PrivSense: Static Analysis for Detecting Privacy-Related Code in Mobile Apps

Abstract

Android application data leakage remains pervasive, despite advancements in leakage detection and user protections. Previous research includes tools that are computa tionally expensive or that did not distinguish between the types of data that were leaked. For example, a user’s age was considered as privacy-sensitive as their pass words. This thesis introduces PrivSense, a light-weight tool designed to detect privacy related code. PrivSense uses Natural Language Processing techniques to capture the semantic meanings of variables, classes, methods, etc., and determines the private data an app is likely to collect. Further, PrivSense correlates the sensitivity of private information with consumers’ attitudes toward data sensitivity. We analyzed 925 apps across 35 categories, and found apps superfluously collect private consumer data ranging from a social security number and banking information, to medication, fingerprints, and physical location. Some apps are wrongly categorized by the Google Play Store which could cause consumer confusion. False positive and false negative rates of PrivSense are analyzed and presented.