Abstract
Privacy and security flaws in apps are commonly detected by static and dynamic analysis approaches. However, the realistic impact rating for detected flaws is often limited. Static approaches lack runtime information and dynamic analysis miss program structure information. We aim to build a dynamic analysis environment and rate the flaw impact based on the data flow context. We correlate the traced API call chains with data sources and sinks of processed information. This way, the actual runtime information is used and program structures for significant data flows can be reconstructed. Therefore, this publication proposes a method for collecting execution traces based on automated function hooking and mechanisms to create and analyze data flow graphs from these traces. We demonstrate the scalability of our privacy and security analysis by automatically analyzing and evaluating the top 1000 free apps from Google Play. Manual app analysis and damn vulnerable app projects prove the high quality results of our automated approach during evaluation.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have