2012/05/22 by Alexandre Bartel, Jacques Klein, Bartel, Alexandre +5 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Network Security and Intrusion Detection #Software Engineering (cs.SE)
paper · doi:10.48550/arxiv.1206.5829
openalex publication_date 2012/05/22 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
A common security architecture, called the permission-based security model (used e.g. in Android and Blackberry), entails intrinsic risks. For instance, applications can be granted more permissions than they actually need, what we call a "permission gap". Malware can leverage the unused permissions for achieving their malicious goals, for instance using code injection. In this paper, we present an approach to detecting permission gaps using static analysis. Our prototype implementation in the context of Android shows that the static analysis must take into account a significant amount of platform-specific knowledge. Using our tool on two datasets of Android applications, we found out that a non negligible part of applications suffers from permission gaps, i.e. does not use all the permissions they declare.