Abstract:A long-standing challenge in analyzing information leaks within mobile apps is to automatically identify the code operating on sensitive data. With all existing solutions relying on System APIs (e.g., IMEI, GPS location) or features of user interfaces (UI), the content from app servers, like user’s Facebook profile, payment history, fall through the crack. Finding such content is important given the fact that most apps today are web applications, whose critical data are often on the server side. In the meantime, operations on the data within mobile apps are often hard to capture, since all server-side information is delivered to the app in the same way, sensitive or not. A unique observation of our research is that in modern apps, a program is essentially a semantics-rich documentation carrying meaningful program elements such as method names, variables and constants that reveal the sensitive data involved, even when the program is under moderate obfuscation. Leveraging this observation, we develop a novel semantics-driven solution for automatic discovery of sensitive user data, including those from the server side. Our approach utilizes natural language processing (NLP) to automatically locate the program elements (variables, methods, etc.) of interest, and then performs a learning-based program structure analysis to accurately identify those indeed carrying sensitive content. Using this new technique, we analyzed 445,668 popular apps, an unprecedented scale for this type of research. Our work brings to light the pervasiveness of information leaks, and the channels through which the leaks happen, including unintentional over-sharing across libraries and aggressive data acquisition behaviors. Further we found that many high-profile apps and libraries are involved in such leaks. Our findings contribute to a better understanding of the privacy risk in mobile apps and also highlight the importance of data protection in today’s software composition.

Code layer semantic analysis driving-based privacy data identification method

Method for identifying permission-irrelevant private data in Android application program

Finding Clues for Your Secrets: Semantics-Driven, Learning-Based Privacy Discovery in Mobile Apps

A Framework for Scanning Privacy Information Based on Static Analysis

Privacy Petri Net and Privacy Leak Software

A machine learning based approach for user privacy preservation in social networks

Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code

Research on Internet data security and privacy protection

A Scheme of Privacy Protection Based on Genetic Algorithm for Behavior Pattern of Social Media Users

Characterizing and Detecting Malicious Accounts in Privacy-Centric Mobile Social Networks: A Case Study

Balancing Innovation and Privacy: Data Security Strategies in Natural Language Processing Applications

Finding Privacy-relevant Source Code

Execution Enhanced Static Detection of Android Privacy Leakage Hidden by Dynamic Class Loading

Identifying Non-Control Security-Critical Data through Program Dependence Learning

A Fine-grained Chinese Software Privacy Policy Dataset for Sequence Labeling and Regulation Compliant Identification

Semantics-Preserved Distortion for Personal Privacy Protection in Information Management

A Deep Learning-Based Method for Preventing Data Leakage in Electric Power Industrial Internet of Things Business Data Interactions

Understanding and Detecting Privacy Leakage Vulnerabilities in Hyperledger Fabric Chaincodes

Application Research of Data Mining Technology in Personal Privacy Protection and Material Data Analysis

Precursor of privacy leakage detection for individual user

A Personal Privacy Preserving Framework