Ambiguity and Generality in Natural Language Privacy Policies
Ambiguity and Generality in Natural Language Privacy Policies
复制标题
DOI：
10.1109/re51729.2021.00014
复制
发表时间：
2021-09
期刊：
影响因子：
--
通讯作者：
M. Hosseini;John Heaps;Rocky Slavin;Jianwei Niu;T. Breaux
中科院分区：
文献类型：
--
作者：
M. Hosseini;John Heaps;Rocky Slavin;Jianwei Niu;T. Breaux
隐私政策是包含应用程序数据实践的法律文件。这些文档是软件工程中公认的需求来源。然而，隐私政策是用自然语言编写的，因此容易产生歧义和抽象。从隐私政策中引出要求是一项具有挑战性的任务，因为这些模糊性可能导致对给定信息类型的多种解释（例如，“我们收集您的设备信息”声明中的模糊信息类型“设备信息”）。为了应对这一挑战，我们提出了一种自动化的方法来推断信息类型之间的语义关系，并构建一个本体来指导需求作者选择最合适的信息类型术语。我们的解决方案利用词嵌入和卷积神经网络（CNN）将信息类型对分类为同义词、同义词或未知。我们在一个人工构建的本体上评估了我们的模型，得出了识别信息类型对中的超义关系的预测，得分为0.904 F-1，这表明本体构建所需的工作量大大减少。
Privacy policies are legal documents containing application data practices. These documents are well-established sources of requirements in software engineering. However, privacy policies are written in natural language, thus subject to ambiguity and abstraction. Eliciting requirements from privacy policies is a challenging task as these ambiguities can result in more than one interpretation of a given information type (e.g., ambiguous information type "device information" in the statement "we collect your device information"). To address this challenge, we propose an automated approach to infer semantic relations among information types and construct an ontology to guide requirements authors in the selection of the most appropriate information type terms. Our solution utilizes word embeddings and Convolutional Neural Networks (CNN) to classify information type pairs as either hypernymy, synonymy, or unknown. We evaluate our model on a manually-built ontology, yielding predictions that identify hypernymy relations in information type pairs with 0.904 F-1 score, suggesting a large reduction in effort required for ontology construction.