An apparatus for monitoring access to resources of the apparatus comprising: a display; a memory for storing instructions; and one or more processors configured to execute the stored instructions to: grant, to an application, an access permission for a resource of the apparatus during a runtime of the application after installation of the application at the apparatus; identify an access attempt by the application for the resource, the identification occurring after the access permission for the resource of the apparatus is granted to the application during the runtime of the application after installation of the application at the apparatus; based on the access permission granted to the application, determine that the access attempt is related to a suspicious activity by evaluating the access attempt from the application accessing the resource of the apparatus; and based on determining that the access attempt is related to the suspicious activity, display, on the display, a graphical user interface, GUI, including a notification of the access attempt related to the suspicious activity, based on a user input, perform at least one of permitting the application to access the resource or blocking the application from accessing the resource. a display; a memory for storing instructions; and one or more processors configured to execute the stored instructions to: grant, to an application, an access permission for a resource of the apparatus during a runtime of the application after installation of the application at the apparatus; identify an access attempt by the application for the resource, the identification occurring after the access permission for the resource of the apparatus is granted to the application during the runtime of the application after installation of the application at the apparatus; based on the access permission granted to the application, determine that the access attempt is related to a suspicious activity by evaluating the access attempt from the application accessing the resource of the apparatus; and based on determining that the access attempt is related to the suspicious activity, display, on the display, a graphical user interface, GUI, including a notification of the access attempt related to the suspicious activity, based on a user input, perform at least one of permitting the application to access the resource or blocking the application from accessing the resource. identify an access attempt by the application for the resource, the identification occurring after the access permission for the resource of the apparatus is granted to the application during the runtime of the application after installation of the application at the apparatus; based on the access permission granted to the application, determine that the access attempt is related to a suspicious activity by evaluating the access attempt from the application accessing the resource of the apparatus; and based on determining that the access attempt is related to the suspicious activity, display, on the display, a graphical user interface, GUI, including a notification of the access attempt related to the suspicious activity, based on a user input, perform at least one of permitting the application to access the resource or blocking the application from accessing the resource.