Manifest-Level Permission Debloating on Android Applications

Abstract

Modern Android applications frequently contain functionality that most users never need or use, a phenomenon known as software bloat. One specific manifestation of bloat is permission over-declaration, where applications declare permissions in their manifest whose corresponding Android API methods are never invoked in the application’s code. Over-declared permissions mislead users, unnecessarily expand the attack surface of the application, and may signal access to sensitive resources such as the camera or microphone without any functional justification. This thesis proposes and evaluates a two-phase hybrid debloating pipeline for Android applications. The first phase is a custom static analysis tool that automatically detects over-declared permissions by scanning the application’s smali bytecode for permission-protected API calls, and removes unused permission declarations from the manifest without modifying any executable code. The second phase applies MiniMon, an existing monitor-based debloating framework, to the output of the first phase, removing methods that were not exercised during monitored usage sessions. The pipeline is evaluated on a dataset of 38 real-world Android applications. The results show that permission over-declaration is widespread, affecting 44.7% of the applications in the dataset. The first phase reduced APK size in 16 out of 17 affected applications with an average reduction of 122.14 KB, while preserving functional correctness by construction. The combined pipeline produced additional size reduction over monitor-based debloating alone in 11 out of 28 applications, demonstrating that the two approaches are complementary: permission-based debloating addresses manifest-level bloat that is invisible to usage-based approaches, while monitor-based debloating addresses code-level bloat that manifest analysis cannot reach.