Functionality-Based Mobile Application Recommendation System with Security and Privacy Awareness

Abstract

Nowadays, with the advent of mobile devices, there are a variety of mobile applications to execute daily tasks, such as paying bills, watching movies and ordering food. That popularity caught the attention of malicious developers that started creating malicious applications for mobile devices instead of desktop computers. Some malicious applications claim that they can perform a certain common task, such as paying bills, just to lure users to install the application to damage their devices and/or execute malicious activities such as sending premium SMS messages or leaking users personal sensitive information. Because of that, users need a way to choose an app that is considered safe and meets their needs. For instance, if a user wants to change the application that he uses to order food, the list of suggestions must have only applications classified as benign that are capable of ordering food. Recommendation systems are currently being used to choose applications inside the Android environment, but most approaches do not evaluate security and privacy, and when they do, only the applications permissions configuration are considered. However, recent studies demonstrate that this approach is not enough. In addition, some approaches rely on user’s knowledge about the permissions, which studies have also shown that is error prone because most of users do not understand how the permissions system work. In this context, this work presents a novel functionality-based recommendation system with security and privacy awareness to evaluate and suggest apps. The system consists of a machine learning security layer that evaluates the applications to make sure that only apps classified as benign can be suggested. The proposed system also has an application scoring system that is based on functionality to ensure that only the applications with similar purposes can be suggested. In addition, users will be able to see popularity, usability and privacy metrics and add weights so that suggestions are made according to the user's preferences. Furthermore, a mapping between the permissions, application method calls, and descriptions is made to create phrases so that users can understand what the application being evaluated can do on the mobile device. The goal is to provide comprehensible information so users will be able to check if the application is executing any suspicious behavior and/or if it is requesting too much permissions. A prototype was developed and compared with works from the literature and the experiments demonstrated that the system had better results because it was able to suggest only applications classified as benign that have similar behaviors. The prototype was also compared with the official Google Play Store in order to verify if the list of suggestion has only apps with similar goals. The results demonstrate that, in terms of functionality, the prototype suggestion list had only apps that share similar goals and that Google Play categories needs to be better defined. The main contributions are the recommendation system with the advent of a security layer, the app scoring system inside a functionality context and the mapping between permissions and API calls raising user confidence and understanding.