TKPERM: Cross-platform Permission Knowledge Transfer to Detect Overprivileged Third-party Applications

Abstract

Background. Prior works have correlated third-party applications’ descriptions with their requested permissions and determine an application as overprivileged if a mismatch is found. However, whenever a new platform emerges (IFTTT, Smartthings, etc), we need tedious human work to label its applications in order to build a model. Moreover, it will require corresponding manual efforts in building and tuning models even if the data is labeled.

Aim. Our main objective is to propose and evaluate the idea of transfer learning for future IoT permission and privacy research. We then seek to understand the reason why certain transfer learning algorithm fails where others succeed.

Data. We manually labeled 36,193 sentences on Android, 4,705 on Chrome-extension, 666 on IFTTT, and 292 on SmartThings. We have publicly released our labeled dataset on https://drive.google.com/drive/folders/1Yfnz-ZpBpL8lftYIdM6JtH-QKE88NcSX?usp=sharing to facilitate open science.

Method. We propose a generic framework, called TKPERM, which transfers knowledge between permission-based platforms. We implemented a prototype of TKPERM that transfers permission knowledge from Android to three different platforms. We introduced a greedy selection algorithm to choose the knowledge that is best suited for the target permission, which outputs the state-of-the-art selection algorithm H-divergence.

Results. TKPERM achieves a 90.02% overall F1 score after transferring, which is 12.62% higher than the one of a model trained directly on the target domain without transfer. Particularly, TKPERM has 91.83% F1 score on IFTTT, 89.13% F1 score on ChromeExtension, and 89.1% F1 score on SmartThings.

Conclusions. Our methodology confirmed that these IoT platforms, though being different, are user-facing and share many common pieces of knowledge, such as permissions and semantics. Transfer learning has the capability of reducing human efforts on labeling while still achieves high accuracy scores with proper source domain selection algorithms. We think that TKPERM can be used and tailored for future research works.

Biographies of the Speakers

Faysal Hossain Shezan is a third-year Ph.D. student at the Computer Science department of the University of Virginia. His broad research interest is in Security & Privacy in IoT (Internet of Things). Currently, his research is more focused on solving various security and privacy issues on the IoT ecosystem using NLP (Natural Language Processing). He is working with Professor Yuan Tian at the Security lab at the University of Virginia. For the last couple of years, he has worked on several problems relevant to these areas, aiming at leveraging the efficiency of secure system implementation, which involves gaining in-depth knowledge in the security domain, detecting application vulnerabilities, designing compiler architecture and fending off the security threats. Before joining as a grad student, he worked as a software engineer (in security lab) at Kona Software Lab Ltd in Bangladesh. He has completed his bachelor’s degree from the Computer Science and Engineering department of Bangladesh University of Engineering and Technology in 2016.

Kaiming Cheng is a first year Master’s student as part of the Fifth Year Master’s program in the Department of Computer Science at the University of Virginia. He works with Professor Yuan Tian on various topics at the Security lab. His primary research objective is to improve how security problems are remedied in practice. He is interested in usable security, Internet of things, privacy and fairness, and human-computer interaction. He completed a bachelor’s degree in Computer Science and Music at the University of Virginia, where he graduated with high honors and high distinctions from both departments.

Zhen Zhang is a second-year Ph.D. student at Johns Hopkins University. He is good at applying/implementing Machine Learning algorithms and Deep Neural Networks models.

Yinzhi Cao is an Assistant Professor in Computer Science at the Johns Hopkins University. He earned his Ph.D. in Computer Science at Northwestern University, worked at Columbia University as a postdoc, and then spent three years at Lehigh University as an assistant professor. Before that, he obtained his B.E. degree in Electronics Engineering at Tsinghua University in China. His research mainly focuses on the security and privacy of the Web, smartphones, and machine learning. His past work was widely featured by over 30 media outlets, such as NSF Science Now (Episode 38), CCTV News, IEEE Spectrum, Yahoo! News and ScienceDaily. He received two best paper awards at SOSP’17 and IEEE CNS’15 respectively. He is a recipient of the Amazon ARA 2017 award.

Yuan Tian is an Assistant Professor of Computer Science at the University of Virginia. Before joining UVA, she obtained her Ph.D. from Carnegie Mellon University in 2017 and interned at Microsoft Research, Facebook, and Samsung Research. Her research interests involve security and privacy and its interactions with computer systems, machine learning, and human-computer interaction. Her current research focuses on developing new technologies for protecting user privacy, particularly in the areas of mobile systems and the Internet of Things. Her work has generated real-world impact as countermeasures and design changes have been integrated into platforms (such as Android, Chrome, SmartThings, Azure, and iOS), and also impacted the security recommendations of standard organizations such as Internet Engineering Task Force (IETF) and World Wide Web Consortium (W3C). She is a recipient of NSF CRII award 2019, Amazon AI Faculty Fellowship 2019, CSAW Security Paper Award 2019, Rising Stars in EECS 2016 and Black Hat Future Female Leaders in Cyber Security 2015. Her research has appeared in top-tier venues in Security and System. Her projects have been covered by media outlets such as IEEE Spectrum, Forbes, Fortune, Wired, and Telegraph.