An Empirical Study on the Impact of Permission Smell in Android Applications

Wu Zhiqiang (오지강); Hakjin Lee (이학진); Scott Uk-Jin Lee

doi:10.9708/jksci.2021.26.06.089

An Empirical Study on the Impact of Permission Smell in Android Applications

Journal of The Korea Society of Computer and Information
Abbr : JKSCI
2021, 26(6), pp.89-96
DOI : 10.9708/jksci.2021.26.06.089
Publisher : The Korean Society Of Computer And Information
Research Area : Engineering > Computer Science
Received : May 11, 2021
Accepted : May 26, 2021
Published : June 30, 2021

Wu Zhiqiang ¹, Hakjin Lee ¹, Scott Uk-Jin Lee ¹

¹한양대학교

Accredited

ABSTRACT

In this paper, we proposed a sniffer to detect permission smells from developer and third-party libraries' code. Moreover, we conducted an empirical study to investigate unnecessary permissions on large real-world Android apps. Our analysis indicates that permission smell extensively exists in Android apps. According to the results, permission smells exist in most Android apps. In particular, third-party libraries request permission for functionalities that are not used by developers, which cause more smells. Moreover, most developers do not properly disable unnecessary permissions that are declared for third-party libraries. We discussed the impacts of permission smells on user experiences. As a result, the existence of permission smell does not impact the number of downloads. However, apps that have more unnecessary permissions have received lower ratings from users.

KEYWORDS

Android, Code Smell, Permission, Empirical Study, Security Risk

Citation status

* References for papers published after 2023 are currently being built.

[web] / Android Market Share / https://www.idc.com/promo/smartphonemarket-share/os

[web] / AppBrain / https://www.appbrain.com/stats/number-of-android-apps

[confproc] H. Wang / 2018 / Why are Android Apps Removed From Google Play? A Large-scale Empirical Study / Proceedings of International Conference on Mining Software Repository : 231~242

[journal] H. Mumtaz / 2018 / An Empirical Study to Improve Software Security Through the Application of Code Refactoring / Information and Software Technology 96 : 112~125

[confproc] K. Rahkema / 2020 / Empirical Study on Code Smells in iOS Applications / Proceedings of International Conference on Mobile Software Engineering and Systems : 61~65

[confproc] Z. Wu / 2019 / Permission Smells Detection for IoT Applications on Android Platform / Proceeding of Korean Computer Congress : 293~295

[journal] J. Xiao / 2020 / An Android Application Risk Evaluation Framework Based on Minimum Permission Set Identification / Journal of Systems and Software 163 : 110533~

[journal] C. Lyvas / 2018 / Dyperm-in : Dynamic permission mining framework for android platform / Computer & Security 77 : 472~487

[journal] Z. Wu / 2021 / FCDP : Fidelity Calculation for Description-to-Permissions in Android Apps / IEEE Access 9 : 1062~1075

[journal] L. Yu / 2017 / Enhancing the Description-to-Behavior Fidelity in Android Apps with Privacy Policy / IEEE Transactions on Software Engineering 44(9) : 834~854

[journal] T. Watanabe / 2018 / Understanding the Inconsistency between Behaviors and Descriptions of Mobile Apps / IEICE Transactions on Information and Systems 101(11) : 2584~2599

[confproc] C. Zhang / 2018 / Re-checking App Behavior against App Description in the Context of Third-party Libraries / Proceeding of International Conference on Software Engineering and Knowledge Engineering

[confproc] C. Dennis / 2017 / P-Lint : A Permission Smell Detector for Android Applications / Proceeding of IEEE/ACM International Conference on Mobile Software Engineering and Systems : 219~220

[confproc] X. Liu / 2018 / Mining Android App Descriptions for Permission Requirements Recommendation / Proceeding of 2018 IEEE 26th International Requirements Engineering Conference(RE) : 147~158

[web] / AndroGuard / https://github.com/androguard/androguard

[confproc] K. W. Y. Au / 2012 / PScout : Analyzing the Android Permission Specification / Proceedings of the 2012ACM conference on Computer and Communications Security : 217~228

[web] / Android Sensors / https://developer.android.com/reference/android/hardware/SensorManager

[confproc] K. Allix / 2016 / AndroZoo : Collecting Millions of Android Apps for the Research Community / Proceedings of International Conference on Mining Software Repositories : 468~471

[confproc] P. Calciati / 2020 / Automatically Granted Permissions in Android Apps / Proceedings of the 17th International Conference on Mining Software Repositories : 114~124

[confproc] M. Ghafari / 2017 / Security Smells in Android / Proceeding of 2017 IEEE 17th International Conference on Source Code Analysis and Manipulation : 121~130

[confproc] Z. Zhang / 2020 / An Empirical Study of Potentially Malicious Third-Party Libraries in Android Apps / Proceeding of ACM Conference on Security and Privacy in Wireless and Mobile Networks : 144~154

This paper was written with support from the National Research Foundation of Korea.

KJCKorea
Journal Central

Journal of The Korea Society of Computer and Information 2023 KCI Impact Factor : 0.65

An Empirical Study on the Impact of Permission Smell in Android Applications

ABSTRACT

KEYWORDS

Citation status

* References for papers published after 2023 are currently being built.

Journal of The Korea Society of Computer and Information 2023 KCI Impact Factor : 0.65

An Empirical Study on the Impact of Permission Smell in Android Applications

ABSTRACT

KEYWORDS

Statistics

Tools

Issue List

Citation status

KCI Citation Counts (0)

REFERENCES (21) * References for papers published after 2023 are currently being built.

Search PDF

Citation

* References for papers published after 2023 are currently being built.