Android permissions: A perspective combining risks and benefits

Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT

Volumn , Issue , 2012, Pages 13-22

  Sarma, Bhaskar ^a   Li, Ninghui ^a   Gates, Chris ^a   Potharaju, Rahul ^a   Nita Rotaru, Cristina ^a   Molloy, Ian ^b  

^a Purdue University   (United States)

^b IBM T J WATSON RESEARCH CENTER   (United States)

Author keywords

Android; Malware

Indexed keywords

ANDROID; DATA SETS; MALWARES; PREMIUM RATE; PRIVATE DATA; RISK SIGNALS; SMS MESSAGES;

ACCESS CONTROL; COMPUTER CRIME; DATA PROCESSING;

ROBOTS;

EID: 84864033989     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2295136.2295141     Document Type: Conference Paper

References (26)

1. K. Au, Y. Zhou, Z. Huang, P. Gill, and D. Lie. Short paper: a look at smartphone permission models. In Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices, pages 63-68. ACM, 2011.
2. D. Barrera, H. Kayacik, P. van Oorschot, and A. Somayaji. A methodology for empirical analysis of permission-based security models and its application to android. In Proceedings of the 17th ACM conference on Computer and communications security, pages 73-84. ACM, 2010.
3. C.-C. Chang and C.-J. Lin. LIBSVM: A library for support vector machines. ACM Transactions on Intelligent Systems and Technology, 2011. Software available at http://www.csie.ntu.edu.tw/~cjlin/libsvm.
4. H. Chew, D. Crisp, R. Bogner, and C. Lim. Target detection in radar imagery using support vector machines with training size biasing. In Proc. Int. Conf. on Control, Automation, Robotics, and Vision (ICARCV), 2000.
5. W. Enck, P. Gilbert, B. Chun, L. Cox, J. Jung, P. McDaniel, and A. Sheth. Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones. In Proceedings of the 9th USENIX conference on Operating systems design and implementation, pages 1-6. USENIX Association, 2010.
6. W. Enck, D. Octeau, P. McDaniel, and S. Chaudhuri. A study of Android application security. In Proceedings of the 20th USENIX conference on Security, SEC'11, pages 21-21, Berkeley, CA, USA, 2011. USENIX Association.
7. W. Enck, M. Ongtang, and P. McDaniel. On lightweight mobile phone application certification. In Proceedings of the 16th ACM conference on Computer and communications security, CCS '09, pages 235-245, New York, NY, USA, 2009. ACM.
8. B. Fathi. Engineering windows 7: User account control, October 2008. MSDN blog on User Account Control.
9. A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In Proceedings of the 18th ACM conference on Computer and communications security, pages 627-638. ACM, 2011.
10. A. Felt, K. Greenwood, and D. Wagner. The effectiveness of application permissions. In Proc. of the USENIX Conference on Web Application Development, 2011.
11. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In Proceedings of the 18th ACM conference on Computer and communications security, CCS '11, pages 627-638, New York, NY, USA, 2011. ACM.
12. A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner. A survey of mobile malware in the wild. In Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices, SPSM '11, pages 3-14, New York, NY, USA, 2011. ACM.
13. A. P. Felt, K. Greenwood, and D. Wagner. The effectiveness of install-time permission systems for third-party applications. Technical Report UCB/EECS-2010-143, EECS Department, University of California, Berkeley, Dec 2010.
14. Y. Huang and S. Du. Weighted support vector machine for classification with uneven training class sizes. In Machine Learning and Cybernetics, 2005. Proceedings of 2005 International Conference on. IEEE, 2005.
15. W. A. Magat, W. K. Viscusi, and J. Huber. Consumer processing of hazard warning information. Journal of Risk and Uncertainty, 1(2):201-32, June 1988.
16. S. Motiee, K. Hawkey, and K. Beznosov. Do windows users follow the principle of least privilege?: investigating user account control practices. In Proceedings of the Sixth Symposium on Usable Privacy and Security. ACM, 2010.
17. M. Nauman, S. Khan, and X. Zhang. Apex: Extending android permission model and enforcement with user-defined runtime constraints. In Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, pages 328-332. ACM, 2010.
18. M. Ongtang, S. McLaughlin, W. Enck, and P. McDaniel. Semantically rich application-centric security in android. In Computer Security Applications Conference, 2009. ACSAC'09. Annual, pages 340-349. Ieee, 2009.
19. G. Portokalidis, P. Homburg, K. Anagnostakis, and H. Bos. Paranoid android: versatile protection for smartphones. In Proceedings of the 26th Annual Computer Security Applications Conference, pages 347-356. ACM, 2010.
20. R. Potharaju, A. Newell, C. Nita-Rotaru, and X. Zhang. Plagiarizing smartphone applications: Attack strategies and defense. Springer, 2012.
21. A. Schmidt, J. Clausen, A. Camtepe, and S. Albayrak. Detecting symbian os malware through static function call analysis. In Malicious and Unwanted Software (MALWARE), 2009 4th International Conference on, pages 15-22. IEEE, 2009.
22. D. W. Stewart and I. M. Martin. Intended and unintended consequences of warning messages: A review and synthesis of empirical research. Journal of Public Policy Marketing, 13(1):1-19, 1994.
23. J. Suykens and J. Vandewalle. Least squares support vector machine classifiers. Neural processing letters, 1999.
24. P. Szor. The art of computer virus research and defense. Addison-Wesley Professional, 2005.
25. T. Vidas, N. Christin, and L. Cranor. Curbing android permission creep. In Proceedings of the Web, volume 2, 2011.
26. T. Zhang. An introduction to support vector machines and other kernel-based learning methods. AI Magazine, 2001.