Android Security Improvement
by Visualization of Application Behavior
Rika Hayashi
Institute of Information Security

I love Android

I love Android.

2

I love Android. But ...
I love Android.

If I give him everything ...

3

I love Android. But ...
If I give him everything ...

He would become ill.

4

I love Android. So ...
I love Android.

So I have to select what I give him.

5

Select what I give him
example : Application to show the map where I am
BlackApp
Applications requires ‘permissions’before installation.
BlueApp

RedApp6

Select what I give him
example : Application to show the map where I am
Applications requires ‘permissions’before installation.
BlackAppINTERNETREAD
PHONE_STATE

RECORDAUDIOAUTHENTICATE_ACCOUNTS

ACCSESSLOCATIONACCESSPERSONAL_INFO
7

Select what I give him
example : Application to show the map where I am
Applications requires ‘permissions’before installation.
BlackAppINTERNETREAD
PHONE_STATE

RECORDAUDIOAUTHENTICATE_ACCOUNTS

ACCSESSLOCATIONACCESSPERSONAL_INFO
8

Select what I give him
example : Application to show the map where I am
Applications requires ‘permissions’before installation.
BlueApp

RedApp

INTERNETACCSESSACCSESSLOCATIONLOCATION
Permissions are reasonable...
9Select what I give him
A user starts app
BlueApp

A user returns home screen

Locationstart getting
locationstop getting
location

A user starts app

A user returns home screen

start getting
locationstop getting
location

RedAppLocation

Locationstart getting location
without user’s intention
10Select what I give him
A user starts app
BlueApp

A user returns home screen

Locationstart getting
locationstop getting
location

A user starts app

A user returns home screen

start getting
locationstop gettinglocation

RedAppLocation

Locationstart getting location
without user’s intention
11Select applications[ now ]safe(BlueApp)

suspicious(RedApp)
malicious(BlackApp)

Checkpermission

Install

After this,no validationis perform.

Not Install12

Select what I give him
example : Application to show the map where we areBlackApp
Applications requires ‘permissions’before installation.
BlueApp

RedApp13

Select what I give him
A user starts app
BlueApp

A user returns home screen

Locationstart getting
locationstop gettinglocation

A user starts app

A user returns home screen

start getting
locationstop getting
location

RedAppLocation

Locationstart getting location
without user’s intention
14

To keep safety by users’ own selves－ Select application[ now ]safe(BlueApp)

suspicious(RedApp)malicious(BlackApp)

Checkpermission

Install

After this,no validationis perform.

Not Install15

Purpose of this study[ now ]
To judge whether applications are malicious, safe or
suspicious, users can only verify the ‘permissions’ requiredby them before installation.
So users can’t notice suspicious applications.
[ propose ]I provide users with information to judge whether applications
are safe or suspicious, even after installing them.
I propose the visualization system to show application
behavior.
16

Proposal
now

safe

suspicious

Check

Installpermission

malicious

Not
Install

malicious

Keepproposal

safe
suspicious

After this,no validationis perform.

Check

Installpermission

Not
Install

Visualization
systemJudge

Uninstall

17

Visualization of Application Behavior
proposal

safe
suspicious

Keep

Check
permission

malicious
Not
Install

Install

Visualization
systemCapture theimportantaction

Judge

Uninstall
Visualize

18

Visualization of Application Behavior
proposal

safe
suspicious

Keep

Checkpermission

malicious
Not
Install

Install

Visualization
systemCapture theimportantactionJudge

Uninstall
Visualize

example :• Get personal info
• Get location• Open network socket• Set the system time zone

19

Visualization of Application Behavior
proposal

safe
suspicious

Keep

Checkpermission

malicious
Not
Install

Install

Visualization
systemCapture theimportantactionJudge

Uninstall
Visualize

Inform onthe spot

Show
brief
history
20

Inform on the spot
Inform users that application
takes an important action

Status bar

An application
takes an importantaction.

21

Inform on the spot
Permit application to take an important action ⇒ Tap the notification area
Reject application to take an important action ⇒ Ignore it＜If permitting＞

dragIf permitting,tap here.

Notification
area

22

Show brief history
Show users the brief history of important actions taken by applications.

The brief history that
BlueApp got location.

The brief history that
RedApp got location.

start getting location
stop getting location
User rejects
starting getting
location

23

Demonstration♣ Implement Visualization system as application
experimentally.
I want to modify the API in the Application Framework of Android
platform, but I haven’t yet ...

24

Demonstration
RedApp is the application to show the location where I am
I start app
start getting
location
RedAppI return home screenstop getting
location
Location

Locationstart getting location
without my intention
Permit the action ⇒ Tap the notification area
Reject the action ⇒ Ignore it

If permitting,tap here.
25

Summary
Add two features to visualize the application behavior.
＜feature1＞ Inform on the spot
♣ Inform users that application takes an important action on the spot.
Users can judge whether the timing of the action is exactly what users
intend.
+α … Users can permit or reject the action as intended.
＜feature2＞ Show brief history♣ Show users the brief history of important actions taken byapplications.
Users can judge whether there are any application
・whose timing of the action is not exactly what users intend
・which took improper duration or repetition of the action.
26

Summary＜feature1＞ Inform on the spot
♣ Inform users that application takes an important action on the spot.
Users can judge whether the timing of the action is exactly what users
intend.
+α … Users can permit or reject the action as intended.

＜feature2＞ Show brief history♣ Show users the brief history of important actions taken byapplications.
Users can judge whether there are any application
・whose timing of the action is not exactly what users intend
・which took improper duration or repetition of the action.
Users can judge whether applications are safe or suspicious,
even after installing them.

27

Fin.
Thank you.

28