一句话：融合程序分析与大语言模型，为移动应用敏感行为自动生成细粒度解释，弥补应用描述与权限说明的缺失。
移动应用广泛访问敏感数据，引发隐私担忧。应用市场虽以权限机制约束私有数据访问，但缺少对权限用途的解释，使该机制效果受限；现有从应用描述中抽取解释句的方法也覆盖不足，许多敏感行为在描述中未被说明。为此，本文提出 AppBDS，将程序分析与大语言模型（LLM）结合，同时处理代码语义与 UI 上下文，并辅以隐私政策与相似应用信息，为应用的敏感行为生成详细解释。具体而言，AppBDS 融合代码语义与 UI 上下文，为每个应用构建 UI-Fused Call Graph（UCG）；同时从隐私政策中抽取与权限相关的命题，并利用知识库中相似应用的信息（PP-KB）增强 LLM 在解释权限用途方面的领域知识。作者在 270 个真实应用上评估，结果显示 AppBDS 在丰富度、具体性与语义相关性上显著优于现有最先进方法，且对常见代码混淆具有较强鲁棒性。
As mobile applications (i.e., apps) increasingly manage a wide variety of user needs, their access to sensitive data intensifies privacy concerns among users. While app markets employ permissions to regulate private data access, the lack of explanation for permission usage renders this mechanism less effective. Existing techniques that extract explanatory sentences from app descriptions to inform users about sensitive behaviors are also limited. Many app behaviors remain unexplained in app descriptions. To address these issues, we propose AppBDS, a novel approach that integrates program analysis with Large Language Models (LLMs) to process code semantics and UI contexts, further complemented by privacy policies and information from similar apps, in order to generate detailed explanations for apps’ sensitive behaviors. Specifically, AppBDS integrates code semantics with UI contexts to build a UI-Fused Call Graph (UCG) for each app. Additionally, AppBDS summarizes permission-related propositions from privacy policies and utilizes similar apps’ information from a knowledge base (PP-KB) to improve LLMs’ domain knowledge in explaining permission usage. Our evaluation on 270 real-world apps demonstrates that AppBDS significantly outperforms state-of-the-art approaches in richness, specificity, and semantic relatedness, while also proving highly robust against common code obfuscation.
DOI 原文 ·
@inproceedings{paperbot9262,
title = {AppBDS: LLM-Powered Description Synthesis for Sensitive Behaviors in Mobile Apps},
author = {Zichen Liu and Xusheng Xiao},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00078}
}