1. Android App Permission Manager
Katherine Schwartz
Eralda Caushaj

2. The Goals Categorize apps into risk categories based on five factors
Inform the user about possible threats to security and privacy
Give the user control over the information accessed by their apps

3. Current Progress
Basic functionalities of the app were already near completion
Research into the area, examining various past approaches
Working on explanation and pseudocode for the risk categorization algorithm

4. The App so far User can view any app’s permissions
User is alerted about potential security threats
Unnecessary risky functions in red text

5. Previous Works
Kirin- Evaluates app permissions vs. a group of set rules
Only looks at app permission combinations
Probabilistic Generative Models- apply a machine learning model to app permissions to find anomalous apps
Complex
Requires large, high-quality training set
Accuracy “in the wild” is unknown
Benefit-adjusted Risk Signals- Risk is evaluated based on how rare a “critical” permission is in the app’s category
Risk signals based solely on rarity of selected permissions, no other factors

6. The AAPM Approach

7. Categorizing Apps: The basics
AAPM will examine a set of factors to compute risk categorization to show the user
Algorithm will determine whether each factor in an app poses a risk. More risks leads to the app getting a higher risk categorization
Safe – Benign – Malicious

8. Categorizing apps: The Factors
Unnecessary app permissions
Total number of privacy threats
Number of dangerous permission combinations
Number of ad networks
How many permissions compared to category average

9. Advantages Takes multiple factors into account
Easy to understand for both users and app developers
Identifies not only malicious apps, but otherwise-benign apps that could pose a security risk
Allows users to immediately mitigate security risks without removing the app in question (if their OS supports the feature)

10. References
W. Enck, M. Ongtang, and P. McDaniel. “On lightweight mobile phone application certification,” in Proceedings of the 16th ACM conference on Computer and communications security, pp. 235–245,
H. Peng, C. Gates, B. Sarma, N. Li, Y. Qi, R. Potharaju, C. Nita-Rotaru, and I. Molloy. Using probabilistic generative models for ranking risks of Android apps. In Proceedings of the ACM conference on Computer and communications security, 2012.
K. Allix, T. F. Bissyande, Q. Jérome, J. Klein, R. State, and Y. Le Traon. “Empirical assessment of machine learning-based malware detectors for android,” in Empirical Software Engineering, 2014.
B. Pratim Sarma, N. Li, C. Gates, R. Potharaju, C. Nita-Rotaru and I. Molloy, "Android permissions: a perspective combining risks and benefits", SACMAT '12 Proceedings of the 17th ACM symposium on Access Control Models and Technologies, pp , 2012.
Felt, A.P., Greenwood, K., Wagner, D. “The Effectiveness of Application Permissions,” in Proceedings of the USENIX Conference on Web Application Development, 2011.