@conference {100,
	title = {Unintentional bugs to vulnerability mapping in Android applications},
	booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on},
	year = {2015},
	month = {May},
	abstract = {<p>The intention of an Android application, determined by the source code analysis is used to identify potential maliciousness in that application (app). Similarly, it is possible to analyze the unintentional behaviors of an app to identify and reduce the window of vulnerabilities. Unintentional behaviors of an app can be any developmental loopholes such as software bugs overlooked by a developer or introduced by an adversary intentionally. FindBugsTM and Android Lint are a couple of tools that can detect such bugs easily. A software bug can cause many security vulnerabilities (known or unknown) and vice-versa, thus, creating a many-to-many mapping. In our approach, we construct a matrix of mapping between the bugs and the potential vulnerabilities. A software bug detection tool is used to identify a list of bugs and create an empirical list of the vulnerabilities in an app. The many-to-many mapping matrix is obtained by two approaches - severity mapping and probability mapping. These mappings can be used as tools to measure the unknown vulnerabilities and their strength. We believe our study is the first of its kind and it can enhance the security of Android apps in their development phase itself. Also, the reverse mapping matrix (vulnerabilities to bugs) could be used to improve the accuracy of malware detection in Android apps.</p>
},
	keywords = {Android (operating system), Android applications, Android Lint, Androids, bugs, Computer bugs, Conferences, development phase, developmental loopholes, FindBugsTM, Humanoid robots, Indexes, invasive software, malware detection, many-to-many mapping matrix, mapping, matrix algebra, probability, probability mapping, program debugging, reverse mapping matrix, Security, security vulnerabilities, severity mapping, Software, software bug detection tool, software bugs, software tools, source code (software), source code analysis, unintentional behavior analysis, unintentional bugs, vulnerability, vulnerability mapping},
	doi = {10.1109/ISI.2015.7165966},
	author = {Bajwa, Garima and Fazeen, Mohamed and Ram Dantu and Tanpure, Sonal}
}
@conference {67,
	title = {Another free app: Does it have the right intentions?},
	booktitle = {Privacy, Security and Trust (PST), 2014 Twelfth Annual International Conference on},
	year = {2014},
	month = {July},
	abstract = {<p>Security and privacy holds a great importance in mobile devices due to the escalated use of smart phone applications (app). This has made the user even more vulnerable to malicious attacks than ever before. We aim to address this problem by proposing a novel framework to identify potential Android malware apps by extracting the intention and their permission requests. First, we constructed a dataset consisting of 1,730 benign apps along with 273 malware samples. Then, both datasets were subjected to source code extraction. From there on, we followed a two phase approach to identify potential malware samples. In phase 1, we constructed a machine learning model to group benign apps into different clusters based on their operations known as the task-intention. Once we trained the model, it was used to identify the task-intention of an Android app. Further, in this phase, we only used the benign apps to construct the task-intentions and none of the malware signatures were involved. Therefore, our approach does not use machine learning models to identify malware apps. Then, for each task-intention group, we extracted the permission-requests of the apps and constructed the probability mass functions (PMF). We named the shape of this PMF as Intention-Shape or I-Shape. In phase 2, we used the permission-requests, task-intentions and I-Shapes to identify potential malware apps. We compared the permission-requests of an unknown app with its corresponding I-Shape to identify the potential malware apps. Using this approach, we obtained an accuracy of 89\% in detecting potential malware samples. The novelty of our work is to perform potential malware identification without training any models with malware signatures, and utilization of I-Shapes to identify such potential malware samples. Our approach can be utilized to identify the safety of an app before it is installed as it performs static code analysis. Further, it can be utilized in pre-screening or multi-layer security sys- ems. It is also highly useful in screening malware apps when launching in Android markets.</p>
},
	keywords = {Android app task-intention identification, Android malware apps, Androids, benign apps, clusters, Feature extraction, Humanoid robots, I-Shape, intention-shape, invasive software, learning (artificial intelligence), machine learning model, malicious attacks, Malware, Mathematical model, mobile computing, permission-requests, PMF, probability mass functions, Shape, smart phone applications, smart phones, source code (software), source code extraction, static code analysis, Unsupervised learning},
	doi = {10.1109/PST.2014.6890950},
	author = {Fazeen, Mohamed and Ram Dantu}
}
