Automated Assessment of Security Risks for Mobile Applications

Transcription

1 Automated Assessment of Security Risks for Mobile Applications Rahul Pandita, Xusheng Xiao, Wei Yang, William Enck, and Tao Xie Department of Computer Science North Carolina State University

2

3 Lookout Mobile Security has reported that android malware resulted in a loss of US $1 million in Source:

4 F-Secure MOBILE THREAT REPORT Q Source :

5 Approach to Mobile Apps Distribution Open system Developer releases the App on Play Store Users can directly install the Apps Google Inc. SECURITY User has to explicitly grant permissions requested by the App

6 Problem Felt, Adrienne Porter, et al. "Android permissions: User attention, comprehension, and behavior." Proceedings of the Eighth Symposium on Usable Privacy and Security. ACM, Only 17% users (participating in the study) paid attention to permissions.

7 Motivations of Recent Android Malware "Yet another modification of the Google Android Snake game. This one listens to the taps for its turn directions." Source:

8 Solution

9 Simple Solution: Keyword-based search Keyword-based search on application descriptions Photo Credit: Ahora estoy en via Flickr

10 Problems with Keyword-based Search Confounding effects: Certain keywords such as contact have a confounding meaning... displays user contact,... contact me at abc@xyz.com Semantic Inference: Sentences often describe a sensitive operation such as reading contacts without actually referring to keyword contact. share yoga exercises with your friends via , sms.

11 WHYPER Implementation APP Description WHYPER APP Permission NLP Parser Semantic Engine Annotated Description API Docs

12 Example Security Metrics-Driven Evaluation,

13 Example Security Metrics-Driven Evaluation, For suggestion please contact me at For suggestion please contact me at

14 Example Security Metrics-Driven Evaluation, Also you can share the yoga exercise to your friends via and SMS. Also you can share the yoga exercise to your friends via and SMS. a sub resource of Contacts share semantically equivalent to send

15 Evaluation Results PERMISSION READ CONTACTS READ CALENDAR RECORD AUDIO No. of Apps Sent. Permission Sentences Annotate d Precisio n Recall F-Score TOTAL

16 Evaluation Results Contd. PERMISSION Delta Precision Delta Recall Delta F-score Delta Accuracy READ CONTACTS READ CALENDAR RECORD AUDIO TOTAL

17 Improvement Better NLP infrastructure Better Semantic Representation of Permissions Blow into the microphone to extinguish candle record calls

18 Future Work refine the NLP infrastructure input from the third-party mobile developers propose security metrics (Transparency Metrics) quantifying the degree to which an application description describes the privacy and security sensitive operations

19 Industrial Collaboration Text analytics for security Text construction for security Repository of textual artifacts for security

20 Summary Our evaluation results show that WHYPER achieves an average precision of 82.8%, and an average recall of 81.5% for three permissions. In summary, our results demonstrate great promise in using NLP techniques to access security risks in mobile applications.