Static Control-Flow Analysis of User-Driven Callbacks in Android Applications

Yang, Shengqian; Yan, Dacong; Wu, Haowei; Wang, Yan; Rountev, Atanas

doi:10.1109/icse.2015.31

Cited by 97 publications

(77 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another framework-related challenge consists of modelling event handler callbacks. While the order of callback invocations can be over-approximated via a non-deterministic model, a more precise solution has been proposed in the literature [16]. However, adopting such an approach for EviCheck could incur an additional cost exceeding the one of the core analysis itself.…”

Section: Technical Discussionmentioning

confidence: 99%

EviCheck: Digital Evidence for Android

Seghir

Aspinall

2015

Automated Technology for Verification and Analysis

View full text Add to dashboard Cite

Abstract. We present EviCheck, a tool for the verification, certification and generation of lightweight fine-grained security policies for Android. It applies static analysis to check the conformance between an application and a given policy. A distinguishing feature of EviCheck is its ability to generate digital evidence: a certificate for the analysis algorithm asserting the conformance between the application and the policy. This certificate can be independently checked by another component (tool) to validate or refute the result of the analysis. The checking process is generally very efficient compared to certificate generation as experiments on 20,000 realworld applications show.

show abstract

Section: Technical Discussionmentioning

confidence: 99%

EviCheck: Digital Evidence for Android

Seghir

Aspinall

2015

Automated Technology for Verification and Analysis

View full text Add to dashboard Cite

show abstract

“…Authors of recent approaches explicitly acknowledge such limitations, indicating that they ignore reflection in their approaches [14,16,44] or failing to state whether reflective calls are handled [45] in their approach.…”

Section: Related Workmentioning

confidence: 99%

DroidRA: taming reflection to support whole-program analysis of Android apps

Bissyandé

Octeau

et al. 2016

Proceedings of the 25th International Symposium on Software Testing and Analysis

130

View full text Add to dashboard Cite

Android developers heavily use reflection in their apps for legitimate reasons, but also significantly for hiding malicious actions. Unfortunately, current state-of-the-art static analysis tools for Android are challenged by the presence of reflective calls which they usually ignore. Thus, the results of their security analysis, e.g., for private data leaks, are inconsistent given the measures taken by malware writers to elude static detection. We propose the DroidRA instrumentationbased approach to address this issue in a non-invasive way. With DroidRA, we reduce the resolution of reflective calls to a composite constant propagation problem. We leverage the COAL solver to infer the values of reflection targets and app, and we eventually instrument this app to include the corresponding traditional Java call for each reflective call. Our approach allows to boost an app so that it can be immediately analyzable, including by such static analyzers that were not reflection-aware. We evaluate DroidRA on benchmark apps as well as on real-world apps, and demonstrate that it can allow state-of-the-art tools to provide more sound and complete analysis results.

show abstract

“…Using a similar approach, we can also construct an inter-callback ICFG to connect onStart and onCreate. Combining our solution with GUI-based control flow graph construction [28], [29], we can further sequence onStart and onStop and obtain a complete faulty path for the app. We leave this for future work.…”

Section: B Our Goalmentioning

confidence: 99%

“…Without considering API methods, we are unable to obtain all possible paths of callbacks for the apps. Due to its importance, previous studies have used manual approaches to model the control flow of callbacks in the Android API methods [28] [29] [25]. The challenges are that the Android framework evolves fast, and it contains more than 20,000 API methods.…”

mentioning

confidence: 99%

Generating Predicate Callback Summaries for the Android Framework

Perez

2017

2017 IEEE/ACM 4th International Conference on Mobile Software Engineering and Systems (MOBILESoft)

View full text Add to dashboard Cite

Abstract-One of the challenges of analyzing, testing and debugging Android apps is that the potential execution orders of callbacks are missing from the apps' source code. However, bugs, vulnerabilities and refactoring transformations have been found to be related to callback sequences. Existing work on control flow analysis of Android apps have mainly focused on analyzing GUI events. GUI events, although being a key part of determining control flow of Android apps, do not offer a complete picture. Our observation is that orthogonal to GUI events, the Android API calls also play an important role in determining the order of callbacks. In the past, such control flow information has been modeled manually. This paper presents a complementary solution of constructing program paths for Android apps. We proposed a specification technique, called Predicate Callback Summary (PCS), that represents the callback control flow information (including callback sequences as well as the conditions under which the callbacks are invoked) in Android API methods and developed static analysis techniques to automatically compute and apply such summaries to construct apps' callback sequences. Our experiments show that by applying PCSs, we are able to construct Android apps' control flow graphs, including inter-callback relations, and also to detect infeasible paths involving multiple callbacks. Such control flow information can help program analysis and testing tools to report more precise results. Our detailed experimental data is available at: goo.gl/NBPrKs

show abstract

Static Control-Flow Analysis of User-Driven Callbacks in Android Applications

Cited by 97 publications

References 26 publications

EviCheck: Digital Evidence for Android

EviCheck: Digital Evidence for Android

DroidRA: taming reflection to support whole-program analysis of Android apps

Generating Predicate Callback Summaries for the Android Framework

Contact Info

Product

Resources

About