To ensure security and privacy, Android employs a permission mechanism which requires developers to explicitly declare the permissions needed by their applications (apps). Users must grant those permissions before they install apps or during runtime. This mechanism protects users’ private data, but also imposes additional requirements on developers. For permission declaration, developers need knowledge about what permissions are necessary to implement various features of their apps, which is difficult to acquire due to the incompleteness of Android documentation. To address this problem, we present a novel permission recommendation system named PerRec for Android apps. PerRec leverages mining-based techniques and data fusion methods to recommend permissions for given apps according to their used APIs and API descriptions. The recommendation scores of potential permissions are calculated by a composition of two techniques which are implemented as two components of PerRec: a collaborative filtering component which measures similarities between apps based on semantic similarities between APIs; and a content-based recommendation component which automatically constructs profiles for potential permissions from existing apps. The two components are combined in PerRec for better performance. We have evaluated PerRec on 730 apps collected from Google Play and F-Droid, a repository of free and open source Android apps. Experimental results show that our approach significantly improves the state-of-the-art approaches $$APRec^{CF_{correlation}}$$APRecCFcorrelation, $$APRec^{TEXT}$$APRecTEXT and Axplorer.

中文翻译：

---

自动、高度准确的应用权限推荐

为了确保安全和隐私，Android 采用了一种权限机制，要求开发者明确声明其应用程序（apps）所需的权限。用户必须在安装应用程序之前或在运行期间授予这些权限。这种机制保护了用户的隐私数据，但也对开发者提出了额外的要求。对于权限声明，开发人员需要了解实现其应用程序的各种功能所需的权限，由于 Android 文档的不完整，这很难获得。为了解决这个问题，我们为 Android 应用程序提出了一个名为 PerRec 的新颖权限推荐系统。PerRec 利用基于挖掘的技术和数据融合方法，根据给定应用程序使用的 API 和 API 描述推荐其权限。潜在权限的推荐分数由两种技术组合计算，这些技术作为 PerRec 的两个组件实现：协作过滤组件，基于 API 之间的语义相似性测量应用程序之间的相似性；以及一个基于内容的推荐组件，它自动为现有应用程序的潜在权限构建配置文件。这两个组件在 PerRec 中结合以获得更好的性能。我们对从 Google Play 和 F-Droid 收集的 730 个应用程序评估了 PerRec，F-Droid 是一个免费和开源 Android 应用程序的存储库。实验结果表明，我们的方法显着改进了最先进的方法 $$APRec^{CF_{correlation}}$$APRecCFcorrelation、$$APRec^{TEXT}$$APRecTEXT 和 Axplorer。