Abstract
AbstractMobile apps represent essential tools in our daily routines, supporting us in almost every task. However, this assistance might imply a high cost in terms of privacy. Indeed, mobile apps gather a massive amount of data about individuals (e.g., users’ profiles and habits) and their devices (e.g., locations), where not all are strictly needed for app execution. According to privacy laws, apps’ providers must inform end-users on adopted data usage practices (e.g., which data are collected and for which purpose). Unfortunately, understanding these practices is a complex task for average end-users. The result is that they install apps without understanding their privacy implications. To support users in making more privacy-aware decisions on app usage, we propose a risk estimation approach based on an analysis of the app’s code. This analysis adopts a hybrid strategy, exploiting static and dynamic code analyses. Static analysis aims at discovering which personal data an app is collecting to determine whether the target app is asking more than required. This gives the first estimation of the app’s risk level. In addition, we also perform a dynamic analysis of the target app’s code. This further analysis helps determining whether the collected personal data is consumed locally on the mobile device or sent out to external services. If this happens, the risk level has to be increased, as personal data are more exposed. To prove the proposal’s effectiveness, we run several experiments involving different groups of participants. The obtained accuracy results are promising and outperform those obtained with static analysis only.
Funder
Horizon 2020 Framework Programme
Publisher
Springer Science and Business Media LLC
Subject
Computer Science Applications,Computational Mechanics
Reference42 articles.
1. Bamberger KA (2020) Can you pay for privacy? consumer expectations and the behavior of free and paid apps. Berkeley Tech LJ 35:327
2. Momen N, Hatamian M, Fritsch L (2019) Did app privacy improve after the GDPR? IEEE Secur Priv 17(6):10–20. https://doi.org/10.1109/MSEC.2019.2938445
3. Reardon J (2019) 50 ways to leak your data: An exploration of apps’ circumvention of the android permissions system. In: 28th USENIX Security Symposium (USENIX Security 19), pp. 603–620
4. Son HX, Carminati B, Ferrari E (2021) A risk assessment mechanism for android apps. In: 2021 IEEE International Conference on Smart Internet of Things (SmartIoT), pp. 237–244. IEEE
5. Chandrasekaran D, Mago V (2020) Evolution of semantic similarity–a survey. In: arXiv preprint arXiv:2004.13820
Cited by
9 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献