Personal Information Classification on Aggregated Android Application’s Permissions
Source abstract
Abstract
Android is offering millions of apps on Google Play-store by the application publishers. However, those publishers do have a parent organization and share information with them. Through the ‘Android permission system’, a user permits an app to access sensitive personal data. Large-scale personal data integration can reveal user identity, enabling new insights and earn revenue for the organizations. Similarly, aggregation of Android app permissions by the app owning parent organizations can also cause privacy leakage by revealing the user profile. This work classifies risky personal data by proposing a threat model on the large-scale app permission aggregation by the app publishers and associated owners. A Google-play application programming interface (API) assisted web app is developed that visualizes all the permissions an app owner can collectively gather through multiple apps released via several publishers. The work empirically validates the performance of the risk model with two case studies. The top two Korean app owners, seven publishers, 108 apps and 720 sets of permissions are studied. With reasonable accuracy, the study finds the contact number, biometric ID, address, social graph, human behavior, email, location and unique ID as frequently exposed data. Finally, the work concludes that the real-time tracking of aggregated permissions can limit the odds of user profiling.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Spam and Phishing Detection · Privacy, Security, and Data Protection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Engineering, Inje University, Gimhae 50834, Korea
Department of Applied Mathematics, Inje University, Gimhae 50834, Korea
Department of Healthcare and IT, Inje University, Gimhae 50834, Korea
Funding
Institute for Information and Communications Technology Promotion
References (97)
Show source-provided references
1. Influence of privacy priming and security framing on mobile app selection10.1016/j.cose.2018.06.005 ↗
2. Mohiuddin Ahmed, A.-S.K.P. (2018). Blockchain in the Era of Industry 4.0. Data Analytics: Concepts, Techniques, and Applications, CRC Press.
3. Recent Advances and Challenges in Mobile Big Data10.1109/MCOM.2018.1700294 ↗
4. Cadwalladr, C., and Graham-Harrison, E. (2019, February 12). Revealed: 50 Million Facebook Profiles Harvested for Cambridge Analytica in Major Data Breach. Available online: https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election.
5. Volodzko, D. (2019, February 12). Marriott Breach. Available online: https://www.forbes.com/sites/davidvolodzko/2018/12/04/marriott-breach-exposes-far-more-than-just-data/#19e9b70f6297.
6. Kenthapadi, K., Mironov, I., and Thakurta, A. (2019, January 20–25). Privacy-preserving Data Mining in Industry. Proceedings of the 2019 World Wide Web Conference, Taipei, Taiwan.10.1145/3308560.3320085 ↗
7. Dynamic privacy leakage analysis of Android third-party libraries
8. An empirical study of collaborative model and its security risk in Android10.1016/j.jss.2017.07.042 ↗
9. Enhancing the Description-to-Behavior Fidelity in Android Apps with Privacy Policy10.1109/TSE.2017.2730198 ↗
10. Ito, K., Hasegawa, H., Yamaguchi, Y., and Shimada, H.Y. (2018, January 3–5). Detecting Privacy Information Abuse by Android Apps from API Call Logs. Proceedings of the 2018 International Workshop on Security, Miyagi, Japan.10.1007/978-3-319-97916-8_10 ↗
11. Islam, M.R. (2014). Numeric rating of Apps on Google Play Store by sentiment analysis on user reviews. Proceedings of the 2014 International Conference on Electrical Engineering and Information & Communication Technology, IEEE.10.1109/ICEEICT.2014.6919058 ↗
12. Hatamian, M., Momen, N., Fritsch, L., and Rannenberg, K. (2019). A Multilateral Privacy Impact Analysis Method for Android Apps. Annual Privacy Forum, Springer.10.1007/978-3-030-21752-5_7 ↗
13. An Android Communication App Forensic Taxonomy10.1111/1556-4029.13164 ↗
14. Forensic Taxonomy of Android Social Apps10.1111/1556-4029.13267 ↗
15. Mehrnezhad, M., and Toreini, E. (2019). What Is This Sensor and Does This App Need Access to It?. Informatics, 6.10.3390/informatics6010007 ↗
16. Gu, J., Huang, R., Jiang, L., Qiao, G., Du, X., and Guizani, M. (2019). A Fog Computing Solution for Context-Based Privacy Leakage Detection for Android Healthcare Devices. Sensors, 19.10.3390/s19051184 ↗
17. Cybersecurity for Android Applications: Permissions in Android 5 and 610.1080/10447318.2018.1489580 ↗
18. User reviews of top mobile apps in Apple and Google app stores10.1145/3141771 ↗
19. Characterizing android apps’ behavior for effective detection of malapps at large scale10.1016/j.future.2017.04.041 ↗
20. Kumar, R., Zhang, X., Khan, R.U., and Sharif, A. (2019). Research on Data Mining of Permission-Induced Risk for Android IoT Devices. Appl. Sci., 9.10.3390/app9020277 ↗
21. Kim, J., and Jung, I. (2018). Efficient Protection of Android Applications through User Authentication Using Peripheral Devices. Sustainability, 10.10.3390/su10041290 ↗
22. Liu, X., Du, X., Zhang, X., Zhu, Q., Wang, H., and Guizani, M. (2019). Adversarial Samples on Android Malware Detection Systems for IoT Systems. Sensors, 19.10.3390/s19040974 ↗
23. Doğru, İ., and KİRAZ, Ö. (2018). Web-based android malicious software detection and classification system. Appl. Sci., 8.10.3390/app8091622 ↗
24. The relative contributions of private information sharing and public information releases to information aggregation10.1016/j.jet.2009.10.017 ↗
25. The Data Sharing Economy: On the Emergence of New Intermediaries
26. Investigating sources of PII used in Facebook’s targeted advertising10.2478/popets-2019-0013 ↗
27. Assessment of the data sharing and privacy practices of smartphone apps for depression and smoking cessation10.1001/jamanetworkopen.2019.2542 ↗
28. Linking Platforms, Practices, and Developer Ethics: Levers for Privacy Discourse in Mobile Application Development10.1007/s10551-017-3504-8 ↗
29. (2019, August 06). Facebook, Instagram, WhatsApp Go down Simultaneously. Available online: https://www.businesstoday.in/technology/internet/facebook-instagram-whatsapp-go-down-simultaneously/story/327610.html.
30. (2019, July 29). Facebook is Sharing Users’ WhatsApp and Instagram Data to Catch Terrorists | The Independent. Available online: https://www.independent.co.uk/life-style/gadgets-and-tech/news/facebook-policy-share-users-data-across-whatsapp-instagram-tackle-terrorists-social-media-app-isis-a7797201.html.
31. Rangole, W.F.H.K. (2019). Large-Scale Authorization Data Collection and Aggregation. (16/056,322), US Patents.
32. Grust, T., Naumann, F., Böhm, A., Lehner, W., Härder, T., Rahm, E., Heuer, A., Klettke, M., and Meyer, H. (2019). Efficient data-parallel cumulative aggregates for large-scale machine learning. BTW 2019, Gesellschaft für Informatik.
33. Bakalash, R., Shaked, G., and Caspi, J. (2008). Enterprise-Wide Data-Warehouse with Integrated Data Aggregation Eng. (7,315,849), U.S. Patent.
34. Solving big data challenges for enterprise application performance management10.14778/2367502.2367512 ↗
35. Fritsch, L., Roßnagel, H., and Hühnlein, D. (2017). Derived Partial Identities Generated from App Permissions. Open Identity Summit 2017, Gesellschaft für Informatik.
36. Jinhong, Y., Chul-Soo, K.I.M., and ONIK, M.M.H. (2019). Aggregated Risk Modelling of Personal Data Privacy in Internet of Things. Proceedings of the 2019 21st International Conference on Advanced Communication Technology (ICACT), IEEE.
37. Onik, M.M.H., Al-Zaben, N., Yang, J., Lee, N.-Y., and Kim, C.-S. (2018). Risk Identification of Personally Identifiable Information from Collective Mobile App Data. Proceedings of the International Conference on Computing, Electronics & Communications Engineering 2018 (iCCECE ’18), IEEE.10.1109/iCCECOME.2018.8659213 ↗
38. Liang, S., and Du, X. (2014). Permission-combination-based scheme for android mobile malware detection. Proceedings of the 2014 IEEE International Conference on Communications (ICC), IEEE.10.1109/ICC.2014.6883666 ↗
39. Shuba, A., Bakopoulou, E., Mehrabadi, M.A., Le, H., Choffnes, D., and Markopoulou, A. (2018). AntShield: On-Device Detection of Personal Information Exposure. arXiv.
40. Privacy Issues in Smartphone Applications: An Analysis of Headache/Migraine Applications10.1111/head.13341 ↗
41. Hosseini, M., Qin, X., Wang, X., and Niu, J. (2018, January 2–7). Extracting Information Types from Android Layout Code Using Sequence to Sequence Learning. Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence, New Orleans, LA, USA.
42. Role of new ideas in the mobile phone market share10.1142/S1793962318500186 ↗
43. (2019, April 06). Kakao. Available online: https://www.kakaocorp.com/.
44. (2019, April 06). Naver. Available online: https://www.naver.com/.
45. (2019, May 11). Privacy Analysis on Mobile App. Available online: http://52.79.237.144:3000/.
46. Taking stock of organisations’ protection of privacy: Categorising and assessing threats to personally identifiable information in the USA10.1057/s41303-017-0065-y ↗
47. European union data privacy law reform: General data protection regulation, privacy shield, and the right to delisting
48. McCallister, E. (2010). Guide to Protecting the Confidentiality of Personally Identifiable Information, Diane Publishing.10.6028/NIST.SP.800-122 ↗
49. Anonymity, unlinkability, undetectability, unobservability, pseudonymity, and identity management-a consolidated proposal for terminology
50. Kaur, G., and Agrawal, S. (2018, January 29–30). Differential Privacy Framework: Impact of Quasi-identifiers on Anonymization. Proceedings of the 2nd International Conference on Communication, Computing and Networking, Chandigarh, India.10.1007/978-981-13-1217-5_4 ↗
51. Learning quasi-identifiers for privacy-preserving exchanges: A rough set theory approach
52. Murphy, R.S. (2017). Property rights in personal information: An economic defense of privacy. Privacy, Routledge.10.4324/9781315246024-4 ↗
53. (2019, February 12). NIST PII, Available online: https://csrc.nist.gov/glossary/term/personally-identifiable-information.
54. Butler, D.A., and Rodrick, S. (2015). Australian Media Law, Thomson Reuters (Professional) Australia Limited.
55. De-identified data and third party data mining: The risk of re-identification of personal information
56. Momen, N., Pulls, T., Fritsch, L., and Lindskog, S. (2017). How Much Privilege Does an App Need? Investigating Resource Usage of Android Apps (Short Paper). Proceedings of the 2017 15th Annual Conference on Privacy, Security and Trust (PST), IEEE.10.1109/PST.2017.00039 ↗
57. (2019, April 06). Android Apps on Google Play. Available online: https://play.google.com/store/apps.
58. (2019, July 01). iTunes - Apple (IN). Available online: https://www.apple.com/kr/itunes/.
59. (2018, December 12). Google Developers Android Dangerous Permissions. Available online: https://developer.android.com/guide/topics/permissions/overview.
60. Sharma, U., and Bansal, D. (2018). A Study of Android Application Execution Trends and Their Privacy Threats to a User with Respect to Data Leaks and Compromise. Advanced Computational and Communication Paradigms, Springer.10.1007/978-981-10-8237-5_65 ↗
61. Baalous, R., and Poet, R. (2018, January 9–11). How Dangerous Permissions are Described in Android Apps’ Privacy Policies?. Proceedings of the 11th International Conference on Security of Information and Networks, Glasgow, UK.10.1145/3264437.3264477 ↗
62. Sivan, N., Bitton, R., and Shabtai, A. (2018). Analysis of Location Data Leakage in the Internet Traffic of Android-based Mobile Devices. arXiv.
63. Kim, K., Kim, T., Lee, S., Kim, S., and Kim, H. (2018, January 28–30). When Harry Met Tinder: Security Analysis of Dating Apps on Android. Proceedings of the 2018 Nordic Conference on Secure IT Systems, Oslo, Norway.10.1007/978-3-030-03638-6_28 ↗
64. A Novel Approach for Network Attack Classification based on Sequential Questions10.33166/AETiC.2018.02.001 ↗
65. Chiluka, N., Singh, A.K., and Eswarawaka, R. (2018, January 11–12). Privacy and Security Issues Due to Permissions Glut in Android System. Proceedings of the 2018 International Conference on Inventive Research in Computing Applications (ICIRCA), Coimbatore, India.10.1109/ICIRCA.2018.8597321 ↗
66. Jadon, P., and Mishra, D.K. (2019). Security and Privacy Issues in Big Data: A Review. Emerging Trends in Expert Applications and Security, Springer.10.1007/978-981-13-2285-3_77 ↗
67. Jain, V., Laxmi, V., Gaur, M., and On, M.M. (2019, January 23–25). APPLADroid: Automaton Based Inter-app Privacy Leak Analysis for Android. Proceedings of the 2019 International Conference on Security & Privacy, Prague, Czech Republic.10.1007/978-981-13-7561-3_16 ↗
68. Towards Privacy Risk Analysis in Android Applications Using Machine Learning Approaches10.4018/IJESMA.2019040101 ↗
69. Mismanagement of personally identifiable information and the reaction of interested parties to safeguarding privacy in South Korea
70. A taxonomy and qualitative comparison of program analysis techniques for security assessment of android software10.1109/TSE.2016.2615307 ↗
71. Significant Permission Identification for Machine Learning Based Android Malware Detection10.1109/TII.2017.2789219 ↗
72. Arora, A., Peddoju, S.K., Chouhan, V., and Chaudhary, A. (November, January 29). Poster: Hybrid Android Malware Detection by Combining Supervised and Unsupervised Learning. Proceedings of the 24th Annual International Conference on Mobile Computing and Networking, New Delhi, India.
73. Shuba, A., Bakopoulou, E., and Markopoulou, A. (2018, January 25–28). Privacy Leak Classification on Mobile Devices. Proceedings of the IEEE Workshop on Signal Processing Advances in Wireless Communications, SPAWC, Kalamata, Greece.10.1109/SPAWC.2018.8445948 ↗
74. Razaghpanah, A., Nithyanand, R., Vallina-Rodriguez, N., Sundaresan, S., Allman, M., Kreibich, C., and Gill, P. (2018, January 18–21). Apps, Trackers, Privacy, and Regulators: A Global Study of the Mobile Tracking Ecosystem. Proceedings of the 2018 Network and Distributed System Security Symposium, San Diego, CA, USA.10.14722/ndss.2018.23353 ↗
75. Ren, J., Rao, A., Lindorfer, M., Legout, A., and Choffnes, D. (2016, January 25–30). Recon: Revealing and controlling pii leaks in mobile network traffic. Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services, Singapore.
76. The legality of deep packet inspection
77. HIPAA and protecting health information in the 21st Century10.1001/jama.2018.5630 ↗
78. Onik, M.M.H., Kim, C.S., and Yang, J. (2019, January 17–20). Personal Data Privacy Challenges of the Fourth Industrial Revolution. Proceedings of the 2019 21st International Conference on Advanced Communication Technology (ICACT), PyeongChang, Korea.10.23919/ICACT.2019.8701932 ↗
79. (2019, April 05). Permissions Overview. Available online: https://developer.android.com/guide/topics/permissions/overview.
80. Galloway, S. (2017). The Four: The Hidden DNA of Amazon, Apple, Facebook and Google, Bantam Press.
81. (2019, July 11). The Data Brokers Quietly Buying and Selling Your Personal Information. Available online: https://www.fastcompany.com/90310803/here-are-the-data-brokers-quietly-buying-and-selling-your-personal-information.
82. Liccardi, I., Pato, J., Weitzner, D., Abelson, H., and De Roure, D. (2014, January 12–14). No technical understanding required: Helping users make informed choices about access to their personal data. Proceedings of the 11th International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, Houston, TX, USA.10.4108/icst.mobiquitous.2014.258066 ↗
83. Kumar, S., and Shanker, R. (2018, January 18–20). Context Aware Dynamic Permission Model: A Retrospect of Privacy and Security in Android System. Proceedings of the 2018 International Conference on Intelligent Circuits and Systems, Hsinchu, Taiwan.10.1109/ICICS.2018.00073 ↗
84. Todorov, A., Chaiken, S., and Henderson, M.D. (2002). The heuristic-systematic model of social information processing. The Persuasion Handbook: Developments in Theory and Practice, SAGE Publications Sage UK.10.4135/9781412976046.n11 ↗
85. Creswell, J., and Poth, C. (2017). Qualitative Inquiry and Research Design: Choosing among Five Approaches, Sage Publications Sage CA.
86. (2019, August 06). Kakaotalk: Number of Monthly Active Users Worldwide 2019 | Statista. Available online: https://www.statista.com/statistics/278846/kakaotalk-monthly-active-users-mau/.
87. (2019, August 06). YouTube Threatens Naver in Korean Internet Search Market - 비즈니스코리아 - BusinessKorea. Available online: http://www.businesskorea.co.kr/news/articleView.html?idxno=30000.
88. (2019, July 30). Top Grossing Apps and Download Statistics Google Play | App Annie. Available online: https://www.appannie.com/en/apps/google-play/top/south-korea/overall/.
89. An introduction to the WEKA data mining system10.1145/1140123.1140127 ↗
90. Classification and regression by randomForest
91. A survey of decision tree classifier methodology10.1109/21.97458 ↗
92. Multi-label classification: An overview10.4018/jdwm.2007070101 ↗
93. Bagging predictors10.1007/BF00058655 ↗
94. Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation
95. Boström, H. (2007, January 13–15). Estimating Class Probabilities in Random Forests. Proceedings of the 2007 Sixth International Conference on Machine Learning and Applications, ICMLA 2007, Cancun, Mexico.10.1109/ICMLA.2007.64 ↗
96. Calibrating random forests for probability estimation10.1002/sim.6959 ↗
97. Machine learning-based malicious application detection of android10.1109/ACCESS.2017.2771470 ↗