Suspicious App Identification via Permission Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying suspicious applications on mobile devices lack effectiveness in evaluating the security and safety of applications prior to download, as users have limited means to assess the permissions requested by applications, especially since many are self-certified and not validated by central authorities.
Innovation Solution
A method involving clustering of applications based on requested permissions using techniques like hierarchical clustering and K-means, calculating similarity scores through metrics such as Hamming, Euclidean, or Jaccard distance, and converting these scores into application scores to flag potentially malicious apps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If applications are self-certified with digital certificates from developers themselves, then application distribution and download are facilitated, but security and safety evaluation capability deteriorates
Solution Approach 1:
The system performs preliminary clustering and similarity scoring of applications based on their requested permissions before users download or purchase them. By pre-evaluating applications using permission-based clustering algorithms (K-means, hierarchical clustering) and computing similarity scores against known safe/malicious applications, the system provides security assessment in advance, allowing users to make informed decisions without compromising distribution speed.
2Ease of operation
If users have limited means to evaluate application permissions, then ease of application installation is maintained, but security risk increases
Solution Approach 1:
The system introduces an intermediary security assessment layer that automatically evaluates applications based on their requested permissions. Instead of requiring users to manually evaluate permissions or trust self-certified developers, the system acts as a mediator by computing similarity scores between the application's permission profile and known safe/malicious applications, providing an automated security recommendation that maintains ease of installation while reducing security risks.
3Measurement precision
If clustering algorithms are used to group applications by permissions, then identification accuracy of suspicious applications is improved, but computational complexity increases
Solution Approach 1:
The system segments the application evaluation process into distinct phases: (1) extracting permission information from manifest files, (2) filtering permissions to exclude rare ones, (3) converting permissions to bit vectors, (4) performing clustering only on relevant permission sets, and (5) computing similarity scores. This segmentation reduces computational complexity by processing only necessary data in each phase while maintaining identification accuracy through systematic analysis.
Solution Approach 2:
The system applies partial action by filtering permissions to exclude those that occur in less than a specified number of applications before clustering. This reduces the dimensionality of the data being processed, making clustering computations more efficient while retaining the most discriminative permission features needed for accurate suspicious application identification.
Data Source
AI summary
Techniques for identifying suspicious applications are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for identifying suspicious applications comprising determining one or more clusters of applications in an identified category of applications based on requested permissions of each of two or more applications in each of the one or more clusters of applications, determining a center application of each of the one or more clusters, and determining, using at least one computer processor, a similarity score for an application being evaluated based at least in part on a distance between the application being evaluated and the center application of a closest cluster of the one or more clusters.