Semantically Rich Application-Centric Security in Android

By Machigar Ongtang, Stephen E. McLaughlin, William Enck, Patrick Drew McDaniel. Asia-Pacific Computer Systems Architecture Conference, 2009

549 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/154b08caab11e9f384e034875516d6bf9752bfce

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Vetting undesirable behaviors in android apps with permission use analysis (2013, methodology): “Apex [45] and Saint [46] were two extensions to the Android’s permission system by introducing runtime constraints on the granted permissions.”
Unsafe exposure analysis of mobile in-app advertisements (2012, background): “Saint [28] takes this approach a step further, by allowing app developers to constrain permission assignment at install-time and permission use at run-time.”
SCanDroid: Automated Security Certification of Android (2009, background): “A related line of work [9, 8, 12] reports a logic-based tool, Kirin, for determining whether the permissions declared by an application satisfy a certain global safety policy.”
XManDroid: A New Android Evolution to Mitigate Privilege Escalation Attacks (2011, methodology): “For instance, one could assign more trust to applications properly secured with Saint [35] policies.”
A Survey on Security for Mobile Devices (2013, background): “Finally, [94, 95] propose Kirin security service for Android, which performs lightweight certification of applications to mitigate malware at install time.”
QUIRE: Lightweight Provenance for Smart Phone Operating Systems (2011, methodology): “Saint [23] extends the functionality of the Kirin sys-tem to allow for runtime inspection of the full system permission state before launching a given application.”
Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis (2013, methodology): “Saint [30] modifies the Android framework to control application interaction.”
A methodology for empirical analysis of permission-based security models and its application to android (2010, background): “Ontang et al. [18] present a fine-grained access control policy infrastructure for protecting applications.”
“Andromaly”: a behavioral malware detection framework for android devices (2012, background): “However, the application/developer has limited ability thereafter to govern to whom those rights are given or how they are later exercised (Ongtang et al. 2009).”
Towards Taming Privilege-Escalation Attacks on Android (2012, methodology): “The problem of application-level privilege escalation attacks has been investigated in the last few years, and various security extensions and enhancements to Android have been proposed such as Kirin [16] [17], TaintDroid [14], Saint [33], QUIRE [13], IPC Inspection [20] to name some.”
Soundcomber: A Stealthy and Context-Aware Sound Trojan for Smartphones (2011, background): “To deliver the data to the latter, the transmitter needs to use covert channels when overt communication is monitored by a protection mechanism [10].”
Privilege Escalation Attacks on Android (2010, background): “The most relevant works to ours are Saint [19], Kirin [10, 11] and TaintDroid [9], as they can provide some measures against the privilege escalation attack.”
Automating GUI testing for Android applications (2011, methodology): “Enck, Ongtang, and McDaniel’s [20] describe Kirin, a logic-based tool for Android that ensures permissions needed by a certain Android application are met by global safety invariants.”
DroidMat: Android Malware Detection through Manifest and API Calls Tracing (2012, methodology): “Finally, we have experiment discussion in Sec IV-D.”
PScout: analyzing the Android permission specification (2012, background): “Saint [29], Apex [27] and Aurasium [35] are three systems proposed to provide runtime policy enforcement to complement existing permission systems.”
Detecting repackaged smartphone applications in third-party android marketplaces (2012, background): “For example, Saint [38] examines the interfaces one application exported to other and extends the Android framework to enforce inter-application security policy (at install and runtime).”
Apex: extending Android permission model and enforcement with user-defined runtime constraints (2010, background): “Similarly, [24] have described saint – a mechanism aimed at Android that allows application developers to define install-time and runtime constraints.”