Android App Permission Manager Katherine Schwartz Eralda Caushaj

The Goals Categorize apps into risk categories based on five factors Inform the user about possible threats to security and privacy Give the user control over the information accessed by their apps

Current Progress Basic functionalities of the app were already near completion Research into the area, examining various past approaches Working on explanation and pseudocode for the risk categorization algorithm

The App so far User can view any app’s permissions User is alerted about potential security threats Unnecessary risky functions in red text

Previous Works Kirin- Evaluates app permissions vs. a group of set rules Only looks at app permission combinations Probabilistic Generative Models- apply a machine learning model to app permissions to find anomalous apps Complex Requires large, high-quality training set Accuracy “in the wild” is unknown Benefit-adjusted Risk Signals- Risk is evaluated based on how rare a “critical” permission is in the app’s category Risk signals based solely on rarity of selected permissions, no other factors

The AAPM Approach

Categorizing Apps: The basics AAPM will examine a set of factors to compute risk categorization to show the user Algorithm will determine whether each factor in an app poses a risk. More risks leads to the app getting a higher risk categorization Safe – Benign – Malicious

Categorizing apps: The Factors Unnecessary app permissions Total number of privacy threats Number of dangerous permission combinations Number of ad networks How many permissions compared to category average

Advantages Takes multiple factors into account Easy to understand for both users and app developers Identifies not only malicious apps, but otherwise-benign apps that could pose a security risk Allows users to immediately mitigate security risks without removing the app in question (if their OS supports the feature)

References W. Enck, M. Ongtang, and P. McDaniel. “On lightweight mobile phone application certification,” in Proceedings of the 16th ACM conference on Computer and communications security, pp. 235–245, 2009. H. Peng, C. Gates, B. Sarma, N. Li, Y. Qi, R. Potharaju, C. Nita-Rotaru, and I. Molloy. Using probabilistic generative models for ranking risks of Android apps. In Proceedings of the 2012 ACM conference on Computer and communications security, 2012. K. Allix, T. F. Bissyande, Q. Jérome, J. Klein, R. State, and Y. Le Traon. “Empirical assessment of machine learning-based malware detectors for android,” in Empirical Software Engineering, 2014. B. Pratim Sarma, N. Li, C. Gates, R. Potharaju, C. Nita-Rotaru and I. Molloy, "Android permissions: a perspective combining risks and benefits", SACMAT '12 Proceedings of the 17th ACM symposium on Access Control Models and Technologies, pp. 13-22, 2012. Felt, A.P., Greenwood, K., Wagner, D. “The Effectiveness of Application Permissions,” in Proceedings of the USENIX Conference on Web Application Development, 2011.