Manifest-Level Permission Debloating on Android Applications

Sammanfattning

Modern Android applications frequently contain functionality that most users neverneed or use, a phenomenon known as software bloat. One specific manifestationof bloat is permission over-declaration, where applications declare permissions intheir manifest whose corresponding Android API methods are never invoked in theapplication’s code. Over-declared permissions mislead users, unnecessarily expandthe attack surface of the application, and may signal access to sensitive resourcessuch as the camera or microphone without any functional justification.This thesis proposes and evaluates a two-phase hybrid debloating pipeline for Androidapplications. The first phase is a custom static analysis tool that automaticallydetects over-declared permissions by scanning the application’s smali bytecode forpermission-protected API calls, and removes unused permission declarations fromthe manifest without modifying any executable code. The second phase appliesMiniMon, an existing monitor-based debloating framework, to the output of the firstphase, removing methods that were not exercised during monitored usage sessions.The pipeline is evaluated on a dataset of 38 real-world Android applications. Theresults show that permission over-declaration is widespread, affecting 44.7% of theapplications in the dataset. The first phase reduced APK size in 16 out of 17 affectedapplications with an average reduction of 122.14 KB, while preserving functionalcorrectness by construction. The combined pipeline produced additional size reduction over monitor-based debloating alone in 11 out of 28 applications, demonstratingthat the two approaches are complementary: permission-based debloating addressesmanifest-level bloat that is invisible to usage-based approaches, while monitor-baseddebloating addresses code-level bloat that manifest analysis cannot reach.