Research On Privacy Protection Based On Resource Access Control For Android Platform

With the popularity of mobile smart devices and the continuous improvement of computing power,numerous applications(apps)are developed by using various resources(peripherals,sensors,network access and other system privileges)provided by smart devices.On the one hand,these apps can bring convenience and entertainment to users'daily lives in contexts with low privacy requirements,such as public cafes and homes.On the other hand,the abuse of these resources in smart devices by malicious apps will also bring potential privacy threats to users in application scenarios with high privacy requirements,such as confidential business conversations.Therefore,how to reasonably control the use of these resources according to different contexts has become a key issue to effectively protect user privacy in the pervasive environment.As the dominant operating system in the market share of mobile operating system,Android system has become the main target of attackers due to its openness.In order to limit the abuse of these resources in devices by malicious apps,the Android system provides a permission-based resource access control mechanism.Using permissions that are granted at the time of installation,apps can access sensbased itive data and resources on mobile devices.Although the permission-mechanism has played a significant role in protecting the user privacy and system security to some extent,there are still some shortcomings.To this end,this paper studies the privacy protection methods in Android platform from the point of view of the resource access control mechanism.The main contributions of this paper are shown as follows:1.The privacy of users will be greatly threatened after kinds of resources in smart devices are abused by applications.The Android system security framework restricts the access and usage of these resources by providing a permission-based resource usage mechanism.To a certain extent,it protects all kinds of resources in the device.However,users have different protection requirements f:or various resources in different contexts,which is not satisfied by the permission-based resource usage mechanism.To overcome these shortcomings,this paper proposes a context-aware resource usage control mechanism,which provides fine-grained resource protection for users by implementing policy-based dynamic access control for device resources.Users control the use of resources by configuring appropriate access policies for various resources in different contexts.Experiments show that the prototype system proposed in this paper can achieve all functions and has almost no effect on the performance of the Android system.2.As a fact that users do not have or only have little security-related expertise,it is very difficult for users to effectively identify potential malicious apps and configure the reasonable usage policies of'corresponding resources in a specific context to protect resources and user privacy.Therefore,this paper proposes MobiSentry,an Android application security analysis model based on the ensemble of machine learning algorithms.Compared with traditional malware detection methods based on static features,this paper novelly employs N-gram features based on application bytecode and proposes ensemble policies based on multiple machine learning methods to improve the detection accuracy.By using a large-scale of dataset obtained from the real world for parameter selection and model training,MobiSentry achieves a higher malware accuracy compared with previous work.The experimental results show that the proposed method can help users identify potential malicious apps under a low system load.3.Mobile smart devices integrate a wealth of sensors and peripherals to provide users with a variety of powerful services,such as recording,calling and intelligent voice assistants.However,microphones and speakers in smart devices can be easily accessed by various apps,and hidden acoustic communication(HAC)can be achieved by using approximate ultrasonic frequency bands(above 18KHz).This kind of side channel will cause serious leakage of user privacy in a specific context.In order to address this problem,this paper analyses the audio data processing mechanism in Android system and designs a prototype system UltraFilter,which filters the audio metadata received by the device in high frequency to protect the privacy of users without affecting their perception.In addition,in order to study user-senseless HAC in normal frequency band(below 18KHZ),this paper designs and develops a prototype system of HAC based on normal frequencies.Experiments show that the user-senseless HAC in normal frequencies also has potential threat to user's privacy.