PerHelper: Helping Developers Make Better Decisions on Permission Uses in Android Apps
Source abstract
Abstract
Permission-related issues in Android apps have been widely studied in our research community, while most of the previous studies considered these issues from the perspective of app users. In this paper, we take a different angle to revisit the permission-related issues from the perspective of app developers. First, we perform an empirical study on investigating how we can help developers make better decisions on permission uses during app development. With detailed experimental results, we show that many permission-related issues can be identified and fixed during the application development phase. In order to help developers to identify and fix these issues, we develop PerHelper, an IDEplugin to automatically infer candidate permission sets, which help guide developers to set permissions more effectively and accurately. We integrate permission-related bug detection into PerHelper and demonstrate its applicability and flexibility through case studies on a set of open-source Android apps.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Software Testing and Debugging Techniques · Software Engineering Research
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Cyberspace Security, Being University of Posts and Telecommunications, Beijing 100876, China
Information Security Research Institute, Beijing Institute of Electronic Science and Technology, Beijing 100070, China
National Computer Network Emergency Response Technical Team, Coordination Center of China, Beijing 100029, China
References (61)
Show source-provided references
1. (2019, August 02). Number of Android Applications. Available online: https://www.appbrain.com/stats.
2. Wang, H., Li, H., and Guo, Y. (2019, January 13–17). Understanding the evolution of mobile app ecosystems: A longitudinal measurement study of google play. Proceedings of the World Wide Web Conference, San Francisco, CA, USA.10.1145/3308558.3313611 ↗
3. Wang, H., Hong, J., and Guo, Y. (2015, January 7–11). Using text mining to infer the purpose of permission use in mobile apps. Proceedings of the 2015 ACM International Joint Conference on Pervasive and Ubiquitous Computing, Osaka, Japan.10.1145/2750858.2805833 ↗
4. Kumar, R., Zhang, X., Khan, R.U., and Sharif, A. (2019). Research on data mining of permission-induced risk for android IoT devices. Appl. Sci., 9.10.3390/app9020277 ↗
5. Stevens, R., Ganz, J., Devanbu, P., Chen, H., and Filkov, V. (2013, January 18–19). Asking for (and About) Permissions Used by Android Apps. Proceedings of the the 10th Working Conference on Mining Software Repositories (MSR’13), San Francisco, CA, USA.10.1109/MSR.2013.6624000 ↗
6. Vidas, T., Christin, N., and Cranor, L. (April, January 28). Curbing Android permission creep. Proceedings of the 20th International Conference on World Wide Web, Hyderabad, India.
7. Wu, S., and Liu, J. (2019, January 20–24). Overprivileged Permission Detection for Android Applications. Proceedings of the ICC 2019—2019 IEEE International Conference on Communications (ICC), Shanghai, China.10.1109/ICC.2019.8761572 ↗
8. Felt, A.P., Chin, E., Hanna, S., Song, D., and Wagner, D. (2011, January 17–21). Android Permissions Demystified. Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS ’11), Chicago, IL, USA.10.1145/2046707.2046779 ↗
9. Au, K.W.Y., Zhou, Y.F., Huang, Z., and Lie, D. (2012, January 16–18). PScout: Analyzing the Android Permission Specification. Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS’12), Raleigh, NC, USA.10.1145/2382196.2382222 ↗
10. Bartel, A., Klein, J., Le Traon, Y., and Monperrus, M. (2012, January 3–7). Automatically Securing Permission-based Software by Reducing the Attack Surface: An Application to Android. Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering (ASE’12), Essen, Germany.10.1145/2351676.2351722 ↗
11. Wu, L., Grace, M., Zhou, Y., Wu, C., and Jiang, X. (2013, January 4–8). The Impact of Vendor Customizations on Android Security. Proceedings of the the 2013 ACM SIGSAC Conference on Computer Communications Security (CCS ’13), Berlin, Germany.10.1145/2508859.2516728 ↗
12. Wang, H., Guo, Y., Tang, Z., Bai, G., and Chen, X. (2015, January 6–10). Reevaluating android permission gaps with static and dynamic analysis. Proceedings of the 2015 IEEE Global Communications Conference (GLOBECOM), San Diego, CA, USA.10.1109/GLOCOM.2015.7417621 ↗
13. Yang, K., Zhuge, J., Wang, Y., Zhou, L., and Duan, H. (2014, January 3–6). IntentFuzzer: Detecting Capability Leaks of Android Applications. Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, Kyoto, Japan.10.1145/2590296.2590316 ↗
14. Gibler, C., Crussell, J., Erickson, J., and Chen, H. (2012, January 13–15). AndroidLeaks: Automatically Detecting Potential Privacy Leaks in Android Applications on a Large Scale. Proceedings of the 5th International Conference on Trust and Trustworthy Computing (TRUST’12), Vienna, Austria.10.1007/978-3-642-30921-2_17 ↗
15. Grace, M., Zhou, Y., Zhang, Q., Zou, S., and Jiang, X. (2012, January 25–29). RiskRanker: Scalable and Accurate Zero-day Android Malware Detection. Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services (MobiSys ’12), Low Wood Bay, UK.10.1145/2307636.2307663 ↗
16. Liu, B., Lin, J., and Sadeh, N. (2014, January 7–11). Reconciling Mobile App Privacy and Usability on Smartphones: Could User Privacy Profiles Help?. Proceedings of the 23rd International Conference on World Wide Web, Seoul, Korea.10.1145/2566486.2568035 ↗
17. Lin, J., Liu, B., Sadeh, N., and Hong, J.I. (2014, January 9–11). Modeling Users’ Mobile App Privacy Preferences: Restoring Usability in a Sea of Permission Settings. Proceedings of the Symposium On Usable Privacy and Security (SOUPS 2014), Menlo Park, CA, USA.
18. (2019, August 02). System Permissions. Available online: http://developer.android.com/guide/topics/security/permissions.html.
19. (2019, August 02). Android API References. Available online: http://developer.android.com/reference/packages.html.
20. Balebako, R., Marsh, A., Lin, J., Hong, J., and Cranor, L. (2014, January 23). The Privacy and Security Behaviors of Smartphone App Developers. Proceedings of the Workshop on Usable Security (USEC), San Diego, CA, USA.10.14722/usec.2014.23006 ↗
21. Felt, A.P., Ha, E., Egelman, S., Haney, A., Chin, E., and Wagner, D. (2012, January 11–13). Android permissions: User attention, comprehension, and behavior. Proceedings of the Eighth Symposium on Usable Privacy and Security, Washington, DC, USA.10.1145/2335356.2335360 ↗
22. Kelley, P.G., Consolvo, S., Cranor, L.F., Jung, J., Sadeh, N., and Wetherall, D. (2012). A conundrum of permissions: Installing applications on an Android smartphone. Financial Cryptography and Data Security, Springer.10.1007/978-3-642-34638-5_6 ↗
23. Enck, W., Ongtang, M., and McDaniel, P. (2009, January 9–13). On Lightweight Mobile Phone Application Certification. Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS’09), Chicago, IL, USA.10.1145/1653662.1653691 ↗
24. Barrera, D., Kayacik, H.G., van Oorschot, P.C., and Somayaji, A. (2010, January 4–8). A Methodology for Empirical Analysis of Permission-based Security Models and Its Application to Android. Proceedings of the 17th ACM Conference on Computer and Communications Security (CCS ’10), Chicago, IL, USA.10.1145/1866307.1866317 ↗
25. Xu, W., Zhang, F., and Zhu, S. (2013, January 4–7). Permlyzer: Analyzing permission usage in Android applications. Proceedings of the 2013 IEEE 24th International Symposium on Software Reliability Engineering (ISSRE), Pasadena, CA, USA.10.1109/ISSRE.2013.6698893 ↗
26. Reddy, N., Jeon, J., Vaughan, J., Millstein, T., and Foster, J. (2011). Application-Centric Security Policies on Unmodified Android, UCLA Computer Science Department. Technical Report.
27. Nauman, M., Khan, S., and Zhang, X. (2010, January 13–16). Apex: Extending Android permission model and enforcement with user-defined runtime constraints. Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, Beijing, China.10.1145/1755688.1755732 ↗
28. Jeon, J., Micinski, K.K., Vaughan, J.A., Fogel, A., Reddy, N., Foster, J.S., and Millstein, T. (2012, January 19). Dr. Android and mr. Hide: Fine-grained permissions in Android applications. Proceedings of the Second ACM Workshop on Security and Privacy in Smartphones and Mobile Devices, Raleigh, NC, USA.10.1145/2381934.2381938 ↗
29. Liu, B., Liu, B., Jin, H., and Govindanz, R. (2015, January 18–22). Efficient Privilege De-Escalation for Ad Libraries in Mobile Apps. Proceedings of the 13th International Conference on Mobile Systems, Applications, and Services (MobiSys ’15), Florence, Italy.10.1145/2742647.2742668 ↗
30. TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones10.1145/2619091 ↗
31. Zhou, Y., Zhang, X., Jiang, X., and Freeh, V.W. (2011, January 22–24). Taming information-stealing smartphone applications (on android). Proceedings of the International Conference on Trust and Trustworthy Computing, Pittsburgh, PA, USA.10.1007/978-3-642-21599-5_7 ↗
32. Beresford, A.R., Rice, A., Skehin, N., and Sohan, R. (2011, January 1–3). Mockdroid: Trading privacy for application functionality on smartphones. Proceedings of the 12th Workshop on Mobile Computing Systems and Applications, Phoenix, AZ, USA.10.1145/2184489.2184500 ↗
33. Hornyack, P., Han, S., Jung, J., Schechter, S., and Wetherall, D. (2011, January 17–21). These aren’t the droids you’re looking for: Retrofitting android to protect data from imperious applications. Proceedings of the 18th ACM Conference on Computer and Communications Security, Chicago, IL, USA.10.1145/2046707.2046780 ↗
34. Tang, Y., Ames, P., Bhamidipati, S., Bijlani, A., Geambasu, R., and Sarda, N. (2012, January 8–10). CleanOS: Limiting mobile data exposure with idle eviction. Proceedings of the 10th USENIX Symposium on Operating Systems Design and Implementation (OSDI ’12), Hollywood, CA, USA.
35. Kynoid: Real-time enforcement of fine-grained, user-defined, and data-centric security policies for android10.1016/j.istr.2012.10.006 ↗
36. Understanding the purpose of permission use in mobile apps10.1145/3086677 ↗
37. Lin, J., Amini, S., Hong, J.I., Sadeh, N., Lindqvist, J., and Zhang, J. (2012, January 5–8). Expectation and Purpose: Understanding Users’ Mental Models of Mobile App Privacy Through Crowdsourcing. Proceedings of the 2012 ACM Conference on Ubiquitous Computing (UbiComp’12), Pittsburgh, PA, USA.10.1145/2370216.2370290 ↗
38. Ismail, Q., Ahmed, T., Kapadia, A., and Reiter, M.K. (2015, January 18–23). Crowdsourced Exploration of Security Configurations. Proceedings of the 33rd Annual ACM Conference on Human Factors in Computing Systems, CHI 2015, Seoul, Korea.10.1145/2702123.2702370 ↗
39. Zhou, Y., and Jiang, X. (2012, January 20–23). Dissecting Android malware: Characterization and evolution. Proceedings of the 2012 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP.2012.16 ↗
40. Zhou, Y., Wang, Z., Zhou, W., and Jiang, X. (2012, January 5–8). Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets. Proceedings of the NDSS 2012, San Diego, CA, USA.
41. Wang, H., Liu, Z., Guo, Y., Chen, X., Zhang, M., Xu, G., and Hong, J. (2017, January 3–7). An explorative study of the mobile app ecosystem from app developers’ perspective. Proceedings of the 26th International Conference on World Wide Web, Perth, Australia.10.1145/3038912.3052712 ↗
42. Wang, H., Wang, X., and Guo, Y. (2019, January 25). Characterizing the global mobile app developers: A large-scale empirical study. Proceedings of the 6th International Conference on Mobile Software Engineering and Systems, Montreal, QC, Canada.10.1109/MOBILESoft.2019.00031 ↗
43. Wang, H., Liu, Z., Liang, J., Vallina-Rodriguez, N., Guo, Y., Li, L., Tapiador, J., Cao, J., and Xu, G. (November, January 31). Beyond google play: A large-scale comparative study of chinese android app markets. Proceedings of the Internet Measurement Conference 2018, Boston, MA, USA.10.1145/3278532.3278558 ↗
44. Bello-Ogunu, E., and Shehab, M. (2014, January 21). PERMITME: Integrating Android permissioning support in the IDE. Proceedings of the 2014 Workshop on Eclipse Technology eXchange, Portland, OR, USA.10.1145/2688130.2688135 ↗
45. Johnson, R., Wang, Z., Gagnon, C., and Stavrou, A. (2012, January 20–22). Analysis of Android applications’ permissions. Proceedings of the 2012 IEEE Sixth International Conference on Software Security and Reliability Companion (SERE-C), Gaithersburg, MD, USA.10.1109/SERE-C.2012.44 ↗
46. Static Analysis for Extracting Permission Checks of a Large Scale Framework: The Challenges And Solutions for Analyzing Android10.1109/TSE.2014.2322867 ↗
47. Zhang, Y., Yang, M., Xu, B., Yang, Z., Gu, G., Ning, P., Wang, X.S., and Zang, B. (2013, January 4–8). Vetting Undesirable Behaviors in Android Apps with Permission Use Analysis. Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (CCS ’13), Berlin, Germany.10.1145/2508859.2516689 ↗
48. Xu, R., Saïdi, H., and Anderson, R. (2012, January 8–10). Aurasium: Practical Policy Enforcement for Android Applications. Proceedings of the USENIX Security Symposium, Bellevue, WA, USA.
49. Zhu, H., Xiong, H., Ge, Y., and Chen, E. (2014, January 24–27). Mobile app recommendations with security and privacy awareness. Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, New York, NY, USA.10.1145/2623330.2623705 ↗
50. Wang, H., Ma, Z., Guo, Y., and Chen, X. (2015, January 13–17). WuKong: A Scalable and Accurate Two-Phase Approach to Android App Clone Detection. Proceedings of the 2015 International Symposium on Software Testing and Analysis (ISSTA’15), Baltimore, MD, USA.10.1145/2771783.2771795 ↗
51. Stevens, R., Gibler, C., Crussell, J., Erickson, J., and Chen, H. (2012, January 28–29). Investigating user privacy in Android ad libraries. Proceedings of the Workshop on Mobile Security Technologies (MoST), San Diego, CA, USA.
52. Backes, M., Gerling, S., Hammer, C., Maffei, M., and von Styp-Rekowsky, P. (2013). AppGuard-enforcing user requirements on Android apps. Tools and Algorithms for the Construction and Analysis of Systems, Springer International Publishing.10.1007/978-3-642-36742-7_39 ↗
53. Bartel, A., Klein, J., Monperrus, M., Allix, K., and Le Traon, Y. (2012). Improving privacy on Android smartphones through in-vivo bytecode instrumentation. arXiv.
54. I-arm-droid: A rewriting framework for in-app reference monitors for Android applications
55. Davis, B., and Chen, H. (2013, January 25–28). RetroSkeleton: Retrofitting Android Apps. Proceedings of the International Conference on Mobile Systems, Applications, and Services (MobiSys’13), Taipei, Taiwan.10.1145/2462456.2464462 ↗
56. Que, P., Guo, X., and Wang, Z. (2015). Lightweight Optimization of Android Permission Model. Proceedings of the 4th International Conference on Computer Engineering and Networks, Springer.10.1007/978-3-319-11104-9_120 ↗
57. Wu, L., Du, X., and Zhang, H. (2015, January 16–19). An effective access control scheme for preventing permission leak in Android. Proceedings of the 2015 International Conference on Computing, Networking and Communications (ICNC), Garden Grove, CA, USA.10.1109/ICCNC.2015.7069315 ↗
58. (2019, August 02). Requesting Permissions at Run Time. Available online: http://developer.android.com/training/permissions/requesting.html.
59. Kennedy, K., Gustafson, E., and Chen, H. (2013, January 23). Quantifying the effects of removing permissions from Android applications. Proceedings of the IEEE MoST 2013, San Francisco, CA, USA.
60. Book, T., Pridgen, A., and Wallach, D.S. (2013). Longitudinal analysis of Android ad library permissions. arXiv.
61. Ma, Z., Wang, H., Guo, Y., and Chen, X. (2016, January 14–22). LibRadar: Fast and accurate detection of third-party libraries in Android apps. Proceedings of the 38th International Conference on Software Engineering Companion, Austin, TX, USA.10.1145/2889160.2889178 ↗