a sequence of discrete - valued observations ( , is finite ) is generated according to some unknown probabilistic law ( measure ) .that is , is a probability measure on the space of one - way infinite sequences ( here is the usual borel -algebra ) . after each new outcome revealed , it is required to predict conditional _ probabilities _ of the next observation , , given the past . since a predictor is required to give conditional probabilities for all possible histories , it defines itself a probability measure on the space of one - way infinite sequences . in other words , a probability measure on can be considered both as a data - generating mechanism and as a predictor .  therefore , given a set of probability measures on , one can ask two kinds of questions about it . first , does there exist a predictor , whose forecast probabilities converge ( in a certain sense ) to the -conditional probabilities , if an arbitrary is chosen to generate the data ? herewe assume that the `` true '' measure that generates the data belongs to the set of interest , and would like to construct a predictor that predicts all measures in .the second type of questions is as follows : does there exist a predictor that predicts at least as well as any predictor , if the measure that generates the data comes possibly from outside of ?therefore , here we consider elements of as predictors , and we would like to combine their predictive properties , if this is possible . note that in this setting the two questions above concern the same object : a set of probability measures on .each of these two questions , the realizable and non - realizable one , have enjoyed much attention in the literature ; the setting for the non - realizable case is usually slightly different , which is probably why it has not ( to the best of the author s knowledge ) been studied as another facet of the realizable case .the realizable case traces back to laplace , who has considered the problem of predicting outcomes of a series of independent tosses of a biased coin .that is , he has considered the case when the set is that of all i.i.d . process measures .other classical examples studied are the set of all computable ( or semi - computable ) measures , the set of -order markov and finite - memory processes ( e.g. ) and the set of all stationary processes . the general question of finding predictors for an arbitrary given set of process measures has been addressed in ; the latter work shows that when a solution exists it can be obtained as a bayes mixture over a countable subset of  .the non - realizable case is usually studied in a slightly different , non - probabilistic , setting .we refer to for a comprehensive overview .it is usually assumed that the observed sequence of outcomes is an arbitrary ( deterministic ) sequence ; it is required not to give conditional probabilities , but just deterministic guesses ( although these guesses can be selected using randomisation ) .predictions result in a certain loss , which is required to be small as compared to the loss of a given set of reference predictors ( experts ) .the losses of the experts and the predictor are observed after each round . in this approach , it is mostly assumed that the set is finite or countable .the main difference with the formulation considered in this work is that we require a predictor to give probabilities , and thus the loss is with respect to something never observed ( probabilities , not outcomes ) .the loss itself is not completely observable in our setting . in this senseour non - realizable version of the problem is more difficult . assuming that the data generating mechanism is probabilistic , even if it is completely unknown , makes sense in such problems as , for example , game playing , or market analysis . in these casesone may wish to assign smaller loss to those models or experts who give probabilities closer to the correct ones ( which are never observed ) , even though different probability forecasts can often result in the same action .aiming at predicting probabilities of outcomes also allows us to abstract from the actual use of the predictions ( e.g. making bets ) and thus from considering losses in a general form ; instead , we can concentrate on the form of losses ( measuring the discrepancy between the forecast and true probabilities ) which are more convenient for the analysis . in this latter respect ,the problems we consider are easier than those considered in prediction with expert advice .( however , in principle nothing restricts us to considering the simple losses that we chose ; they are just a convenient choice . )noteworthy , the probabilistic approach also makes the machinery of probability theory applicable , hopefully making the problem easier . in this workwe consider two measures of the quality of prediction .the first one is the total variation distance , which measures the difference between the forecast and the `` true '' conditional probabilities of all future events ( not just the probability of the next outcome ) .the second one is expected ( over the data ) average ( over time ) kullback - leibler divergence . requiring that predicted and true probabilitiesconverge in total variation is very strong ; in particular , this is possible if and only if the process measure generating the data is absolutely continuous with respect to the predictor .the latter fact makes the sequence prediction problem relatively easy to analyse .here we investigate what can be paralleled for the other measure of prediction quality ( average kl divergence ) , which is much weaker , and thus allows for solutions for the cases of much larger sets of process measures ( considered either as predictors or as data generating mechanisms ) .having introduced our measures of prediction quality , we can further break the non - realizable case into two problems .the first one is as follows . given a set of predictors , we want to find a predictor whose prediction error converges to zero if there is at least one predictor in whose prediction error converges to zero ; we call this problem simply the `` non - realisable '' case , or problem 2 ( leaving the name `` problem 1 '' to the realizable case ) .the second problem is the `` fully agnostic '' problem : it is to make the prediction error asymptotically as small as that of the best ( for the given process measure generating the data ) predictor in ( we call this problem 3 ) .thus , we now have three problems about a set of process measures to address .we show that if the quality of prediction is measured in total variation , then all the three problems coincide : any solution to any one of them is a solution to the other two . for the case of expected average kl divergence ,all the three problems are different : the realizable case is strictly easier than non - realizable ( problem 2 ) , which is , in turn , strictly easier than the fully agnostic case ( problem 3 ) .we then analyse which results concerning prediction in total variation can be transferred to which of the problems concerning prediction in average kl divergence . it was shown in that , for the realizable case , if there is a solution for a given set of process measures , then a solution can also be obtained as a bayesian mixture over a countable subset of ; this holds both for prediction in total variation and in expected average kl divergence .here we show that this result also holds true for the ( non - realizable ) case of problem 2 , for prediction in expected average kl divergence . for the fully agnostic case of problem 3 ,we show that separability with respect to a certain topology given by kl divergence is a sufficient ( though not a necessary ) condition for the existence of a predictor .this is used to demonstrate that there is a solution to this problem for the set of all finite - memory process measures , complementing similar results obtained earlier in different settings . on the other hand ,we show that there is no solution to this problem for the set of all stationary process measures , in contrast to a result of which gives a solution to the realizable case of this problem ( that is , a predictor whose expected average kl error goes to zero if any stationary process is chosen to generate the data ) .let be a finite set .the notation is used for .we consider stochastic processes ( probability measures ) on where is the sigma - field generated by the cylinder sets  ] is the set of all infinite sequences that start with . fora finite set denote its cardinality .we use for expectation with respect to a measure .next we introduce the measures of the quality of prediction used in this paper . for two measures and we are interested in how different the - and -conditional probabilities are , given a data sample .introduce the _ ( conditional ) total variation _distance if and , and otherwise .we say that predicts in total variation if   this convergence is rather strong . in particular, it means that -conditional probabilities of arbitrary far - off events converge to -conditional probabilities .moreover , predicts in total variation if and only if  is absolutely continuous with respect to . denote the relation of absolute continuity ( that is , if is absolutely continuous with respect to ) .thus , for a class of measures there is a predictor that predicts every in total variation if and only if every has a density with respect to .although such sets of processes are rather large , they do not include even such basic examples as the set of all bernoulli i.i.d . processes .that is , there is no that would predict in total variation every bernoulli i.i.d .process measure ,  ] denote the set of equivalence classes of with respect to , and for denote  ] ( or ) are called disjoint ( or singular ) if there is no {tv} ] for  ] has a supremum . introducing into {tv} ], we can state that for every {tv} ] is at most countable .furthermore , we introduce the ( unconditional ) total variation distance between process measures .the ( unconditional ) total variation distance is defined as   known characterizations of those sets that are bounded with respect to can now be related to our prediction problems 1 - 3 as follows .[ th : tv ] let .the following statements about are equivalent .* there exists a solution to problem 1 in total variation .* there exists a solution to problem 2 in total variation .* there exists a solution to problem 3 in total variation .* is upper - bounded with respect to .* there exists a sequence , such that for some ( equivalently , for every ) sequence of weights  ] and the measures and are such that is absolutely continuous with respect to and is singular with respect to .let be such a set that and .note that we can take and .from we have -a.s . , as well as -a.s . and -a.smoreover , so that -a.s . furthermore , and we have -a.s . and hence -a.s . , as well as -a.s . and hence -a.sthus , , which concludes the proof .  * remark . *using lemma [ th:01 ] we can also define _ expected _( rather than almost sure ) total variation loss of with respect to , as the -probability that converges to 1 : then problem 3 can be reformulated for this notion of loss .however , it is easy to see that for this reformulation theorem [ th : tv ] holds true as well .thus , we can see that , for the case of prediction in total variation , all the sequence prediction problems formulated reduce to studying the relation of absolute continuity for process measures and those families of measures that are absolutely continuous ( have a density ) with respect to some measure ( a predictor ) .on the one hand , from a statistical point of view such families are rather large : the assumption that the probabilistic law in question has a density with respect to some ( nice ) measure is a standard one in statistics .it should also be mentioned that such families can easily be uncountable .( in particular , this means that they are large from a computational point of view . ) on the other hand , even such basic examples as the set of all bernoulli i.i.d .measures does not allow for a predictor that predicts every measure in total variation ( as explained in section [ s : pre ] ) .that is why we have to consider weaker notions of predictions ; from these , prediction in expected average kl divergence is perhaps one of the weakest .the goal of the next sections is to see which of the properties that we have for total variation can be transferred ( and in which sense ) to the case of expected average kl divergence .first of all , we have to observe that for prediction in kl divergence problems 1 , 2 , and 3 are different , as the following theorem shows .while the examples provided in the proof are artificial , there is a very important example illustrating the difference between problem 1 and problem 3 for expected average kl divergence : the set of all stationary processes , given in theorem [ th : st ] in the end of this section .[ th : comp ] for the case of prediction in expected average kl divergence , problems 1 , 2 and 3 are different : there exists a set for which there is a solution to problem 1 but there is no solution to problem 2 , and there is a set for which there is a solution to problem 2 but there is no solution to problem 3 .we have to provide two examples .fix the binary alphabet . for each deterministic sequence construct the process measure as follows : and for let , for all .that is , is bernoulli i.i.d .1/2 process measure strongly biased towards a specific deterministic sequence , .let also for all , ( the bernoulli i.i.d .1/2 ) . for the set we have a solution to problem 1 : indeed , .however , there is no solution to problem 2 .indeed , for each we have ( that is , for every deterministic measure there is an element of which predicts it ) , while by lemma [ th : disc ] for every there exists such that for all ( that is , there is no predictor which predicts every measure that is predicted by at least one element of ) .the second example is similar . for each deterministic sequence construct the process measure as follows : and for let , for all .it is easy to see that is a solution to problem 2 for the set . indeed ,if is such that then we must have . from this and the fact that and coincide ( up to ) on all other sequences we conclude .however , there is no solution to problem 3 for . indeed , for every we have .therefore , if is a solution to problem 3 then which contradicts lemma [ th : disc ] .thus , prediction in expected average kl divergence turns out to be a more complicated matter than prediction in total variation .the next idea is to try and see which of the facts about prediction in total variation can be generalized to some of the problems concerning prediction in expected average kl divergence .first , observe that , for the case of prediction in total variation , the equivalence of problems 1 and 2 was derived from the transitivity of the relation of absolute continuity . for the case of expected average kl divergence , the relation `` predicts in expected average kl divergence '' is not transitive ( and problems 1 and 2 are not equivalent ) .however , for problem 2 we are interested in the following relation : `` dominates '' if predicts every such that predicts .denote this relation by :  we write if for every the equality implies .the relation has some similarities with .first of all , is also transitive ( as can be easily seen from the definition ) . moreover , similarly to , one can show that for any any strictly convex combination is a supremum of with respect to  .next we will obtain a characterization of predictability with respect to similar to one of those obtained for .the key observation is the following .if there is a solution to problem 2 for a set then a solution can be obtained as a bayesian mixture over a countable subset of . for total variationthis is the statement of theorem [ th : tv ] .[ th:2 ] let be a set of probability measures on .if there is a measure such that for every ( is a solution to problem 2 ) then there is a sequence , , such that for every , where are some positive weights .the proof is deferred to appendix . an analogous result for problem 1 was established in .( the proof of theorem [ th:2 ] is based on similar ideas , but is more involved . )  for the case of problem 3 , we do not have results similar to theorem [ th:2 ] ( or statement of theorem [ th : tv ] ) ; in fact , we conjecture that the opposite is true : there exists a ( measurable ) set of measures such that there is a solution to problem 3 for , but there is no bayesian solution to problem 3 , meaning that there is no probability distribution on ( discrete or not ) such that the mixture over with respect to this distribution is a solution to problem 3 for .  however, we can take a different route and extend another part of theorem [ th : tv ] to obtain a characterization of sets for which a solution to problem 3 exists .we have seen that , in the case of prediction in total variation , separability with respect to the topology of this distance is a necessary and sufficient condition for the existence of a solution to problems 1 - 3 . in the case of expected average kl divergencethe situation is somewhat different , since , first of all , ( asymptotic average ) kl divergence is not a metric .while one can introduce a topology based on it , separability with respect to this topology turns out to be a sufficient but not a necessary condition for the existence of a predictor , as is shown in the next theorem .[ def : dinf ] define the distance on process measures as follows where we assume .clearly , is symmetric and satisfies the triangle inequality , but it is not exact . moreover , for every we have the distance measures the difference in behaviour of and on all individual sequences .thus , using this distance to analyse problem 3 is most close to the traditional approach to the non - realizable case , which is formulated in terms of predicting individual deterministic sequences .[ th : dinf ]  * let be a set of process measures .if is separable with respect to then there is a solution to problem 3 for , for the case of prediction in expected average kl divergence .* there exists a set of process measures such that is not separable with respect to , but there is a solution to problem 3 for this set , for the case of prediction in expected average kl divergence .  for the first statement , let be separable and let be a dense countable subset of .define , where are any positive summable weights .fix any measure and any .we will show that .for every , find such a that .we have from this , dividing by taking on both sides , we conclude since this holds for every the first statement is proven .the second statement is proven by the following example .let be the set of all deterministic sequences ( measures concentrated on just one sequence ) such that the number of 0s in the first symbols is less than , for all . clearly , this set is uncountable .it is easy to check that implies for every , but the predictor , given by independently for different , predicts every in expected average kl divergence . since all elements of are deterministic , is also a solution to problem 3 for .although simple , theorem [ th : dinf ] can be used to establish the existence of a solution to problem 3 for an important class of process measures : that of all processes with finite memory , as the next theorem shows. results similar to theorem [ th : mark ] are known in different settings , e.g. , and others .[ th : mark ] there exists a solution to problem 3 for prediction in expected average kl divergence for the set of all finite - memory process measures .we will show that the set is separable with respect to .then the statement will follow from theorem [ th : dinf ] .it is enough to show that each set is separable with respect to .  for simplicity ,assume that the alphabet is binary ( ; the general case is analogous ) .observe that the family of -order stationary binary - valued markov processes is parametrized by  ] ) is dense in , proving the separability of the latter set .another important example is the set of all stationary process measures .this example also illustrates the difference between the prediction problems that we consider .for this set a solution to problem 1 was given in .in contrast , here we show that there is no solution to problem 3 for .[ th : st ] there is no solution to problem 3 for the set of all stationary processes .this proof is based on the construction similar to the one used in to demonstrate impossibility of consistent prediction of stationary processes without cesaro averaging .let be a markov chain with states and state transitions defined as follows . from each sate the chain passes to the state with probability 2/3 and to the state 0 with probability 1/3 .it is easy to see that this chain possesses a unique stationary distribution on the set of states ( see , e.g. , ) ; taken as the initial distribution it defines a stationary ergodic process with values in .fix the ternary alphabet . foreach sequence define the process as follows .it is a deterministic function of the chain . if the chain is in the state 0 then the process outputs ; if the chain is in the state then the process outputs .that is , we have defined a hidden markov process which in the state 0 of the underlying markov chain always outputs , while in other states it outputs either or according to the sequence  .  to show that there is no solution to problem 3 for , we will show that there is no solution to problem 3 for the smaller set .indeed , for any we have .then if is a solution to problem 3 for we should have for every , which contradicts lemma [ th : disc ] .  from the proof theorem [ th :st ] one can see that , in fact , the statement that is proven is stronger : there is no solution to problem 3 for the set of all functions of stationary ergodic countable - state markov chains .we conjecture that a solution to problem 2 exists for the latter set , but not for the set of all stationary processes .it has been long realized that the so - called probabilistic and agnostic ( adversarial , non - stochastic , deterministic ) settings of the problem of sequential prediction are strongly related .this has been most evident from looking at the solutions to these problems , which are usually based on the same ideas .here we have proposed a formulation of the agnostic problem as a non - realizable case of the probabilistic problem . while being very close to the traditional one, this setting allows us to directly compare the two problems . as a somewhat surprising result, we can see that whether the two problems are different depends on the measure of performance chosen : in the case of prediction in total variation distance they coincide , while in the case of prediction in expected average kl divergence they are different . in the latter case, the distinction becomes particularly apparent on the example of stationary processes : while a solution to the realizable problem has long been known , here we have shown that there is no solution to the agnostic version of this problem. the new formalization also allowed us to introduce another problem that lies in between the realizable and the fully agnostic problems : given a class of process measures , find a predictor that is predicts asymptotically optimal every measure for which at least one of the measures in is asymptotically optimal ( problem 2 ) .this problem is less restrictive then the fully agnostic one ( in particular , it is not concerned with the behaviour of a predictor on every deterministic sequence ) but at the same time the solutions to this problem have performance guarantees far outside the model class considered .  since the problem formulations presented here are mostly new ( at least , in such a general form ) , it is not surprising that there are many questions left open .a promising route to obtain new results seems to be to first analyse the case of prediction in total variation , which amounts to studying the relation of absolute continuity and singularity of probability measures , and then to try and find analogues in less restrictive ( and thus more interesting and difficult ) cases of predicting only the next observation , possibly with cesaro averaging .this is the approach that we took in this work .here it is interesting to find properties common to all or most of the prediction problems ( in total variation as well as with respect to other measures of the performance ) .a candidate is the `` countable bayes '' property of theorem [ th:2 ] : if there is a solution to a given sequence prediction problem for a set , then a solution can be obtained as a mixture over a suitable countable subset of .  another direction for future research concerns finite - time performance analysis . in this workwe have adopted the asymptotic approach to the prediction problem , ignoring the behaviour of predictors before asymptotic .while for prediction in total variation it is a natural choice , for other measures of performance , including average kl divergence , it is clear that problems 1 - 3 admit non - asymptotic formulations .it is also interesting what are the relations between performance guarantees that can be obtained in non - asymptotic formulations of problems 13 .define the weights , where is the normalizer . define the sets as the set of all measures such that predicts in expected average kl divergencelet .for each let be any ( fixed ) such that .in other words , is the set of all measures that are predicted by some of the measures in , and for each measure in we designate one `` parent '' measure from such that predicts ._ for each let be any monotonically increasing function such that and .define the sets  and we will upper - bound .first , using markov s inequality , we derive next , observe that for every and every set , using jensen s inequality we can obtain moreover , where in the inequality we have used ( [ eq : v ] ) for the first summand and ( [ eq : jen ] ) for the second .thus , from ( [ eq : t ] ) , ( [ eq : markk ] ) and ( [ eq : del ] ) we conclude   _ step 2n : a countable cover , time ._ fix an .define ( since are finite all suprema are reached ) .find any such that and let . for , let .if , let be any such that , and let ; otherwise let . observe that ( for each ) there is only a finite number of positive , since the set is finite ; let be the largest index such that .let as a result of this construction , for every every and every using the definitions ( [ eq : t ] ) , ( [ eq : u ] ) and ( [ eq : v ] ) we obtain   _ step 2 : the resulting predictor ._ finally , define where is the i.i.d .measure with equal probabilities of all ( that is , for every and every ) .we will show that predicts every , and then in the end of the proof ( step r ) we will show how to replace by a combination of a countable set of elements of ( in fact , is just a regularizer which ensures that -probability of any word is never too close to 0 ) ._ step 3 : predicts every . _fix any .introduce the parameters , , to be defined later , and let .observe that , for any and any , by definition of these sets .since the sets , are disjoint , we obtain .hence , for some , since otherwise so that , which is a contradiction . thus , we can upper - bound as follows .first , observe that then , from ( [ eq : t ] ) and ( [ eq : u ] ) we get from ( [ eq : jen ] ) and ( [ eq : tm ] ) we get furthermore , where the first inequality is obvious , in the second inequality we have used the fact that entropy is maximized when all events are equiprobable and in the third one we used . combining ( [ eq : mut ] ) with the bounds ( [ eq : e1 ] ) , ( [ eq : e2 ] ) and ( [ eq : e3 ] ) we obtain so that from the fact that and ( [ eq : mark ] ) it follows that the term in brackets is , so that we can define the parameters in such a way that while at the same time the bound ( [ eq : mu2 ] ) gives .fix such a choice of . then , using ( [ eq : mark ] ) , we conclude   we proceed with the proof of . for any we have where the first inequality follows from ( [ eq : nu ] ) , the second from ( [ eq : ext ] ) , and in the equality we have used and .next we use the decomposition from ( [ eq : i ] ) we find where in the second inequality we have used , and , in the last inequality we have again used the fact that the entropy is maximized when all events are equiprobable , while the last equality follows from ( [ eq : xt ] ) . moreover , from ( [ eq : nu ] ) we find where in the last inequality we have used and , and the last equality follows from ( [ eq : xt ] ) .   _ step r : the regularizer . it remains to show that the i.i.d .regularizer in the definition of  ( [ eq : nu ] ) , can be replaced by a convex combination of a countably many elements from .indeed , for each , denote and let for each the measure be any measure from such that .define for each , , and let . for every we have for every and every , which clearly suffices to establish the bound as in ( [ eq:2 ] ) .this work has been partially supported by the french ministry of higher education and research , nord - pas de calais regional council and feder through the `` contrat de projets etat region ( cper ) 2007 - 2013 '' , by the french national research agency ( anr ) , project explo - ra anr-08-cosi-004 , and by pascal2 .

Abstract: a sequence of discrete - valued observations is generated according to some unknown probabilistic law ( measure ) . after observing each outcome , it is required to give the conditional probabilities of the next observation . the realizable case is when the measure belongs to an arbitrary but known class of process measures . the non - realizable case is when is completely arbitrary , but the prediction performance is measured with respect to a given set of process measures . we are interested in the relations between these problems and between their solutions , as well as in characterizing the cases when a solution exists , and finding these solutions . we show that if the quality of prediction is measured by total variation distance , then these problems coincide , while if it is measured by expected average kl divergence , then they are different . for some of the formalizations we also show that when a solution exists , it can be obtained as a bayes mixture over a countable subset of . as an illustration to the general results obtained , we show that a solution to the non - realizable case of the sequence prediction problem exists for the set of all finite - memory processes , but does not exist for the set of all stationary processes .   the framework is completely general : the processes measures considered are not required to be i.i.d . , mixing , stationary , or to belong to any parametric family .


powerful and well - connected smartphones are becoming increasingly common with the availability of affordable devices and data plans .increasingly , the smartphones features are provided by focused applications that users can easily install from application market places . on the other hand , with tens of thousands of applications available, there is only limited control over the quality and intent of those applications .mobile code and extensibility is one of the key issues that increase the complexity of information security . to counter this threat ,mobile operating systems impose security restrictions for each application .the android mobile operating system is one of the major systems on mobile phones . in case of the android security model, the least - privilege principle is enforced through application - level permissions that can be requested by the applications .end users need to grant the permissions at install time and thereby decide on the adequacy of the required permissions and the trustworthiness of the individual application . the permission granting procedure places a burden on the end users , who need to reason about how the application might employ the permissions .in particular , the end user has little knowledge about the consequences regarding the transitivity of permission granting .as depicted in figure [ fig : android - example ] , a malicious application ( 1 ) with only local permissions ( 2 ) may proxy sensitive data ( 3 ) through third party applications and services ( 4 ) to external destinations ( 5 ) .we describe further attack scenarios in section [ sec : android - attack - scenarios ] .the inter - component cooperation is an important concept on the android platform , but the user needs to be able to differentiate between legitimate and malicious information flows .the above - described issue of missing transparency poses a risk with the spreading of smartphones , the large numbers of available applications and the prevalent custom of installing applications from untrustworthy sources .the high likelihood of the threat can be deduced from the wealth of sensitive data that is stored on mobile phones , ranging from online banking and business application credentials to communication data and location information . on the android platform , the first attacks have already been conducted through malicious online banking applications . the threat is further increased by the number of data channels , such as the short message service , e - mail or web access that allow the flow of information out of the device context . moreover , attack scenarios are not limited to confidentiality breaches .the integrity of the device may also be endangered through similar attack vectors .for example , permissions to use expensive services may be abused .  in this paper , we describe an approach to detecting illegitimate information flows between different applications and out of the platform . this way , problems can be revealed that are induced by interacting applications and permission transitivity .we demonstrate the feasibility of our approach with applications running on the android platform , although other mobile platforms and application markets ( iphone store , blackberry world , windows mobile market ) are similarly threatened .the transitivity - of - trust problem is not only restricted to mobile platforms .a similar threat can be seen in other multi - component environments , such as social networking applications and service - oriented architecture ( soa ) . in this sense, we see our work as a starting point for research , namely , analyzing the consequences of the extensibility of systems with respect to security and mitigating possible risks induced by this paradigm .our approach to the information flow analysis spanning multiple applications is as follows .the information on data sources such as location services , databases , or contact lists are combined with information on the data sinks ( outgoing channels ) .these input data are used in a two - layer information flow analysis : first , we identify android components and the respective inter - process communication ( ipc ) points with the help of the reverse engineering tool - suite bauhaus .this part of the analysis is carried out at the level of the software architecture , reducing the analysis effort . in the second step ,we use these architectural information to slice the code and conduct focused data flow analyses on the software slices , resulting in the actual information flows that are used to construct an information flow graph at the architectural layer .the information flow graph can then be used by developers and security experts to identify malicious flows and the graph can be checked against a policy of legitimate information flows . moreover , an abstract representation can help end users in assessing the risk from a new application .the advantage of the proposed two - layer approach is its scalability . in addition , the approach is practically relevant and has real - world environments as the benchmark .  in summary , our analysis method can be considered complementary to other static code analysis approaches that can dectect implementation bugs such as sql injection and cross - site scripting vulnerablities .our approach , however , is focused more on the aspect of program comprehension for security and makes transparent interactions between different applications .the remainder of this paper is structured as follows . in section [ sec : background ] , we briefly describe the background on android , android s security concepts and the software analysis tools used for our analyses .we , then , list possible attack scenarios on the android platform and show the relevance of the transitivity of trust problem before discussing the data sources and sinks of android applications . in section [ sec : approach ] , we present our approach to the security analysis of android applications in detail , followed by a case study in section [ sec : eval ] . we discuss the advantages but also limitations of our approach in section [ sec : discuss ] .after listing the related work , we conclude in section [ sec : summary ] .applications on the android platform are developed using the java programming language .android applications are not executed on traditional java virtual machines , but are converted into the custom dex bytecode and interpreted with the dalvik virtual machine .the android sdk supports most of the java platform , standard edition and contains , in addition , android - specific extensions , including telephony functions and a ui framework .android applications consist of four basic component types : activities , services , content providers , and broadcast receivers .activities constitute the presentation layer of an application and allow users to directly interact with the application .services represent background processes without a user interface .content providers are data stores that allow developers to share databases across application boundaries .broadcast receivers receive and react to broadcast messages , for example the `` battery low '' message from the android os or messages from other applications . for communication between the individual components of applications , inter - process communication ( ipc )provides a means to pass messages between different applications , activities , and services .android uses messages that contain meta information and arbitrary data , called intents , for ipc .android components follow a lifecycle that is managed by the os . as a consequence, there is no ` main ( ) ` method from which the applications are started .instead , the android os calls the lifecycle methods , such as ` oncreate ( ) ` , whenever e.g. an activity is started for the first time or a new message is received by a service .further information about component lifecycles is available from the android developer s guide .android has two basic methods of security enforcement .firstly , applications run as linux processes with individual unix users and thus are separated from each other .this way , a security hole in one application does not affect other applications .however , as mentioned above , android provides ipc mechanisms that need to be secured .the android middleware implements a reference monitor to mediate the access to application components based upon permission labels defined for the component being accessed . if an application intends to access a component of another application , the end user has to grant an appropriate permission .the requested permissions are specified in the application s policy file .all permissions requested by an application are granted by the end user at installation time , i.e. , the permission assignment can not be changed at runtime . during the installation process, a list of dangerous permissions is presented to the end user in a dialog window and needs to be confirmed .furthermore , the security model has several refinements that increase the model s complexity .one example is the concept of shared user ids that allow different applications to share the same user i d if the applications are issued by the same developer .another refinement are protected apis : several security - critical system resources can be accessed directly rather than using components .examples of such resources are internet services that allow an application to open arbitrary network sockets and have full access to the internet and outgoing call apis that allow an application to monitor , modify , or abort outgoing calls . in order to mediate access to such resources , additional in - code security checkshave been implemented .moreover , permissions are assigned protection levels such as `` normal '' , `` dangerous '' , and `` signature '' .the android security model also supports delegation concepts such as pending intents and uri permissions that can only be checked at the code level rather than at the policy level .the bauhaus tool - suite is a reverse engineering tool - suite that has been developed for more than ten years and has been used in several industry projects .bauhaus allows one to deduce two abstractions from the source code , namely the intermediate language ( iml ) and the resource flow graph ( rfg ) .the iml representation is , in essence , an attributed syntax tree ( an enhanced ast ) that contains the detailed program structure information such as loop statements , variable definitions and name bindings .the rfg representation works at a higher abstraction level and represents architecturally relevant information of the software .the rfg is a hierarchical graph that consists of typed nodes and edges representing elements like types , components and routines and their relations .the information that is stored in the rfg is structured in views , where each view represents a different aspect of the architecture , e.g. a call graph .technically , views are subgraphs of the rfg .bauhaus supports a meta - model and thus allows one to define new node and edge types .currently , rfg profiles exist for c / c++ , c # , and java , representing syntactical elements of the respective language and their relations .for example , typical node types for java are class , method , and member ; edge types are member set , member use , and dispatching_call among others .in particular , an extension of the java - based rfg model with android - specific node and edge types is also possible .for visualizing the different views of rfgs , the graphical visualiser ( gravis ) has been implemented .gravis facilitates high - level analysis of the system and provides a rich functionality to produce new views by rfg analyses or to manipulate generated views .the bauhaus rfg represents the software architecture , but this abstract representation lacks detailed program information that is needed for data flow analysis .thus , for our goal of tracing the data flow through the application , we need an enhanced ast .the bauhaus iml - generator supports java program code below version 1.5 , but for developing and analyzing android applications , we need to analyze java 1.5 code and above . to deal with this issue , we chose soot , a well - established java analysis tool , as a basis for performing the data flow analysis .soot was designed as a java bytecode optimization framework in 1999 . in the following years, this framework has been enhanced with several other analysis methods , like points - to analysis or dynamic inter - procedural analysis .soot provides the ability to inject self - written analyses into the existing analysis chain on every intermediate representation .our analysis takes place on the jimple representation , a 3-address code representation . the built - in call graph generation and flow analysis frameworkdoes not facilitate our analysis , since , to take advantage of the android framework semantics as described in section [ sec : android - programming - model ] , a custom static data flow analysis is required .we first describe different attack scenarios that may lead to undesirable information flows on the android platform .in particular , these scenarios show that real attacks are possible that exploit transitive trust issues .thereafter , we argue that the transitivity problem is more general , not restricted to android or other smartphone platforms .we identified three classes of attack scenarios through android applications against the confidentiality of user data , depicted in figure [ fig : android - attack - scenarios ] . in the simplest case ,scenario ( a ) , a maliciously crafted application is published through the android market .while the application may provide a useful function on the surface , behind the back of the user , it transfers sensitive data ( 1 ) to a web service on the internet ( 2 ) .the android security concept requires the end user to notice the combination of permissions to read sensitive data and access the internet and cancel the installation .there are several reasons why this assumption may fail :  * end users are used to accepting permission requests with every installation of applications , thus tempted to just acknowledge the shown list ; * many applications require rather broad permissions , for example , internet access for update checks ; * the dangerous permissions may be `` hidden '' between less critical or irrelevant permissions , such as controlling the display backlight ; * in a subconscious risk assessment , the end user may deem the usefulness of the application so high that the risk may be acceptable despite the unusual combination of permissions.  moreover , as seen in a recent attack , applications can access sensitive data without explicitly requiring a permission , for example the phone serial number .one way to counter these kinds of attacks is to make the information flows from critical sources to sinks transparent . for end users ,the permissions listed in the affirmation dialog could be enriched with indications how these relate to information flows .scenario ( b ) is considerably more complex since the attacker takes advantage of application interaction mechanisms in android .similar to scenario ( a ) , the goal is to compromise the end users confidentiality by disclosing sensitive data . to hide the critical combination of permissions to read sensible data and to send it to remote services , reading and sending are split into separate applications .the first application appears to be `` local - only '' and has read access to sensitive data ( 1 ) .this application interacts using the android ipc mechanisms , for example , a service binding , with a second application without the end users knowledge ( 2 ) .the second application requires internet access permissions and can thus forward the data to a remote service ( 3 ) .the interaction between the two applications can be completely hidden from the end user .there are two approaches to prevent this attack : either to make the information flows within each application explicit , in this case from a data source to the android ipc and from android ipc to a data sink . alternatively , to analyze all installed applications to identify combinations of applications that can interact to create an information flow from a critical data source to a remote data sink .scenario ( c ) is a variant of ( b ) , but with malicious intentions by either the first or the second application .if the first one is malicious as shown in figure [ fig : android - attack - scenarios ] , it will read sensitive data as in scenario ( b ) .it will then abuse an erroneous application into tricking it to transfer the data to a remote target . in the second case ,not shown , an erroneous application that may read sensitive data offers this data through android ipc and a malicious application retrieves the data to forward it to a remote service .repositories , such as openintents , that offer interfaces for several inter - component interactions may facilitate this kind of attack . apart from making the critical information flows transparent , it is helpful to validate whether adequate permission enforcement is enacted on critical information flow paths within applications , either manifest - based or programmatic to counter this threat .if permissions are enforced , end users have a chance of noticing unusual combinations of permission requirements that do not match with the claimed application purpose .   the transitivity of trust problem as discussed before can be regarded as an instance of a more general security problem in software , namely , undesirable interaction of different applications and components , respectively .this problem has been described in the literature , e.g. , by piessens and anderson .transitivity issues between applications are not limited to the android platform or in general to mobile platforms .android , however , is a classical example of such systems .first , it supports the mobile code paradigm which supports dynamically loading new applications .furthermore , although there has been implemented a separation mechanism for applications ( or android components ) , access between the separated applications is still possible via ipc in order to allow the development of practically useful applications .similar remarks hold for other systems such as multifunction smartcards as stated , for example , by anderson .these cards allow one to install different applications , e.g. , one application for electronic passport functionality and another one for digital signature to allow for legally binding business . in particular , the javacard technology provides the possibility to dynamically load new java applets . in order to protect the applications from each other ,the concept of `` application firewalls '' has been introduced . similarly to android , however , there exists a mechanism to share java objects between applications . as a consequence , transitivity issues stemming from interacting applications are again conceivable as first discussed by mcgraw and felten . in this scenario ,an application a allows a trusted application b to access a sensitive object x via a virtual method x.foo ( ) .application b then gives a third application ( not necessarily trusted by a ) access to a method y.bar ( ) , which calls x.foo ( ) . this way , c indirectly has access to object x , although a has not explicitly given that permission .the interaction problem and specifically transitivity issues also exist in soa , which is based on extensible systems such as javaee and .net .in particular , web services , which often implement soa , aim at coupling and composing services depending on the needs of an organization . as karp et al . point out , service chaining leads to transitivity problems .we now briefly discuss this point in the context of enterprise resource planning ( erp ) systems , which often extensively support soa .sap , for example , makes the netweaver platform available to integrate different applications such as the human resources module or material management .in particular , sap netweaver can be used to allow different sap modules or even external applications access to centrally administered data such as master data ( e.g. , about customers or vendors ) , which are sensitive for an organization .a business process such as a loan origination workflow , for example , may then access or manipulate master data of a customer via a web service .this loan origination workflow itself might be exposed as a service within the organization .if this service is not secured appropriately ( e.g. , the role - based access control policy is erroneous ) , then it is conceivable that these sensitive data might be accessed by unauthorized actors through the service .  in summary ,application interaction w.r.t .transitivity is a prevalent problem on many platforms . in this paper , we focus on the android platform , although the techniques we use can be applied to other systems as well .specifically , we then need to map the system - specific programming concepts to our analysis infrastructure and , e.g. , introduce specific modeling elements at the rfg level .our approach to information flow analysis is to analyze inter - component flows from information sources , such as contact lists , to channels through which information leaves the device context .thus , we must identify communication mechanisms between components as well as critical incoming and outgoing channels on the android platform .the incoming channels are referred to as `` data sources '' , outgoing channels as `` data sinks '' .we identified a list of inter - component communication mechanisms , sources and sinks by exploring of the android application framework and the provided samples ..inter - component communication mechanisms [ cols="<,<",options="header " , ]   the origin of the data in a information flow needs to be known to effectively analyze the flows criticality .table [ tab : sources ] provides a list of data sources that allow the flow of information into the device and application context .enck et al .similarly identified data sources for the placement of security hooks in their dynamic analysis , categorizing sources into sensors , such as location sensors and camera , information databases and device identifiers .the criticality of a data source is determined by the data that the source makes potentially accessible .as the criticality depends on various factors , we only evaluate the criticality for average users at this point to give a risk estimation .we will conduct an in - depth analysis of source criticality as part of our future work .for the criticality values in table [ tab : sources ] , high criticality indicates that the impact is potentially significant .medium criticality is assigned for observation scenarios , where consequences resulting from attacks are limited for average users , depending on the monitored person in a given case .low criticality indicates that there is only little impact that most users might accept the annoyance .an example of a data source with medium criticality is android s location manager , which provides access to the device s geographical location and is used in this paper s case study .bluetooth is a data source with high criticality because of the possibility to access critical data like contacts , files and images on paired devices through this channel .  in table[ tab : sinks ] , we list data sinks of android applications with possible attack scenarios and the requirements for the realization of this scenario as well as a valuation of the attack complexity . while there are severity metrics for software vulnerabilities, the existing models do not match the requirements of the evaluation of information flow data sinks .we assess the attack complexity through the complexity of possible attack scenarios . for medium attack complexity, it is sufficient for a malicious application to trick a single application into proxying sensitive data to external destinations . in cases that require several applications to be coordinated for an attack, we rate the attack complexity as high .very high attack complexity indicates that it is , in addition , necessary to modify the operation system and/or external services , such as the google maps web service .an example of a data sink with medium attack complexity is a webview which displays web pages as part of the ui .to channel data out of the device context through this sink , a malicious application has to manipulate the target uri .in contrast , content providers are data sinks with high attack complexity because a malicious application must mislead one application into writing into a content provider and another component afterwards into using this content provider to channel data out .  following the standard risk assessment approach of , the risk of an information flow can be approximated from the source criticality ( impact ) and the sinks attack complexity ( probability ) .thus , a low attack complexity of data sinks combined with a high criticality of data sources results in a maximum risk .to improve the transparency with respect to the transitivity of trust problem on the android platform , we propose to analyze the information flows between the applications .we first introduce the analysis method on a high level before we describe our prototype implementation of the analysis .our analysis approach aims to identify undesirable information flows between different android applications and components , respectively . in order to analyze a larger set of applications ( as it usually exists on an end user s phone ) ,we did not directly employ the ast for the entire analysis .we rather employ two layers of abstraction in the analysis , beginning at the level of the software architecture to identify the android components , before diving into the ast details to enrich the architecture and , lastly , deriving the final results from the architecture . in this last step ,we employ the architecture to compose information flows through single android components into information flows spanning an entire application , and thereafter compose these intra - application information flows to inter - application information flows .all architectural - level analyses are conducted on a hierarchical architecture graph that represents architectural elements , such as methods and classes , as nodes and relations between the elements , such as calls , as edges . in the following ,we explain our analysis algorithm in more detail .a listing of the high - level algorithm is shown in ruby - style pseudo - code in listing [ pseudocode ] .the algorithm starts from a set of android applications that should be considered for inter - application information flows . in the first architectural analysis phase, android components are identified for each application .components are the basic entities in the android programming model that communicate through ipc , including services , activities and broadcast receivers ( see section [ sec : android - programming - model ] ) . in further architecture - level analyses , we search for the ipc entry and exit points for each component using architectural patterns .these points are the basis for the detailed analysis of intra - component information flows at the ast level .as shown in listing [ pseudocode - component ] , backward slicing is conducted on the ast , starting from each of the exit points .the goal is to identify information flows that reach one of the entry points of the component , representing an intra - component information flow .  at the architectural level ,the intra - component flows are used to enrich the information flow graph with communication links within each application , resulting in a component - level flow graph .next , we identify information flows on the level of individual applications .we focus on flows that originate outside the application context , pass through it and leave the application again .as depicted in listing [ pseudocode - application ] , we conduct a reachability search on the flow graph to find the information flows within each application . searching the flow graphsignificantly reduces the search space since we only consider the identified flows and not the entire ast .we start out from selected entry and exit points : sources and sinks .sources are entry points of components that connect to the outside of the application , for example , receiving broadcasts .sinks are the opposite , those exit points that leave from the application , for example , starting application - external activities or accessing web pages . from the reachability analysis on the component - level flow graph, we identify all flows between sources and sinks within the application .  at this point , we found information flows that pass through applications , but only for individual applications . for inter - application flows , in the last phase , we identify the information flows that involve critical sources and sinks as described in section [ sec : critical - sources - sinks ] .an application - level flow graph is constructed from the intra - application flows as the basis for the identification of critical flows .again , a reachability search is conducted , starting from critical sinks and searching for flows to one of the critical sources . as a result, all information flows are known that originate at critical sources and terminate at critical sinks .we implemented the analysis method described above as a prototype that identifies information flows between android applications and the android platform .the prototype uses two distinct tools to implement the analysis .as depicted in figure [ fig : analysis - workflow ] , we employ the bauhaus tool suite at the architectural level and the soot tool for ast - based analyses .[ [ identify - components - and - ipc - points ] ] identify components and ipc points + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  in the first phase of the analysis , we identify the components as well as the associated entry and exit points on the architectural level .the architecture - level analyses are based upon the rfg that the bauhaus tool generates from the java bytecode of the analyzed applications . from the global rfg, we create a reduced information flow subgraph ( view ) , containing only the relevant parts of the studied components .the relevant parts are identified through the search for relevant android framework patterns that are described in section [ sec : critical - sources - sinks ] .the bauhaus tool - suite provides python language bindings to read and modify rfgs .we developed a python script that prototypically identifies relevant parts through pattern matching and marks the related methods , classes and calls by adding the nodes and edges to an information flow view .to interface with the further , ast - based data flow analysis , the identified methods and classes are listed together with the critical calls in an xml - based exchange format that is passed to the next analysis stage .[ [ subsec : intra - comp - data - flow ] ] identify component - level flows + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  in order to find information flows between entry and exit points in components , an intra - component data flow analysis is carried out at the ast level .we use the previously identified entry and exit points to focus the data - flow analysis and significantly reduce the analysis effort at this level .we developed analysis algorithms for the soot tool that utilize the known android framework semantics .for each class of entry and exit points that is supported by the prototype , a corresponding analysis building block has been implemented .the behavior of the android platform prevents the soot framework from generating a sufficient call graph for our analyses .one reason is that there is no single entry point to the android applications , such as the traditional ` main ( ) ` method , but several , depending on the ipc mechanism .more importantly , there are several , partly dynamic framework semantics that need to be part of the call graph , such as ui event handlers , but are difficult to be statically analyzed .  to identify the intra - component information flows , we search for all program points that affect a given exit point in a component .therefore , we chose a static backward slicing technique as described by weiser .if the backward slicing reaches an entry point of the component under investigation , we consider this an information flow for the specific entry and exit points .[ [ identify - application - level - flows ] ] identify application - level flows + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +  the component - level flow data from the ast - based analysis is now employed to enrich the information flow graph .the primary purpose of the information flow graph is to allow developers and security experts to quickly identify flows and determine the risks related to the flows .the information flow graph is represented as an rfg view in the bauhaus tool suite and is extended as follows . for each information flow that has been identified in the previous analysis step, the intra - component flow edge is drawn between the entry and exit point and the corresponding nodes are added to the view . if the origin of the current flow is of type `` source '' , an information flow edge is inserted from the origin to the point of entry inside the current information flow .additionally , for all types of destinations , an edge is inserted between the point of exit and the destination s point of entry .we derive the application - level information flows by conducting a reachability analysis based on the information flow graph , starting from exit points that leave the application , backwards to entry points that enter the application . in a last step ,we combine the rfgs of multiple applications to identify the critical flows between sources and sinks in the application ecosystem again through a reachability analysis . the resulting view for the case study belowis shown in figure [ fig : gravis - analysis - results ] as it is displayed in bauhaus gravis tool .we evaluate our approach by means of a case study of a public transport - related application and thereafter show how the analysis results can be displayed in a usable manner .     as a case study , we chose to analyze two real - world android applications that are available on the android market with installations on more than 2000 devices .there are several reasons for selecting these two applications .one pragmatic aspect is that one of the authors developed the applications so that we had access to the applications bytecode as the basis for our analysis .the case study did not affect the design or implementation of the applications since the development of the applications were finished when our research work on the analysis started . a more important criterion for choosingthis application was that it encompassed different frequently - used android concepts such as starting activities or binding to services and a multi - component design ( see section [ sec : android - programming - model ] ) . with this case study, we also demonstrate that our analysis approach supports more complex semantics of the android framework such as registering and executing remote service callbacks .the two applications also demonstrate that the transitivity of trust is a necessary concept , although the missing transparency may cause the concept to be misused .the first application is called `` pubtrans '' , an interface to a public transport routing web application , primarily improving the input form to take advantage of the context ( current location and time as well as previous searches ) .pubtrans takes parameters such as origin , destination and desired arrival time and sends a query to the routing web application .thus , the pubtrans application requires unrestricted web access privileges .  when entering the public transport routing parameters , the user may choose to take the current address as the origin .since using detailed location data is not strictly necessary for the application s main goal , location queries have been factored out into a separate android component that is installed as a separate application .as shown in figure [ fig : efa - query - case - study ] , the pubtranslocation application thus requires location data permissions . with two separate applications , a user may choose whether she would like to grant location access .still , as shown in the figure , there is an information flow between both applications .this information flow is required to fulfill the intended goals , but it was not explicitly granted at installation time .although not harmful , this information flow is an example of the missing transparency with regard to the transitivity of trust on the android platform .we now describe our analysis approach in more detail with the help of this case study . in figure[ fig : efa - query - case - study ] , we can see that our system consists of two applications with three android components .we can identify the entry and exit points of the components by means of the architecture - level analysis ( `` identify components and ipc points '' step in section [ sec : prototype ] ) . taking a closer look at the ` resultwebview ` activity , we obtain as an entry point the ` oncreate ( ) ` method and as an exit point the call to the android ` webview ` ui element , which is at the same time a possible data sink as described in section [ sec : critical - sources - sinks ] .thereafter , we interface with the soot tool to perform the detailed analysis on the ast .we use an xml - based exchange format to pass on the architectural information to soot .the component description excerpt in listing [ lst : exchange - format - example ] displays two ipc points in the ` resultwebview ` component .      on the ast level , we carry out the soot analysis with the backward slicing algorithm ( `` identify component - level flows '' step ) , based on the component and ipc point information . for the ` resultwebview ` component, we need to verify , for example , whether an intra - component information flow exists between the ipc points ` oncreate ( ) ` and ` webview ` .figure [ fig : analysis - visualized ] depicts a didactically simplified excerpt of the backward slice production corresponding to the information flow from the ` resultwebview ` entry point ` oncreate ` to ` webview ` . in the figure , the backward slice starting point is the exit point of the component , calling ` loadurl ( ) ` on a ` webview ` component .beginning here , we look up all variables passed with the method call and move backward along the statements inside the method ` loadresults ( ) ` to identify each point that affects the exit point .when the beginning of this method is reached , we have a set of variables that affect the exit point and we evaluate whether any of these are method parameters to do further analysis on affected points , maybe , in other methods of the ` resultwebview ` class . in the shown case , the variable ` extras ` , marked green in figure [ fig : analysis - visualized ] , is a parameter , so we trace where the current method was called .the method was called by ` oncreate ( ) ` that was described as a starting point for activities in section [ sec : android - programming - model ] . inside ` oncreate ( ) ` , ` loadresults ( ) ` is called with the returned value of the inherited method ` getintent ( ) ` .this inherited method is another artifact of android activities and returns the intent with a set of parameters that started the activity .thus , we identified an intra - component information flow between the entry point ` oncreate ` and the exit point ` webview ` .the results from the ast - level analysis are passed back to the architectural analysis through an exchange file , shown in listing [ lst : exchange - output - example ] . in the last step ,the information flow data are used to draw appropriate edges in the information flow view on the architectural level ( `` identify application - level flows '' step ) .the information flow view of the resulting rfg is shown in figure [ fig : gravis - analysis - results ] as displayed in the bauhaus gravis visualization .when comparing the information flow graph to the case study set up in figure [ fig : efa - query - case - study ] , one can follow the information flow from the location provider source through the three components to the internet .thus , the developed method successfully identified the potentially harmful , at least intransparent information flow . while this detailed visualization is helpful for developers who need to find out which architectural elements are related to potentially unexpected information flows , security engineers and end users need significantly more abstract visualizations .for this reason , further graph searches are conducted to identify the critical flows that are to be displayed at higher levels of abstraction .   as indicated in the previous section , the developer - oriented visualization in figure [ fig : gravis - analysis - results ]is too detailed to be of use for end users . to provide an adequate level of abstraction, we generate a more abstract visualization from the analysis results , depicted in figure [ fig : end - user - ui - mockup ] .the goal is to provide insights into the potentially malicious information flows between the applications and critical sources and sinks .we display those information flows that take advantage of the transitivity of trust .first , we show all information flows that start out at a critical source and lead to a critical sink . additionally , to prevent false negatives , we also display flows to the sink from applications on the path .one option is for end users to employ this visualization on - demand to gain an overview of hidden information flows on their devices .arguably even more effectively , the visualization might serve as an addition to the existing installation process . in this case ,additional information flows that are facilitated by the new application are shown after the user has accepted the permissions that the application requires but before the actual installation .the latter case is what figure [ fig : end - user - ui - mockup ] depicts .while currently implemented as a separate application , the information flow transparency view could be integrated into the installer at a later time .also , the flow transparency application currently reads the information flow data from a file that has been previously generated on a pc . we may port the analysis to the android platform as part of our future work .alternatively , the analysis may be conducted by the android market owner when the application is uploaded to the market and provided at installation time in addition to the application package .the generated information flow data may additionally be used by security engineers to assess the security of a set of applications .for example , the market supervision could use an appropriate visualization to identify potentially harmful applications .information security staff at companies might also be interested in analyzing the security of applications on their employees smartphones .we discuss the advantages as well as the limitations of our approach .in particular , this discussion covers aspects such as false positives , scalability and the relationship to dynamic analysis .the positive result from the case study is promising , in particular , when considering that the studied applications are real - world applications that have not been modified for the developed method .however , the proposed method depends on framework semantics and thus is limited to those sources , sinks and ipc mechanisms that are implemented . as of now , we have discovered the critical mechanisms that are listed in section [ sec : critical - sources - sinks ] .currently , the algorithm is implemented for the location provider source , the ` webview ` sink as well as ` startactivity ` and ` bindservice ` ipc .we are planning to add the other mechanisms as part of our future work .in general , unsupported source or sink types will result in false negatives .moreover , while evaluating the proposed method , we discovered two aspects that are difficult to automatically analyze and may lead to additional false negatives .firstly , user inputs can contain credentials and need to be taken into account as a data source . also , information flows involving content providers as intermediate step are difficult to follow without deeper knowledge of content provider uri semantics .   similar to other static analyses ,our approach may lead to false positives that can be produced on different levels of our analyses .the first source of false positives is that we find all information flows from critical data sources to data sinks irrespective of whether they are intended or unintended . in our case study , it is intended by the programmer that the location information is passed to the web page because it is the only way to retrieve the requested information .therefore , this information flow is a false positive from the programmer s viewpoint . and it may also be a false positive for an end user if she is aware that the feature necessarily needs the location data .the second source of false positives is the underlying data flow analysis .this analysis may find data flows that are not existent due to overestimation .in such a case , we may identify a connection between a data source and a data sink within an application that may not occur in practice .this false positive on the lower level of our analysis may lead to false positives in the set of possible inter - component information flows .the highest complexity of the proposed algorithm lies in the backward slicing algorithm .specifically , the construction of the internal data structure for slicing , i.e. , the ast or to be more precise , the program dependence graph ( pdg ) is the time - consuming step . by isolating the backslicing runs for each component , we are confident that the whole algorithm will scale well in relation to the number of examined components . by selecting only potential paths between the components entry and exit points with the help of the rfg ( see the step `` identify components and ipc points '' ) , the number of the nodes of the pdg will be reduced .we do not have to build a complete pdg for all android components .the effort for the backward slicing algorithm then is linear in the size of the pdg .the focus of our work lies on static code analysis , which in principle can be carried out offline , e.g. , on other hardware as done in our current prototype implementation .dynamic analysis is another approach to address the problem of undesirable information flows on android .specifically , the taintdroid tool implements dynamic monitoring of privacy - relevant flows by modifying the dalvik vm and the android kernel . instead of static analysis before installation , taintdroid complements our approach by offering analyses at runtime . while taintdroid aims to minimize the performance overhead , static analyses can also afford to carry out more detailed analyses .for example , the tools employed by our approach allow us to even detect indirect information flows induced by control flows although this is not the topic of this paper .one argument in favor of the dynamic analysis of android applications is that no source code is needed .android uses a different distribution format called dex , which is a customized bytecode format being register - based rather than employing an operand stack .however , we have obtained promising early results with the dex2jar tool , which translates dex to java bytecode . since our analyses work on java bytecode ( see section [ sec : prototype ] ), we also applied our tools to dex code for the case study .however , applying the dex2jar tool to larger application sets remains future work .not all properties can be inferred from the code statically .one example is the implicit intent decomposition mechanism in the android framework .it decides at runtime among all registered components which component offers the requested intent features and accordingly suits to the implicit intent call . at this point ,static analysis can not determine which components will be connected at runtime and which component the platform will choose , if there exists more than one suitable component .  in the end , a hybrid approach consisting of both static and dynamic analyses will be reasonable .this way , static analyses can be improved by information gained from runtime analyses .furthermore , users who can not afford to use static analysis tools can rely on the taintdroid approach , whereas in business or governmental scenarios as well as at market entry , the static approach can be employed additionally .there exist a plethora of works for the static security analysis of software , e.g. , discussed by chess and west .the works on static information flow analysis for security often resides at the source code level .some approaches deal with programmer - written annotations for information flows that permit static code checks . moreover , the language - based security extensions in jflow support the modeling of access control .this allows one to statically check code privileges , but all modeled access controls will be removed after the jflow compiler processing .this kind of language - based security analysis is limited to the use of annotations by programmers at the source - code level .our analysis methods , however , works without code annotations aiming to detect undesirable information flow between different applications and components , respectively .  in another approach, type - based security combines annotations with dependence graph - based information flow control .hammer s proposed analysis uses the java bytecode and a succinct security policy specification that is inserted as annotations in code comments . although both approaches aim to detect information flow violations of java - based applications , they differ in the analysis techniques they use .we employ an analysis approach using the rfg to restrict the search space and thereafter carrying out a more focused analysis at the detail level .hammer uses the complete dependence graph to directly conduct the information flow analysis .in addition , hammer s method requires code annotations for the security labeling , similar to jflow .this way , this approach can only be applied by the developer , but neither by the android market owner nor the end user .  chandra and franz implemented an information flow framework for java applications using static as well as dynamic checks .static checks are needed to improve the dynamic analysis such that information about alternative control paths is also available .the approach works at the bytecode level and is fully compatible with the class file format . in general , all aforementioned approaches tackle the problem of indirect information flow induced by the control flow of applications , whereas we currently only analyze direct flows .the focus of our work lies on an inter - application analysis .furthermore , our techniques are tailored towards the android platform by considering android - specific programming concepts as well as data sources and sinks . certainly , it is worthwhile to address indirect information flows in future work .important research prototypes from static security analysis are e.g. mops , eau claire , blast , and lapse .mops uses temporal logics as formalism and model checking to discover issues such as race conditions in c programs .eau claire allows the formulation of pre- and postconditions as code annotations and is based on a theorem prover .eau claire detects general security problems such as buffer overflows .blast uses ( lazy ) abstraction to find safety properties in c / c++ code .the tool xg++ by ashcraft and engler was used to detect vulnerabilities in the linux kernel .the lapse approach by livshits and lam resembles our approach in also targeting java applications .in contrast , we focus on interactions between applications and specifically consider android s framework semantics for our analyses , whereas lapse aims to detect implementation bugs such as sql injection and cross - site scripting vulnerabilities .however , the techniques employed by the lapse approach can also be used for our analyses at the source code level instead of the backward slicing algorithm .some of the research prototypes have developed into commercial tools such as fortify source code analyzer and coverity prevent .our approach is complementary to all those works because we utilize architectural information to focus the analysis at the code level . in addition , those tools are designed to detect common low - level security bugs such as buffer overflows , sql injection and cross - site scripting vulnerabilities .we , however , focus on information flow analysis , and more generally aim to detect security problems induced by software extensibility .after the release of the android platform , some works have addressed the built - in application security mechanisms of this platform . moreover , chaudhuri et al .define a formal language to describe android application behavior and the application s permission usage . as discussed above the taintdroid approachis close to our work .beyond taintdroid , there are also other approaches with similar goals .kirin is an alternative application installer for android with a built - in security framework that enforces policy invariants on the phone .the tool checks at application install time for issues such as unchecked interfaces .when problems are found , the application installation is canceled . for the analysis ,kirin only uses the android manifest file ( containing the permissions ) and does not look at the program code .in addition , the interplay between different applications was not considered .nauman et al .present an android permission framework and a policy configuration user interface that allows the user to dynamically limit application permissions at install time . similarly to kirin , no inter - component relations are taken into consideration for the policy enforcement and only conditions according to time and usage count are described . on a lower level ,shabtai et al. enable the selinux feature in the android kernel to explore additional protection opportunities and benchmark the system performance with activated selinux on a htc g1 smartphone running android .another research approach is the saint architecture .it inserts enforcement hooks into android s middleware layer to improve the currently limited android security architecture .this work takes semantics such as location and time into account , but strictly focuses on the developer view of permissions and does not account for transitive data flows .in this paper , we discussed how the transitivity of trust problem affects dynamic multi - component systems . focusing on the android platform, we presented a two - layer approach to the static security analysis of information flows for composite android applications and thus approached the transitivity of trust problem in this context . on the upper layer ,we use the software architecture to slice the applications .thereafter , the actual data flow analysis is carried out at the ast level .the results are integrated into the architecture to derive information flows at the architectural layer .we demonstrated the effectiveness of our analysis method with the help of two real - world applications , which use advanced java and android programming concepts such as inner classes , gui handling , and android service binding .there are several directions for further research .first , we aim to support a more complete set of data sources and sinks as well as other concepts of the android framework such as pending intents , uri permissions , and service hooks .furthermore , our static analysis can be combined with dynamic analyses into a hybrid approach in order to improve on the precision of the analyses .lastly , we will analyze larger sets of applications .for example , it would be interesting to investigate ( at least ) parts of the android market and develop information flow policies that the applications should adhere to .    ,`` android app steals bank login details , '' online , 2010 , http://www.h - online.com / security / news / item / android - app - steals - bank - logi% n - details-901895.html[http://www.h - online.com / security / news / item / android - app - steals - bank - logi% n-details-901895.html ] .a. raza , g. vogel , and e. pldereder , `` bauhaus a tool suite for program analysis and reverse engineering , '' in _ ada - europe _ , ser .lecture notes in computer science , vol .4006.1em plus 0.5em minus 0.4emspringer , 2006 , pp. 7182 .    ,`` android activity lifecycle , '' online , 2010 , http://developer.android.com / reference / android / app / activity.html#activi% tylifecycle[http://developer.android.com / reference / android / app / activity.html#activi% tylifecycle ] .j. czeranski , t. eisenbarth , h. kienle , r. koschke , and d. simon , `` analyzing xfig using the bauhaus tool , '' in _ proceedings of the 7th working conference on reverse engineering_.1em plus 0.5em minus 0.4em , nov .2000 , pp .197199 .   r. valle - rai , p. co , e. gagnon , l. hendren , p. lam , and v. sundaresan , `` soot - a java bytecode optimization framework , '' in _cascon 99 : proceedings of the 1999 conference of the centre for advanced studies on collaborative research_.1em plus 0.5em minus 0.4emibm press , 1999 , p. 13 .o. lhotk and l. hendren , `` scaling java points - to analysis using spark , '' in _ compiler construction , 12th international conference _ , ser .lncs , g. hedin , ed . ,2622.1em plus 0.5em minus 0.4em warsaw , poland : springer , april 2003 , pp. 153169 .f. qian and l. hendren , `` towards dynamic interprocedural analysis in jvms , '' in _vm04 : proceedings of the 3rd conference on virtual machine research and technology symposium_.1em plus 0.5em minus 0.4emberkeley , ca , usa : usenix association , 2004 , pp .1111 .f. piessens , `` a taxonomy ( with examples ) of causes of software vulnerabilities in internet software , '' department of computer science , k.u.leuven , leuven , belgium , cw reports cw346 , august 2002 .[ online ] .available : https://lirias.kuleuven.be/handle/123456789/132159     a. h. karp and j. li , `` solving the transitive access problem for the services oriented architecture , '' in _ proceedings of the fifth international conference on availability , reliability and security ( ares)_.1em plus 0.5em minus 0.4emieee computer society , 2010 , pp .w. enck , p. gilbert , b. gon chun , l. p. cox , j. jung , p. mcdaniel , and a. n. sheth , `` taintdroid : an information - flow tracking system for realtime privacy monitoring on smartphones , '' in _9th usenix symposium on operating systems design and implementation ( osdi 10 ) _ , 2010 .d. chandra and m. franz , `` fine - grained information flow analysis and enforcement in a java virtual machine , '' in _ proceedings of the 22th annual computer security applications conference_.1em plus 0.5em minus 0.4emieee computer society , 2007 , pp .463475 .c. hammer , `` experiences with pdg - based ifc , '' in _ international symposium on engineering secure software and systems ( essos10 ) _ , ser .lncs , vol .5965.1em plus 0.5em minus 0.4emspringer - verlag , february 2010 , pp .h. chen and d. wagner , `` mops : an infrastructure for examining security properties of software , '' in _ proceedings of the acm conference on computer and communications security_.1em plus 0.5em minus 0.4em new york , ny , usa : acm , 2002 , pp . 235244.  b. chess , `` improving computer security using extended static checking , '' in _ ieee symposium on security and privacy_.1em plus 0.5em minus 0.4emlos alamitos , ca , usa : ieee computer society , 2002 , p. 160 .k. ashcraft and d. engler , `` using programmer - written compiler extensions to catch security holes , '' in _ proceedings of the ieee symposium on security and privacy_.1em plus 0.5em minus 0.4emieee computer society , 2002 , p. 143 .a. chaudhuri , `` language - based security on android , '' in _ proceedings of the 4th acm sigplan workshop on programming languages and analysis for security ( plas09)_.1em plus 0.5em minus 0.4emacm , 2009 , pp . 17 .w. enck , m. ongtang , and p. mcdaniel , `` mitigating android software misuse before it happens , '' network and security research center , , department of computer science and engineering , pennsylvania state university , university park , pa , usa , , technical report nas - tr-0094 - 2008 , september 2008 .m. nauman , s. khan , and x. zhang , `` apex : extending android permission model and enforcement with user - defined runtime constraints , '' in _asiaccs 10 : proceedings of the 5th acm symposium on information , computer and communications security_.1em plus 0.5em minus 0.4emnew york , ny , usa : acm , 2010 , pp .328332 .m. ongtang , s. mclaughlin , w. enck , and p. mcdaniel , `` semantically rich application - centric security in android , '' in _ proceedings of the 25th annual computer security applications conference _ ,los alamitos , ca , usa , 2009 , pp . 340349 .

Abstract: mobile phones have developed into complex platforms with large numbers of installed applications and a wide range of sensitive data . application security policies limit the permissions of each installed application . as applications may interact , restricting single applications may create a false sense of security for the end users while data may still leave the mobile phone through other applications . instead , the information flow needs to be policed for the composite system of applications in a transparent and usable manner . in this paper , we propose to employ static analysis based on the software architecture and focused data flow analysis to scalably detect information flows between components . specifically , we aim to reveal transitivity of trust problems in multi - component mobile platforms . we demonstrate the feasibility of our approach with android applications , although the generalization of the analysis to similar composition - based architectures , such as service - oriented architecture , can also be explored in the future .