EAGER: Tracing Privacy-Policy Statements into Code for Privacy-Aware Mobile App Development

EAGER：将隐私政策声明跟踪到隐私意识移动应用程序开发的代码中

• 批准号: 1748109
• 负责人: Xiaoyin Wang
• 金额: $ 12.83万
• 依托单位: University of Texas at San Antonio
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-08-15 至 2020-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1748109&HistoricalAwards=false
• 关键词: EAGER; Tracing; Privacy; Policy; Statements

Privacy for smartphone and mobile applications users present unprecedented threats. In the United States, privacy policies serve as the primary means to inform users about how mobile apps process privacy data. The application developers are responsible for implementing privacy policies so that the code corresponds to the policies. Currently, there are no techniques for tracing high-level privacy practices into code. New research is needed to develop automatic privacy-aware development tools, as well as tools to determine if the code implements the policies correctly. To automatically trace high-level privacy practices in privacy policies into application code, the project borrows the idea of context-based classification from information extraction in natural language processing (NLP). In particular, both the natural-language-based policies and the program code are subjected to statistical NLP techniques to determine relationships between the policies and their implementations. The assumption that NLP techniques can be applied to code is based on recent work that has established the "naturalness" of software, in the sense that statistical NLP techniques appear to work just as well for computer programs as they do for, say, English. The project will mine a large set of privacy policies and corresponding code to find out how, or to what extent, policies manifest themselves in code. To the extent that consistency between privacy policies and code can be determined, new approaches to privacy policy understanding and enforcement might be possible.

智能手机和移动的应用程序用户的隐私面临着前所未有的威胁。在美国，隐私政策是告知用户移动的应用程序如何处理隐私数据的主要手段。应用程序开发人员负责实现隐私策略，以便代码与策略相对应。目前，还没有将高级隐私实践跟踪到代码中的技术。 需要新的研究来开发自动隐私感知开发工具，以及确定代码是否正确实现策略的工具。为了将隐私策略中的高级隐私实践自动跟踪到应用程序代码中，该项目借鉴了自然语言处理（NLP）中信息提取的基于上下文的分类思想。 特别地，基于自然语言的策略和程序代码都受到统计NLP技术的影响，以确定策略及其实现之间的关系。 NLP技术可以应用于代码的假设是基于最近的工作，这些工作已经确定了软件的“自然性”，从这个意义上说，统计NLP技术似乎对计算机程序和对英语一样有效。该项目将挖掘大量的隐私策略和相应的代码，以了解策略如何或在多大程度上体现在代码中。在某种程度上，隐私政策和代码之间的一致性可以确定，隐私政策的理解和执行的新方法可能是可能的。

项目成果

Privacy Assurance for Android Augmented Reality Apps

Android 增强现实应用程序的隐私保证

• DOI: 10.1109/prdc47002.2019.00037
• 发表时间: 2019
• 期刊: IEEE Pacific Rim International Symposium on Dependable Computing (PRDC
• 作者: Zhang, Xueling;Slavin, Rocky;Wang, Xiaoyin;Niu, Jianwei
• 通讯作者: Niu, Jianwei

Toward Detection of Access Control Models from Source Code via Word Embedding

• DOI: 10.1145/3322431.3326329
• 发表时间: 2019-05
• 期刊: Proceedings of the 24th ACM Symposium on Access Control Models and Technologies
• 作者: John Heaps;Xiaoyin Wang;T. Breaux;Jianwei Niu

IconIntent: Automatic Identification of Sensitive UI Widgets Based on Icon Classification for Android Apps

• DOI: 10.1109/icse.2019.00041
• 发表时间: 2019-05
• 期刊: 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE)
• 作者: Xusheng Xiao;Xiaoyin Wang;Zhihao Cao;Hanlin Wang;Peng Gao

TestMig: migrating GUI test cases from iOS to Android

• DOI: 10.1145/3293882.3330575
• 发表时间: 2019-07
• 期刊: Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis
• 作者: Xue Qin;Hao Zhong;Xiaoyin Wang

Toward a reliability measurement framework automated using deep learning

使用深度学习实现自动化的可靠性测量框架

• DOI: 10.1145/3314058.3317733
• 发表时间: 2019
• 期刊: Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security
• 作者: Heaps, John;Zhang, Xueling;Wang, Xiaoyin;Breaux, Travis;Niu, Jianwei
• 通讯作者: Niu, Jianwei