Enhancing Fidelity of Description in Android Apps With Category-Based Common Permissions

Abstract

Application description analysis is applied for various purposes in software engineering domains. Besides the inherent challenges from the ambiguity of natural language, sparse permission semantics raise the difficulties of predicting functionalities and permission usages from app descriptions. More specifically, the functionalities common to the app's category are intentionally abbreviated by developers due to the limited number of characters, and the permissions are often over-claimed. These are the main reasons that cause false positives in predicting permissions from app descriptions. Such unmentioned permissions can only be detected as suspicious in previous studies where effective assistance for developers in refining app descriptions and preventing potential security risks is not provided. In this paper, we propose the FideDroid, a framework to identify category-based common permissions to offset those essential functionalities while assessing the fidelity of app descriptions. Our framework augments the labeled dataset of app descriptions to improve the prediction of permissions. FideDroid compares inferred permissions with used ones to reveal the suspicious and unnecessary permissions based on the prediction. It helps developers to refine app descriptions and maintain permission usages. In our experiments on large real-world apps, we analyzed and revealed that the category-based common permissions may cover more unmentioned functionalities without considering all possible permissions during app description analysis. In addition, we discovered three factors causing the inconsistency between descriptions and permission usages to be: 1) human interventions in writing description; 2) bad practices on permission usages; and 3) prolific developers. These findings will facilitate developers to refine app descriptions and optimize permission usages in the apps.

Deep-Layer Clustering to Identify Permission Usage Patterns of Android App Categories

“…As a consequence, a method that can automatically categorize multiple types of apps can be useful for organizing the Android Market as well as identifying malicious applications. Studies show that the addition of an application category will greatly increase the efficiency 20 apps with their versions (2016 to 2020) [36] 16,343 [35] 10 categories 2,254 [38] 18 categories 13,005 [3] 10,000 [19] 3100 Our work 46 categories 16,000…”

“…Our approach is similar to [32,2,36,35] in terms of permission-related concerns, we dissimilar in terms of the dataset (including the size, features, and the number of permissions), using machine learning, and considering the categories'apps in their studies. In our present work, we expand on the existing research.…”

“…Experiments are run on 16,343 popular Google Play applications. In [35], the authors manually annotated 2,254 app descriptions from the Google Play Store to include 26 permissions classified into ten categories. They used two natural language processing approaches to enhance our annotated dataset in order to acquire additional permission semantics.…”

PriApp-Install: Learning User Privacy Preferences on Mobile Apps’ Installation

“…Zhiqiang et al [28] proposes the FideDroid framework that predicts permissions needed by an app by analyzing its description. After that, FideDroid compares the inferred permissions with those marked as suspicious and unnecessary by determining whether the predicted permissions from the app's description are used in the app's code.…”