FCDP: Fidelity Calculation for Description-to-Permissions in Android Apps

Wu, Zhiqiang; Chen, Xin; Lee, Scott Uk-Jin

doi:10.1109/access.2020.3047019

Cited by 7 publications

(12 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• Description Analyzer: We augmented annotated app descriptions using two NLP techniques (i.e., thesaurus and back-translation) to increase the number of sentences with permission semantics for the training model. Subsequently, we preprocessed the textual dataset and input them into a learning-based model proposed by Wu et al [19] to predict whether the sentence explicitly or implicitly discloses any dangerous permission usage.…”

Section: System Overviewmentioning

confidence: 99%

“…The general process is to clean the data first using regular expressions and embed textual words into numerical vectors. We used procedures similar to those in previous studies [16], [19] to preprocess descriptions for the deep learning model.…”

Section: B Description Pre-processingmentioning

confidence: 99%

“…We developed a state-of-the-art Bi-LSTM with a selfattention mechanism for predicting permissions proposed by FCDP [19]. The model primarily contains three layers: an embedding layer, a Bi-LSTM layer, and a self-attention layer.…”

Section: Permissions Classifiermentioning

confidence: 99%

“…To decompile the Android apps, AndroGuard was used to extract DPs from the manifest file and invocation relations. To facilitate the analysis of all apps, we executed Dypermin to obtain API mappings for multiple Android versions (API level [16][17][18][19][20][21][22][23][24][25][26][27][28]. Dypermin extracts API mappings from the SDK source code via Java annotations.…”

Section: Empirical Evaluationmentioning

confidence: 99%

“…It comprises three phases: description analyzer, common permission identifier, and API checker. In the first phase, the annotated dataset is augmented using two Natural Language Processing (NLP) techniques (i.e., thesaurus [17] and back-translation [18]) and an existing neural network from a previous study [19] is used to predict permissions from app descriptions. In the second phase, a 1 https://play.google.com/store/apps/details?id=com.instagram.android permission relation graph is constructed for each category based on the categorization of the Play Store.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Enhancing Fidelity of Description in Android Apps With Category-Based Common Permissions

Chen

Khan

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Application description analysis is applied for various purposes in software engineering domains. Besides the inherent challenges from the ambiguity of natural language, sparse permission semantics raise the difficulties of predicting functionalities and permission usages from app descriptions. More specifically, the functionalities common to the app's category are intentionally abbreviated by developers due to the limited number of characters, and the permissions are often over-claimed. These are the main reasons that cause false positives in predicting permissions from app descriptions. Such unmentioned permissions can only be detected as suspicious in previous studies where effective assistance for developers in refining app descriptions and preventing potential security risks is not provided. In this paper, we propose the FideDroid, a framework to identify category-based common permissions to offset those essential functionalities while assessing the fidelity of app descriptions. Our framework augments the labeled dataset of app descriptions to improve the prediction of permissions. FideDroid compares inferred permissions with used ones to reveal the suspicious and unnecessary permissions based on the prediction. It helps developers to refine app descriptions and maintain permission usages. In our experiments on large real-world apps, we analyzed and revealed that the category-based common permissions may cover more unmentioned functionalities without considering all possible permissions during app description analysis. In addition, we discovered three factors causing the inconsistency between descriptions and permission usages to be: 1) human interventions in writing description; 2) bad practices on permission usages; and 3) prolific developers. These findings will facilitate developers to refine app descriptions and optimize permission usages in the apps.

show abstract

Section: System Overviewmentioning

confidence: 99%

Section: B Description Pre-processingmentioning

confidence: 99%

Section: Permissions Classifiermentioning

confidence: 99%

Section: Empirical Evaluationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Enhancing Fidelity of Description in Android Apps With Category-Based Common Permissions

Chen

Khan

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

A Risk Estimation Mechanism for Android Apps based on Hybrid Analysis

2022

View full text Add to dashboard Cite

Mobile apps represent essential tools in our daily routines, supporting us in almost every task. However, this assistance might imply a high cost in terms of privacy. Indeed, mobile apps gather a massive amount of data about individuals (e.g., users’ profiles and habits) and their devices (e.g., locations), where not all are strictly needed for app execution. According to privacy laws, apps’ providers must inform end-users on adopted data usage practices (e.g., which data are collected and for which purpose). Unfortunately, understanding these practices is a complex task for average end-users. The result is that they install apps without understanding their privacy implications. To support users in making more privacy-aware decisions on app usage, we propose a risk estimation approach based on an analysis of the app’s code. This analysis adopts a hybrid strategy, exploiting static and dynamic code analyses. Static analysis aims at discovering which personal data an app is collecting to determine whether the target app is asking more than required. This gives the first estimation of the app’s risk level. In addition, we also perform a dynamic analysis of the target app’s code. This further analysis helps determining whether the collected personal data is consumed locally on the mobile device or sent out to external services. If this happens, the risk level has to be increased, as personal data are more exposed. To prove the proposal’s effectiveness, we run several experiments involving different groups of participants. The obtained accuracy results are promising and outperform those obtained with static analysis only.

show abstract

Large-scale App privacy governance

Fan

Liu

et al. 2022

Front. Eng. Manag.

View full text Add to dashboard Cite

FCDP: Fidelity Calculation for Description-to-Permissions in Android Apps

Cited by 7 publications

References 41 publications

Enhancing Fidelity of Description in Android Apps With Category-Based Common Permissions

Enhancing Fidelity of Description in Android Apps With Category-Based Common Permissions

A Risk Estimation Mechanism for Android Apps based on Hybrid Analysis

Large-scale App privacy governance

Contact Info

Product

Resources

About