隨著智慧型手機的發展，具備各式功能的APP爭相上架，但為了降低開發時間及成本，許多開發者使用不安全或不熟悉的third-party library，而Android的權限機制卻給予third-party library擁有與host-app一模一樣的存取權限。因此如何阻止third-party library進行越權行為成了值得探討的問題。
在先前的研究 [1]、 [2]都有提到了third-party library會有越權的行為，進一步地對使用者隱私造成威脅。為此本篇論文做出兩點貢獻(一)針對Android framework中的權限控制機制做出修改並且讓運行時的權限管理更加彈性。(二)阻擋third-party library的越權行為，開發者能夠動態的關閉/開啟APP所擁有的敏感權限，保護使用者隱私。
為了證明此機制的可用性，本論文對許多Real-world APP進行實際測試，在Google Play商店中獲得熱門APP，將這些APP套用我們所開發出來的機制，提供開發者動態地阻止敏感功能運作藉此證明此機制，限制third-party library存取敏感權限。

App with all kinds of features arise in today's smart phone market, many developers use unsafe or unknown Third-party Library to reduce the development time and cost; however, host-app and Third-party Library has the same permissions, there is no clear distinctions between them. Therefore, how to prevent Third-party Libraries from overriding permissions has become an worth discussing issue.
Previous research [1], [2] have mentioned the third-party library might have the issue of exceeding the permission and threat the users’ privacy. This thesis has two contributions: (1) Modify the permission mechanism of Android framework and achieve more dynamically control permission in the runtime. (2) Prevent third-party library from exceeding the permission. Developer enable to open/close permissions of the App have to protect users’ privacy.
In order to prove the practicality of this mechanism, this thesis examines many Real-world APPs obtaining popular APPs in the Google Play store. The results of applying these APPs not only shows that our proposed mechanism successfully enables the developer to dynamically control permission in the runtime but being able to restrict third-party library to access sensitive permission.

[1] J. Seo, D. Kim, D. Cho, T. Kim and I. Shin, "FLEXDROID: Enforcing In-App Privilege Separation in Android," Network and Distributed System Security Symposium (NDSS), 2016.
[2] M. C. Grace, W. Zhou, X. Jiang and A.-R. Sadeghi, "Unsafe exposure analysis of mobile in-app advertisements," Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks, 2012.
[3] L. Li, T. F. Bissyandé, J. Klein and Y. Traon, "An Investigation into the Use of Common Libraries in Android Apps," Software Analysis, Evolution, and Reengineering (SANER), IEEE 23rd International Conference on, 2016.
[4] T. Book, A. Pridgen and D. S. Wallach, "Longitudinal Analysis of Android Ad Library," arXiv preprint arXiv:1303.0857, 2013.
[5] "Firm fined for angry birds mobile billing scam," [Online]. Available: http://ipkonfig.com/firm-fined-for-angry-birds-mobile-billing-scam.
[6] "Android Developer Reference, Fundamental Components.," [Online]. Available: https://developer.android.com/guide/components/fundamentals.html.
[7] "ART and Dalvik," [Online]. Available: https://source.android.com/devices/tech/dalvik/.
[8] "Normal and Dangerous Permissions," [Online]. Available: https://developer.android.com/guide/topics/permissions/requesting.html.
[9] "Compare with emulators," [Online]. Available: http://www.androidauthority.com/best-android-emulators-for-pc-655308/.
[10] B. Livshits and J. Jung, "Automatic mediation of privacy-sensitive," The Network and Distributed System Security Symposium (NDSS), 2013.
[11] R. Bhoraskar, S. Han, J. Jeon, T. Azim, S. Chen, J. Jung, S. Nath, R. Wang and D. Wetherall, "Brahmastra: Driving Apps to Test the Security of Third-Party Components," 23rd USENIX Security Symposium, 2014.
[12] J. Crussell, R. Stevens and H. Chen, "MAdFraud: investigating ad fraud in android applications," Proceedings of the 12th annual international conference on Mobile systems, applications, and services, 2014.
[13] J. Huang, Z. Li, X. Xiao, Z. Wu, K. Lu, X. Zhang and G. Jiang, "SUPOR: Precise and Scalable Sensitive User Input," 24th USENIX Security Symposium, 2015.
[14] "Android Open Source Project emulators," [Online]. Available: https://source.android.com/source/building.
[15] "Android Developer Reference, ActivityManager.," [Online]. Available: https://developer.android.com/reference/android/app/ActivityManager.html.
[16] "Google Developers ,AdWords API ,Client Libraries," [Online]. Available: https://developers.google.com/adwords/api/docs/clientlibraries.
[17] W. Meng, R. Ding, S. P. Chung, S. Han and W. Lee, "The Price of Free:Privacy Leakage in Personalized Mobile In-App Ads," The Network and Distributed System Security Symposium, 2016.
[18] "Google Developers ,AdWords help, Targeting your ads," [Online]. Available: https://support.google.com/adwords/answer/1704368?hl=en.
[19] "Android Developer Reference, ContextWrapper.," [Online]. Available: https://developer.android.com/reference/android/content/ContextWrapper.html.
[20] "Android Developer Reference, Activity.," [Online]. Available: https://developer.android.com/reference/android/app/Activity.html.
[21] "Android Open Source Project," [Online]. Available: https://source.android.com/.
[22] "Google Play store," [Online]. Available: https://play.google.com/store?hl=zh_TW.
[23] "AnTuTu-Benchmark," [Online]. Available: http://www.antutu.com/.
[24] "K9 Mail," [Online]. Available: https://k9mail.github.io/.