Taming break points: essential steps toward whole-program analysis of android apps

Picture of xiaoyu-sun.md Xiaoyu Sun

23 Aug 2023

We are seeking highly motivated Honours/Master students to work on a project to investigate the break points in call graphs when performing program analysis on Android apps. Opportunity for a further PhD study is possible depending on student’s performance in this project.

Background

Android developers heavily use reflection calls/native code in their apps for legitimate reasons. However, the adoption of these language features is also significantly used for hiding malicious actions. Unfortunately, current state-of-the-art static analysis tools for Android are challenged by the presence of such language features which they usually ignore. Thus, the results of their security analysis, e.g., for private data leaks, are incomplete, given the measures taken by malware writers to elude static detection.

To address this research gap, we plan to propose a new instrumentation-based approach to address this issue in a non-invasive way. Firstly, efforts should be directed towards understanding the root causes that lead to “break points” during program analysis. Additionally, we intend to develop automated tools for rectifying these break points by constructing a unified call graph of all code within Android apps. Our prospective approach need to augment the original app so that it can be more effectively statically analyzable, including by such static analyzers that are not reflection-aware or native-aware. Furthermore, new benchmark apps should be designed based on the identified break point findings. Subsequently, we will evaluate our tool on these benchmark apps, as well as on real-world apps, to provide comprehensive analysis results.

Requirements

The project requires a strong interest and background in software engineering and program analysis. Experience with Java programming is highly desirable.

Background Literature

Xiaoyu Sun, Li Li, Tegawendé F. Bissyandé, Jacques Klein, Damien Octeau, and John Grundy, Taming reflection: An essential step toward whole-program analysis of android apps, ACM Transactions on Software Engineering and Methodology (TOSEM) 2021. 2021

Jordan Samhi, Jun Gao, Nadia Daoudi, Pierre Graux, Henri Hoyez, Xiaoyu Sun, Kevin Allix, Tegawendé F. Bissyandé and Jacques Klein, JuCify: a step towards Android code unification for enhanced static analysis, Proceedings of the 44th International Conference on Software Engineering (ICSE 2022), 2022 

Contact

xiaoyu.sun1@anu.edu.au

You are on Aboriginal land.

The Australian National University acknowledges, celebrates and pays our respects to the Ngunnawal and Ngambri people of the Canberra region and to all First Nations Australians on whose traditional lands we meet and work, and whose cultures are among the oldest continuing cultures in human history.

arrow-left bars search times arrow-up