| As mobile users depend on mobile devices and mobile apps more and more in their daily life,mobile app related privacy and security are considered as extremely important.The Android system uses a security mechanism based on permissions to restrict apps to access sensitive device resources.An Android app statically declares the permissions that it requests in a manifest file(Android Manifest.xml),and the Android system prompts app users for consent during the app installation(for Android API level 22 or lower)or execution(for Android API level 23).The users need to accept these permissions when they install(for Android API level 22 or lower)or run(for Android API level 23)the app.However,because of some disadvantages,such as coarse-granularity of permissions and insufficient permission documentation,existing permission management system is not convenient and effective for the users to use.In addition,only 3% users pay attention to the requested permissions,since they tend to rush through the prompted permission request to get to use the apps.Even though users realize the importance of permission setting,they still cannot make a proper decision on permission configuration due to lack of permission related professional knowledge.In this paper,we propose PermitRec,a permission configuration recommender system based on trust management which aims to help users on permission setting to protect user privacy and device security.The PermitRec recommender system can automatically generate recommendations on permission configuration for a mobile app based on the setting risk evaluated by considering the app reputation generated according to user trust behaviors,the security configurations of similar apps installed and used by the user,app similarity,and the user trust in similar apps,as well as the risk level of app permissions.It is developed based on a reputation system Tru Be Repec to get the trust and reputation value of an app for the recommendation of permission settings.To the best of our knowledge,PermitRec is the first recommender system based on trust management to recommend users on permission settings.It can provide personalized permission setting recommendations based on the user trust in apps.We present the design and implementation of PermitRec recommender system in this thesis and further evaluate its accuracy,usability,and effectiveness.The Android system provides default permission settings in case users do not set on permissions.The LBE Security Master can also provide permission recommendations without rooting the mobile device.We compare the permission recommendation performance of PermitRec,Android default permission settings and LBE Security Master recommender system to evaluate the accuracy of PermitRec recommender system.Then we check PermitRec’s recommendation time,CPU utilization,electricity consumption,and runtime memory consumption in order to evaluate the effectivenessof PermitRec.Finally we conduct a small scale user study to collect user feedback and evaluate the user acceptance of PermitRec.The performance evaluationresults show that the PermitRec recommender system can provide accuratepermission recommendations with good effectiveness to prevent potential security threats and its current version gains positive user acceptance. |
