The Android platform facilitates reuse of app functionalities by allowing an app to request an action from another app through inter-process communication mechanism. This feature is one of the reasons for the popularity of Android, but it also poses security risks to the end users because malicious, unprivileged apps could exploit this feature to make privileged apps perform privileged actions on behalf of them. In this paper, we investigate the hybrid use of program analysis, genetic algorithm based test generation, natural language processing, machine learning techniques for precise detection of permission re-delegation vulnerabilities in Android apps. Our approach first groups a large set of benign and non-vulnerable apps into different clusters, based on their similarities in terms of functional descriptions. It then generates permission re-delegation model for each cluster, which characterizes common permission re-delegation behaviors of the apps in the cluster. Given an app under test, our approach checks whether it has permission re-delegation behaviors that deviate from the model of the cluster it belongs to. If that is the case, it generates test cases to detect the vulnerabilities. We evaluated the vulnerability detection capability of our approach based on 1,258 official apps and 20 mutated apps. Our approach achieved 81.8% recall and 100% precision. We also compared our approach with two static analysis-based approaches — Covert and IccTA — based on 595 open source apps. Our approach detected 30 vulnerable apps whereas Covert detected one of them and IccTA did not detect any. Executable proof-of-concept attacks generated by our approach were reported to the corresponding app developers.

中文翻译：

---

Android应用权限重委派漏洞安全分析

Android 平台允许应用程序通过进程间通信机制从另一个应用程序请求操作，从而促进应用程序功能的重用。此功能是 Android 流行的原因之一，但它也给最终用户带来了安全风险，因为恶意的非特权应用程序可以利用此功能使特权应用程序代表他们执行特权操作。在本文中，我们研究了程序分析、基于遗传算法的测试生成、自然语言处理、机器学习技术的混合使用，以精确检测 Android 应用程序中的权限重新委派漏洞。我们的方法首先根据它们在功能描述方面的相似性，将大量良性和非易受攻击的应用程序分组到不同的集群中。然后为每个集群生成权限重新委托模型，该模型表征集群中应用程序的常见权限重新委托行为。给定一个正在测试的应用程序，我们的方法会检查它是否具有偏离其所属集群模型的权限重新委派行为。如果是这种情况，它会生成测试用例来检测漏洞。我们基于 1,258 个官方应用程序和 20 个变异应用程序评估了我们方法的漏洞检测能力。我们的方法实现了 81.8% 的召回率和 100% 的准确率。我们还将我们的方法与两种基于静态分析的方法 - Covert 和 IccTA - 基于 595 个开源应用程序进行了比较。我们的方法检测到 30 个易受攻击的应用程序，而 Covert 检测到其中一个，而 IccTA 没有检测到任何一个。