一句话：提出 ICONINTENT，结合程序分析与图标分类自动识别 Android 应用中敏感 UI 组件。
许多 Android 应用通过 UI 组件使用或收集敏感数据，但组件常用对象图标或带文字图标表达意图，仅分析文本难以识别敏感组件。本文提出 ICONINTENT，通过静态分析应用 UI 布局文件与代码关联 UI 组件和图标，并采用计算机视觉技术将图标分类为八类敏感数据。在 Google Play 150 个应用上，ICONINTENT 于 97 个应用中检出 248 个敏感 UI 组件，精确率 82.4%。与基于文本的 SUPOR 结合后，SUPOR+ICONINTENT 检出 487 个敏感组件，较 SUPOR 提升 101.2%，并将待检查的可疑权限减少 50.7%（较 SUPOR 提升 129.4%）。
Many mobile applications (i.e., apps) include UI widgets to use or collect users' sensitive data. Thus, to identify suspicious sensitive data usage such as UI-permission mismatch, it is crucial to understand the intentions of UI widgets. However, many UI widgets leverage icons of specific shapes (object icons) and icons embedded with text (text icons) to express their intentions, posing challenges for existing detection techniques that analyze only textual data to identify sensitive UI widgets. In this work, we propose a novel app analysis framework, ICONINTENT, that synergistically combines program analysis and icon classification to identify sensitive UI widgets in Android apps. ICONINTENT automatically associates UI widgets and icons via static analysis on app's UI layout files and code, and then adapts computer vision techniques to classify the associated icons into eight categories of sensitive data. Our evaluations of ICONINTENT on 150 apps from Google Play show that ICONINTENT can detect 248 sensitive UI widgets in 97 apps, achieving a precision of 82.4%. When combined with SUPOR, the state-of-the-art sensitive UI widget identification technique based on text analysis, SUPOR +ICONINTENT can detect 487 sensitive UI widgets (101.2% improvement over SUPOR only), and reduces suspicious permissions to be inspected by 50.7% (129.4% improvement over SUPOR only).
@inproceedings{XiaoWCWG19,
title = {IconIntent: Automatic Identification of Sensitive UI Widgets Based on Icon Classification for Android Apps},
author = {Xusheng Xiao and Xiaoyin Wang and Zhihao Cao and Hanlin Wang and Peng Gao},
booktitle = {ICSE},
year = {2019},
doi = {10.1109/icse.2019.00041}
}