A Framework for Permission Recommendation and Risk Evaluation Based on Skewness-Based Filtering

Android mobile ecosystem has penetrated into people's every aspect of life. Since more and more sensitive and valuable information is stored in mobile ecosystem, how to configure the permission system to guarantee the security becomes an important issue for the whole community. In order to solve the permission over-privilege problem, a skewness-based permission recommendation framework is presented to identify the over-privilege permission and evaluate the risk for the Android Apps. Specially, the topic model Latent Dirichlet Allocation is employed to build the mapping between functionality and permission. Considering the fact that even the popular applications violate the least privilege principle, a collaborative filtering variant method in which high risk applications and permissions are identified is presented to recommend required permissions. Finally, the permission over-privilege based ap-proach is presented to evaluate the risk of the application. The experiments based on the Apps from Google Play shows that our approach is effective to identify the unexpected permissions for both popular and malicious Apps.