Mining Specification of Insecure Browser Extension Behavior

In this paper, a method about how to identify insecure behaviors of browser extensions is proposed. Typically, the identification of insecure extension behaviors is based on knowledge which is got by investigating known malicious or vulnerable extensions. We present an automatic technique that can ease the laborious manual investigating process. Our technique mines the difference between the behavior graphs of insecure and secure extensions based on graph mining algorithm. The difference between them is the specification of insecure extension behaviors which can be further analyzed manually or automatically to help people make a better decision about whether an extension is secure or not. We developed a prototype and the experimental results show that this kind of technique can effectively extract insecure extension behaviors.