I. INTRODUCTION
Smartphones and tablets are becoming ubiquitous, fueled by the explosive growth of mobile applications. For example, Google’s Android Market has topped the 200K, 300K, and 400K available apps milestones in April, August, and December 2011, respectively [1]. Since most of these applications are written by third-party developers and have not gone through rigorous review, they may violate the user’s security or privacy expectations. For example, they may exfiltrate the user’s confidential or private information or modify critical data. Even though Android allows the user to review and approve the permissions requested by each application, few users are able or willing to understand the implications of each permission completely. Moreover, unless the user agrees to grant all the requested permissions, Android will refuse to install the application.
To overcome the above limitations, we propose a rewriting framework to embed In-App Reference Monitors (I-ARM) in Android applications. Unlike traditional x86 applications, most Android application code runs on the Dalvik Virtual Machine (DVM) and is structured and