Privacy Policy Ontology
收藏资源简介：
Government regulations increasingly require mobile and web-based application (app) companies to standardize their data practices concerning the collection, use, and sharing of various types of information. A summary of these practices are communicated to users through online privacy policies. The challenge of acquiring requirements from data practice descriptions, however, is that privacy policies often contain ambiguities. Abstract and ambiguous terminology in requirements statements concerning information types (e.g., "we collect your device information"), can reduce shared understanding among app developers, policy writers, and users. To address this challenge, we propose a syntax-driven method that first parses a given information type phrase (e.g. mobile device identifier) into its constituents using a context-free grammar and second infers semantic relationships between constituents using semantic rules. The inferred semantic relationships between a given phrase and its constituents generate a hierarchy that models the generality and ambiguity of phrases. Through this method, we infer relations from a lexicon consisting of a set of information type phrases to populate a partial ontology. The resulting ontology is a knowledge graph that can be used to guide requirements authors in the selection of the most appropriate information type terms. We evaluate the method’s performance using two criteria: (1) expert assessment of relations between information types; and (2) non-expert preferences for relations between information types. The results suggest performance improvement when compared to a previously proposed method. We also evaluate the reliability of the method considering the information types extracted from different data practices (e.g., collection, usage, sharing, etc.) in privacy policies for mobile or web-based apps in various app domains. This data repository contains lexicons and ontologies that we used to construct and evaluate our method.
各国政府监管机构日益要求移动与基于网页的应用（app）厂商规范其针对各类信息的收集、使用与共享等数据处理行为。此类数据处理行为的概要会通过在线隐私政策告知用户。然而，从数据处理行为描述中提取监管要求所面临的一大挑战在于，隐私政策往往存在歧义表述。针对信息类型的需求表述中，若使用抽象且模糊的术语（例如"我们会收集您的设备信息"），则会削弱应用开发者、隐私政策撰写者与用户三方的共识认知。为解决这一难题，本文提出一种句法驱动方法：首先利用上下文无关文法（context-free grammar），将给定的信息类型短语（例如"移动设备标识符"）拆解为其组成单元；随后通过语义规则，推导各组成单元间的语义关联。通过给定短语与其组成单元间推导得到的语义关联，可生成一套层级结构，用以对短语的一般性与歧义性进行建模。借助该方法，我们从由一系列信息类型短语构成的词表（lexicon）中推导关联关系，以此填充局部本体（ontology）。最终生成的本体为一套知识图谱（knowledge graph），可用于辅助需求撰写者挑选最为恰当的信息类型术语。本文采用两项评估指标评估该方法的性能：其一为信息类型间关联关系的专家评审；其二为信息类型间关联关系的非专家偏好调研。实验结果显示，相较于此前提出的方法，本方法的性能更优。此外，本文还针对不同应用领域的移动或网页应用隐私政策中，从各类数据处理行为（例如收集、使用、共享等）提取的信息类型，评估了该方法的可靠性。本数据集仓库包含了我们在构建与评估本方法过程中所使用的词表与本体。
