Finding Privacy-relevant Source Code
CoRR(2024)
摘要
Privacy code review is a critical process that enables developers and legal
experts to ensure compliance with data protection regulations. However, the
task is challenging due to resource constraints. To address this, we introduce
the concept of privacy-relevant methods - specific methods in code that are
directly involved in the processing of personal data. We then present an
automated approach to assist in code review by identifying and categorizing
these privacy-relevant methods in source code.
Using static analysis, we identify a set of methods based on their
occurrences in 50 commonly used libraries. We then rank these methods according
to their frequency of invocation with actual personal data in the top 30 GitHub
applications. The highest-ranked methods are the ones we designate as
privacy-relevant in practice. For our evaluation, we examined 100 open-source
applications and found that our approach identifies fewer than 5
methods as privacy-relevant for personal data processing. This reduces the time
required for code reviews. Case studies on Signal Desktop and Cal.com further
validate the effectiveness of our approach in aiding code reviewers to produce
enhanced reports that facilitate compliance with privacy regulations.
更多查看译文
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要