An Android APP automatic compliance detection method based on intelligent program analysis

Abstract

The application discloses an Android APP automatic compliance detection method based on intelligent program analysis. The application comprises the following steps: firstly, using a Chinese named entity model to extract the privacy content collected by the APP privacy policy declaration; then deploying a dynamic test environment to automatically test the target APP, capture the actual privacy content data of the APP in real time, and perform image recognition through an OCR method and a multi-classification model; finally, analyzing the actual privacy content of the APP and the privacy content of the privacy policy declaration, and comparing the actual privacy content of the APP, to analyze the actual violation items of the APP. The application can realize compliance analysis on user interaction privacy content, so as to standardize the APP behavior and protect the privacy safety of Android APP users.

Description

Technical Field

[0001] This invention relates to a compliance testing method for Android apps, specifically to an automated compliance testing method, device, and medium for Android apps based on intelligent program analysis. Background Technology

[0002] With the rapid development of mobile internet, apps have become an indispensable part of people's lives. Android app stores contain a large number of applications, but some of them have compliance issues. These issues may involve violations of privacy protection, advertising compliance, and content regulations, posing significant security risks and legal liabilities to users. To protect users' legitimate rights and interests and promote the healthy development of the mobile application market, it is necessary to conduct compliance testing on Android applications.

[0003] In recent years, industry researchers have typically used natural language processing (NLP) technology to analyze app privacy policies, extract key statements, and then analyze the app's actual behavior through data flow and dynamic methods. Finally, they compare the privacy policy statement information with the actual behavior to determine whether the app is compliant.

[0004] However, current detection methods focus on information directly accessed through the Android platform, but struggle to handle user interaction information, which is a major source of privacy content. Therefore, it is necessary to propose an automated compliance detection method, device, and medium for Android apps based on intelligent program analysis. Summary of the Invention

[0005] To address the issue that existing detection methods focus on information directly accessed through the Android platform but struggle to handle user interaction information, this invention proposes an automated compliance detection method, device, and medium for Android apps based on intelligent program analysis, which can more effectively solve the problem of app privacy compliance detection.

[0006] The technical solution of the present invention is as follows:

[0007] I. An Automated Compliance Detection Method for Android Apps Based on Intelligent Program Analysis

[0008] S1: The privacy policy of the APP under test is preprocessed and then input into the named entity recognition model M1. The model extracts the privacy content set DCP declared in the privacy policy of the APP under test.

[0009] S2: Perform automated testing on the APP under test, obtain screenshots of the dynamic graphical user interface of the APP under test and network data during the automated testing process, extract and classify semantic information from the screenshots of the dynamic graphical user interface of the APP under test, obtain interface analysis results, and form the actual privacy content dataset ACP of the APP under test by the interface analysis results and network data.

[0010] S3: Based on the privacy content collection DCP declared in the privacy policy of the app under test and the actual privacy content dataset ACP, perform privacy content compliance detection to obtain the compliance detection results of the app under test.

[0011] In step S1, the preprocessing of the privacy policy of the app to be tested specifically involves segmenting the text content of the privacy policy into sentences.

[0012] In S2, the graphical user interface of the APP under test during the automated testing process includes a startup interface, a settings interface, an advertising pop-up interface, and a permission request pop-up interface.

[0013] In S2, the network data of the APP under test during the automated testing process includes the request time, request address, request header and request body during the operation of the APP under test.

[0014] S3 includes:

[0015] Based on the actual privacy content dataset ACP of the app under test, compare and analyze whether the description of the purpose of collecting privacy content in the privacy content collection DCP declared in the privacy policy is complete.

[0016] The network data in the ACP dataset of the actual privacy content of the app under test is used to detect the actual privacy content transmitted by the app under test and the encryption status of the transmission.

[0017] Based on the semantic information contained in the actual privacy content dataset (ACP) of the app under test, detect whether the app under test explicitly collects privacy content and accesses permissions;

[0018] By comparing the privacy content set DCP declared in the privacy policy with the actual privacy content dataset ACP, the test app is detected to determine whether it collects privacy content beyond its scope and requests related permissions.

[0019] II. An automated compliance detection device for Android apps based on intelligent program analysis

[0020] The APP privacy content extraction module is used to extract the collection of privacy content (DCP) declared in the privacy policy of the APP under test.

[0021] The APP automated testing module is used to perform automated testing on the APP under test.

[0022] The graphical user interface acquisition module is used to collect the graphical user interface of the APP under test during automated testing.

[0023] The interface information extraction and classification module is used to extract and classify information from the graphical user interface of the app under test.

[0024] The network data monitoring module is used to collect network data during the operation of the app under test.

[0025] The APP privacy content compliance detection module is used to generate compliance detection results based on the privacy content collection (DCP) declared in the privacy policy and the actual privacy content dataset (ACP).

[0026] III. A computer device

[0027] The device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method.

[0028] IV. A computer-readable storage medium

[0029] The medium stores a computer program that, when executed by a processor, implements the steps of the method.

[0030] V. A computer program product

[0031] The product includes a computer program / instructions that, when executed by a processor, implement the steps of the method.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] This invention captures multimodal privacy content in real time during automated APP testing and uses an AI model to efficiently analyze the captured privacy content. Ultimately, by analyzing and comparing the privacy content described in the privacy policy with the actual privacy content, the compliance of the APP's user interaction privacy content is comprehensively assessed. This can more effectively solve the problem of APP privacy compliance detection, thereby standardizing APP behavior and protecting the privacy and security of Android APP users. Attached Figure Description

[0034] Figure 1 This is an overall flowchart of an automated compliance detection method for Android apps based on intelligent program analysis, according to the present invention.

[0035] Figure 2 This is a flowchart of the dynamic analysis environment setup in an automated compliance detection method for Android apps based on intelligent program analysis, as described in this invention.

[0036] Figure 3 This is a flowchart of the privacy content extraction and analysis process in an automated compliance detection method for Android apps based on intelligent program analysis, as described in this invention.

[0037] Figure 4 This is a flowchart of the violation analysis process in an automated compliance detection method for Android apps based on intelligent program analysis, as described in this invention.

[0038] Figure 5 This is a schematic diagram of the device structure of an automated compliance detection method for Android apps based on intelligent program analysis according to the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] like Figure 1 As shown, the automated compliance detection method for Android apps based on intelligent program analysis proposed in this invention includes the following steps:

[0041] S1: Construct an Android sample set and train a named entity recognition model; for the APP under test and its privacy policy, use the named entity recognition model to extract the privacy content collection (DCP) declared in the privacy policy of the APP under test;

[0042] S1 specifically includes the following steps:

[0043] S101: Use web crawler scripts to crawl apps and privacy policies from third-party app stores, build an Android sample dataset, and divide it into training set, validation set and test set;

[0044] S102: Use the Docano tool to annotate the privacy policy content in the training and validation sets, including the app's access permissions, the personal information collected by the app, and the purpose of the app's collection of personal information;

[0045] Doccano is an open-source text tagging tool that supports multiple platforms such as Windows and Ubuntu, and can be used to perform Chinese named entity tagging tasks.

[0046] S103: Train and validate the named entity detection model using the privacy policy training set marked in step S102 to obtain the final entity recognition model M1; the entity recognition model M1 is a natural language processing (NLP) model.

[0047] S104: Process the privacy policy of the test set APP by using the re.split() method to split the text content into sentences;

[0048] S105: The entity recognition model M1 trained in S103 is used to extract the privacy information declared in the clauses, and the extracted information is finally integrated to obtain the privacy content set DCP of privacy policy statements.

[0049] S2: Deploy a dynamic privacy compliance analysis environment for Android apps;

[0050] like Figure 2 As shown, S2 includes the following steps:

[0051] S201: Electronic device environment configuration, i.e., installing Python and Paddleocr Python packages;

[0052] S202: Install the DroidBot automated testing tool on electronic devices and install the droidbotApp.apk software on real devices to enable interaction between electronic devices and real devices;

[0053] DroidBot is a lightweight test input generator for the Android operating system. It can send random or scripted input events to Android applications, achieving higher test coverage faster, and generating a UI Transition Graph (UTG) after testing.

[0054] S203: Install the Mitmproxy tool on electronic devices, install and configure the network proxy for Android devices, listen on port 8080, and manually configure the WLAN network proxy on the devices.

[0055] Mitmproxy is a Python-based man-in-the-middle proxy tool that supports HTTP(S). It provides a Python API, allowing easy control of requests and responses by loading custom Python scripts.

[0056] S3: Train the image multi-classification model M2, perform automated testing on the test set APP, obtain privacy content and use the image multi-classification model M2 for recognition, thereby constructing the test set APP actual privacy content dataset ACP;

[0057] like Figure 3 As shown, S3 includes the following steps:

[0058] S301: Use the ADB tool to install training set APP samples, use the DroidBot tool to perform automated testing on these APPs, and take screenshots of the interface based on the state transitions of the GUI (Graphical User Interface).

[0059] S302: Filter the dynamic graphical user interface screenshots obtained in S301 and set image tags, mainly including startup screen, settings screen, advertising pop-up screen, permission request pop-up screen, etc., and then train an AI-based image multi-classification model M2; the image multi-classification model M2 is a CNN network.

[0060] S303: Install the test set APP, combine the important semantic information contained in the interface extracted by OCR technology, use the image multi-classification model M2 obtained in S302 to perform real-time detection and analysis on the running interface of the test set APP, obtain the classification results of each interface, and the interface analysis results are composed of the important semantic information contained in the interface and the classification results.

[0061] S304: Use the Mitmproxy tool to obtain network data during the operation of the APP, including request time, request address, request header, and request body;

[0062] S305: Integrate the data obtained from S303 and S304 to construct the App's Actual Privacy Content Dataset (ACP).

[0063] S4: Based on relevant laws and regulations, analyze and compare the DCP obtained in S1 and the ACP obtained in S3 to analyze the compliance of the privacy content of the test set APP.

[0064] like Figure 4 As shown, S4 includes the following steps:

[0065] S401: Analyze the collection of privacy content (DCP) declared in the privacy policy of the app under test obtained from S1, and check the completeness of the purpose statement of the test set app in collecting privacy content; if it is incomplete, the app is deemed to be in violation.

[0066] S402: By analyzing the network data monitored by Mitmproxy, detect and analyze the privacy content actually transmitted by the test set APP and whether the transmission is encrypted;

[0067] Sensitive privacy content mainly includes obtaining mobile device information (IMEI, MEID, DeviceId, MAC address, etc.) and WIFI list information (SSID, BSSID, WIFI MAC, etc.);

[0068] S403: Based on the important semantic information contained in the interface extracted in step S303, detect whether the APP explicitly discloses the permissions for collecting private content and accessing it;

[0069] S404: By comparing the privacy content set DCP declared in the privacy policy with the actual privacy content dataset ACP, analyze whether the test set APP collects privacy content and accesses permissions beyond its scope.

[0070] It should be understood that the above description of the preferred embodiments of the present invention is quite detailed, but it should not be construed as limiting the scope of protection of the present invention to the content disclosed in the above embodiments and drawings. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be pointed out that for those skilled in the art, any equivalent or modified versions made without departing from the spirit of the present invention fall within the scope of protection of the present invention.

[0071] This invention also proposes an automated compliance detection device for Android apps based on intelligent program analysis, comprising:

[0072] The APP privacy content extraction module is used to extract the collection of privacy content (DCP) declared in the privacy policy of the APP under test.

[0073] The APP automated testing module is used to perform automated testing on the APP under test.

[0074] The graphical user interface acquisition module is used to collect the graphical user interface of the APP under test during automated testing.

[0075] The interface information extraction and classification module is used to extract and classify information from the graphical user interface of the app under test.

[0076] The network data monitoring module is used to collect network data during the operation of the app under test.

[0077] The APP privacy content compliance detection module is used to generate compliance detection results based on the privacy content collection (DCP) declared in the privacy policy and the actual privacy content dataset (ACP).

[0078] like Figure 5 As shown, an automated compliance detection device for Android apps based on intelligent program analysis includes one or more processors, used to implement an automated compliance detection method for Android apps based on intelligent program analysis as described in the above embodiments.

[0079] An embodiment of the automated compliance detection device for Android apps based on intelligent program analysis of this invention can be applied to any device with data processing capabilities, such as a computer. The device embodiment can be implemented through software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device reading the corresponding computer program instructions from non-volatile memory into memory and executing them. From a hardware perspective, such as... Figure 5 The diagram shown is a hardware structure diagram of any device with data processing capabilities, including the Android APP automated compliance detection device based on intelligent program analysis according to the present invention. (Except for...) Figure 5 In addition to the processor, memory, network interface, and non-volatile memory shown, any data processing-capable manufacturing process in which the device is located in the embodiment may also include other hardware depending on the actual function of the data processing-capable device, which will not be described in detail here.

[0080] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0081] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0082] This invention also provides a readable storage medium storing a program that, when executed by a processor, implements an automated compliance detection method for Android apps based on intelligent program analysis as described in the above embodiments.

[0083] The readable storage medium can be an internal storage unit of any data processing device described in any of the foregoing embodiments, such as a hard disk or memory. The readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the readable storage medium can include both internal storage units of any data processing device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0084] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An automated compliance detection method for Android apps based on intelligent program analysis, characterized in that, Includes the following steps: S1: The privacy policy of the APP under test is preprocessed and then input into the named entity recognition model M1. The named entity recognition model M1 extracts the privacy content set DCP declared in the privacy policy of the APP under test. S2: Perform automated testing on the APP under test, obtain screenshots of the dynamic graphical user interface of the APP under test and network data during the automated testing process, extract and classify semantic information from the screenshots of the dynamic graphical user interface of the APP under test, obtain interface analysis results, and form the actual privacy content dataset ACP of the APP under test by the interface analysis results and network data. S3: Based on the privacy content collection DCP declared in the privacy policy of the app under test and the actual privacy content dataset ACP, perform privacy content compliance detection to obtain the compliance detection results of the app under test; S3 includes: Based on the actual privacy content dataset ACP of the app under test, compare and analyze whether the description of the purpose of collecting privacy content in the privacy content collection DCP declared in the privacy policy is complete. The network data in the ACP dataset of the actual privacy content of the app under test is used to detect the actual privacy content transmitted by the app under test and the encryption status of the transmission. Based on the semantic information contained in the actual privacy content dataset (ACP) of the app under test, detect whether the app under test explicitly collects privacy content and accesses permissions; By comparing the privacy content set DCP declared in the privacy policy with the actual privacy content dataset ACP, the test app is detected to determine whether it collects privacy content beyond its scope and requests related permissions.

2. The automated compliance detection method for Android apps based on intelligent program analysis according to claim 1, characterized in that, In step S1, the preprocessing of the privacy policy of the app to be tested specifically involves segmenting the text content of the privacy policy into sentences.

3. The automated compliance detection method for Android apps based on intelligent program analysis according to claim 1, characterized in that, In S2, the dynamic graphical user interface of the APP under test during the automated testing process includes a startup interface, a settings interface, an advertising pop-up interface, and a permission request pop-up interface.

4. The automated compliance detection method for Android apps based on intelligent program analysis according to claim 1, characterized in that, In S2, the network data of the APP under test during the automated testing process includes the request time, request address, request header and request body during the operation of the APP under test.

5. An automated compliance detection device for Android apps based on intelligent program analysis, characterized in that, include: The APP privacy content extraction module is used to extract the collection of privacy content (DCP) declared in the privacy policy of the APP under test. The APP automated testing module is used to perform automated testing on the APP under test. The graphical user interface acquisition module is used to collect the graphical user interface of the APP under test during automated testing. The interface information extraction and classification module is used to extract and classify information from the graphical user interface of the app under test. The network data monitoring module is used to collect network data during the operation of the app under test. The APP privacy content compliance detection module is used to generate compliance detection results based on the privacy content collection (DCP) declared in the privacy policy and the actual privacy content dataset (ACP). The APP privacy content compliance detection module specifically includes: Based on the actual privacy content dataset ACP of the app under test, compare and analyze whether the description of the purpose of collecting privacy content in the privacy content collection DCP declared in the privacy policy is complete. The network data in the ACP dataset of the actual privacy content of the app under test is used to detect the actual privacy content transmitted by the app under test and the encryption status of the transmission. Based on the semantic information contained in the actual privacy content dataset (ACP) of the app under test, detect whether the app under test explicitly collects privacy content and accesses permissions; By comparing the privacy content set DCP declared in the privacy policy with the actual privacy content dataset ACP, the test app is detected to determine whether it collects privacy content beyond its scope and requests related permissions.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 4.

Images