Towards automatic generation of security-centric descriptions for Android apps

• Main Authors: ZHANG, Mu, DUAN, Yue, FENG, Qian, YIN, Heng
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2015
• Subjects: Android; Natural language generation; Program analysis; Subgraph mining; Textual description; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/8174; https://ink.library.smu.edu.sg/context/sis_research/article/9177/viewcontent/2015_zhang2015towards.pdf
• Institution: Singapore Management University

To improve the security awareness of end users, Android markets directly present two classes of literal app information: 1) permission requests and 2) textual descriptions. Unfortunately, neither can serve the needs. A permission list is not only hard to understand but also inadequate; textual descriptions provided by developers are not security-centric and are significantly deviated from the permissions. To fill in this gap, we propose a novel technique to automatically generate security-centric app descriptions, based on program analysis. We implement a prototype system, DESCRIBEME, and evaluate our system using both DroidBench and real-world Android apps. Experimental results demonstrate that DESCRIBEME enables a promising technique which bridges the gap between descriptions and permissions. A further user study shows that automatically produced descriptions are not only readable but also effectively help users avoid malware and privacy-breaching apps.