一句话：揭示 VPA 应用可能通过过度隐私声明掩盖数据收集，呼吁审计声明与真实需求的一致性。
虚拟个人助理（VPA）服务包含大量第三方应用，用于扩展功能。已有工作会审查这些应用的数据收集行为是否与其声明的隐私政策一致。然而，用户安装时通常忽略隐私政策，这一现实被不诚实的开发者利用：他们可以嵌入过度的数据收集声明，从而在合规审计中掩盖实际的数据收集行为。该论文由此提出“你的请求是否是你的真实需求”这一问题，关注 VPA 应用中过度数据收集的检查，强调需要识别声明与实际需求或行为之间的偏差。摘要主要阐述问题动机与审计盲点，未具体说明所采用的技术方法或实验评估结果。
Virtual personal assistants (VPA) services encompass a large number of third-party applications (or apps) to enrich their functionalities. These apps have been well examined to scrutinize their data collection behaviors against their declared privacy policies. Nonetheless, it is often overlooked that most users tend to ignore privacy policies at the installation time. Dishonest developers thus can exploit this situation by embedding excessive declarations to cover their data collection behaviors during compliance auditing.
@inproceedings{paperbot11467,
title = {Are Your Requests Your True Needs? Checking Excessive Data Collection in VPA App},
author = {Fuman Xie and Chuan Yan and Mark Huasong Meng and Shaoming Teng and Yanjun Zhang and Guangdong Bai},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639107}
}