With the unprecedented convenience brought by Apps on mobile devices, we are facing severe security attacks and privacy leakage caused by them since they may stealthily access unclaimed or unneeded permissions for some purposes. Many works strive to discover these malicious apps using program analysis techniques, however, they fail to tell users why an app needs to request the permission from users’ perspective. In this paper, we leverage the power of the crowdsourced user reviews to understand why an app requests a permission. We propose a framework, called SmartPI, that automatically identifies functionality-relevant user reviews and infers the permission implication of them, bridging the gap between the functionalities and the actual behaviors of an app. In particular, we extract features from the platform documents to identify functionality-relevant user reviews from noisy crowdsourced user reviews with Natural Language Processing (NLP) techniques. The topic model is further adopted to infer the permission implications of apps from the functionality-relevant user reviews. More than 20,000 apps, 2,653,159 users, and 4,247,769 user reviews are crawled from Google Play as a real-world dataset to evaluate the performance of SmartPI. The experiments results show that the permission usage of apps can be better reflected by user reviews than the claimed descriptions of apps.

中文翻译：

---

SmartPI：从用户评论中了解 Android 应用的权限影响

借助移动设备上的应用程序带来的前所未有的便利，我们正面临着由它们造成的严重安全攻击和隐私泄露，因为它们可能会出于某些目的秘密访问无人认领或不需要的权限。许多作品试图通过程序分析技术来发现这些恶意应用程序，但它们未能从用户的角度告诉用户为什么应用程序需要请求权限。在本文中，我们利用众包用户评论的力量来理解应用程序请求许可的原因。我们提出了一个名为 SmartPI 的框架，它可以自动识别与功能相关的用户评论并推断它们的权限含义，从而弥合应用程序的功能和实际行为之间的差距。特别是，我们从平台文档中提取特征，以使用自然语言处理 (NLP) 技术从嘈杂的众包用户评论中识别与功能相关的用户评论。进一步采用主题模型从与功能相关的用户评论中推断应用程序的权限含义。从 Google Play 中抓取了超过 20,000 个应用程序、2,653,159 个用户和 4,247,769 条用户评论，作为真实世界的数据集来评估 SmartPI 的性能。实验结果表明，与应用声称的描述相比，用户评论可以更好地反映应用的权限使用情况。从 Google Play 中抓取了 000 个应用程序、2,653,159 个用户和 4,247,769 条用户评论作为真实世界的数据集来评估 SmartPI 的性能。实验结果表明，与应用声称的描述相比，用户评论可以更好地反映应用的权限使用情况。从 Google Play 中抓取了 000 个应用程序、2,653,159 个用户和 4,247,769 条用户评论作为真实世界的数据集来评估 SmartPI 的性能。实验结果表明，与应用声称的描述相比，用户评论可以更好地反映应用的权限使用情况。