发表机构
PUC-Rio（天主教里约热内卢大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
PrivDev将122个Bearer CLI数据类型映射到DPV-PD类别并关联GDPR条款，结合确定性匹配与检索增强LLM，生成经SHACL验证的RDF知识图谱，人工评估显示映射合理且可复现。
AI 中文摘要
静态分析扫描器能够识别源代码中的个人数据类型，但缺乏将这些发现连接到标准化隐私词汇表的机制。PrivDev将122个Bearer CLI数据类型映射到数据隐私词汇表个人数据（DPV-PD）类别，并将它们链接到可能相关的GDPR条款。我们的方法结合了43个精确标签匹配的确定性映射与基于检索的增强大型语言模型（LLM），以解决剩余的79个非平凡映射。生成的RDF知识图谱包含118个ODRL策略资源，这些资源已通过SHACL进行结构验证。该工件通过了五个互补的验证门，涵盖结构正确性、查询一致性、检索质量、基于LLM的评估和人工评估。在人工评估中，九名标注者产生了711项判断，原始一致性为0.72，Gwet的AC1为0.68，Gwet的AC2为0.88。我们的结果表明，所提出的映射是合理且可复现的，同时也揭示了扫描器定义的数据类型标签中的歧义以及DPV-PD中的覆盖缺口。
英文摘要
Static-analysis scanners can identify personal-data types in source code, but they lack mechanisms to connect these findings to standardized privacy vocabularies. PrivDev maps 122 Bearer CLI data types to Data Privacy Vocabulary Personal Data (DPV-PD) categories and links them to potentially relevant GDPR provisions. Our approach combines deterministic mapping for 43 exact-label matches with a retrieval-grounded Large Language Model (LLM) to resolve the remaining 79 non-trivial mappings. The resulting RDF knowledge graph contains 118 ODRL policy resources that were structurally validated using SHACL. The artifact passed five complementary validation gates that cover structural correctness, query consistency, retrieval quality, LLM-based assessment, and human evaluation. In human evaluation, nine annotators produced 711 judgments, yielding a raw agreement of 0.72, Gwet's AC1 of 0.68, and Gwet's AC2 of 0.88. Our results indicate that the proposed mappings are plausible and reproducible, while also revealing ambiguities in scanner-defined data-type labels and coverage gaps in DPV-PD.
Comments7 pages, 1 figure, 4 tables. Published at the 14th Workshop on Software Visualization, Maintenance and Evolution (VEM 2026), part of CBSoft 2026, São Paulo, Brazil. Received the workshop's Best Paper Award. Conference version available at https://cbsoft.sbc.org.br/2026/data/papers/workshops/PrivDev%20Mapping%20Static-Analysis%20Data%20Types%20to%20DPV.pdf
