kirancodes.me
To Proof Maintenance & Beyond!
ASE 2015

String Analysis of Android Applications (N)

Justin Del Vecchio, Feng Shen, Kenny M. Yee, Boyu Wang, Steven Y. Ko, Lukasz Ziarek

DOI 10.1109/ase.2015.20dblp

Abstract

The desire to understand mobile applications has resulted in researchers adapting classical static analysis techniques to the mobile domain. Examination of data and control flows in Android apps is now a common practice to classify them. Important to these analyses is a fine-grained examination and understanding of strings, since in Android they are heavily used in intents, URLs, reflection, and content providers. Rigorous analysis of string creation, usage, and value characteristics offers additional information to increase precision of app classification. This paper shows that inter-procedural static analysis that specifically targets string construction and usage can be used to reveal valuable insights for classifying Android apps. To this end, we first present case studies to illustrate typical uses of strings in Android apps. We then present the results of our analysis on real-world malicious and benign apps. Our analysis examines how strings are created and used for URL objects, Java reflection, and Android intents, and infers the actual string values used as much as possible. Our results demonstrate that string disambiguation based on creation, usage, and value indeed provides additional information that may be used to improve precision of classifying application behaviors.

BibTeX
@inproceedings{Vecchio-al:ASE15,
  author    = {Justin Del Vecchio and
               Feng Shen and
               Kenny M. Yee and
               Boyu Wang and
               Steven Y. Ko and
               Lukasz Ziarek},
  title     = {String Analysis of Android Applications {(N)}},
  booktitle = {ASE},
  pages     = {680--685},
  publisher = {{IEEE} Computer Society},
  year      = {2015},
}

Related papers