一句话：提出 PP-CSA，用本地差分隐私扰动软件调用栈，在 Java/Android 程序上兼顾效用、隐私与效率。
软件调用栈分析（CSA）被广泛用于性能优化、缺陷发现与性能剖析，但如今软件多部署在手机、智能手表等用户侧设备，采集的调用栈可能包含健康、位置等隐私敏感信息，泄露给第三方会引发歧视、定向广告等问题。本文提出 PP-CSA：一个可实际部署的隐私保护调用栈分析框架，以本地差分隐私（LDP）作为形式化隐私保证，在客户端对采集到的调用栈进行扰动。为让 LDP 真正适用于调用栈这一结构化数据，作者设计了编码器-解码器方案以正确施加 LDP，并在客户端与服务端引入多项优化以大幅提升效率。在真实 Java 与 Android 程序上的评估表明，该流水线在保持高实用性与隐私保证的同时具备高运行效率；实现已开源以保证结果可复现。
Software call stack is a sequence of function calls that are executed during the runtime of a software program. Software call stack analysis (CSA) is widely used in software engineering to analyze the runtime behavior of software, which can be used to optimize the software performance, identify bugs, and profile the software. Despite the benefits of CSA, it has recently come under scrutiny due to concerns about privacy. To date, software is often deployed at user-side devices like mobile phones and smart watches. The collected call stacks may thus contain privacy-sensitive information, such as healthy information or locations, depending on the software functionality. Leaking such information to third parties may cause serious privacy concerns such as discrimination and targeted advertisement. This paper presents PP-CSA, a practical and privacy-preserving CSA framework that can be deployed in real-world scenarios. Our framework leverages local differential privacy (LDP) as a principled privacy guarantee, to mutate the collected call stacks and protect the privacy of individual users. Furthermore, we propose several key design principles and optimizations in the technical pipeline of PP-CSA, including an encoder-decoder scheme to properly enforce LDP over software call stacks, and several client/server-side optimizations to largely improve the efficiency of PP-CSA. Our evaluation over real-world Java and Android programs shows that our privacy-preserving CSA pipeline can achieve high utility and privacy guarantees while maintaining high efficiency. We have released our implementation of PP-CSA as an open-source project at https://github.com/wangzhaoyu07/PP-CSA for results reproducibility. We will provide more detailed documents to support and the usage and extension of the community.
@article{paperbot2572,
title = {PP-CSA: Practical Privacy-Preserving Software Call Stack Analysis},
author = {Zhaoyu Wang and Pingchuan Ma and Huaijin Wang and Shuai Wang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {OOPSLA1},
year = {2024},
doi = {10.1145/3649856}
}