【摘要】 移动社交应用提供的社交互动功能使得用户可以轻松地获取其他用户的个人信息，进而促成跨用户的隐私分享。根据相关法律规定的最小必要原则，应用分享的个人信息应当限定于展示功能所需要的最小范围，因此不得分享未在隐私政策声明且未在用户界面上展示的个人信息。目前相关工作缺少对跨用户隐私分享合规性的研究，因此设计了自动化合规检测系统，以隐私政策和用户界面作为判定是否符合最小必要原则的依据，检测违规的跨用户隐私分享行为。该系统面向应用市场509个移动社交应用展开合规检测，对每个移动社交应用进行20 min的动态测试发现，47个移动社交应用存在合计101次非重复的违规隐私分享行为，涉及18类用户隐私数据。经过人工验证，确认91.09%的违规隐私分享行为实际存在。实验结果表明，该系统相较先前工作在精准率和召回率上均有良好表现。更多还原

【Abstract】 The social interaction functions provided by mobile social applications(apps) allow users to easily obtain the personal information of other users, thereby promoting cross-user privacy sharing. According to the data minimization principle stipulated in relevant laws and regulations, the personal information shared by the application should be limited to the minimum scope necessary to the display function. Therefore, personal information not stated in the privacy policy and not displayed on the user interface shall not be shared. However, security communities barely pay attention to the compliance of cross-user privacy sharing. Therefore, an automated compliance detection system was designed to use privacy policies and user interfaces as the basis for determining whether the data minimization principle is met in cross-user privacy sharing behaviors. According to the compliance inspection results of 509 mobile social apps, which each app is dynamically tested for 20 minutes, a total of 101 unique violations of privacy sharing behaviors was found in 47mobile apps, involving 18 types of user privacy data. Through manual verification, it was confirmed that 91.09% violations of privacy sharing behaviors actually exist. Experimental results show that the system performs well in both precision and recall compared to previous work.更多还原