Quantitative Security Risk Assessment of Android Permissions and Applications

The effective mitigation of landslide risk requires analytical approaches. In qualitative risk assessment, the components of risk, which are hazard, elements at risk and vulnerability, are expressed verbally and the final result is in terms of ranked or verbal risk levels (IUGS 1997). Qualitative risk assessment is subjective in nature. Quantitative risk assessment involves quantification of risk components and computation of risk. The purpose of quantitative risk assessment (QRA) is to calculate a value for the risk to enable improved risk communication and decision-making (Lee & Jones 2004). For landslides, the use of quantitative risk assessment procedures is recommended. Several frameworks for QRA have been proposed by many experts and organizations (e.g. Varnes 1984, Whitman 1984, Einstein 1988, Fell 1994, Wu et al. 1996, Morgenstern 1997, Fell & Hartford 1997, Einstein 1997, Aleotti & Chowdhury 1999, Ho et al. 2000, Roberds 2001, Dai et al. 2002, Nadim & Lacasse 2003, Lee & Jones 2004, IUGS 1997, AGS 2000, NRC Transportation Research Board 1996, GEO 1998). The QRA frameworks have common intention to find answers to the following questions (Ho et al. 2000, Lee & Jones 2004):1 What are the probable dangers/problems? [Danger Identification]2 What would be the magnitude of dangers/problems? [Hazard Assessment]3 What are the possible consequences and/or elements at risk? [Consequence/Elements at Risk Identification]4 What might be the degree of damage in elements at risk [Vulnerability Assessment]5 What is the probability of damage? [Risk Quantification/Estimation]6 What is the significance of estimated risk? [Risk Evaluation]7 What should be done? [Risk Management]Depending on the characteristics of a landslide, available data, scale of investigation and nature of consequences, the QRA frameworks may differ. Hazard assessment for a specific slope usually involves probabilistic analysis of the given slope, while hazard assessment for a region generally requires the computation of frequency of the landslides in the region. The probabilistic models used for a specific slope depend on the failure mechanism (flows, falls or slides) and slope material (soil or rock). Furthermore, the characteristics of a landslide and scale of investigation influence the consequence/elements at risk, vulnerability, risk quantification/assessment, risk evaluation and risk management. Two important aspects of QRA for landslides are the lack of wellestablished acceptable risk criteria and methods forABSTRACT: Two important aspects of quantitative landslide risk assessment, vulnerability and acceptable risk, are studied as part of a new Integrated Risk Assessment Framework (IRAF). IRAF consists of four steps: data collection, hazard assessment, vulnerability assessment, and risk assessment. Data collection involves obtaining the appropriate data for the hazard, vulnerability and risk assessments. The hazard component integrates the numerical and probabilistic analyses to exploit the added knowledge from the two approaches. A new 3-dimensional framework for quantification of vulnerability is proposed. The fourth component of IRAF is risk assessment, with the computation and evaluation of the risk based on some acceptability criteria. IRAF is implemented for rock slopes. To define an acceptability criterion, published data were collected. Various terminology relating to acceptable risk used in the literature, such as acceptable vs. tolerable, specific vs. total, voluntary vs. involuntary and individual vs. societal, are discussed.

Android is the most popular mobile platform today, and it is also the mobile operating system that is most heavily targeted by malware. Existing static analyses are effective in detecting the presence of most malicious code and unwanted information flows. However, certain types of malice are very difficult to capture explicitly by modeling permission sets, suspicious API calls, or unwanted information flows. One important type of such malice is malicious application logic, where a program (often subtly) modifies its outputs or performs actions that violate the expectations of the user. Malicious application logic is very hard to identify without a specification of the normal, expected functionality of the application. We refer to malicious application logic that is executed, or triggered, only under certain (often narrow) circumstances as a logic bomb. This is a powerful mechanism that is commonly employed by targeted malware, often used as part of APTs and state-sponsored attacks: in fact, in this scenario, the malware is designed to target specific victims and to only activate under certain circumstances. In this paper, we make a first step towards detecting logic bombs. In particular, we propose trigger analysis, a new static analysis technique that seeks to automatically identify triggers in Android applications. Our analysis combines symbolic execution, path predicate reconstruction and minimization, and inter-procedural control-dependency analysis to enable the precise detection and characterization of triggers, and it overcomes several limitations of existing approaches. We implemented a prototype of our analysis, called TriggerScope, and we evaluated it over a large corpus of 9,582 benign apps from the Google Play Store and a set of trigger-based malware, including the recently-discovered HackingTeam's RCSAndroid advanced malware. Our system is capable of automatically identify several interesting time-, location-, and SMS-related triggers, is affected by a low false positive rate (0.38%), and it achieves 100% detection rate on the malware set. We also show how existing approaches, specifically when tasked to detect logic bombs, are affected by either a very high false positive rate or false negative rate. Finally, we discuss the logic bombs identified by our analysis, including two previously-unknown backdoors in benign apps.

In this paper, we present a novel methodology that addresses some of these weaknesses. Our goal is to provide mobile users with an effective malware detection and mitigation solution keeping in view the limited resources of mobile devices and versatility of malware behavior. We are leveraging the resource rich cloud platform for carrying out the processing on the replicas of mobile devices. Our detection engine analyses the apps against certain distinguishing combination of permissions and intents used by target apps. Different machine learning algorithms were tested for best classification results on the data set of real world benign and malware apps. Naive Bayesian outperformed most of the tested algorithms and therefore it was selected for our detection engine on its performance. This work is first of its kind which is leveraging the cloud computing and machine learning algorithms to investigate the combined effects of permissions and intents for effectively distinguishing between the malware and benign apps. Performance of proposed approach has been validated by applying the technique to the available malicious and benign samples collected from different sources. The contributions of this study are as follows:  Permissions and intents amalgamation. We combine the two vital security mechanisms of android apps for malware detection. 

Environmental epidemiology has proven critical to study various associations between environmental exposures and adverse human health effects. However, there is a perception that it often does not sufficiently inform quantitative risk assessment. To help address this concern, in 2017, the Health and Environmental Sciences Institute initiated a project engaging the epidemiology, exposure science, and risk assessment communities with tripartite representation from government agencies, industry, and academia, in a dialogue on the use of environmental epidemiology for quantitative risk assessment and public health decision making. As part of this project, four meetings attended by experts in epidemiology, exposure science, toxicology, statistics, and risk assessment, as well as one additional meeting engaging funding agencies, were organized to explore incentives and barriers to realizing the full potential of epidemiological data in quantitative risk assessment. A set of questions was shared with workshop participants prior to the meetings, and two case studies were used to support the discussion. Five key ideas emerged from these meetings as areas of desired improvement to ensure that human data can more consistently become an integral part of quantitative risk assessment: 1) reducing confirmation and publication bias, 2) increasing communication with funding agencies to raise awareness of research needs, 3) developing alternative funding channels targeted to support quantitative risk assessment, 4) making data available for reuse and analysis, and 5) developing cross-disciplinary and cross-sectoral interactions, collaborations, and training. We explored and integrated these themes into a roadmap illustrating the need for a multi-stakeholder effort to ensure that epidemiological data can fully contribute to the quantitative evaluation of human health risks, and to build confidence in a reliable decision-making process that leverages the totality of scientific evidence.

We discuss the capability of a new feature set for malware detection based on potential component leaks (PCLs). PCLs are defined as sensitive data-flows that involve Android inter-component communications. We show that PCLs are common in Android apps and that malicious applications indeed manipulate significantly more PCLs than benign apps. Then, we evaluate a machine learning-based approach relying on PCLs. Experimental validations show high performance for identifying malware, demonstrating that PCLs can be used for discriminating malicious apps from benign apps.

_ This article, written by JPT Technology Editor Chris Carpenter, contains highlights of paper SPE 220333, “Quantitative Risk Assessments: Why They Fall Short and How To Use Them Better,” by Peter A.R. Hudson, SPE, and Timothy G.L. Hudson, SPE, Hudson Global Consulting. The paper has not been peer reviewed. _ This paper discusses the limitations of quantitative risk assessment (QRA) with respect to the usefulness of the concept in managing day‑to‑day and emerging risks and the effect of change. The current use of QRA creates a mismatch between the management of risks on paper and real‑world situations. This paper proposes updating QRA by transforming it into an active management tool linked to proactive management of risks through bowtie and similar models. Challenges of QRA The purpose of QRA is to establish a number that represents the likelihood of incidents and to undertake measures that mitigate risk to within an acceptable level. In a range of industries, it can be observed that what are presumed to be very unlikely events, based on QRA reports, nevertheless appear to occur with regularity. Major events, such as refinery explosions and rail fires, in theory, should occur so rarely that a single instance should not be expected. In oil and gas, the expected rate of fires and explosions is approximately one incident per 10 years per refinery. This is orders of magnitude away from the intended level. Hyperbolically, it should be closer to once in the lifetime of the universe. One real‑world example is the Texas City refinery explosion on 23 March 2005 that resulted in the deaths of 15 people and 170 injuries. Shortcomings in that incident included overreliance within QRA on historical data that did not reflect the unique conditions and actual operations at the refinery. The QRA underestimated the likelihood of organizational and human‑error deficiencies, which were significant contributors to the incident. The QRA used simplified assumptions that failed to capture the complexity of the refinery’s operations and the scale of catastrophic failure modes. An example from the nuclear industry is the Fukushima Daiichi nuclear disaster on 11 March 2011. Following a massive earthquake and tsunami, the cooling systems at the nuclear plant failed, leading to a core meltdown in three reactors, extensive radioactive contamination, and significant evacuation zones. The QRA underestimated the risks because of several factors, including the natural hazard, the effectiveness of redundancy systems, and the effect of organizational and regulatory failures. The QRA assumed that redundancy systems would function correctly without considering how a single event might cause simultaneous failures. These examples demonstrate that discrepancies between predicted failure rates or rates of negative outcomes from QRA and actual failure rates can be attributed to several factors. These factors include limitations in data, modeling assumptions, human factors, unforeseen events, and the complexity of real‑world operations. An appendix is included in the complete paper to ensure that unfamiliar readers understand the basic concepts of QRA and understand forms of data and sources for such data.

The dramatic rise of Android application (app) marketplaces has significantly gained the success of convenience for mobile users. Consequently, with the advantage of numerous Android apps, Android malware seizes the opportunity to steal privacy-sensitive data by pretending to provide functionalities as benign apps do. To distinguish malware from millions of Android apps, researchers have proposed sophisticated static and dynamic analysis tools to automatically detect and classify malicious apps. Most of these tools, however, rely on manual configuration of lists of features based on permissions, sensitive resources, intents, etc., which are difficult to come by. To address this problem, we study real-world Android apps to mine hidden patterns of malware and are able to extract highly sensitive APIs that are widely used in Android malware. We also implement an automated malware detection system, MalPat, to fight against malware and assist Android app marketplaces to address unknown malicious apps. Comprehensive experiments are conducted on our dataset consisting of 31 185 benign apps and 15 336 malware samples. Experimental results show that MalPat is capable of detecting malware with a high $F_1$ score (98.24%) comparing with the state-of-the-art approaches.

In recent years, many oil and gas fields have been discovered in ultra-deep sea (UDS). Some of these fields are evaluated to have no commercial value if existing oil field development approaches are used, especially while the oil prices remain low. A new alternative field development solution, termed as Subsurface Well Completion (SWC) system, is proposed with the aim to produce oil and gas in a cost-effective manner in UDS. This system primarily consists of four parts: a tethered subsurface platform, the rigid riser, SWC equipment and flexible jumper. Obviously, central to the evaluation and application of the new SWC technology is the inherent risk relative to acceptance level. In particular, an uncontrolled release of hydrocarbons to sea, which may lead to catastrophical consequences involving personnel risk, environmental damage and economic losses, is a main contributor to the total risk and of great concern to the offshore petroleum industry. As for the new SWC system, any failure will not be a direct source of risk for the personnel on the surface installation due to its offset feature. In this context, this paper proposes a quantitative risk assessment (QRA) framework to assess such uncontrolled releases to sea with regard to the SWC system for an oil field in the production phase based on the new Subsurface Tension Leg Production (STLP) facility. According to the QRA results presented in this paper, the identified scenarios representing uncontrolled releases to sea are subsea wellhead leaks, rigid riser leaks, subsurface wellhead leaks, releases from X-mas tree and flexible jumper leaks. Among these scenarios, subsea wellhead is found to be the high-risk area. Compared with the established risk acceptance criteria (RAC), the environmental risk levels for the subsea wellhead’s leak lie within the As Low As Reasonably Practicable (ALARP) region while other risks are all below ALARP limits, which means that there is a need for improved consideration of the existing design with regard to the subsea wellhead area, and the corresponding risk reduction measures are proposed. Furthermore, the sources and effects of uncertainties are reviewed and sensitivity studies are carried out to illustrate the effect of some of the important assumptions in the risk model. It can be found that some assumptions made are conservative or optimistic while others are unknown. However, the final QRA results can be regarded as somewhat conservative. This paper concludes that the new SWC technology has a distinct advantage with respect to the leakage duration time in UDS, and thus mitigates the environmental and commercial impacts to a large extent. Besides, relaxed design requirements for the X-mas tree and flexible jumper can be accepted. It is also concluded that there are no serious and major commercial losses for all the identified accidental release scenarios, which is of great importance and attractiveness to oil producers.

Detecting similar applications is a challenging problem, since it implies that similar high-level features and their low-level implementations can be detected and matched automatically. We propose an approach for automatically detecting Closely reLated applications in ANdroid (CLANdroid) by relying on advanced Information Retrieval techniques and five semantic anchors: identifiers, Android APIs, intents, permissions, and sensors. To evaluate CLANdroid we created a benchmark consisting of 14,450 apps along with information on similar apps provided by Google Play. We also compared effectiveness of different semantic anchors for detecting similar apps as perceived by 27 users. The results show that using Android-specific semantic anchors are useful for detecting similar Android apps across different categories. We also measured the impact of third-party libraries and obfuscated code when identifying similar Android apps, and our results suggest that there is significant difference in the accuracy when third-party libraries are excluded.

Separation of uncertainty and variability in quantitative microbial risk assessment models

A Bayesian network approach for cybersecurity risk assessment implementing and extending the FAIR model

Using quantitative risk assessment in the chemical process industry

Application of in vitro skin penetration measurements to confirm and refine the quantitative skin sensitization risk assessment of methylisothiazolinone

to a particular method of estimating risks known by its > e a practitioners as "quantitative risk assessment" or "QRA." This term specifically identifies a sophisticated statistical estimate of the risk of a particular untoward health event, usually cancer, as the result of a specified exposure to a toxic chemical or physical agent. Ten years ago, quantitative risk assessment was more or less a scientific novelty, a mathematical device seemingly developed for the amusement of biostatisticians and epidemiologists. In I 9 8 5, the Public Health Service Committee to Coordinate Environmental Health and Related Programs (CCEHRP) established the Subcommittee on Environmental Health Risk Assessment (SEHRA). As director of an institute that performs quantitative risk assessment, I was named chairman of the subcommittee. Though previously there had been several reviews of risk assessment by various groups, SEHRA was the first standing organization in the Public Health Service charged with coordinating risk assessment as a discipline. The establishment of SEHRA suggests that by I985 risk assessment had crossed an important threshold of professional and bureaucratic awareness within the Service. Today, risk assessment is attracting considerable attention at the very highest levels of government. Late in I990, an organization was established at the White House to coordinate risk assessment throughout the national government. The Federal Coordinating Council on Science, Engineering, and Technology (FCCSET), an organization convened by

Syncretic oil pumping–gas compression stations exist because oil and gas pipelines often run parallel to one another. Risk assessment and safety management present challenges in these stations because they house large numbers of devices that perform complicated operations. Quantitative risk assessment is effective in predicting probabilities and consequences of accidents; however, this method does not clearly address accident causation and other important factors that can lead to major accidents. To supplement quantitative risk assessment, this article proposes a safety barrier–based accident model for oil and gas stations based on the Swiss cheese model. An example is employed to illustrate the application of the combined method in safety management. Risk levels for different subsystems are calculated in quantitative risk assessment, and safety barriers with bad performance in high-risk subsystems are identified based on the proposed accident model. These results indicate that the combined method can be efficient for a complicated system since it helps the operators focus on the cells with high risk instead of the whole system.