EAGER: Tracing Privacy-Policy Statements into Code for Privacy-Aware Mobile App Development

智能手机和移动的应用程序用户的隐私面临着前所未有的威胁。在美国，隐私政策是告知用户移动的应用程序如何处理隐私数据的主要手段。应用程序开发人员负责实现隐私策略，以便代码与策略相对应。目前，还没有将高级隐私实践跟踪到代码中的技术。 需要新的研究来开发自动隐私感知开发工具，以及确定代码是否正确实现策略的工具。为了将隐私策略中的高级隐私实践自动跟踪到应用程序代码中，该项目借鉴了自然语言处理（NLP）中信息提取的基于上下文的分类思想。 特别地，基于自然语言的策略和程序代码都受到统计NLP技术的影响，以确定策略及其实现之间的关系。 NLP技术可以应用于代码的假设是基于最近的工作，这些工作已经建立了软件的“自然性”，从某种意义上说，统计NLP技术似乎对计算机程序和对英语一样有效。该项目将挖掘大量的隐私策略和相应的代码，以了解策略如何或在多大程度上体现在代码中。在某种程度上，隐私政策和代码之间的一致性可以确定，隐私政策的理解和执行的新方法可能是可能的。

Privacy for smartphone and mobile applications users present unprecedented threats. In the United States, privacy policies serve as the primary means to inform users about how mobile apps process privacy data. The application developers are responsible for implementing privacy policies so that the code corresponds to the policies. Currently, there are no techniques for tracing high-level privacy practices into code. New research is needed to develop automatic privacy-aware development tools, as well as tools to determine if the code implements the policies correctly. To automatically trace high-level privacy practices in privacy policies into application code, the project borrows the idea of context-based classification from information extraction in natural language processing (NLP). In particular, both the natural-language-based policies and the program code are subjected to statistical NLP techniques to determine relationships between the policies and their implementations. The assumption that NLP techniques can be applied to code is based on recent work that has established the "naturalness" of software, in the sense that statistical NLP techniques appear to work just as well for computer programs as they do for, say, English. The project will mine a large set of privacy policies and corresponding code to find out how, or to what extent, policies manifest themselves in code. To the extent that consistency between privacy policies and code can be determined, new approaches to privacy policy understanding and enforcement might be possible.