PScout: analyzing the Android permission specification

By Kathy Wain Yee Au, Yi Fan Zhou, Zhen Huang, David Lie. Conference on Computer and Communications Security, 2012

845 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/2fe33f4b7c75d9e29bf80e7bdd719205cfafc3c9

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Software

In Signal Processing

Citations in the corpus

FeatureSmith: Automatically Engineering Features for Malware Detection by Mining the Security Literature (2016, background): “[9] proposed static analysis tools to analyze the Android permission specification.”
SoK: Security Evaluation of Home-Based IoT Deployments (2019, methodology): “Wang18 [37] - - - Permissions Programming Data Protection Barre10 [38] Au12 [39] - - Egele13 [40] Vienn14 [41] - - - - - - Max16 [23] Sivar16 [16] Demet17 [42] M ob ile”
Vetting undesirable behaviors in android apps with permission use analysis (2013, methodology): “Existing work [12,27] has built privileged API lists with required permissions.”
Following Devil's Footprints: Cross-Platform Analysis of Potentially Harmful Libraries on Android and iOS (2016, methodology): “Speciﬁcally, such permissions were automatically discovered using PScout [28] and then manually inspected before placing the class requiring them into a speciﬁc category.”
A Probabilistic Discriminative Model for Android Malware Detection with Decompiled Source Code (2015, methodology): “Android Permissions Analysis: PScout [23] performs static code analysis on the Android source to extract function to permission mappings.”
A Survey of App Store Analysis for Software Engineering (2017, background): “permissions analysis tool Stowaway [12], that can detect declared and used permissions.”
Security Analysis of Emerging Smart Home Applications (2016, methodology): “designed PScout, a static analysis framework for Android source code to produce complete permission specifications for different Android versions [8].”
Static analysis of android apps: A systematic literature review (2017, methodology): “As examples, we have dismissed PSCout [27] and EdgeMiner [28] in this paper because they are dedicated to analysing the Android framework.”
Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications (2014, background): “use it to find a mapping between Android APIs and required permissions for different versions of Android [5].”
Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps (2014, background): “For instance, prior research [7, 17] has documented a list of security-critical source and sink APIs, which can be used here.”
Malware Detection in Adversarial Settings: Exploiting Feature Evolutions and Confusions in Android Apps (2017, methodology): “We compile the list of security-sensitive methods based on PScout [8] and construct the call graphs using the SPARK call-graph algorithm implemented in Soot [40].”
A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks (2014, methodology): “For assessing the impact of the permission feature, we ran the PScout subset again with the permission feature disabled, yielding the results shown in Table III.”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “…variety of contexts, including dynamic symbolic execution [90], [226], grammar-based test case generation [88], [105], [213], permission testing [24], [80], behavioral testing [122], [175], [224], complexity testing [135], [222], kernel testing [216], [196], [186], representation dependence…”
ContexloT: Towards Providing Contextual Integrity to Appified IoT Platforms (2017, background): “The security of IoT platforms are not hypothetical concerns as a number of real attacks have already been reported.”
WHYPER: Towards Automating Risk Assessment of Mobile Applications (2013, background): “’s work [38] to find the API document of the class/interface pertaining to a particular permission.”
Checking app behavior against app descriptions (2014, background): “However, studies showed that almost 30% of Android applications request more permissions than they actually use [7, 2, 3, 23].”
You Get Where You're Looking for: The Impact of Information Sources on Code Security (2016, neutral): “distracted or overwhelmed [1], [8], [9], [11], [14]–[18], [26], [29], [31], [33], [34], [36], [43], [44], [46].”
ANDRUBIS -- 1,000,000 Apps Later: A View on Current Android Malware Behaviors (2014, methodology): “Furthermore, by mapping the method trace to permissions utilizing a permission mapping, such as the ones provided by PScout [30] or Stowaway [31] we can determine the permissions an app actually used during runtime.”