Set Of Permissions Research Articles

Protective effect of HLA-DPB1 mismatch remains valid in reduced-intensity conditioning unrelated donor hematopoietic cell transplantation.

SummaryA mismatch at HLA-DPB1 locus is associated with higher acute GVHD and lower relapse rate after myeloablative (MAC) allogeneic hematopoietic cell transplantation (alloHCT). Also, in MAC setting, mismatch permissiveness and expression level impact alloHCT outcomes. However, in reduced intensity (RIC), DP mismatch effect on transplant outcomes is unknown. We retrospectively evaluated DP mismatch influence (number, permissiveness, and expression) on HCT outcomes in 310 patients with high-resolution typing (HLA-A, -B, -C, -DRB1, -DQB1 and -DPB1), who underwent RIC-HCT. By multivariable analysis, 11/12 had better overall survival (OS) and relapse vs. 12/12 (HR=1.61 and 2.02; p=0.04 and 0.01, respectively) and better OS vs. 10/12 (HR=1.68; p=0.02). Within the 11/12, non-permissive mismatch (NoPR) was associated with higher risk of grade II-IV acute GVHD (HR=1.97; p=0.005) and non-relapse mortality (HR=2.13; p=0.02) vs. permissive (PR). Grouping 11/12 based on the DP expression conferred higher mortality (HR=3.78; p= 0.003) when low expressers received a graft from high expressers (AG) vs. low expressers (AA). Better OS was achieved in PR 11/12, when expression was low in patient and donor (AA) vs. all other combinations. Therefore, in RIC HCT, a single DP mismatch has a protective role, especially in permissive setting, when donor and recipient are low expressers.

Personal Information Classification on Aggregated Android Application’s Permissions

Android is offering millions of apps on Google Play-store by the application publishers. However, those publishers do have a parent organization and share information with them. Through the ‘Android permission system’, a user permits an app to access sensitive personal data. Large-scale personal data integration can reveal user identity, enabling new insights and earn revenue for the organizations. Similarly, aggregation of Android app permissions by the app owning parent organizations can also cause privacy leakage by revealing the user profile. This work classifies risky personal data by proposing a threat model on the large-scale app permission aggregation by the app publishers and associated owners. A Google-play application programming interface (API) assisted web app is developed that visualizes all the permissions an app owner can collectively gather through multiple apps released via several publishers. The work empirically validates the performance of the risk model with two case studies. The top two Korean app owners, seven publishers, 108 apps and 720 sets of permissions are studied. With reasonable accuracy, the study finds the contact number, biometric ID, address, social graph, human behavior, email, location and unique ID as frequently exposed data. Finally, the work concludes that the real-time tracking of aggregated permissions can limit the odds of user profiling.

PerHelper: Helping Developers Make Better Decisions on Permission Uses in Android Apps

Permission-related issues in Android apps have been widely studied in our research community, while most of the previous studies considered these issues from the perspective of app users. In this paper, we take a different angle to revisit the permission-related issues from the perspective of app developers. First, we perform an empirical study on investigating how we can help developers make better decisions on permission uses during app development. With detailed experimental results, we show that many permission-related issues can be identified and fixed during the application development phase. In order to help developers to identify and fix these issues, we develop PerHelper, an IDEplugin to automatically infer candidate permission sets, which help guide developers to set permissions more effectively and accurately. We integrate permission-related bug detection into PerHelper and demonstrate its applicability and flexibility through case studies on a set of open-source Android apps.

Component‐based permission management of Android applications

SummaryMost Android applications include third‐party libraries (3PLs) to make revenues, to facilitate their development, and to track user behaviors. 3PLs generally require specific permissions to realize their functionalities. Current Android systems manage permissions in app (process) granularity. As a result, the permission sets of apps with 3PLs (3PL‐apps) may be augmented, introducing overprivilege risks. In this paper, we firstly study how severe the problem is by analyzing the permission sets of 27 718 real‐world Android apps with and without 3PLs downloaded in both 2016 and 2017. We find that the usage of 3PLs and the permissions required by 3PL‐apps have increased over time. As a result, the possibility of overprivilege risks increases. We then propose Perman, a fine‐grained permission management mechanism for Android. Perman isolates the permissions of the host app and those of the 3PLs through dynamic code instrumentation. It allows users to manage permission requests of different modules of 3PL‐apps during app runtime. Unlike existing tools, Perman does not need to redesign Android apps and systems. Therefore, it can be applied to millions of existing apps and various Android devices. We conduct experiments to evaluate the effectiveness and efficiency of Perman. The experimental results verify that Perman is capable of managing permission requests of the host app and those of the 3PLs. We also confirm that the overhead introduced by Perman is comparable to that by existing commercial permission management tools.

Determination of Toxic Metals Content in Iranian and Italian Flavoured Olive Oil

Abstract Cultural practices and control of diseases and insects are widely used for cultivation of Olea europea L. These are considered potential contaminants. Aim of this investigation lies in determination of concentrations of contaminants in several edible olive oils. All test samples were purchased in three consecutive seasons. They were analysed in compliance with standardized international protocols of wet digestion methods. Ion concentrations were determined in three replicates using method of inductively coupled plasma optical emission spectrometry. We have registered a positive correlation between storage time and heavy metals contents. It was particularly high in Iranian brands and varied significantly. Investigation results show that all obtained heavy metals contents in pepper-flavoured olive oil samples were significantly lower than in other samples. Considering the fungi-flavoured samples, levels of Pb and Cd were prominent and exceeded the maximum permissible level set in the majority of cases. The further monitoring is needed as all these metals are toxic and their detrimental effect becomes obvious only after several years of exposure.

Towards Privacy Risk Analysis in Android Applications Using Machine Learning Approaches

Android-based devices easily fall prey to an attack due to its free availability in the android market. These Android applications are not certified by the legitimate organization. If the user cannot distinguish between the set of permissions requested by an application and its risk, then an attacker can easily exploit the permissions to propagate malware. In this article, the authors present an approach for privacy risk analysis in Android applications using machine learning. The proposed approach can analyse and identify the malware application permissions. Here, the authors achieved high accuracy and improved F-measure through analyzing the proposed method on the M0Droid dataset and completed testing on an extensive test set with malware from the Androzoo dataset and benign applications from the Drebin dataset.

Understanding Mobile Users’ Privacy Expectations: A Recommendation-Based Method Through Crowdsourcing

Privacy is a pivotal issue of mobile apps because there is a plethora of personal and sensitive information in smartphones. Many mechanisms and tools are proposed to detect and mitigate privacy leaks. However, they rarely consider users’ preferences and expectations. Users hold various expectation towards different mobile apps. For example, users may allow a social app to access their photos rather than a game app because it goes beyond users’ expectation to access personal photos. Therefore, we believe it is practical and beneficial to understand users’ privacy expectations on various mobile apps and help them mitigate privacy risks introduced by smartphones. To achieve this objective, we propose and implement PriWe, a system based on crowdsourcing driven by users who contribute privacy permission settings of the apps installed on their smartphones. PriWe leverages the crowdsourced permission settings to understand users’ privacy expectations and provides app specific recommendations to mitigate information leakage. We deployed PriWe in the real world for evaluation. According to the feedback of 78 users who evaluated our system and 422 participants who completed our survey, PriWe is able to make proper recommendations which can match participants’ privacy expectations and are mostly accepted by users, thereby help them to mitigate privacy disclosure in smartphones.

Overcoming the risks of privileged user abuse in Salesforce

Privileged Salesforce users are necessary to every organisation. These are members of your organisation who have more advanced permission sets than the average user and can include Salesforce admins, sales reps, developers, HR staff, management and senior or executive leadership. Privileged Salesforce users are necessary to every organisation. But they hold the keys to your kingdom, with access to a broad array of company data, security controls, workflows and resources. These advanced users can make nearly unlimited changes to your Salesforce instance, placing your organisation at tremendous risk. And they can even cover their own tracks in the process. Privileged user abuse may be malicious or it may be unintentional. Either way, it represents a huge vulnerability to your company with the two main areas of concern being data security and compliance, explains Mike Mason of FairWarning.

Measuring the value of central bank commitment in the benchmark New Keynesian model

We measure the value of commitment in executing monetary policies in context of the benchmark New Keynesian model and where “value” is represented by the standard quadratic welfare function containing weighted output gap and inflation variances. The value of commitment is calculated as the difference in this welfare across commitment regimes of which there are at least six. Inspired by Bilbie (2014) we show how by means of selecting the optimal level of a single parameter in the setup of several so-called “discretionary” targeting regimes (price-targeting, speed-limit, etc.) one can produce optimal inertia identical to that of the Clarida, Gali, and Gertler (1999) “global commitment.” Combining the targeting regimes with the commitment regime, we are left with three levels of commitment. Deriving welfare analytically as a function of all permissible parameters, rather the standard practice of calculating welfare based on a single or handful of parameter sets, we can measure the gain that would occur from jumping to higher commitment levels over all permissible sets. We also compare welfare surfaces with parameter combinations we have sampled. Result: depending on parameter selection the gains from optimal inertia may be high or low. Our sample of parameters actually used in the literature puts many near the high end, a few not. We find no parameter sets where a switch from no- to high-commitment would imply low or negligible gains. A side-effect of the analysis is that the optimal inertia regimes reduce nominal and real interest rate variance even when interest stability is not an objective of the central bank. We include Taylor-type rules that satisfy the requirements of each commitment level. Conceptually, the results indicate that at least in the benchmark NKM long-time questions such as whether price- or inflation-targeting is preferable are off point. The pertinent question is: in what commitment regime does the central bank find itself in?

Identifying cyber threats to mobile-IoT applications in edge computing paradigm

The malware has become an increasing problem for Mobile-Internet of Things applications in edge computing platform. Variants of malware can be identified once their general characteristics are known and overtly malicious behavior can be identified. Some research has been performed using static analysis in order to identify privacy violating malware for IoT in edge computing. Dynamic analysis can be easily evaded as malware can adapt to avoid detection and has performance overheads. The case where an application lies about its intention for requesting a permission or intentionally violates the user’s expectation of an applications behavior is not so well researched. This research extensively explores the fundamental gap in the current literature in terms of mobile malware. We particularly focus on a greater set of permissions which may be leveraged for other purposes, for example by using sensors to record user credentials or monitoring a user’s movements. This research will attempt to identify such scenarios by employing behavioral analysis to determine when and how permissions are used and static and dynamic analysis to determine the behavior of application logic yet to execute. We proposed two-layer detection engine with hybrid feature analysis. Experimental results with real mobile malware IoT data show that our proposed approach with permission related features outperforms other detection engines.

Caregiver and Health Care Provider Perspectives on Cloud-Based Shared Care Plans for Children With Medical Complexity.

Shared care plans play an essential role in coordinating care across health care providers and settings for children with medical complexity (CMC). However, existing care plans often lack shared ownership, are out-of-date, and lack universal accessibility. In this study, we aimed to establish requirements for shared care plans to meet the information needs of caregivers and providers and to mitigate current information barriers when caring for CMC. We followed a user-centered design methodology and conducted in-depth semistructured interviews with caregivers and providers of CMC who receive care at a tertiary care children's hospital. We applied inductive, thematic analysis to identify salient themes. Analysis occurred concurrently with data collection; therefore, the interview guide was iteratively revised as new questions and themes emerged. Interviews were conducted with 17 caregivers and 22 providers. On the basis of participant perspectives, we identified 4 requirements for shared care plans that would help meet information needs and mitigate current information barriers when caring for CMC. These requirements included the following: (1) supporting the accessibility of care plans from multiple locations (eg, cloud-based) and from multiple devices, with alert and search features; (2) ensuring the organization is tailored to the specific user; (3) including collaborative functionality such as real-time, multiuser content management and secure messaging; and (4) storing care plans on a secure platform with caregiver-controlled permission settings. Although further studies are needed to understand the optimal design and implementation strategies, shared care plans that meet these specified requirements could mitigate perceived information barriers and improve care for CMC.

A feature selection technique based on rough set and improvised PSO algorithm (PSORS-FS) for permission based detection of Android malwares

The set of permissions required by any Android app during installation time is considered as the feature set which are used in permission based detection of Android malwares. Those high dimensional feature set should be reduced to minimize computational overhead by choosing an optimal sub set of features. In recent times, selection of meaningful attributes is an inevitable step for mining of large dimensional data and the application of heuristic feature selection algorithms are the main research directions in this field. “Quality of classification” measure is inspired by rough set theory and can be combined with bio inspired heuristic search techniques (Particle swarm optimization, Genetic Algorithm etc.) in selecting optimal or near optimal subsets of features. In this work, a feature selection technique based on rough set and improvised particle swarm optimization (PSO) algorithm is proposed for selection of features in the permission based detection of Android malwares. The main contribution of this work is to recommend a new random key encoding method which is used in the proposed work (PSORS-FS) to convert classical PSO algorithm in discrete domain. It also reduces the issues related to maximum velocity of particles as well as sigmoid function which is related with binary PSO. PSORS-FS ensures diversity in the search process and it also reduces the tendency of premature convergence. Datasets of UCI, KEEL machine learning repository and two Android permission datasets have been used to evaluate the performance of the proposed method. Better classification performance has been yielded by proposed method over conventional filters and wrapper methods for most of the machine learning classifiers.

Studying users’ adaptation to Android’s run-time fine-grained access control system

The advent of the sixth Android version brought a significant security and privacy advancement to its users. The platform’s security model has changed dramatically, allowing users to grant or deny access to resources when requested by applications during run-time. This improvement changed the traditional coarse-grained permission system and it was anticipated for a long time by privacy-aware users. In this paper, we present a pilot study that aims to analyze how Android users adapted to the run-time permission model. We gathered anonymous data from 52 participants, who downloaded an application we developed and answered questions related to the run-time permission model. Their answers suggest that most of them positively accepted the new model. We also collected data that describe users’ permission settings for each installed application on their devices. Our analysis shows that individuals make consistent choices regarding the resources they allow to various applications to access. In addition, the results of this pilot study showcase that on a second data collection round (occurred one month after the first phase of our experiments), 50% of the respondents did not change a single permission on their devices and only 2.26% of installed applications (on average) presented altered permission settings.

An Empirical Analysis of Android Permission System Based on User Activities

In today’s world there has been an exponential growth among smart-phone users which has led to the unbridled growth of smart-phone apps available in Google play store, app store etc., In case of android application, there are many free applications for which the user need not shell out a penny to use the services. Here the magic word is “free” which entices millions of pliant people into installing those apps and giving unnecessary access to their data and device control. Current studies have shown that over 70% of the apps in market, request to gather data digressive to the most functions of apps that might cause seeping of personal data or inefficient use of mobile resources. Of late, couple of malignant applications gather unobtrusive information of the user through third-party applications by increasing their permissions to high-level on the Android Operating System. Android permission system provides, the user access to the third party apps and in return based on the permissions granted by the user, an app can access the related resource from the user's mobile. A user is bound to grant or deny permits during the installation of the application. For the most part, users don't focus on the asked permissions, or sometimes users do not understand the meaning of the permission and install the app on their device. They allow a way for attackers to perform the malicious task by demanding for more than expected set of permissions. These extra permissions permit the attacker to exploit the device and also retrieve sensitive information from it. In this research paper we describe how permission system security can create an awareness among the users that would assist them in deciding on permission grants. This improved and responsible user activities in Android OS can help the users in utilizing their device securely.

A COMPREHENSIVE SURVEY ON DETECTING BLACK HOLE ATTACK IN MOBILE AD-HOC NETWORK (MANET)

The infrastructure-less nature and mobility of nodes in mobile ad-hoc network (MANET) make it to be very susceptible to various attacks. Besides, owing to its flexibility and simplicity, there is no predefined time or permission set for nodes to leave or join the network and each node can act as a client or server. Nevertheless, securing communication between nodes has become a challenging problem than in other types of network. Attacks in MANET range into different categories. Black hole attack is one of the attacks that has been addressed by many researchers in the recent years. It does occur when a harmful mobile node called black hole becomes a part of the network and tries to use its malicious behaviors by sending fake route reply packets (RREP) for any received route request packets (RREQ). When these faked packets arrive to the source node, it does reply to them by sending data packet via the established route. Once the packets are received by the black hole, it drops them before reaching the destination. Hence, preventing the source node from reaching the intended destination. In this paper, we present an overview of a wide range of techniques suggested in the literature for detecting and preventing black hole attacks in mobile ad hoc network. Additionally, the effect of each approach on the network performance is also presented.

Hydra‐Bite: Static Taint Immunity, Split, and Complot Based Information Capture Method for Android Device

In order to attract attention to the malicious use of large‐scale operation of applications, Hydra‐Bite, an Android device privacy leak path implemented by splitting traditional malicious application and restructuring to a collaborative application group, is proposed in this paper. For Hydra‐Bite, firstly, traditional privacy stealing Trojan is analyzed to obtain the permission set. And the permission set redundancy elimination splitting algorithm is subsequently adopted to extract the simplest key permission set and split the set by functions so as to form the collaborative application group. Then, a covert channel is adopted for the intergroup Apps to remove the information’s taint tagged by security methods. Meanwhile, a communication medium selection algorithm and an information normalization coding method are proposed to improve the efficiency and the concealing property for taints removal. Finally, collaborative external transmission of information is realized on the basis of intragroup Apps’ communication. The experimental results show that Hydra‐Bite could resist the detecting and killing of about 60 security engines such as Kaspersky, McAfee, and Qihoo‐360 in VirusTotal platform and capture the privacy information of the devices of different versions from Android 4.0 to Android 7.0. Hydra‐Bite can resist the killing of the following two methods, the typical detection tool Androguard based on “permission‐API” and the typical static taint tracking tool FlowDroid. Compared with traditional privacy stealing Trojan, Hydra‐Bite has higher information capture rate and stronger antikilling performance.

Android Malware Permission-Based Multi-Class Classification Using Extremely Randomized Trees

Due to recent developments in hardware and software technologies for mobile phones, people depend on their smartphones more than ever before. Today, people conduct a variety of business, health, and financial transactions on their mobile devices. This trend has caused an influx of mobile applications that require users’ sensitive information. As these applications increase so too have the number of malicious applications that steal users’ sensitive information. Through our research, we developed a reverse engineering framework (RevEng). Within RevEng, the applications’ permissions were selected, and then fed into machine learning algorithms. Through our research, we created a reduced set of permissions by using extremely randomized trees that achieved high accuracy and a shorter execution time. Furthermore, we conducted two approaches based on the extracted information. Approach one used binary value representation of the permissions. Approach two used the features’ importance; we represented each selected permission (in approach one) by its weighted value instead of the binary value. We conducted a comparison between the results of our two approaches and other related work. Our approaches achieved better results in both accuracy and time performance with a reduced number of permissions.

Negotiation as a Collaborative Tool for Determining Permissions and Detection of Malicious Applications

In Android OS users find it very difficult to understand and comprehend its permission mechanism. Frequently, users tend to ignore permission negotiations dialogs during installation of an application. Users, who pay attention to the permission negotiation dialogs, find it tough to comprehend the description and evaluation of permission procedure. They do not know the impact of granting these permissions on their data. One major issue is that user is unaware about how application uses their data. He has no insight after granting permission to the application and effect of these permissions on his data’s privacy and security. This research reveals that discrete permission settings are helpful for user to secure his device resources and data. This study uses a distinct technique to detect danger of unnecessary permissions. It helps end users of Android OSs to understand the problems and provides them batter way to deal with the problems and grounds to explore alternatives.

A detailed study on risk assessment of mobile app permissions

Mobile phone have user’s personal and private information. When mobile applications have the permission to access to this information they may leak it to third parties without user’s consent for their own benefits. As users are not aware of how their personal information would be used once applications are installed and permissions are granted, this raises a potential privacy concern. Therefore, there is a need for a risk assessment model that can intimate the users about the threats the mobile application poses to the user's private information. We propose an approach that helps in increasing user’s awareness of the privacy risk involved with granting permissions to Android applications. The proposed model focuses on the requested permissions of the application and determines the risk based on the permission set asked and gives a risk score.

To Permit or Not to Permit, That is the Usability Question: Crowdsourcing Mobile Apps’ Privacy Permission Settings

Abstract Millions of apps available to smartphone owners request various permissions to resources on the devices including sensitive data such as location and contact information. Disabling permissions for sensitive resources could improve privacy but can also impact the usability of apps in ways users may not be able to predict. We study an efficient approach that ascertains the impact of disabling permissions on the usability of apps through large-scale, crowdsourced user testing with the ultimate goal of making recommendations to users about which permissions can be disabled for improved privacy without sacrificing usability. We replicate and significantly extend previous analysis that showed the promise of a crowdsourcing approach where crowd workers test and report back on various configurations of an app. Through a large, between-subjects user experiment, our work provides insight into the impact of removing permissions within and across different apps (our participants tested three apps: Facebook Messenger (N=218), Instagram (N=227), and Twitter (N=110)). We study the impact of removing various permissions within and across apps, and we discover that it is possible to increase user privacy by disabling app permissions while also maintaining app usability.