Privacy Analysis of Android Apps: Implicit Flows and Quantitative Analysis

Gianluca Barbon (1) , Agostino Cortesi (1) , Pietro Ferrara (2) , Marco Pistoia (2) , Omer Tripp (2)

1 University of Ca’ Foscari [Venice, Italy]
2 IBM Thomas J.Watson Research Center

A static analysis is presented, based on the theory of abstract interpretation, for verifying privacy policy compliance by mobile applications. This includes instances where, for example, the application releases the user’s location or device ID without authorization. It properly extends previous work on datacentric semantics for verification of privacy policy compliance by mobile applications by (i) tracking implicit information flow, and (ii) performing a quantitative analysis of information leakage. This yields to a novel combination of qualitative and quantitative analyses of information flows in mobile applications.

Domaines: Informatique [cs]

Gianluca Barbon, Agostino Cortesi, Pietro Ferrara, Marco Pistoia, Omer Tripp. Privacy Analysis of Android Apps: Implicit Flows and Quantitative Analysis. 14th Computer Information Systems and Industrial Management (CISIM), Sep 2015, Warsaw, Poland. pp.3-23, ⟨10.1007/978-3-319-24369-6_1⟩. ⟨hal-01444523⟩