IconIntent: Automatic Identification of Sensitive UI Widgets Based on Icon Classification for Android Apps
IconIntent: Automatic Identification of Sensitive UI Widgets Based on Icon Classification for Android Apps
复制标题
DOI：
10.1109/icse.2019.00041
复制
发表时间：
2019-05
期刊：
影响因子：
--
通讯作者：
Xusheng Xiao;Xiaoyin Wang;Zhihao Cao;Hanlin Wang;Peng Gao
中科院分区：
文献类型：
--
作者：
Xusheng Xiao;Xiaoyin Wang;Zhihao Cao;Hanlin Wang;Peng Gao
许多移动的应用（即，应用程序）包括UI小部件以使用或收集用户的敏感数据。因此，要识别可疑的敏感数据使用（如UI权限不匹配），了解UI小部件的意图至关重要。然而，许多UI小部件利用特定形状的图标（对象图标）和嵌入有文本的图标（文本图标）来表达其意图，这对仅分析文本数据以识别敏感UI小部件的现有检测技术提出了挑战。在这项工作中，我们提出了一种新的应用程序分析框架，ICONINTENT，协同结合程序分析和图标分类，以识别Android应用程序中的敏感UI部件。ICONINTENT通过对应用程序的UI布局文件和代码进行静态分析，自动将UI小部件和图标关联起来，然后采用计算机视觉技术将关联的图标分为八类敏感数据。我们在Google Play的150个应用程序上对ICONINTENT进行了评估，结果显示ICONINTENT可以在97个应用程序中检测到248个敏感UI小部件，准确率达到82.4%。当与基于文本分析的最先进的敏感UI小部件识别技术SUPOR相结合时，SUPOR +ICONINTENT可以检测487个敏感UI小部件（比仅SUPOR提高101.2%），并将可疑权限减少50.7%（比仅SUPOR提高129.4%）。
Many mobile applications (i.e., apps) include UI widgets to use or collect users' sensitive data. Thus, to identify suspicious sensitive data usage such as UI-permission mismatch, it is crucial to understand the intentions of UI widgets. However, many UI widgets leverage icons of specific shapes (object icons) and icons embedded with text (text icons) to express their intentions, posing challenges for existing detection techniques that analyze only textual data to identify sensitive UI widgets. In this work, we propose a novel app analysis framework, ICONINTENT, that synergistically combines program analysis and icon classification to identify sensitive UI widgets in Android apps. ICONINTENT automatically associates UI widgets and icons via static analysis on app's UI layout files and code, and then adapts computer vision techniques to classify the associated icons into eight categories of sensitive data. Our evaluations of ICONINTENT on 150 apps from Google Play show that ICONINTENT can detect 248 sensitive UI widgets in 97 apps, achieving a precision of 82.4%. When combined with SUPOR, the state-of-the-art sensitive UI widget identification technique based on text analysis, SUPOR +ICONINTENT can detect 487 sensitive UI widgets (101.2% improvement over SUPOR only), and reduces suspicious permissions to be inspected by 50.7% (129.4% improvement over SUPOR only).