An Empirical Study on the Impact of Permission Smell in Android Applications
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
In this paper, we proposed a sniffer to detect permission smells from developer and third-party libraries' code. Moreover, we conducted an empirical study to investigate unnecessary permissions on large real-world Android apps. Our analysis indicates that permission smell extensively exists in Android apps. According to the results, permission smells exist in most Android apps. In particular, third-party libraries request permission for functionalities that are not used by developers, which cause more smells. Moreover, most developers do not properly disable unnecessary permissions that are declared for third-party libraries. We discussed the impacts of permission smells on user experiences. As a result, the existence of permission smell does not impact the number of downloads. However, apps that have more unnecessary permissions have received lower ratings from users.
Abstract
In this paper, we proposed a sniffer to detect permission smells from developer and third-party libraries' code. Moreover, we conducted an empirical study to investigate unnecessary permissions on large real-world Android apps. Our analysis indicates that permission smell extensively exists in Android apps. According to the results, permission smells exist in most Android apps. In particular, third-party libraries request permission for functionalities that are not used by developers, which cause more smells. Moreover, most developers do not properly disable unnecessary permissions that are declared for third-party libraries. We discussed the impacts of permission smells on user experiences. As a result, the existence of permission smell does not impact the number of downloads. However, apps that have more unnecessary permissions have received lower ratings from users.
참고문헌 (21)
- "Android Market Share"[URL]
- "AppBrain"[URL]
- H. Wang, "Why are Android Apps Removed From Google Play? A Large-scale Empirical Study", Proceedings of International Conference on Mining Software Repository, pp.231~242 (2018)
- H. Mumtaz, "An Empirical Study to Improve Software Security Through the Application of Code Refactoring", Information and Software Technology, 96, pp.112~125 (2018)
- K. Rahkema, "Empirical Study on Code Smells in iOS Applications", Proceedings of International Conference on Mobile Software Engineering and Systems, pp.61~65 (2020)
- Z. Wu, "Permission Smells Detection for IoT Applications on Android Platform", Proceeding of Korean Computer Congress, pp.293~295 (2019)
- J. Xiao, "An Android Application Risk Evaluation Framework Based on Minimum Permission Set Identification", Journal of Systems and Software, 163, pp.110533~ (2020)
- C. Lyvas, "Dyperm-in : Dynamic permission mining framework for android platform", Computer & Security, 77, pp.472~487 (2018)
- Z. Wu, "FCDP : Fidelity Calculation for Description-to-Permissions in Android Apps", IEEE Access, 9, pp.1062~1075 (2021)
- L. Yu, "Enhancing the Description-to-Behavior Fidelity in Android Apps with Privacy Policy", IEEE Transactions on Software Engineering, 44(9), pp.834~854 (2017)
- T. Watanabe, "Understanding the Inconsistency between Behaviors and Descriptions of Mobile Apps", IEICE Transactions on Information and Systems, 101(11), pp.2584~2599 (2018)
- C. Zhang, "Re-checking App Behavior against App Description in the Context of Third-party Libraries", Proceeding of International Conference on Software Engineering and Knowledge Engineering (2018)
- C. Dennis, "P-Lint : A Permission Smell Detector for Android Applications", Proceeding of IEEE, 2017, 219~220
- X. Liu, "Mining Android App Descriptions for Permission Requirements Recommendation", Proceeding of 2018 IEEE 26th International Requirements Engineering Conference(RE), pp.147~158 (2018)
- "AndroGuard"[URL]
- K. W. Y. Au, "PScout : Analyzing the Android Permission Specification", Proceedings of the 2012ACM conference on Computer and Communications Security, pp.217~228 (2012)
- "Android Sensors"[URL]
- K. Allix, "AndroZoo : Collecting Millions of Android Apps for the Research Community", Proceedings of International Conference on Mining Software Repositories, pp.468~471 (2016)
- P. Calciati, "Automatically Granted Permissions in Android Apps", Proceedings of the 17th International Conference on Mining Software Repositories, pp.114~124 (2020)
- M. Ghafari, "Security Smells in Android", Proceeding of 2017 IEEE 17th International Conference on Source Code Analysis and Manipulation, pp.121~130 (2017)
- Z. Zhang, "An Empirical Study of Potentially Malicious Third-Party Libraries in Android Apps", Proceeding of ACM Conference on Security and Privacy in Wireless and Mobile Networks, pp.144~154 (2020)