DATA PROCESSING SYSTEMS AND METHODS FOR AUTOMATIC DISCOVERY AND ASSESSMENT OF MOBILE SOFTWARE DEVELOPMENT KITS
A mobile application privacy analysis system is described, where the system scans a mobile device to identify files associated with a particular SDK and generates a tokenized name for the SDK. The tokenized name includes tokens representing the SDK vendor and one or more functions of the SDK. Using the tokenized name, the system then determines corresponding categories for each functionality token and score for each such category. Based on the scores, the system determines the most significant category and assigns that category to the SDK for use in privacy analysis. The system may also, or instead, determine a vendor category using the vendor token and assign that category to the SDK. Weighting factors may be applied to the scores for the categories associated with the functionality tokens and vendor tokens.
1 . A method comprising:
scanning, by computing hardware, at least one of a folder on a mobile device or a file stored on the mobile device to determine identifying information for a third-party development tool;
generating, by the computing hardware, a functionality token for the third-party development tool by:
querying, based on the identifying information for the third-party development tool, a database that stores a plurality of third-party identities in correlation with a plurality of respective identifying information of third-party development tools,
determining, based on a result of querying the database, a third-party identity corresponding to the third-party development tool, and
generating the functionality token based on the third-party identity;
determining, by the computing hardware, a functionality category for the functionality token;
assigning, by the computing hardware, a third-party development tool category to the third-party development tool based on the functionality category; and
linking, by the computing hardware, the third-party development tool category to the third-party development tool.
2 . The method of claim 1 , wherein:
the method further comprises generating, by the computing hardware, a tokenized name for the third-party development tool using natural language processing on at least one of a filename for the file stored on the mobile device or content in the file stored on the mobile device; and
the identifying information for the third-party development tool comprises the tokenized name.
3 . The method of claim 2 , further comprising:
determining, by the computing hardware, based on the identifying information, a source of the third-party development tool; and
assigning, by the computing hardware, the third-party development tool category based on the source.
4 . The method of claim 3 , wherein:
the tokenized name comprises a source token; and
the method comprises determining the source of the third-party development tool based on the source token.
5 . The method of claim 1 , wherein scanning the at least one of the folder on the mobile device or the file stored on the mobile device comprises performing a filename search on the mobile device to determine the identifying information for the third-party development tool.
6 . The method of claim 1 , wherein:
the functionality token comprises a first functionality token representing a first functionality type of the third-party development tool and a second functionality token representing a second functionality type of the third-party development tool; and
assigning, by the computing hardware, the third-party development tool category to the third-party development tool based on the functionality category comprises assigning the third-party development tool category based on a relative relevance weighting of the first functionality token and the second functionality token.
7 . The method of claim 1 , wherein the third-party development tool is a software development kit used to generate an application, the application being configured to operate on the mobile device.
8 . A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
scanning at least one of a folder on a mobile device or a file stored on the mobile device to determine identifying information for a third-party development tool;
generating a source token for the third-party development tool by:
querying, based on the identifying information for the third-party development tool, a database that stores a plurality of third-party identities in correlation with a plurality of respective identifying information of third-party development tools,
determining, based on a result of querying the database, a third-party identity corresponding to the third-party development tool, and
generating the source token based on the third-party identity;
identifying a third-party computing system from the source token;
assigning a third-party development tool category to the third-party development tool based on the third-party computing system; and
linking the third-party development tool category to the third-party development tool.
9 . The system of claim 8 , wherein:
the operations further comprise generating a tokenized name for the third-party development tool using natural language processing on at least one of a filename for the file stored on the mobile device or content in the file stored on the mobile device; and
the identifying information for the third-party development tool comprises the tokenized name.
10 . The system of claim 9 , wherein:
the tokenized name comprises a first function token; and
the operations further comprise assigning the third-party development tool category based on the first functionality token.
11 . The system of claim 10 , wherein:
the tokenized name comprises a second function token; and
the operations further comprise assigning the third-party development tool category based on the first functionality token and the second functionality token.
12 . The system of claim 8 wherein scanning the at least one of a folder on the mobile device or the file stored on the mobile device comprises determining the identifying information for the third-party development tool based on at least one of a package name, a file name, or a folder name.
13 . The system of claim 9 , wherein the third-party development tool is a software development kit used to generate an application.
14 . The system of claim 8 , wherein the third-party development tool category includes at least one of a targeting category, a functional category, or a location category.
15 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations comprising:
scanning at least one of a folder on a mobile device or a file stored on the mobile device to determine identifying information for a third-party development tool;
generating a tokenized name for the third-party development tool based on the identifying information, the tokenized name comprising a functionality token representing a function of the third-party development tool;
assigning a third-party development tool category to the third-party development tool based on the functionality token; and
linking the assigned third-party development tool category to the third-party development tool.
16 . The non-transitory computer-readable medium of claim 15 , wherein:
generating the tokenized name for the third-party development tool comprises using natural language processing on at least one of a filename for the file stored on the mobile device or content in the file stored on the mobile device; and
the identifying information for the third-party development tool comprises the tokenized name.
17 . The non-transitory computer-readable medium of claim 15 , wherein scanning the at least one of the folder on the mobile device or the file stored on the mobile device comprises performing a filename search on the mobile device to determine the identifying information for the third-party development tool.
18 . The non-transitory computer-readable medium of claim 15 , wherein:
the functionality token is a first functionality token;
the tokenized name comprises a second functionality token; and
the operations further comprise assigning the third-party development tool category based on the first functionality token but not on the second functionality token.
19 . The non-transitory computer-readable medium of claim 15 , wherein:
the functionality token comprises a first functionality token representing a first functionality type of the third-party development tool and a second functionality token representing a second functionality type of the third-party development tool; and
assigning the third-party development tool category to the third-party development tool based on the functionality category comprises assigning the third-party development tool category based on a relative relevance weighting of the first functionality token and the second functionality token.
20 . The non-transitory computer-readable medium of claim 15 , wherein the third-party development tool is a software development kit used to generate an application, the application being configured to operate on the mobile device.