SuSi: A Tool for the Fully Automated Classification and Categorization of Android Sources and Sinks

摘要: Today’s smartphone users face a security dilemma: many apps they install operate on privacy-sensitive data, although might originate from developers whose trustworthiness is hard to judge. Researchers have proposed more and sophisticated static dynamic analysis tools as an aid assess the behavior of such applications. Those tools, however, are only good privacy policies configured with. Policies typically refer list sources sensitive data well sinks which leak untrusted observers. Sources moving target: new versions mobile operating system regularly introduce methods, need be reconfigured take them into account. In this work we show that, at least for case Android, API comprises hundreds sinks. We propose SuSi, novel fully automated machine-learning approach identifying directly Android source code. On our training set, SuSi achieves recall precision than 92%. To provide fine-grained information, further categorizes (e.g., unique identifier, location etc.) network, file, etc.), with average about 89%. also that current program can circumvented because use hand-picked lists largely incomplete, hence allowing potential leaks go unnoticed.