Mining Permission Request Patterns from Android and Facebook Applications (extended author version)

摘要

Android and Facebook provide third-party applications with access to users'private data and the ability to perform potentially sensitive operations (e.g.,post to a user's wall or place phone calls). As a security measure, theseplatforms restrict applications' privileges with permission systems: users mustapprove the permissions requested by applications before the applications canmake privacy- or security-relevant API calls. However, recent studies haveshown that users often do not understand permission requests and lack a notionof typicality of requests. As a first step towards simplifying permissionsystems, we cluster a corpus of 188,389 Android applications and 27,029Facebook applications to find patterns in permission requests. Using a methodfor Boolean matrix factorization for finding overlapping clusters, we find thatFacebook permission requests follow a clear structure that exhibits highstability when fitted with only five clusters, whereas Android applicationsdemonstrate more complex permission requests. We also find that low-reputationapplications often deviate from the permission request patterns that weidentified for high-reputation applications suggesting that permission requestpatterns are indicative for user satisfaction or application quality.