TKPERM: Cross-platform Permission Knowledge Transfer to Detect Overprivileged Third-party Applications
TKPERM: Cross-platform Permission Knowledge Transfer to Detect Overprivileged Third-party Applications
复制标题
DOI：
10.14722/ndss.2020.24287
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
F. H. Shezan;Kaiming Cheng;Zhen Zhang;Yinzhi Cao;Yuan Tian
中科院分区：
文献类型：
--
作者：
F. H. Shezan;Kaiming Cheng;Zhen Zhang;Yinzhi Cao;Yuan Tian
基于权限的访问控制使用户能够管理和控制第三方应用程序的敏感数据。在理想情况下，第三方应用程序包括足够的详细信息来说明此类数据的使用，而现实情况是，对第三方应用程序的许多描述对其安全或隐私活动含糊其辞。因此，在向这些应用程序授予敏感数据时，用户无法获得足够的详细信息。之前的工作，如WHYPER和AutoCog，已经通过所谓的许可关联系统解决了上述问题。这样的系统将第三方应用程序的描述与其所请求的许可相关联，并且如果发现所请求的许可与描述之间的不匹配，则将应用程序确定为过度特权。然而，尽管已有的工作在各自的平台上取得了成功，如Android生态系统，但在没有广泛的数据标注和参数调整的情况下，它们不能直接适用于新的平台，如Chrome扩展和IFTTT。在本文中，我们设计、实现并评估了一个新的系统，称为TKPERM，它可以跨平台地传递权限关联系统的知识。我们的主要想法是，这些具有不同使用情形的不同平台-如智能手机、物联网和桌面浏览器-都是面向用户的，因此允许知识跨平台传输。特别是，我们采用了一种贪婪的选择算法，选择最好的源域来转移到新平台上的目标权限。TKPERM在转移后的F1总分达到90.02%，比没有转移的直接在目标域上训练的模型高12.62%。特别是，TKPERM在IFTTT上的F1得分为91.83%，在Chrome-Expansion上的F1得分为89.13%，在SmartThings上的F1得分为89.1%。TKPERM还成功识别了许多现实世界中的过度特权应用程序，例如游戏中心在没有合法使用的情况下请求位置许可。
Permission-based access control enables users to manage and control their sensitive data for third-party applications. In an ideal scenario, third-party application includes enough details to illustrate the usage of such data, while the reality is that many descriptions of third-party applications are vague about their security or privacy activities. As a result, users are left with insufficient details when granting sensitive data to these applications. Prior works, such as WHYPER and AutoCog, have addressed the aforementioned problem via a so-called permission correlation system. Such a system correlates thirdparty applications’ description with their requested permissions and determines an application as overprivileged, if a mismatch between the requested permission and the description is found. However, although prior works are successful on their own platforms, such as Android eco-system, they are not directly applicable to new platforms, such as Chrome extensions and IFTTT, without extensive data labeling and parameter tuning. In this paper, we design, implement, and evaluate a novel system, called TKPERM, which transfers knowledges of permission correlation systems across platforms. Our key idea is that these varied platforms with different use cases—like smartphones, IoTs, and desktop browsers—are all user-facing and thus allow the knowledges to be transferrable across platforms. Particularly, we adopt a greedy selection algorithm that picks the best source domains to transfer to the target permission on a new platform. TKPERM achieves 90.02% overall F1 score after transfer, which is 12.62% higher than the one of a model trained directly on the target domain without transfer. Particularly, TKPERM has 91.83% F1 score on IFTTT, 89.13% F1 score on Chrome-Extension, and 89.1% F1 score on SmartThings. TKPERM also successfully identified many real-world overprivileged applications, such as a gaming hub requesting location permissions without legitimate use.