一句话：提出 MiniChecker，自动检测小程序滥用权限请求行为，在真实数据集中发现大量隐私风险小程序。
小程序在超级应用平台上的普及带来便利，但开发者对数据权限申请的不当处理引发隐私违规问题。现有工具难以构建通用的小程序函数调用图，且缺乏对滥用行为的系统研究。本文提出自动化检测工具 MiniChecker，基于权限请求行为特征定义五类滥用问题：首页弹窗、覆盖弹窗、骚扰弹窗、重复弹窗和循环弹窗。它通过构建函数调用图并识别上述行为来发现风险小程序。在基准上，MiniChecker 达到 82.4% 的精确率和 95.3% 的召回率；在 20,000 个真实小程序中识别出 3,866 个风险小程序。分析还揭示了小程序权限机制的设计缺陷，并已向多个平台反馈。
The rising popularity of mini-programs deployed on super-app platforms has drawn significant attention due to their convenience. However, developers’ improper handling of data permission application in mini-programs has raised concerns about non-compliance and violations. Unfortunately, existing tools lack the capability to support the construction of a universal function call graph for the mini-program and the literature lacks a comprehensive and systematic study of the abusive issues. To bridge this gap, this paper introduces an automated tool, MiniChecker, to uncover the abusive permission request behavior in mini-programs. It defines five primary categories of abusive issues, namely homepage pop-up, overlaying pop-up, bothering pop-up, repeating pop-up, and looping pop-up, based on the request behavior features. MiniChecker achieves a detection precision rate of 82.4% and a recall rate of 95.3% on our benchmark, and identifies 3,866 risky mini-programs out of 20,000 real-world mini-programs. Our analysis reveals inherent design flaws in the mini-program permission mechanism, and we have shared our findings with several mini-program platforms.CCS CONCEPTS• Software and its engineering; • Security and privacy → Software security engineering;
@inproceedings{Wang0ZWJLCLZH024,
title = {MiniChecker: Detecting Data Privacy Risk of Abusive Permission Request Behavior in Mini-Programs},
author = {Yin Wang and Ming Fan and Hao Zhou and Haijun Wang and Wuxia Jin and Jiajia Li and Wenbo Chen and Shijie Li and Yu Zhang and Deqiang Han and Ting Liu},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695534}
}