论文标题
基于最低权限集合标识的Android应用程序风险评估框架
An Android Application Risk Evaluation Framework Based on Minimum Permission Set Identification
论文作者
论文摘要
Android使用了一种安全机制，要求应用程序请求访问敏感用户数据的权限，例如联系人和SMS或某些系统功能，例如相机和Internet访问。但是，Android应用程序往往过于特权，即，它们通常要求超过必要的权限。这就提出了过度特权的安全问题。为了减轻过度的问题，本文提出了MPDroid，该方法结合了静态分析和协作过滤，以根据其应用程序描述和API使用来确定Android应用程序的最低权限。给定一个应用程序，MpDroid首先采用协作过滤来确定该应用程序的初始最低权限。然后，通过静态分析，确定了应用程序真正需求的最终最低权限。最后，它通过检查应用程序的额外特权，即应用程序要求的不必要的许可，从而评估了过度的风险。实验是对从Google Play收集的16,343个流行应用程序进行的。结果表明，mpdroid的表现明显优于最先进的方法。
Android utilizes a security mechanism that requires apps to request permission for accessing sensitive user data, e.g., contacts and SMSs, or certain system features, e.g., camera and Internet access. However, Android apps tend to be overprivileged, i.e., they often request more permissions than necessary. This raises the security problem of overprivilege. To alleviate the overprivilege problem, this paper proposes MPDroid, an approach that combines static analysis and collaborative filtering to identify the minimum permissions for an Android app based on its app description and API usage. Given an app, MPDroid first employs collaborative filtering to identify the initial minimum permissions for the app. Then, through static analysis, the final minimum permissions that an app really needs are identified. Finally, it evaluates the overprivilege risk by inspecting the apps extra privileges, i.e., the unnecessary permissions requested by the app. Experiments are conducted on 16,343 popular apps collected from Google Play. The results show that MPDroid outperforms the state-of-the-art approach significantly.
