RTPDroid: Detecting Implicitly Malicious Behaviors Under Runtime Permission Model

In Android 6.0 and above, Install-time Permission Model is replaced with Runtime Permission Model (RPM) where permission requesting is performed at runtime, rather than at install-time, to protect users' privacy. RPM brings certain benefits to security, but still has drawbacks that are exploitable by malware. The permission could be attained under a reasonable context and then be freely used under another context for executing malicious behavior without notifying users. In addition, RPM may cause bugs when developers forget to add permission checking before using the permission. Motivated by these problems, we propose RTPDroid, an approach to the detection of implicitly malicious behaviors and bugs brought by RPM. In this approach, these implicitly malicious behaviors and bugs are defined formally. Then, notions of user-aware contexts as well as user-aware call graphs are utilized for the detection. Experiments on 221 real-world apps reveal 131 bugs and 174 implicitly malicious behaviors under RPM.