A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks

Abstract

Abstract-Today's smartphone users face a security dilemma: many apps they install operate on privacy-sensitive data, although they might originate from developers whose trustworthiness is hard to judge. Researchers have addressed the problem with more and more sophisticated static and dynamic analysis tools as an aid to assess how apps use private user data. Those tools, however, rely on the manual configuration of lists of sources of sensitive data as well as sinks which might leak data to untrusted observers. Such lists are hard to come by.We thus propose SUSI, a novel machine-learning guided approach for identifying sources and sinks directly from the code of any Android API. Given a training set of hand-annotated sources and sinks, SUSI identifies other sources and sinks in the entire API. To provide more fine-grained information, SUSI further categorizes the sources (e.g., unique identifier, location information, etc.) and sinks (e.g., network, file, etc.).For Android 4.2, SUSI identifies hundreds of sources and sinks with over 92% accuracy, many of which are missed by current information-flow tracking tools. An evaluation of about 11,000 malware samples confirms that many of these sources and sinks are indeed used. We furthermore show that SUSI can reliably classify sources and sinks even in new, previously unseen Android versions and components like Google Glass or the Chromecast API.

IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

“…A path may be within a single component or across multiple components. In this paper, the sources and sinks we use are provided by SUSI [38]. Listing 1 illustrates the concept of ICC leak through a concrete example.…”

Potential Component Leaks in Android Apps: An Investigation into a New Feature Set for Malware Detection

“…Potential Active Component Leak (PACL). We define a PACL as a taint flow path starting from a source (defined as calls into resource methods returning non-constant values into the application code [23]) and ending with an exit-point. Such PCLs are referred to as "active", as the involved component is actively leaking sensitive data that it collected itself to other components (cf.…”

“…We define a PPCL as a taint flow path starting from an entry-point and ending with a sink (defined as calls into resource methods accepting at least one non-constant data value from the application code as parameter, if and only if a new value is written or an existing one is overwritten on the shared resource (e.g., GSM network) [23]). Such PCLs are referred to as "passive", as the involved component is passively leaking sensitive data collected by other components (cf.…”

“…The key idea behinds static taint analysis is to identify a path that starts from a sensitive source and ends with a sensitive sink. In this study, the sensitive source and sink we use are extracted by SUSI [23], which automatically classifies all methods in the whole Android API as source, sink or neither. In Android 4.2, SUSI yields 18,076 source methods and 8,314 sink methods.…”

Information-Flow Analysis of Android Applications in DroidSafe

“…Initially, we tested SuSi, a tool that automatically identifies sink and source methods in the Android API [24]. The automatically identified sources and sinks were incomplete.…”