SieveDroid: Intercepting Undesirable Private-Data Transmissions in Android Applications

Abstract

Android applications may abuse their permissions on private data, leaking the user's privacy out of the mobile device via data transmissions. A straightforward way to deal with this problem is to restrict the application permissions. However, the restriction not only prevents the undesirable operations from leaking privacy but also prohibits the desirable operations from utilizing private data. Our goal is to get both of the points: ensuring the user's privacy by preventing undesirable private-data transmissions and enduring no degradation on the desirable application functionalities. We propose SieveDroid, a fine-grained runtime privacy control framework. SieveDroid addresses two key challenges of intercepting the undesirable private-data transmissions: revealing how private-data transmissions occur to end-users and setting privacy control rules which intercept the undesirable private-data transmissions at runtime without interfering with desirable ones. We evaluate SieveDroid by using Android malware samples and real applications from the Android market. The results demonstrate that SieveDroid reveals the undesirable operations precisely and concisely and it can effectively intercept the undesirable data transmissions. Besides, desirable functionalities in 98% of the tested applications are not affected.