Risk analysis of Android applications: a user-centric solution
File(s)2016-FGCS-dmmpss-accepted.pdf (927.81 KB)
Accepted version
Author(s)
Type
Journal Article
Abstract
Android applications (apps) pose many risks to their users, e.g., by including code that may threaten user privacy or system integrity. Most of the current security countermeasures for detecting dangerous apps show some weaknesses, mainly related to users’ understanding and acceptance. Hence, users would benefit from an effective but simple technique that indicates whether an app is safe or risky to be installed. In this paper, we present MAETROID (Multi-criteria App Evaluator of TRust for AndrOID), a framework to evaluate the trustworthiness of Android apps, i.e., the amount of risk they pose to users, e.g., in terms of confidentiality and integrity. MAETROID performs a multi-criteria analysis of an app at deploy-time and returns a single easy-to-understand evaluation of the app’s risk level (i.e., Trusted, Medium Risk, and High Risk), aimed at driving the user decision on whether or not installing a new app. The criteria include the set of requested permissions and a set of metadata retrieved from the marketplace, denoting the app quality and popularity. We have tested MAETROID on a set of 11,000 apps both coming from Google Play and from a database of known malicious apps. The results show a good accuracy in both identifying the malicious apps and in terms of false positive rate.
Date Issued
2016-06-08
Date Acceptance
2016-05-25
Citation
Future Generation Computer Systems, 2016, 80, pp.505-518
ISSN
0167-739X
Publisher
Elsevier
Start Page
505
End Page
518
Journal / Book Title
Future Generation Computer Systems
Volume
80
Copyright Statement
© 2016 Elsevier. Licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International http://creativecommons.org/licenses/by-nc-nd/4.0/
Subjects
0805 Distributed Computing
0806 Information Systems
Distributed Computing
Publication Status
Published