Three top papers on Privacy Protection for Android users from 2015.5 to 2015.6, googlehosts2015.5

Three top papers on Privacy Protection for Android users from 2015.5 to 2015.6, googlehosts2015.5


1.TurkeyAbant Izzet BaysalUniversityAndGaziUniversityThe researchers raised questions about the existing Android permission management which cannot be dynamically adjusted and users cannot understand the meaning of permissions.A permission-basedAndroidMalware detection methodAnd implements its prototype system APKAuditor. The server end of APKAuditor can analyze the permissions of applications on users' devices and applications in the Google Play app store, and calculate the security of each permission based on the probability theory method, the formula is used to show the likelihood score of a malicious application and the Logistic regression method is used to determine the critical value of the malicious application score. The experimental dataset uses public datasets such as contagiomobile, Drebin, and Android Malware GenomeProject. A total of 8762 applications are used. The experimental results show that the Malware detection rate of APK Auditor is as high as 88%, and the false positive rate is 0.46%. Compared with other jobs, APKAuditor completes analysis on the server, does not need to occupy mobile phone resources, and the time overhead of this method is small. Therefore, the APK size is not limited. Online Analysis address: http://app.ibu.edu.tr: 8080/apkinspectoradmin, user name, password is "guest/Guest1 ". This achievement can be used in mobile app stores to improve the security of the mobile app ecosystem. (APK Auditor: Permission-based Android malwaredetection system, Digital Investigation (SCI, IF = 0.986), June 2015)


2.Magir University CanadaAndShanghai Jiao Tong UniversityResearchers raised a question about the leakage of user privacy data in existing Android applications.Application Audit Method Based on Static Analysis and Dynamic Analysis -- AppAuditStatic analysis uses a rough judgment method to ensure the analysis speed. for dynamic analysis, this paper proposes a dynamic analysis method based on Approximated Execution (approximate Execution, while only executing part of the application code, we can effectively guess the unknown variables to ensure that the analysis path is as complete as possible. The experimental results of three public datasets (1400 in total) show that the privacy leak detection rate of the AppAudit method is as high as 99.3%, and zero false positives are achieved. Compared with existing jobs, the detection speed of the AppAudit method is improved by 8.3 times, and the memory usage is reduced by 90%. AppAudit has discovered 30 data leakage vulnerabilities in actual applications, most of which are caused by the transmission of user data through unencrypted HTTP connections by third-party advertising modules, this fully demonstrates the significance of AppAudit to app stores, app developers, and end users. This achievement can be used in mobile app stores to improve the security of the mobile app ecosystem. (Valid Real-time Android Application Auditing, S & P' 15 (2015 IEEE Symposium on Security andPrivacy), May 2015)


3.University of California Santa BarbaraResearchers from the Institute of Computer Science are confused about the privacy leakage caused by malicious androidapps disguised as normal programs, so as to confuse users with providing corresponding privacy information (such as phishing attacks, A setAttack solution, reinforcement of the system and reminder of users. This framework analyzes the android source code using automated tools to identify and classify hidden attack vectors (which may allow apps to initiate phishing attacks or clickjacking attacks ), A set of attack solutions are proposed. To address these threats, 1) at the application market level, the researchers established a tool to use static analysis to identify code that may initiate GUI attacks; 2) at the terminal level, by adding an indicator on the navigationbar, you can be notified of the real source of the running program and compared with the normal source to remind you. Through access and testing of 308 users, our tools can help users prevent such threats. The project's attack code and defense prototype code has been open source (https://github.com/ucsb-seclab/android_ui_deception ). (What the App is That? Deception and Countermeasures in the Android User Interface, 2015 IEEE Symposium on Security and Privacy, May 2015)