Effective Real-Time Android Application Auditing

Abstract

Mobile applications can access both sensitive personal data and the network, giving rise to threats of data leaks. App auditing is a fundamental program analysis task to reveal such leaks. Currently, static analysis is the de facto technique which exhaustively examines all data flows and pinpoints problematic ones. However, static analysis generates false alarms for being over-estimated and requires minutes or even hours to examine a real app. These shortcomings greatly limit the usability of automatic app auditing.To overcome these limitations, we design AppAudit that relies on the synergy of static and dynamic analysis to provide effective real-time app auditing. AppAudit embodies a novel dynamic analysis that can simulate the execution of part of the program and perform customized checks at each program state. AppAudit utilizes this to prune false positives of an efficient but over-estimating static analysis. Overall, AppAudit makes app auditing useful for app market operators, app developers and mobile end users, to reveal data leaks effectively and efficiently.We apply AppAudit to more than 1,000 known malware and 400 real apps from various markets. Overall, AppAudit reports comparative number of true data leaks and eliminates all false positives, while being 8.3x faster and using 90% less memory compared to existing approaches. AppAudit also uncovers 30 data leaks in real apps. Our further study reveals the common patterns behind these leaks: 1) most leaks are caused by 3rd-party advertising modules; 2) most data are leaked with simple unencrypted HTTP requests. We believe AppAudit serves as an effective tool to identify dataleaking apps and provides implications to design promising runtime techniques against data leaks.

Things You May Not Know About Android (Un)Packers: A Systematic Study based on Whole-System Emulation

“…Many previous efforts were made to pursue in-depth analysis of application behaviors. Ded [22], DroidSIFT [41], CHEX [28], PEG [18], FlowDroid [15], DroidSafe [24] and AppAudit [38] practiced static dataflow analysis to identify specific code (e.g. malicious code or heavy computation code [20]) in Android apps.…”

IntelliDroid: A Targeted Input Generator for the Dynamic Analysis of Android Malware

“…The work most closely related to IntelliDroid are hybrid static/dynamic analyses such as AppAudit [42], ContentScope [28], AppIntent [45], SmartDroid [48], SmvHunter [37] and Brahmastra [9]. The main difference between IntelliDroid and these systems is the level of fidelity of the injected inputs.…”

Agile Research for Cybersecurity: Creating Authoritative, Actionable Knowledge When Speed Matters

“…Current approaches involve static and dynamic analysis, used in combination. A recent paper [4] described how to combine the two, and presented impressive results. The students examined the work described in the paper, and especially the limitations.…”