Automated testing and notification of mobile app privacy leak-cause behaviours

Abstract

I describe the design, implementation and evaluation of a novel hybrid static/dynamic analysis system for automatically uncovering and testing for the user-triggered causes and paths of privacy leaks in Android applications (privacy 'leak-causes'). I describe how I plan to further evaluate and demonstrate improvements in accuracy, coverage and testing speed of my hybrid testing approach against other currently available systems. I also show how user privacy is improved by the presentation of information on leak-causes in a field study as privacy notices. I present plans to investigate which of the commonly utilized mobile notification mechanisms is best suited to the presentation of leak-causes, as well as how users may set better privacy control policies with the information provided.