  There are over 1.2 million applications on the Google Play store today with a
large number of competing applications for any given use or function. This
creates challenges for users in selecting the right application. Moreover, some
of the applications being of dubious origin, there are no mechanisms for users
to understand who the applications are talking to, and to what extent. In our
work, we first develop a lightweight characterization methodology that can
automatically extract descriptions of application network behavior, and apply
this to a large selection of applications from the Google App Store. We find
several instances of overly aggressive communication with tracking websites, of
excessive communication with ad related sites, and of communication with sites
previously associated with malware activity. Our results underscore the need
for a tool to provide users more visibility into the communication of apps
installed on their mobile devices. To this end, we develop an Android
application to do just this; our application monitors outgoing traffic,
associates it with particular applications, and then identifies destinations in
particular categories that we believe suspicious or else important to reveal to
the end-user.
