Data processing systems and methods for automatic discovery and assessment of mobile software development kits
A mobile application privacy analysis system is described, where the system scans a mobile device to identify files associated with a particular SDK and generates a tokenized name for the SDK. The tokenized name includes tokens representing the SDK vendor and one or more functions of the SDK. Using the tokenized name, the system then determines corresponding categories for each functionality token and score for each such category. Based on the scores, the system determines the most significant category and assigns that category to the SDK for use in privacy analysis. The system may also, or instead, determine a vendor category using the vendor token and assign that category to the SDK. Weighting factors may be applied to the scores for the categories associated with the functionality tokens and vendor tokens.
1. A method comprising:
generating, by computing hardware, a tokenized name for a third-party development tool, the tokenized name comprising a functionality token representing a function of the third-party development tool and a source token indicating a third-party computing system from which the third-party development tool can be obtained, wherein the source token is generated by:
querying, based on identifying information of the third-party development tool, a database that stores a plurality of third-party identities in correlation with a plurality of respective identifying information of third-party development tools,
determining, based on a result of querying the database, a third-party identity corresponding to the third-party development tool, and
generating the source token based on the third-party identity;
determining, by the computing hardware, a functionality category for the functionality token;
identifying, by the computing hardware, the third-party computing system from the source token,
assigning, by the computing hardware, a third-party development tool category to the third-party development tool based on the functionality category and the identification of the third-party computing system; and
storing, by the computing hardware, the assigned third-party development tool category and linking the assigned third-party development tool category to the third-party development tool.
2. The method of claim 1 , wherein the third-party development tool is a software development kit used to generate an application, the application being configured to operate on a mobile device.
3. The method of claim 1 , further comprising:
determining, by the computing hardware, the identifying information of the third-party development tool by scanning at least one of a folder on a mobile device or a file stored on the mobile device.
4. The method of claim 3 , wherein scanning the at least one of the folder on the mobile device or the file stored on the mobile device comprises identifying information regarding at least one of a package name, a file name, or a folder name.
5. The method of claim 1 , further comprising:
determining, by the computing hardware, the identifying information for the third-party development tool;
cross-referencing, by the computing hardware, the identifying information in the database; and
determining, by the computing hardware, that the third-party development tool is valid in response to successfully cross-referencing the identifying information in the database.
6. The method of claim 1 , wherein generating the tokenized name for the third-party development tool comprises using natural language processing.
7. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
generating, by the processing device, a tokenized name for a third-party development tool, the tokenized name comprising a source token indicating a third-party computing system from which the third-party development tool can be obtained, wherein the source token is generated by:
querying, based on identifying information of the third-party development tool, a database that stores a plurality of third-party identities in correlation with a plurality of respective identifying information of third-party development tools,
determining, based on a result of querying the database, a third-party identity corresponding to the third-party development tool, and
generating the source token based on the third-party identity;
determining, by the processing device, a source category corresponding to a source of the third-party development tool;
identifying, by the processing device, the third-party computing system from the source token;
assigning, by the processing device, a third-party development tool category to the third-party development tool based on the source category and the third-party computing system; and
storing, by the processing device, the assigned third-party development tool category and linking the assigned third-party development tool category to the third-party development tool.
8. The system of claim 7 , wherein the third-party development tool is a software development kit used to generate an application.
9. The system of claim 7 , the operations further comprising:
determining, by the processing device, the identifying information of the third-party development tool by scanning at least one of a folder on a mobile device or a file stored on the mobile device.
10. The system of claim 9 , wherein scanning the at least one of the folder on the mobile device or the file stored on the mobile device comprises identifying information regarding at least one of a package name, a file name, or a folder name.
11. The system of claim 7 , the operations further comprising:
determining, by the processing device, identifying the information of the third-party development tool;
cross-referencing, by the processing device, the identifying information in the database; and
determining, by the processing device, that the third-party development tool is valid in response to successfully cross-referencing the identifying information in the database.
12. The system of claim 7 , wherein generating the tokenized name for the third-party development tool comprises using natural language processing.
13. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations comprising:
generating a tokenized name for a third-party development tool, the tokenized name comprising a functionality token representing a function of the third-party development tool, and a source token indicating a third-party computing system from which the third-party development tool can be obtained, wherein the source token is generated by:
querying, based on identifying information of the third-party development tool, a database that stores a plurality of third-party identities in correlation with a plurality of respective identifying information of third-party development tools,
determining, based on a result of querying the database, a third-party identity corresponding to the third-party development tool, and
generating the source token based on the third-party identity;
determining a functionality category for the functionality token;
identifying the third-party computing system from the source token;
assigning a third-party development tool category to the third-party development tool based on the functionality category and the identification of the third-party computing system; and
storing the assigned third-party development tool category and linking the assigned third-party development tool category to the third-party development tool.
14. The non-transitory computer-readable medium of claim 13 , wherein the third-party development tool is a software development kit used to generate an application, the application being configured to operate on a mobile device.
15. The non-transitory computer-readable medium of claim 13 , the operations further comprising:
determining the identifying information of the third-party development tool by scanning at least one of a folder on a mobile device or a file stored on the mobile device.
16. The non-transitory computer-readable medium of claim 15 , wherein scanning the at least one of the folder on the mobile device or the file stored on the mobile device comprises identifying information regarding at least one of a package name, a file name, or a folder name.
17. The non-transitory computer-readable medium of claim 13 , wherein generating the tokenized name for the third-party development tool comprises using natural language processing.