EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework

22nd Annual Network and Distributed System Security Symposium, NDSS 2015

Volumn , Issue , 2015, Pages

  Cao, Yinzhi ^a   Fratantonio, Yanick ^b   Bianchi, Antonio ^b   Egele, Manuel ^c   Kruegel, Christopher ^b   Vigna, Giovanni ^b   Chen, Yan ^d  

^a Columbia University ^*  (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

^c BOSTON UNIVERSITY   (United States)

^d NORTHWESTERN UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANDROID (OPERATING SYSTEM); DATA FLOW ANALYSIS; FLOW GRAPHS; GRAPHIC METHODS; STATIC ANALYSIS;

ANALYSIS SYSTEM; ANALYSIS TOOLS; ANDROID APPLICATIONS; ART ANALYSIS; CONTROL-FLOW GRAPHS; FLOW TRANSITIONS; IMPLICIT CONTROL FLOW; RECENT RESEARCHES; SENSITIVE DATAS; STATE OF THE ART;

SENSITIVE DATA;

EID: 85180550562     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14722/ndss.2015.23140     Document Type: Conference Paper

References (31)

1. Android-apktool: a tool for reverse engineering Android APK files. https://code.google.com/p/android-apktool/.
2. Android Open Source Project (AOSP). https://source.android.com/.
3. Documentation related to the Activity component. http://developer.android.com/reference/android/app/Activity.html.
4. DroidBench. http://sseblog.ec-spride.de/tools/droidbench/.
5. UI/Application Exerciser Monkey. http://developer.android.com/tools/help/monkey.html.
6. Worldwide Smartphone Shipments Top One Billion Units for the First Time. https://www.idc.com/getdoc.jsp?containerId=prUS24645514.
7. K. Ali and O. Lhoták. Application-Only Call Graph Construction. In Proceedings of the 26th European Conference on Object-Oriented Programming (ECOOP), 2012.
8. D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, and K. Rieck. Drebin: Effective and Explainable Detection of Android Malware in Your Pocket. In Proceedings of the Annual Symposium on Network and Distributed System Security (NDSS), 2014.
9. S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. le Traon, D. Octeau, and P. McDaniel. FlowDroid: Precise Context, Flow, Field, Object-sensitive and Lifecycle-aware Taint Analysis for Android Apps. In Proceedings of the Annual ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), 2014.
10. K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie. PScout: analyzing the Android permission specification. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2012.
11. P. P. Chan, L. C. Hui, and S. M. Yiu. DroidChecker: Analyzing Android Applications for Capability Leak. In Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WISEC), 2012.
12. R. Cytron, J. Ferrante, B. K. Rosen, M. N. Wegman, and F. K. Zadeck. Efficiently Computing Static Single Assignment Form and the Control Dependence Graph. ACM Trans. Program. Lang. Syst., 13(4):451-490, Oct. 1991.
13. W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth. TaintDroid: an Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones. In Proceedings of the USENIX Conference on Operating Systems Design and Implementation (OSDI), 2010.
14. W. Enck, D. Octeau, P. McDaniel, and S. Chaudhuri. A Study of Android Application Security. In Proceedings of the USENIX Security Symposium, 2011.
15. W. Enck, M. Ongtang, and P. McDaniel. On Lightweight Mobile Phone Application Certification. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2009.
16. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2011.
17. A. P. Fuchs, A. Chaudhuri, and J. S. Foster. SCanDroid: Automated Security Certification of Android Applications. Technical Report, University of Maryland, 2009.
18. M. Grace, Y. Zhou, Z. Wang, and X. Jiang. Systematic Detection of Capability Leaks in Stock Android Smartphones. In Proceedings of the Annual Symposium on Network and Distributed System Security (NDSS), 2012.
19. M. Grace, Y. Zhou, Q. Zhang, S. Zou, and X. Jiang. RiskRanker: Scalable and Accurate Zero-day Android Malware Detection. In Proceedings of the International Conference on Mobile Systems, Applications, and Services (MobiSys), 2012.
20. C.-H. Hsiao, C. L. Pereira, J. Yu, G. a. Pokam, S. Narayanasamy, P. M. Chen, Z. Kong, and J. Flinn. Race Detection for Event-Driven Mobile Applications. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), 2014.
21. J. Jeon, K. K. Micinski, J. A. Vaughan, A. Fogel, N. Reddy, J. S. Foster, and T. Millstein. Dr. Android and Mr. Hide: Fine-Grained Permissions in Android Applications. In In Proceedings of The ACM Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM), 2012.
22. P. Lam, E. Bodden, O. Lhoták, and L. Hendren. The Soot Framework for Java Program Analysis: a Retrospective. In Cetus Users and Compiler Infrastructure Workshop, 2011.
23. L. Lu, Z. Li, Z. Wu, W. Lee, and G. Jiang. CHEX: Statically Vetting Android Apps for Component Hijacking Vulnerabilities. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2012.
24. M. Madsen, B. Livshits, and M. Fanning. Practical Static Analysis of JavaScript Applications in the Presence of Frameworks and Libraries. In Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering (ESEC/FSE), 2013.
25. C. W. Probst. Modular Control Flow Analysis for Libraries. In Proceedings of the International Symposium on Static Analysis (SAS), 2002.
26. S. Rasthofer, S. Arzt, and E. Bodden. A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks. In Proceedings of the Annual Symposium on Network and Distributed System Security Symposium (NDSS), 2014.
27. V. Rastogi, Y. Chen, and W. Enck. AppsPlayground: Automatic Security Analysis of Smartphone Applications. In Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY), pages 209-220, New York, NY, USA, 2013. ACM.
28. D. Yan, G. Xu, and A. Rountev. Rethinking Soot for Summary-Based Whole-Program Analysis. In Proceedings of the ACM SIGPLAN International Workshop on State of the Art in Java Program Analysis (SOAP), 2012.
29. W. Zhang and B. G. Ryder. Constructing Accurate Application Call Graphs For Java To Model Library Callbacks. In the IEEE International Workshop on Source Code Analysis and Manipulation (SCAM), 2006.
30. Y. Zhou and X. Jiang. Detecting Passive Content Leaks and Pollution in Android Applications. In Proceedings of the Annual Symposium on Network and Distributed System Security (NDSS), 2013.
31. Y. Zhou, Z. Wang, W. Zhou, and X. Jiang. Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets. In Proceedings of the Annual Symposium on Network and Distributed System Security (NDSS), 2012.