Risk analysis of Android applications: A user-centric solution

Abstract

Android applications (apps) pose many risks to their users, e.g., by including code that may threaten user privacy or system integrity. Most of the current security countermeasures for detecting dangerous apps show some weaknesses, mainly related to users' understanding and acceptance. Hence, users would benefit from an effective but simple technique that indicates whether an app is safe or risky to be installed. In this paper, we present MAETROID (Multi-criteria App Evaluator of TRust for AndrOID), a framework to evaluate the trustworthiness of Android apps, i.e., the amount of risk they pose to users, e.g., in terms of confidentiality and integrity. MAETROID performs a multi-criteria analysis of an app at deploy-time and returns a single easyto-understand evaluation of the app's risk level (i.e., Trusted, Medium Risk, and High Risk), aimed at driving the user decision on whether or not installing a new app. The criteria include the set of requested permissions and a set of metadata retrieved from the marketplace, denoting the app quality and popularity. We have tested MAETROID on a set of 11,000 apps both coming from Google Play and from a database of known malicious apps. The results show a good accuracy in both identifying the malicious apps and in terms of false positive rate.

Risk Management Governance in Applications

“…First of all, it focuses on the development of applications in a way that will make sure that any external forces are not being able to penetrate into the database of the users which can lead to a massive breach of security. At the same time, the network also initiates a complex security facility that is highly capable of identifying a data leakage and take actions in a timely manner in order to reduce the losses that may happen if the breach lasts for a prolonged period of time (Dini et. al.;.…”

On Transparency and Accountability of Smart Assistants in Smart Cities

“…Different methods are used to validate the working and behaviors of Android apps to prevent them from misbehaving or risking user privacy and device security. Misalignments in their descriptions and permission requirements, unnecessary use of Android permissions and sensitive Application Programming Interfaces (APIs), app collusions, and use of framing effect are some of the known indicators for intrusive apps [31,[39][40][41][42][43][44][45][46][47]. Apps should also put adequate privacy protection and security controls in place [48].…”

“…Understandability of a system by its users is critical for its risk assessment [32]. For example, risk assessment affects the privacy management decisions of smartphone users [44]. Understandability of an Android app by its users can be reflected in their understanding of its functions and data access requirements [30].…”

“…Android Applications are typically distributed through app stores, and users download them to meet different needs [63]. The responsibility of assessing an app's risk lies in the users [44]. At this stage, app stores present app descriptions and their permission requirements to potential app users.…”

“…App permissions are central to many risk evaluation models. For example, the authors of [39,[44][45][46] used app permissions to determine its access to sensitive user data and critical device features for calculating app risks. As Android uses a privacy self-management model and users grant or deny different permissions to an app after evaluating the costs and benefits of a function that the app is offering, users are supposed to be familiar with the sensitivity of different permissions [64].…”