RightsGen: Automated Generation of User Rights Declaration on Android via LLM-Guided UI Traversal
TL;DR
RightsGen, a framework that leverages Large Language Models (LLMs) to automate the discovery and documentation of user rights declarations in Android applications, demonstrates high efficiency in dynamic testing and highlights the effectiveness of RightsGen in automating the generation of user rights declarations.
Abstract
Ensuring compliance with privacy regulations, such as GDPR and CCPA, has become a critical challenge for mobile applications. These regulations mandate that apps provide accessible paths for users to exercise rights, such as account deletion and data export. However, these paths are often buried deep within complex UI hierarchies, making manual auditing unscalable. In this paper, we introduce RightsGen, a framework that leverages Large Language Models (LLMs) to automate the discovery and documentation of user rights declarations in Android applications. Unlike traditional random UI fuzzers, RightsGen utilizes the semantic reasoning capabilities of LLMs to navigate dynamic UI states. It employs a path-oriented mechanism and a GUI Agent acting as a rights tester guided by structured rights tuples. In our evaluation across 144 popular apps, RightsGen demonstrated high efficiency in dynamic testing, achieving a recall rate of 92.5% in recognizing user rights paths and 87.3% in extracting rights tuples. These results highlight the effectiveness of RightsGen in automating the generation of user rights declarations.