FlowDroid

Abstract

Today's smartphones are a ubiquitous source of private and confidential data. At the same time, smartphone users are plagued by carelessly programmed apps that leak important data by accident, and by malicious apps that exploit their given privileges to copy such data intentionally. While existing static taint-analysis approaches have the potential of detecting such data leaks ahead of time, all approaches for Android use a number of coarse-grain approximations that can yield high numbers of missed leaks and false alarms. In this work we thus present FlowDroid, a novel and highly precise static taint analysis for Android applications. A precise model of Android's lifecycle allows the analysis to properly handle callbacks invoked by the Android framework, while context, flow, field and object-sensitivity allows the analysis to reduce the number of false alarms. Novel on-demand algorithms help FlowDroid maintain high efficiency and precision at the same time. We also propose DroidBench, an open test suite for evaluating the effectiveness and accuracy of taint-analysis tools specifically for Android apps. As we show through a set of experiments using SecuriBench Micro, DroidBench, and a set of well-known Android test applications, FlowDroid finds a very high fraction of data leaks while keeping the rate of false positives low. On DroidBench, FlowDroid achieves 93% recall and 86% precision, greatly outperforming the commercial tools IBM AppScan Source and Fortify SCA. FlowDroid successfully finds leaks in a subset of 500 apps from Google Play and about 1,000 malware apps from the VirusShare project.

Protecting contacts against privacy leaks in smartphones

“…Static analysis-based approaches determine whether apps are malicious or benign, and consider the possibility of leakage of private data by analyzing the package files of apps without running them [21][22][23][24][25][26][27][28][29][30][31][32][33][34][35][36].…”

“…Yet another static approach based on a control flow graph (CFG) detects user privacy leaks through inter-component communication (ICC) [33][34][35]. A machine learning-based approach was recently proposed [36] that uses Extra-Trees, a machine learning algorithm to detect malicious apps regardless of code obfuscation.…”

A Practical Intent Fuzzing Tool for Robustness of Inter-Component Communication in Android Apps

“…The majority of the calls use a specific string key to extract extra data from Intents whereas data type itself is encoded in the name of the methods. This research also attempted to use Flowdroid [10] for static analysis on more precise Intent structure, but it reported that the simple CFG-based analysis mentioned previously is enough for Intent fuzz testing in terms of scalability and precision [5]. A set of Intents was generated afterward with the statically analyzed Intent structure information, target components were executed with these fuzzed Intents, and both code coverage and crashes due to exceptions were monitored.…”

“…A mark * in the table tells this difference. Both IntentFuzzer [5] and ICCFuzzer [7] have used FlowDroid [10] for backend of their own static analyzer, for example, to collect keys and types of extra data of Intent statically. ICCFuzzer [7] went one step more to collect event handler information in Activity and Service components potentially to trigger deeper execution of target Android components, which a mark † points out.…”

Verification of Android Applications

“…Since static analysis is very efficient at tracking data flow within an application, most of the static analysis tools for Android applications are focused on performing some kind of data flow analysis for example privacy leaks [7]- [9].…”