No abstract

No abstract

Summary Android is extensively used worldwide by mobile application developers. Android provides applications with a message passing system to communicate within and between them. Due to the risks associated with this system, it is vital to detect its unsafe operations and potential vulnerabilities. To achieve this goal, a new framework, called VAnDroid, based on Model Driven Reverse Engineering (MDRE), is presented that identifies security risks and vulnerabilities related to the Android application communication model. In the proposed framework, some security‐related information included in an Android app is automatically extracted and represented as a domain‐specific model. Then, it is used for analyzing security configurations and identifying vulnerabilities in the corresponding application. The proposed framework is implemented as an Eclipse‐based tool, which automatically identifies the Intent Spoofing and Unauthorized Intent Receipt as two attacks related to the Android application communication model. To evaluate the tool, it has been applied to several real‐world Android applications, including 20 apps from Google Play and 110 apps from the F‐Droid repository. VAnDroid is also compared with several existing analysis tools, and it is shown that it has a number of key advantages over those tools specifically regarding its high correctness, scalability, and usability in discovering vulnerabilities. The results well indicate the effectiveness and capacity of the VAnDroid as a promising approach in the field of Android security.

No abstract

Model Driven Engineering is a development paradigm that uses models instead of code as primary development artifacts. In this paper, we focus on executable models, which are used to abstract the behavior of systems for the purpose of verifying and validating (V&V) a system's properties. Model execution tracing (i.e., obtaining and analyzing traces of model executions) is an important enabler for many V&V techniques including testing, model checking, and system comprehension. This may explain the increase in the number of proposed approaches on tracing model executions in the last years. Despite the increased attention, there is currently no clear understanding of the state of the art in this research field, making it difficult to identify research gaps and opportunities. The goal of this paper is to survey and classify existing work on model execution tracing, and identify promising future research directions. To achieve this, we conducted a systematic mapping study where we examined 64 primary studies out of 645 found publications. We found that the majority of model execution tracing approaches has been developed for the purpose of testing and dynamic analysis. Furthermore, most approaches target specific