Privacy policies play a vital role in informing users about how mobile apps collect, use, and share their data, but their length and complexity often obscure transparency. This is especially concerning for Android apps, which frequently request sensitive permissions, e.g., location, contacts, and storage. To tackle this issue, we developed an NLP-based system that classifies privacy policy segments according to the permissions they describe. Using a dataset of over 5,000 Android apps from AndroZoo, we scraped privacy policies and extracted permissions to form a diverse dataset. The extracted permissions include those from the vanilla Android OS, as well as a small subset from third-party tools and custom Android distributions, ensuring a comprehensive analysis. After data cleaning and preprocessing, we employed both keyword-based and manual labeling, assisted by ChatGPT, to categorize policy segments. We trained NLP models like BERT, RoBERTa, and DistilBERT, comparing their performance based on accuracy, precision, recall, and F1 score. Our results showed that an ensemble learning approach, combining predictions from multiple models, outperformed individual models. This study advances efforts to enhance privacy policy transparency, improve user awareness, and strengthen privacy protection within diverse Android systems.

In this paper, we investigated ChatGPT’s code transformation capability and the effectiveness of the code authorship attribution technique specially designed for ChatGPT code. Through our experiments, we made several key observations. Firstly, ChatGPT demonstrated the capability to transform code in ways that can mislead existing authorship attribution techniques by generating various styles, while it has some constraints, such as the maximum of 12 styles, with certain styles being more commonly employed than others. We also found that the feature-based code authorship attribution proved to be effective when even applied to ChatGPT-transformed code, while the naive approach encountered challenges with accurate classification. In addition, an authorship model trained for binary classification is still effective for ChatGPT-transformed code by achieving up to 93% accuracy. These findings provide insights into the code transformation ability of ChatGPT and shed light on the effectiveness of code authorship attribution techniques for ChatGPT-transformed code.

The development of metaverses and virtual worlds on various platforms, including mobile devices, has led to the growth of applications in virtual reality (VR) and augmented reality (AR) in recent years. This application growth is paralleled by a growth of interest in analyzing and understanding AR/VR applications from security and performance standpoints. Despite this growing interest, benchmark datasets are lacking to facilitate this research pursuit. In this article, we collect a dataset that consists of 408 diverse AR/VR applications from the Google Play Store and acquire various data modalities associated with those applications standardized in the form of seven features: control flow graphs, strings, functions, permissions, API calls, hexdump, and metadata. We highlight various research endeavors (applications) that can benefit from our dataset for each data modality.

This paper examines free content websites (FCWs) and premium content websites (PCWs) in different countries, comparing them to general websites. The focus is on the distribution of malicious websites and their correlation with the national cyber security index (NCSI), which measures a country’s cyber security maturity and its ability to deter the hosting of such malicious websites. By analyzing a dataset comprising 1,562 FCWs and PCWs, along with Alexa’s top million websites dataset sample, we discovered that a majority of the investigated websites are hosted in the United States. Interestingly, the United States has a relatively low NCSI, mainly due to a lower score in privacy policy development. Similar patterns were observed for other countries With varying NCSI criteria. Furthermore, we present the distribution of various categories of FCWs and PCWs across countries. We identify the top hosting countries for each category and provide the percentage of discovered malicious websites in those countries. Ultimately, the goal of this study is to identify regional vulnerabilities in hosting FCWs and guide policy improvements at the country level to mitigate potential cyber threats.