Combining static analysis with probabilistic models to enable market-scale Android inter-component analysis

Abstract

Static analysis has been successfully used in many areas, from verifying mission-critical software to malware detection. Unfortunately, static analysis often produces false positives, which require significant manual effort to resolve. In this paper, we show how to overlay a probabilistic model, trained using domain knowledge, on top of static analysis results, in order to triage static analysis results. We apply this idea to analyzing mobile applications. Android application components can communicate with each other, both within single applications and between different applications. Unfortunately, techniques to statically infer Inter-Component Communication (ICC) yield many potential inter-component and interapplication links, most of which are false positives. At large scales, scrutinizing all potential links is simply not feasible. We therefore overlay a probabilistic model of ICC on top of static analysis results. Since computing the inter-component links is a prerequisite to inter-component analysis, we introduce a formalism for inferring ICC links based on set constraints. We design an efficient algorithm for performing link resolution. We compute all potential links in a corpus of 11,267 applications in 30 minutes and triage them using our probabilistic approach. We find that over 95.1% of all 636 million potential links are associated with probability values below 0.01 and are thus likely unfeasible links. Thus, it is possible to consider only a small subset of all links without significant loss of information. This work is the first significant step in making static inter-application analysis more tractable, even at large scales.

Accessing Inaccessible Android APIs: An Empirical Study

“…There are even a number of well know tools such as Soot [23] and dex2jar which allow the translation of Android app bytecode into Java. c) Java reflection, as already pointed out in several works, remains challenging for static analysis [24], [25]. All data in this study on the adoption of inacessible APIs by market apps are extracted from the detection of reflective calls using constant string analysis.…”

DroidRA: taming reflection to support whole-program analysis of Android apps

“…Besides, the conservative setting, where a string is represented by a regular expression ("*") if COAL cannot statically infer its value, which could be taken as everything and thus may also introduce false positives. Applying a probabilistic model could potentially mitigate this threat [37]. Another threat is related to Dynamic Class Loading.…”

Mining AndroZoo: A Retrospect

“…Then, an ICC method startActivity is called, which switches the current execution from Activity1 to Activity2. Finally, in Activity2, the device id is retrieved and is eventually sent out of the device through sendTextMessage (lines [15][16][17] This privacy leak cannot be detected by intra-component analyzers such as FlowDroid [10], because the switching between Activity1 and Activity2 is unfortunately decided only by the system and it is non-trivial to obtain it directly at the code level [11], [12]. Therefore, in this work we present IccTA, a code instrumentation based approach, which modifies the code to be analyzed in a way that inter-component feature is mitigated.…”