Demystifying Application Performance Management Libraries for Android

Abstract

Being able to automatically detect the performance issues in apps can significantly improve apps' quality as well as having a positive influence on user satisfaction. Application Performance Management (APM) libraries are used to locate the apps' performance bottleneck, monitor their behaviors at runtime, and identify potential security risks. Although app developers have been exploiting application performance management (APM) tools to capture these potential performance issues, most of them do not fully understand the internals of these APM tools and the effect on their apps. To fill this gap, in this paper, we conduct the first systematic study on APMs for apps by scrutinizing 25 widely-used APMs for Android apps and develop a framework named APMHunter for exploring the usage of APMs in Android apps. Using APMHunter, we conduct a large-scale empirical study on 500,000 Android apps to explore the usage patterns of APMs and discover the potential misuses of APMs. We obtain two major findings: 1) some APMs still employ deprecated permissions and approaches, which makes APMs fail to perform as expected; 2) inappropriate use of APMs can cause privacy leaks. Thus, our study suggests that both APM vendors and developers should design and use APMs scrupulously.

Demystifying Privacy Policy of Third-Party Libraries in Mobile Apps

“…According to Android permission mechanism, TPLs share the same privileges with host apps [19]- [21]. TPLs may abuse permissions to access users' personally identifiable information without users' consent [22], [23], which results in personal information leakage [8]- [18], [53].…”

Demystifying Privacy Policy of Third-Party Libraries in Mobile Apps

“…Due to Android's permission mechanism, TPLs share the same privileges with host apps [19]- [21]. TPLs may abuse permissions to access users' personally identifiable information without users' consent [22], [23], which results in personal information leakage [8]- [18], [53].…”

Logging Practices with Mobile Analytics: An Empirical Study on Firebase

“…Some of the mobile analytics tools focus on monitoring performance of the software [37], [38]. A recent study found mobile analytics are often used poorly and with user-privacy concerns [17].…”

“…For example, mobile analytics logging may bring extra non-negligible resource overhead to generate and transmit the logs. In addition, the remote storage of information may also bring privacy concerns [17]. Therefore, research into the characteristics of practices of mobile analytics logging is germane to help practitioners and researchers further understand and address the challenges.…”