PurExt: Automated Extraction of the Purpose-Aware Rule from the Natural Language Privacy Policy in IoT

Lu Yang; Xingshu Chen; Yonggang Luo; Xiao Lan; Li Chen

doi:10.1155/2021/5552501

journal article Open Access May 07, 2021

PurExt: Automated Extraction of the Purpose-Aware Rule from the Natural Language Privacy Policy in IoT

Lu Yang

Security and Communication Networks Vol. 2021 pp. 1-11 · Wiley

View at Publisher Save 10.1155/2021/5552501

Abstract

The extensive data collection performed by the Internet of Things (IoT) devices can put users at risk of data leakage. Consequently, IoT vendors are legally obliged to provide privacy policies to declare the scope and purpose of the data collection. However, complex and lengthy privacy policies are unfriendly to users, and the lack of a machine-readable format makes it difficult to check policy compliance automatically. To solve these problems, we first put forward a purpose-aware rule to formalize the purpose-driven data collection or use statement. Then, a novel approach to identify the rule from natural language privacy policies is proposed. To address the issue of diversity of purpose expression, we present the concepts of explicit and implicit purpose, which enable using the syntactic and semantic analyses to extract purposes in different sentences. Finally, the domain adaption method is applied to the semantic role labeling (SRL) model to improve the efficiency of purpose extraction. The experiments that are conducted on the manually annotated dataset demonstrate that this approach can extract purpose-aware rules from the privacy policies with a high recall rate of 91%. The implicit purpose extraction of the adapted model significantly improves the F1-score by 11%.

Topics

No keywords indexed for this article. Browse by subject →

References

42

[1]

10.1108/ics-07-2019-0090<remarks>doi_inserted_from_crossref</remarks>

[2]

E. Zeng "Understanding and improving security and privacy in multi-user smart homes: a design exploration and in-home user study"

[3]

10.1145/3274469<remarks>doi_inserted_from_crossref</remarks>

[4]

10.1007/s00779-017-1067-4

[5]

S. Wilson "The creation and analysis of a website privacy policy corpus"

[6]

10.1007/978-3-030-33752-0_6

[7]

W. B. Tesfay "I read but don’t agree: privacy policy benchmarking using machine learning and the EU GDPR"

[8]

G. Kapitsaki "Linked USDL privacy: describing privacy policies for services"

[9]

10.1145/3127519<remarks>doi_inserted_from_crossref</remarks>

[10]

10.1007/978-3-319-95276-5_3

[11]

J. Bhatia "Semantic incompleteness in privacy policy goals"

[12]

N. M. Nejad "Establishing a strong baseline for privacy policy classification" (2020) 10.1007/978-3-030-58201-2_25

[13]

S. Wilson "Crowdsourcing annotations for websites’ privacy policies: can it really work?"

[14]

B. Andow "Policylint: investigating internal privacy policy contradictions on google play"

[15]

L. Yu "Enhancing the description-to-behavior fidelity in android apps with privacy policy" IEEE Transactions on Software Engineering (2017) 10.1109/tse.2017.2730198

[16]

10.1007/978-3-642-40203-6_34<remarks>doi_inserted_from_crossref</remarks>

[17]

10.1007/978-3-662-58387-6_2

[18]

P. Shayegh "Automated approach to improve iot privacy policies" (2019)

[19]

E. Onu "Contextual privacy policy modeling in iot"

[20]

H. Harkous "Polisis: automated analysis and presentation of privacy policies using deep learning"

[21]

A. Subahi "Ensuring compliance of IoT devices with their privacy policy agreement"

[22]

S. Zimmeck "Automated analysis of privacy requirements for mobile apps" 10.14722/ndss.2017.23034

[23]

B. Andow "Actions speak louder than words: entity-sensitive privacy policy and data flow analysis with policheck"

[24]

P. Story "Natural language processing for mobile app privacy compliance"

[25]

10.2478/popets-2019-0037

[26]

10.1007/s00766-019-00315-y<remarks>doi_inserted_from_crossref</remarks>

[27]

X. Xiao "Automated extraction of security policies from natural-language software documents"

[28]

J. Slankas "Relation extraction for inferring access control rules from natural language artifacts"

[29]

J. Slankas "Access control policy extraction from unconstrained natural language text"

[30]

10.1007/978-3-319-61176-1_5

[31]

M. Narouei "Automatic extraction of access control policies from natural language documents" IEEE Transactions on Dependable and Secure Computing (2018)

[32]

10.1162/coli.2008.34.2.257

[33]

M. Lewis "Joint a∗ ccg parsing and semantic role labelling"

[34]

A. Björkelund "Multilingual semantic role labeling"

[35]

R. Collobert "Natural language processing (almost) from scratch" Journal of Machine Learning Research (2011)

[36]

M. Surdeanu "Semantic role labeling using complete syntactic analysis"

[37]

10.1145/1272516.1272522

[38]

X. Yang "Security policy refinement: high-level specification to low-level implementation"

[39]

M. Honnibal "Spacy 2: Natural language understanding with bloom embeddings" Convolutional Neural Networks and Incremental Parsing (2017)

[40]

X. Carreras "Introduction to the CoNLL-2005 shared task: semantic role labeling"

[41]

[42]

A systematic analysis of performance measures for classification tasks

Marina Sokolova, Guy Lapalme

Information Processing & Management 10.1016/j.ipm.2009.03.002

Metrics

6

Citations

42

References

Details

Published: May 07, 2021
Vol/Issue: 2021
Pages: 1-11
License: View

Authors

L

Lu Yang

College of Computer Science, Sichuan University, Chengdu 610065, China; Cyber Science Research Institute, Sichuan University, Chengdu 610065, China

X

Xingshu Chen

Cyber Science Research Institute, Sichuan University, Chengdu 610065, China; College of Cyber Science and Engineering, Sichuan University, Chengdu 610065, China

Y

Yonggang Luo

Cyber Science Research Institute, Sichuan University, Chengdu 610065, China; College of Cyber Science and Engineering, Sichuan University, Chengdu 610065, China

X

Xiao Lan

Cyber Science Research Institute, Sichuan University, Chengdu 610065, China; College of Cyber Science and Engineering, Sichuan University, Chengdu 610065, China

L

Li Chen

College of Computer Science, Sichuan University, Chengdu 610065, China; Cyber Science Research Institute, Sichuan University, Chengdu 610065, China

Funding

National Natural Science Foundation of China Award: U19A2081

Cite This Article

Lu Yang, Xingshu Chen, Yonggang Luo, et al. (2021). PurExt: Automated Extraction of the Purpose-Aware Rule from the Natural Language Privacy Policy in IoT. Security and Communication Networks, 2021, 1-11. https://doi.org/10.1155/2021/5552501

PurExt: Automated Extraction of the Purpose-Aware Rule from the Natural Language Privacy Policy in IoT

You May Also Like