A new approach for managing Android permissions: learning users’ preferences

Abstract

Today, permissions management solutions on mobile devices employ Identity Based Access Control (IBAC) models. If this approach was suitable when people had only a few games (like Snake or Tetris) installed on their mobile phones, the current situation is different. A survey from Google in 2013 showed that, on average, french users have installed 32 applications on their Android smartphones. As a result, these users must manage hundreds of permissions to protect their privacy. Scalability of IBAC is a well-known issue and many more advanced access control models have introduced abstractions to cope with this problem. However, such models are more complex to handle by non-technical users. Thus, we present a permission management system for Android devices that (1) learns users' privacy preferences with a novel learning algorithm, (2) proposes them abstract authorization rules, and (3) provides advanced features to manage these high-level rules. Our learning algorithm is compared to two other well-known approaches to show its efficiency. Finally, we prove this whole approach is more efficient than current permission management system by comparing it to Privacy Guard Manager.

ARANAC: A Bring-Your-Own-Permissions Network Access Control Methodology for Android Devices

“…Oglaza et al present in [42] Kapuer, an IBAC (Identity Based Access Control) related permission management system for Android devices that: i) learns users' privacy preferences with a novel learning algorithm, ii) proposes abstract authorization rules, and iii) provides advanced features to manage these high-level rules.…”

Functionality-based mobile application recommendation system with security and privacy awareness

“…Oglaza et al [55] propose Kapuer, a system that uses machine learning to understand user preferences and create rules that permit or deny a permission configuration request. Kapuer can also create high-level permission configuration rules such as "Applications from Social category can have local access to user data" which is a global rule for all the applications from the social category.…”

Analisis Statis Menggunakan Mobile Security Framework Untuk Pengujian Keamanan Aplikasi Mobile E-Commerce Berbasis Android

“…Di sini perlu memahami arsitektur OS Android untuk menilai tingkat kekritisannya yang sebenarnya. Dari informasi izin ini akan dapat terlihat seberapa banyak izin yang diminta aplikasi dan seberapa banyak yang dalam kategori dangerous permissions (Oglaza, 2017). Contoh hasil analisis yang ditampilkan oleh MobSF seperti pada Gambar 3.…”