Static analysis of android apps: A systematic literature review

Abstract

Context: Static analysis approaches have been proposed to assess the security of Android apps, by searching for known vulnerabilities or actual malicious code. The literature thus has proposed a large body of works, each of which attempts to tackle one or more of the several challenges that program analyzers face when dealing with Android apps.Objective: We aim to provide a clear view of the state-of-the-art works that statically analyze Android apps, from which we highlight the trends of static analysis approaches, pinpoint where the focus has been put and enumerate the key aspects where future researches are still needed.Method: We have performed a systematic literature review which involves studying around 90 research papers published in software engineering, programming languages and security venues. This review is performed mainly in five dimensions: problems targeted by the approach, fundamental techniques used by authors, static analysis sensitivities considered, android characteristics taken into account and the scale of evaluation performed.Results: Our in-depth examination have led to several key findings: 1) Static analysis is largely performed to uncover security and privacy issues; 2) The Soot framework and the Jimple intermediate representation are the most adopted basic support tool and format, respectively; 3) Taint analysis remains the most applied technique in research approaches; 4) Most approaches support several analysis sensitivities, but very few approaches consider path-sensitivity; 5) There is no single work that has been proposed to tackle all challenges of static analysis that are related to Android programming; and 6) Only a small portion of state-of-the-art works have made their artifacts publicly available.Conclusion: The research community is still facing a number of challenges for building approaches that are aware altogether of implicit-Flows, dynamic code loading features, reflective calls, native code and multi-threading, in order to implement sound and highly precise static analyzers.

DroidRA: taming reflection to support whole-program analysis of Android apps

“…To that end, based on the motivation example and our study of reflective call patterns, we observe that the reflection problem can be modeled as a constant propagation 5 The format of an apk is actually a compressed ZIP archive.…”

“…In particular, reflection can be used to hide the real purpose, e.g., by invoking a method at runtime to escape static scanning, or simply to deliver malicious code [4]. We have conducted a quick review of recent contributions on static analysis-based approaches for Android, and have found that over 90% of around 90 publications [5] from top conferences (including ICSE and ISSTA) do not tackle reflection. Indeed, most state-of-the-art approaches and tools for static analysis of Android simply ignore the use of reflection [6,7] or may treat it partially [8,9].…”

Mining families of android applications for extractive SPL adoption

“…Our visions aims to bring the Android research community to topics specific to SPLE. The research field on malware detection is creating advanced and scalable methods for mining app markets [12]. Their objective is to heuristically define if a legitimate app has a malware counterpart signed with another certificate.…”

SimiDroid: Identifying and Explaining Similarities in Android Apps

“…Unfortunately, the state-of-the-art on repackaged/clone app detection builds on internal heuristics are tedious to replicate, while the associated prototype tools are not available for furthering research in these directions [5]. Most of repackaged app detection works [3], [6] indeed do not come with reusable tools for the research community.…”