A methodology for empirical analysis of permission-based security models and its application to android

By David Barrera, Hilmi Günes Kayacik, P. V. Oorschot, Anil Somayaji. 2010

584 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection (2017, background): “DURING the last decade, machine learning has been increasingly applied in security-related tasks, in response to the increasing variability and sophistication of modern attacks [1], [3], [6], [27], [33].”
Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis (2013, methodology): “Other methods for permission analysis have been proposed [2, 15, 16], including analyses to detect over-privileged applications [15] or malware [36].”
Privilege Escalation Attacks on Android (2010, methodology): “[2] propose a methodology to analyze permission usage by various applications and provides results of such an analysis for a selection of 1,100 Android applications.”
Android permissions demystified (2011, background): “examine 1, 100 Android applications’ permission requirements and use self-organizing maps to visualize which permissions are used in applications with similar characteristics [5].”
SoK: Security Evaluation of Home-Based IoT Deployments (2019, methodology): “We adapted Acar’s approach and identified three major classes of insecurities that effect IoT devices: over-privilege (permissions [38], [39]), programming errors (programming [40]), and hard-coded sensitive information (data protection [41]).”
XManDroid: A New Android Evolution to Mitigate Privilege Escalation Attacks (2011, background): “(6)Although Android offers many different kinds of permissions, only a few of them are actively used [2].”
Vetting undesirable behaviors in android apps with permission use analysis (2013, background): “To protect sensitive resources in the smartphones, permission-based isolation mechanism [13] is used by modern smartphone systems to prevent untrusted apps from unauthorized accesses.”
Privacy as part of the app decision-making process (2013, background): “Others who have looked at Android permissions have attempted to cluster applications that require similar permissions to simplify the current scheme [2] or have attempted a comparison of the differences between modern smartphone permission systems [1].”
DroidMat: Android Malware Detection through Manifest and API Calls Tracing (2012, methodology): “The number of clusters are decided by Singular Value Decomposition (SVD) method on the low rank approximation.”
A Survey of App Store Analysis for Software Engineering (2017, unknown): “[17], Jeon et al.”
Android Security: A Survey of Issues, Malware Penetration, and Defenses (2015, methodology): “used permissions is an important risk identification technique [86], [87].”
WHYPER: Towards Automating Risk Assessment of Mobile Applications (2013, background): “Such requirements could be placed on all new applications, or iteratively applied to existing applications by automatically emailing developers of applications with unjustiﬁed permissions.”
Modeling Users' Mobile App Privacy Preferences: Restoring Usability in a Sea of Permission Settings (2014, background): “A great deal of past work analyzing smartphone apps has focused on developing useful techniques and tools to detect and manage leakage of sensitive personal information [8-10, 14-26] or studying how users react to these usages [6, 13, 27, 28].”
A Conundrum of Permissions: Installing Applications on an Android Smartphone (2012, background): “Others who have looked at Android permissions have attempted to cluster applications that require similar permissions to simplify the current scheme [3] or have attempted a comparison of modern smartphone permission systems [1].”