Android app permissions and IVT risk
Android apps must declare the permissions they need. Some permissions are more common in apps with high invalid traffic (IVT). Pixalate scores each permission an Android app requests for how likely it is to be used to generate IVT, and combines those scores into an overall IVT permission risk for the app.
You see the result in the Media Ratings Terminal (MRT) on a Google Play app’s Insight page, in the App Permission Risk section and in Pixalate Advisories. In the Enrichment API, it’s the appPermissions widget and riskOverview.overallIvtPermissionRisk.
What app permissions are
An app permission controls an app’s access to a system or device function through the operating system. Permissions often have privacy implications, such as access to precise location. They protect:
- restricted data, such as system state and a user’s contact information
- restricted actions, such as connecting to a paired device or recording audio
An Android app that needs sensitive data or functions must list the permissions it needs in its manifest file. Google classifies each permission by protection level and privacy risk. See Android’s permissions overview and list of permissions.
Developers can also define custom permissions that aren’t in Google’s list. Pixalate’s assessment doesn’t cover them.
Typical and atypical permissions
Apps need some permissions to work. A navigation app needs precise location to give directions; a drawing app doesn’t.
So permissions can be typical or atypical for an app, depending on whether the app needs them for what it’s meant to do. The app’s category is a good proxy: the most common permissions are usually present in every app in the category.
Atypical permissions give an app more access than it needs, which makes them an avenue for generating IVT or other malicious activity.
How Pixalate assesses permissions
Pixalate looks for permissions that correlate with higher IVT than the average for the app’s category.
For example, among navigation apps, a location permission doesn’t make higher-than-usual IVT more likely, because every navigation app uses it. Among games, the same permission may be associated with higher IVT, so it can be flagged as high risk there.
This lets Pixalate ask of each app:
- Does the app need this permission to function?
- Does this permission indicate behavior that increases IVT?
- Overall, does the app request many unnecessary permissions?
The assessment measures correlation, not causation. A high-risk permission makes it more likely that the app generates high IVT. It doesn’t mean that permission causes the IVT by itself: IVT can be generated in more complex ways, such as by combining several permissions.
Methodology
Phase 1: score each permission within a category
- Classify every app as high or low risk based on its IVT levels.
- Calculate the share of high-risk apps in each category.
- Calculate how many high-risk apps in the category have a given permission.
- Compare how often apps with that permission are high risk with how often apps in the whole category are high risk.
- If the share for the permission is higher than the share for the whole category, give the permission a risk score for that category, in proportion to the ratio between the two.
Phase 2: score each app
An app can request several risky permissions, so Pixalate calculates an overall IVT permission score for the app:
- Count how many high- and medium-risk permissions apps in the category normally have, and how many the app has.
- Compare the app’s ratio with the category’s, and rate the app high, medium or low depending on the size of the difference.
Caveats
- If a category has fewer than 10 apps, Pixalate uses the permission’s high-risk app ratio across all categories instead.
- Pixalate also rates each permission high, medium or low overall, compared with other permissions.
- A permission that appears in fewer than 10 apps isn’t scored, and defaults to low.
- Some permissions are always flagged as high IVT risk, based on historical IVT data. They’re listed below.
Permissions flagged as high IVT risk by default
The protection level is Google’s classification of the permission. Protection levels can change between Android versions, so check Android’s list of permissions for the current level.
Related
Questions? Email support@pixalate.com.