checking more alerting less presented by: amin rois sinung nugroho

24
Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Upload: ira-dickerson

Post on 14-Jan-2016

222 views

Category:

Documents


2 download

TRANSCRIPT

Page 1: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Checking More Alerting LessPRESENTED BY: AMIN ROIS SINUNG NUGROHO

Page 2: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Authors.

Page 3: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 4: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 5: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 6: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Pronounced as Apple.

Page 7: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Improvements of AAPL over previous works

Page 8: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 9: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 10: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Purifying Peer Apps

Noisy Apps:

Most popular apps, frequently installed along.

Filter with same category policy.

Accessories Apps:

Compare similarity in apps description (English only) using natural language processing technique called semantic similarity.

Polluting Apps:

Apps from the same developer with similar functionality.

Filter by developer account.

Page 11: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 12: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Uncovering Privacy Disclosures Conditional Flow Identification (sensitivities can’t be surely

determined)

a. Opportunistic Constant Evaluation (dependent on parameter value), e.g., uri=content://contacts//…” will be considered as sensitive data source.

b. Object Origin Interface (dependent on object type), infer derived type of interested object, e.g., HttpsURLConnection.getOutputStream(), will be considered as sensitive sink.

Joint Flow Tracking

joint flow tracking records all potential sources/sinks even they point to non-sensitive resources/channels, and finds all sub-flows containing potential sources or potential sinks by conservatively matching all potential sinks with all potential sources.

Page 13: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 14: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 15: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

CHEX

Page 16: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

IBM Wala

Page 17: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

AAPL Usage Cases

Market Providers (e.g. Google Play)

An efficient detection and screening system to detect apps with potential privacy leakages.

Users

Identify apps with suspicious privacy disclosures. (should be developed further to recommend alternative apps with less or none privacy disclosures)

Developers

Check whether their apps have suspicious privacy disclosures. If caused by third party library, choose an alternative library.

Page 18: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 19: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 20: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO
Page 21: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Already cited by 3 papers in less than a year.

Page 22: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Weaknesses

Peer apps selection has not been bound formally by an algorithm. Such algorithm will make it more scalable.

The authors skipped non English description from the peer apps filtering. It should not be hard to use digital translator such as Google translate to provide better peer apps filtering.

Peer voting mechanism will not work if majority of peer apps show similar behavior. Suspicious primary apps will be detected as legitimate in this scenario.

Because of Android fragmentation, this method might not work well in all Android version (software) or devices (hardware).

Page 23: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Further Improvement

Recommend an alternative apps from peer apps in a situation where the primary apps display suspicious privacy disclosures.

Page 24: Checking More Alerting Less PRESENTED BY: AMIN ROIS SINUNG NUGROHO

Thank you.