Mining apps for anomalies

Abstract

When interacting with mobile apps, do users always get what they expect? We have mined thousands of Android apps for common features such as descriptions, APIs used, data flows, and (recently) user interfaces and callbacks. Associating these with each other allows us to detect outliers: Apps whose description does not fit their behavior; apps whose sensitive data flow is usual; and user interface elements whose text or icon suggests one action, but which actually are tied to other actions. Such anomalies not only reveal bugs, but actual security issues – and there is a huge treasure trove worth of data to be mined, abstracted, and analyzed.