Journals
  Publication Years
  Keywords
Search within results Open Search
Please wait a minute...
For Selected: Toggle Thumbnails
Analysis of consistency between sensitive behavior and privacy policy of Android applications
Baoshan YANG, Zhi YANG, Xingyuan CHEN, Bing HAN, Xuehui DU
Journal of Computer Applications    2024, 44 (3): 788-796.   DOI: 10.11772/j.issn.1001-9081.2023030290
Abstract222)   HTML6)    PDF (1850KB)(110)       Save

The privacy policy document declares the privacy information that an application needs to obtain, but it cannot guarantee that it clearly and fully discloses the types of privacy information that the application obtains. Currently, there are still deficiencies in the analysis of the consistency between actual sensitive behaviors of applications and privacy policies. To address the above issues, a method for analyzing the consistency between sensitive behaviors and privacy policies of Android applications was proposed. In the privacy policy analysis stage, a Bi-GRU-CRF (Bi-directional Gated Recurrent Unit Conditional Random Field) neural network was used and the model was incrementally trained by adding a custom annotation library to extract key information from the privacy policy declaration. In the sensitive behavior analysis stage, IFDS (Interprocedural, Finite, Distributive, Subset) algorithm was optimized by classifying sensitive API (Application Programming Interface) calls, deleting already analyzed sensitive API calls from the input sensitive source list, and marking already extracted sensitive paths. It ensured that the analysis results of sensitive behaviors matched the language granularity of the privacy policy description, reduced the redundancy of the analysis results and improved the efficiency of analysis. In the consistency analysis stage, the semantic relationships between ontologies were classified into equivalence, subordination, and approximation relationships, and a formal model for consistency between sensitive behaviors and privacy policies was defined based on these relationships. The consistency situations between sensitive behaviors and privacy policies were classified into clear expression and ambiguous expression, and inconsistency situations were classified into omitted expression, incorrect expression, and ambiguous expression. Finally, based on the proposed semantic similarity-based consistency analysis algorithm, the consistency between sensitive behaviors and privacy policies was analyzed. Experimental results show that, by analyzing 928 applications, with the privacy policy analysis accuracy of 97.34%, 51.4% of Android applications are found to have inconsistencies between the actual sensitive behaviors and the privacy policy declaration.

Table and Figures | Reference | Related Articles | Metrics