SPRisk

      In this project, we propose a comprehensive and understandable privacy risk assessment framework for Android apps, called SPRisk. The main idea is to construct a fine-grained assessment model with multiple factors. SPRisk considers the resource diversity in semantic level, and concerns APIs' execution context from trigger conditions of sensitive data-flow which indicates users' intention. Meanwhile, SPRisk also takes the transmission destination into account, while private data leaving devices has a higher risk than that staying on the devices. We not only provide qualitative result (called risk level), but also provide quantitative result (called risk score). For an app, the risk level presents which level its privacy risk belongs to, and the risk score indicates how risky it is. Furthermore, to quantify the diversity of various factors, we exploit a machine-learning method which can assign each factor's weight automatically. We implement SPRisk and evaluate our assessment framework using 172,445 Google Play apps. Our evaluation of SPRisk discloses some interesting findings about risk distribution.