A Novel Hybrid Method to Analyze Security Vulnerabilities in Android Applications

• 作者: Junwei Tang Kaipeng Wang Ruixuan Li Xiwu Gu Zhiyong Xu
• 来源期刊: 清华大学学报自然科学版（英文版）
• 年，卷（期）: 2020,（5）
• 页码范围: 589-603
• 页数: 15页
• 语种: 英文
• DOI: 10.26599/TST.2019.9010067

摘要

We propose a novel hybrid method to analyze the security vulnerabilities in Android applications.Our method combines static analysis,which consists of metadata and data flow analyses with dynamic analysis,which includes dynamic executable scripts and application program interface hooks.Our hybrid method can effectively analyze nine major categories of important security vulnerabilities in Android applications.We design dynamic executable scripts that record and perform manual operations to customize the execution path of the target application.Our dynamic executable scripts can replace most manual operations,simplify the analysis process,and further verify the corresponding security vulnerabilities.We successfully statically analyze 5547 malwares in Drebin and 10151 real-world applications.The average analysis time of each application in Drebin is 4.52 s,whereas it reaches 92.02 s for real-word applications.Our system can detect all the labeled vulnerabilities among 56 labeled applications.Further dynamic verification shows that our static analysis accuracy approximates 95％ for real-world applications.Experiments show that our dynamic analysis can effectively detect the vulnerability named input unverified,which is difficult to be detected by other methods.In addition,our dynamic analysis can be extended to detect more types of vulnerabilities.

作者信息

序号	姓名	单位	发文数	被引次数	H指数	G指数
1	Junwei Tang		1	0	0.0	0.0
2	Ruixuan Li		1	0	0.0	0.0
3	Kaipeng Wang		1	0	0.0	0.0
4	Xiwu Gu		1	0	0.0	0.0
5	Zhiyong Xu		1	0	0.0	0.0