AutoCog

Abstract

The booming popularity of smartphones is partly a result of application markets where users can easily download wide range of third-party applications. However, due to the open nature of markets, especially on Android, there have been several privacy and security concerns with these applications. On Google Play, as with most other markets, users have direct access to natural-language descriptions of those applications, which give an intuitive idea of the functionality including the security-related information of those applications. Google Play also provides the permissions requested by applications to access security and privacy-sensitive APIs on the devices. Users may use such a list to evaluate the risks of using these applications. To best assist the end users, the descriptions should reflect the need for permissions, which we term description-to-permission fidelity. In this paper, we present a system AutoCog to automatically assess description-to-permission fidelity of applications. AutoCog employs state-of-the-art techniques in natural language processing and our own learning-based algorithm to relate description with permissions. In our evaluation, AutoCog outperforms other related work on both performance of detection and ability of generalization over various permissions by a large extent. On an evaluation of eleven permissions, we achieve an average precision of 92.6% and an average recall of 92.0%. Our large-scale measurements over 45,811 applications demonstrate the severity of the problem of low description-to-permission fidelity. AutoCog helps bridge the long-lasting usability gap between security techniques and average users.

Code Between the Lines: Semantic Analysis of Android Applications

“…In a combination of static code inspection and text analysis, Watanabe et al [14] present a keyword-based technique to correlate access to privacy-relevant resources with app descriptions. AutoCog [10] correlates permission-related API calls with frequently occurring text fragments. As a result, semantic patterns are derived that can provide an insight into why Android apps request certain permissions.…”

Discovering Inconsistencies between Requested Permissions and Application Metadata by using Deep Learning

“…Another model, AutoCog proposed by Qu et al [3] is based on explicit semantic analysis (ESA) which provides a vectoral representation of a given text, thereby giving a representation of the meaning in the text. The model uses vectoral representations of app descriptions to assess their semantic relatedness to permissions.…”

“…If the selected sentence is related to the relevant permission group, it is labeled as 1; if not, it is labeled as 0. Unlike previous studies in the literature [3], [6], AC-Net labelled application descriptions according to permission groups rather than single permission. 9 of these permission groups are belong to dangerous permissions.…”

“…In this study, a new approach based on NLP and recurrent neural networks (RNNs) is employed in order to fnd inconsistencies between the requested permissions of an application and its metadata. This problem is known as description-tofdelity problem [3] in the literature. Permissions [4] is one of the important security mechanisms introduced by Android, so users have to grant dangerous permissions before their usage.…”

“…We use Porter stemmer[17] 2. https://dynet.readthedocs.io/en/latest/tutorial.html3 The implementation will be publicly available if the paper gets accepted.…”