一句话：首次系统实证研究 Android 应用中数据最小化原则的违反情况，并设计强化学习驱动的检测工具 GUIMind。
数据最小化原则对保护个人隐私至关重要，但 Android 运行时权限机制无法保证该原则被遵守，且缺乏自动执行手段，导致应用是否合规存在不确定性。为弥补这一空白，本文首次对数据最小化原则的违反行为开展系统性实证研究，并设计了自动执行工具 GUIMind：它先用强化学习模型探索应用界面活动，监控需要敏感权限的敏感 API 访问，再借助已有工具判定违规。作者在 120 个真实 Android 应用上评估 GUIMind，检测准确率达 96.1%，有效加速了实证研究。实证分析聚焦违规的普遍性、管理员对违规的响应，以及导致违规的潜在因素与特征（如典型违规类型、应用类别、个人数据类型）。结果显示 83.5% 的应用至少存在一项隐私违规，健康类应用最严重；电话信息是最常泄露的数据类型，占 71.1%。最后，作者随机选取 60 个不合规应用向管理员举报，管理员的回应证实了该方法有效。
The Data Minimization Principle is crucial for protecting individual privacy. However, existing Android runtime permissions do not guarantee this principle. Moreover, the lack of an automatic enforcement mechanism leads to uncertainty as to whether apps strictly comply with this principle. To bridge this gap, we conduct the first systematic empirical study on violations of the Data Minimization Principle and design a new enforcement tool called GUIMind to detect them. GUIMind first utilizes a reinforcement learning model to explore app activities and monitor access to sensitive APIs that require sensitive permissions, and then it leverages an existing tool to detect such violations. We evaluate the performance of GUIMind using 120 real-world Android apps. The results indicate that GUIMind can achieve a detection accuracy of 96.1%, effectively accelerating the empirical study. Our empirical research is mainly focused on the prevalence of violations, the responses of administrators to violations, and the potential factors and characteristics that lead to violations, such as typical violations, app categories, and personal data types. Our study reveals that 83.5% of apps contain at least one privacy violation, with health apps being the most severe. In addition, telephony information is the most commonly leaked personal data type, accounting for 71.1%. Finally, we randomly selected 60 non-compliant apps for reporting to the administrator, whose responses confirm the effectiveness of our approach.
@inproceedings{ZhangLWLGC23,
title = {How Android Apps Break the Data Minimization Principle: An Empirical Study},
author = {Shaokun Zhang and Hanwen Lei and Yuanpeng Wang and Ding Li and Yao Guo and Xiangqun Chen},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00141}
}