CN118332300A - Compliance detection method and system for privacy policy labels of mobile terminal application programs - Google Patents

Abstract

The invention belongs to the technical field of tag compliance detection, and provides a compliance detection method and a compliance detection system for privacy policy tags of mobile terminal application programs, wherein the method comprises the steps of firstly screening and traversing trees of acquired privacy policy links, removing invalid links and deleting invalid characters; then, extracting nouns in the privacy policy link text after screening processing, and establishing a database; according to a pre-trained large language model, carrying out label prediction; and finally, carrying out consistency judgment on the label obtained through prediction, the privacy label predefined in the service provider and the privacy label in actual operation. On the basis of realizing automatic and accurate prediction of the labels, the detection result is obtained after consistency judgment is carried out on the labels obtained through prediction, the privacy labels predefined in the service provider and the privacy labels in actual operation, so that the problem that the privacy policy is inconsistent with the information acquired by the application program in the use of the real world is solved.

Description

Compliance detection method and system for privacy policy labels of mobile applications

Technical Field

The present invention belongs to the technical field of compliance detection of labels, and in particular, relates to a compliance detection method and system for a privacy policy label of a mobile application.

Background technique

The analysis of the correctness of mobile application privacy policy labels is of great research significance; most of the analysis methods of mobile application privacy policies are limited to the segmentation of known text information.

The inventors found that there is still a large gap in the method of automatically obtaining and analyzing privacy policies and their labels when application information is limited; currently, most analysis methods for application privacy policies mainly focus on segmenting or labeling text; without making a comprehensive comparison between the privacy labels of application providers and the privacy labels generated by applications in real scenarios, resulting in inconsistencies between privacy policies and information collected by applications in real-world use, which brings security issues.

Summary of the invention

In order to solve the above problems, the present invention proposes a compliance detection method and system for privacy policy labels of mobile applications. Based on the realization of automatic and accurate prediction of labels, the present invention obtains detection results after consistency judgment is made among the predicted labels, the privacy labels predefined by the service provider, and the privacy labels during actual runtime, thereby solving the problem of inconsistency between the privacy policy and the information collected by the application in the real world.

In order to achieve the above object, the present invention is implemented through the following technical solutions:

In a first aspect, the present invention provides a compliance detection method for a privacy policy label of a mobile application, comprising:

Get a link to the Privacy Policy;

Screening the obtained privacy policy links to exclude invalid links; and traversing the privacy policy links after excluding invalid links to delete invalid characters;

Extract nouns from the privacy policy link text after screening and establish a database;

Perform label prediction based on the database and pre-trained large language model;

The predicted labels, the privacy labels predefined by the service provider, and the privacy labels during actual runtime are judged for consistency to obtain the detection results.

Furthermore, the privacy policy file of the page in the privacy policy link is retained as a text file; the text is read according to the hierarchical structure and the labels are divided layer by layer; the text information in each layer of labels is extracted, and invalid characters in the text information are deleted.

Furthermore, invalid characters include carriage returns, line feeds, indents, and non-conventional encoded characters.

Furthermore, a natural language processing toolkit is used to perform text preprocessing operations to verify whether the extracted nouns are valid nouns.

Furthermore, the privacy policy link text was cleaned to remove HTML tags and special characters, word segmentation, and stop words.

Furthermore, the large language model includes a multi-head self-attention mechanism, a feedforward neural network, layer normalization and residual connection; the multi-head self-attention mechanism focuses on information at different positions when processing an input sequence, and the feedforward neural network improves nonlinear modeling capabilities through an activation function; layer normalization and residual connection are introduced after each sublayer of the large language model.

In a second aspect, the present invention further provides a compliance detection system for a privacy policy label of a mobile application, comprising:

The data collection module is configured to: obtain the privacy policy link;

The preprocessing module is configured to: filter the acquired privacy policy links and exclude invalid links; and perform tree traversal on the privacy policy links after excluding invalid links and delete invalid characters;

The database establishment module is configured to: extract nouns from the privacy policy link text after screening and establish a database;

The tag prediction module is configured to: perform tag prediction based on the database and the pre-trained large language model;

The detection module is specifically configured to perform consistency judgment on the predicted labels, the privacy labels predefined by the service provider, and the privacy labels during actual runtime to obtain the detection results.

In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the compliance detection method for the privacy policy label of a mobile application described in the first aspect.

In a fourth aspect, the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein when the processor executes the program, the steps of the compliance detection method for the privacy policy label of the mobile application described in the first aspect are implemented.

In a fifth aspect, the present invention further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the compliance detection method for the privacy policy label of a mobile application described in the first aspect.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention first screens the acquired privacy policy links to exclude invalid links; and performs tree traversal on the privacy policy links after excluding invalid links to delete invalid characters; then, extracts nouns in the privacy policy link text after screening and establishes a database; performs label prediction based on the database and a pre-trained large language model; finally, performs consistency judgment on the predicted labels, the privacy labels predefined in the service provider, and the privacy labels during actual operation to obtain the test results. On the basis of achieving accurate automatic label prediction, the privacy labels in the application provider and the privacy labels generated in the real scenario are considered. After consistency judgment is performed on the predicted labels, the privacy labels predefined in the service provider, and the privacy labels during actual operation, the test results are obtained, which solves the problem of inconsistency between the privacy policy and the information collected by the application in the real world.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings in the specification that constitute a part of this embodiment are used to provide a further understanding of this embodiment. The schematic embodiments of this embodiment and their descriptions are used to explain this embodiment and do not constitute improper limitations on this embodiment.

FIG1 is a flow chart of a method according to Embodiment 1 of the present invention;

FIG. 2 is a schematic diagram of a system flow chart of Embodiment 1 of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

Embodiment 1:

Currently, most of the analysis methods for mobile application privacy policies are limited to the segmentation of known text information, while there is still a large gap in the analysis methods for automatically obtaining and analyzing privacy policies and their labels when application information is limited.

The analysis of the correctness of application privacy policy labels is of great research significance. Mainstream application providers now provide pre-generated solutions. For example, Google Play and App Store allow developers to attach privacy policy labels themselves. These labels can clearly tell users what information the application needs to collect from users, but some studies in recent years have shown that there is a problem of inconsistency between privacy policies and the information collected by applications in real-world use, and there are many security issues.

In view of the above problems, this embodiment provides a compliance detection method for a privacy policy label of a mobile application, including:

Get a link to the Privacy Policy;

Screening the obtained privacy policy links to exclude invalid links; and traversing the privacy policy links after excluding invalid links to delete invalid characters;

Extract nouns from the privacy policy link text after screening and establish a database;

Perform label prediction based on the database and pre-trained large language model;

The predicted labels, the privacy labels predefined by the service provider, and the privacy labels during actual runtime are judged for consistency to obtain the detection results.

Specifically, the obtained privacy policy links are screened and the tree is traversed. Based on the automatic and accurate prediction of labels using a large language model, the privacy labels in the application provider and the privacy labels generated in real scenarios are considered. The predicted labels, the predefined privacy labels in the service provider, and the privacy labels at actual runtime are judged for consistency to obtain the test results, which solves the problem of inconsistency between the privacy policy and the information collected by the application in the real world.

In this embodiment, for the obtained privacy policy link, considering the diversity of page structure, directly accessing the page to extract text will synchronously collect multiple unnecessary separator fields and JavaScript scripts. JavaScript is a lightweight, interpreted or just-in-time compiled programming language with function priority. Therefore, when processing the privacy policy link, this embodiment first performs link screening and preprocessing to exclude invalid links and ensure that only content related to the privacy policy is processed; then, HTML parsing and DOM tree traversal are performed to understand the page structure, and NLP technology is used to extract and clean up text data, including removing HTML tags and redundant blank characters; finally, the verified results are stored in the database for further analysis.

In this embodiment, for DOM tree traversal, first, the privacy policy file of the page is retained as a text file. Then, the local privacy policy text is read; read according to the hierarchical structure, such as the html/div/ul/li/p tags of the page are divided layer by layer; extract the text information in each layer of tags, and delete invalid characters in the text information, such as carriage returns, line feeds, indents and unconventional encoding characters; optionally, use the Replace function in Python to remove invalid characters in the text. The Replace function is one of the built-in methods of the Python string object, which is used to replace a specified substring in a string with a new substring. It can replace invalid characters in the text with empty, thereby achieving the effect of removing invalid characters.

In this embodiment, the data is then cleaned using a natural language processing method. Optionally, in this embodiment, a natural language processing toolkit (Natural Language Toolkit, NLTK) is used to perform text preprocessing operations. Specifically, first, the NLTK package and its WordNet module are loaded. The WordNet module is used to verify whether the extracted nouns are valid nouns. The WordNet module is an English vocabulary database that organizes the relationships between English words, including their synonyms, antonyms, nouns, and hyponyms, etc. The nouns contained in the text can be extracted by using the is_noun function therein; then, these nouns are saved in the database for further analysis.

In this embodiment, when predicting labels, for each noun contained in the privacy policy stored in the database, it is input into the large language model for label prediction. Among them, the large language model includes but is not limited to ChatGPT, Wenxin Yiyan, Tongyi Qianwen, etc. In this embodiment, a fixed Prompt project is designed for these general large language models to ask questions; for example, ChatGPT, the full name of ChatGPT is Chat Generative Pre-TrainedTransformer, which adopts the Transformer structure, which includes key components such as multi-head self-attention mechanism, feedforward neural network, layer normalization and residual connection. The multi-head self-attention mechanism allows the model to pay attention to information at different positions when processing the input sequence, and the feedforward neural network improves the nonlinear modeling ability through the activation function; in order to maintain the stability of training and gradient flow, layer normalization and residual connection are introduced after each sublayer, and position encoding is used to save the order information of the input sequence. In large-scale pre-training, through self-supervised learning, the model can learn the statistical structure and pattern of language from a wide range of corpora. Its advantage is that it has billions of parameters. Through large-scale pre-training, it has learned a wide range of corpora, can generate natural and fluent text, and performs well in a variety of natural language processing tasks. In privacy label prediction, the large language model can deeply understand a large amount of text data, enabling it to identify and understand privacy-related semantics and context, thereby effectively predicting the privacy content in the text. For the application scenario, the question statement in this embodiment is set as: As a privacy policy analyst, here is what you know about the labels (<DefinedLabel A>, <Defined Label B>, ...). Next, I will give you a list of privacy policy words (<DB Label A>, <DB Label B>, ...). Can you please tell me which tags these lists involve? Reply format [<label>, <label>, ...]. Among them, <Defined Label> corresponds to all privacy label information collected in advance from Google Play and App Store, and <DB Label> corresponds to the noun information extracted from the privacy policy stored in the database. The large language model will return the privacy labels contained in each privacy policy noun in the format of a list.

The method in this embodiment, first of all, realizes an automated process, reduces user manual operations and improves efficiency through predefined scripts and automatic configuration. Secondly, it widely collects detailed information of APP data in major application markets, including privacy policy links, labels and application installation packages, to ensure the comprehensiveness of data; at the same time, it uses deep learning models to predict labels to improve accuracy; in addition, through automated testing and traffic capture, the application is installed in the simulator and data traffic is captured, and the application behavior is comprehensively analyzed to help identify potential privacy issues; through rule matching and consistency checks, the consistency of the privacy policy is ensured, and the accuracy and security of privacy labels are improved. Finally, the user-friendly interface and report output enable users to easily use the system, clearly understand the privacy policy compliance and potential risks, and provide a comprehensive solution for data privacy protection. The specific steps of this embodiment are:

S1. Run the predefined script file to automatically configure the required dependency environment.

S1.1. Optionally, the user runs the PreChecker.exe file, which can be used to detect the operating system information and hardware configuration used by the user and provide a virtual machine installation address that meets the operating conditions.

S1.2. Optionally, the user installs the Android virtual machine by himself. Check whether the virtual machine configuration is correct, automatically configure the Python environment and install the required dependent code libraries, then download the deep learning model files required by the privacy policy label analysis system. After the configuration is completed, close the application according to the prompts and restart the machine.

S2. Read the APK (Android application package) information input by the user and collect detailed data information of APP data from major application markets.

Optionally, the PolicyLabel.exe application is launched, the user enters the name of the application package to be analyzed, and then selects the application service provider entrance according to the prompts, and then starts the application information collection process.

S3. Extract the privacy policy label, privacy policy link, and application installation package predefined in the application service provider from the collected data information.

Optionally, through step S2, the privacy policy link, label and APK of the application can be obtained, and then the privacy label is stored in the database for final comparative analysis.

S4. Access the privacy policy link, extract the privacy policy text information, pre-process the text content, input it into the system's pre-trained deep learning model for label prediction, and generate label prediction results; the deep learning model can optionally be a large language model.

S4.1. With respect to the privacy policy link, considering that each APK has a different page structure, this embodiment predefines crawling rules. For example, with respect to a plain text page, all text within the <p> tags of the page is collected. Through this rule, the privacy policy text information in the vast majority of current privacy policy links can be collected.

S4.2. Preprocess the collected privacy policy text. The preprocessing process of the privacy policy text includes cleaning the text, removing HTML tags and special characters, word segmentation, removing stop words, stemming or word form restoration, etc., building a vocabulary, encoding the text into digital representation, padding or truncating the text to ensure the same dimension, and providing legal input for the subsequent deep learning model privacy label prediction.

S4.3. Input the preprocessed text into the system’s built-in large language model for label prediction.

S5. Install the application in the simulator, perform automated testing on the application, capture the data traffic generated therein, segment the plaintext data of the traffic, and generate a privacy label.

S5.1. Install the APK file into the virtual machine by calling the command adb install path/to/your-app.apk, and then call adb forward tcp:8080tcp:8080 to connect the mitmproxy port 8080 on the Android device to the computer's port 8080. The purpose is to associate the predefined mitmproxy port 8080 with the device. Finally, call adb shell monkey-pyour.package.name-v{seconds} to test the application and capture the network traffic generated.

S5.2. For the pcap file exported by mitmproxy, this embodiment extracts data, then splits the data, and outputs the privacy label corresponding to each data field.

S6. Perform rule matching on the predefined privacy label in step S3, the prediction result in step S4, and the privacy label at runtime in step S5 to determine the consistency of their privacy policies and generate a privacy label security report.

Specifically, the privacy label stored in step S3, the predicted label in step S4.3, and the extracted label in step S5.2 are compared, and the comparison result is written into a predefined template to obtain a privacy label security report.

Optionally, the labels in step S3 are predefined, such as [contacts, calendars, photos]; the labels predicted in step S4.3 are similar, such as [calendar, photos, phone numbers, contacts, voice]. The predefined labels and the predicted labels are distinguished by taking a complement; for example, the labels in step S3 are [contacts, calendars, photos], and the labels in step S4.3 are [calendar, photos, phone numbers, contacts, voice], the intersection is [contacts, calendars, photos], and the complement is [phone numbers, voice].

Through the method provided in this embodiment, the user only needs to provide the package name of the application to extract the privacy policy and privacy label of the application, and analyze whether the privacy label is correctly marked. This helps mobile security auditors to make judgments on the compliance of the privacy policy, and also helps customers of the application to more clearly understand the information that the application needs to collect.

Embodiment 2:

This embodiment provides a compliance detection system for a privacy policy label of a mobile application, including:

The data collection module is configured to: obtain the privacy policy link;

The preprocessing module is configured to: filter the acquired privacy policy links and exclude invalid links; and perform tree traversal on the privacy policy links after excluding invalid links and delete invalid characters;

The database establishment module is configured to: extract nouns from the privacy policy link text after screening and establish a database;

The tag prediction module is configured to: perform tag prediction based on the database and the pre-trained large language model;

The detection module is specifically configured to perform consistency judgment on the predicted labels, the privacy labels predefined by the service provider, and the privacy labels during actual runtime to obtain the detection results.

The working method of the system is the same as the compliance detection method of the privacy policy label of the mobile application in Example 1, and will not be repeated here.

Embodiment 3:

This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the compliance detection method for the privacy policy label of the mobile application described in Example 1 are implemented.

Embodiment 4:

This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the program, the steps of the compliance detection method for the privacy policy label of the mobile application described in Example 1 are implemented.

Embodiment 5:

This embodiment provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the compliance detection method for the privacy policy label of the mobile application described in Example 1 are implemented.

The above description is only a preferred embodiment of the present embodiment and is not intended to limit the present embodiment. For those skilled in the art, the present embodiment may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present embodiment shall be included in the protection scope of the present embodiment.

Claims (10)

1. The compliance detection method of the privacy policy tag of the mobile terminal application program is characterized by comprising the following steps:

Acquiring a privacy policy link;

Screening the obtained privacy policy links and removing invalid links; performing tree traversal on the privacy policy links excluding invalid connections, and deleting invalid characters;

Extracting nouns in the privacy policy link text after screening processing, and establishing a database;

According to the database and a pre-trained large language model, carrying out label prediction;

and carrying out consistency judgment on the label obtained by prediction, the privacy label predefined in the service provider and the privacy label in actual operation to obtain a detection result.

2. The method for compliance detection of a privacy policy tag of a mobile terminal application of claim 1, wherein a privacy policy file of a page in a privacy policy link is maintained as a text file; reading the text according to the hierarchical structure and dividing the labels layer by layer; extracting text information in each layer of labels, and deleting invalid characters in the text information.

3. The method for compliance detection of a privacy policy tag of a mobile terminal application of claim 1, wherein the invalid characters comprise carriage returns, line feeds, retractors and non-regular coded characters.

4. The method for compliance detection of privacy policy tags for mobile end applications of claim 1, wherein text preprocessing operations are performed using a natural language processing tool package to verify whether the extracted noun belongs to a valid noun.

5. The method for compliance detection of privacy policy tags for mobile end applications of claim 1, wherein the privacy policy link text is cleaned to remove HTML tags and special characters, segmentation and stop words.

6. The method for compliance detection of a mobile-end application privacy policy tag of claim 1, wherein the large language model comprises a multi-headed self-attention mechanism, a feed-forward neural network, layer normalization, and residual connection; the multi-head self-attention mechanism focuses on information of different positions when processing an input sequence, and the feedforward neural network improves nonlinear modeling capacity through an activation function; layer normalization and residual connection are introduced after each sub-layer of the large language model.

7. A compliance detection system for a privacy policy tag of a mobile terminal application, comprising:

The data acquisition module is respectively configured to: acquiring a privacy policy link;

The preprocessing module is respectively configured to: screening the obtained privacy policy links and removing invalid links; performing tree traversal on the privacy policy links excluding invalid connections, and deleting invalid characters;

the database establishment module is respectively configured to: extracting nouns in the privacy policy link text after screening processing, and establishing a database;

the label prediction module is configured to: according to the database and a pre-trained large language model, carrying out label prediction;

the detection module is respectively configured to: and carrying out consistency judgment on the label obtained by prediction, the privacy label predefined in the service provider and the privacy label in actual operation to obtain a detection result.

8. A computer readable storage medium having stored thereon a computer program, which when executed by a processor implements the steps of a method of compliance detection of a privacy policy tag of a mobile end application as claimed in any of claims 1 to 6.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor implements the steps of the mobile-end application privacy policy tag compliance detection method of any of claims 1-6 when the program is executed by the processor.

10. A computer program product comprising a computer program which, when executed by a processor, implements the steps of the compliance detection method of a mobile end application privacy policy tag as claimed in any one of claims 1 to 6.