{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T20:35:18Z","timestamp":1770755718280,"version":"3.50.0"},"reference-count":54,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,10,28]],"date-time":"2024-10-28T00:00:00Z","timestamp":1730073600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,10,28]],"date-time":"2024-10-28T00:00:00Z","timestamp":1730073600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"name":"Taishan Young Scholar Program of Shandong Province","award":["tsqn202211001"],"award-info":[{"award-number":["tsqn202211001"]}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["ZR2023MF043"],"award-info":[{"award-number":["ZR2023MF043"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2025,1]]},"DOI":"10.1007\/s10664-024-10559-0","type":"journal-article","created":{"date-parts":[[2024,10,28]],"date-time":"2024-10-28T09:16:25Z","timestamp":1730106985000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["From guidelines to practice: assessing Android app developer compliance with google\u2019s security recommendations"],"prefix":"10.1007","volume":"30","author":[{"given":"Shishuai","family":"Yang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qinsheng","family":"Hou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shuang","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fenghao","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0916-8806","authenticated-orcid":false,"given":"Wenrui","family":"Diao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,10,28]]},"reference":[{"key":"10559_CR1","doi-asserted-by":"publisher","unstructured":"Allix K, Bissyand\u00e9 TF, Klein J, Traon YL (2016) Androzoo: collecting millions of android apps for the research community. In: Kim M, Robbes R, Bird C (eds) Proceedings of the 13th international conference on mining software repositories (MSR), Austin, TX, USA, May 14-22, 2016. https:\/\/doi.org\/10.1145\/2901739.2903508","DOI":"10.1145\/2901739.2903508"},{"key":"10559_CR2","unstructured":"Andow B, Mahmud SY, Whitaker J, Enck W, Reaves B, Singh K, Egelman S (2020) Actions speak louder than words: entity-sensitive privacy policy and data flow analysis with PoliCheck. In: Proceedings of the 29th USENIX security symposium (USENIX-Sec), Boston, MA, USA, August 12-14, 2020. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/andow"},{"key":"10559_CR3","unstructured":"C R (2021) Over 60% of android apps have security vulnerabilities. https:\/\/atlasvpn.com\/blog\/over-60-of-android-apps-have-security-vulnerabilities"},{"key":"10559_CR4","unstructured":"Diao W, Zhang Y, Zhang L, Li Z, Xu F, Pan X, Liu X, Weng J, Zhang K, Wang X (2019) Kindness is a risky business: on the usage of the accessibility APIs in android. In: Proceedings of the 22nd international symposium on research in attacks, intrusions and defenses (RAID), Beijing, China, September 23-25, 2019. https:\/\/www.usenix.org\/conference\/raid2019\/presentation\/diao"},{"key":"10559_CR5","doi-asserted-by":"publisher","unstructured":"Egele M, Brumley D, Fratantonio Y, Kruegel C (2013) An empirical study of cryptographic misuse in android applications. In: Proceedings of the 20th ACM SIGSAC conference on computer and communications security (CCS), Berlin, Germany, November 4-8, 201. https:\/\/doi.org\/10.1145\/2508859.2516693","DOI":"10.1145\/2508859.2516693"},{"issue":"1","key":"10559_CR6","doi-asserted-by":"publisher","first-page":"212","DOI":"10.1109\/TR.2019.2956690","volume":"70","author":"J Gao","year":"2021","unstructured":"Gao J, Li L, Kong P, Bissyand\u00e9 TF, Klein J (2021) Understanding the evolution of android app vulnerabilities. IEEE Trans Reliab 70(1):212\u2013230","journal-title":"IEEE Trans Reliab"},{"key":"10559_CR7","unstructured":"Google (2023a) android:exported. https:\/\/developer.android.com\/topic\/security\/risks\/android-exported"},{"key":"10559_CR8","unstructured":"Google (2023b) Fixing a zip path traversal vulnerability. https:\/\/developer.android.com\/topic\/security\/risks\/zip-path-traversal"},{"key":"10559_CR9","unstructured":"Google (2023c) Implicit intent hijacking. https:\/\/developer.android.com\/privacy-and-security\/risks\/implicit-intent-hijacking"},{"key":"10559_CR10","unstructured":"Google (2023d) Intent redirection. https:\/\/developer.android.com\/privacy-and-security\/risks\/intent-redirection"},{"key":"10559_CR11","unstructured":"Google (2023e) Path traversal vulnerability. https:\/\/developer.android.com\/topic\/security\/risks\/path-traversal"},{"key":"10559_CR12","unstructured":"Google (2023f) Unsafe HostnameVerifier. https:\/\/developer.android.com\/topic\/security\/risks\/unsafe-hostname"},{"key":"10559_CR13","unstructured":"Google (2023g) Unsafe X.509 TrustManager. https:\/\/developer.android.com\/topic\/security\/risks\/unsafe-trustmanager"},{"key":"10559_CR14","unstructured":"Google (2024a) Add a network security configuration. https:\/\/developer.android.com\/privacy-and-security\/security-best-practices#network-security-config"},{"key":"10559_CR15","unstructured":"Google (2024b) Address webview SSL error. https:\/\/support.google.com\/faqs\/answer\/7071387"},{"key":"10559_CR16","unstructured":"Google (2024c) Android permission protection level. https:\/\/developer.android.com\/guide\/topics\/manifest\/permission-element"},{"key":"10559_CR17","unstructured":"Google (2024d) App security best practices. https:\/\/developer.android.com\/privacy-and-security\/security-best-practices"},{"key":"10559_CR18","unstructured":"Google (2024e) Application sandbox. https:\/\/source.android.com\/security\/app-sandbox"},{"key":"10559_CR19","unstructured":"Google (2024f) Apply signature-based permissions. https:\/\/developer.android.com\/privacy-and-security\/security-best-practices#apply-signature-based-permissions"},{"key":"10559_CR20","unstructured":"Google (2024g) Intent scheme hijacking. https:\/\/support.google.com\/faqs\/answer\/9101196"},{"key":"10559_CR21","unstructured":"Google (2024h) Mitigate security risks in your app. https:\/\/developer.android.com\/privacy-and-security\/risks"},{"key":"10559_CR22","unstructured":"Google (2024i) Permissions on android. https:\/\/developer.android.com\/guide\/topics\/permissions\/overview"},{"key":"10559_CR23","unstructured":"Google (2024j) Privacy & security SC-DF2. https:\/\/developer.android.com\/docs\/quality-guidelines\/core-app-quality#SC-10"},{"key":"10559_CR24","unstructured":"Google (2024k) Privacy & security SC-DF3. https:\/\/developer.android.com\/docs\/quality-guidelines\/core-app-quality#sc"},{"key":"10559_CR25","unstructured":"Google (2024l) Request permissions. https:\/\/developer.android.com\/privacy-and-security\/about#permissions"},{"key":"10559_CR26","unstructured":"Google (2024m) SharedPreferences. https:\/\/developer.android.com\/privacy-and-security\/security-best-practices#sharedpreferences"},{"key":"10559_CR27","unstructured":"Google (2024n) shouldOverrideUrlLoading. https:\/\/developer.android.com\/reference\/android\/webkit\/WebViewClient#shouldOverrideUrlLoading(android.webkit.WebView,%20android.webkit.WebResourceRequest)"},{"key":"10559_CR28","unstructured":"Google (2024o) Store data in external storage on use case. https:\/\/developer.android.com\/privacy-and-security\/security-best-practices#external-storage"},{"key":"10559_CR29","unstructured":"Google (2024p) Store private data within internal storage. https:\/\/developer.android.com\/privacy-and-security\/security-best-practices#internal-storage"},{"key":"10559_CR30","unstructured":"Google (2024q) WebView objects. https:\/\/developer.android.com\/privacy-and-security\/security-best-practices#webview"},{"key":"10559_CR31","unstructured":"JoMingyu (2024) Google-play-scraper. https:\/\/github.com\/JoMingyu\/google-play-scraper"},{"issue":"3","key":"10559_CR32","doi-asserted-by":"publisher","first-page":"2058","DOI":"10.1007\/s10664-019-09764-z","volume":"25","author":"L Li","year":"2020","unstructured":"Li L, Gao J, Bissyand\u00e9 TF, Ma L, Xia X, Klein J (2020) CDA: characterising deprecated android APIs. Empir Softw Eng 25(3):2058\u20132098","journal-title":"Empir Softw Eng"},{"key":"10559_CR33","doi-asserted-by":"publisher","unstructured":"Li Z, Machiry A, Chen B, Naik M, Wang K, Song L (2021) ARBITRAR: user-guided api misuse detection. In: Proceedings of the 42nd IEEE symposium on security and privacy (IEEE S &P), San Francisco, CA, USA, 24-27 May 2021.https:\/\/doi.org\/10.1109\/SP40001.2021.00090","DOI":"10.1109\/SP40001.2021.00090"},{"key":"10559_CR34","unstructured":"Lin YC (2015) AndroBugs framework. https:\/\/github.com\/AndroBugs\/AndroBugs_Framework#androbugs-framework"},{"key":"10559_CR35","doi-asserted-by":"publisher","unstructured":"Luo T, Wu J, Yang M, Zhao S, Wu Y, Wang Y (2018) MAD-API: detection, correction and explanation of API misuses in distributed android applications. In: Proceedings of the 7th international conference on artificial intelligence and mobile services (AIMS), Seattle, WA, USA, June 25-30, 201. https:\/\/doi.org\/10.1007\/978-3-319-94361-9_10","DOI":"10.1007\/978-3-319-94361-9_10"},{"key":"10559_CR36","unstructured":"Lyons A, Gamba J, Shawaga A, Reardon J, Tapiador J, Egelman S, Vallina-Rodriguez N (2023) Log: it\u2019s big, it\u2019s heavy, it\u2019s filled with personal data! measuring the logging of sensitive information in the android ecosystem. In: Proceedings of the 32nd USENIX security symposium (USENIX-Sec), Anaheim, CA, USA, August 9-11, 2023. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/lyons"},{"key":"10559_CR37","unstructured":"MITRE (2013) Improper export of android application components. https:\/\/cwe.mitre.org\/data\/definitions\/926.html"},{"key":"#cr-split#-10559_CR38.1","unstructured":"Oltrogge M, Huaman N, Amft S, Acar Y, Backes M, Fahl S (2021) Why eve and mallory still love android: revisiting TLS"},{"key":"#cr-split#-10559_CR38.2","unstructured":"(In) security in android applications. In: Proceedings of the 30th USENIX security symposium (USENIX-Sec), August 11-13, 2021. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/oltrogge"},{"key":"10559_CR39","unstructured":"Overflow S (2015) Android get serial number. https:\/\/stackoverflow.com\/questions\/33079734\/android-get-serial-number"},{"key":"10559_CR40","unstructured":"OWASP (2024) The mobile application security verification standard. https:\/\/mas.owasp.org\/MASVS\/"},{"key":"10559_CR41","doi-asserted-by":"publisher","unstructured":"Shao Y, Ott J, Jia YJ, Qian Z, Mao ZM (2016) The misuse of android unix domain sockets and security implications. In: Proceedings of the 23rd ACM SIGSAC conference on computer and communications security (CCS), Vienna, Austria, October 24-28, 201.https:\/\/doi.org\/10.1145\/2976749.2978297","DOI":"10.1145\/2976749.2978297"},{"key":"10559_CR42","unstructured":"Simplilearn (2022) Android developer salary - for freshers and experienced. https:\/\/www.simplilearn.com\/tutorials\/software-career-resources\/android-developer-salary"},{"key":"10559_CR43","unstructured":"Stack-Overflow (2010a) Remove debug logging. https:\/\/stackoverflow.com\/questions\/2446248\/"},{"key":"10559_CR44","unstructured":"Stack-Overflow (2010b) Uzip file. https:\/\/stackoverflow.com\/questions\/3382996\/how-to-unzip-files-programmatically-in-android"},{"key":"10559_CR45","unstructured":"Stack-Overflow (2012a) Android.os.build.serial. https:\/\/stackoverflow.com\/questions\/11794749\/how-to-decode-android-os-build-serial"},{"key":"10559_CR46","unstructured":"Stack-Overflow (2012b) Share file. https:\/\/stackoverflow.com\/questions\/12170386\/create-and-share-a-file-from-internal-storage"},{"key":"10559_CR47","unstructured":"Turner A (2024) Google Play App Statistics. https:\/\/www.bankmycell.com\/blog\/number-of-google-play-store-apps\/"},{"key":"10559_CR48","doi-asserted-by":"publisher","unstructured":"V\u00e1squez ML, Bavota G, Bernal-C\u00e1rdenas C, Penta MD, Oliveto R, Poshyvanyk D (2013) API change and fault proneness: a threat to the success of android apps. In: Proceedings of the 9th joint meeting of the european software engineering conference and the ACM SIGSOFT symposium on the foundations of software engineering (ESEC\/FSE), Saint Petersburg, Russian Federation, August 18-26, 201. https:\/\/doi.org\/10.1145\/2491411.2491428","DOI":"10.1145\/2491411.2491428"},{"key":"10559_CR49","doi-asserted-by":"publisher","unstructured":"V\u00e1squez ML, Bavota G, Penta MD, Oliveto R, Poshyvanyk D (2014) How do API changes trigger stack overflow discussions? a study on the android SDK. In: Proceedings of the 22nd international conference on program comprehension (ICPC), Hyderabad, India, June 2-3, 201. https:\/\/doi.org\/10.1145\/2597008.2597155","DOI":"10.1145\/2597008.2597155"},{"key":"10559_CR50","doi-asserted-by":"publisher","unstructured":"Yang S, Hou Q, Li S, Diao W (2023) Do app developers follow the android official data security guidelines? \u2013 an empirical measurement on app data security. In: Proceedings of the 30th asia-pacific software engineering conference (APSEC), Seoul, Korea, December 4-7, 2023. https:\/\/doi.org\/10.1109\/APSEC60848.2023.00017","DOI":"10.1109\/APSEC60848.2023.00017"},{"key":"10559_CR51","doi-asserted-by":"publisher","unstructured":"Yang S, Li R, Chen J, Diao W, Guo S (2022) Demystifying android non-SDK APls: measurement and understanding. In: Proceedings of the 44th IEEE\/ACM international conference on software engineering (ICSE), , Pittsburgh, PA, USA, May 25-27, 202. https:\/\/doi.org\/10.1145\/3510003.3510045","DOI":"10.1145\/3510003.3510045"},{"key":"10559_CR52","doi-asserted-by":"publisher","unstructured":"Zhang T, Upadhyaya G, Reinhardt A, Rajan H, Kim M (2018) Are code examples on an online Q &A forum reliable? a study of API misuse on stack overflow. In: Proceedings of the 40th international conference on software engineering (ICSE), Gothenburg, Sweden, May 27 - June 03, 2018. https:\/\/doi.org\/10.1145\/3180155.3180260","DOI":"10.1145\/3180155.3180260"},{"key":"10559_CR53","doi-asserted-by":"publisher","unstructured":"Zhou R, Hamdaqa M, Cai H, Hamou-Lhadj A (2020) MobiLogLeak: a preliminary study on data leakage caused by poor logging practices. In: Proceedings of the 27th IEEE international conference on software analysis, evolution and reengineering (SANER), London, ON, Canada, February 18-21, 2020. https:\/\/doi.org\/10.1109\/SANER48275.2020.9054831","DOI":"10.1109\/SANER48275.2020.9054831"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-024-10559-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10664-024-10559-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-024-10559-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,7]],"date-time":"2025-01-07T14:10:10Z","timestamp":1736259010000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10664-024-10559-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,28]]},"references-count":54,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,1]]}},"alternative-id":["10559"],"URL":"https:\/\/doi.org\/10.1007\/s10664-024-10559-0","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,10,28]]},"assertion":[{"value":"30 September 2024","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 October 2024","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declared that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflicts of interest"}}],"article-number":"11"}}