Checking App Behavior Against App Descriptions

Author(s): Alessandra Gorla, Ilaria Tavecchia, Florian Gross, Andreas Zeller
Venue: International Conference on Software Engineering
Date: 2014

Type of Experiement: Survey/Multi-Case Study
Sample Size: 32136
Class/Experience Level: Graduate Student
Participant Selection: Free apps downloaded from Google Play
Data Collection Method: Project Artifact(s)


Determining if an app works as advertised is a particular problem in the software engineering industry. Specifically, malicious mobile applications may access APIs not advertised in the application. For example, a puzzle game may secretly track a user's location. To combat this, the authors designed a system that uses NLP to look at the explicit stated features of the application and matches them against all the APIs the app consumes. The goal is to detect apps that use APIs that are inconsistent with the stated features, noting a potentially malicious application.
After running their system, 39% of the applications marked as potentially malicious were indeed malicious. The authors recommend that app distributers, specifically Google adopt a more strict app submission standards to avoid malicious applications. Also, the authors suggest that Google revamp its permission asking. Users may be confused as to the messages that the Android platform gives to users when a device asks for permission to access a certain item.