A methodology for empirical analysis of permission-based security models and its application to android

TLDR

Permission‑based security models grant controlled access to system resources, and the expressiveness of their permission sets determines the granularity of access control, making visualization of such systems valuable beyond Android. The study introduces a methodology that empirically analyzes permission‑based security models using the Self‑Organizing Map algorithm. The methodology employs the Self‑Organizing Map algorithm and is applied to 1,100 Android applications as a case study. The authors discuss ways to enhance Android’s permission model by increasing expressiveness without adding more permissions or complexity.

Abstract

Permission-based security models provide controlled access to various system resources. The expressiveness of the permission set plays an important role in providing the right level of granularity in access control. In this work, we present a methodology for the empirical analysis of permission-based security models which makes novel use of the Self-Organizing Map (SOM) algorithm of Kohonen (2001). While the proposed methodology may be applicable to a wide range of architectures, we analyze 1,100 Android applications as a case study. Our methodology is of independent interest for visualization of permission-based systems beyond our present Android-specific empirical analysis. We offer some discussion identifying potential points of improvement for the Android permission model attempting to increase expressiveness where needed without increasing the total number of permissions or overall complexity.