ML-based Privacy Leakage Behavior Detection in Android Apps at Scale

In recent years, Android application privacy leaking issues frequently occur, with the results that privacy leakage detection becomes a critical role in app market security review, and numerous mobile apps have been removed from the app stores as a consequence. At the same time, manual review is still considered as a main method for market security audit, but it would cause low efficiency and high false positive when faced with thousands of auditing tasks. To overcome the above problems, this paper implements a large volume, automated detection of privacy leaks in Android applications via machine learning algorithms. In order to achieve a comprehensive and in-depth analysis of application behavior features, firstly, 2346 benign software from app market and 1912 malware identified by a national regulatory authority as leaking privacy in the past two years were selected and studied using a hybrid static-dynamic analysis. Then by developing novel sensitivity criteria, we opt privacy-sensitive key permissions and API calls that are highly relevant to privacy leakage behavior. Moreover, in order to improve the practicability of our system, this thesis systematically optimize the application exerciser on the Android emulator, and achieve average per-app analysis time with less than 2 minutes. Finally, the results of the comparison experiments reveal that the stacking ensemble learning algorithm displayed the best classification performance and achieved 97.81% in accuracy of privacy leakage behavior detection.