# PerHelper: Helping Developers Make Better Decisions on Permission Uses in Android Apps
## 2 Background and Related Work
### Android Permission from Developers' Perspective  
According to the analysis above, we argue that it is more efficient and practical to solve permission-related issues from the perspective of app developers. What concerns a developer most is whether the app he/she develops functions well and meets the requirement of the targeted users. However, this does not necessarily mean that developers have no motivation to solve permission-related issues in their apps. Actually, some permission-related issues will cause the app to behave in an undesirable way (i.e., app crash or security breach). These are detrimental to the popularity of the app. Thus, any permission-related issues that may influence the functionality and robustness of an app are also important concerns for developers.  
Generally, fixing permission-related issues at the development phase will have the following advantages:  
* To analyze released apps, one has to decompile the app to bytecode to perform further analysis. However, at the development phase, the analysis can be conducted on source code directly, which potentially has more information than bytecode. At least, source code at the development phase will not be obfuscated, which has become a common obstacle in analyzing Android bytecode.
* Compared to app users, app developers have a much better knowledge of the functionalities and behaviors of the apps they are developing. App developers without malicious intentions will not purposely write codes that behave maliciously or contain security vulnerabilities. With the help of an automated tool, the developers can express their intentions correctly in the code snippets. It is also true that some permission control tools are also efficient enough to assist app users. However, users know little about Android permission specifications. Therefore, it is possible that users unjustly regard a normal permission usage as inappropriate. Developers, on the other hand, have better understanding of the Android permission model and are less prone to making such mistakes.
* It is always better to solve a problem at the earliest stage, instead of postponing it to later. If all permission-related issues are solved at the development phase, all users will enjoy the functionality of the app without any concerns about permission uses. Otherwise, every user of the app will have to experience the bad effect of those issues.  
There are already several studies that explored research questions relevant to mobile app developers. For example, [PERSON] et al. [20] explored how app developers make decisions about privacy and security. They examined whether any privacy and security behaviors were related to the characteristics of the app development companies. They interviewed 19 and surveyed 228 developers about their privacy and security behaviors. Their findings suggested that smaller companies are less likely to demonstrate positive privacy and security behaviors. Besides, developers are not aware of the data collected by third-party libraries. [PERSON] et al. [41; 42; 43] analyzed the privacy behaviors of app developers and found that more than 70% of apps with severe privacy risks are created by 1% of developers.  
The work of [PERSON] et al. [44] and [PERSON] et al. [6] were the closest to us. They both developed plugins for the Eclipse IDE to guide developers on the set of required permissions when creating Android applications. In particular, they detected if permission overprivilege existed in the app and recommended appropriate permission settings. In comparison, our work not only deals with permission gaps, but also detects _permission-related bugs_ in apps. Our paper is the first work to check the permission underprivilege and unprotected API issues in the form of an IDE plugin, and we separate the permissions used in third-party libraries during analysis. Secondly, we not only design an efficient tool for developers, but also present a comprehensive study on permission-related issues from the developer's perspective.