NDLI: MorphDroid: Fine-grained Privacy Verification

Please wait, while we are loading the content...

Evaluating the Flexibility of the Java Sandbox

Decentralized Authorization and Privacy-Enhanced Routing for Information-Centric Networks

Vulnerability Assessment of OAuth Implementations in Android Applications

Control Flow and Code Integrity for COTS binaries: An Effective Defense Against Real-World ROP Attacks

Handling Reboots and Mobility in 802.15.4 Security

JaTE: Transparent and Efficient JavaScript Confinement

AuDroid: Preventing Attacks on Audio Channels in Mobile Devices

Provenance-based Integrity Protection for Windows

Soteria: Offline Software Protection within Low-cost Embedded Devices

Proximity Verification for Contactless Access Control and Authentication Systems

Is Bigger Better? Comparing User-Generated Passwords on 3x3 vs. 4x4 Grid Sizes for Android's Pattern Unlock

Binary Code Continent: Finer-Grained Control Flow Integrity for Stripped Binaries

Towards Analyzing the Input Validation Vulnerabilities associated with Android System Services

Analyzing and Modeling Longitudinal Security Data: Promise and Pitfalls

Combining Differential Privacy and Secure Multiparty Computation

Getting to know your Card: Reverse-Engineering the Smart-Card Application Protocol Data Unit

Emerging Image Game CAPTCHAs for Resisting Automated and Human-Solver Relay Attacks

Know Your Achilles' Heel: Automatic Detection of Network Critical Services

BareDroid: Large-Scale Analysis of Android Apps on Real Devices

A Principled Approach for ROP Defense

Using Channel State Information for Tamper Detection in the Internet of Things

Cross-Site Framing Attacks

On the Robustness of Mobile Device Fingerprinting: Can Mobile Users Escape Modern Web-Tracking Mechanisms?

MOSE: Live Migration Based On-the-Fly Software Emulation

PIE: Parser Identification in Embedded Systems

Scalable and Secure Concurrent Evaluation of History-based Access Control Policies

ErsatzPasswords: Ending Password Cracking and Detecting Password Leakage

ShrinkWrap: VTable Protection without Loose Ends

MorphDroid: Fine-grained Privacy Verification

Accurate, Low Cost and Instrumentation-Free Security Audit Logging for Windows

Secure and Efficient Key Derivation in Portfolio Authentication Schemes Using Blakley Secret Sharing

Logical Partitions on Many-Core Platforms

On the Security and Usability of Crypto Phones

Proactive Security Analysis of Changes in Virtualized Infrastructures

Experimental Study with Real-world Data for Android App Security Analysis using Machine Learning

Defeating ROP Through Denial of Stack Pivot

Using Visual Challenges to Verify the Integrity of Security Cameras

Covert Botnet Command and Control Using Twitter

Grab 'n Run: Secure and Practical Dynamic Code Loading for Android Applications

Privacy-preserving Virtual Machine

Defending Against Malicious USB Firmware with GoodUSB

Entity-Based Access Control: supporting more expressive access control policies

PARS: A Uniform and Open-source Password Analysis and Research System

DynaGuard: Armoring Canary-based Protections against Brute-force Attacks

MobiPluto: File System Friendly Deniable Storage for Mobile Devices

SeSQLite: Security Enhanced SQLite: Mandatory Access Control for Android databases

Hardware-assisted Memory Tracing on New SoCs Embedding FPGA Fabrics

MorphDroid: Fine-grained Privacy Verification

Content Provider	ACM Digital Library
Author	Tripp, Omer Ferrara, Pietro Pistoia, Marco
Abstract	Mobile devices are rich in sensors, such as a Global Positioning System (GPS) tracker, microphone and camera, and have access to numerous sources of personal information, including the device ID, contacts and social data. This richness increases the functionality of mobile apps, but also creates privacy threats. As a result, different solutions have been proposed to verify or enforce privacy policies. A key limitation of existing approaches is that they reason about privacy at a coarse level, without accounting for declassification rules, such that the location for instance is treated as a single unit of information without reference to its many fields. As a result, legitimate app behaviors --- such as releasing the user's city rather than exact address --- are perceived as privacy violations, rendering existing analyses overly conservative and thus of limited usability. In this paper, we present MorphDroid, a novel static analysis algorithm that verifies mobile applications against fine-grained privacy policies. Such policies define constraints over combinations of fine-grained units of private data. Specifically, through a novel design, MorphDroid tracks flows of fine-grained privacy units while addressing important challenges, including (i) detection of correlations between different units (e.g. longitude and latitude) and (ii) modeling of semantic transformations over private data (e.g. conversion of the location into an address). We have implemented MorphDroid, and present a thorough experimental evaluation atop a comprehensive benchmark suite for Android static and dynamic analyses (DroidBench), as well as the 500 top-popular Google Play applications in 2014. Our experiments involve a spectrum of 5 security policies, ranging from a strict coarse-grained policy to a more realistic fine-grained policy that accounts for declassification rules. The experiment on DroidBench shows that MorphDroid achieves precision and recall scores of over 90%. The experiments on popular apps show that the gap between policies is dramatic, the most conservative policy yielding warnings on 171 of the applications (34%), and the more realistic policy flagging only 4 of the applications as misbehaved (< 1%). In addition, MorphDroid exhibits good performance with an average analysis time of < 20 seconds, where on average apps consist of 1.4M lines of code.
Starting Page	371
Ending Page	380
Page Count	10
File Format	PDF
ISBN	9781450336826
DOI	10.1145/2818000.2818037
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2015-12-07
Publisher Place	New York
Access Restriction	Subscribed
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

M ORPH D ROID : Fine-grained Privacy Verification

Privacy-Preserving Fine-grained Correctness Verification of Query Results in Outsourced Databases

Checking linearizability with fine-grained traces

Privacy image protection using fine-grained mosaic technique

Enforcing fine-grained security and privacy policies in an ecosystem within an ecosystem

Privacy policy enforcement for health information data access

A fined-grained privacy-preserving access control protocol in wireless sensor networks

Fine-grained privacy control for the RFID middleware of EPCglobal networks

Fine-Grained Privacy-Preserving Spatiotemporal Matching in Mobile Social Networks

MorphDroid: Fine-grained Privacy Verification

Similar Documents

M ORPH D ROID : Fine-grained Privacy Verification

Privacy-Preserving Fine-grained Correctness Verification of Query Results in Outsourced Databases

Checking linearizability with fine-grained traces

Privacy image protection using fine-grained mosaic technique

Enforcing fine-grained security and privacy policies in an ecosystem within an ecosystem

Privacy policy enforcement for health information data access

A fined-grained privacy-preserving access control protocol in wireless sensor networks

Fine-grained privacy control for the RFID middleware of EPCglobal networks

Fine-Grained Privacy-Preserving Spatiotemporal Matching in Mobile Social Networks

MorphDroid: Fine-grained Privacy Verification