VAnDroid: A framework for vulnerability analysis of Android applications using a model‐driven reverse engineering technique

Abstract

Summary Android is extensively used worldwide by mobile application developers. Android provides applications with a message passing system to communicate within and between them. Due to the risks associated with this system, it is vital to detect its unsafe operations and potential vulnerabilities. To achieve this goal, a new framework, called VAnDroid, based on Model Driven Reverse Engineering (MDRE), is presented that identifies security risks and vulnerabilities related to the Android application communication model. In the proposed framework, some security‐related information included in an Android app is automatically extracted and represented as a domain‐specific model. Then, it is used for analyzing security configurations and identifying vulnerabilities in the corresponding application. The proposed framework is implemented as an Eclipse‐based tool, which automatically identifies the Intent Spoofing and Unauthorized Intent Receipt as two attacks related to the Android application communication model. To evaluate the tool, it has been applied to several real‐world Android applications, including 20 apps from Google Play and 110 apps from the F‐Droid repository. VAnDroid is also compared with several existing analysis tools, and it is shown that it has a number of key advantages over those tools specifically regarding its high correctness, scalability, and usability in discovering vulnerabilities. The results well indicate the effectiveness and capacity of the VAnDroid as a promising approach in the field of Android security.

Utilizando Metadados de Aplicações e Comunicação entre Processos para Identificar Ameaças no Android

“…Sua desvantagem é a possibilidade dos aplicativos maliciosos esconderem a sua real atividade no arquivo executável através de técnicas de ofuscação, como códigos cifrados, geração de código em tempo de execução, etc. Esse tipo de comportamento só pode ser detectado na análise dinâmica em tempo de execução [Nirumand et al 2018].…”

Reversely Discovering and Modifying Properties Based on Active Deep Q-Learning

“…J. Qiu [16] proposed a light-weight solution to automatically identify the Android malicious samples with high security and privacy impact. Nirumand [17] presented a framework based on Model Driven Reverse Engineering. In the proposed framework, some security-related information included in an Android app is automatically extracted and represented as a domain-specific model.…”

Android application behavioural analysis for data leakage

“…It can also distinguish high-level malware and identify high-risk malware. In contrast, regarding dynamic investigations, fundamental discovery and analysis are performed at runtime (Li et al, 2018;Navarro, Navarro, Grégio, Rocha, & Dahab, 2018;Nirumand, Zamani, & Tork 1 depicts the scenario for problem identification where a user unintentionally gives additional permissions to the android application, which makes the device vulnerable to security attacks.…”

“…It can also distinguish high‐level malware and identify high‐risk malware. In contrast, regarding dynamic investigations, fundamental discovery and analysis are performed at runtime (Li et al, 2018; Navarro, Navarro, Grégio, Rocha, & Dahab, 2018; Nirumand, Zamani, & Tork Ladani, 2019; Sharma & Gupta, 2019; Tam, Feizollah, Anuar, Salleh, & Cavallaro, 2017).…”