Abstract:Assessing description-to-permission fidelity is critical for safeguarding personal data accessed through sensitive APIs in Android apps. However, it remains a challenge for existing methods, both static and dynamic. Static methods are either infeasible due to various dynamic features (e.g., code obfuscation, dynamic class loading, and reflection) or too coarse-grained to understand how sensitive APIs collect privacy data under runtime contexts. Existing dynamic methods lack contextual understanding regarding sensitive API calls. For example, they fail to understand which GUI widgets are more likely to trigger sensitive APIs and ignore the preceding UI contexts that could reveal the intention of API calls when analyzing their fidelity.In this paper, we propose an API-driven automated dynamic analysis tool called APIMind for assessing runtime description-to-permission fidelity in Android apps. APIMind can discover sensitive APIs more effectively by utilizing multimodal features to jointly infer the semantics of GUI widgets and leveraging deep networks to automatically learn their relationship based on multifaceted rewards. Then, it could accurately assess description-to-permission fidelity by developing an extended tool that considers dual UI contexts (i.e., preceding and current contexts). We evaluate the accuracy and efficiency of APIMind using 121 real-world apps. Experimental results demonstrate that APIMind can achieve a detection accuracy of 96.1%. Compared to the competitive baseline, APIMind increases efficiency by 43%. In addition, based on our proposed tool, we conduct a large-scale case study of 1013 real Android apps, which reveals the prevalence of several typical inconsistencies and demonstrates the effectiveness of our approach in the wild.

PERUIM

What Permissions Should This Android App Request?

Automated Android Application Permission Recommendation

Privacy Requirements Patterns for Mobile Operating Systems

Comparison of Perceptual Differences Between Users and Designers in Mobile Shopping App Interface Design: Implications for Evaluation Practice

Understanding the Purpose of Permission Use in Mobile Apps

Detecting capability leaks in Android-based smartphones

Automatic Permission Optimization Framework for Privacy Enhancement of Mobile Applications

Finding the Missing Piece: Permission Specification Analysis for Android NDK

Component-based Permission Management of Android Applications

Rethinking Permission Enforcement Mechanism on Mobile Systems.

Mining Android App Descriptions for Permission Requirements Recommendation

Broken Relationship of Mobile User Intentions and Permission Control of Shared System Resources

Enhancement of Permission Management for an ARM-Android Platform.

APIMind: API-driven Assessment of Runtime Description-to-permission Fidelity in Android Apps.

Same Origin Based Fine-Grained Privacy Protection for Mobile Applications

Automatic, Highly Accurate App Permission Recommendation

Measuring and Characterizing (mis)compliance of the Android permission system

Perman: Fine-Grained Permission Management for Android Applications

SmartPI: Understanding Permission Implications of Android Apps from User Reviews

ON RELATIONSHIP OF FUNCTIONS AND PERMISSIONS IN ANDROID APPLICATIONS