Enhancing Mobile App Security by Aligning User Expectations with App Behaviors
Explore how bridging user expectations with application behaviors can improve mobile application security. Learn about user perceptions, privacy requirements, and the importance of automated risk assessment in ensuring a secure user experience.
Uploaded on | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Improving Mobile Application Security via Bridging User Expectations and Application Behaviors Xusheng Xiao Rahul Pandita William Enck NC State Univ. Wei Yang Univ. of Illinois Tao Xie Univ. of Illinois
User Expectations and App Behaviors User expectations are reflected via user perceptions of app behaviors (in combination with user judgments) User Expectations User judgments, Privacy requirements There are gaps btw. user perceptions and application behaviors Some application behaviors may be user imperceptible, or contradict w/ user perceptions The user may not be able to make right judgments based on perceived information User Perceptions Interfaces, Descriptions, Usage scenarios etc. App Behaviors
WHYPER: Automated Risk Assessment [Pandita et al. USENIX Security 13] User Perceptions: App Description App Behaviors: Permission Request/Use A framework using NLP techniques to construct traceability between a sentence in app description a permission of an app Permission List App Description Links
WHYPER Use Cases Enhance user experience while installing apps Enforce functionality disclosure on developers Complement program analysis to ensure more appropriate justifications DEVELOPERS Application Market WHYPER USERS
User-Aware Privacy Control [Xiao et al. ASE 12] User Perceptions: Inspected Outgoing Info App Behaviors: Info Flows Source (Location) Sink (Sharing) what data type flowing to what output channels User-awareness of shared data instances at runtime monitored sink viauser inspection
Escaping/Tampering Flows Notify users of potential information leak escaping flows info may flow to output channels (e.g., network sockets) where users cannot inspect tampering flows info may be tampered before the info is presented to users for inspection
