# PerHelper: Helping Developers Make Better Decisions on Permission Uses in Android Apps
## 1 Introduction  
Mobile apps have seen widespread adoption in recent years. The number of apps on Google Play surpassed the 2.5 million mark by August 2019 [1; 2]. As apps become more pervasive, they usually access sensitive data stored on mobile devices, including users' personal information (i.e., contacts) and data collected via various sensors (i.e., locations) [3; 4]. As a result, it is vital to protect these sensitive data from various adversaries. The Android operating system provides a permission-based security model to restrict whether an app can access various resources on a smartphone, including sensitive data such as contacts and locations. App developers can declare what permissions the app requires in the Android manifest file, and users will be asked to approve these permissions. However, sometimes, the permission specifications for Android can be quite complicated and confusing to developers because of the large number of permissions and different usages, which will lead to many cases of inappropriate permission requests among Android apps [5; 6]. For example, some previous studies [7; 8; 9; 10; 11; 12] explored the issue of permission gaps, where there are differences between the set of permissions an app requests and the set of permissions it actually uses. These gaps introduced bad consequences on security and privacy of these Android apps. For example, malware can take advantage of the permission differences to achieve their malicious goals [10]. Currently, most of the existing studies on permission-related issues have been conducted from the perspective of app users. For example, some approaches [13; 14; 15] point out security issues due to improper usage of permissions among apps and attempt to detect malware. Others [16; 17] take a step further to develop tools or modify the operating system so that users can configure their own permission settings. These approaches try to inform app users of potential security and privacy vulnerabilities on permission-related issues and provide them with methods to avoid such problems. However, most of the existing works somehow neglect the other end of the mobile app ecosystem, i.e., _the app developers_. We believe that app developers can play an essential role in exploring and fixing these issues. Different from app users, who view permission-related issues as an alert of potential security hazards, app developers view these issues as mistakes they commit during the development phase. As a result, these mistakes can prevent their apps from gaining popularity because they fail to function correctly or inadvertently being classified as malware. On the other hand, according to existing studies [8], developers commit those mistakes for both intrinsic reasons (i.e., carelessness) and extrinsic reasons (i.e., incomplete Android API documents). This gives us opportunities to tackle the issues during the development phase, which will help developers avoid these mistakes. Solving these issues in advance will not only benefit the developers, but also benefit app users as the apps they use will be free of permission-related issues. In general, this will benefit the whole app ecosystem. This paper investigates permission-related issues from a developer's perspective. In particular, we propose to integrate automated detection and fixing of permission-related issues in an Integrated Development Environment (IDE)to help developers make better decisions on permission use during app development. In order to achieve this goal, we first give a summary of permission-related issues from the developer's perspective. We find that apart from some widely-recognized issues (i.e., permission overprivilege (an app declares more permission than actually used)), several other issues cannot be ignored among Android apps. For example, permission underprivilege also happens to many apps, which means that they actually use more permissions than they requested. We also find that there are permission-related bugs that might cause the app to crash or function incorrectly.