Abstract
Application description analysis is applied for various purposes in software engineering domains. Besides the inherent challenges from the ambiguity of natural language, sparse permission semantics raise the difficulties of predicting functionalities and permission usages from app descriptions. More specifically, the functionalities common to the app’s category are intentionally abbreviated by developers due to the limited number of characters, and the permissions are often over-claimed. These are the main reasons that cause false positives in predicting permissions from app descriptions. Such unmentioned permissions can only be detected as suspicious in previous studies where effective assistance for developers in refining app descriptions and preventing potential security risks is not provided. In this paper, we propose the FideDroid, a framework to identify category-based common permissions to offset those essential functionalities while assessing the fidelity of app descriptions. Our framework augments the labeled dataset of app descriptions to improve the prediction of permissions. FideDroid compares inferred permissions with used ones to reveal the suspicious and unnecessary permissions based on the prediction. It helps developers to refine app descriptions and maintain permission usages. In our experiments on large real-world apps, we analyzed and revealed that the category-based common permissions may cover more unmentioned functionalities without considering all possible permissions during app description analysis. In addition, we discovered three factors causing the inconsistency between descriptions and permission usages to be: 1) human interventions in writing description; 2) bad practices on permission usages; and 3) prolific developers. These findings will facilitate developers to refine app descriptions and optimize permission usages in the apps.
Highlights
Mobile applications are becoming an integral part of people’s daily lives, providing functionalities such as recreation, mobile payment, social communication, online shopping, and collaboration
Different from the previous studies, our work proposes a new perspective of app description analysis as a Category-based Common Permissions (CCPs) and considers such permissions as normal even though they are not mentioned in the description
We proposed a framework to analyze app descriptions, which enhances the security maintainability in descriptions and permission usages with the ability to identify common permissions based on app categories and to check the API usages of associated permissions from the source code
Summary
Mobile applications (apps) are becoming an integral part of people’s daily lives, providing functionalities such as recreation, mobile payment, social communication, online shopping, and collaboration. In April 2021, over 2.9 million Android apps are available for download in Google Play Store [1] To promote their apps, developers provide various meta-information for users while uploading their apps, such as app descriptions, screenshots, privacy policies, and app categories [2]. All of them failed to address above mentioned issues to maintain the app descriptions and permission usages in the app To address these issues, we propose a novel framework named FideDroid to identify the Category-based Common Permissions (CCPs), which are frequently used permissions in a specified category, to assess the fidelity of descriptionto-permission for Android apps. We propose a novel framework named FideDroid to identify the Category-based Common Permissions (CCPs), which are frequently used permissions in a specified category, to assess the fidelity of descriptionto-permission for Android apps It comprises three phases: description analyzer, common permission identifier, and API checker.
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
