Privacy compliance detection method and device, electronic equipment and computer program product

Abstract

The embodiment of the invention is suitable for the technical field of data security, and provides a privacy compliance detection method and device, electronic equipment and a computer program product, and the method comprises the steps: determining state transition information of a to-be-detected application; controlling the to-be-detected application to run according to the state transition information so as to traverse a plurality of preset page states of the to-be-detected application; in the running process of the to-be-detected application, extracting to-be-analyzed data; the to-be-analyzed data comprises privacy text data and application behavior data; and generating a compliance detection result based on the to-be-analyzed data and preset privacy compliance requirement information. According to the embodiment of the invention, the method can achieve the automatic operation of the to-be-detected application to traverse each page state, extracts the privacy text data and the application behavior data in the operation process of the to-be-detected application, and carries out the privacy compliance detection of the to-be-detected application based on the privacy text and the application behavior. And the efficiency, the coverage degree and the reliability of privacy compliance detection are improved.

Description

Technical Field

[0001] This application belongs to the field of data security technology, and in particular relates to privacy compliance detection methods, devices, electronic devices and computer program products. Background Technology

[0002] The number of applications on terminal devices is growing exponentially. However, due to the varying levels of skill among application developers, there may be non-compliant applications on the market, which could infringe upon users' rights to know and their privacy, and may also lead to the leakage of users' personal information.

[0003] Currently, existing application privacy compliance testing methods primarily employ dynamic analysis. Dynamic analysis mainly collects dynamic characteristics and data of applications during operation, typically within a sandbox environment or on a real physical device. Mainstream automated execution methods fall into two categories: pseudo-random flow and model / search-based methods.

[0004] For pseudo-random flow, the application is run randomly by setting runtime and simulating events. Model / search-based automation uses artificial intelligence models and finite state machines to determine state transitions dynamically during execution based on predefined settings. However, pseudo-random flow methods are aimless, inefficient, and prone to "dilemmas," leading to excessive time consumption to cover application runtime states, or failing to cover required runtime states despite setting acceptable runtime. Model / search-based automation methods often focus only on code coverage, accessing states unnecessary for compliance checks, ultimately impacting automation efficiency. Therefore, a currently lacking efficient and comprehensive solution for application privacy compliance checks is evident. Summary of the Invention

[0005] In view of this, embodiments of this application provide privacy compliance detection methods, apparatus, electronic devices, and computer program products to improve the efficiency, coverage, and reliability of privacy compliance detection.

[0006] The first aspect of this application provides a privacy compliance detection method, including: Determine the state transition information of the application to be tested; The application under test is controlled to run according to the state transition information to traverse multiple preset page states of the application under test; During the operation of the application under test, data to be analyzed is extracted; the data to be analyzed includes private text data and application behavior data. Based on the data to be analyzed and the preset privacy compliance requirements, a compliance detection result is generated.

[0007] In some implementations of the first aspect, the state transition information includes the page type and page elements corresponding to each page state; controlling the operation of the application to be tested according to the state transition information to traverse multiple preset page states of the application to be tested includes: Determine the page type and page elements of the current page state of the application to be detected; Simulate touch on the target page element corresponding to the page type to trigger the application to be detected to transition from the current page state to the next page state; If there are untraversed page states, return to the step of determining the page type and page elements of the current page state of the application to be detected.

[0008] In some implementations of the first aspect, the current page state is the page state of the current page of the application to be detected; determining the page type and page elements of the current page state of the application to be detected includes: The page type of the current page is identified using a preset screen classifier; A preset screen element classifier is used to identify the category of the page elements and their position on the current page. The screen classifier is obtained by training a first neural network with a preset page image and the page category label corresponding to the preset page image.

[0009] The screen element classifier is obtained by training a second neural network with a preset page image, the element category labels corresponding to the preset page image, and the training positions corresponding to the element category labels.

[0010] In some implementations of the first aspect, the current page state is the page state of the current page of the application to be detected; the simulated touch on the target page element corresponding to the page type includes: Determine the target page element corresponding to the page type; Simulated touch is performed on the target element position of the target page element.

[0011] In some implementations of the first aspect, the privacy text data is generated through the following steps: If it is determined that the current page of the privacy policy page of the application to be detected is a privacy policy page, obtain the privacy policy image; A trained large language model is used to generate privacy text data corresponding to the privacy policy image.

[0012] In some implementations of the first aspect, the use of a trained large language model to generate privacy text data corresponding to the privacy policy image includes: Extract the text content of the privacy policy image, as well as the prominent identification text in the privacy policy image; A trained large language model is used to generate structured information corresponding to the text content; The trained large language model is used to generate analytical information for the salient text. Based on the structured information and the analysis information, privacy-preserving text data is generated.

[0013] In some implementations of the first aspect, the application behavior data includes at least one of the following: interface call behavior information related to calling the application programming interface, plaintext transmission behavior information related to plaintext transmission to the server, page display behavior information related to page display, and interaction behavior information related to human-computer interaction.

[0014] A second aspect of this application provides a privacy compliance detection device, including: The state transition information determination module is used to determine the state transition information of the application to be detected; The operation control module is used to control the operation of the application to be tested according to the state transition information, so as to traverse multiple preset page states of the application to be tested; The data extraction module is used to extract data to be analyzed during the operation of the application to be detected; the data to be analyzed includes private text data and application behavior data. The detection module is used to generate compliance detection results based on the data to be analyzed and preset privacy compliance requirements.

[0015] A third aspect of this application provides an electronic device including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electronic device implements the privacy compliance detection method described in the first aspect above.

[0016] A fourth aspect of this application provides a computer program product, including a computer program that, when run, causes the privacy compliance detection method described in the first aspect above to be executed.

[0017] A fifth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the privacy compliance detection method described in the first aspect above.

[0018] The embodiments of this application have the following beneficial effects: This application embodiment determines the state transition information of the application under test; controls the operation of the application under test according to the state transition information to traverse multiple preset page states of the application under test; extracts data to be analyzed during the operation of the application under test; the data to be analyzed includes privacy text data and application behavior data; and generates compliance detection results based on the data to be analyzed and preset privacy compliance requirement information. This application embodiment can automate the operation of the application under test to traverse each page state and extract privacy text data and application behavior data during the operation of the application under test. It performs privacy compliance detection on the application under test based on two dimensions: privacy text and application behavior, thereby improving the efficiency, coverage, and reliability of privacy compliance detection. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of a privacy compliance detection method provided in an embodiment of this application; Figure 2 This is a privacy compliance detection architecture diagram provided in an embodiment of this application; Figure 3 This is a schematic diagram of a privacy policy pop-up page provided in an embodiment of this application; Figure 4 This is a schematic diagram of a privacy policy page provided in an embodiment of this application; Figure 5 This is a schematic diagram of another privacy policy page provided in an embodiment of this application; Figure 6 This is a schematic diagram of another privacy policy pop-up page provided in an embodiment of this application; Figure 7 This is a schematic diagram of another privacy policy page provided in an embodiment of this application; Figure 8 This is a schematic diagram of a privacy compliance detection device provided in an embodiment of this application; Figure 9 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0022] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0023] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0024] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0025] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0027] The technical solution of this application will be described below through specific embodiments.

[0028] Reference Figure 1The diagram illustrates a privacy compliance detection method provided in an embodiment of this application, which may specifically include the following steps: Step 101: Determine the state transition information of the application to be tested; Different testing modes can be performed on the application under test, including but not limited to normal mode (a pop-up agreeing to the privacy policy and agreeing to authorization), guest mode (a pop-up rejecting the privacy policy), and authorization denial mode (a pop-up agreeing to the privacy policy and denying authorization). Different testing processes can be preset for different modes. The pages to be tested and the options on the pages may not be the same for different testing processes. Page states can be defined according to preset rules to distinguish different pages and different attributes of page elements within the same page.

[0029] For example, the login page and the main page have different page states. The login page shows a different state depending on whether "Agree to the Privacy Policy" is checked.

[0030] It can determine the status of each page related to privacy compliance detection based on actual needs, and generate state transition information based on each page status. Under different actual needs (i.e., in different state transition information), the control method for the same page may not be the same.

[0031] For example, to check the compliance of an app under normal circumstances, you need to click the "Agree" button on the privacy policy page to allow access to the app while permitting it to obtain your personal information. To check the compliance of an app under guest mode, you need to click the "Refuse" or "Browse Only" button on the privacy policy page to allow browsing of the app while refusing access to your personal information.

[0032] Example 2: When testing the compliance of a specific version of an application under normal circumstances, clicking the "Agree" button on the privacy policy pop-up page satisfies both the normal situation (clicking the "Agree" button is required) and the specific version (agreeing to the privacy policy does not change the current version of the application under test). Similarly, clicking the "Deny" button on the update page satisfies both the normal situation (denying the update will not enter guest mode) and the specific version (clicking the "Deny" button will maintain the current version).

[0033] The embodiments of this application do not limit the operating system adapted to the application being tested.

[0034] Step 102: Control the operation of the application to be tested according to the state transition information to traverse multiple preset page states of the application to be tested; The application under test is controlled according to the state transition information, so that the application under test automatically switches to various page states according to the state transition information, so as to traverse multiple page states related to privacy compliance testing.

[0035] Since page states include different pages and different attributes that distinguish page elements within the same page, the application under test is controlled to jump between pages or switch page element attributes (such as checking checkboxes) according to the state transition information. This controls the state transition of the application under test, and multiple preset page states can be traversed through one or more state transitions.

[0036] In practical applications, the page state switching of the application under test can be customized according to privacy policy compliance requirements, so that it can focus on the page states required for privacy compliance testing and the page state transition logic. Based on the state transition information obtained from the page state transition logic, the application under test can be run automatically.

[0037] Step 103: During the operation of the application to be tested, extract the data to be analyzed; the data to be analyzed includes privacy text data and application behavior data; During the operation of the application under test, the page state of the application under test undergoes one or more state transitions. During these state transitions, data to be analyzed for privacy compliance analysis is extracted.

[0038] The data to be analyzed includes privacy text data and application behavior data. Privacy text data may include the content of the privacy policy text and prominent privacy policy labels. Application behavior data may include behavioral data of the applications to be analyzed that are related to privacy policy behavior.

[0039] Step 104: Generate compliance test results based on the data to be analyzed and the preset privacy compliance requirements.

[0040] Privacy compliance requirements can be preset, and it can be determined whether the data to be analyzed complies with the privacy compliance requirements. The privacy compliance requirements are used to judge the data to be analyzed, and compliance test results are generated.

[0041] The compliance test results include those that comply with privacy policy requirements and those that do not. For cases of non-compliance, the compliance test results also include the portions of the data to be analyzed that do not comply with privacy policy requirements. This application embodiment can also determine the consistency between privacy text data and application behavior data. The compliance test results also include those that are consistent between privacy text data and application behavior data, and those that are inconsistent. For cases of inconsistency between privacy text data and application behavior data, the compliance test results also include the portions of the application behavior data that are inconsistent with the privacy text data.

[0042] This application embodiment determines the state transition information of the application under test; controls the operation of the application under test according to the state transition information to traverse multiple preset page states of the application under test; extracts data to be analyzed during the operation of the application under test; the data to be analyzed includes privacy text data and application behavior data; and generates compliance detection results based on the data to be analyzed and preset privacy compliance requirement information. This application embodiment can automate the operation of the application under test to traverse each page state and extract privacy text data and application behavior data during the operation of the application under test. It performs privacy compliance detection on the application under test based on two dimensions: privacy text and application behavior, thereby improving the efficiency, coverage, and reliability of privacy compliance detection.

[0043] Reference Figure 2 This diagram illustrates a privacy compliance detection architecture provided by an embodiment of this application. In some implementations of this application, the state transition information includes the page type and page elements corresponding to each page state; step 102 includes: determining the page type and page elements of the current page state of the application to be detected; simulating touch on the target page element corresponding to the page type to trigger the application to be detected to transition from the current page state to the next page state; and, if there are untraversed page states, returning to the step of determining the page type and page elements of the current page state of the application to be detected.

[0044] The state transition information records the page type and page elements corresponding to each page state. The page type is used to represent different categories of pages, and the categories can be predefined. For example, the page type can include, but is not limited to, a privacy policy pop-up page, a main page, and a settings page. Page elements can be touchable objects on the page, and page elements can include, but are not limited to, hyperlinks, controls, and input areas.

[0045] During the automated operation of the application under test, the system automatically identifies the current page state of the application, determines the page type and page elements of the current page state, identifies the target page element from the current page elements according to the page type, and simulates touch on the target page element (e.g., simulating a user click) to switch the application under test to a next page state different from the current page state. Simultaneously, the system records the page states traversed during the operation of the application under test. If there are untraversed page states, it indicates that all page states included in the current state transition information have not been covered; therefore, the system returns to the process of determining the current page state of the application under test until no untraversed page states remain.

[0046] In some implementations of this application, the current page state is the page state of the current page of the application to be detected; determining the page type and page elements corresponding to the current page state includes: using a preset screen classifier to identify the page type of the current page; using a preset screen element classifier to identify the category of the page elements and the element position of the page elements on the current page; the screen classifier is obtained by training a first neural network with a preset page image and the page category label corresponding to the preset page image; the screen element classifier is obtained by training a second neural network with a preset page image, the element category label corresponding to the preset page image, and the training position corresponding to the element category label.

[0047] First, a first neural network can be determined, along with a preset page image and its corresponding page category label. Then, the first neural network is trained using the preset page image and its corresponding page category label to obtain a screen classifier. The page category label describes the category to which the entire page belongs, such as: privacy policy pop-up page, home page, settings page, login page, update page, etc.

[0048] Using the first trained neural network as a screen classifier, it can identify the page displayed by the application to be detected and output the page type corresponding to that page.

[0049] First, a second neural network can be determined, along with a preset page image and its corresponding element category labels. Then, the second neural network is trained using the preset page image and its corresponding element category labels to obtain a screen element classifier. The element category labels describe elements on the page, such as controls, text, and images.

[0050] The trained second neural network is used as a screen element classifier. The screen element classifier can identify the category of each page element in the application to be detected, as well as the position of the page element, i.e., the element position.

[0051] The preset page images and page category labels used to train the first neural network, and the preset page images and element category labels used to train the second neural network, can be collected from multiple applications to improve the applicability of the screen classifier and screen element classifier to different applications in this embodiment. In specific implementations, different applications differ significantly in their specific functional pages, such as shopping pages and chat pages; however, they share high similarity in their basic functional pages (privacy policy pages, home pages, login pages, settings pages, etc.). Based on the specific functional pages and basic functional pages of a large number of applications and their corresponding page elements, existing application state transition logic is implemented.

[0052] This application does not limit the network structure or network parameters of the first and second neural networks. The screen classifier can determine the page type corresponding to the page of the application to be detected, and the screen element classifier can identify the page elements in the page and the position of the page elements in the page.

[0053] like Figure 2 The page state transition section shown in the figure is based on a screen classifier and page element classifier of a neural network to realize the page state recognition and switching of the application to be detected, thereby realizing the dynamic and automated operation of the application to be detected.

[0054] In some implementations of the embodiments of this application, the current page state is the page state of the current page of the application to be detected; simulating touch on the target page element corresponding to the page type of the current page state includes: determining the target page element corresponding to the page type of the current page state; and simulating touch on the target element position of the target page element.

[0055] Clicking on the same category of elements on different types of pages will have different effects. For example, on a privacy policy pop-up page, clicking the "Agree" button will normally lead to the next page required for privacy policy compliance, while clicking the "Reject" button may cause the application under test to exit. On an application update page, clicking the "Agree" button will result in version inconsistency, affecting the detection of the current version of the application under test, while clicking the "Reject" button can either cancel the update normally or force an update, causing the application under test to exit.

[0056] This determines the page element corresponding to the current page state and page type as the target page element, determines the position of the target page element as the target element position, and then simulates touch on the target element position to simulate user operation, such as simulating a user clicking on the target position to touch the target page element located at the target position.

[0057] In some implementations of this application, privacy text data is generated through the following steps: when it is determined that the current page of the application to be detected is a privacy policy page, obtaining a privacy policy image; and using a trained large language model to generate privacy text data corresponding to the privacy policy image.

[0058] During the process of controlling the application under test according to the state transition information, it is identified whether the current page of the application under test is a privacy policy page. A privacy policy page is a page that displays privacy policy content. If it is determined that the current page of the application under test is a privacy policy page, a privacy policy image is obtained. The privacy policy image is a screenshot containing the privacy policy content. In order to obtain the complete privacy policy image, the current page can be scrolled up and screenshots can be taken in a loop. When the current page is scrolled to the bottom, the privacy policy image with complete privacy policy content can be obtained.

[0059] After obtaining the privacy policy image, the content in the privacy policy image is structured based on a large language model, outputting structured privacy text data, which facilitates multi-dimensional analysis of the privacy text data.

[0060] In some implementations of this application, a trained large language model is used to generate privacy text data corresponding to the privacy policy image, including: extracting the text content of the privacy policy image and the prominent identification text in the privacy policy image; using a trained large language model to generate structured information corresponding to the text content; using a trained large language model to generate analysis information of the prominent identification text; and generating privacy text data based on the structured information and the analysis information of the prominent identification text.

[0061] like Figure 2 As shown, in the specific implementation, when the application to be detected accesses a page with a privacy policy entry point (e.g., a privacy policy pop-up page, login page, settings page), the screen element recognizer identifies the text of the privacy policy control or hyperlink, such as: privacy policy, privacy policy, privacy statement, etc. Then, the recognized privacy policy control or hyperlink is touched, and it is determined whether the page redirects. If a redirect occurs, it is determined that the text is a privacy policy control or hyperlink and the redirected page is the privacy policy page. Then, the privacy policy image is obtained as described above.

[0062] The privacy text data contains structured information and analytical information of salient text. The structured information is the information that structures the full text of the privacy policy text, while the analytical information of salient text is the information that structures the content that is prominently displayed in the privacy policy text. The specified styles of salient text include: bold, italic, blue, red, etc. The generation process of the structured information and analytical information of salient text will be further explained below.

[0063] Based on the obtained privacy policy image, the privacy policy content is structured and analyzed, including the prominent text of the privacy policy content. Specifically, this may include using optical character recognition technology to extract the text content from the privacy policy image.

[0064] A trained large language model is used to generate structured information corresponding to the text content, including three forms: 1. Whether the text contains specific information, with the structure: {"whether": "", "based on page number": "", "detailed evidence": []}. Based on this structure, it can be used to structure whether it explicitly states that personal information will be collected; 2. If the text describes specific information, key information is extracted, with the structure: {"information": ""}. This can be used to structure information such as customer service email information; 3. Information with similar characteristics is structured, such as: a description of the frequency of personal information collection {"personal information type": "", "frequency": "", "related business function": ""}. Through the above three structuring methods, a comprehensive analysis of the privacy policy text is achieved, which is used for compliance review of the privacy policy text content.

[0065] This involves extracting text styles from privacy policy images, such as black, red, and blue extraction based on color thresholds. It also retrieves the text content corresponding to specified text styles. A trained large language model is used to construct corresponding text style analysis information for the above-mentioned saliently marked text content, including: 1. Whether it contains personal information; 2. Extracting text style tags related to personal information.

[0066] Through the above methods, this application embodiment achieves a comprehensive analysis of the text content and style of the privacy policy.

[0067] In some implementations of this application, the application behavior data includes at least one of the following: interface call behavior information related to calling the application programming interface, plaintext transmission behavior information related to plaintext transmission to the server, page display behavior information related to page display, and human-computer interaction behavior information.

[0068] Interface call behavior information refers to information related to a specified application programming interface (API), such as IMEI (International Mobile Equipment Identity). Dynamic instrumentation tools can be used to collect call information for a specified API during the actual operation of the application under test, such as call time and call stack. User interaction information can record the timing of simulated user click events, back events, foreground / background switching, etc., which can be used in conjunction with calls to specified APIs to determine whether the collection of personal information is compliant, or to distinguish the running state of the application under test, such as silent state or background operation.

[0069] Plaintext transmission behavior information refers to network information exchanged between the local and remote servers. By setting up an HTTP (Hypertext Transfer Protocol) proxy, network information, including time and content—that is, plaintext transmission behavior information—can be obtained without affecting the actual operation of network requests.

[0070] The page display behavior information is the page information used by the user. During the page state transition process of the above-mentioned application to be tested, a screenshot is taken before each state jump to determine whether the page content is compliant. For example, if the privacy policy pop-up page does not provide both "agree" and "decline" buttons at the same time, or the text description of the "agree" button is unclear (I understand, I am aware, etc.), it is considered non-compliant because it does not emphasize the user's subjective willingness to provide personal information.

[0071] Interactive behavior information refers to (simulated) human-computer interaction information during user use. During the control process of the application under test, the following three types of interactive information are recorded, including but not limited to: the start and end times of business functions, the time of clicks and other operations, and application status information. Among these, the application status information indicates whether the application is currently running in the foreground, silent, or background state, and records its start and end times.

[0072] In summary, by analyzing at least one of the following: API call behavior information, plaintext transmission behavior information, page display behavior information related to page display, and interaction behavior information, a comprehensive analysis of the various behaviors of the application under test during dynamic operation can be achieved.

[0073] The following four examples further illustrate the embodiments of this application.

[0074] Example 1: Reference Figure 3 The diagram illustrates a privacy policy pop-up page provided in an embodiment of this application. (Refer to...) Figure 4 The diagram illustrates a privacy policy page provided in an embodiment of this application.

[0075] When the application to be tested is running... Figure 3 When the privacy policy pop-up page was displayed, the hyperlink text of the "User Privacy Agreement" was recognized. Figure 3 (The text in blue font) Clicking this hyperlink will redirect you to... Figure 4 The privacy policy page shown is incorrect. The privacy policy text of the app under test is no longer accessible because the link is broken. Therefore, users cannot access detailed information about the app's collection of personal information, and it is determined that the app under test does not comply with privacy policy requirements.

[0076] Example 2: Reference Figure 5The diagram illustrates another privacy policy page provided in an embodiment of this application.

[0077] By obtaining API call behavior information, it can be determined how long the automated process to be detected has been running. Figure 5 When the privacy policy pop-up page was displayed, the time of clicking "Agree" was 2024-12-11 10:30:28. The API call behavior information determined that prior to this time, there were already timestamps indicating that personal information had been collected before the privacy policy was agreed upon. Therefore, it was determined that the application under test did not comply with the privacy policy compliance requirements.

[0078] Example 3: The known IMEI is: 684354321864521.

[0079] HTTP request: { "time":"2024-12-1116:55:58", "host":"metrics-drcn.dt.dbankcloud.cn", IP address: "123.6.129.176" "country":"China", "method":"POST" "url":"https: / / metrics-drcn.dt.dbankcloud.cn / webv2?idsite=CeliaWeb", "headers":"Headers[(b'Connection', b'keep-alive'), (b'Content-Length', b'1484')]", "query":"MultiDictView[('idsite','CeliaWeb')]", "content":"data=684354321864521", } Given that the IMEI is 684354321864521, and the IMEI (684354321864521) is transmitted in plaintext in the HTTP request, which is to say, transmitting personal information in plaintext, it is determined that the application under test does not comply with the privacy policy requirements.

[0080] Example 4: Reference Figure 6The diagram illustrates another privacy policy pop-up page provided in an embodiment of this application. (Refer to...) Figure 7 The diagram illustrates another privacy policy page provided in an embodiment of this application.

[0081] The application under test runs automatically until Figure 6 The privacy policy pop-up page shown was clicked "Agree" at 10:00:07 on September 11, 2024, and as... Figure 7 The privacy policy text shown (by clicking as shown) Figure 6 The hyperlink to the blue text shown leads to... Figure 7 The page shown does not clearly and completely list the core business functions, and some are omitted ("etc."). By obtaining relevant API call behavior information, it was determined that after clicking "agree" (2024-09-11, 10:00:08), there was a specific API call to obtain IMEI information. That is, the privacy policy text does not clearly state all business functions, but personal information is collected after the user agrees. Therefore, it is determined that the application under test does not comply with the privacy policy requirements.

[0082] It should be noted that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0083] Reference Figure 8 The diagram illustrates a privacy compliance detection device provided in an embodiment of this application, which may specifically include: The state transition information determination module 801 is used to determine the state transition information of the application to be detected. The operation control module 802 is used to control the operation of the application under test according to the state transition information, so as to traverse multiple preset page states of the application under test; The data extraction module 803 is used to extract data to be analyzed during the operation of the application to be tested; the data to be analyzed includes privacy text data and application behavior data. The detection module 804 is used to generate compliance detection results based on the data to be analyzed and preset privacy compliance requirements.

[0084] In some implementations of this application, the state transition information includes the page type and page elements corresponding to each page state; the operation control module includes: The current page state determination submodule is used to determine the page type and page elements of the current page state of the application to be detected; The target page element touch submodule is used to simulate touch on the target page element corresponding to the surface type, so as to trigger the application to be detected to transition from the current page state to the next page state; The traversal validation submodule is used to re-invoke the current page state determination submodule if there are untraversed page states.

[0085] In some implementations of this application, the current page state is the current page state of the application to be detected; the current page state determination submodule includes: The page type identification unit is used to identify the page type of the current page using a preset screen classifier; An element position recognition unit is used to identify the category of the page element and the element position of the page element on the current page using a preset screen element classifier. The screen classifier is obtained by training a first neural network with preset page images and the page category labels corresponding to the preset page images; The screen element classifier is obtained by training a second neural network with a preset page image, the element category labels corresponding to the preset page image, and the training positions corresponding to the element category labels.

[0086] In some implementations of this application, the current page state is the current page state of the application to be detected; the target page element touch submodule includes: The target page element determination unit is used to determine the target page elements corresponding to the page type. The simulated touch unit is used to simulate touch on the target element position of the target page element.

[0087] In some implementations of this application's embodiments, the privacy text data is generated by a module, including: The privacy policy image acquisition module is used to acquire the privacy policy image when it is determined that the current page of the privacy policy page of the application to be detected is a privacy policy page; The privacy text data generation module is used to generate privacy text data corresponding to the privacy policy image using a trained large language model.

[0088] In some implementations of this application, the privacy text data generation module includes: The image content extraction submodule is used to extract the text content of the privacy policy image, as well as the prominent text in the privacy policy image; The structured information generation submodule is used to generate structured information corresponding to the text content using a trained large language model; The text style analysis information generation submodule is used to generate analysis information for saliently labeled text using a trained large language model; The privacy text data generation submodule is used to generate privacy text data based on structured and analytical information.

[0089] In some implementations of this application, the application behavior data includes at least one of the following: interface call behavior information related to calling the application programming interface, plaintext transmission behavior information related to plaintext transmission to the server, page display behavior information related to page display, and human-computer interaction behavior information.

[0090] This application provides a privacy compliance detection device, which can be used to implement the steps in the aforementioned method embodiments.

[0091] As the apparatus embodiments are basically similar to the method embodiments, they are described in a relatively simple manner. For relevant details, please refer to the description in the method embodiment section.

[0092] Reference Figure 9 The diagram illustrates an electronic device according to an embodiment of this application. Figure 9 As shown, the electronic device 900 in this embodiment includes: a processor 910, a memory 920, and a computer program 921 stored in the memory 920 and executable on the processor 910. When the processor 910 executes the computer program 921, it implements the steps in the various embodiments of the privacy compliance detection method described above, for example... Figure 1 Steps 101 to 104 are shown. Alternatively, when the processor 910 executes the computer program 921, it implements the functions of each module / unit in the above-described device embodiments, for example... Figure 5 The functions of modules 501 to 504 are shown.

[0093] For example, the computer program 921 may be divided into one or more modules / units, which are stored in the memory 920 and executed by the processor 910 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which may be used to describe the execution process of the computer program 921 in the electronic device 900.

[0094] The electronic device 900 can be a desktop computer, cloud server, or other computing device. The electronic device 900 may include, but is not limited to, a processor 910 and a memory 920. Those skilled in the art will understand that... Figure 9 This is merely one example of electronic device 900 and does not constitute a limitation on electronic device 900. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device 900 may also include input / output devices, network access devices, buses, etc.

[0095] The processor 910 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0096] The memory 920 can be an internal storage unit of the electronic device 900, such as a hard disk or memory of the electronic device 900. The memory 920 can also be an external storage device of the electronic device 900, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc., equipped on the electronic device 900. Furthermore, the memory 920 can include both internal and external storage units of the electronic device 900. The memory 920 is used to store the computer program 921 and other programs and data required by the electronic device 900. The memory 920 can also be used to temporarily store data that has been output or will be output.

[0097] This application also discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the privacy compliance detection method as described in the foregoing embodiments.

[0098] This application also discloses a computer program product, including a computer program, which, when run, causes the privacy compliance detection method described in the foregoing embodiments to be executed.

[0099] The embodiments described above are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A privacy compliance detection method, characterized in that, include: Determine the state transition information of the application to be tested; The application under test is controlled to run according to the state transition information to traverse multiple preset page states of the application under test; During the operation of the application under test, data to be analyzed is extracted; the data to be analyzed includes private text data and application behavior data. Based on the data to be analyzed and the preset privacy compliance requirements, a compliance detection result is generated.

2. The method according to claim 1, characterized in that, The state transition information includes the page type and page elements corresponding to each page state; controlling the operation of the application to be tested according to the state transition information to traverse multiple preset page states of the application to be tested includes: Determine the page type and page elements of the current page state of the application to be detected; Simulate touch on a target page element corresponding to the page type of the current page state to trigger the application to be detected to transition from the current page state to the next page state; If there are untraversed page states, return to the step of determining the page type and page elements of the current page state of the application to be detected.

3. The method according to claim 2, characterized in that, The current page state is the current page state of the application to be detected; determining the page type and page elements of the current page state of the application to be detected includes: The page type of the current page is identified using a preset screen classifier; A preset screen element classifier is used to identify the category of the page elements and their position on the current page. The screen classifier is obtained by training a first neural network with a preset page image and the page category label corresponding to the preset page image; The screen element classifier is obtained by training a second neural network with a preset page image, the element category labels corresponding to the preset page image, and the positions corresponding to the element category labels.

4. The method according to claim 2, characterized in that, The current page state refers to the current page state of the application to be detected; the simulated touch corresponds to the target page element of the page type of the current page state, including: Determine the target page element corresponding to the page type of the current page state; Simulated touch is performed on the target element position of the target page element.

5. The method according to claim 1, characterized in that, The privacy-preserving text data is generated through the following steps: If it is determined that the current page of the application to be detected is a privacy policy page, obtain the privacy policy image; A trained large language model is used to generate privacy text data corresponding to the privacy policy image.

6. The method according to claim 5, characterized in that, The step of using a trained large language model to generate privacy text data corresponding to the privacy policy image includes: Extract the text content of the privacy policy image, as well as the prominent identification text in the privacy policy image; A trained large language model is used to generate structured information corresponding to the text content; The trained large language model is used to generate analytical information for the salient text. Based on the structured information and the analysis information, privacy-preserving text data is generated.

7. The method according to claim 1, characterized in that, The application behavior data includes at least one of the following: interface call behavior information related to calling application programming interfaces, plaintext transmission behavior information related to plaintext transmission to the server, page display behavior information related to page display, and human-computer interaction behavior information.

8. A privacy compliance detection device, characterized in that, include: The state transition information determination module is used to determine the state transition information of the application to be detected; The operation control module is used to control the operation of the application to be tested according to the state transition information, so as to traverse multiple preset page states of the application to be tested; The data extraction module is used to extract data to be analyzed during the operation of the application to be detected; the data to be analyzed includes private text data and application behavior data. The detection module is used to generate compliance detection results based on the data to be analyzed and preset privacy compliance requirements.

9. An electronic device, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device performs the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, Includes a computer program, which, when run, causes the method as described in any one of claims 1-7 to be performed.

Images