A Multi-criteria-Based Evaluation of Android Applications

Abstract

Android users can face the risk of downloading and installing bad applications on their devices. In fact, many applications may either hide malware, or their expected behavior do not fully follow the user's expectation. This happens because, at install-time, even if the user is warned with the potential security threat of the application, she often skips this alert message. On Android this is due to the complexity of the permission system, which may be tricky to fully understand. We propose a multi-criteria evaluation of Android applications, to help the user to easily understand the trustworthiness degree of an application, both from a security and a functional side. We validate our approach by testing it on more than 180 real applications found either on official and unofficial markets.

Risk analysis of Android applications: A user-centric solution

“…The other criteria (user rating, number of downloads and developer reputation) are extracted by parsing the market's web page. Upon computing the values for the five criteria, MAETROID implements AHP through Jama, the Java matrix package for matrix calculi 8 .…”

“…Hence, a malicious app can cause a consistent financial damage to the user, e.g., by issuing calls to premium numbers which are likely to pass unnoticed (at least until the user credit ends or the user receives the bill). Table A.7 in Appendix A gives an excerpt of the threat scores we have assigned to all the Android permissions (we refer the reader to [16] for a full list). In Table A.7, acronyms PT, ST, and FT are an abbreviation of privacy, system, and financial threat, respectively.…”

“…With respect to our previous work [8], the current work's novel contributions are a detailed investigation and formalization of the global threat score deriving from the permissions list required by the application, the detailing of the implementation of MAETROID as an Android app, and the results of the classification extended to a set of 11,000 apps.…”

Are photos on Social Networks really private?

“…Among the protection mechanisms, as we did for mobile applications [6], we plan to develop ratings for Facebook applications based on the privileges those asks (see also [7]) hence helping users to make informed decisions. Eventually, our goal is to enhance Phook with data control mechanisms and policies that can empower the user with a complete, understandable and predictable control of their data.…”

Evaluating the Trust of Android Applications through an Adaptive and Distributed Multi-criteria Approach

“…In this paper, we propose MAETROID (Mobile Application Evaluator of TRust for andrOID), a framework for evaluating the level of trust of Android applications, which extends the framework proposed in [3]. This previous framework estimates the level of trust for an application using static analysis only.…”