Projekte pro Jahr
Abstract
Permissions are a key factor in Android to protect users' privacy. As it is often not obvious why applications require certain permissions, developer-provided descriptions in Google Play and third-party markets should explain to users how sensitive data is processed. Reliably recognizing whether app descriptions cover permission usage is challenging due to the lack of enforced quality standards and a variety of ways developers can express privacy-related facts.
We introduce a machine learning-based approach to identify critical discrepancies between developer-described app behavior and permission usage. By combining state-of-the-art techniques in natural language processing (NLP) and deep learning, we design a convolutional neural network (CNN) for text classification that captures the relevance of words and phrases in app descriptions in relation to the usage of dangerous permissions. Our system predicts the likelihood that an app requires certain permissions and can warn about descriptions in which the requested access to sensitive user data and system features is textually not represented.
We evaluate our solution on 77,000 real-world app descriptions and find that we can identify individual groups of dangerous permissions with a precision between 71% and 93%. To highlight the impact of individual words and phrases, we employ a model explanation algorithm and demonstrate that our technique can successfully bridge the semantic gap between described app functionality and its access to security- and privacy-sensitive resources.
We introduce a machine learning-based approach to identify critical discrepancies between developer-described app behavior and permission usage. By combining state-of-the-art techniques in natural language processing (NLP) and deep learning, we design a convolutional neural network (CNN) for text classification that captures the relevance of words and phrases in app descriptions in relation to the usage of dangerous permissions. Our system predicts the likelihood that an app requires certain permissions and can warn about descriptions in which the requested access to sensitive user data and system features is textually not represented.
We evaluate our solution on 77,000 real-world app descriptions and find that we can identify individual groups of dangerous permissions with a precision between 71% and 93%. To highlight the impact of individual words and phrases, we employ a model explanation algorithm and demonstrate that our technique can successfully bridge the semantic gap between described app functionality and its access to security- and privacy-sensitive resources.
| Originalsprache | englisch |
|---|---|
| Titel | CODASPY 2020 - Proceedings of the 10th ACM Conference on Data and Application Security and Privacy |
| Erscheinungsort | New York |
| Herausgeber (Verlag) | Association of Computing Machinery |
| Seiten | 203-214 |
| Seitenumfang | 12 |
| ISBN (elektronisch) | 978-1-4503-7107-0 |
| DOIs | |
| Publikationsstatus | Veröffentlicht - 16 März 2020 |
| Veranstaltung | 10th ACM Conference on Data and Application Security and Privacy - New Orleans, Virtuell, USA / Vereinigte Staaten Dauer: 3 Aug. 2020 → 4 Aug. 2020 Konferenznummer: 20 http://www.codaspy.org/2020/ |
Publikationsreihe
| Name | CODASPY 2020 - Proceedings of the 10th ACM Conference on Data and Application Security and Privacy |
|---|
Konferenz
| Konferenz | 10th ACM Conference on Data and Application Security and Privacy |
|---|---|
| Kurztitel | CODASPY |
| Land/Gebiet | USA / Vereinigte Staaten |
| Ort | New Orleans, Virtuell |
| Zeitraum | 3/08/20 → 4/08/20 |
| Internetadresse |
ASJC Scopus subject areas
- Software
- Angewandte Informatik
Fingerprint
Untersuchen Sie die Forschungsthemen von „Understanding Privacy Awareness in Android App Descriptions Using Deep Learning“. Zusammen bilden sie einen einzigartigen Fingerprint.Projekte
- 1 Laufend
-
A-SIT - Zentrum für sichere Informationstechnologie Austria
Stranacher, K. (Teilnehmer (Co-Investigator)), Dominikus, S. (Teilnehmer (Co-Investigator)), Leitold, H. (Teilnehmer (Co-Investigator)), Marsalek, A. (Teilnehmer (Co-Investigator)), Teufl, P. (Teilnehmer (Co-Investigator)), Bauer, W. (Teilnehmer (Co-Investigator)), Aigner, M. J. (Teilnehmer (Co-Investigator)), Rössler, T. (Teilnehmer (Co-Investigator)), Neuherz, E. (Teilnehmer (Co-Investigator)), Dietrich, K. (Teilnehmer (Co-Investigator)), Zefferer, T. (Teilnehmer (Co-Investigator)), Mangard, S. (Teilnehmer (Co-Investigator)), Payer, U. (Teilnehmer (Co-Investigator)), Orthacker, C. (Teilnehmer (Co-Investigator)), Lipp, P. (Teilnehmer (Co-Investigator)), Reiter, A. (Teilnehmer (Co-Investigator)), Knall, T. (Teilnehmer (Co-Investigator)), Bratko, H. (Teilnehmer (Co-Investigator)), Bonato, M. (Teilnehmer (Co-Investigator)), Suzic, B. (Teilnehmer (Co-Investigator)), Zwattendorfer, B. (Teilnehmer (Co-Investigator)), Kreuzhuber, S. (Teilnehmer (Co-Investigator)), Oswald, M. E. (Teilnehmer (Co-Investigator)), Tauber, A. (Teilnehmer (Co-Investigator)), Posch, R. (Projektleiter (Principal Investigator)), Bratko, D. (Teilnehmer (Co-Investigator)), Feichtner, J. (Teilnehmer (Co-Investigator)), Ivkovic, M. (Teilnehmer (Co-Investigator)), Reimair, F. (Teilnehmer (Co-Investigator)), Wolkerstorfer, J. (Teilnehmer (Co-Investigator)) & Scheibelhofer, K. (Teilnehmer (Co-Investigator))
21/05/99 → 31/12/24
Projekt: Arbeitsgebiet