Data compliance detection method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a data compliance detection method and device, electronic equipment and a readable storage medium, and belongs to the technical field of computer software, and the method comprises the steps: obtaining first information of an application program based on a data compliance detection request under the condition that the data compliance detection request of the application program is received, the first information comprises use behavior information of data collected by the application program; performing text feature mapping on the use behavior information to obtain a first vector of the use behavior information; based on the first vector and a pre-obtained second vector corresponding to a target policy text, consistency detection is carried out on the use behavior information and the target policy text to obtain a target detection result, and the target detection result is used for indicating whether the use behavior information is compliant or not; the target policy text comprises at least one of compliance policy text and privacy policy text of the application program.

Description

Technical Field

[0001] This application belongs to the field of computer software technology, and specifically relates to a data compliance detection method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] To ensure the smooth operation and further optimization of business, applications typically need to collect relevant data during runtime. However, some applications, in pursuit of illicit profits, illegally collect data that is not essential for business operations, leading to the excessive collection and misuse of user information. Therefore, to prevent such excessive collection and misuse of users' personal information, regulatory authorities have issued corresponding legal and compliance policies, such as MIIT Document No. 164 and the EU General Data Protection Regulation (GDPR).

[0003] To comply with regulatory policies, app stores typically conduct compliance checks on applications before listing them. However, these checks are usually done manually, requiring a significant investment of manpower and resulting in low efficiency. For example, they might search for relevant information in the application's privacy statement and compliance policy, checking if the privacy statement complies with regulations; or they might use tools to analyze the application's data usage and manually verify if this data usage aligns with its stated privacy policy. Summary of the Invention

[0004] The purpose of this application is to provide a data compliance detection method, apparatus, electronic device, and readable storage medium that can automate the data compliance detection of applications and improve the efficiency of data compliance detection.

[0005] In a first aspect, embodiments of this application provide a data compliance detection method, the method comprising:

[0006] Upon receiving a data compliance detection request from an application, the application's first information is obtained based on the data compliance detection request. The first information includes usage behavior information of the data collected by the application.

[0007] The usage behavior information is mapped using text features to obtain a first vector of the usage behavior information.

[0008] Based on the first vector and the second vector corresponding to the pre-acquired target policy text, a consistency detection is performed on the usage behavior information and the target policy text to obtain a target detection result. The target detection result is used to indicate whether the usage behavior information is compliant. The target policy text includes at least one of a compliance policy text and the application's privacy policy text.

[0009] Secondly, embodiments of this application provide a data compliance detection device, which includes:

[0010] The acquisition module is used to acquire first information of the application based on the data compliance detection request received from the application, wherein the first information includes usage behavior information of the data collected by the application;

[0011] The first text feature mapping module is used to perform text feature mapping on the usage behavior information to obtain a first vector of the usage behavior information;

[0012] The detection module is used to perform consistency detection on the usage behavior information and the target policy text based on the first vector and the second vector corresponding to the pre-acquired target policy text, and obtain a target detection result. The target detection result is used to indicate whether the usage behavior information is compliant. The target policy text includes at least one of a compliance policy text and the privacy policy text of the application.

[0013] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the data compliance detection method as described in the first aspect.

[0014] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the data compliance detection method as described in the first aspect.

[0015] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the steps of the data compliance detection method as described in the first aspect.

[0016] In a sixth aspect, embodiments of this application provide a computer program product stored in a storage medium, which is executed by at least one processor to implement the steps of the data compliance detection method as described in the first aspect.

[0017] In this embodiment, upon receiving a data compliance detection request from an application, the system obtains usage behavior information of the data collected by the application based on the request. This usage behavior information is then mapped using text features to obtain a first vector. Subsequently, based on the first vector and a second vector corresponding to a pre-acquired target policy text, a consistency check is performed between the usage behavior information and the target policy text. This yields a target detection result indicating whether the usage behavior information of the data collected by the application is compliant. Thus, data compliance detection of applications can be automated using artificial intelligence (AI), improving the efficiency of application data compliance detection. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the data compliance detection method provided in the embodiments of this application;

[0019] Figure 2 This is a schematic diagram illustrating the interaction of obtaining usage behavior information provided in an embodiment of this application;

[0020] Figure 3 This is a schematic diagram illustrating the processing interaction of compliance policy text provided in the embodiments of this application;

[0021] Figure 4 This is a schematic diagram illustrating the processing interaction of the privacy policy text provided in this application embodiment;

[0022] Figure 5 This is a schematic diagram illustrating the compliance detection interaction of privacy statement information provided in an embodiment of this application;

[0023] Figure 6 This is a schematic diagram illustrating the consistency detection between usage behavior information and the privacy policy text statement provided in this application embodiment;

[0024] Figure 7 This is a schematic diagram of the architecture of the data compliance detection system provided in the embodiments of this application;

[0025] Figure 8 This is a schematic diagram of the data compliance detection device provided in the embodiments of this application;

[0026] Figure 9 These are schematic diagrams of the structure of electronic devices provided in some embodiments of this application;

[0027] Figure 10 A schematic diagram of the hardware structure of an electronic device provided for some embodiments of this application. Detailed Implementation

[0028] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0029] The terms "first," "second," etc., used in this application's specification are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, in the specification, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects have an "or" relationship.

[0030] The data compliance detection method provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0031] It should be noted that the data compliance detection method in this embodiment can be applied to a data compliance detection system, which can be deployed on a terminal device or on a server.

[0032] In some embodiments, when a user downloads an application from an app store, a data compliance detection system deployed on the terminal device can be used to detect whether the usage information of the data collected by the application is consistent with the statements in the privacy policy text.

[0033] In some embodiments, when an application is listed on an app store, a data compliance detection system deployed on a server can be used to detect whether the usage behavior information of the data collected by the application is compliant.

[0034] Figure 1 This is a flowchart illustrating the data compliance detection method provided in the embodiments of this application, such as... Figure 1 As shown, the method includes the following steps:

[0035] Step 101: Upon receiving a data compliance detection request from an application, obtain first information about the application based on the data compliance detection request. The first information includes usage behavior information of the data collected by the application.

[0036] The data compliance detection system may include an orchestration module, which calls the various modules of the data compliance detection system to achieve data compliance detection.

[0037] Compliance engineers or users can send requests to the data compliance testing system. The orchestration module can serve as the entry point for these requests, receiving them as well. These requests can include application attribute information (such as application name, developer name, storage address, etc.), policy attribute information (such as name, publisher name, format (such as PDF, image, DOC, etc.), and storage address).

[0038] Based on the application's attribute information, program information of the application can be obtained. By analyzing the application's program information, usage behavior information of the data collected by the application can be obtained. This usage behavior information is in the form of binary or triple tuples. A binary tuple includes the data collection subject, such as the application itself or third-party applications, as well as data information such as device information and user information. A triple tuple, in addition to the binary tuple, can also include operations performed on the collected data, such as usage or sharing with third-party applications.

[0039] The application collects multiple sets of data on user behavior, and this data can be obtained by analyzing the application's data stream information.

[0040] In some embodiments, the data compliance detection system may further include a data flow analysis module and a data flow information management module. The orchestration module can communicate with the data flow analysis module to call the data flow analysis module to analyze the application's data flow information, thereby obtaining usage behavior information of the data collected by the application. The data flow analysis module can communicate with the data flow information management module to store the usage behavior information in a corresponding database. Figure 2 As shown, the data compliance detection system's interaction process for acquiring usage behavior information of the data collected by the application can be as follows:

[0041] 1) The orchestration module receives a data compliance check request from the application;

[0042] 2) The orchestration module forwards data compliance detection requests to the data flow analysis module;

[0043] 3) The data flow analysis module receives data compliance detection requests and locates application information such as the location of the application's binary code based on the application's attribute information;

[0044] 4) After locating the application's binary code, the data flow analysis module can use data flow analysis tools (such as SDK Hook tools, application API Hook tools, etc.) to analyze the application's data flow and obtain a first information list. Each entry in the first information list represents a usage behavior information.

[0045] 5) The data flow analysis module sends a storage request for the first information list to the data flow information management module;

[0046] 6) The data flow information management module receives the storage request and stores the first information list;

[0047] 7) The data flow information management module responds to the data flow analysis module that information storage is complete;

[0048] 8) The data flow analysis module responds to the orchestration module that the information acquisition is complete;

[0049] 9) The orchestration module has completed the acquisition of response information.

[0050] In some embodiments, the first information may also include the privacy policy text and the privacy statement information within the privacy policy text. For example, consistency checks can be performed on the usage behavior information and the privacy policy text. Alternatively, it can be checked whether the privacy statement information meets the requirements of the compliance policy text.

[0051] In some embodiments, the data compliance detection system may further include a vector conversion module and a privacy statement information management module. The orchestration module may communicate with the vector conversion module to call the vector conversion module to obtain relevant information about the privacy policy text, such as the privacy policy text, a second information list containing privacy statement information, and the full-text vector of the privacy policy text. The vector conversion module may communicate with the privacy statement information management module to store the relevant information about the privacy policy text in the corresponding memory.

[0052] Step 102: Perform text feature mapping on the usage behavior information to obtain the first vector of the usage behavior information.

[0053] The data compliance detection system may also include a consistency analysis management module. The orchestration module can communicate with the consistency analysis management module. When the orchestration module obtains the relevant information required for data compliance detection, it can call the consistency analysis management module to perform data compliance detection on the application. The consistency analysis management module can communicate with the text embedding model to call the text embedding model to perform text feature mapping on the usage behavior information and obtain the first vector of the usage behavior information.

[0054] Among them, the text embedding model can be a small model obtained by fine-tuning an open-source model. It can convert text information into vectors and realize the vector representation of text information.

[0055] In addition, the consistency analysis management module can also call the text embedding model to perform text feature mapping on the privacy statement information, obtaining the first target sub-vector of the privacy statement information. The text embedding model can also be scheduled by other modules, such as the vector transformation module, to perform text feature mapping on the privacy policy text and the compliance policy text, obtaining the second target sub-vector of the privacy policy text and the first sub-vector of the compliance policy text.

[0056] Step 103: Based on the first vector and the second vector corresponding to the pre-acquired target policy text, perform consistency detection on the usage behavior information and the target policy text to obtain a target detection result. The target detection result is used to indicate whether the usage behavior information is compliant. The target policy text includes at least one of a compliance policy text and the application's privacy policy text.

[0057] In some embodiments, such as a data compliance detection system deployed on a terminal device, users are typically concerned with whether the usage behavior information of the data collected by the applications they download is consistent with the statements in the privacy policy text. In this scenario, the target policy text may only include the privacy policy text.

[0058] In some embodiments, such as for compliance engineers, the primary concern is whether the usage information of the data collected by the application is compliant. Compliance is reflected not only in the consistency between the usage information and the statements in the privacy policy text, but also in the fact that the privacy policy text meets compliance policy requirements. In this scenario, the target policy text may include both the privacy policy text and the compliance policy text.

[0059] In some embodiments, the target policy text may also include only the compliance policy text.

[0060] The second vector may include a second target sub-vector of the privacy policy text, a first target sub-vector of the privacy statement information, and a first sub-vector of the compliance policy text. The first sub-vector may be the full-text vector of the compliance policy text, and the second target sub-vector may be the full-text vector of the privacy policy text.

[0061] It should be noted that since compliance policy texts, such as GDPR, are typically relatively fixed and do not change frequently, the data compliance detection system can preprocess the text to obtain the first sub-vector of the compliance policy text before receiving a data compliance detection request from an application. Alternatively, upon receiving a data compliance detection request from an application, the system can call the compliance information management module to determine whether the first sub-vector of the compliance policy text is stored in the database. If it is not stored, the orchestration module can call the vector conversion module to convert the compliance policy text into vector form. If it is stored, the first sub-vector of the compliance policy text can be retrieved from the corresponding database.

[0062] In some embodiments, such as Figure 3 As shown, the data compliance detection system's processing and interaction with compliance policy texts can be as follows:

[0063] 1) The orchestration module receives vector conversion requests for compliance policy texts. These requests can be data compliance inspection requests, and the compliance policy texts can be GDPR, etc.

[0064] 2) The orchestration module forwards the vector transformation request to the vector transformation module;

[0065] 3) The vector conversion module receives the vector conversion request, searches for the compliance policy document based on the policy attribute information carried in the request, converts the compliance policy document into text, and splits the text into text blocks;

[0066] 4) The vector conversion module selects a text block and sends a request to the text embedding model to convert the text block into a vector;

[0067] 5) The text embedding model receives the request and converts the text block into a vector;

[0068] 6) The text embedding model returns the transformed vector to the vector transformation module;

[0069] 7) The vector conversion module sends a request to the compliance information management module to store the vector;

[0070] 8) The compliance information management module receives storage requests and stores the vector of the text block;

[0071] 9) The compliance information management module responds to the vector conversion module to complete the vector storage; the above processes 4) and 9) can be repeated until the vector storage of all text blocks is completed. In this way, storing the vectors of the text blocks in the order of the text blocks can also achieve the effect of vector concatenation and obtain the full-text vector of the compliance policy text.

[0072] 10) The vector conversion module responds to the arrangement module indicating that the compliance policy text conversion is complete;

[0073] 11) The orchestration module has completed the conversion of the compliance policy text.

[0074] In some embodiments, after the vector conversion module completes the text conversion of all text blocks, the vectors of each text block can be concatenated to obtain the full-text vector of the compliance policy text, i.e., the first sub-vector, and then a storage request for the full-text vector can be sent to the compliance information management module.

[0075] In some embodiments, such as Figure 4 As shown, the data compliance detection system's processing and interaction process for privacy policy text can be as follows:

[0076] 1) The orchestration module receives a data compliance check request from the application;

[0077] 2) The orchestration module forwards data compliance detection requests to the vector conversion module;

[0078] 3) The vector conversion module receives data compliance detection requests and searches for privacy policy documents based on policy attribute information. After finding relevant documents, it converts them into privacy policy text.

[0079] 4) The vector conversion module extracts privacy statement information from the privacy policy text to obtain a second information list. Each entry in the second information list is a privacy statement, and each entry includes, but is not limited to, the data collection subject, data information, and data collection target, i.e., the operation performed on the collected data.

[0080] 5) The vector conversion module sends a storage request for the second information list to the privacy statement information management module;

[0081] 6) The privacy statement information management module stores a second information list;

[0082] 7) The privacy statement information management module responds to the vector conversion module, indicating that the information storage is complete;

[0083] 8) The vector conversion module splits the privacy policy text into text blocks;

[0084] 9) The vector conversion module selects a text block and sends a request to the text embedding model to convert the text block into a vector;

[0085] 10) The text embedding model receives the request and converts the text block into a fifth vector;

[0086] 11) The text embedding model returns the fifth vector to the vector transformation module;

[0087] 12) The vector conversion module sends a storage request for the fifth vector to the privacy statement information management module.

[0088] 13) The privacy statement information management module receives the storage request and stores the fifth vector;

[0089] 14) The privacy statement information management module responds to the vector conversion module that the vector storage is complete; the above processes 9) and 14) can be repeated until the vector storage of all text blocks is completed. In this way, storing the vectors of the text blocks in the order of the text blocks can also achieve the effect of vector concatenation and obtain the full-text vector of the privacy policy text.

[0090] 15) The vector conversion module responds to the layout module that the privacy policy text conversion is complete;

[0091] 16) The orchestration module has completed the conversion of the privacy policy text.

[0092] In some embodiments, the method further includes:

[0093] The privacy policy text is divided into K text blocks, where K is a positive integer;

[0094] Perform text feature mapping on each text block to obtain K fifth vectors for the K text blocks;

[0095] The K fifth vectors are concatenated to obtain the second target sub-vector.

[0096] In other words, after the vector conversion module completes the text conversion of all text blocks, the vectors of each text block can be concatenated to obtain the full-text vector of the privacy policy text, i.e., the second target sub-vector. Then, a storage request for the full-text vector is sent to the privacy statement information management module. This enables the conversion of the privacy policy text and simplifies the interaction between modules in the data compliance detection system.

[0097] The orchestration module can communicate with the consistency analysis management module. Once it has obtained the full-text vectors of usage behavior information, privacy statement information, compliance policy text, and privacy policy text, it can call the consistency analysis management module to perform consistency checks between the usage behavior information and the target policy text.

[0098] In some embodiments, the first vector can be matched with the first sub-vector. If the match is successful, it can be determined that the usage behavior information of the data collected by the application is compliant. If the match is unsuccessful, it can be determined that the usage behavior information of the data collected by the application is non-compliant.

[0099] In some embodiments, the first vector can be matched with the second target sub-vector. If the match is successful, it can be determined that the usage behavior information of the data collected by the application is consistent with the statement in the privacy policy text and that the usage behavior information is compliant. If the match is unsuccessful, it can be determined that the usage behavior information of the data collected by the application is inconsistent with the statement in the privacy policy text and that the usage behavior information is non-compliant.

[0100] Since the application can collect multiple pieces of usage behavior information, the target detection result can refer to the compliance level of the usage behavior information, such as 80% compliance, or a summary result of whether each piece of usage behavior information is compliant. The target detection result can be displayed in the form of text, images, tables, etc.

[0101] In this embodiment, upon receiving a data compliance detection request from an application, the system obtains usage behavior information of the data collected by the application based on the request. This usage behavior information is then mapped using text features to obtain a first vector. Subsequently, based on the first vector and a second vector corresponding to a pre-acquired target policy text, a consistency check is performed between the usage behavior information and the target policy text. This yields a target detection result indicating whether the usage behavior information of the data collected by the application is compliant. Thus, data compliance detection of applications can be automated using artificial intelligence (AI), improving the efficiency of application data compliance detection.

[0102] In some embodiments, the target policy text includes a compliance policy text and the privacy policy text, and the second vector includes a first sub-vector corresponding to the compliance policy text and a second sub-vector corresponding to the privacy policy text; step 103 specifically includes:

[0103] Based on the first sub-vector and the second sub-vector, the privacy policy text is subjected to compliance detection to obtain a first detection result. The first detection result is used to indicate whether the statement in the privacy policy text complies with the requirements of the compliance policy text.

[0104] Based on the first vector and the second sub-vector, a consistency detection is performed on the usage behavior information and the privacy policy text to obtain a second detection result. The second detection result is used to indicate whether the usage behavior information is consistent with the statement in the privacy policy text.

[0105] Based on the first detection result and the second detection result, the target detection result is determined.

[0106] The second sub-vector may include the full-text vector of the privacy policy text, i.e., the second target sub-vector. In some embodiments, the second target sub-vector may be matched with the first sub-vector, i.e., the full-text vector of the privacy policy text may be matched with the full-text vector of the compliance policy text, to perform compliance detection on the privacy policy text and obtain a first detection result.

[0107] In some embodiments, the privacy policy text includes privacy statement information about the data collected by the application, and the second sub-vector includes a first target sub-vector of the privacy statement information. The compliance check on the privacy policy text based on the first sub-vector and the second sub-vector to obtain a first detection result includes:

[0108] The first target subvector is matched with the first subvector to obtain the first matching result;

[0109] Based on the first matching result, the privacy policy text is subjected to compliance testing to obtain the first testing result.

[0110] In some embodiments, the first matching result can be either a successful or unsuccessful vector match. If the vector match is successful, it can be determined that the privacy policy text complies with the requirements of the compliance policy text. If the vector match fails, it can be determined that the privacy policy text does not comply with the requirements of the compliance policy text.

[0111] It should be noted that vector matching can be performed using a text embedding model. The output of vector matching is usually the probability of matching. A threshold (e.g., 90%) can be preset. If the probability of matching is greater than or equal to the threshold, the vector matching is considered successful. If the probability of matching is less than the threshold, the vector matching is considered unsuccessful.

[0112] In some embodiments, the first matching result includes a third vector in the first sub-vector that matches the first target sub-vector. The step of performing compliance checks on the privacy policy text based on the first matching result to obtain the first detection result includes:

[0113] Obtain the compliance information corresponding to the third vector from the compliance policy text;

[0114] The privacy statement information and the compliance information are semantically matched to obtain the first detection result.

[0115] The number of third vectors can be multiple. The first matching result can include P third vectors in the first sub-vector that are arranged in descending order of their matching degree with the first target sub-vector.

[0116] Specifically, the first detection result can be obtained by semantically matching the privacy statement information and compliance information based on a consistency analysis model. The consistency analysis model can be a small language model fine-tuned from an open-source model, possessing semantic matching capabilities and the ability to summarize analysis results. The consistency analysis management module can construct sample prompts based on the privacy statement information and compliance information and send them to the consistency analysis model. Correspondingly, the consistency analysis model can perform semantic matching between the privacy statement information and compliance information based on the sample prompts to obtain the first detection result.

[0117] This embodiment uses a combination of vector matching and text semantic matching to perform compliance checks on privacy policy texts, which can improve the accuracy of compliance checks on privacy policy texts, thereby improving the accuracy of data compliance checks on applications.

[0118] In some embodiments, the number of privacy statement information items is M, where M is an integer greater than 1. The semantic matching of the privacy statement information and the compliance information to obtain the first detection result includes:

[0119] Semantic matching is performed on each of the privacy statement information and the compliance information to obtain M first sub-detection results;

[0120] The M first sub-detection results are aggregated and processed to obtain the first detection result.

[0121] The first sub-result can be whether the privacy statement information complies with the requirements of the compliance policy text. The first result can refer to the degree of compliance of each privacy statement, such as 80% compliance, or the summary result of whether each privacy statement is compliant. The first result can be displayed in the form of text, images, tables, etc.

[0122] The data compliance detection system may also include a detection result management module. The orchestration module can communicate with the detection result management module. Once the orchestration module determines that the consistency analysis management module has completed the compliance detection analysis of the privacy statement information, it can call the detection result management module. Correspondingly, the detection result management module can use the consistency analysis model to automatically summarize and process the M first sub-detection results to obtain the first detection result. Furthermore, it can classify the first sub-detection results according to the data collection subject and data type, and automatically summarize and process them according to the classification. This makes the first detection result clearer and more concise, improving the presentation of the detection results.

[0123] In some embodiments, such as Figure 5 As shown, the data compliance inspection system's interaction process for verifying the compliance of privacy statement information can be as follows:

[0124] 1) The orchestration module sends a compliance check request for the privacy statement information to the consistency analysis and management module;

[0125] 2) The consistency analysis management module uses the privacy statement information management module to obtain an entry from the second information list;

[0126] 3) The consistency analysis management module communicates with the text embedding model to convert the privacy statement information into the first target sub-vector;

[0127] 4) The consistency analysis management module communicates with the compliance information management module and the text embedding model to obtain the top P third vectors that are closest to the query entry through vector similarity search, and sort them according to their proximity to the query entry;

[0128] 5) The consistency analysis management module communicates with the compliance information management module to obtain compliance information for each third vector from the compliance policy text;

[0129] 6) The consistency analysis management module generates sample prompt information, for example,

[0130] Context: Compliance information for P third vectors,

[0131] Question: Does the privacy statement information fit the "context" of the following compliance information?

[0132] 7) The consistency analysis management module sends sample prompt information to the consistency analysis model;

[0133] 8) The consistency analysis management module uses the consistency analysis model to obtain the first sub-detection result;

[0134] 9) The consistency analysis management module stores the first sub-detection result; repeat steps 2) to 9) until all entries in the second information list are analyzed;

[0135] 10) The Consistency Analysis Manager responds to the Orchestration Module, indicating that the compliance check for the privacy statement information is complete;

[0136] 11) The orchestration module sends a result summary request to the test result management module;

[0137] 12) The detection result management module retrieves the first sub-detection result from the database;

[0138] 13) The test result management module generates sample prompt information, for example,

[0139] Context: First sub-detection result,

[0140] Question: Summarize the "context" of the following detection results;

[0141] 14) The test result management module sends the generated sample prompt information to the consistency analysis model;

[0142] 15) The test result management module uses a consistency analysis model to obtain summary results;

[0143] 16) The detection result management module stores the summary results; repeat steps 12) to 16) until the summarization of the M first sub-detection results is completed;

[0144] 17) The test result management module obtains the first test result;

[0145] 18) The test result management module responds to the orchestration module to complete the result summary.

[0146] In some embodiments, the second sub-vector includes a second target sub-vector of the privacy policy text. The step of performing consistency detection on the usage behavior information and the privacy policy text based on the first vector and the second sub-vector to obtain a second detection result includes:

[0147] The first vector is matched with the second target sub-vector to obtain the second matching result;

[0148] Based on the second matching result, a consistency check is performed on the usage behavior information and the privacy policy text to obtain the second detection result.

[0149] In some embodiments, the second matching result can be either a successful or unsuccessful vector match. If the vector match is successful, it can be determined that the usage behavior information is consistent with the statements in the privacy policy text. If the vector match fails, it can be determined that the usage behavior information is inconsistent with the statements in the privacy policy text.

[0150] In some embodiments, the second matching result includes a fourth vector in the second target sub-vector that matches the first vector. The step of performing consistency detection on the usage behavior information and the privacy policy text based on the second matching result to obtain the second detection result includes:

[0151] Obtain the privacy text information corresponding to the fourth vector from the privacy policy text;

[0152] The usage behavior information and the privacy text information are semantically matched to obtain the second detection result.

[0153] The number of fourth vectors can be multiple, and the second matching result can include L fourth vectors from the second target sub-vectors, arranged in descending order of their matching degree with the first vector.

[0154] Specifically, a second detection result can be obtained by semantically matching usage behavior information and privacy text information based on a consistency analysis model. The consistency analysis model can be a small model fine-tuned from an open-source model, possessing semantic matching capabilities and the ability to summarize analysis results. Sample prompts can be constructed based on usage behavior information and privacy text information and input into the consistency analysis model. Correspondingly, the consistency analysis model can perform semantic matching between the usage behavior information and privacy text information to obtain the second detection result.

[0155] This embodiment uses vector matching combined with text semantic matching to perform consistency detection on usage behavior information and privacy text information, which can improve the accuracy of consistency detection between usage behavior information and privacy text information, thereby improving the accuracy of data compliance detection for applications.

[0156] In some embodiments, the number of usage behavior information items is N, where N is an integer greater than 1. The step of semantically matching the usage behavior information with the privacy text information to obtain the second detection result includes:

[0157] Semantic matching is performed on each of the usage behavior information and the privacy text information to obtain N second sub-detection results;

[0158] The N second sub-detection results are aggregated and processed to obtain the second detection result.

[0159] The second sub-detection result can be whether the usage behavior information is consistent with the privacy policy text. This second result can refer to the degree of consistency between each piece of usage behavior information and the privacy policy text, such as 80% consistency, or a summary result of the consistency between each piece of usage behavior information and the privacy policy text. The second result can be displayed in the form of text, images, tables, etc.

[0160] Once the orchestration module confirms that the consistency analysis management module has completed the consistency analysis between the user behavior information and the privacy policy text statement, the detection result management module can be invoked. Correspondingly, the detection result management module can call the consistency analysis model to automatically aggregate and process N second sub-detection results to obtain the second detection result. Furthermore, the second sub-detection results can be categorized according to the data collection subject and data type, and automatically aggregated according to the category. This makes the second detection result clearer and more concise, improving the presentation of the detection results.

[0161] In some embodiments, such as Figure 6 As shown, the interaction process of the data compliance detection system in detecting the consistency between usage behavior information and the privacy policy text statement can be as follows:

[0162] 1) The orchestration module sends a consistency check request between the usage behavior information and the privacy policy text statement to the consistency analysis and management module;

[0163] 2) The consistency analysis management module uses the data flow information management module to obtain an entry from the first information list;

[0164] 3) The consistency analysis management module communicates with the text embedding model to convert the items in the first information list into the first vector;

[0165] 4) The consistency analysis management module communicates with the privacy statement information management module and the text embedding model to obtain the top L fourth vectors that are closest to the query entry through vector similarity search, and sort them according to their proximity to the query entry;

[0166] 5) The consistency analysis management module communicates with the privacy statement information management module to obtain the privacy text information of each fourth vector from the privacy policy text;

[0167] 6) The consistency analysis management module uses sample prompts, for example,

[0168] Context: Privacy-preserving text information for each fourth vector.

[0169] Question: Is the use of behavioral information consistent with the "context" of the following privacy policy text statement?

[0170] 7) The consistency analysis management module sends sample prompt information to the consistency analysis model;

[0171] 8) The consistency analysis management module uses the consistency analysis model to obtain the second sub-detection result;

[0172] 9) The consistency analysis management module stores the results of the second sub-detection; repeat steps 2) to 9) until all entries in the first information list are analyzed;

[0173] 10) The consistency analysis management module responds to the orchestration module, indicating that the consistency check between the usage behavior information and the privacy policy text statement is complete;

[0174] 11) The consistency analysis management module sends a result summary request to the detection result management module;

[0175] 12) The detection result management module retrieves the second sub-detection result from the database;

[0176] 13) The test result management module generates sample prompt information, for example,

[0177] Context: Second sub-detection result,

[0178] Question: Summarize the "context" of the following detection results;

[0179] 14) The test result management module sends the generated sample prompt information to the consistency analysis model;

[0180] 15) The test result management module uses a consistency analysis model to obtain summary results;

[0181] 16) The detection result management module stores the summary results; repeat steps 12) to 16) until the N second sub-detection results are summarized;

[0182] 17) The test result management module obtains the second test result;

[0183] 18) The test result management module responds to the orchestration module to complete the result summary.

[0184] In some embodiments, the use behavior information of the data collected by the application may be determined to be compliant if the first detection result indicates that the statement in the privacy policy text complies with the requirements of the compliance policy text and the second detection result indicates that the use behavior information is consistent with the statement in the privacy policy text. Conversely, the use behavior information of the data collected by the application may be determined to be non-compliant if the first detection result indicates that the statement in the privacy policy text does not comply with the requirements of the compliance policy text, or if the second detection result indicates that the use behavior information is inconsistent with the statement in the privacy policy text.

[0185] In some embodiments, the use behavior information of the data collected by the application may be determined to be compliant if the second detection result indicates that the use behavior information is consistent with the statement in the privacy policy text, and non-compliant if the second detection result indicates that the use behavior information of the data collected by the application is inconsistent with the statement in the privacy policy text.

[0186] In some embodiments, such as Figure 7 The diagram provides a specific example of a data compliance detection system, which may include an orchestration module, a vector conversion module, a privacy statement information management module, a compliance information management module, a data flow information management module, a data flow analysis module, a consistency analysis management module, and a detection result management module.

[0187] The data compliance detection system may also include a text embedding model and a consistency analysis model for module calls within the system, enabling text feature mapping, semantic matching, and result summarization. The data flow analysis module can also call data flow analysis tools (such as SDK hook tools and application API hook tools) to monitor application data flow information. Additionally, the data compliance detection system may include multiple databases, such as... Figure 7As shown, the data compliance detection system includes two types of databases. Database 1 can be used to store a first information list, a second information list, and detection results. Database 2 can be used for vectors of privacy policy texts and compliance policy texts. It should be noted that this embodiment does not limit the number of databases; for example, one database can be configured for storing each type of information. This data compliance detection system can achieve the following: Figure 2-6 The interactive flow is shown.

[0188] In this embodiment, based on multiple small language models finely tuned from the open-source model, information related to data usage behavior can be automatically extracted from the lengthy and difficult-to-understand privacy policy and compliance policy texts of applications. At the same time, it can automatically determine whether the application's privacy policy text statement complies with compliance policy requirements, and detect whether the data usage behavior information collected by the application is consistent with the privacy policy text statement. This can save a lot of manpower costs for security compliance engineers before the application is released, and make it more convenient for users to perform compliance checks on the applications they are using at any time, ensuring user rights.

[0189] It should be noted that the data compliance detection method provided in this application embodiment can be executed by a data compliance detection device or a control module within the data compliance detection device for executing the data compliance detection method. This application embodiment uses the execution of the data compliance detection method by a data compliance detection device as an example to illustrate the data compliance detection device provided in this application embodiment.

[0190] See Figure 8 , Figure 8 This is a schematic diagram of the data compliance detection device provided in this application embodiment. The device includes:

[0191] The acquisition module 801 is used to acquire first information of the application based on the data compliance detection request received from the application, wherein the first information includes usage behavior information of the data collected by the application.

[0192] The first text feature mapping module 802 is used to perform text feature mapping on the usage behavior information to obtain a first vector of the usage behavior information;

[0193] The detection module 803 is used to perform consistency detection on the usage behavior information and the target policy text based on the first vector and the second vector corresponding to the pre-acquired target policy text, and obtain a target detection result. The target detection result is used to indicate whether the usage behavior information is compliant. The target policy text includes at least one of a compliance policy text and the privacy policy text of the application.

[0194] In some embodiments, the target policy text includes a compliance policy text and the privacy policy text, and the second vector includes a first sub-vector corresponding to the compliance policy text and a second sub-vector corresponding to the privacy policy text; the detection module 803 includes:

[0195] The first detection unit is used to perform compliance detection on the privacy policy text based on the first sub-vector and the second sub-vector to obtain a first detection result. The first detection result is used to indicate whether the statement in the privacy policy text complies with the requirements of the compliance policy text.

[0196] The second detection unit is used to perform consistency detection on the usage behavior information and the privacy policy text based on the first vector and the second sub-vector, and obtain a second detection result. The second detection result is used to indicate whether the usage behavior information is consistent with the statement in the privacy policy text.

[0197] A determining unit is configured to determine the target detection result based on the first detection result and the second detection result.

[0198] In some embodiments, the privacy policy text includes privacy statement information about the data collected by the application, the second sub-vector includes a first target sub-vector of the privacy statement information, and the first detection unit is specifically used for:

[0199] The first target subvector is matched with the first subvector to obtain the first matching result;

[0200] Based on the first matching result, the privacy policy text is subjected to compliance testing to obtain the first testing result.

[0201] In some embodiments, the first matching result includes a third vector in the first sub-vector that matches the first target sub-vector, and the first detection unit is further configured to:

[0202] Obtain the compliance information corresponding to the third vector from the compliance policy text;

[0203] The privacy statement information and the compliance information are semantically matched to obtain the first detection result.

[0204] In some embodiments, the number of privacy statement information items is M, where M is an integer greater than 1, and the first detection unit is further configured to:

[0205] Semantic matching is performed on each of the privacy statement information and the compliance information to obtain M first sub-detection results;

[0206] The M first sub-detection results are aggregated and processed to obtain the first detection result.

[0207] In some embodiments, the second sub-vector includes a second target sub-vector of the privacy policy text, and the second detection unit is specifically used for:

[0208] The first vector is matched with the second target sub-vector to obtain the second matching result;

[0209] Based on the second matching result, a consistency check is performed on the usage behavior information and the privacy policy text to obtain the second detection result.

[0210] In some embodiments, the second matching result includes a fourth vector in the second target sub-vector that matches the first vector, and the second detection unit is further configured to:

[0211] Obtain the privacy text information corresponding to the fourth vector from the privacy policy text;

[0212] The usage behavior information and the privacy text information are semantically matched to obtain the second detection result.

[0213] In some embodiments, the number of behavioral information used is N, where N is an integer greater than 1, and the second detection unit is further configured to:

[0214] Semantic matching is performed on each of the usage behavior information and the privacy text information to obtain N second sub-detection results;

[0215] The N second sub-detection results are aggregated and processed to obtain the second detection result.

[0216] In some embodiments, the apparatus further includes:

[0217] The text segmentation module is used to segment the privacy policy text into K text blocks, where K is a positive integer.

[0218] The second text feature mapping module is used to perform text feature mapping on each text block to obtain K fifth vectors for the K text blocks;

[0219] The vector concatenation module is used to concatenate the K fifth vectors to obtain the second target sub-vector.

[0220] In this embodiment, upon receiving a data compliance detection request from an application, the system obtains usage behavior information of the data collected by the application based on the request. This usage behavior information is then mapped using text features to obtain a first vector. Subsequently, based on the first vector and a second vector corresponding to a pre-acquired target policy text, a consistency check is performed between the usage behavior information and the target policy text. This yields a target detection result indicating whether the usage behavior information of the data collected by the application is compliant. Thus, data compliance detection of applications can be automated using artificial intelligence (AI), improving the efficiency of application data compliance detection.

[0221] The data compliance detection device in this application embodiment can be a device, or it can be a component, integrated circuit, or chip within a data compliance detection device. The data compliance detection device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0222] The data compliance detection device in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0223] The data compliance detection device provided in this application embodiment can achieve... Figure 1 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0224] Optionally, such as Figure 9As shown, this application embodiment also provides an electronic device 900, including a processor 901, a memory 902, and a program or instructions stored in the memory 902 and executable on the processor 901. When the program or instructions are executed by the processor 901, they implement the various processes of the above-described data compliance detection method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0225] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0226] Figure 10 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of this application.

[0227] The electronic device 1000 includes, but is not limited to, components such as: radio frequency unit 1001, network module 1002, audio output unit 1003, input unit 1004, sensor 1005, display unit 1006, user input unit 1007, interface unit 1008, memory 1009, and processor 1010.

[0228] Those skilled in the art will understand that the electronic device 1000 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 1010 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 10 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0229] Processor 1010, used for:

[0230] Upon receiving a data compliance detection request from an application, the application's first information is obtained based on the data compliance detection request. The first information includes usage behavior information of the data collected by the application.

[0231] The usage behavior information is mapped using text features to obtain a first vector of the usage behavior information.

[0232] Based on the first vector and the second vector corresponding to the pre-acquired target policy text, a consistency detection is performed on the usage behavior information and the target policy text to obtain a target detection result. The target detection result is used to indicate whether the usage behavior information is compliant. The target policy text includes at least one of a compliance policy text and the application's privacy policy text.

[0233] In this embodiment, upon receiving a data compliance detection request from an application, the system obtains usage behavior information of the data collected by the application based on the request. This usage behavior information is then mapped using text features to obtain a first vector. Subsequently, based on the first vector and a second vector corresponding to a pre-acquired target policy text, a consistency check is performed between the usage behavior information and the target policy text. This yields a target detection result indicating whether the usage behavior information of the data collected by the application is compliant. Thus, data compliance detection of applications can be automated using artificial intelligence (AI), improving the efficiency of application data compliance detection.

[0234] In some embodiments, the target policy text includes a compliance policy text and the privacy policy text, and the second vector includes a first sub-vector corresponding to the compliance policy text and a second sub-vector corresponding to the privacy policy text; the processor 1010 is configured to:

[0235] Based on the first sub-vector and the second sub-vector, the privacy policy text is subjected to compliance detection to obtain a first detection result. The first detection result is used to indicate whether the statement in the privacy policy text complies with the requirements of the compliance policy text.

[0236] Based on the first vector and the second sub-vector, a consistency detection is performed on the usage behavior information and the privacy policy text to obtain a second detection result. The second detection result is used to indicate whether the usage behavior information is consistent with the statement in the privacy policy text.

[0237] Based on the first detection result and the second detection result, the target detection result is determined.

[0238] In some embodiments, the privacy policy text includes privacy statement information about the data collected by the application, and the second sub-vector includes a first target sub-vector of the privacy statement information. The processor 1010 is configured to:

[0239] The first target subvector is matched with the first subvector to obtain the first matching result;

[0240] Based on the first matching result, the privacy policy text is subjected to compliance testing to obtain the first testing result.

[0241] In some embodiments, the first matching result includes a third vector in the first sub-vector that matches the first target sub-vector, and the processor 1010 is configured to:

[0242] Obtain the compliance information corresponding to the third vector from the compliance policy text;

[0243] The privacy statement information and the compliance information are semantically matched to obtain the first detection result.

[0244] In some embodiments, the number of privacy statement information items is M, where M is an integer greater than 1, and the processor 1010 is used for:

[0245] Semantic matching is performed on each of the privacy statement information and the compliance information to obtain M first sub-detection results;

[0246] The M first sub-detection results are aggregated and processed to obtain the first detection result.

[0247] In some embodiments, the second subvector includes a second target subvector of the privacy policy text, and the processor 1010 is used for:

[0248] The first vector is matched with the second target sub-vector to obtain the second matching result;

[0249] Based on the second matching result, a consistency check is performed on the usage behavior information and the privacy policy text to obtain the second detection result.

[0250] In some embodiments, the second matching result includes a fourth vector in the second target sub-vector that matches the first vector, and the processor 1010 is used to:

[0251] Obtain the privacy text information corresponding to the fourth vector from the privacy policy text;

[0252] The usage behavior information and the privacy text information are semantically matched to obtain the second detection result.

[0253] In some embodiments, the number of behavioral information items used is N, where N is an integer greater than 1, and the processor 1010 is used for:

[0254] Semantic matching is performed on each of the usage behavior information and the privacy text information to obtain N second sub-detection results;

[0255] The N second sub-detection results are aggregated and processed to obtain the second detection result.

[0256] In some embodiments, the processor 1010 is configured to:

[0257] The privacy policy text is divided into K text blocks, where K is a positive integer;

[0258] Perform text feature mapping on each text block to obtain K fifth vectors for the K text blocks;

[0259] The K fifth vectors are concatenated to obtain the second target sub-vector.

[0260] It should be understood that, in this embodiment, the input unit 1004 may include a graphics processing unit (GPU) 10041 and a microphone 10042. The GPU 10041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 1006 may include a display panel 10061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, or the like. The user input unit 1007 includes a touch panel 10071 and at least one of other input devices 10072. The touch panel 10071 is also called a touch screen. The touch panel 10071 may include a touch detection device and a touch controller. Other input devices 10072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be described in detail here.

[0261] The memory 1009 can be used to store software programs and various data. The memory 1009 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 1009 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 1009 in this embodiment includes, but is not limited to, these and any other suitable types of memory.

[0262] Processor 1010 may include one or more processing units; in some embodiments, processor 1010 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the modem processor may also not be integrated into processor 1010.

[0263] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described data compliance detection method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0264] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory, random access memory, magnetic disk, or optical disk.

[0265] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described data compliance detection method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0266] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0267] This application provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the data compliance detection method embodiments described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0268] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0269] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause an electronic device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0270] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A data compliance detection method, characterized in that, The method includes: Upon receiving a data compliance detection request from an application, the application's first information is obtained based on the data compliance detection request. The first information includes usage behavior information of the data collected by the application. The usage behavior information is mapped using text features to obtain a first vector of the usage behavior information. Based on the first vector and the second vector corresponding to the pre-acquired target policy text, a consistency detection is performed on the usage behavior information and the target policy text to obtain a target detection result. The target detection result is used to indicate whether the usage behavior information is compliant. The target policy text includes at least one of a compliance policy text and the application's privacy policy text.

2. The method according to claim 1, characterized in that, The target policy text includes a compliance policy text and the privacy policy text. The second vector includes a first sub-vector corresponding to the compliance policy text and a second sub-vector corresponding to the privacy policy text. The step of performing consistency detection on the usage behavior information and the target policy text based on the first vector and the pre-acquired second vector corresponding to the target policy text to obtain a target detection result includes: Based on the first sub-vector and the second sub-vector, the privacy policy text is subjected to compliance detection to obtain a first detection result. The first detection result is used to indicate whether the statement in the privacy policy text complies with the requirements of the compliance policy text. Based on the first vector and the second sub-vector, a consistency detection is performed on the usage behavior information and the privacy policy text to obtain a second detection result. The second detection result is used to indicate whether the usage behavior information is consistent with the statement in the privacy policy text. Based on the first detection result and the second detection result, the target detection result is determined.

3. The method according to claim 2, characterized in that, The privacy policy text includes privacy statement information about the data collected by the application. The second sub-vector includes a first target sub-vector of the privacy statement information. Based on the first sub-vector and the second sub-vector, compliance detection is performed on the privacy policy text to obtain a first detection result, including: The first target subvector is matched with the first subvector to obtain the first matching result; Based on the first matching result, the privacy policy text is subjected to compliance testing to obtain the first testing result.

4. The method according to claim 3, characterized in that, The first matching result includes a third vector in the first sub-vector that matches the first target sub-vector. The step of performing compliance checks on the privacy policy text based on the first matching result to obtain the first detection result includes: Obtain the compliance information corresponding to the third vector from the compliance policy text; The privacy statement information and the compliance information are semantically matched to obtain the first detection result.

5. The method according to claim 4, characterized in that, The number of privacy statement information items is M, where M is an integer greater than 1. The semantic matching of the privacy statement information and the compliance information to obtain the first detection result includes: Semantic matching is performed on each of the privacy statement information and the compliance information to obtain M first sub-detection results; The M first sub-detection results are aggregated and processed to obtain the first detection result.

6. The method according to claim 2, characterized in that, The second sub-vector includes a second target sub-vector of the privacy policy text. The second detection result, obtained by performing consistency detection on the usage behavior information and the privacy policy text based on the first vector and the second sub-vector, includes: The first vector is matched with the second target sub-vector to obtain the second matching result; Based on the second matching result, a consistency check is performed on the usage behavior information and the privacy policy text to obtain the second detection result.

7. The method according to claim 6, characterized in that, The second matching result includes the fourth vector in the second target sub-vector that matches the first vector. Based on the second matching result, the consistency detection of the usage behavior information and the privacy policy text is performed to obtain the second detection result, including: Obtain the privacy text information corresponding to the fourth vector from the privacy policy text; The usage behavior information and the privacy text information are semantically matched to obtain the second detection result.

8. The method according to claim 7, characterized in that, The number of usage behavior information items is N, where N is an integer greater than 1. The semantic matching of the usage behavior information with the privacy text information to obtain the second detection result includes: Semantic matching is performed on each of the usage behavior information and the privacy text information to obtain N second sub-detection results; The N second sub-detection results are aggregated and processed to obtain the second detection result.

9. The method according to claim 6, characterized in that, Before matching the first vector with the second target sub-vector to obtain the second matching result, the method further includes: The privacy policy text is divided into K text blocks, where K is a positive integer; Perform text feature mapping on each text block to obtain K fifth vectors for the K text blocks; The K fifth vectors are concatenated to obtain the second target sub-vector.

10. A data compliance detection device, characterized in that, The device includes: The acquisition module is used to acquire first information of the application based on the data compliance detection request received from the application, wherein the first information includes usage behavior information of the data collected by the application; The first text feature mapping module is used to perform text feature mapping on the usage behavior information to obtain a first vector of the usage behavior information; The detection module is used to perform consistency detection on the usage behavior information and the target policy text based on the first vector and the second vector corresponding to the pre-acquired target policy text, and obtain a target detection result. The target detection result is used to indicate whether the usage behavior information is compliant. The target policy text includes at least one of a compliance policy text and the privacy policy text of the application.

11. The apparatus according to claim 10, characterized in that, The target policy text includes a compliance policy text and a privacy policy text; the second vector includes a first sub-vector corresponding to the compliance policy text and a second sub-vector corresponding to the privacy policy text; the detection module includes: The first detection unit is used to perform compliance detection on the privacy policy text based on the first sub-vector and the second sub-vector to obtain a first detection result. The first detection result is used to indicate whether the statement in the privacy policy text complies with the requirements of the compliance policy text. The second detection unit is used to perform consistency detection on the usage behavior information and the privacy policy text based on the first vector and the second sub-vector, and obtain a second detection result. The second detection result is used to indicate whether the usage behavior information is consistent with the statement in the privacy policy text. A determining unit is configured to determine the target detection result based on the first detection result and the second detection result.

12. The apparatus according to claim 11, characterized in that, The privacy policy text includes a privacy statement regarding the data collected by the application, the second sub-vector includes a first target sub-vector of the privacy statement information, and the first detection unit is specifically used for: The first target subvector is matched with the first subvector to obtain the first matching result; Based on the first matching result, the privacy policy text is subjected to compliance testing to obtain the first testing result.

13. The apparatus according to claim 12, characterized in that, The first matching result includes a third vector in the first sub-vector that matches the first target sub-vector. The first detection unit is further configured to: Obtain the compliance information corresponding to the third vector from the compliance policy text; The privacy statement information and the compliance information are semantically matched to obtain the first detection result.

14. The apparatus according to claim 13, characterized in that, The number of privacy statement information items is M, where M is an integer greater than 1. The first detection unit is further configured to: Semantic matching is performed on each of the privacy statement information and the compliance information to obtain M first sub-detection results; The M first sub-detection results are aggregated and processed to obtain the first detection result.

15. The apparatus according to claim 11, characterized in that, The second sub-vector includes the second target sub-vector of the privacy policy text, and the second detection unit is specifically used for: The first vector is matched with the second target sub-vector to obtain the second matching result; Based on the second matching result, a consistency check is performed on the usage behavior information and the privacy policy text to obtain the second detection result.

16. The apparatus according to claim 15, characterized in that, The second matching result includes a fourth vector in the second target sub-vector that matches the first vector. The second detection unit is further configured to: Obtain the privacy text information corresponding to the fourth vector from the privacy policy text; The usage behavior information and the privacy text information are semantically matched to obtain the second detection result.

17. The apparatus according to claim 16, characterized in that, The number of usage behavior information items is N, where N is an integer greater than 1. The second detection unit is further configured to: Semantic matching is performed on each of the usage behavior information and the privacy text information to obtain N second sub-detection results; The N second sub-detection results are aggregated and processed to obtain the second detection result.

18. The apparatus according to claim 15, characterized in that, The device further includes: The text segmentation module is used to segment the privacy policy text into K text blocks, where K is a positive integer. The second text feature mapping module is used to perform text feature mapping on each text block to obtain K fifth vectors for the K text blocks; The vector concatenation module is used to concatenate the K fifth vectors to obtain the second target sub-vector.

19. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the data compliance detection method as described in any one of claims 1-9.

20. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the data compliance detection method as described in any one of claims 1-9.

Images