Efficient Fingerprinting-Based Android Device Identification With Zero-Permission Identifiers

Mobile device identification techniques can be applied to secure authentication, and will be of particular importance for the security of mobile networks, such as avoiding spoofing attacks. For Android devices, explicit identifiers, e.g., Android ID, are used to uniquely identify a device. However, permissions are required to gain such identifiers, and this could cause the permission abuse and the leakage of user privacy. To address these issues, we use the combination of implicit identifiers that cannot identify a device individually. We first investigate 38 implicit identifiers that are acquired without requesting any permission. Then, a feature selection algorithm is used to choose effective identifiers as the device fingerprint, and three algorithms are designed to identify the devices. Finally, we conduct experimental evaluations on 50 830 fingerprints from 2239 different Android devices. The empirical results demonstrate the effectiveness and efficiency of our algorithms.