Toward an Android Static Analysis Approach for Data Protection
- URL: http://arxiv.org/abs/2402.07889v1
- Date: Mon, 12 Feb 2024 18:52:39 GMT
- Title: Toward an Android Static Analysis Approach for Data Protection
- Authors: Mugdha Khedkar and Eric Bodden
- Abstract summary: This paper motivates the need to explain data protection in Android apps.
The data analysis will recognize personal data sources in the source code.
App developers can then address key questions about data manipulation and data manipulation derived data.
- Score: 7.785051236155595
- License: http://creativecommons.org/licenses/by/4.0/
- Abstract: Android applications collecting data from users must protect it according to
the current legal frameworks. Such data protection has become even more
important since the European Union rolled out the General Data Protection
Regulation (GDPR). Since app developers are not legal experts, they find it
difficult to write privacy-aware source code. Moreover, they have limited tool
support to reason about data protection throughout their app development
process.
This paper motivates the need for a static analysis approach to diagnose and
explain data protection in Android apps. The analysis will recognize personal
data sources in the source code, and aims to further examine the data flow
originating from these sources. App developers can then address key questions
about data manipulation, derived data, and the presence of technical measures.
Despite challenges, we explore to what extent one can realize this analysis
through static taint analysis, a common method for identifying security
vulnerabilities. This is a first step towards designing a tool-based approach
that aids app developers and assessors in ensuring data protection in Android
apps, based on automated static program analysis.
Related papers
- A Large-Scale Privacy Assessment of Android Third-Party SDKs [17.245330733308375]
Third-party Software Development Kits (SDKs) are widely adopted in Android app development.
This convenience raises substantial concerns about unauthorized access to users' privacy-sensitive information.
Our study offers a targeted analysis of user privacy protection among Android third-party SDKs.
arXiv Detail & Related papers (2024-09-16T15:44:43Z) - Collection, usage and privacy of mobility data in the enterprise and public administrations [55.2480439325792]
Security measures such as anonymization are needed to protect individuals' privacy.
Within our study, we conducted expert interviews to gain insights into practices in the field.
We survey privacy-enhancing methods in use, which generally do not comply with state-of-the-art standards of differential privacy.
arXiv Detail & Related papers (2024-07-04T08:29:27Z) - Security Approaches for Data Provenance in the Internet of Things: A Systematic Literature Review [0.0]
Internet of Things systems are vulnerable to security attacks.
Data provenance offers a way to record the origin, history, and handling of data to address these vulnerabilities.
arXiv Detail & Related papers (2024-07-03T19:25:36Z) - Securing Data Platforms: Strategic Masking Techniques for Privacy and
Security for B2B Enterprise Data [0.0]
Business-to-business (B2B) enterprises are increasingly constructing data platforms.
It has become critical to design these data platforms with mechanisms that inherently support data privacy and security.
Data masking stands out as a vital feature of data platform architecture.
arXiv Detail & Related papers (2023-12-06T05:04:37Z) - PrivacyMind: Large Language Models Can Be Contextual Privacy Protection Learners [81.571305826793]
We introduce Contextual Privacy Protection Language Models (PrivacyMind)
Our work offers a theoretical analysis for model design and benchmarks various techniques.
In particular, instruction tuning with both positive and negative examples stands out as a promising method.
arXiv Detail & Related papers (2023-10-03T22:37:01Z) - Towards Generalizable Data Protection With Transferable Unlearnable
Examples [50.628011208660645]
We present a novel, generalizable data protection method by generating transferable unlearnable examples.
To the best of our knowledge, this is the first solution that examines data privacy from the perspective of data distribution.
arXiv Detail & Related papers (2023-05-18T04:17:01Z) - No Free Lunch in "Privacy for Free: How does Dataset Condensation Help
Privacy" [75.98836424725437]
New methods designed to preserve data privacy require careful scrutiny.
Failure to preserve privacy is hard to detect, and yet can lead to catastrophic results when a system implementing a privacy-preserving'' method is attacked.
arXiv Detail & Related papers (2022-09-29T17:50:23Z) - Black-box Dataset Ownership Verification via Backdoor Watermarking [67.69308278379957]
We formulate the protection of released datasets as verifying whether they are adopted for training a (suspicious) third-party model.
We propose to embed external patterns via backdoor watermarking for the ownership verification to protect them.
Specifically, we exploit poison-only backdoor attacks ($e.g.$, BadNets) for dataset watermarking and design a hypothesis-test-guided method for dataset verification.
arXiv Detail & Related papers (2022-08-04T05:32:20Z) - An Example of Privacy and Data Protection Best Practices for Biometrics
Data Processing in Border Control: Lesson Learned from SMILE [0.9442139459221784]
Misuse of data, compromising the privacy of individuals and/or authorized processing of data may be irreversible.
This is partly due to the lack of methods and guidance for the integration of data protection and privacy by design in the system development process.
We present an example of privacy and data protection best practices to provide more guidance for data controllers and developers.
arXiv Detail & Related papers (2022-01-10T15:34:43Z) - Android Security using NLP Techniques: A Review [1.218340575383456]
Android is among the most targeted platform by attackers.
Traditional solutions based on static and dynamic analysis have been evolving.
This study aims to explore possible research directions for future studies by presenting state-of-the-art in this domain.
arXiv Detail & Related papers (2021-07-07T08:33:00Z) - Explainable Patterns: Going from Findings to Insights to Support Data
Analytics Democratization [60.18814584837969]
We present Explainable Patterns (ExPatt), a new framework to support lay users in exploring and creating data storytellings.
ExPatt automatically generates plausible explanations for observed or selected findings using an external (textual) source of information.
arXiv Detail & Related papers (2021-01-19T16:13:44Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.