The Effectiveness of Application Permissions

By Adrienne Porter Felt, Kate Greenwood, David A. Wagner. USENIX Conference on Web Application Development, 2011

337 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/c01b0314e512edf4ebb922b14500789c46847eed

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

A survey of mobile malware in the wild (2011, background): “In particular, 8 of 11 (73%) of malicious applications in our sample ask for this permission, while only 33% of legitimate applications request this permission [28].”
Expectation and purpose: understanding users' mental models of mobile app privacy through crowdsourcing (2012, background): “Past work has shown that few people read End-User License Agreements (EULAs) [20] or web privacy policies [23], because (a) there is an overriding desire to install the app or use the web site, (b) reading these policies is not part of the user’s main task (which is to use the app or web site), (c)…”
Vetting undesirable behaviors in android apps with permission use analysis (2013, background): “As Android adopts a ﬁne-grained permission model [30] to protect system resources, our insight is that applications usually need to use multiple permissions together to accomplish a meaningful behavior.”
Using probabilistic generative models for ranking risks of Android apps (2012, background): “Another work by Felt et al. [14] surveys applications (free and paid) from the Android Market.”
DroidAPIMiner: Mining API-Level Features for Robust Malware Detection in Android (2013, background): “According to [13, 14, 26], a large percentage of Android apps are over-privileged.”
PScout: analyzing the Android permission specification (2012, background): “There is a large body of security research on permissionbased systems [15,16] and in Android security [6,7,8,11,12, 13, 18].”
Android permissions: a perspective combining risks and benefits (2012, background): “[10] surveys applications (free and paid) from the Android Market.”
Android permissions demystified (2011, background): “manually classify a small set of Android applications as overprivileged or not, but they were limited by the Android documentation [15].”
A Probabilistic Discriminative Model for Android Malware Detection with Decompiled Source Code (2015, background): “In [24] Felt et al. conduct a more general survey of applications (free and paid) from the Android Market.”
AdDroid: privilege separation for applications and advertisers in Android (2012, background): “Recent studies [11, 9] have explored whether Android applications request more permissions than they require to function.”
WHYPER: Towards Automating Risk Assessment of Mobile Applications (2013, background): “Such requirements could be placed on all new applications, or iteratively applied to existing applications by automatically emailing developers of applications with unjustiﬁed permissions.”
Modeling Users' Mobile App Privacy Preferences: Restoring Usability in a Sea of Permission Settings (2014, background): “A great deal of past work analyzing smartphone apps has focused on developing useful techniques and tools to detect and manage leakage of sensitive personal information [8-10, 14-26] or studying how users react to these usages [6, 13, 27, 28].”
Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis (2013, methodology): “Other methods for permission analysis have been proposed [2, 15, 16], including analyses to detect over-privileged applications [15] or malware [36].”
DroidMat: Android Malware Detection through Manifest and API Calls Tracing (2012, methodology): “The number of clusters are decided by Singular Value Decomposition (SVD) method on the low rank approximation.”