一句话：首个系统研究 VPA 应用隐私政策合规性，提出 Skipper 工具结合 NLP 与黑盒测试检测 Amazon Alexa 技能的违规行为。
虚拟个人助理（VPA）应用（如 Amazon Alexa 技能）附带隐私政策文档说明数据处理方式，但这些文档冗长复杂，开发者可能有意或无意地不遵守。本文首次系统研究 VPA 应用的隐私政策合规问题，提出 Skipper 工具：利用自然语言处理与机器学习技术分析隐私政策文档，自动提取技能声明的隐私画像；同时通过黑盒测试推导技能实际的行为隐私画像，并将两者进行对比以发现不合规。作者对 Alexa 商店中所有技能进行了大规模分析，发现大量技能存在隐私政策不合规问题。
A large number of functionality-rich and easily accessible applications have become popular among various virtual personal assistant (VPA) services such as Amazon Alexa. VPA applications (or VPA apps for short) are accompanied by a privacy policy document that informs users of their data handling practices. These documents are usually lengthy and complex for users to comprehend, and developers may intentionally or unintentionally fail to comply with them. In this work, we conduct the first systematic study on the privacy policy compliance issue of VPA apps. We develop Skipper, which targets Amazon Alexa skills. It automatically depicts the skill into the declared privacy profile by analyzing their privacy policy documents with Natural Language Processing (NLP) and machine learning techniques, and derives the behavioral privacy profile of the skill through a black-box testing. We conduct a large-scale analysis on all skills listed on Alexa store, and find that a large number of skills suffer from the privacy policy noncompliance issues.
@inproceedings{paperbot7228,
title = {Scrutinizing Privacy Policy Compliance of Virtual Personal Assistant Apps},
author = {Fuman Xie and Yanjun Zhang and Chuan Yan and Suwan Li and Lei Bu and Kai Chen and Zi Huang and Guangdong Bai},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3560416}
}