Detecting Security Hazards in SEAndroid Vendor Customizations via Large-Scale Supervised ML
summary
A tool called VSPMiner builds a training set from differential analysis of ~10,000 AOSP commits to label ~25,000 positive and ~24,000 negative SELinux rules, encodes field- and frequency-based features, and trains tree models (notably GBDT XGBoost and random forests) to classify vendor policy changes. The detector crawls ~5 million policy rules from ~22 brands and ~2,000 images, flags thousands of risky rules, expands known patterns to over 2,000 problematic access cases, and shows tree-based models outperform linear baselines on cross‑validation.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:40Framework
- 3:08Policy Language
- 5:17Android is complex
- 7:22Winter customizations
- 8:08Our work
- 11:08Key idea
- 12:37Architecture
- 13:38Strategy
- 14:42Differential Analysis
- 16:16Never Allowed
- 16:55Combine
- 17:22Special Symbols
- 17:59Critical Fields
- 19:17P9 Rules
- 19:43Training Set
- 20:45Feature Extraction
- 24:08Model Training
- 25:17CrossValidation
- 26:00Results
- 26:44Data Acquisition
- 36:57Example
- 42:02Summary
- 43:10Showcase
related talks
25mHarvesting Inconsistent Security Configurations in Custom Android ROMs...
30mSecurity-Enhanced Android
23mAdventures in Vendor Security and Continuous Review
29mVendor Security: Where Our Data Goes We Follow
36mRevisiting Stealthy Sensitive Information Collection from Android Apps
45mSecuring Software Supply Chain: Problems, Solutions, and AI/ML Challenges
25mSecure ML: Automated Security Best Practices in Machine Learning
30mData Driven Security