论文标题
关于Android应用中隐私政策的（联合国）可靠性
On the (Un)Reliability of Privacy Policies in Android Apps
论文作者
论文摘要
在移动社区中，访问有关Android的隐私敏感信息是一个日益关注的问题。尽管Google Play最近推出了一些隐私准则，但仍然是一个开放的问题，可以验证应用程序是否真的符合此类规则。为了这个目的，在本文中，我们讨论了一种基于静态分析，动态分析和机器学习技术的富有成果的组合的新方法，该方法允许评估这种合规性。更详细地，我们的方法学检查每个应用程序是否）包含符合Google Play隐私指南的隐私策略，ii）仅在用户接受策略后才访问对隐私敏感的信息。此外，该方法还允许检查Apps W.R.T.中嵌入的第三方库的合规性。相同的隐私准则。我们在3PDroid的工具中实现了方法，并对Google Play商店中的一系列最新且最容易销售的Android应用程序进行了评估。实验结果表明，超过95％的应用程序访问用户对隐私敏感的信息，但仅符合它们的子集（约1％）完全符合Google Play Play隐私准则。
Access to privacy-sensitive information on Android is a growing concern in the mobile community. Albeit Google Play recently introduced some privacy guidelines, it is still an open problem to soundly verify whether apps actually comply with such rules. To this aim, in this paper, we discuss a novel methodology based on a fruitful combination of static analysis, dynamic analysis, and machine learning techniques, which allows assessing such compliance. More in detail, our methodology checks whether each app i) contains a privacy policy that complies with the Google Play privacy guidelines, and ii) accesses privacy-sensitive information only upon the acceptance of the policy by the user. Furthermore, the methodology also allows checking the compliance of third-party libraries embedded in the apps w.r.t. the same privacy guidelines. We implemented our methodology in a tool, 3PDroid, and we carried out an assessment on a set of recent and most-downloaded Android apps in the Google Play Store. Experimental results suggest that more than 95% of apps access user's privacy-sensitive information, but just a negligible subset of them (around 1%) fully complies with the Google Play privacy guidelines.
