# Personal Information Classification on Aggregated Android Application's Permissions
## 3 Risk Modeling
### Android Permission Scope Model  
This section defines the personal information distribution likelihood on the Android platform. Android platform associated stakeholders and their permission gathering mechanism (user consent) were discussed here. The key stakeholders of the Android ecosystem were defined here:  
**Definition 1**. : _Application, a software intended to perform special function and tasks of individuals through a handphone, smart TV, IoT device, smart vehicle, etc. on the Android platform. The set of applications or apps are represented by APP = {A_1, \(A\)2... _A_NAAPP}, where _N_APP are the elements of APP. Figure 3: Overall architecture of the proposed study. **Definition 2**. : _Publisher, a group of sub-organizations that publishes one or more Android applications on the Google Play-store intended for the Android platform. The set of publishers are represented by PUB = {W1, W2... WNPUB}, where NPUB are the elements of the set PUB._  
**Definition 3**. : _Owner, a company that owns few subsidiaries (sub-organizations) or publishers who publish applications. The set of owners are represented by OWN = {K1, K2... KNOWN}, where NONN are the elements of the set OWN._  
**Definition 4**. : _The purpose of an Android apps' permission is to safeguard the personal information of an Android user. An Android application demands user consent (install and run time) to access sensitive user data via an app. Permissions, a group of personal information accessing consent, frequently gathered by Android apps during an install and run time. The set of permissions are represented by PER = {P1, P2... PNPER}, where NPER are the elements of the set PER._  
Out of all permissions, Android marked 26 dangerous permissions that involve the user's private information or affect the user's identity (requires user consent to access) [59] (Table 2). The study only considers those 26 dangerous permissions that are represented by {Pn1, Pn2... Pn26}. Naturally, {A1, A2... ANAP} are linked with the respective {W1, W2, W3,..., WNPUB} and associated {K1, K2... KNOWN}. This study now describes the data sharing scope of applications, publishers and owners. * Firstly, {A1, A2... ANAP} collects four types of user consents: Normal, dangerous, signature and system [79]. Only {Pn1, Pn2... Pn26} are used by the apps for sensitive personal data collection. * Secondly, {W1, W2... WNPUB} publishes and owns the {A1, A2... ANAP} those are available at the Google Play-store [57]. As a {W1, W2... WNPUB} controls the {A1, A2... ANAP}, it can easily accumulate partial data through underneath {Pn1, Pn2... Pn26} of those {A1, A2... ANAP}. * Finally, {K1, K2... KNOWN} owns several app publishing publishers or sub-organizations. Personal information selling to the same owners and even different owners are well-practiced [12; 36; 80]. Therefore, {K1, K2... KNOWN} can directly or indirectly collect personal data from the {W1, W2... WNPUB} and the {A1, A2... ANAP} through associated {Pn1, Pn2... Pn26}. Greater data possession can lead to stronger data mining. Thus, the study provides three data distribution associated assumptions by the applications, publishers and owners respectively. **Assumption 1**. : _Actually, not all {Pn1, Pn2... Pn26} are concurrently needed by an application. Each Android application demands a specific set of dangerous permissions. For example, application A1 might require a set of dangerous permissions, {Pn1, Pn5, Pn6, Pn12, Pn13, Pn16, Pn23, Pn26}; application A2 might require a fully different set of dangerous permissions, {Pn2, Pn3, Pn8, Pn15, Pn19, Pn21, Pn25} and application A3 might require another set of dangerous permissions, {Pn1, Pn3, Pn8, Pn13, Pn16, Pn21, Pn25}. The above example indicates that more than one application may be used to collect all available {Pn1, Pn2... Pn26}. Therefore, the study inferred the possibility of dangerous permissions aggregation from multiple apps._  
**Assumption 2**. : _Android releases several apps on the Play-store through the publishers.