Method, device and equipment for compliance detection

Abstract

The embodiment of the invention discloses a compliance detection method, device and equipment. In the embodiment of the invention, a compliance detection task of an application program is obtained; static task initialization and dynamic task initialization are respectively performed according to the compliance detection task, dynamic analysis and static analysis are respectively performed on an installation package of the application program, the static initialization is used for configuring a running environment of a static analysis engine, and the dynamic initialization is used for configuring the running environment of the static analysis engine; performing dynamic analysis on the installation package to generate structured privacy policy content; meanwhile, performing static analysis on the installation package to generate static analysis data; and inputting the structured privacy policy content and the static analysis data into a large language model, performing privacy policy consistency judgment, and generating a consistency judgment result. By means of the method, efficient and accurate compliance detection can be conducted on the application program.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more specifically, to a method, device, and equipment for compliance detection. Background Art

[0002] With the wide use of intelligent devices, the application programs (APPs) used in intelligent devices are also emerging in an endless stream, covering all aspects of users' production and life. For example, work-related application programs, learning-related application programs, shopping applications, and entertainment applications, etc. Various application programs may need to obtain some permissions of the intelligent device or some personal sensitive information of the user during use. When the application program is installed, it will be shown to the user through the content of the privacy policy file. The application program is installed and used under the condition of the user's authorization. In order to prevent the application program from obtaining other permissions or personal sensitive information other than those disclosed in the privacy policy file content, R & D personnel and regulatory agencies need to conduct compliance detection on the application program.

[0003] In the prior art, static detection, dynamic detection, or traditional manual detection methods are used to conduct compliance detection on application programs. Among them, the above-mentioned static detection converts the source program of the application program into binary code, generates binary code, and performs static analysis on the binary code to obtain the application programming interfaces (APIs) and permission information of personal sensitive information, as well as the privacy policy content of multiple versions. Through static analysis, it is impossible to determine the specific version of the privacy policy content used, and personal sensitive information needs to be manually marked, which will lead to inaccurate compliance detection. The above-mentioned dynamic detection can obtain the specific version of the privacy policy content used through dynamic simulation compared with the above-mentioned static detection, but it cannot obtain the real usage scenarios of all the APIs and permission information of personal sensitive information, and it also needs to manually mark personal sensitive information, which will also lead to inaccurate compliance detection. The above-mentioned traditional manual detection completely relies on manual reading of the privacy policy content combined with the static analysis results for analysis, with low efficiency and easy omission of problems, which will also lead to inaccurate compliance detection.

[0004] In summary, how to conduct efficient and accurate compliance detection on application programs is a problem that needs to be solved currently. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, device, and equipment for compliance detection, which adopt a combination of dynamic detection, static detection, and large language models to conduct efficient and accurate compliance detection on application programs.

[0006] First aspect, an embodiment of the present invention provides a method for compliance detection, the method comprising: obtaining a compliance detection task of an application, wherein the compliance detection task includes an installation package of the application; respectively performing static task initialization and dynamic task initialization according to the compliance detection task, and respectively performing dynamic analysis and static analysis on the installation package of the application, wherein the static initialization is used to configure the running environment of the static analysis engine, and the dynamic initialization is used to configure the running environment of the static analysis engine; performing dynamic analysis on the installation package to generate structured privacy policy content; at the same time, performing static analysis on the installation package to generate static analysis data; inputting the structured privacy policy content and the static analysis data into a large language model to perform privacy policy consistency determination and generate a consistency determination result.

[0007] Optionally, in response to the privacy policy consistency determination result being consistent, the method further comprises: determining that the application is compliant.

[0008] Optionally, in response to the privacy policy consistency determination result being inconsistent, the method further comprises: performing scenario recognition according to the large language model and the UI interface restored from the function call link in the static analysis data to determine a non-compliant scenario.

[0009] Optionally, the method further comprises: displaying the non-compliant scenario.

[0010] Optionally, the performing dynamic analysis on the installation package to generate structured privacy policy content specifically comprises: obtaining a privacy policy content link corresponding to the installation package according to a received click instruction; determining the privacy policy content of the privacy policy content link according to the privacy policy content link, wherein the privacy policy content is in text format; inputting the privacy policy content into a large language model to generate structured privacy policy content.

[0011] Optionally, the determining the privacy policy content of the privacy policy content link according to the privacy policy content link specifically comprises: determining an initial privacy policy content and at least one sub-link according to the privacy policy content link; obtaining at least one sub-content in the at least one sub-link; determining the initial privacy policy content and the at least one sub-content as the privacy policy content.

[0012] Optionally, the static analysis data specifically includes personal sensitive information application programming interfaces, permission information, software development toolkits, and UI interfaces restored from function call links.

[0013] Second aspect, an embodiment of the present invention provides a device for compliance detection, the device comprising:

[0014] An acquisition unit for acquiring compliance detection tasks of an application, where the compliance detection tasks include the installation package of the application;

[0015] A processing unit for respectively performing static task initialization and dynamic task initialization according to the compliance detection tasks, and respectively performing dynamic analysis and static analysis on the installation package of the application, where the static initialization is used to configure the running environment of the static analysis engine, and the dynamic initialization is used to configure the running environment of the static analysis engine;

[0016] A generation unit for performing dynamic analysis on the installation package to generate structured privacy policy content; at the same time, performing static analysis on the installation package to generate static analysis data;

[0017] A determination unit for inputting the structured privacy policy content and the static analysis data into a large language model to perform privacy policy consistency determination.

[0018] Optionally, in response to the privacy policy consistency determination result being consistent, the determination unit is further configured to: determine that the application is compliant.

[0019] Optionally, in response to the privacy policy consistency determination result being inconsistent, the determination unit is further configured to: perform scenario recognition according to the large language model and the UI interface restored from the function call link in the static analysis data, and determine a non-compliant scenario.

[0020] Optionally, the device further includes: a display unit for displaying the non-compliant scenario.

[0021] Optionally, the generation unit is specifically configured to: obtain a privacy policy content link corresponding to the installation package according to a received click instruction; determine the privacy policy content of the privacy policy content link according to the privacy policy content link, where the privacy policy content is in text format; input the privacy policy content into a large language model to generate structured privacy policy content.

[0022] Optionally, the generation unit is further specifically configured to: determine initial privacy policy content and at least one sub-link according to the privacy policy content link; obtain at least one sub-content in the at least one sub-link; determine the initial privacy policy content and the at least one sub-content as the privacy policy content.

[0023] Optionally, the static analysis data specifically includes personal sensitive information application programming interfaces, permission information, software development toolkits, and UI interfaces restored from function call links.

[0024] In an embodiment of the present invention, by obtaining a compliance detection task of an application, where the compliance detection task includes an installation package of the application; respectively performing static task initialization and dynamic task initialization according to the compliance detection task, and respectively performing dynamic analysis and static analysis on the installation package of the application, where the static initialization is used to configure the operating environment of the static analysis engine, and the dynamic initialization is used to configure the operating environment of the static analysis engine; performing dynamic analysis on the installation package to generate structured privacy policy content; at the same time, performing static analysis on the installation package to generate static analysis data; inputting the structured privacy policy content and the static analysis data into a large language model to perform privacy policy consistency determination and generate a consistency determination result. Through the above method, a combination of dynamic detection, static detection, and a large language model is used to perform efficient and accurate compliance detection on the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Through the following description of the embodiments of the present invention with reference to the drawings, the above and other objects, features, and advantages of the present invention will become more apparent. In the drawings:

[0026] Figure 1 is a flowchart of a method for compliance detection in an embodiment of the present invention;

[0027] Figure 2 is a flowchart of another method for compliance detection in an embodiment of the present invention;

[0028] Figure 3 is a flowchart of another method for compliance detection in an embodiment of the present invention;

[0029] Figure 4 is a flowchart of another method for compliance detection in an embodiment of the present invention;

[0030] Figure 5 is a schematic diagram of a compliance detection system in an embodiment of the present invention;

[0031] Figure 6 is a schematic diagram of a device for compliance detection in an embodiment of the present invention;

[0032] Figure 7 is a schematic diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0033] The following is a description of the present application based on embodiments, but the present application is not limited to these embodiments. In the following detailed description of the present application, some specific details are described in detail. Those skilled in the art can fully understand the present application without the description of these details. In order to avoid obscuring the essence of the present application, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0034] In addition, those of ordinary skill in the art should understand that the accompanying drawings provided herein are for illustrative purposes only, and the drawings are not necessarily drawn to scale.

[0035] Unless the context clearly requires otherwise, words such as "including" and "comprising" in the entire application document should be construed in an inclusive sense rather than an exclusive or exhaustive sense; that is, it is the meaning of "including but not limited to".

[0036] In the description of this application, it should be understood that terms such as "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance. In addition, in the description of this application, unless otherwise specified, the meaning of "a plurality of" is two or more.

[0037] In the prior art, compliance means that the application complies with the requirements of regulatory rules. Specifically, it means that the content of the privacy policy presented to the user by the application is consistent with the content obtained by the actual collection behavior of the application, and no additional information unauthorized by the user will be obtained without the user's knowledge. For example, if the API and permission information of personal sensitive information are mentioned in the privacy policy content, then the actual collection behavior of the application can only obtain the API and permission information of personal sensitive information mentioned in the privacy policy content. If the application obtains other information outside the privacy policy content, it does not comply with the regulatory rules. Therefore, it is necessary to perform a consistency check on the content of the privacy policy presented to the user by the application and the content obtained by the actual collection behavior of the application, which is also called compliance check. Among them, the privacy policy content is a statement document provided by the application developer regarding the collection, use, and protection of personal information.

[0038] Specifically, the compliance detection of the application program is carried out by static detection, dynamic detection or traditional manual detection respectively; among them, the above-mentioned static detection generates binary code by binary conversion of the source program of the application program, performs static analysis on the above binary code, and combines regular matching rules to obtain the application programming interface (API) and permission information of personal sensitive information. Since some application programs may have multiple privacy policy links, multiple versions of the privacy policy content can be obtained. It is impossible to determine the version of the privacy policy content actually used through static analysis, and it is difficult to perform consistency analysis on the privacy policy content and the actual collection behavior; and personal sensitive information needs to be manually labeled, that is, manually tag the API of personal sensitive information, but manual tagging will cause errors, for example, the same thing uses different names, etc.; the above static detection also cannot identify the real usage scenario of the API of personal sensitive information. The above reasons will all lead to the problem of inaccurate compliance detection, that is, consistency comparison cannot be performed; compared with the above static detection, the above dynamic detection can obtain the version of the privacy policy content actually used through dynamic simulation, and use regular matching or fuzzy matching to extract the privacy policy content, but it cannot be extracted in a general way, that is, the extracted content cannot be formatted, and the real usage scenarios of all APIs and permission information of personal sensitive information cannot be obtained, and manual labeling of personal sensitive information is also required, and the real usage scenario of the API of personal sensitive information cannot be identified. The above reasons will all lead to the problem of inaccurate compliance detection, that is, consistency comparison cannot be performed; the above traditional manual detection completely relies on manual reading of the privacy policy content combined with the static analysis results for analysis, with low efficiency and easy omission of problems, which will also lead to the problem of inaccurate compliance detection. Therefore, how to perform efficient and accurate compliance detection on application programs is a problem that needs to be solved at present.

[0039] In an embodiment of the present invention, to solve the above problems, a compliance detection method is proposed, specifically as Figure 1 shown, the method includes:

[0040] Step S101, obtain a compliance detection task of the application program.

[0041] Among them, the compliance detection task includes the installation package of the application program.

[0042] Step S102, respectively perform static task initialization and dynamic task initialization according to the compliance detection task, and perform dynamic analysis and static analysis on the installation package of the application program.

[0043] Among them, the static initialization is used to configure the operating environment of the static analysis engine, and the dynamic initialization is used to configure the operating environment of the static analysis engine.

[0044] In a possible implementation, the static initialization is specifically used to configure the operating environment and rule data of the static analysis engine. The rule data includes rules for extracting static analysis data; uploading the rule data to the static analysis engine and configuring the operating environment of the static analysis engine. The static analysis data specifically includes application programming interfaces for personal sensitive information, permission information, software development kits (SDKs), and UI interfaces for restoring function call links. Among them, the personal sensitive information is data that can directly or indirectly identify the user's identity, such as name, user identification number, device ID, etc.; the permission information refers to the system function access permissions requested by the application during operation, such as camera, location, etc.; the SDK refers to a code library provided by a third party for integrating specific functions.

[0045] In a possible implementation, the dynamic initialization is used to configure the operating environment of the compliance detection system and install the installation package into the compliance detection system. For example, virtualize an intelligent device installed with the installation package on the static analysis engine.

[0046] Step S103: Perform dynamic analysis on the installation package to generate structured privacy policy content; at the same time, perform static analysis on the installation package to generate static analysis data.

[0047] Specifically, the performing dynamic analysis on the installation package to generate structured privacy policy content is as Figure 2 shown and includes:

[0048] Step S201: Obtain the privacy policy content link corresponding to the installation package according to the received click instruction.

[0049] Specifically, the dynamic analysis engine extracts the privacy policy content link by scheduling and running automated test analysis scripts and simulating the way of clicking on the underlying hook.

[0050] Step S202: Determine the privacy policy content of the privacy policy content link according to the privacy policy content link.

[0051] Among them, the privacy policy content is in text format.

[0052] Specifically, an algorithm tool plugin is used to obtain the initial privacy policy content and at least one sub-link according to the privacy policy content link; and obtain at least one sub-content in the at least one sub-link; and determine the initial privacy policy content and the at least one sub-content as the privacy policy content.

[0053] Step S203: Input the privacy policy content into a large language model to generate a structured privacy policy content.

[0054] Specifically, the structured privacy policy content can be a privacy policy content in jason format.

[0055] In an embodiment of the present invention, the large language model (LLM) can also be referred to as an artificial intelligence (AI) model, a large model, or a large language model. Among them, the large language model is a deep learning model based on a transformer architecture. Deep learning in the deep learning model is a way of machine learning. It uses a deep neural network to establish a model, learns the parameters of the model from a large amount of data, and finally uses the model and data for prediction. Large language models represented by ChatGPT, QWEN, etc. have shown amazing understanding and generation capabilities.

[0056] Step S104: Input the structured privacy policy content and the static analysis data into a large language model to perform privacy policy consistency determination and generate a consistency determination result.

[0057] In a possible implementation manner, the static analysis of the installation package to generate static analysis data is specifically to perform static analysis on the installation package to generate APIs of personal sensitive information, permission information, SDKs, and a UI interface for restoring the function call link.

[0058] In a possible implementation manner, in response to the privacy policy consistency determination result being consistent, after step S104, other steps are further included, specifically as Figure 3 described, including:

[0059] Step S105: Determine that the application is compliant.

[0060] In a possible implementation manner, in response to the privacy policy consistency determination result being inconsistent, after step S104, other steps are further included, specifically as Figure 4 described, including:

[0061] Step S106: Perform scenario recognition based on the large language model and the UI interface restored from the function call link in the static analysis data to determine non-compliant scenarios.

[0062] Step S107: Display the non-compliant scenarios.

[0063] Specifically, display on the display screen of the compliance detection system except for the non-compliant scenarios and inconsistent content.

[0064] Through the above embodiments, the comprehensiveness and accuracy of privacy compliance detection are improved, the consistency analysis between privacy policies and actual behaviors is achieved, and the scenario-based privacy behavior analysis ability is provided, helping R & D personnel quickly locate the scenarios where compliance risks occur.

[0065] In the embodiment of the present invention, the structural schematic diagram of the compliance detection system is as Figure 5 shown, including: a resource scheduling module 501, a static analysis module 502, a dynamic analysis module 503, an algorithm module 504, a risk identification module 505, and a scenario recognition module 506. Among them, the algorithm module 504 includes a tool plug-in 5041 and a structuring module 5042. Among them, the resource scheduling module 501 is used for the distribution and scheduling of overall dynamic tasks and static tasks, the initialization of static tasks and dynamic tasks, and the data transfer of the installation package of the application program. The static analysis module 502 is used for static analysis to generate static analysis data. The dynamic analysis module 503 is used for dynamic analysis to obtain the privacy policy content link. The dynamic analysis module 503 sends the privacy policy content link to the tool plug-in 5041 to extract the privacy policy content. The structuring module 5042 structures the privacy policy content to generate structured privacy policy content. The generated structured privacy policy content is sent to the risk identification module 505, and at the same time, the static analysis data generated by the static analysis module 502 is also input into the risk identification module 505. The risk identification module 505 performs privacy policy consistency determination through a large language model to generate a consistency determination result. If the consistency determination result is inconsistent, the consistency determination result is input into the scenario recognition module 506 for scenario recognition.

[0066] In the embodiment of the present invention, a device for compliance detection is provided, as Figure 6As shown in the figure, it specifically includes: an acquisition unit 601, a processing unit 602, a generation unit 603, and a determination unit 604; among them, the acquisition unit 601 is used to acquire the compliance detection task of the application program, where the compliance detection task includes the installation package of the application program; the processing unit 602 is used to perform static task initialization and dynamic task initialization respectively according to the compliance detection task, and perform dynamic analysis and static analysis on the installation package of the application program respectively, where the static initialization is used to configure the running environment of the static analysis engine, and the dynamic initialization is used to configure the running environment of the static analysis engine; the generation unit 603 is used to perform dynamic analysis on the installation package to generate structured privacy policy content; at the same time, perform static analysis on the installation package to generate static analysis data; the determination unit 604 is used to input the structured privacy policy content and the static analysis data into a large language model for privacy policy consistency determination.

[0067] Further, in response to the privacy policy consistency determination result being consistent, the determination unit is further used to: determine that the application program is compliant.

[0068] Further, in response to the privacy policy consistency determination result being inconsistent, the determination unit is further used to: perform scenario recognition based on the large language model and the UI interface restored from the function call link in the static analysis data, and determine non-compliant scenarios.

[0069] Further, the device further includes: a display unit for displaying the non-compliant scenarios.

[0070] Further, the generation unit is specifically used to: obtain the privacy policy content link corresponding to the installation package according to the received click instruction; determine the privacy policy content of the privacy policy content link according to the privacy policy content link, where the privacy policy content is in text format; input the privacy policy content into a large language model to generate structured privacy policy content.

[0071] Further, the generation unit is specifically further used to: determine the initial privacy policy content and at least one sub-link according to the privacy policy content link; obtain at least one sub-content in the at least one sub-link; determine the initial privacy policy content and the at least one sub-content as the privacy policy content.

[0072] Further, the static analysis data specifically includes personal sensitive information application programming interfaces, permission information, software development kits, and UI interfaces restored from function call links.

[0073] Figure + It is a schematic structural diagram of the electronic device in the embodiment of the present invention. AsFigure 7 As shown, it includes a general computer hardware structure, which at least includes a processor 701 and a memory 702. The processor 701 and the memory 702 are connected by a bus 703. The memory 702 is adapted to store instructions or programs executable by the processor 701. The processor 701 can be an independent microprocessor or a set of one or more microprocessors. Thus, by executing the instructions stored in the memory 702, the processor 701 executes the method flow of the embodiment of the present invention as described above to implement the processing of data and the control of other devices. The bus 703 connects the above-mentioned multiple components together and at the same time connects the above-mentioned components to a display controller 704, a display device, and an input / output (I / O) device 705. The input / output (I / O) device 705 can be a mouse, a keyboard, a modem, a network interface, a touch input device, a somatosensory input device, a printer, and other devices well-known in the art. Typically, the input / output (I / O) device 705 is connected to the system through an input / output (I / O) controller 706.

[0074] Among them, the instructions stored in the memory 702 are executed by at least one processor 701 to achieve: obtaining a compliance detection task of an application program, where the compliance detection task includes an installation package of the application program; respectively performing static task initialization and dynamic task initialization according to the compliance detection task, and respectively performing dynamic analysis and static analysis on the installation package of the application program, where the static initialization is used to configure the running environment of the static analysis engine, and the dynamic initialization is used to configure the running environment of the static analysis engine; performing dynamic analysis on the installation package to generate structured privacy policy content; at the same time, performing static analysis on the installation package to generate static analysis data; inputting the structured privacy policy content and the static analysis data into a large language model to perform privacy policy consistency determination and generate a consistency determination result.

[0075] Specifically, the electronic device includes: one or more processors 701 and a memory 702, Figure 7 Taking one processor 701 as an example. The processor 701 and the memory 702 can be connected by a bus or other means, Figure 7 taking the connection by bus as an example. As a non-volatile computer-readable storage medium, the memory 702 can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The processor 701 executes various functional applications and data processing of the device by running the non-volatile software programs, instructions, and modules stored in the memory 702, that is, implements the method for determining compliance detection as described above.

[0076] The memory 702 may include a program storage area and a data storage area. The program storage area may store an operating system and application programs required for at least one function. The data storage area may store an option list and the like. In addition, the memory 702 may include high-speed random access memory and may also include non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the memory 702 may optionally include a memory remotely disposed relative to the processor 701, and these remote memories may be connected to an external device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0077] One or more modules are stored in the memory 702 and, when executed by one or more processors 701, perform the method for compliance detection in any of the above method embodiments.

[0078] As those skilled in the art will realize, various aspects of the embodiments of the present invention can be implemented as a system, a method, or a computer program product. Therefore, various aspects of the embodiments of the present invention may take the following forms: a complete hardware implementation, a complete software implementation (including firmware, resident software, microcode, etc.), or an implementation combining software aspects and hardware aspects that are generally referred to herein as "circuits", "modules", or "systems". In addition, various aspects of the embodiments of the present invention may take the following forms: a computer program product implemented in one or more computer-readable media having computer-readable program code implemented thereon.

[0079] Any combination of one or more computer-readable media may be utilized. A computer-readable media may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example (but not limited to), an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (non-exhaustive list) of the computer-readable storage medium will include the following: an electrical connection having one or more wires, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of the embodiments of the present invention, a computer-readable storage medium may be any tangible medium that can contain or store a program used by or in connection with an instruction execution system, apparatus, or device.

[0080] A computer-readable signal medium may include a propagated digital signal having computer-readable program code embodied therein, either as in a baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including but not limited to: electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0081] Any suitable medium may be used to transmit the program code embodied on a computer-readable medium, including but not limited to wireless, wired, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

[0082] The computer program code for performing operations in connection with aspects of the embodiments of the present invention may be written in any combination of one or more programming languages, including: object-oriented programming languages such as Java, Smalltalk, C++, etc.; and conventional procedural programming languages such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet service provider).

[0083] The flowchart illustrations and / or block diagrams above, of methods, apparatus (systems), and computer program products according to embodiments of the present invention, depict various aspects of the embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0084] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instructions for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0085] Computer program instructions can also be loaded onto a computer, other programmable data processing device, or other device, so as to perform a series of operable steps on the computer, other programmable device, or other device to generate a computer-implemented process, such that the instructions executed on the computer or other programmable device provide a process for implementing the functions / actions specified in the flowchart and / or block diagram block or blocks.

[0086] The foregoing are only the preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, various modifications and variations can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the protection scope of the present application.

[0087] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entrances are provided for users to choose to authorize or refuse. When a user refuses to process personal information other than the necessary information required for the basic functions, it will not affect the user's use of the basic functions.

Claims

1. A method for compliance detection, characterized in that, The method includes: Obtaining a compliance detection task for the application, where the compliance detection task includes the installation package of the application; Performing static task initialization and dynamic task initialization respectively according to the compliance detection task, and performing dynamic analysis and static analysis on the installation package of the application respectively. The static initialization is used to configure the running environment of the static analysis engine, and the dynamic initialization is used to configure the running environment of the static analysis engine; Performing dynamic analysis on the installation package to generate structured privacy policy content; at the same time, performing static analysis on the installation package to generate static analysis data; Inputting the structured privacy policy content and the static analysis data into a large language model to perform privacy policy consistency determination and generate a consistency determination result.

2. The method according to claim 1, wherein In response to the privacy policy consistency determination result being consistent, the method further includes: Determining that the application is compliant.

3. The method according to claim 1, wherein In response to the privacy policy consistency determination result being inconsistent, the method further includes: Performing scenario recognition according to the large language model and the UI interface restored from the function call link in the static analysis data to determine non-compliant scenarios.

4. The method according to claim 3, wherein The method further includes: Displaying the non-compliant scenarios.

5. The method according to claim 1, wherein The performing dynamic analysis on the installation package to generate structured privacy policy content specifically includes: Obtaining a privacy policy content link corresponding to the installation package according to the received click instruction; Determining the privacy policy content of the privacy policy content link according to the privacy policy content link, where the privacy policy content is in text format; Inputting the privacy policy content into a large language model to generate structured privacy policy content.

6. The method according to claim 5, characterized in that, The determining the privacy policy content of the privacy policy content link according to the privacy policy content link specifically includes: Determining initial privacy policy content and at least one sub-link according to the privacy policy content link; Obtaining at least one sub-content in the at least one sub-link; Determining the initial privacy policy content and the at least one sub-content as the privacy policy content.

7. The method according to claim 1, characterized in that, The static analysis data specifically includes personal sensitive information application programming interfaces, permission information, software development kits, and UI interfaces restored from function call links.

8. A device for compliance detection, characterized in that, The device includes: An obtaining unit, configured to obtain a compliance detection task for the application, where the compliance detection task includes the installation package of the application; A processing unit, configured to perform static task initialization and dynamic task initialization respectively according to the compliance detection task, and perform dynamic analysis and static analysis on the installation package of the application respectively. The static initialization is used to configure the running environment of the static analysis engine, and the dynamic initialization is used to configure the running environment of the static analysis engine; A generating unit, configured to perform dynamic analysis on the installation package to generate structured privacy policy content; at the same time, perform static analysis on the installation package to generate static analysis data; A determining unit, configured to input the structured privacy policy content and the static analysis data into a large language model to perform privacy policy consistency determination.

9. An electronic device, comprising a memory and a processor, characterized in that, The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1-7 is implemented.

Images