AppScalpel: Combining static analysis and outlier detection to identify and prune undesirable usage of sensitive data in Android applications.

Today’s Android users face a security dilemma: they want to grant permissions to apps for enjoying more abundant functionalities, but also worry that the apps may abuse these permissions to leak their private information without their grants. To optimize users’ benefits, we implement a novel privacy-preserving system named AppScalpel to prune undesirable usage of sensitive data in Android applications, on the top of static analysis and outlier detection results. We use static analysis to extract sufficient contextual features of data usage behaviors within applications. To precisely identify undesirable usage of sensitive data, we leverage outlier detection, which solves the problem of lacking labeled behavioral samples. To enforce the privacy-preserving rules within apps, AppScalpel instruments rule enforcers on each undesirable data-flow path respectively by the code instrumentation technique. We aim to block undesirable usage of sensitive data without affecting other user-desired functionalities. Our evaluation demonstrates that AppScalpel precisely identifies undesirable usage of sensitive data and effectively protects users’ private information in a fine-grained mode, and the robustness of the instrumented apps is also achieved. Moreover, for the instrumented apps, AppScalpel introduces little space and runtime overhead.