Critical Review of Bridging the Compliance Gap: Effective and Efficient Detection of Non-Compliant Behaviors in Android Applications
Introduction
The increase in the usage of Android apps has raised many concerns about the issues related to user privacy, regulatory compliance, and security of software. Given that GDPR, CCPA, and PIPL have evolved, the detection of compliance for Android Applications has emerged as one of the research topics in Application Security. The static and dynamic techniques available so far have not been able to handle Non-Compliant Applications.
In the paper “Bridging the Compliance Gap: Effective and Efficient Android Application Compliance Detection,” Fan et al. (2026) introduce a novel Behaviour Property Graph (BPG), which combines several programming models to enhance App Compliance. The proposed BPG prototype, known as BPGᴇɴ, employs graph-based behavioural analysis for compliance detection.
Summary of the article
This article looks into the shortcomings of current compliance testing approaches for Android applications and introduces a novel graph approach to analysing application behaviour. While earlier work concentrated on the aspect of privacy leakage using taint analysis or runtime monitoring, the Behaviour Property Graph introduced here combines several components, including AST (Abstract Syntax Tree), CFG (Control Flow Graph), CG (Call Graph), PDG (Program Dependence Graph), and PAG (Pointer Assignment Graph).
This proposed graph-based method allows the authors to transform extracted behavioural properties of applications in the form of graph queries that recognise compliance violations. The BPGᴇɴ framework was designed for generating Behaviour Property Graphs and tested with 200 Android applications having seven different types of compliance violations. It was experimentally shown that the proposed framework analyses more than 90% of the applications in less than ten minutes while discovering 34 previously unknown compliance violations with fewer false positives and negatives than the existing methods.
Critique
Significance and contribution of the field
One of the important aspects of this paper is that it makes a significant contribution to the field of Compliance Detection, which is getting more attention due to the changing global privacy laws and increasing concern about the security of mobile applications. Unlike traditional research on compliance detection, which only focused on the leakage of sensitive data, the Behavioural Property Graph model used in the proposed framework also focuses on the behaviour and interactions of resources and logic of the application.
This study also exhibits an improvement in practice as compared to previous static analysis models. For instance, the FlowDroid model proposed by Arzt et al. (2014) offers lifecycle-aware taint analysis that is very accurate with respect to the identification of information leaks in Android applications; however, it only deals with information flow between pre-specified sources and sinks. On the other hand, the Amandroid model (Wei et al., 2018) is an improved version of inter-component data-flow analysis, but is still restricted to security vulnerability detection rather than compliance with regulations.
Moreover, this research also correlates well with the recent advancements in graph learning for software security analysis. Several recent studies by Li et al. (2023) and others who work on graph learning techniques have proved that graph representation is highly efficient in capturing structural relations in Android apps. Through the creation of one unified Behaviour Property Graph using multiple graph representations, this research contributes to a better understanding of Android Security.
While considering these contributions, it should be stated that the main focus of this paper is related to Android App Compliance analysis in Chinese regulatory frameworks. Even though the authors note that there could be an option to extend the framework for the use of GDPR and CCPA regulations, the paper provides little information about how the behavioural requirements may vary in different regions.
Methodology and research design
From a methodological perspective, this paper offers a strong method for Android Malware Detection through combining several program representations into a Behaviour Property Graph. Contrary to conventional approaches of static analysis, which use pre-defined sources and sinks, this technique uses AST, CFG, CG, PDG, and PAG to create a Behaviour Property Graph and thus capture complex behaviour of applications. Multiple compliance violations can therefore be identified using graph queries and not repeating program analysis.
The proposed evaluation enhances the research by evaluating BPGᴇɴ with 200 real-world Android applications related to seven compliance violations. It has proven to be efficient by obtaining low rates of false positives and negatives in comparison to other compliance detection solutions and detecting new violations that have never been discovered before.
The methodology used to develop the framework is also capable of addressing drawbacks of previous frameworks for Android application security. The FlowDroid method (Arzt et al., 2014) performs taint analysis very accurately, but it requires multiple analyses when adding new sources and sinks to the program, while TaintDroid (Enck et al., 2014) performs runtime execution and cannot detect all behaviours.
However, there are some methodological weaknesses associated with the study. The testing procedure involves the use of 200 Android apps, which were gathered predominantly from the Chinese app markets. Hence, the findings of this study can hardly be generalised. In addition, as BPGᴇɴ is a static analysis framework, it is unable to identify violations that are observed only at runtime.
Theoretical and Interdisciplinary Analysis
In this study, there is an interdisciplinary perspective that involves aspects from software engineering, graph theory, cybersecurity, and regulatory compliance. The traditional focus on compliance from a security perspective is shifted to the modelling of interactions between program behaviour, data flow, and program execution in a model referred to as the Behaviour Property Graph.
This model is also consistent with graph-based program analysis literature. FlowCog (Pan et al., 2018), and Amandroid (Wei et al., 2018) are research works that prove that the representation in graphs helps in behavioural analysis and in detecting vulnerabilities. The approach is taken further by Fan et al., who apply the approach of integrating graphs specifically for Compliance Detection and detect Non-Compliant Android Applications.
Still, the theoretical discussion revolves around implementation. It has been mentioned in the paper how the Behaviour Property Graphs are created, but there is no discussion about the theoretical perspective in the context of software compliance, privacy engineering and secure software development.
Ethical Considerations
An essential ethical problem is raised in this research paper as it discusses the use of Compliance Detection to safeguard user privacy and promote ethical software development. Most mobile applications gather a lot of private information; the detection of compliance problems enables developers to comply with privacy standards and avoid risks connected to Non-Compliant Applications.
One of the advantages of the method is that it is possible to analyse the code of an application without monitoring its users’ actions and gathering more personal information during execution. As opposed to dynamic approaches, the static graph-based one offers a less obtrusive solution to check the compliance of Android apps.
Nonetheless, the research pays less attention to the impacts that arise due to false positives and negatives. Wrong findings can lead to developers having a high workload or even allowing non-compliant applications to be used by users, hence making them vulnerable to privacy threats. Moreover, the research fails to mention any ethical concerns, including those relating to explainability, transparency, and fairness of such automation systems.
Writing Style and Structure
The paper is well-structured, and the discussion proceeds logically from the problem to the solution framework, implementation and evaluation. Technical terminologies are complemented with diagrams and algorithms to ensure better understanding of the Behaviour Property Graph and its significance in relation to Android App Security. This way, the article becomes easier for software engineers to comprehend.
Nevertheless, some parts of the paper are too technical, making it difficult for people not familiar with program analysis using graphs. Moreover, while the paper emphasises the implementation issues, the use of the Compliance Detection Framework in real-world scenarios is not discussed in depth. Therefore, adding some case studies in the paper could be beneficial.
Conclusion
Bridging the Compliance Gap: Efficient and Effective Detection of Non-Compliant Behaviours in Android Applications is a highly significant contribution to Compliance Detection Research since it uses the Behaviour Property Graph for detecting non-compliance. Using several different forms of program representation and analysis of behaviour via graphs solves many of the shortcomings associated with traditional approaches to static and dynamic analysis.
Even though this research needs further testing internationally, as well as a deeper theoretical framework, along with a more thorough examination of problems related to the implementation, this paper shows how powerful graph-based algorithms can be used in the field of Android Application Compliance and Mobile Application Security. In general, this article offers a good base for future studies in this field.
“Need support with your critical review? PhD Assistance Research Lab provides expert guidance for doctoral scholars and early-career researchers to enhance their review in the: Effective and Efficient Detection of Non-Compliant Behaviours in Android Applications.”
Reference
- Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Le Traon, Y., Octeau, D., & McDaniel, P. (2014). FlowDroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps. Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’14), 259–269. https://doi.org/10.1145/2594291.2594299
- Enck, W., Gilbert, P., Han, S., Tendulkar, V., Chun, B.-G., Cox, L. P., Jung, J., McDaniel, P., & Sheth, A. N. (2014). TaintDroid: An information-flow tracking system for real-time privacy monitoring on smartphones. ACM Transactions on Computer Systems, 32(2), Article 5. https://doi.org/10.1145/2619091
- Fan, X., Zhao, J., Wang, X., Zhang, J., Yang, S., & Liu, Y. (2026). Bridging the compliance gap: Effective, efficient detection of non-compliant behaviour in Android applications. Tsinghua Science and Technology. (Use the publication details exactly as provided in your uploaded article.) https://www.sciopen.com/local/article_pdf/10.26599/TST.2024.9010220.pdf
- Pan, H., Liang, X., Wang, Y., Zhang, Y., & Yang, Y. (2018). FlowCog: Context-aware semantic analysis for detecting vulnerabilities in Android applications. IEEE Access, 6, 67982–67995. https://yinzhicao.org/flowcog/flowcog-journal.pdf
- Wei, F., Roy, S., Ou, X., & Robby. (2018). Amandroid: A precise and general inter-component data flow analysis framework for security vetting of Android apps. ACM Transactions on Privacy and Security, 21(3), Article 14. https://dl.acm.org/doi/10.1145/3183575