Reverse Engineering and Testing Service Life Cycles of Mobile Platforms

Franke, Dominik; Elsemann, Corinna; Kowalewski, Stefan

doi:10.1109/dexa.2012.40

Cited by 5 publications

(2 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Like activity, the Android-supplied service life cycle model omits some states and transitions between the states. We apply the above mentioned technique (also described in [23]) to reverse-engineer the service life cycle model. Static and transient states are used to model the service life cycle as shown in Figure 6.…”

Section: The Reverse-engineered Service Life Cycle Modelmentioning

confidence: 99%

“…In the realm of application life cycle models, Franke et al [18,23] use same technique as discussed above to perform reverse-engineering on Android, iOS and Java ME applications. Their activity life cycle model developed for Android 2.2-a pre-Honeycomb version-contains some flows between the callbacks which do not occur in the Android's post-Honeycomb versions.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Dexteroid: Detecting malicious behaviors in Android apps using reverse-engineered life cycle models

Junaid

Liu

Kung

2016

Computers & Security

View full text Add to dashboard Cite

The amount of Android malware has increased greatly during the last few years. Static analysis is widely used in detecting such malware by analyzing the code without execution. The effectiveness of current tools relies on the app model as well as the malware detection algorithm which analyzes the app model. If the model and/or the algorithm is inadequate, then sophisticated attacks that are triggered by specific sequences of events will not be detected.This paper presents a static analysis framework called Dexteroid, which uses reverseengineered life cycle models to accurately capture the behaviors of Android components. Dexteroid systematically derives event sequences from the models, and uses them to detect attacks launched by specific ordering of events. A prototype implementation of Dexteroid detects two types of attacks: (1) leakage of private information, and (2) sending SMS to premium-rate numbers. A series of experiments are conducted on 1526 Google Play apps, 1259 Genome Malware apps, and a suite of benchmark apps called DroidBench and the results are compared with a state-of-the-art static analysis tool called FlowDroid. The evaluation results show that the proposed framework is effective and efficient in terms of precision, recall, and execution time.

show abstract

Section: The Reverse-engineered Service Life Cycle Modelmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%