Measuring User Perception for Detecting Unexpected Access to Sensitive Resource in Mobile Apps

Nguyen, Trung Tin; Nguyen, Duc Cuong; Schilling, Michael; Wang, Gang; Backes, Michael

doi:10.1145/3433210.3437511

Cited by 7 publications

(4 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Previous works have proposed various techniques to better analyze privacy leakage in the mobile ecosystem. For the Android platform, static analysis [55], [56], [42], dynamic analysis [66], [51], and their mixed approaches [68], [57] are extensively used for detecting privacy leakage in a more efficient way. For example, FlowDroid [31] is one of the widely used tools for detecting privacy leakage via static analysis.…”

Section: Related Workmentioning

confidence: 99%

Leaking the Privacy of Groups and More: Understanding Privacy Risks of Cross-App Content Sharing in Mobile Ecosystem

Wu,

Nan,

Xing

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Cross-app content sharing is one of the prominent features widely used in mobile apps. For example, a short video from one app can be shared to another (e.g., a messaging app) and further viewed by other users. In many cases, such Crossapp content sharing activities could have privacy implications for both the sharer and sharee, such as exposing app users' personal interests. In this paper, we provide the first in-depth study on the privacy implications of Cross-app content sharing (as we call Cracs) activities in the mobile ecosystem. Our research showed that during the sharing process, the adversary can not only track and infer user interests as traditional web trackers but also cause other severe privacy implications to app users. More specifically, due to multiple privacy-intrusive designs and implementations of Cracs, an adversary can easily reveal a user's social relations to an outside party, or unnecessarily expose user identities and her associated personal data (e.g., user accounts in another app). Such privacy implications are indeed a concern for app users, as confirmed by a user study we have performed with 300 participants. To further evaluate the impact of our identified privacy implications at large, we have designed an automatic pipeline named Shark, combined with static analysis and dynamic analysis to effectively identify whether a given app introduces unnecessary data exposure in Cracs. We analyzed 300 top downloaded apps collected from app stores in both the US and China. The analysis results showed that over 55% of the apps from China and 10% from the US are indeed problematic.

show abstract

Section: Related Workmentioning

confidence: 99%

Leaking the Privacy of Groups and More: Understanding Privacy Risks of Cross-App Content Sharing in Mobile Ecosystem

Wu,

Nan,

Xing

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…The decision is mainly based on the privacy risks related to the information collected and shared with third parties and the benefits the users might get from the app. Moreover, in developing our tool, we acknowledge that users might have different perceptions of privacy risks implied by apps' data collection [9], or more in general of privacy, as well as, on possible benefits. To consider this subjective dimension, PriApp-Install leverages semi-supervised learning to build a classifier for predicting decisions about apps' installation based on users' feedback.…”

Section: Overall Architecturementioning

confidence: 99%

“…The algorithm, then, trains a new classifier using all the apps (i.e., both the original labeled, pseudo-labeled apps). 9 If shared data are not specified in the privacy policy, 3pt is set to not specif ied. 10 θ parameters aim at optimizing the label probability.…”

Section: Naive and Category-based Prediction Modelsmentioning

confidence: 99%

PriApp-Install: Learning User Privacy Preferences on Mobile Apps’ Installation

Son

Carminati

Ferrari

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

It is undeniable that smartphones play a vital role in our lives, as their applications (called apps) can be used to access a variety of services anytime and anywhere. Despite the benefits provided by mobile apps, there are risks connected to the release of personal and sensitive data. Understanding the potential privacy risks of installing an app based on its description or privacy policy could be challenging, especially for non-skilled users. In this paper, to assist users in their app selection process, we propose PriApp-Install, a privacy-aware app installation recommendation system. It leverages semi-supervised learning to learn individual privacy preferences w.r.t mobile app installation. Learning is done based on a rich set of features modeling both the app behavior w.r.t. personal data consumption and the benefits a user can get in installing the app. We have tested four different learning strategies on a real dataset by exploiting three participant groups: security and privacy experts, IT workers, and crowd workers. The obtained results show the effectiveness of our proposal.

show abstract

“…Furthermore, generating comments for bytecode has practical implications. For example, (1) In APP sensitive-resource-access detection (Nguyen et al 2021;Hăjmăsan et al 2019), some existing tools detect the API from bytecode to determine its specific behavior (e.g., accessing the phone's contact list). However, if an attacker deliberately names an API to hide its true functionality, we cannot analyze the API's behavior by its name.…”

Section: Introductionmentioning

confidence: 99%

BCGen: a comment generation method for bytecode

Huang

Chen

et al. 2022

Autom Softw Eng

View full text Add to dashboard Cite

Bytecode is a form of instruction set designed for efficient execution by a software interpreter. Unlike human-readable source code, bytecode is even harder to understand for programmers and researchers. Bytecode has been widely used in various software tasks such as malware detection and clone detection. In order to understand the meaning of the bytecode more quickly and accurately and further help programmers in more software activities, we propose a bytecode comment generation method (called BCGen) using neural language model. Specifically, to get the structured information of the bytecode, we first generate the control flow graph (CFG) of the bytecode, and serialize the CFG with bytecode semantic information. Then a transformer model combining gate recurrent unit is proposed to learn the features of bytecode to generate comments. We obtain the bytecode by building the Jar packages of the well-known open-source projects in the Maven repository and construct a bytecode dataset to train and evaluate our model. Experimental results show that the BLEU of BCGen can reach 0.26, which outperforms several baselines and proves the effectiveness and practicability of our method. It is concluded that it is possible to generate natural language comments directly from the bytecode. Meanwhile, it is important to take structured and semantic information into account in generating bytecode comments.

show abstract

Measuring User Perception for Detecting Unexpected Access to Sensitive Resource in Mobile Apps

Cited by 7 publications

References 38 publications

Leaking the Privacy of Groups and More: Understanding Privacy Risks of Cross-App Content Sharing in Mobile Ecosystem

Leaking the Privacy of Groups and More: Understanding Privacy Risks of Cross-App Content Sharing in Mobile Ecosystem

PriApp-Install: Learning User Privacy Preferences on Mobile Apps’ Installation

BCGen: a comment generation method for bytecode

Contact Info

Product

Resources

About