一句话：提出 DroidGem，用静态控制流/调用图、图嵌入与监督学习按 UI 功能分类 Android 权限误用。
Android 权限常在首次授权后被长期保留，应用可能在与用户当前操作无关的情境中滥用权限。本文提出 DroidGem，面向由 UI 事件处理器触发的每个功能，构建进程间控制流图与调用图，将图结构通过嵌入转为数值编码，再用监督式机器学习模型分类该功能对权限的使用是否为误用。作者实现原型并在 89 个多样 Android 应用上评估，与人工验证结果比较，精确率和召回率最高约 95%。该机制可为用户提供细粒度权限提示，提升对权限与隐私数据误用的感知。
Android is the most popular operating system for mobile devices nowadays. Permissions are a very important part of Android security architecture. Apps frequently need the users' permission, but many of them only ask for it once—when the user uses the app for the first time—and then they keep and abuse the given permissions. Longing to enhance Android permission security and users' private data protection is the driving factor behind our approach to explore fine-grained context-sensitive permission usage analysis and thereby identify misuses in Android apps. In this work, we propose an approach for classifying the fine-grained permission uses for each functionality of Android apps that a user interacts with. Our approach, named DroidGem, relies on mainly three technical components to provide an in-context classification for permission (mis)uses by Android apps for each functionality triggered by users: (1) static inter-procedural control-flow graphs and call graphs representing each functionality in an app that may be triggered by users' or systems' events through UI-linked event handlers, (2) graph embedding techniques converting graph structures into numerical encoding, and (3) supervised machine learning models classifying (mis)uses of permissions based on the embedding. We have implemented a prototype of DroidGem and evaluated it on 89 diverse apps. The results show that DroidGem can accurately classify whether permission used by the functionality of an app triggered by a UI-linked event handler is a misuse in relation to manually verified decisions, with up to 95% precision and recall. We believe that such a permission classification mechanism can be helpful in providing fine-grained permission notices in a context related to app users' actions, and improving their awareness of (mis)uses of permissions and private data in Android apps.
@inproceedings{MalviyaTLXSJ23,
title = {Fine-Grained In-Context Permission Classification for Android Apps Using Control-Flow Graph Embedding},
author = {Vikas K. Malviya and Yan Naing Tun and Chee Wei Leow and Ailys Tee Xynyn and Lwin Khin Shar and Lingxiao Jiang},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00056}
}