MOBILESoft 2024
Mon 15 Apr 2024 Lisbon, Portugal
co-located with ICSE 2024
Mon 15 Apr 2024 14:00 - 14:22 at Carlos Paredes - Quality Assurance

Major app stores have introduced privacy labels (e.g., Google Play’s data safety section since July 2022), requiring app developers to provide their privacy disclosures, including data types collected and shared by their apps and third-party SDKs they use. Third- party SDK providers have published guidance pages instructing app developers what data types their SDKs use and thus must be declared to the data safety section. Availability and correctness of the guidance pages are critical issues but have yet to receive any attention. This paper presents the first study of the guidance pages. We first attempted to collect the guidance pages of 175 commercial SDKs widely used in Android apps and did not obtain them for 63% of the SDKs, suggesting that the majority of them have not provided guidance pages. Further, we develop a system that detects inconsistencies between the guidance pages and the actual data collection of SDKs. It uses machine learning and dynamic taint analysis to extract privacy practices from the guidance pages and SDKs and analyzes the outcomes to detect the critical gap. We construct datasets of 47 guidance pages and 43 SDKs’ 159 sample apps and evaluate the system. The system uncovered discrepancies related to location and identifiers in the guidance pages of eight SDKs. We also evaluate the machine learning model’s accuracy for unknown guidance page contents. The results show that the model performs satisfactorily for updated guidance pages, and the accuracy for newly posted ones increases as the model learns more. This study exposes the critical issues of the guidance pages and also contributes to tools and datasets for facilitating further research on guidance pages and privacy labels.

Mon 15 Apr

Displayed time zone: Lisbon change

14:00 - 15:30
14:00
22m
Full-paper
Detection of Inconsistencies between Guidance Pages and Actual Data Collection of Third-party SDKs in Android AppsFull Paper
Research Track
Hiroki Inayoshi Okayama University, Shohei Kakei Nagoya Institute of Technology, Japan, Shoichi Saito Nagoya Institute of Technology, Japan
DOI Pre-print
14:22
22m
Full-paper
Generating Rate Features for Mobile ApplicationsBest Presentation AwardFull Paper
Research Track
Shristi Shrestha Louisiana State University, Anas "Nash" Mahmoud Louisiana State University
14:45
15m
Short-paper
Toward an Android Static Analysis Approach for Data Protection
Research Forum Track
Mugdha Khedkar Heinz Nixdorf Institute at Paderborn University, Eric Bodden Heinz Nixdorf Institut, Paderborn University and Fraunhofer IEM
Pre-print
15:00
15m
Short-paper
Are Your Android App Analyzers Still Relevant?
Research Forum Track
chenhaonan , Daihang Chen Beihang University, China, Yonghui Liu Monash University, Xiaoyu Sun Australian National University, Australia, Li Li Beihang University
15:15
15m
Short-paper
Towards Benchmarking the Coverage of Automated Testing Tools in Android against Manual Testing
Research Forum Track
Ferdian Thung Singapore Management University, Ivana Clairine Irsan Singapore Management University, Jiakun Liu Singapore Management University, David Lo Singapore Management University