Forgotten Permission Usages: An Empirical Study on App Description Based Android App Analysis
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
In this paper, we conducted an empirical study to investigate whether Android app descriptions provide enough permission usages for measuring app quality in terms of human writing and consistency between code and descriptions. Android app descriptions are analyzed for various purposes such as quality measurement, functionality recommendation, and malware detection. However, many app descriptions do not disclose permission usages, whether accidentally or on purpose. Most importantly, the previous studies could not precisely analyze app descriptions if permission usages cannot be completely introduced in app descriptions. To assess the consistency between permissions and app descriptions, we implemented a state-of-the-art method to predict Android permissions for 29,270 app descriptions. As a result, 25% of app descriptions may not contain any permission semantic, and 57% of app descriptions cannot accurately reflect permission usages.
Abstract
In this paper, we conducted an empirical study to investigate whether Android app descriptions provide enough permission usages for measuring app quality in terms of human writing and consistency between code and descriptions. Android app descriptions are analyzed for various purposes such as quality measurement, functionality recommendation, and malware detection. However, many app descriptions do not disclose permission usages, whether accidentally or on purpose. Most importantly, the previous studies could not precisely analyze app descriptions if permission usages cannot be completely introduced in app descriptions. To assess the consistency between permissions and app descriptions, we implemented a state-of-the-art method to predict Android permissions for 29,270 app descriptions. As a result, 25% of app descriptions may not contain any permission semantic, and 57% of app descriptions cannot accurately reflect permission usages.
참고문헌 (23)
- C. Zhang, "Re-checking App Behavior against App Description in the Context of Third-party Libraries", Proceeding of International Conference on Software Engineering and Knowledge Engineering (2018)
- A. A. Subaihin, "Empirical Comparison of Text-based Mobile Apps Similarity Measurement Techniques", Empirical Software Engineering, 24, pp.3290~3315 (2019)
- "Privacy, deception and device abuse"[URL]
- J. Xiao, "An android application risk evaluation framework based on minimum permission set identification", Journal of Systems and Software, 163, pp.110533~ (2020)
- L. Yu, "Revisiting the description-to-behavior fidelity in android applications", Proceedings of IEEE International Conference on Software Analysis, Evolution, and Reengineering, pp.415~426 (2016)
- M. Shamsujjoha, "Checking app behavior against app descriptions : What if there are no app descriptions?", Proceedings of International Conference on Program Comprehension, pp, pp.422~432 (2021)
- Z. Wu, "FCDP : Fidelity Calculation for Description-to-Permissions in Android Apps", IEEE Access, 9, pp.1062~1075 (2021)
- T. Watanabe, "Understanding the inconsistencies between text descriptions and the use of privacy-sensitive resources of mobile apps", Proceedings of Symposium On Usable Privacy and Security, pp.241~255 (2015)
- R. Pandita, "WHYPER:Towards automating risk assessment of mobile applications", Proceedings of USENIX Security Symposium, pp.527~542 (2013)
- Z. Qu, "Autocog: Measuring the description-to-permission fidelity in android applications", Proceedings of ACM Conference on Computer and Communications Security, pp.1354~1365 (2014)
- A. Gorla, "Checking app behavior against app descriptions", Proceedings of International Conference on Software Engineering, pp.1025~1035 (2014)
- "Compact language detector"[URL]
- K. Allix, "Androzoo : Collecting millions of android apps for the research community", Proceedings of International Conference on Mining Software Repositories, pp.468~471 (2016)
- "AndroGuard"[URL]
- Y. Feng, "AC-Net : Assessing the Consistency of Description and Permission in Android Apps", IEEE Access, 7, pp.57829~57842 (2019)
- H. Alecakir, "Attention : there is an inconsistency between android permissions and application metadata!", International Journal of Information Security, pp.1~19 (2021)
- Y. Hu, "CHAMP : Characterizing Undesired App Behaviors from User Comments based on Market Policies", Proceedings of IEEE, 2021, 933~945
- A. A. Subaihin, "Empirical Comparison of Text-based Mobile Apps Similarity Measurement Techniques", Empirical Software Engineering, 24, pp.3290~3315 (2019)
- H. Wu, "Identifying Key Features from App User Reviews", Proceedings of International Conference on Software Engineering, pp.922~932 (2021)
- F. H. Shezan, "TKPERM : Cross-platform Permission Knowledge Transfer to Detect Overprivileged Third-party Applications", Proceedings of Network and Distributed Systems Security Symposium, pp.1~15 (2020)
- O. Olukoya, "Security-oriented View of App Behavior using Textual Descriptions and User-granted Permission Requests", Computers & Security, 89, pp.1~18 (2020)
- Z. Wu, "Permissions based Automatic Android Malware Repair using Long Short-Term Memory", Proceedings of the Korean Society of Computer Information Conference, pp.387~388 (2019)
- Z. Wu, "Identifying Latent Android Malware from Application's Description using LSTM", Proceedings of International Conference on Information, System and Convergence Applications, pp.40~42 (2019)