一句话：提出 ATPChecker，自动检测 Android 第三方库的隐私政策合规性及其与宿主应用的数据共享披露情况。
论文关注移动应用中第三方库（TPL）的隐私合规问题。由于 TPL 隐私政策收集困难、二进制行为分析困难，且难以判断 TPL 功能与政策、宿主应用政策与数据共享之间的一致性，现有研究较少。作者提出自动化系统 ATPChecker，构建包含 458 个 TPL、247 份 TPL 隐私政策、187 个 TPL 二进制文件、641 个宿主应用及其隐私政策的数据集，通过分析字节码、自然语言处理隐私政策并实现专家系统来识别合规性。实验发现：23% 的 TPL 违反提供隐私政策的要求；超过 47% 的 TPL 未在政策中披露数据使用；超过 65% 的宿主应用与 TPL 共享用户数据，其中 65% 未披露与 TPL 的交互。
The privacy of personal information has received significant attention in mobile software. Although researchers have designed methods to identify the conflict between app behavior and privacy policies, little is known about the privacy compliance issues relevant to third-party libraries (TPLs). The regulators enacted articles to regulate the usage of personal information for TPLs (e.g., the CCPA requires businesses clearly notify consumers if they share consumers' data with third parties or not). However, it remains challenging to investigate the privacy compliance issues of TPLs due to three reasons: 1) Difficulties in collecting TPLs' privacy policies. In contrast to Android apps, which are distributed through markets like Google Play and must provide privacy policies, there is no unique platform for collecting privacy policies of TPLs. 2) Difficulties in analyzing TPL's user privacy access behaviors. TPLs are mainly provided in binary files, such as jar or aar, and their whole functionalities usually cannot be executed independently without host apps. 3) Difficulties in identifying consistency between TPL's functionalities and privacy policies, and host app's privacy policy and data sharing with TPLs. This requires analyzing not only the privacy policies of TPLs and host apps but also their functionalities. In this paper, we propose an automated system named ATPChecker to analyze whether Android TPLs comply with the privacy-related regulations. We construct a data set that contains a list of 458 TPLs, 247 TPL's privacy policies, 187 TPL's binary files and 641 host apps and their privacy policies. Then, we analyze the bytecode of TPLs and host apps, design natural language processing systems to analyze privacy policies, and implement an expert system to identify TPL usage-related regulation compliance. The experimental results show that 23% TPLs violate regulation requirements for providing privacy policies. Over 47% TPLs miss disclosing data usage in their privacy policies. Over 65% host apps share user data with TPLs while 65% of them miss disclosing interactions with TPLs. Our findings remind developers to be mindful of TPL usage when developing apps or writing privacy policies to avoid violating regulations,
@inproceedings{ZhaoZYZZLWL23,
title = {Demystifying Privacy Policy of Third-Party Libraries in Mobile Apps},
author = {Kaifa Zhao and Xian Zhan and Le Yu and Shiyao Zhou and Hao Zhou and Xiapu Luo and Haoyu Wang and Yepang Liu},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00137}
}