,and has a wide application prospect.