Towards speedy permission-based debloating for Android apps

• Main Authors: Ferdian, Thung, LIU, Jiakun, RATTANUKUL, Pattarakrit, MAOZ, Shahar, TOCH, Eran, GAO, Debin, LO, David
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2024
• Subjects: Security and privacy; Software security engineering; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/9259; https://ink.library.smu.edu.sg/context/sis_research/article/10259/viewcontent/3647632.3651390.pdf
• Institution: Singapore Management University

Android apps typically include many functionalities that not all users require. These result in software bloat that increases possible attack surface and app size. Common functionalities that users may not require are related to permissions that they intend to disallow in the first place. As these permissions are disallowed, their related code would never be executed and therefore can be safely removed. Existing work has proposed a solution to debloat Android apps according to the disallowed permissions. However, for large and complex applications, the debloating process could take hours, typically due the long time that may be needed to construct call graph for analysis. In this work, we propose MiniAppPerm, that speeds up the permission-based debloating by constructing a partial call graph instead of a complete call graph. Our preliminary experiments on a set of apps in Google Play show that MiniAppPerm can reduce the call graph construction time by up to 85.3%. We also checked that the debloated apps can run without crashes.