Right to Know, Right to Refuse: Towards UI Perception-Based Automated Fine-Grained Permission Controls for Android AppsVirtual
It is the basic right of a user to know how the permissions are used within the Android app’s scope and to refuse the app if granted permissions are used for the activities other than the specified use which can amount to malicious behavior. This paper proposes an approach and a vision to automatically model the permissions necessary for Android apps from users’ perspective and enable fine-grained permission controls by users, thus facilitating users in making more well-informed and flexible permission decisions for different app functionalities, which in turn improve the security and data privacy of the App and enforce apps to reduce permission misuses. Our proposed approach works in mainly two stages. First, it looks for discrepancies between the permission uses perceivable by users and the permissions actually used by apps via program analysis techniques. Second, it runs prediction algorithms using machine learning techniques to catch the discrepancies in permission usage and thereby alert the user for action about data violation. We have evaluated preliminary implementations of our approach and achieved promising fine-grained permission control accuracy. In addition to the benefits of users’ privacy protection, we envision that wider adoption of the approach may also enforce better privacy-aware design by responsible bodies such as app developers, governments, and enterprises.
Tue 11 OctDisplayed time zone: Eastern Time (US & Canada) change
10:30 - 12:30 | Technical Session 4 - Mobile Apps IResearch Papers / NIER Track / Industry Showcase / Journal-first Papers / Tool Demonstrations at Gold A Chair(s): Jacques Klein University of Luxembourg | ||
10:30 20mResearch paper | Mining Android API Usage to Generate Unit Test Cases for Pinpointing Compatibility Issues Research Papers Xiaoyu Sun Monash University, Xiao Chen Monash University, Yanjie Zhao Monash University, Pei Liu Monash University, John Grundy Monash University, Li Li Monash University DOI Pre-print | ||
10:50 20mPaper | Automated, Cost-effective, and Update-driven App TestingVirtual Journal-first Papers Chanh-Duc Ngo University of Luxembourg, Fabrizio Pastore University of Luxembourg, Lionel Briand University of Luxembourg; University of Ottawa Link to publication | ||
11:10 20mIndustry talk | Fastbot2: Reusable Automated Model-based GUI Testing for Android Enhanced by Reinforcement LearningVirtual Industry Showcase Zhengwei Lv ByteDance, Chao Peng ByteDance, China, Zhao Zhang Bytedance Network Technology, Ting Su East China Normal University, Kai Liu Bytedance, Ping Yang Bytedance Network Technology | ||
11:30 10mVision and Emerging Results | Right to Know, Right to Refuse: Towards UI Perception-Based Automated Fine-Grained Permission Controls for Android AppsVirtual NIER Track Vikas K. Malviya Singapore Management University, Chee Wei Leow Singapore Management University, Ashok Kasthuri Singapore Management University, Yan Naing Tun Singapore Management University, Lwin Khin Shar Singapore Management University, Lingxiao Jiang Singapore Management University Pre-print Media Attached | ||
11:40 20mResearch paper | MalWhiteout: Reducing Label Errors in Android Malware DetectionVirtual Research Papers Liu Wang Beijing University of Posts and Telecommunications, Haoyu Wang Huazhong University of Science and Technology, China, Xiapu Luo Hong Kong Polytechnic University, Yulei Sui University of Technology Sydney | ||
12:00 10mDemonstration | AUSERA: Automated Security Vulnerability Detection for Android AppsVirtual Tool Demonstrations Sen Chen Tianjin University, Yuxin Zhang Tianjin University, Lingling Fan Nankai University, Jiaming Li Tianjin University, Yang Liu Nanyang Technological University | ||
12:10 20mResearch paper | A Comprehensive Evaluation of Android ICC Resolution TechniquesVirtual Research Papers Jiwei Yan Institute of Software at Chinese Academy of Sciences, China, Shixin Zhang Beijing Jiaotong University, China, Yepang Liu Southern University of Science and Technology, Xi Deng Institute of Software, Chinese Academy of Sciences, Jun Yan Institute of Software at Chinese Academy of Sciences, China, Jian Zhang Institute of Software at Chinese Academy of Sciences, China DOI Pre-print |